codehere 1.0.1 → 1.0.2

package/dist/presentation/cli/commands/repo-map-builder.js

@@ -1,247 +0,0 @@
-/**
- * F3 Task 4 — repo_map.json builder (v0.5 TS-native MVP).
- *
- * v0.5 SCOPE:
- *   - Walks `git ls-files` (respects .gitignore via git itself).
- *   - For .ts/.tsx/.js/.jsx/.py files, regex-extracts top-level public-surface
- *     symbols (export function/class/const/interface/type, def/class for Python).
- *   - Reference count via `git grep -c` per symbol name.
- *   - Writes JSON to .codehere/memory/episodic/repo_map.json.
- *
- * v0.6 PLAN:
- *   - Replace the regex extractor with proper tree-sitter parsing
- *     (Aider's repomap.py MIT port — Python helper + TS shell-out, OR
- *     a TS-native tree-sitter library evaluation).
- *   - Add PageRank-style symbol importance (currently raw reference count).
- *   - Incremental rebuild via the per-file `hash` field already in the schema.
- *
- * Schema is forward-compatible — only the extractor implementation changes.
- *
- * Why regex MVP for v0.5:
- *   - Zero new deps (tree-sitter would mean Python + 5 packages OR a 30+ MB
- *     TS dep). codehere is bootstrap-zero-cost; every dep is friction.
- *   - Closes the F3 episodic/repo_map.json layer enough for spawned agents
- *     to read it as a starting context block.
- *   - Honest about limitations — see schema._note in the output JSON.
- */
-import { spawnSync } from 'child_process';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';
-import { createHash } from 'crypto';
-import { join, dirname, extname } from 'path';
-const SUPPORTED_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.py']);
-/**
- * Per-language extractors. v0.5 regex-based — line-anchored to avoid
- * matching identifiers inside string literals. Returns 1-indexed line numbers.
- *
- * v0.6 will swap these for AST-based extractors. The interface stays the
- * same: (body) → RepoMapSymbol[].
- */
-function extractTsLikeSymbols(body) {
-    const lines = body.split('\n');
-    const symbols = [];
-    // export function NAME(  | export async function NAME(
-    // export class NAME
-    // export const NAME = | export let NAME = | export var NAME =
-    // export interface NAME { | export type NAME =
-    const PATTERNS = [
-        [/^export\s+(?:async\s+)?function\s+(\w+)\s*[<(]/, 'function'],
-        [/^export\s+(?:abstract\s+)?class\s+(\w+)/, 'class'],
-        [/^export\s+(?:const|let|var)\s+(\w+)\s*[:=]/, 'const'],
-        [/^export\s+interface\s+(\w+)/, 'interface'],
-        [/^export\s+type\s+(\w+)\s*=/, 'type'],
-        [/^export\s+enum\s+(\w+)/, 'enum'],
-    ];
-    for (let i = 0; i < lines.length; i++) {
-        for (const [re, kind] of PATTERNS) {
-            const m = lines[i].match(re);
-            if (m) {
-                symbols.push({ kind, name: m[1], line: i + 1 });
-                break;
-            }
-        }
-    }
-    return symbols;
-}
-function extractPythonSymbols(body) {
-    const lines = body.split('\n');
-    const symbols = [];
-    // Top-level (column 0) def NAME(  | class NAME(  | class NAME:
-    const PATTERNS = [
-        [/^def\s+(\w+)\s*\(/, 'def'],
-        [/^class\s+(\w+)\s*[(:]/, 'class'],
-    ];
-    for (let i = 0; i < lines.length; i++) {
-        for (const [re, kind] of PATTERNS) {
-            const m = lines[i].match(re);
-            if (m) {
-                symbols.push({ kind, name: m[1], line: i + 1 });
-                break;
-            }
-        }
-    }
-    return symbols;
-}
-function extractSymbols(filePath, body) {
-    const ext = extname(filePath);
-    if (ext === '.py')
-        return extractPythonSymbols(body);
-    if (SUPPORTED_EXTENSIONS.has(ext))
-        return extractTsLikeSymbols(body);
-    return [];
-}
-/**
- * Hash file content for incremental-rebuild support in v0.6.
- * Format: `sha256:<64-hex>` so the algorithm is self-describing.
- */
-function hashContent(body) {
-    return 'sha256:' + createHash('sha256').update(body).digest('hex');
-}
-/**
- * `git ls-files` returns paths relative to the repo root. Filters out
- * non-supported extensions in one pass. If `git` isn't a repo, returns null
- * so the caller can refuse with a clear message.
- */
-function gitListFiles(repoRoot) {
-    const r = spawnSync('git', ['ls-files', '-z'], { cwd: repoRoot, encoding: 'utf-8' });
-    if (r.status !== 0)
-        return null;
-    return r.stdout
-        .split('\0')
-        .filter((p) => p.length > 0)
-        .filter((p) => SUPPORTED_EXTENSIONS.has(extname(p)));
-}
-/**
- * Count references to a symbol name across the repo via git grep.
- * `-c` returns "<file>:<count>" per matching file; sum the counts.
- *
- * Uses word-boundary regex so `popular` doesn't match `unpopular`. The grep
- * finds DEFINITIONS too, so subtract the definition count to get pure refs.
- */
-function countReferences(repoRoot, symbolName) {
-    // -F = fixed string, -w = word boundary. Combined with grep itself.
-    const r = spawnSync('git', ['grep', '-c', '-w', '-F', '--', symbolName], { cwd: repoRoot, encoding: 'utf-8' });
-    if (r.status !== 0 && r.status !== 1)
-        return 0;
-    let total = 0;
-    for (const line of r.stdout.split('\n')) {
-        const m = line.match(/:(\d+)$/);
-        if (m)
-            total += parseInt(m[1], 10);
-    }
-    // Subtract 1 for the definition line itself (best-effort — undercounts if
-    // the symbol is defined in multiple files; v0.6 with AST will be accurate).
-    return Math.max(0, total - 1);
-}
-/**
- * Build the repo_map for the repo at `repoRoot`. Returns the JSON object —
- * caller writes to disk. Pure-ish (still spawns git), no codehere-specific
- * paths inside.
- *
- * The `_stats` block in the returned RepoMap persists to disk so downstream
- * agents know whether the map is incomplete (e.g. >1MB files skipped during
- * walk).
- */
-export function buildRepoMap(repoRoot) {
-    if (!existsSync(join(repoRoot, '.git'))) {
-        return { error: 'not a git repo (run `git init` first)' };
-    }
-    const files = gitListFiles(repoRoot);
-    if (files === null) {
-        return { error: 'git ls-files failed' };
-    }
-    const fileMap = {};
-    const allSymbols = [];
-    let skippedLargeFiles = 0;
-    for (const rel of files) {
-        const abs = join(repoRoot, rel);
-        // Skip giant files (>1MB) — surfaced in the result so users see the count.
-        try {
-            if (statSync(abs).size > 1_000_000) {
-                skippedLargeFiles++;
-                continue;
-            }
-        }
-        catch {
-            continue;
-        }
-        let body;
-        try {
-            body = readFileSync(abs, 'utf-8');
-        }
-        catch {
-            // File deleted between ls-files and read — skip.
-            continue;
-        }
-        const symbols = extractSymbols(rel, body);
-        fileMap[rel] = {
-            hash: hashContent(body),
-            symbols,
-        };
-        for (const s of symbols) {
-            allSymbols.push({ name: s.name, file: rel, line: s.line });
-        }
-    }
-    // Rank by reference count.
-    //
-    // codex Round 1 fix: the previous version applied .slice(0, 200) BEFORE
-    // grepping, which meant "first 200 discovered names" not "top 200
-    // candidates." Symbols defined in files traversed late silently got
-    // references=0 and dropped out of topSymbols, regardless of how heavily
-    // they were referenced. Now we grep ALL unique names. O(N) git greps is
-    // acceptable for v0.5 — codehere's own 249-symbol repo runs in ~5s.
-    // v0.6's tree-sitter port will swap raw grep for AST-aware reference
-    // resolution + PageRank, which is faster AND more accurate.
-    const uniqueNames = Array.from(new Set(allSymbols.map((s) => s.name)));
-    const refCounts = new Map();
-    for (const name of uniqueNames) {
-        refCounts.set(name, countReferences(repoRoot, name));
-    }
-    const topSymbols = allSymbols
-        .map((s) => ({ ...s, references: refCounts.get(s.name) ?? 0 }))
-        // Stable sort: references DESC, then name ASC for tie-breaking.
-        .sort((a, b) => b.references - a.references || a.name.localeCompare(b.name))
-        .slice(0, 50);
-    return {
-        version: 'v0.5',
-        generatedAt: new Date().toISOString(),
-        rootPath: repoRoot,
-        _note: 'TS-native regex MVP · KNOWN MISSES (v0.5, addressed in v0.6 tree-sitter port): ' +
-            '`export default function/class` (no name on the export line), ' +
-            '`export { foo, bar }` blocks, `export { foo } from "..."` re-exports, ' +
-            '`export * from "..."` star re-exports, multi-line `export { ... }` blocks, ' +
-            '`export declare`, CommonJS `module.exports` / `exports.X` assignments, ' +
-            'symbols not at column 0 in Python. Reference counts via word-bounded ' +
-            'git grep undercount when a name is defined in multiple files. ' +
-            'Read `_stats.skippedLargeFiles` to detect files left out of the walk.',
-        _stats: { skippedLargeFiles },
-        files: fileMap,
-        topSymbols,
-    };
-}
-/**
- * Disk-side wrapper: build + write to .codehere/memory/episodic/repo_map.json.
- *
- * `_stats` is preserved in the on-disk JSON (codex Round 2 fix) so spawned
- * agents reading the map can tell "no symbols in this file" from "this file
- * was skipped during the walk." The CLI also surfaces it on the return value.
- */
-export function writeRepoMap(repoRoot, codehereDir, options = {}) {
-    const targetPath = join(codehereDir, 'memory/episodic/repo_map.json');
-    if (existsSync(targetPath) && !options.rebuild) {
-        return { result: 'exists', path: targetPath };
-    }
-    const built = buildRepoMap(repoRoot);
-    if ('error' in built) {
-        return { result: 'failed', path: targetPath, error: built.error };
-    }
-    mkdirSync(dirname(targetPath), { recursive: true });
-    writeFileSync(targetPath, JSON.stringify(built, null, 2) + '\n');
-    return {
-        result: 'written',
-        path: targetPath,
-        fileCount: Object.keys(built.files).length,
-        symbolCount: Object.values(built.files).reduce((acc, f) => acc + f.symbols.length, 0),
-        skippedLargeFiles: built._stats.skippedLargeFiles,
-    };
-}
-//# sourceMappingURL=repo-map-builder.js.map

package/dist/presentation/cli/commands/report-command.js

@@ -1,403 +0,0 @@
-/**
- * CLI Command: report
- *
- * Generates a shareable audit narrative — not just a score.
- * The viral artifact: something developers post in PRs, tweet, and put in READMEs.
- *
- * Usage:
- *   codehere report                    # scan current dir, print markdown
- *   codehere report src/               # scan a subdirectory
- *   codehere report --out report.md    # write to file
- *   codehere report --json             # machine-readable JSON
- *   codehere report --diff HEAD        # scan only changed files
- *
- * Output is a markdown document with:
- *   - Executive summary with score and grade
- *   - Per-severity finding breakdowns with context
- *   - Actionable recommendations in plain English
- *   - A shareable badge and attribution
- */
-import { writeFileSync, readFileSync, existsSync } from 'fs';
-import { basename, relative, join, isAbsolute } from 'path';
-import { colors, success, error, newline, info } from '../../../ui.js';
-import { scoreFile, aggregateTrust } from '../../../infrastructure/security/trust-scorer.js';
-import { collectCodeFiles } from '../../../infrastructure/security/file-collection.js';
-import { loadProductContext, adjustRecommendation } from '../../../infrastructure/config/product-context.js';
-// ── Markdown generation ───────────────────────────────────────────────────────
-// S19 glyph language: grades carry the sanctioned geometric set, never emoji.
-function gradeGlyph(grade) {
-    return grade === 'A' ? '✓' : grade === 'B' ? '·' : grade === 'C' ? '!' : grade === 'D' ? '✕' : '✕✕';
-}
-function severityLabel(severity) {
-    return severity === 'critical'
-        ? '✕ Critical'
-        : severity === 'high'
-            ? '! High'
-            : severity === 'medium'
-                ? '· Medium'
-                : '· Low';
-}
-function badgeUrl(score, grade) {
-    const color = grade === 'A'
-        ? 'brightgreen'
-        : grade === 'B'
-            ? 'green'
-            : grade === 'C'
-                ? 'yellow'
-                : grade === 'D'
-                    ? 'orange'
-                    : 'red';
-    return `https://img.shields.io/badge/codehere%20trust-${score}%25%20${grade}-${color}?logo=shield&logoColor=white`;
-}
-function narrativeSummary(report) {
-    const { overallScore, criticalCount, highCount, mediumCount, files } = report;
-    if (criticalCount === 0 && highCount === 0) {
-        if (overallScore >= 90) {
-            return (`Clean codebase. ${files.length} file${files.length !== 1 ? 's' : ''} scanned, nothing blocking a merge. ` +
-                (mediumCount > 0
-                    ? `${mediumCount} medium-severity pattern${mediumCount !== 1 ? 's' : ''} worth reviewing in a future sprint.`
-                    : 'No significant findings.'));
-        }
-        return `Solid codebase with some medium/low findings. ${overallScore}/100 · worth a review pass but not blocking.`;
-    }
-    if (criticalCount > 0) {
-        return (`${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} found that should be resolved before this merges. ` +
-            `${highCount > 0 ? `Also ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} to address.` : ''}`);
-    }
-    return `No critical issues, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing before merge.`;
-}
-function recommendationsMarkdown(report) {
-    const { criticalCount, highCount, mediumCount, lowCount } = report;
-    const lines = [];
-    if (criticalCount > 0) {
-        lines.push(`1. **Resolve all ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} before merging.** These represent active security risks (credentials in code, eval injection, SQL without parameterization, etc.). They're usually quick fixes.`);
-    }
-    if (highCount > 0) {
-        lines.push(`${lines.length + 1}. **Address the ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} in this sprint.** Not blocking, but worth fixing while the code is fresh.`);
-    }
-    if (mediumCount > 0) {
-        lines.push(`${lines.length + 1}. **${mediumCount} medium-severity item${mediumCount !== 1 ? 's' : ''} can be queued for a future cleanup pass.** Mostly defensive hygiene · redirect hardening, input validation gaps.`);
-    }
-    if (lowCount > 0) {
-        lines.push(`${lines.length + 1}. **${lowCount} low-severity note${lowCount !== 1 ? 's' : ''} for informational purposes.** These rarely cause issues but keep the score from being perfect.`);
-    }
-    if (lines.length === 0) {
-        lines.push('1. **Nothing blocking.** Keep it up · this is what a healthy codebase looks like.');
-    }
-    return lines.join('\n\n');
-}
-function findingsMarkdown(files) {
-    const sections = [];
-    for (const severity of ['critical', 'high', 'medium', 'low']) {
-        const allFindings = [];
-        for (const f of files) {
-            for (const finding of f.findings.filter((x) => x.severity === severity)) {
-                allFindings.push({ filepath: f.filepath, ...finding });
-            }
-        }
-        if (allFindings.length === 0)
-            continue;
-        sections.push(`### ${severityLabel(severity)}\n`);
-        // Cap per-severity at 10 most impactful findings
-        for (const f of allFindings.slice(0, 10)) {
-            const loc = f.line ? `:${f.line}` : '';
-            const cwe = f.cwe ? ` · ${f.cwe}` : '';
-            const matched = f.matched ? `\n> Matched: \`${f.matched.substring(0, 80)}\`` : '';
-            sections.push(`**${f.category}** · \`${f.filepath}${loc}\`${cwe}  \n> ${f.description}${matched}\n`);
-        }
-        if (allFindings.length > 10) {
-            sections.push(`*... and ${allFindings.length - 10} more ${severity}-severity findings*\n`);
-        }
-    }
-    return sections.length > 0 ? sections.join('\n') : '*No findings.*\n';
-}
-function generateMarkdown(report, target, cwd) {
-    const { overallScore, grade, files, criticalCount, highCount, mediumCount, lowCount, scannedAt } = report;
-    const targetLabel = basename(target) || '.';
-    const dateStr = new Date(scannedAt).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
-    const badge = badgeUrl(overallScore, grade);
-    const summary = narrativeSummary(report);
-    const gradeIcon = gradeGlyph(grade);
-    const productCtx = loadProductContext(cwd);
-    const contextLine = productCtx
-        ? `\nProject: **${productCtx.name}** · Risk level: **${productCtx.riskLevel}**${productCtx.productionApp ? ' · Production' : ''}\n`
-        : '';
-    const recommendation = adjustRecommendation(report.recommendation, criticalCount, highCount, overallScore, productCtx);
-    return `# Security Audit Report · ${targetLabel}
-
-${gradeIcon} **Score: ${overallScore}/100 · Grade ${grade}**
-Generated ${dateStr} by [codehere](https://github.com/codehere-dev/codehere)
-${contextLine}
-> ${recommendation}
-
----
-
-## Summary
-
-${summary}
-
-| | |
-|---|---|
-| Files scanned | ${files.length} |
-| Critical | ${criticalCount > 0 ? `**${criticalCount}** ✕` : criticalCount} |
-| High | ${highCount > 0 ? `**${highCount}** !` : highCount} |
-| Medium | ${mediumCount} |
-| Low | ${lowCount} |
-
----
-
-## Findings
-
-${findingsMarkdown(files)}
-
----
-
-## Recommendations
-
-${recommendationsMarkdown(report)}
-
----
-
-## Add to your README
-
-\`\`\`markdown
-![codehere trust](${badge})
-\`\`\`
-
-Renders as: ![codehere trust](${badge})
-
----
-
-*Generated with [codehere](https://github.com/codehere-dev/codehere) — every AI action, traced. Every agent, verified.*
-`;
-}
-// ── Command ───────────────────────────────────────────────────────────────────
-// ── Simple (non-technical) output ────────────────────────────────────────────
-function generateSimpleReport(report, target) {
-    const { overallScore, grade, criticalCount, highCount, mediumCount, files } = report;
-    const targetLabel = basename(target) || 'your project';
-    const lines = [];
-    // Plain English headline
-    if (criticalCount > 0) {
-        lines.push(`Your AI assistant found ${criticalCount} serious problem${criticalCount !== 1 ? 's' : ''} in ${targetLabel} that need${criticalCount === 1 ? 's' : ''} fixing before you share this code.`);
-    }
-    else if (highCount > 0) {
-        lines.push(`${targetLabel} looks mostly safe. There ${highCount === 1 ? 'is' : 'are'} ${highCount} thing${highCount !== 1 ? 's' : ''} worth reviewing, but nothing that needs urgent attention.`);
-    }
-    else if (overallScore >= 90) {
-        lines.push(`${targetLabel} is clean. Your AI assistant found nothing concerning. You're good to go.`);
-    }
-    else {
-        lines.push(`${targetLabel} is in reasonable shape. A few minor things to be aware of, but nothing blocking.`);
-    }
-    lines.push('');
-    // Score in human terms
-    const gradeMeaning = grade === 'A'
-        ? 'Excellent'
-        : grade === 'B'
-            ? 'Good'
-            : grade === 'C'
-                ? 'Fair · some issues to address'
-                : grade === 'D'
-                    ? 'Needs work'
-                    : 'Urgent attention needed';
-    lines.push(`Security score: ${overallScore}/100 (${gradeMeaning})`);
-    lines.push(`Files checked: ${files.length}`);
-    lines.push('');
-    // What was found, in plain terms
-    if (criticalCount > 0 || highCount > 0 || mediumCount > 0) {
-        lines.push('What was found:');
-        if (criticalCount > 0) {
-            lines.push(`  • ${criticalCount} serious issue${criticalCount !== 1 ? 's' : ''} · things like exposed passwords, unsafe commands, or code that could be exploited`);
-        }
-        if (highCount > 0) {
-            lines.push(`  • ${highCount} notable issue${highCount !== 1 ? 's' : ''} · worth fixing, but not an emergency`);
-        }
-        if (mediumCount > 0) {
-            lines.push(`  • ${mediumCount} minor thing${mediumCount !== 1 ? 's' : ''} · good to know about, low urgency`);
-        }
-        lines.push('');
-    }
-    // Plain English what to do
-    lines.push('What to do:');
-    if (criticalCount > 0) {
-        lines.push(`  1. Ask your developer to look at the ${criticalCount} serious issue${criticalCount !== 1 ? 's' : ''} listed in the full report.`);
-        lines.push('  2. Do not share or deploy this code until those are resolved.');
-        if (highCount > 0) {
-            lines.push(`  3. The ${highCount} notable issue${highCount !== 1 ? 's' : ''} can be addressed in your next sprint.`);
-        }
-    }
-    else if (highCount > 0) {
-        lines.push(`  1. Ask your developer to review the ${highCount} notable issue${highCount !== 1 ? 's' : ''} when they get a chance.`);
-        lines.push('  2. This code is safe to continue working on in the meantime.');
-    }
-    else {
-        lines.push('  1. Keep going · this code is in good shape.');
-        lines.push('  2. Run this scan again before your next release.');
-    }
-    lines.push('');
-    lines.push('---');
-    lines.push('Generated by codehere · know what your AI agent did before your tech lead asks.');
-    return lines.join('\n');
-}
-/**
- * Write report to the requested path. If the path is unwritable (EROFS,
- * EACCES, EPERM, ENOENT on a parent dir we can't create), fall back to
- * stdout so the user still gets the report instead of a stack trace.
- *
- * Returns true if the file was written, false if we fell back to stdout.
- *
- * Provoked by rc.25 UAT: `codehere report --simple` from `/` crashed with
- * `EROFS: read-only file system, open 'codehere-audit.md'`. A user running
- * the command from any unwritable cwd should still get their report.
- */
-function writeReportWithFallback(targetPath, content, label) {
-    try {
-        writeFileSync(targetPath, content);
-        console.log(success(`${label} written to ${targetPath}`));
-        return true;
-    }
-    catch (e) {
-        const code = e.code ?? '';
-        if (['EROFS', 'EACCES', 'EPERM', 'ENOENT'].includes(code)) {
-            console.error(error(`Could not write to ${targetPath} (${code}). Printing to stdout instead · pass --out <path> to a writable location.`));
-            process.stdout.write(content + '\n');
-            return false;
-        }
-        throw e;
-    }
-}
-export async function executeReportCommand(target, options = {}) {
-    const cwd = process.cwd();
-    const resolved = target ? (isAbsolute(target) ? target : join(cwd, target)) : cwd;
-    // rc.18: explicit mutex on combinations Codex flagged as silently
-    // ambiguous. Two pairs:
-    //   format    {--json, --simple} — pick at most one output format
-    //   dest      {--stdout, --out}   — pick at most one destination
-    // Previously the second flag silently lost; now we error so users know.
-    if (options.json && options.simple) {
-        console.error(error('--json and --simple cannot be used together. Pick one output format.'));
-        process.exit(2);
-    }
-    if (options.stdout && options.out) {
-        console.error(error('--stdout and --out cannot be used together. Pick one destination.'));
-        process.exit(2);
-    }
-    // Default routing rules (after mutex check):
-    //   --json            → stdout (pipeable to jq, every CLI convention).
-    //   --simple / md     → file (user expects a shareable artifact, not a wall of markdown).
-    //   --out <path>      → wins over the default (explicit beats default).
-    //   --stdout          → forces stdout for non-json formats.
-    // Rationale: rc.15 — `report --json` writing to disk silently broke pipelines
-    // (`codehere report --json | jq` produced empty stdout). Stdout for machine-
-    // readable formats matches `kubectl get -o json`, `docker inspect`, etc.
-    const defaultOut = options.json
-        ? undefined // stdout
-        : 'codehere-audit.md';
-    const effectiveOut = options.stdout ? undefined : (options.out ?? defaultOut);
-    if (!existsSync(resolved)) {
-        console.error(error(`Not found: ${resolved}`));
-        process.exit(1);
-    }
-    // Collect and scan
-    const paths = collectCodeFiles(resolved);
-    if (paths.length === 0) {
-        console.log(info('No code files found to scan.'));
-        return;
-    }
-    // Show progress for large codebases
-    if (!effectiveOut && paths.length > 20 && process.stderr.isTTY) {
-        process.stderr.write(colors.dim(`  Scanning ${paths.length} files...`));
-    }
-    // S8 · same read semantics as `trust`: unreadable files are skipped, not
-    // crashed on — a different read-set was the other way the report could see
-    // a different score than the badge for the same target.
-    const results = [];
-    for (const p of paths) {
-        let code;
-        try {
-            code = readFileSync(p, 'utf-8');
-        }
-        catch {
-            continue;
-        }
-        results.push(scoreFile(relative(cwd, p), code));
-    }
-    // Clear progress line
-    if (!effectiveOut && paths.length > 20 && process.stderr.isTTY) {
-        process.stderr.write('\r\x1b[K');
-    }
-    // S8 · score + grade come from the ONE shared aggregation (trust-scorer's
-    // aggregateTrust) — this block used to duplicate trust-command's reduce-and-
-    // cap and the badge could disagree with the report for the same target.
-    const { overallScore, grade, criticalCount, highCount, mediumCount, lowCount, totalFindings } = aggregateTrust(results);
-    // Same rule as trust-command: a score aggregated over zero files is not a clean scan.
-    const scanned = results.length > 0;
-    const recommendation = criticalCount > 0
-        ? `${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} need${criticalCount === 1 ? 's' : ''} attention before this merges.`
-        : highCount > 0
-            ? `Nothing critical, but ${highCount} high-severity pattern${highCount !== 1 ? 's' : ''} worth addressing.`
-            : !scanned
-                ? 'No files scanned — nothing was graded.'
-                : overallScore >= 75
-                    ? 'Clean scan. Nothing blocking a merge.'
-                    : 'A few things to look at · nothing critical.';
-    const report = {
-        files: results,
-        scanned,
-        overallScore,
-        grade,
-        totalFindings,
-        criticalCount,
-        highCount,
-        mediumCount,
-        lowCount,
-        recommendation,
-        scannedAt: new Date().toISOString(),
-    };
-    if (paths.length > 20) {
-        process.stderr.write(' '.repeat(40) + '\r');
-    }
-    // JSON output
-    if (options.json) {
-        const output = JSON.stringify(report, null, 2);
-        if (effectiveOut) {
-            writeReportWithFallback(effectiveOut, output, 'Report');
-        }
-        else {
-            console.log(output);
-        }
-        return;
-    }
-    // Simple (non-technical) output
-    if (options.simple) {
-        const simple = generateSimpleReport(report, resolved);
-        if (effectiveOut) {
-            writeReportWithFallback(effectiveOut, simple, 'Plain-English report');
-        }
-        else {
-            process.stdout.write(simple + '\n');
-        }
-        return;
-    }
-    // Markdown output
-    const markdown = generateMarkdown(report, resolved, cwd);
-    if (effectiveOut) {
-        if (!writeReportWithFallback(effectiveOut, markdown, 'Report'))
-            return;
-        newline();
-        console.log(colors.dim(`  ${paths.length} files · score ${overallScore}/100 · grade ${grade}`));
-        if (criticalCount > 0) {
-            console.log(colors.red(`  ${criticalCount} critical issue${criticalCount !== 1 ? 's' : ''} · check the report`));
-        }
-        newline();
-        console.log(colors.dim('  Share it: paste it in your PR, add the badge to your README.'));
-        console.log(colors.dim('  Use --stdout to pipe the report instead of writing a file.'));
-        newline();
-    }
-    else {
-        // --stdout: print to stdout (can be piped)
-        process.stdout.write(markdown);
-    }
-}
-//# sourceMappingURL=report-command.js.map