@mergelight/cli 0.0.0-stage → 0.1.14

package/dist/publish/publish.js

@@ -0,0 +1,367 @@
+import { GitHub } from "./api.js";
+import { commentableLines, place } from "./diff-lines.js";
+import { closedBody, readClosed, reopenedBody, resolvedByPeople, threadAction, threadFinding } from "./closed.js";
+import { failedSummaryBody, FINDING_MARKER_RE, headline, inlineBody, isFailedSummary, isPendingSummary, LIGHT, pendingSummaryBody, SUMMARY_MARKER, summaryBody } from "./markdown.js";
+import { readMarks, trustedComment, writeAccess } from "./handled.js";
+import { decodeState, nextState } from "./state.js";
+import { newerVersion } from "../update.js";
+export { trustedComment } from "./handled.js";
+export const CHECK_NAME = "Mergelight";
+/**
+ * How each merge light shows up as a GitHub check. Yellow is neutral, which
+ * GitHub counts as passing: a solo developer can't approve their own PR, so
+ * yellow must not wait for an approval unless a team asks for that. Then it's
+ * action_required, which doesn't pass until someone approves (see approveCheck).
+ */
+export function checkConclusion(light, yellowBlocks = false) {
+    if (light === "green")
+        return "success";
+    if (light === "red")
+        return "failure";
+    return yellowBlocks ? "action_required" : "neutral";
+}
+/**
+ * The summary comment, which Mergelight edits and reads its state from. Only a bot's comment or the
+ * current login's own counts. A person's association isn't enough: a teammate who wrote the marker
+ * could edit the comment later, and change a login code people are told to enter.
+ */
+export async function ownSummary(comments, viewer) {
+    const marked = comments.filter((c) => c.body?.includes(SUMMARY_MARKER));
+    const bots = marked.find((c) => c.user?.type === "Bot");
+    if (bots || !marked.length)
+        return bots;
+    const me = await viewer();
+    return me ? marked.find((c) => c.user?.login === me) : undefined;
+}
+/** What Mergelight has on this PR so far. Reviews read it before they publish, and the MCP server hands it to agents. */
+export async function readPrReviewState(api, number) {
+    const issueComments = await api.list(`issues/${number}/comments`);
+    const reviewComments = await api.list(`pulls/${number}/comments`);
+    const summary = await ownSummary(issueComments, () => api.viewer());
+    const marks = await readMarks([...issueComments, ...reviewComments], writeAccess(api));
+    return { summary, state: decodeState(summary?.body), marks, reviewComments };
+}
+const MAX_PREVIOUS = 40;
+/** What earlier rounds found on this PR, latest first, for the verifier to check again. */
+export async function previousFindings(api, number) {
+    const { state, marks } = await readPrReviewState(api, number);
+    const resolved = await resolvedByPeople(await reviewThreads(api, number).catch(() => []), writeAccess(api));
+    // A decision not to fix must reach the verifier however long the list gets, or the problem comes back as new.
+    const order = (f) => (marks.get(f.id)?.as === "wont_fix" || resolved.has(f.id) ? 0 : f.status === "gone" ? 2 : 1);
+    return (state?.findings ?? [])
+        .sort((a, b) => order(a) - order(b))
+        .slice(0, MAX_PREVIOUS)
+        .map(({ id, title, file, line, end_line, how }) => {
+        const mark = marks.get(id);
+        const by = resolved.get(id);
+        const handled = mark
+            ? { as: mark.as, note: mark.note, by: mark.by, sha: mark.sha }
+            : by
+                ? { as: "wont_fix", note: "Resolved the comment on the pull request.", by, sha: null }
+                : undefined;
+        return { id, title, file, line, end_line, how, ...(handled ? { handled } : {}) };
+    });
+}
+export const CHECK_FAILED_TITLE = "Couldn't review this pull request";
+export const checkLoginTitle = (plan) => `The ${plan} login didn't work`;
+export const checkLimitTitle = (plan) => `${CHECK_FAILED_TITLE}: your ${plan} plan hit its limit`;
+export const isFailedCheckTitle = (title) => Boolean(title && (title.startsWith(CHECK_FAILED_TITLE) || /^The \w+ login didn't work$/.test(title)));
+/**
+ * Creates the check, or updates it if it has an id. GitHub only lets Apps write
+ * checks, so a personal `gh` login gets a 403 on any repository. That doesn't sink
+ * a review, since the comments carry it. Every other error still throws.
+ */
+export async function writeCheck(api, id, headSha, body, log) {
+    try {
+        if (id)
+            return await api.write("PATCH", `check-runs/${id}`, body);
+        return await api.write("POST", "check-runs", { name: CHECK_NAME, head_sha: headSha, ...body });
+    }
+    catch (err) {
+        if (!/must authenticate via a GitHub App/i.test(err.message))
+            throw err;
+        log?.("Skipped the Mergelight check: GitHub only lets a GitHub App write checks, not a personal gh login.");
+        return null;
+    }
+}
+/**
+ * Shows a live "Reviewing" check right away, so people and agents can see work is
+ * happening. A login that can't write checks hears about it once, from the last write.
+ */
+export async function startCheck(api, headSha) {
+    const run = await writeCheck(api, null, headSha, {
+        status: "in_progress",
+        started_at: new Date().toISOString(),
+        output: {
+            title: "Reviewing",
+            summary: "Mergelight is reviewing this pull request with Codex on your own plan. This usually takes 2 to 15 minutes.",
+        },
+    });
+    return run?.id ?? null;
+}
+/** Puts the summary comment on the PR before anything else, so it comes first. Later rounds edit it in place. */
+export async function startSummary(api, number) {
+    const { summary } = await readPrReviewState(api, number);
+    return summary ?? (await api.write("POST", `issues/${number}/comments`, { body: pendingSummaryBody() }));
+}
+/** A first review that couldn't run shouldn't say "Reviewing" forever, and an older failure shouldn't outlive a newer reason. Real results stay. */
+export async function failSummary(api, number, notice) {
+    const { summary } = await readPrReviewState(api, number);
+    if (summary && (isPendingSummary(summary.body) || isFailedSummary(summary.body)))
+        await api.write("PATCH", `issues/comments/${summary.id}`, { body: failedSummaryBody(notice) });
+}
+/**
+ * A review that couldn't run ends neutral, so a broken login doesn't block
+ * merging. The workflow job itself still fails, so it's visible.
+ */
+export async function failCheck(api, checkRunId, headSha, reason, log, title = CHECK_FAILED_TITLE) {
+    await writeCheck(api, checkRunId, headSha, {
+        status: "completed",
+        conclusion: "neutral",
+        completed_at: new Date().toISOString(),
+        output: {
+            title,
+            summary: `${reason.slice(0, 2000)}\n\nThis check is neutral so a broken review doesn't block merging. The workflow log has the details.`,
+        },
+    }, log);
+}
+export async function publishReview(review, opts = {}) {
+    const log = opts.log ?? (() => { });
+    const api = new GitHub(review.pr.owner, review.pr.repo, opts);
+    const n = review.pr.number;
+    // What's already on the PR: the summary comment with last round's state, and inline findings.
+    const { summary: existing, state: prev, marks, reviewComments } = await readPrReviewState(api, n);
+    // The summary goes up before the inline comments, so it stays on top of them.
+    const summary = existing ?? (await api.write("POST", `issues/${n}/comments`, { body: pendingSummaryBody() }));
+    const urls = new Map();
+    for (const c of reviewComments) {
+        if (!trustedComment(c))
+            continue;
+        const id = c.body.match(FINDING_MARKER_RE)?.[1];
+        if (id && !urls.has(id))
+            urls.set(id, c.html_url);
+    }
+    // New top picks go inline, if their lines are in the diff. A finding from an earlier
+    // round stays where it is, even if the verifier ranks it higher now: the reader has
+    // seen it, and a new comment on old code is just more noise.
+    const lines = await commentableLines(api, n);
+    const seen = new Set(prev?.findings.map((f) => f.id));
+    const fresh = review.findings.filter((f) => f.tier === "post" && !urls.has(f.id) && !seen.has(f.id));
+    const inline = [];
+    const outside = [];
+    for (const f of fresh) {
+        const at = place(lines, f.file, f.line, f.end_line);
+        if (!at) {
+            outside.push(f);
+            continue;
+        }
+        inline.push({
+            f,
+            comment: {
+                path: f.file,
+                side: "RIGHT",
+                line: at.line,
+                ...(at.start_line ? { start_line: at.start_line, start_side: "RIGHT" } : {}),
+                body: inlineBody(f),
+            },
+        });
+    }
+    if (inline.length) {
+        const body = {
+            commit_id: review.pr.head_sha,
+            event: "COMMENT",
+            comments: inline.map((i) => i.comment),
+        };
+        try {
+            const posted = await api.write("POST", `pulls/${n}/reviews`, body);
+            if (posted) {
+                for (const c of await api.list(`pulls/${n}/reviews/${posted.id}/comments`)) {
+                    const id = c.body.match(FINDING_MARKER_RE)?.[1];
+                    if (id)
+                        urls.set(id, c.html_url);
+                }
+            }
+        }
+        catch (err) {
+            // One line GitHub won't take rejects the whole review. List them in the summary instead.
+            log(`Inline review rejected, listing findings in the summary instead: ${err.message}`);
+            outside.push(...inline.map((i) => i.f));
+            inline.length = 0;
+        }
+    }
+    const { handled, resolved } = await settleThreads(api, review, log);
+    const state = nextState(prev, review.findings, review.pr.head_sha, review.light, urls);
+    const summaryInput = { review, state, urls, marks, handled, update: await newerVersion(api) };
+    const commentBody = summaryBody(summaryInput);
+    let summaryUrl = summary?.html_url ?? null;
+    if (summary) {
+        await api.write("PATCH", `issues/comments/${summary.id}`, { body: commentBody });
+    }
+    else {
+        const created = await api.write("POST", `issues/${n}/comments`, { body: commentBody });
+        summaryUrl = created?.html_url ?? null;
+    }
+    const light = LIGHT[review.light];
+    const check = {
+        status: "completed",
+        conclusion: checkConclusion(review.light, opts.yellowBlocks),
+        completed_at: new Date().toISOString(),
+        ...(summaryUrl ? { details_url: summaryUrl } : {}),
+        output: {
+            title: `${light.dot} ${light.label}: ${headline(review, handled.size)}`,
+            summary: summaryBody(summaryInput, false).replace(SUMMARY_MARKER, "").slice(0, 65_000),
+        },
+    };
+    await writeCheck(api, opts.checkRunId, review.pr.head_sha, check, log);
+    await syncApproval(api, n, review.light, review.pr.head_sha, log);
+    return { summaryUrl, inline: inline.length, outside: outside.length, resolved, light: review.light };
+}
+export const APPROVAL_MARKER = "<!-- mergelight:approval -->";
+/** Only these post Mergelight's reviews, so a person's review that quotes the marker is never touched. */
+const OWN_REVIEWERS = new Set(["mergelight-ai[bot]", "github-actions[bot]"]);
+/**
+ * Green approves the pull request, like a reviewer would. Anything else takes back an approval Mergelight gave
+ * earlier, so an old approval can't stand next to a newer finding. Yellow and red never request changes, so a
+ * review from Mergelight never blocks a merge by itself. Failures only log: the check already carries the result.
+ */
+export async function syncApproval(api, number, light, headSha, log = () => { }) {
+    try {
+        const ours = (await api.list(`pulls/${number}/reviews`)).filter((r) => OWN_REVIEWERS.has(r.user?.login ?? "") && (r.body ?? "").includes(APPROVAL_MARKER));
+        const standing = ours.filter((r) => r.state === "APPROVED");
+        if (light === "green") {
+            if (standing.some((r) => r.commit_id === headSha))
+                return "already";
+            await api.write("POST", `pulls/${number}/reviews`, {
+                commit_id: headSha,
+                event: "APPROVE",
+                body: `${APPROVAL_MARKER}\n🟢 Mergelight found nothing that needs fixing in this commit.`,
+            });
+            return "approved";
+        }
+        for (const r of standing) {
+            await api.write("PUT", `pulls/${number}/reviews/${r.id}/dismissals`, { message: "A newer Mergelight review found something to look at.", event: "DISMISS" });
+        }
+        return standing.length ? "dismissed" : "none";
+    }
+    catch (err) {
+        log(`Couldn't update Mergelight's approval: ${err instanceof Error ? err.message : String(err)}`);
+        return "none";
+    }
+}
+export async function reviewThreads(api, number) {
+    const data = await api.graphql(`query($owner: String!, $repo: String!, $number: Int!) {
+      repository(owner: $owner, name: $repo) {
+        pullRequest(number: $number) {
+          reviewThreads(first: 100) {
+            nodes { id isResolved isOutdated resolvedBy { login } comments(first: 50) { nodes { databaseId body authorAssociation author { __typename } } } }
+          }
+        }
+      }
+    }`, { owner: api.owner, repo: api.repo, number });
+    return data?.repository.pullRequest.reviewThreads.nodes ?? [];
+}
+export const resolveThread = (api, id) => api.graphql(`mutation($id: ID!) { resolveReviewThread(input: { threadId: $id }) { thread { id } } }`, { id }, true);
+const unresolveThread = (api, id) => api.graphql(`mutation($id: ID!) { unresolveReviewThread(input: { threadId: $id }) { thread { id } } }`, { id }, true);
+/**
+ * Brings inline comments in line with the threads: fixed or resolved ones get a
+ * checkmark and a dropdown, and reopened or returning ones go back to the
+ * original. Returns what counts as handled now, for the summary.
+ */
+async function settleThreads(api, review, log) {
+    const handled = new Map();
+    let resolved = 0;
+    let threads;
+    try {
+        threads = await reviewThreads(api, review.pr.number);
+    }
+    catch (err) {
+        log(`Couldn't read review threads: ${err.message}`);
+        return { handled, resolved };
+    }
+    const open = new Set(review.findings.map((f) => f.id));
+    const sha = review.pr.head_sha.slice(0, 7);
+    const canWrite = writeAccess(api);
+    const edit = (commentId, body) => api.write("PATCH", `pulls/comments/${commentId}`, { body }).catch((err) => log(`Couldn't update a comment: ${err.message}`));
+    for (const t of threads) {
+        const found = threadFinding(t);
+        if (!found)
+            continue;
+        const by = t.resolvedBy?.login ?? null;
+        const action = threadAction(t, open);
+        if (!action) {
+            const was = readClosed(found.body);
+            if (was)
+                handled.set(found.id, { how: was.how, by, sha: was.sha });
+            continue;
+        }
+        if (action.kind === "fixed") {
+            let isResolved = !action.resolve;
+            if (action.resolve) {
+                try {
+                    await resolveThread(api, t.id);
+                    isResolved = true;
+                    resolved++;
+                }
+                catch (err) {
+                    // GitHub only lets a workflow token resolve threads with contents: write. The comment still says it's handled.
+                    const hint = /not accessible by integration/i.test(err.message) ? "the workflow needs contents: write for that" : err.message;
+                    log(`Couldn't mark a fixed thread resolved: ${hint}`);
+                }
+            }
+            handled.set(found.id, { how: "fixed", sha });
+            await edit(found.commentId, closedBody(found.body, { how: "fixed", resolved: isResolved, sha }));
+        }
+        else if (action.kind === "resolved") {
+            // A workflow token sees a private org member as CONTRIBUTOR, so ask who can write instead of trusting the association.
+            if (!by || !(await canWrite(by)))
+                continue;
+            handled.set(found.id, { how: "resolved", by });
+            await edit(found.commentId, closedBody(found.body, { how: "resolved", resolved: true, by }));
+        }
+        else {
+            if (action.kind === "regressed" && action.unresolve) {
+                await unresolveThread(api, t.id).catch((err) => log(`Couldn't reopen a thread: ${err.message}`));
+            }
+            await edit(found.commentId, reopenedBody(found.body, action.kind === "reopened"));
+        }
+    }
+    return { handled, resolved };
+}
+/** A yellow check. A review that couldn't run also ends neutral, but an approval says nothing about that. */
+export function isYellowCheck(check) {
+    return check.conclusion === "action_required" || (check.conclusion === "neutral" && Boolean(check.output.title?.startsWith(LIGHT.yellow.dot)));
+}
+/** The newest Mergelight check on a commit. */
+export async function latestCheck(api, sha) {
+    const runs = await api.get(`commits/${sha}/check-runs?check_name=${CHECK_NAME}`);
+    return [...runs.check_runs].sort((a, b) => b.id - a.id)[0];
+}
+/** When someone approves a PR with a yellow check, it turns green. A blocked check (a bug to fix) stays red. */
+export async function approveCheck(api, number, by) {
+    const pr = await api.get(`pulls/${number}`);
+    const latest = await latestCheck(api, pr.head.sha);
+    if (!latest)
+        return "No Mergelight check on this commit.";
+    if (!isYellowCheck(latest))
+        return `Mergelight check is ${latest.conclusion ?? "still running"}, nothing to approve.`;
+    const body = {
+        conclusion: "success",
+        output: {
+            title: `🟢 Approved by ${by}`,
+            summary: `Approved by ${by} after the Mergelight review.\n\n${latest.output.summary ?? ""}`.slice(0, 65_000),
+        },
+    };
+    try {
+        await api.write("PATCH", `check-runs/${latest.id}`, body);
+    }
+    catch {
+        await api.write("POST", "check-runs", {
+            name: CHECK_NAME,
+            head_sha: pr.head.sha,
+            status: "completed",
+            completed_at: new Date().toISOString(),
+            ...body,
+        });
+    }
+    return `Mergelight check approved by ${by}.`;
+}

package/dist/publish/state.js

@@ -0,0 +1,82 @@
+import { gunzipSync, gzipSync } from "node:zlib";
+const MARKER = "mergelight:state:v1";
+/** State shares a comment with the summary, and GitHub caps a comment at 65,536 characters. */
+const MAX_STATE = 40_000;
+const pack = (state) => `<!-- ${MARKER} ${gzipSync(JSON.stringify(state)).toString("base64")} -->`;
+function withoutDetails(f) {
+    const { likelihood: _l, what_breaks: _w, fix: _f, fix_cost: _c, verdict: _v, rank: _r, ...rest } = f;
+    return rest;
+}
+function withoutHow(f) {
+    const { how: _, ...rest } = withoutDetails(f);
+    return rest;
+}
+/** Past any real review the details go first: a comment GitHub refuses would lose the whole round. */
+export function encodeState(state) {
+    const packed = pack(state);
+    if (packed.length <= MAX_STATE)
+        return packed;
+    const slimmer = pack({ ...state, findings: state.findings.map(withoutDetails) });
+    return slimmer.length <= MAX_STATE ? slimmer : pack({ ...state, findings: state.findings.map(withoutHow) });
+}
+/** The encoded state exactly as it sits in a comment, to carry over into a new body. */
+export function stateBlock(body) {
+    return body?.match(new RegExp(`<!-- ${MARKER} [A-Za-z0-9+/=]+ -->`))?.[0] ?? null;
+}
+export function decodeState(body) {
+    const m = body?.match(new RegExp(`<!-- ${MARKER} ([A-Za-z0-9+/=]+) -->`));
+    if (!m)
+        return null;
+    try {
+        const raw = Buffer.from(m[1], "base64");
+        // Reviews from before the state was gzipped are plain base64 JSON.
+        const json = raw[0] === 0x1f && raw[1] === 0x8b ? gunzipSync(raw, { maxOutputLength: 5_000_000 }) : raw;
+        const state = JSON.parse(json.toString("utf8"));
+        return state.v === 1 ? state : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Merge this review into the previous state. */
+export function nextState(prev, findings, sha, light, urls) {
+    const round = (prev?.round ?? 0) + 1;
+    const current = new Set(findings.map((f) => f.id));
+    const before = new Map((prev?.findings ?? []).map((f) => [f.id, f]));
+    const merged = findings.map((f) => {
+        const url = urls.get(f.id) ?? before.get(f.id)?.url;
+        return {
+            id: f.id,
+            tier: f.tier,
+            class: f.class,
+            severity: f.severity,
+            title: f.title,
+            file: f.file,
+            line: f.line,
+            end_line: f.end_line,
+            how: f.how_it_happens,
+            likelihood: f.likelihood,
+            what_breaks: f.what_breaks,
+            fix: f.fix,
+            fix_cost: f.fix_cost,
+            verdict: f.verdict,
+            rank: f.rank ?? null,
+            first_round: before.get(f.id)?.first_round ?? round,
+            status: "open",
+            ...(url ? { url } : {}),
+        };
+    });
+    for (const old of prev?.findings ?? []) {
+        if (!current.has(old.id))
+            merged.push({ ...withoutDetails(old), status: "gone" });
+    }
+    return {
+        v: 1,
+        round,
+        rounds: [
+            ...(prev?.rounds ?? []).slice(-19),
+            { sha, at: new Date().toISOString(), light, posted: findings.filter((f) => f.tier === "post").length },
+        ],
+        findings: merged,
+    };
+}

package/dist/render.js

@@ -0,0 +1,106 @@
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code) => (s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : s);
+const bold = paint("1");
+const dim = paint("2");
+const red = paint("31");
+const yellow = paint("33");
+const green = paint("32");
+const LIGHT = {
+    red: { dot: "🔴", label: "Blocked", color: red },
+    yellow: { dot: "🟡", label: "Needs a human", color: yellow },
+    green: { dot: "🟢", label: "Safe to merge", color: green },
+};
+function duration(ms) {
+    const s = Math.round(ms / 1000);
+    return s >= 60 ? `${Math.floor(s / 60)}m${String(s % 60).padStart(2, "0")}s` : `${s}s`;
+}
+function wrap(text, indent, width = 92) {
+    const words = text.replace(/\s+/g, " ").trim().split(" ");
+    const lines = [];
+    let line = "";
+    for (const w of words) {
+        if (line && (indent.length + line.length + 1 + w.length) > width) {
+            lines.push(line);
+            line = w;
+        }
+        else {
+            line = line ? `${line} ${w}` : w;
+        }
+    }
+    if (line)
+        lines.push(line);
+    return lines.map((l, i) => (i === 0 ? l : indent + l)).join("\n");
+}
+function where(f) {
+    return f.end_line > f.line ? `${f.file}:${f.line}-${f.end_line}` : `${f.file}:${f.line}`;
+}
+function full(f, dot, label) {
+    const pad = "            ";
+    return [
+        `${dot} ${bold(label)}  ${bold(f.title)}`,
+        `   ${dim(where(f))}  ${dim(`${f.likelihood} · ${f.severity} · fix ${f.fix_cost}`)}`,
+        `   How     ${wrap(f.how_it_happens, pad)}`,
+        `   Breaks  ${wrap(f.what_breaks, pad)}`,
+        `   Fix     ${wrap(f.fix, pad)}`,
+        `   ${bold(`→ ${f.verdict}`)}`,
+    ].join("\n");
+}
+function kind(f) {
+    if (f.class === "bug")
+        return f.severity === "minor" ? { dot: "🟠", label: "Minor bug" } : { dot: "🔴", label: "Bug" };
+    if (f.class === "risk")
+        return { dot: "🟡", label: "Risk" };
+    return { dot: "⚪", label: "Small fix" };
+}
+export function renderTerminal(r) {
+    const light = LIGHT[r.light];
+    // Top picks first, most important first. Older reviews without picks post everything marked post.
+    const posted = r.findings.filter((f) => f.tier === "post").sort((a, b) => (a.rank ?? 9) - (b.rank ?? 9));
+    const listed = r.findings.filter((f) => f.tier === "list");
+    const decisions = r.findings.filter((f) => f.tier === "decision");
+    const hardening = r.findings.filter((f) => f.tier === "hardening");
+    const counts = [
+        `${posted.length} to fix first`,
+        `${listed.length} more worth fixing`,
+        `${decisions.length} decision${decisions.length === 1 ? "" : "s"}`,
+        `${hardening.length} hardening`,
+    ].join(", ");
+    const words = (...parts) => parts.filter(Boolean).join(" ");
+    const hunters = words(r.provider.name, r.provider.model, r.provider.effort);
+    const checker = r.verifier && r.verifier.name !== r.provider.name ? `, checked by ${words(r.verifier.name, r.verifier.model)}` : "";
+    const out = [];
+    out.push(`${bold("Mergelight")} ${dim("·")} ${r.pr.owner}/${r.pr.repo}#${r.pr.number} ${dim("·")} ${r.pr.title}`);
+    out.push(`${light.dot} ${light.color(bold(light.label))}  ${dim(`(${counts})`)}  ${dim(`· ${hunters}${checker} · ${duration(r.stats.duration_ms)} · ${r.pr.head_sha.slice(0, 7)}`)}`);
+    const checked = r.trace.candidates.length;
+    out.push(dim(`Checked ${checked} candidate${checked === 1 ? "" : "s"}, rejected ${r.trace.rejected.length}${r.trace.failed_hunters.length ? `, hunters failed: ${r.trace.failed_hunters.join(", ")}` : ""}`));
+    out.push("");
+    out.push(wrap(r.summary, ""));
+    for (const f of posted) {
+        const k = kind(f);
+        out.push("", full(f, k.dot, k.label));
+    }
+    if (listed.length) {
+        out.push("", bold(`Also worth fixing (${listed.length})`));
+        for (const f of listed) {
+            out.push(`   ${kind(f).dot} ${dim(where(f))}  ${f.title}`);
+            out.push(`      ${dim(`${f.likelihood} · ${f.severity} · fix ${f.fix_cost} ·`)} ${f.verdict}`);
+        }
+    }
+    if (decisions.length) {
+        out.push("", bold(`Your call (${decisions.length})`));
+        for (const f of decisions) {
+            out.push(`   ${dim(where(f))}  ${f.title}`);
+            out.push(`      ${dim(`${f.likelihood} · fix ${f.fix_cost} ·`)} ${f.verdict}`);
+        }
+    }
+    if (hardening.length) {
+        out.push("", dim(`⚪ Hardening, not worth fixing by default (${hardening.length})`));
+        for (const f of hardening) {
+            out.push(dim(`   ${where(f)}  ${f.title}`));
+            out.push(dim(`      → ${f.verdict}`));
+        }
+    }
+    if (!r.findings.length)
+        out.push("", green("Nothing worth fixing."));
+    return out.join("\n");
+}