ctxman 3.1.0 → 3.2.7

package/lib/policy/workspace.js

@@ -0,0 +1,254 @@
+/**
+ * Multi-repository workspace policy inspection & audit log aggregation
+ *
+ * Unlike `resolveWorkspaceRepos()`, `resolvePolicyWorkspaceDirs()` does NOT abort on the
+ * first invalid `.ctxman/policy.json` file so `ctxman policy check --repo ...` and MCP
+ * `check_policy` / `audit_log` can inspect and report all repositories in one pass.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { loadPolicy, PolicyConfigError } from './policy.js';
+import { auditLogFiles, readAuditLog, filterAuditEvents } from './audit.js';
+
+function sanitizeAlias(raw) {
+  const cleaned = String(raw || 'repo')
+    .trim()
+    .replace(/[\\/]+/g, '-')
+    .replace(/^\.+/, '');
+  return cleaned || 'repo';
+}
+
+function buildWorkspaceInputs(primaryRoot, extraRepos = []) {
+  const resolvedPrimary = path.resolve(primaryRoot || process.cwd());
+  if (!Array.isArray(extraRepos) || extraRepos.length === 0) {
+    return [resolvedPrimary];
+  }
+  const realPrimary = fs.existsSync(resolvedPrimary)
+    ? fs.realpathSync(resolvedPrimary)
+    : resolvedPrimary;
+  const isContainerOfExtra = extraRepos.some((item) => {
+    const raw = typeof item === 'string' ? item : item?.path;
+    if (typeof raw !== 'string' || !raw.trim()) return false;
+    const resolved = path.resolve(raw);
+    const real = fs.existsSync(resolved) ? fs.realpathSync(resolved) : resolved;
+    return real !== realPrimary && real.startsWith(realPrimary + path.sep);
+  });
+  return isContainerOfExtra ? [...extraRepos] : [resolvedPrimary, ...extraRepos];
+}
+
+/**
+ * Resolve, validate directory existence, deduplicate, and assign unique aliases without
+ * failing on invalid policy files.
+ *
+ * @param {string} primaryRoot
+ * @param {Array<string|{path: string, alias?: string}>} [extraRepos]
+ * @returns {Array<{alias: string, root: string, realRoot: string}>}
+ */
+export function resolvePolicyWorkspaceDirs(primaryRoot, extraRepos = []) {
+  const inputs = buildWorkspaceInputs(primaryRoot, extraRepos);
+  const rawEntries = [];
+  const seenRealRoots = new Set();
+
+  for (const item of inputs) {
+    const rawPath = typeof item === 'string' ? item : item?.path;
+    const explicitAlias = typeof item === 'object' && item !== null ? item.alias : undefined;
+    if (typeof rawPath !== 'string' || !rawPath.trim()) {
+      throw new Error('Repository path must be a non-empty string');
+    }
+    const resolved = path.resolve(rawPath);
+    if (!fs.statSync(resolved, { throwIfNoEntry: false })?.isDirectory()) {
+      throw new Error(`Not a directory: ${rawPath}`);
+    }
+    const realRoot = fs.realpathSync(resolved);
+    if (seenRealRoots.has(realRoot)) continue;
+    seenRealRoots.add(realRoot);
+
+    rawEntries.push({
+      root: resolved,
+      realRoot,
+      explicitAlias: explicitAlias ? sanitizeAlias(explicitAlias) : null,
+      baseName: sanitizeAlias(path.basename(resolved) || path.basename(realRoot) || 'repo'),
+      parentName: sanitizeAlias(path.basename(path.dirname(resolved))),
+    });
+  }
+
+  const baseCounts = new Map();
+  for (const entry of rawEntries) {
+    const candidate = entry.explicitAlias ?? entry.baseName;
+    baseCounts.set(candidate, (baseCounts.get(candidate) ?? 0) + 1);
+  }
+
+  const usedAliases = new Set();
+  return rawEntries.map((entry) => {
+    let candidate = entry.explicitAlias ?? entry.baseName;
+    if (!entry.explicitAlias && (baseCounts.get(candidate) ?? 0) > 1 && entry.parentName) {
+      candidate = `${entry.parentName}-${entry.baseName}`;
+    }
+    let unique = candidate;
+    let suffix = 2;
+    while (usedAliases.has(unique)) {
+      unique = `${candidate}-${suffix++}`;
+    }
+    usedAliases.add(unique);
+    return {
+      alias: unique,
+      root: entry.root,
+      realRoot: entry.realRoot,
+    };
+  });
+}
+
+/**
+ * Validate and summarize export policies across a multi-repository workspace.
+ *
+ * @param {string} primaryRoot
+ * @param {Array<string|{path: string, alias?: string}>} [extraRepos]
+ * @param {object} [options]
+ * @param {object} [options.env=process.env]
+ * @returns {object}
+ */
+export function checkWorkspacePolicies(primaryRoot, extraRepos = [], { env = process.env } = {}) {
+  const dirs = resolvePolicyWorkspaceDirs(primaryRoot, extraRepos);
+  const repoResults = [];
+  const validPolicies = [];
+
+  for (const { alias, root } of dirs) {
+    try {
+      const policy = loadPolicy(root, { env });
+      validPolicies.push({ alias, policy });
+      repoResults.push({
+        alias,
+        valid: true,
+        ...policy.toJSON(),
+      });
+    } catch (error) {
+      if (!(error instanceof PolicyConfigError)) throw error;
+      repoResults.push({
+        alias,
+        root,
+        valid: false,
+        file: error.file,
+        errors: error.errors,
+        message: error.message,
+      });
+    }
+  }
+
+  const valid = repoResults.every((r) => r.valid);
+  const active = validPolicies.some(({ policy }) => policy.active);
+  const requireRedaction = validPolicies.some(({ policy }) => policy.requireRedaction);
+  const tokenLimits = validPolicies
+    .map(({ policy }) => policy.maxExportTokens)
+    .filter((n) => typeof n === 'number');
+  const maxExportTokens = tokenLimits.length > 0 ? Math.min(...tokenLimits) : null;
+
+  const modelRules = validPolicies.flatMap(({ alias, policy }) =>
+    policy.modelRules.map(({ scope, file, patterns }) => ({
+      repo: alias,
+      scope,
+      file,
+      patterns,
+    }))
+  );
+  const ignoreFiles = [...new Set(validPolicies.flatMap(({ policy }) => policy.ignoreFiles))];
+
+  return {
+    valid,
+    active,
+    requireRedaction,
+    maxExportTokens,
+    allowedTargetModels: modelRules.length > 0 ? modelRules : null,
+    ignoreFiles,
+    repos: repoResults,
+  };
+}
+
+/**
+ * Read, tag with `repo`, deduplicate, and chronologically merge export audit logs across
+ * a multi-repository workspace.
+ *
+ * @param {string} primaryRoot
+ * @param {Array<string|{path: string, alias?: string}>} [extraRepos]
+ * @param {object} [options]
+ * @param {Date|null} [options.since=null]
+ * @param {number|null} [options.limit=null]
+ * @param {object} [options.env=process.env]
+ * @returns {object}
+ */
+export function readWorkspaceAuditLogs(
+  primaryRoot,
+  extraRepos = [],
+  { since = null, limit = null, env = process.env } = {}
+) {
+  const dirs = resolvePolicyWorkspaceDirs(primaryRoot, extraRepos);
+  const aliasByRoot = new Map();
+  for (const dir of dirs) {
+    aliasByRoot.set(dir.root, dir.alias);
+    aliasByRoot.set(dir.realRoot, dir.alias);
+  }
+
+  const seenEventIds = new Set();
+  const seenFiles = new Set();
+  const allFiles = [];
+  const existingFiles = [];
+  const missingFiles = [];
+  const policyErrors = [];
+  const mergedEvents = [];
+  let skippedLines = 0;
+
+  for (const { alias, root } of dirs) {
+    const { files, error } = auditLogFiles(root, { env });
+    if (error) {
+      policyErrors.push({ repo: alias, root, message: error.message });
+    }
+
+    const unreadFiles = files.filter((file) => {
+      const resolvedFile = path.resolve(file);
+      if (seenFiles.has(resolvedFile)) return false;
+      seenFiles.add(resolvedFile);
+      allFiles.push(file);
+      return true;
+    });
+    if (unreadFiles.length === 0) continue;
+
+    const { events, skipped, missing } = readAuditLog(unreadFiles);
+    skippedLines += skipped;
+    for (const file of unreadFiles) {
+      if (missing.includes(file)) missingFiles.push(file);
+      else existingFiles.push(file);
+    }
+
+    for (const event of events) {
+      if (event.id && seenEventIds.has(event.id)) continue;
+      if (event.id) seenEventIds.add(event.id);
+      let eventRepo = event.repo ?? null;
+      if (!eventRepo && typeof event.root === 'string') {
+        const resolvedEventRoot = path.resolve(event.root);
+        const realEventRoot = fs.existsSync(resolvedEventRoot)
+          ? fs.realpathSync(resolvedEventRoot)
+          : resolvedEventRoot;
+        eventRepo = aliasByRoot.get(resolvedEventRoot) ?? aliasByRoot.get(realEventRoot) ?? null;
+      }
+      mergedEvents.push({
+        repo: eventRepo ?? alias,
+        ...event,
+      });
+    }
+  }
+
+  mergedEvents.sort((a, b) => String(a.timestamp).localeCompare(String(b.timestamp)));
+  const matching = filterAuditEvents(mergedEvents, { since });
+  const selected = filterAuditEvents(matching, { limit });
+
+  return {
+    repos: dirs.map(({ alias, root }) => ({ alias, root })),
+    files: existingFiles,
+    allFiles,
+    missing: missingFiles,
+    total: matching.length,
+    events: selected,
+    skippedLines,
+    policyErrors,
+  };
+}

package/lib/pr/pr-context.js

@@ -17,6 +17,7 @@ import FileUtils from '../utils/file-utils.js';
 import TokenUtils from '../utils/token-utils.js';
 import { redactSecrets } from '../utils/secret-redactor.js';
 import { readFileChecked } from '../utils/safe-read.js';
+import { resolveWorkspaceRepos, enforceWorkspacePolicies } from '../workspace/index.js';
 import PrGit, { bufferToText } from './pr-git.js';
 import {
   parseNameStatus,
@@ -53,6 +54,7 @@ const DEFAULTS = {
   redact: true,
   maxFileBytes: 1024 * 1024,
   maxRelatedTests: 50,
+  repos: null,
 };
 
 // Test files read to look for imports and references: per file, and for all of them
@@ -65,6 +67,7 @@ const FILTER_NAMES = {
   context: '.contextignore',
   'context-include': '.contextinclude',
 };
+const IMPACT_ORDER = { low: 0, medium: 1, high: 2 };
 
 /**
  * Check and complete the options
@@ -273,35 +276,58 @@ function describeDropped(dropped) {
   return labels;
 }
 
-/**
- * Build the review context for a branch, the staged changes or the working tree
- * @param {string} [root=process.cwd()] - Project directory (inside a git work tree); a
- *   subdirectory limits the change to that directory
- * @param {object} [options]
- * @param {string} [options.base] - Base revision (default: origin/HEAD, else main, else master;
- *   HEAD with staged/working)
- * @param {string} [options.head='HEAD'] - Head revision
- * @param {boolean} [options.staged] - Compare the index with the base instead
- * @param {boolean} [options.working] - Compare the working tree (with untracked files)
- * @param {number} [options.unified=3] - Context lines in the diff
- * @param {boolean} [options.diff=true] - Include the unified diff
- * @param {boolean} [options.withTests] - Include related tests' contents
- * @param {boolean} [options.withFiles] - Include changed files' full contents
- * @param {string} [options.ask] - Question appended at the end
- * @param {string} [options.instructions] - Instructions appended at the end
- * @param {number} [options.budget] - Maximum tokens of the output
- * @param {'markdown'|'xml'|'json'} [options.style='markdown']
- * @param {boolean} [options.redact=true] - Mask secrets in contents, diff and commit messages
- * @returns {Promise<object>} `output` (the rendered text), `tokens`, per-section `sections`
- *   token counts, the collected `commits`, `files`, `methods`, `relatedTests`, `stats`,
- *   `budget` (limit, dropped, over), `redactions` and `warnings`
- */
-export async function buildPrContext(root = process.cwd(), options = {}) {
-  const opts = normalizePrOptions(options);
-  const rootPath = path.resolve(root);
-  if (!fs.existsSync(rootPath) || !fs.statSync(rootPath).isDirectory()) {
-    throw new Error(`Not a directory: ${rootPath}`);
+function buildWorkspaceRepoInputs(primaryRoot, extraRepos) {
+  const realPrimary = fs.existsSync(primaryRoot)
+    ? fs.realpathSync(primaryRoot)
+    : path.resolve(primaryRoot);
+  const isContainerOfExtra = extraRepos.some((item) => {
+    const raw = typeof item === 'string' ? item : item?.path;
+    if (typeof raw !== 'string' || !raw.trim()) return false;
+    const resolved = path.resolve(raw);
+    const real = fs.existsSync(resolved) ? fs.realpathSync(resolved) : resolved;
+    return real !== realPrimary && real.startsWith(realPrimary + path.sep);
+  });
+  if (isContainerOfExtra || !PrGit.findRepoRoot(realPrimary)) {
+    return [...extraRepos];
   }
+  return [primaryRoot, ...extraRepos];
+}
+
+function prefixDiffWithAlias(diffText, alias) {
+  if (!diffText) return diffText;
+  return diffText
+    .split('\n')
+    .map((line) => {
+      if (line.startsWith('diff --git a/')) {
+        return line.replace(
+          /^diff --git a\/(.+?) b\/(.+)$/,
+          `diff --git a/${alias}/$1 b/${alias}/$2`
+        );
+      }
+      if (line.startsWith('--- a/')) {
+        return `--- a/${alias}/${line.slice(6)}`;
+      }
+      if (line.startsWith('+++ b/')) {
+        return `+++ b/${alias}/${line.slice(6)}`;
+      }
+      if (line.startsWith('rename from ')) {
+        return `rename from ${alias}/${line.slice(12)}`;
+      }
+      if (line.startsWith('rename to ')) {
+        return `rename to ${alias}/${line.slice(10)}`;
+      }
+      if (line.startsWith('copy from ')) {
+        return `copy from ${alias}/${line.slice(10)}`;
+      }
+      if (line.startsWith('copy to ')) {
+        return `copy to ${alias}/${line.slice(8)}`;
+      }
+      return line;
+    })
+    .join('\n');
+}
+
+function collectSingleRepoPr(rootPath, opts) {
   const repoTop = PrGit.findRepoRoot(rootPath);
   if (!repoTop) throw new Error(`Not inside a git repository: ${rootPath}`);
   const repoRoot = fs.realpathSync(repoTop);
@@ -635,7 +661,10 @@ export async function buildPrContext(root = process.cwd(), options = {}) {
     );
   }
 
-  // --- render within the budget ------------------------------------------------------------
+  return { model, scope, redactions, warnings };
+}
+
+function renderModelWithinBudget(model, opts, redactions, warnings, scope) {
   const count = (text) => TokenUtils.calculate(text, 'pr-context.md');
   const dropped = {
     contents: [],
@@ -691,6 +720,7 @@ export async function buildPrContext(root = process.cwd(), options = {}) {
   }
 
   return {
+    ...(model.repos ? { repos: model.repos } : {}),
     output: result.output,
     tokens: result.tokens,
     style: opts.style,
@@ -704,8 +734,9 @@ export async function buildPrContext(root = process.cwd(), options = {}) {
     budget: model.budget,
     commits: model.commits,
     files: model.files,
-    methods: { changed: methods, deleted: deletedMethods },
-    relatedTests: tests.map(({ path: testPath, reasons, changed, excluded }) => ({
+    methods: { changed: model.methods, deleted: model.deletedMethods },
+    relatedTests: model.tests.map(({ path: testPath, reasons, changed, excluded, repo }) => ({
+      ...(repo ? { repo } : {}),
       path: testPath,
       reasons,
       changed,
@@ -716,6 +747,236 @@ export async function buildPrContext(root = process.cwd(), options = {}) {
   };
 }
 
+/**
+ * Build the review context for a branch, the staged changes or the working tree
+ * @param {string} [root=process.cwd()] - Project directory (inside a git work tree); a
+ *   subdirectory limits the change to that directory
+ * @param {object} [options]
+ * @param {string} [options.base] - Base revision (default: origin/HEAD, else main, else master;
+ *   HEAD with staged/working)
+ * @param {string} [options.head='HEAD'] - Head revision
+ * @param {boolean} [options.staged] - Compare the index with the base instead
+ * @param {boolean} [options.working] - Compare the working tree (with untracked files)
+ * @param {number} [options.unified=3] - Context lines in the diff
+ * @param {boolean} [options.diff=true] - Include the unified diff
+ * @param {boolean} [options.withTests] - Include related tests' contents
+ * @param {boolean} [options.withFiles] - Include changed files' full contents
+ * @param {string} [options.ask] - Question appended at the end
+ * @param {string} [options.instructions] - Instructions appended at the end
+ * @param {number} [options.budget] - Maximum tokens of the output
+ * @param {'markdown'|'xml'|'json'} [options.style='markdown']
+ * @param {boolean} [options.redact=true] - Mask secrets in contents, diff and commit messages
+ * @param {Array<string|{path: string, alias?: string}>} [options.repos] - Additional workspace repositories
+ * @returns {Promise<object>} `output` (the rendered text), `tokens`, per-section `sections`
+ *   token counts, the collected `commits`, `files`, `methods`, `relatedTests`, `stats`,
+ *   `budget` (limit, dropped, over), `redactions` and `warnings`
+ */
+export async function buildPrContext(root = process.cwd(), options = {}) {
+  const opts = normalizePrOptions(options);
+  const rootPath = path.resolve(root);
+  if (!fs.existsSync(rootPath) || !fs.statSync(rootPath).isDirectory()) {
+    throw new Error(`Not a directory: ${rootPath}`);
+  }
+
+  const isWorkspace = Array.isArray(options.repos) && options.repos.length > 0;
+  if (!isWorkspace) {
+    const { model, scope, redactions, warnings } = collectSingleRepoPr(rootPath, opts);
+    return renderModelWithinBudget(model, opts, redactions, warnings, scope);
+  }
+
+  const resolvedRepos = resolveWorkspaceRepos(buildWorkspaceRepoInputs(rootPath, options.repos));
+  enforceWorkspacePolicies(resolvedRepos, {
+    filesByRepo: new Map(),
+    tokens: 0,
+    redact: opts.redact,
+  });
+
+  for (const repo of resolvedRepos) {
+    if (!PrGit.findRepoRoot(repo.realRoot)) {
+      throw new Error(`Not inside a git repository: ${repo.root}`);
+    }
+  }
+
+  const perRepoResults = [];
+  const skippedErrors = [];
+  let firstError = null;
+
+  for (const repo of resolvedRepos) {
+    try {
+      const single = collectSingleRepoPr(repo.root, { ...opts, budget: null });
+      perRepoResults.push({ repo, ...single });
+    } catch (error) {
+      if (error.name === 'PolicyConfigError' || error.name === 'PolicyViolationError') {
+        throw error;
+      }
+      firstError ??= error;
+      skippedErrors.push({ repo, error });
+    }
+  }
+
+  if (perRepoResults.length === 0 && firstError) {
+    throw firstError;
+  }
+
+  const warnings = [];
+  for (const { repo, error } of skippedErrors) {
+    warnings.push(`${repo.alias}: skipped (${error.message})`);
+  }
+
+  const redactions = {};
+  const commits = [];
+  const files = [];
+  const methods = [];
+  const deletedMethods = [];
+  const diffs = [];
+  const allTests = [];
+  const contents = [];
+  const byStatus = {};
+  const filesByRepo = new Map(resolvedRepos.map((r) => [r.alias, []]));
+
+  let highestImpact = { level: 'low', score: 0 };
+
+  for (const { repo, model: m, redactions: r, warnings: w } of perRepoResults) {
+    for (const [type, count] of Object.entries(r)) {
+      redactions[type] = (redactions[type] || 0) + count;
+    }
+    for (const warning of w) {
+      warnings.push(`${repo.alias}: ${warning}`);
+    }
+    if (
+      (IMPACT_ORDER[m.impact.level] ?? 0) > (IMPACT_ORDER[highestImpact.level] ?? 0) ||
+      m.impact.score > highestImpact.score
+    ) {
+      highestImpact = {
+        level:
+          (IMPACT_ORDER[m.impact.level] ?? 0) >= (IMPACT_ORDER[highestImpact.level] ?? 0)
+            ? m.impact.level
+            : highestImpact.level,
+        score: Math.max(highestImpact.score, m.impact.score),
+      };
+    }
+    for (const [status, cnt] of Object.entries(m.stats.byStatus)) {
+      byStatus[status] = (byStatus[status] || 0) + cnt;
+    }
+    for (const c of m.commits) {
+      commits.push({ ...c, repo: repo.alias });
+    }
+    for (const f of m.files) {
+      filesByRepo.get(repo.alias)?.push({ path: f.path, tokens: 0 });
+      files.push({
+        ...f,
+        repo: repo.alias,
+        path: `${repo.alias}/${f.path}`,
+        oldPath: f.oldPath ? `${repo.alias}/${f.oldPath}` : null,
+      });
+    }
+    for (const method of m.methods) {
+      methods.push({
+        ...method,
+        repo: repo.alias,
+        file: `${repo.alias}/${method.file}`,
+      });
+    }
+    for (const dm of m.deletedMethods) {
+      deletedMethods.push({
+        ...dm,
+        repo: repo.alias,
+        file: `${repo.alias}/${dm.file}`,
+      });
+    }
+    for (const d of m.diffs) {
+      diffs.push({
+        ...d,
+        repo: repo.alias,
+        path: `${repo.alias}/${d.path}`,
+        text: prefixDiffWithAlias(d.text, repo.alias),
+      });
+    }
+    for (const t of m.tests) {
+      allTests.push({
+        ...t,
+        repo: repo.alias,
+        path: `${repo.alias}/${t.path}`,
+      });
+    }
+    for (const c of m.contents) {
+      contents.push({
+        ...c,
+        repo: repo.alias,
+        path: `${repo.alias}/${c.path}`,
+      });
+    }
+  }
+
+  const tests = allTests.slice(0, opts.maxRelatedTests);
+  if (allTests.length > tests.length) {
+    warnings.push(
+      `${allTests.length} related tests found across workspace; the first ${tests.length} are listed`
+    );
+  }
+
+  const uniqueJoin = (values) => [...new Set(values.filter(Boolean))].join(', ');
+  const firstModel = perRepoResults[0].model;
+  const baseRef = uniqueJoin(perRepoResults.map((x) => x.model.base.ref));
+  const baseShort = uniqueJoin(perRepoResults.map((x) => x.model.base.short));
+  const headRef = uniqueJoin(perRepoResults.map((x) => x.model.head.ref));
+  const headShort = uniqueJoin(perRepoResults.map((x) => x.model.head.short));
+  const mergeShort = uniqueJoin(perRepoResults.map((x) => x.model.mergeBase.short));
+
+  const workspaceModel = {
+    repos: resolvedRepos.map(({ alias, root: r }) => ({ alias, root: r })),
+    mode: firstModel.mode,
+    base: { ref: baseRef, sha: firstModel.base.sha, short: baseShort || null },
+    head:
+      firstModel.mode === 'range'
+        ? { ref: headRef, sha: firstModel.head.sha, short: headShort || null }
+        : { ref: headRef, sha: null, short: null },
+    mergeBase: { sha: firstModel.mergeBase.sha, short: mergeShort },
+    scope: '',
+    impact: highestImpact,
+    stats: {
+      commits: commits.length,
+      files: files.length,
+      byStatus,
+      additions: files.reduce((sum, f) => sum + f.additions, 0),
+      deletions: files.reduce((sum, f) => sum + f.deletions, 0),
+      excluded: files.filter((f) => f.excluded).length,
+      changedMethods: methods.length,
+      addedMethods: methods.filter((m) => m.change === 'added').length,
+      deletedMethods: deletedMethods.length,
+      relatedTests: tests.length,
+    },
+    commits,
+    files,
+    methods,
+    deletedMethods,
+    diffEnabled: opts.diff,
+    diffs,
+    tests,
+    withTests: opts.withTests,
+    withFiles: opts.withFiles,
+    contents,
+    instructions: opts.instructions,
+    ask: opts.ask,
+    budget: opts.budget ? { limit: opts.budget, dropped: [], over: false } : null,
+    tokens: null,
+    logBodiesDropped: false,
+    logDropped: false,
+    filesDropped: false,
+    methodsDropped: false,
+  };
+
+  const rendered = renderModelWithinBudget(workspaceModel, opts, redactions, warnings, '');
+
+  enforceWorkspacePolicies(resolvedRepos, {
+    filesByRepo,
+    tokens: rendered.tokens,
+    redact: opts.redact,
+  });
+
+  return rendered;
+}
+
 /**
  * What the budget drops, least important first: full file contents, test contents, related
  * test paths, per-file diffs, method sources, the methods list, commit bodies, the commit