capscan 0.1.0

package/src/commands/init.ts

@@ -0,0 +1,132 @@
+import { defineCommand } from 'citty';
+import { readFile, writeFile, access } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const NPMRC_CONTENT = `
+# CapScan pre-install hook
+# Checks dependency capabilities before installing
+preinstall = npx capscan check --quiet
+`.trim();
+
+const GITIGNORE_LINE = 'node_modules/';
+
+async function fileExists(path: string): Promise<boolean> {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function readOrCreateNpmrc(projectPath: string): Promise<string> {
+  const npmrcPath = join(projectPath, '.npmrc');
+
+  if (await fileExists(npmrcPath)) {
+    return await readFile(npmrcPath, 'utf-8');
+  }
+
+  return '';
+}
+
+async function readOrCreateGitignore(projectPath: string): Promise<string> {
+  const gitignorePath = join(projectPath, '.gitignore');
+
+  if (await fileExists(gitignorePath)) {
+    return await readFile(gitignorePath, 'utf-8');
+  }
+
+  return '';
+}
+
+function hasCapscanHook(content: string): boolean {
+  return content.includes('capscan check');
+}
+
+function addCapscanHook(content: string): string {
+  if (hasCapscanHook(content)) {
+    return content;
+  }
+
+  const lines = content.split('\n');
+  const lastEmptyIndex = lines.length - 1;
+
+  // Find a good place to insert
+  let insertIndex = lastEmptyIndex;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (lines[i].trim() === '') {
+      insertIndex = i;
+      break;
+    }
+  }
+
+  // If no empty line found, append at end
+  if (insertIndex === lastEmptyIndex && lines[lastEmptyIndex]?.trim() !== '') {
+    lines.push('');
+    insertIndex = lines.length;
+  }
+
+  lines.splice(insertIndex, 0, ...NPMRC_CONTENT.split('\n'));
+
+  return lines.join('\n');
+}
+
+function addNodeModulesToGitignore(content: string): string {
+  if (content.includes('node_modules/')) {
+    return content;
+  }
+
+  return content.trim() + '\n\n' + GITIGNORE_LINE + '\n';
+}
+
+export const initCommand = defineCommand({
+  meta: {
+    name: 'init',
+    description: 'Initialize CapScan hooks in your project',
+  },
+  args: {
+    path: { type: 'positional', description: 'Path to project directory', default: '.' },
+    force: {
+      type: 'boolean',
+      description: 'Overwrite existing configuration',
+      default: false,
+      alias: 'f',
+    },
+  },
+  async run({ args }) {
+    const projectPath = args.path;
+
+    try {
+      console.log('\n  \x1b[36mCapScan\x1b[0m \x1b[2mInit\x1b[0m\n');
+
+      // Update .npmrc
+      const npmrcContent = await readOrCreateNpmrc(projectPath);
+      if (hasCapscanHook(npmrcContent) && !args.force) {
+        console.log('  \x1b[33m●\x1b[0m .npmrc already configured');
+      } else {
+        const newNpmrc = addCapscanHook(npmrcContent);
+        const npmrcPath = join(projectPath, '.npmrc');
+        await writeFile(npmrcPath, newNpmrc, 'utf-8');
+        console.log('  \x1b[32m✓\x1b[0m .npmrc updated');
+      }
+
+      // Update .gitignore
+      const gitignoreContent = await readOrCreateGitignore(projectPath);
+      if (gitignoreContent.includes('node_modules/')) {
+        console.log('  \x1b[33m●\x1b[0m .gitignore already has node_modules/');
+      } else {
+        const newGitignore = addNodeModulesToGitignore(gitignoreContent);
+        const gitignorePath = join(projectPath, '.gitignore');
+        await writeFile(gitignorePath, newGitignore, 'utf-8');
+        console.log('  \x1b[32m✓\x1b[0m .gitignore updated');
+      }
+
+      console.log('\n  \x1b[2mCapScan will now check capabilities before each install.\x1b[0m');
+      console.log('  \x1b[2mTo disable: remove the "preinstall" line from .npmrc\x1b[0m\n');
+
+    } catch (error) {
+      console.error('\x1b[31m✗\x1b[0m Init failed:', error);
+      process.exit(1);
+    }
+  },
+});

package/src/commands/scan.ts

@@ -0,0 +1,44 @@
+import { defineCommand } from 'citty';
+import { scan } from '@capscan/engine';
+import { reportTerminal } from '../reporters/terminal.js';
+import { reportJson } from '../reporters/json.js';
+import { reportMarkdown } from '../reporters/markdown.js';
+import ora from 'ora';
+
+export const scanCommand = defineCommand({
+  meta: { name: 'scan', description: 'Scan a project for dependency capabilities' },
+  args: {
+    path: { type: 'positional', description: 'Path to project directory', default: '.' },
+    format: { type: 'string', description: 'Output format (json, terminal, markdown)', default: 'terminal', alias: 'f' },
+    output: { type: 'string', description: 'Output file path', alias: 'o' },
+  },
+  async run({ args }) {
+    const spinner = ora('Scanning project...').start();
+    try {
+      const result = await scan({ path: args.path });
+      spinner.succeed(`Found ${result.summary.packagesWithCapabilities} packages with capabilities`);
+
+      if (args.format === 'json') {
+        const out = await reportJson(result, args.output);
+        if (args.output) console.log(`Report saved to ${args.output}`);
+        else console.log(out);
+      } else if (args.format === 'markdown') {
+        const md = reportMarkdown(result);
+        if (args.output) {
+          await writeFile(args.output, md, 'utf-8');
+          console.log(`Report saved to ${args.output}`);
+        } else {
+          console.log(md);
+        }
+      } else {
+        console.log(reportTerminal(result));
+      }
+    } catch (error) {
+      spinner.fail('Scan failed');
+      console.error(error);
+      process.exit(1);
+    }
+  },
+});
+
+import { writeFile } from 'node:fs/promises';

package/src/commands/snapshot.ts

@@ -0,0 +1,28 @@
+import { defineCommand } from 'citty';
+import { scan, createSnapshot } from '@capscan/engine';
+import { join } from 'node:path';
+import ora from 'ora';
+
+export const snapshotCommand = defineCommand({
+  meta: { name: 'snapshot', description: 'Create a capability snapshot for diffing' },
+  args: {
+    path: { type: 'positional', description: 'Path to project directory', default: '.' },
+    output: { type: 'string', description: 'Snapshot file path', default: '.capscan/snapshot.json' },
+  },
+  async run({ args }) {
+    const spinner = ora('Creating snapshot...').start();
+    try {
+      const result = await scan({ path: args.path });
+      const snapshotPath = join(args.path, args.output);
+      const snapshot = await createSnapshot(result, snapshotPath);
+
+      const pkgCount = Object.keys(snapshot.packages).length;
+      spinner.succeed(`Snapshot saved to ${args.output}`);
+      console.log(`  ${pkgCount} packages with capabilities recorded.`);
+    } catch (error) {
+      spinner.fail('Snapshot failed');
+      console.error(error);
+      process.exit(1);
+    }
+  },
+});

package/src/commands/why.ts

@@ -0,0 +1,112 @@
+import { defineCommand } from 'citty';
+import { scan } from '@capscan/engine';
+import type { CapabilityCategory, Permission, ScanResult, PackageResult, CapabilityFinding } from '@capscan/engine';
+
+function dim(s: string): string { return `\x1b[2m${s}\x1b[0m`; }
+function bold(s: string): string { return `\x1b[1m${s}\x1b[0m`; }
+
+const CATEGORY_LABELS: Record<CapabilityCategory, string> = {
+  filesystem: 'Filesystem', network: 'Network', process: 'Process',
+  environment: 'Environment', crypto: 'Crypto', dynamic_code: 'Dynamic Code',
+  native: 'Native', installation: 'Installation', obfuscation: 'Obfuscation',
+};
+
+const CATEGORY_ICONS: Record<CapabilityCategory, string> = {
+  filesystem: '📁', network: '🌐', process: '⚙️', environment: '🔑',
+  crypto: '🔐', dynamic_code: '📦', native: '🧩', installation: '🔧', obfuscation: '🎭',
+};
+
+function isCategory(input: string): input is CapabilityCategory {
+  return Object.keys(CATEGORY_LABELS).includes(input);
+}
+
+function extractPermissions(finding: CapabilityFinding): Permission[] {
+  return [finding.capability.permission];
+}
+
+function printFindings(label: string, findings: Array<{ pkg: PackageResult; finding: CapabilityFinding }>) {
+  const lines: string[] = [];
+  lines.push('');
+  lines.push(`  ${bold(label)}`);
+  lines.push(`  ${dim('─'.repeat(50))}`);
+  lines.push('');
+
+  // Group by package
+  const byPkg = new Map<string, Array<{ finding: CapabilityFinding }>>();
+  for (const { pkg, finding } of findings) {
+    const arr = byPkg.get(pkg.name) || [];
+    arr.push({ finding });
+    byPkg.set(pkg.name, arr);
+  }
+
+  let totalEvidence = 0;
+  for (const [pkgName, items] of byPkg) {
+    const pkgVersion = items[0] ? findings.find(f => f.pkg.name === pkgName)?.pkg.version : '';
+    lines.push(`  ${bold(pkgName)}@${dim(pkgVersion || '')}`);
+    for (const { finding } of items) {
+      for (const e of finding.evidence) {
+        totalEvidence++;
+        const loc = e.line > 0 ? `${e.file}:${e.line}` : e.file;
+        lines.push(`    └── ${dim(loc)}  ${bold(e.symbol)}`);
+      }
+    }
+    lines.push('');
+  }
+
+  lines.push(`  ${dim(`${totalEvidence} evidence points across ${byPkg.size} packages`)}`);
+  lines.push('');
+  console.log(lines.join('\n'));
+}
+
+export const whyCommand = defineCommand({
+  meta: { name: 'why', description: 'Explain why a capability, permission, or package is detected' },
+  args: {
+    target: { type: 'positional', description: 'Category, permission, or package name', required: true },
+    extra: { type: 'positional', description: 'Second filter (permission or package)', required: false },
+    path: { type: 'string', description: 'Path to project directory', default: '.', alias: 'p' },
+  },
+  async run({ args }) {
+    const result = await scan({ path: args.path });
+    const target = args.target.toLowerCase();
+    const extra = args.extra?.toLowerCase();
+
+    // Find matching findings
+    const matches: Array<{ pkg: PackageResult; finding: CapabilityFinding }> = [];
+
+    for (const pkg of result.packages) {
+      for (const finding of pkg.capabilities) {
+        const matchesTarget =
+          isCategory(target) && finding.capability.category === target ||
+          finding.capability.permission === target ||
+          pkg.name.toLowerCase() === target ||
+          pkg.name.toLowerCase().includes(target);
+
+        const matchesExtra = !extra ||
+          finding.capability.permission === extra ||
+          pkg.name.toLowerCase() === extra ||
+          pkg.name.toLowerCase().includes(extra);
+
+        if (matchesTarget && matchesExtra) {
+          matches.push({ pkg, finding });
+        }
+      }
+    }
+
+    if (matches.length === 0) {
+      console.log(`\n  No findings for "${args.target}${extra ? ' ' + extra : ''}".\n`);
+      return;
+    }
+
+    // Determine display label
+    let label: string;
+    if (isCategory(target)) {
+      label = `${CATEGORY_ICONS[target]} ${CATEGORY_LABELS[target]}`;
+    } else if (matches[0]?.finding.capability.permission === target) {
+      label = target;
+    } else {
+      label = `Package: ${target}`;
+    }
+
+    printFindings(label, matches);
+  },
+});

package/src/determinism-test.ts

@@ -0,0 +1,76 @@
+import { scan } from '@capscan/engine';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const FIXTURES_DIR = resolve(import.meta.dirname, '../../../fixtures');
+const RUNS = 10;
+
+async function determinismTest() {
+  const fixtures = readdirSync(FIXTURES_DIR).filter(f => {
+    try {
+      readFileSync(join(FIXTURES_DIR, f, 'package.json'), 'utf-8');
+      return true;
+    } catch {
+      return false;
+    }
+  });
+
+  console.log(`\n  CapScan Determinism Test`);
+  console.log(`  ${'─'.repeat(50)}`);
+  console.log(`  Running each fixture ${RUNS} times and comparing outputs\n`);
+
+  let allPassed = true;
+
+  for (const fixture of fixtures) {
+    const fixtureDir = join(FIXTURES_DIR, fixture);
+    const results: unknown[] = [];
+
+    for (let i = 0; i < RUNS; i++) {
+      const result = await scan({ path: fixtureDir });
+      // Exclude timestamp from comparison (it changes every run)
+      (result as { meta: { timestamp: string } }).meta.timestamp = '<stable>';
+      results.push(result);
+    }
+
+    const baseline = JSON.stringify(results[0]);
+    let mismatch = -1;
+    for (let i = 1; i < results.length; i++) {
+      if (JSON.stringify(results[i]) !== baseline) {
+        mismatch = i;
+        break;
+      }
+    }
+
+    if (mismatch === -1) {
+      console.log(`  \x1b[32m✓\x1b[0m ${fixture} — ${RUNS}/${RUNS} identical`);
+    } else {
+      console.log(`  \x1b[31m✗\x1b[0m ${fixture} — mismatch at run ${mismatch}`);
+
+      // Show diff
+      const baselineObj = JSON.parse(baseline);
+      const mismatchObj = JSON.parse(results[mismatch] as string);
+
+      // Compare timestamps
+      if (baselineObj.meta.timestamp !== mismatchObj.meta.timestamp) {
+        console.log(`    Timestamp differs: ${baselineObj.meta.timestamp} vs ${mismatchObj.meta.timestamp}`);
+      }
+
+      // Compare package counts
+      if (baselineObj.summary.totalPackages !== mismatchObj.summary.totalPackages) {
+        console.log(`    Package count differs: ${baselineObj.summary.totalPackages} vs ${mismatchObj.summary.totalPackages}`);
+      }
+
+      // Compare capabilities
+      if (JSON.stringify(baselineObj.summary.capabilities) !== JSON.stringify(mismatchObj.summary.capabilities)) {
+        console.log(`    Capabilities differ`);
+      }
+
+      allPassed = false;
+    }
+  }
+
+  console.log(`\n  ${allPassed ? '\x1b[32mAll tests passed\x1b[0m' : '\x1b[31mSome tests failed\x1b[0m'}\n`);
+  process.exit(allPassed ? 0 : 1);
+}
+
+determinismTest();

package/src/generate-expected.ts

@@ -0,0 +1,30 @@
+import { scan } from '@capscan/engine';
+import { writeFileSync, readdirSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const FIXTURES_DIR = resolve(import.meta.dirname, '../../../fixtures');
+
+async function generateExpected() {
+  const fixtures = readdirSync(FIXTURES_DIR).filter(f => {
+    try {
+      readFileSync(join(FIXTURES_DIR, f, 'package.json'), 'utf-8');
+      return true;
+    } catch {
+      return false;
+    }
+  });
+
+  console.log('Generating expected.json files...\n');
+
+  for (const fixture of fixtures) {
+    const fixtureDir = join(FIXTURES_DIR, fixture);
+    const result = await scan({ path: fixtureDir });
+    const outputPath = join(fixtureDir, 'expected.json');
+    writeFileSync(outputPath, JSON.stringify(result, null, 2), 'utf-8');
+    console.log(`  ✓ ${fixture}`);
+  }
+
+  console.log('\nDone.');
+}
+
+generateExpected();

package/src/golden-test.ts

@@ -0,0 +1,79 @@
+import { scan } from '@capscan/engine';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const FIXTURES_DIR = resolve(import.meta.dirname, '../../../fixtures');
+
+interface ScanResult {
+  version: number;
+  meta: { tool: string; engine: string; version: string; timestamp: string; packageManager: string; scanPath: string };
+  summary: { totalPackages: number; packagesWithCapabilities: number; capabilities: Record<string, Record<string, number>> };
+  packages: Array<{ name: string; version: string; path: string; capabilities: unknown[] }>;
+}
+
+function normalizeForComparison(result: ScanResult): unknown {
+  return {
+    summary: result.summary,
+    packages: result.packages
+      .filter(p => p.capabilities.length > 0)
+      .map(p => ({
+        name: p.name,
+        version: p.version,
+        capabilityCount: p.capabilities.length,
+        permissions: [...new Set((p.capabilities as Array<{ capability: { permission: string } }>).map(c => c.capability.permission))].sort(),
+      }))
+      .sort((a, b) => a.name.localeCompare(b.name)),
+  };
+}
+
+async function runGoldenTests() {
+  const fixtures = readdirSync(FIXTURES_DIR).filter(f => {
+    try {
+      const stat = readFileSync(join(FIXTURES_DIR, f, 'package.json'), 'utf-8');
+      return stat.includes('"dependencies"');
+    } catch {
+      return false;
+    }
+  });
+
+  console.log(`\n  CapScan Golden Tests`);
+  console.log(`  ${'─'.repeat(50)}\n`);
+
+  let passed = 0;
+  let failed = 0;
+
+  for (const fixture of fixtures) {
+    const fixtureDir = join(FIXTURES_DIR, fixture);
+    const expectedPath = join(fixtureDir, 'expected.json');
+
+    try {
+      const result = await scan({ path: fixtureDir });
+      const expected = JSON.parse(readFileSync(expectedPath, 'utf-8'));
+
+      const actualNorm = normalizeForComparison(result as ScanResult);
+      const expectedNorm = normalizeForComparison(expected);
+
+      const actualJson = JSON.stringify(actualNorm, null, 2);
+      const expectedJson = JSON.stringify(expectedNorm, null, 2);
+
+      if (actualJson === expectedJson) {
+        console.log(`  \x1b[32m✓\x1b[0m ${fixture}`);
+        passed++;
+      } else {
+        console.log(`  \x1b[31m✗\x1b[0m ${fixture}`);
+        console.log(`    Expected: ${(expectedNorm as { packages: unknown[] }).packages.length} packages`);
+        console.log(`    Actual:   ${(actualNorm as { packages: unknown[] }).packages.length} packages`);
+        failed++;
+      }
+    } catch (error) {
+      console.log(`  \x1b[31m✗\x1b[0m ${fixture} (error)`);
+      console.log(`    ${error}`);
+      failed++;
+    }
+  }
+
+  console.log(`\n  ${passed} passed, ${failed} failed\n`);
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+runGoldenTests();

package/src/index.ts

@@ -0,0 +1,27 @@
+import { defineCommand, runMain } from 'citty';
+import { scanCommand } from './commands/scan.js';
+import { diffCommand } from './commands/diff.js';
+import { snapshotCommand } from './commands/snapshot.js';
+import { whyCommand } from './commands/why.js';
+import { compareCommand } from './commands/compare.js';
+import { checkCommand } from './commands/check.js';
+import { initCommand } from './commands/init.js';
+
+const main = defineCommand({
+  meta: {
+    name: 'capscan',
+    version: '0.1.0',
+    description: 'Deterministic capability analysis engine for software dependencies',
+  },
+  subCommands: {
+    scan: scanCommand,
+    why: whyCommand,
+    diff: diffCommand,
+    snapshot: snapshotCommand,
+    compare: compareCommand,
+    check: checkCommand,
+    init: initCommand,
+  },
+});
+
+runMain(main);

package/src/performance-budget.ts

@@ -0,0 +1,89 @@
+import { scan } from '@capscan/engine';
+import { readdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const FIXTURES_DIR = resolve(import.meta.dirname, '../../../fixtures');
+const BUDGET_FILE = resolve(import.meta.dirname, '../../../fixtures/.performance-budget.json');
+const MAX_REGRESSION_PCT = 15;
+
+interface Budget {
+  [fixture: string]: {
+    maxMs: number;
+    lastRunMs: number;
+    timestamp: string;
+  };
+}
+
+function loadBudget(): Budget {
+  if (existsSync(BUDGET_FILE)) {
+    return JSON.parse(readFileSync(BUDGET_FILE, 'utf-8'));
+  }
+  return {};
+}
+
+function saveBudget(budget: Budget) {
+  writeFileSync(BUDGET_FILE, JSON.stringify(budget, null, 2), 'utf-8');
+}
+
+async function performanceBudget() {
+  const fixtures = readdirSync(FIXTURES_DIR).filter(f => {
+    try {
+      readFileSync(join(FIXTURES_DIR, f, 'package.json'), 'utf-8');
+      return true;
+    } catch {
+      return false;
+    }
+  });
+
+  console.log(`\n  CapScan Performance Budget`);
+  console.log(`  ${'─'.repeat(50)}`);
+  console.log(`  Max regression: ${MAX_REGRESSION_PCT}%\n`);
+
+  const budget = loadBudget();
+  let failed = false;
+  const newBudget: Budget = {};
+
+  for (const fixture of fixtures) {
+    const fixtureDir = join(FIXTURES_DIR, fixture);
+
+    // Warm up (3 runs)
+    for (let i = 0; i < 3; i++) {
+      await scan({ path: fixtureDir });
+    }
+
+    // Benchmark (5 runs, take median)
+    const times: number[] = [];
+    for (let i = 0; i < 5; i++) {
+      const start = performance.now();
+      await scan({ path: fixtureDir });
+      times.push(performance.now() - start);
+    }
+    times.sort((a, b) => a - b);
+    const medianTime = times[2]; // Middle of 5
+
+    const prev = budget[fixture];
+    const maxMs = prev ? prev.maxMs * (1 + MAX_REGRESSION_PCT / 100) : medianTime * 2;
+
+    newBudget[fixture] = {
+      maxMs: Math.max(prev?.maxMs || 0, medianTime),
+      lastRunMs: medianTime,
+      timestamp: new Date().toISOString(),
+    };
+
+    if (prev && medianTime > prev.maxMs * (1 + MAX_REGRESSION_PCT / 100)) {
+      const regressionPct = ((medianTime - prev.maxMs) / prev.maxMs * 100).toFixed(1);
+      console.log(`  \x1b[31m✗\x1b[0m ${fixture} — ${medianTime.toFixed(0)}ms (was ${prev.maxMs.toFixed(0)}ms, +${regressionPct}% regression)`);
+      failed = true;
+    } else {
+      console.log(`  \x1b[32m✓\x1b[0m ${fixture} — ${medianTime.toFixed(0)}ms`);
+    }
+  }
+
+  saveBudget(newBudget);
+  console.log(`\n  ${failed ? '\x1b[31mPerformance regression detected\x1b[0m' : '\x1b[32mAll within budget\x1b[0m'}`);
+  console.log(`  Budget saved to fixtures/.performance-budget.json\n`);
+
+  process.exit(failed ? 1 : 0);
+}
+
+performanceBudget();

package/src/reporters/json.ts

@@ -0,0 +1,12 @@
+import { writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import type { ScanResult } from '@capscan/engine';
+
+export async function reportJson(result: ScanResult, outputPath?: string): Promise<string> {
+  const json = JSON.stringify(result, null, 2);
+  if (outputPath) {
+    await writeFile(resolve(outputPath), json, 'utf-8');
+    return outputPath;
+  }
+  return json;
+}

package/src/reporters/markdown.ts

@@ -0,0 +1,55 @@
+import type { ScanResult, CapabilityCategory } from '@capscan/engine';
+
+const CAPABILITY_LABELS: Record<CapabilityCategory, string> = {
+  filesystem: 'Filesystem', network: 'Network', process: 'Process',
+  environment: 'Environment', crypto: 'Crypto', dynamic_code: 'Dynamic Code',
+  native: 'Native', installation: 'Installation', obfuscation: 'Obfuscation',
+};
+
+function generateCapabilityTable(summary: ScanResult['summary']): string {
+  const lines: string[] = [];
+  lines.push('| Category | Permission | Count |');
+  lines.push('|----------|------------|-------|');
+  for (const [cat, perms] of Object.entries(summary.capabilities)) {
+    for (const [perm, count] of Object.entries(perms)) {
+      if (count > 0) lines.push(`| ${CAPABILITY_LABELS[cat as CapabilityCategory]} | \`${perm}\` | ${count} |`);
+    }
+  }
+  return lines.join('\n');
+}
+
+export function reportMarkdown(result: ScanResult): string {
+  const lines: string[] = [];
+  lines.push('# CapScan Report');
+  lines.push('');
+  lines.push(`**Generated**: ${result.meta.timestamp}`);
+  lines.push(`**Engine**: ${result.meta.engine}`);
+  lines.push(`**Package Manager**: ${result.meta.packageManager}`);
+  lines.push(`**Total Dependencies**: ${result.summary.totalPackages}`);
+  lines.push(`**Packages with Capabilities**: ${result.summary.packagesWithCapabilities}`);
+  lines.push('');
+  lines.push('## Summary');
+  lines.push('');
+  lines.push(generateCapabilityTable(result.summary));
+  lines.push('');
+
+  const packagesWithCaps = result.packages.filter(p => p.capabilities.length > 0);
+  if (packagesWithCaps.length > 0) {
+    lines.push('## Packages');
+    lines.push('');
+    for (const pkg of packagesWithCaps) {
+      lines.push(`### ${pkg.name}@${pkg.version}`);
+      lines.push('');
+      lines.push('| Permission | Symbol | File | Line | Confidence |');
+      lines.push('|------------|--------|------|------|------------|');
+      for (const f of pkg.capabilities) {
+        for (const e of f.evidence) {
+          lines.push(`| \`${f.capability.permission}\` | \`${e.symbol}\` | \`${e.file}\` | ${e.line} | ${e.confidence} |`);
+        }
+      }
+      lines.push('');
+    }
+  }
+
+  return lines.join('\n');
+}