easyvibegate 0.4.4

package/dist/cli/index.js

@@ -0,0 +1,402 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { createInterface } from 'node:readline';
+import { runFlow } from '../orchestrator/flow.js';
+import { badgeMarkdown, exitCodeFor, renderConsole, renderJson, renderMarkdown, renderNextSteps, renderVerdict, summarize, } from '../engine/report.js';
+import { buildAiFixPrompt } from '../engine/aifix.js';
+import { runWizard } from './wizard.js';
+import { pickLang } from '../engine/i18n.js';
+import { color } from '../engine/util/color.js';
+import { VERSION } from '../engine/version.js';
+const HELP = `
+🛡  easyvibegate — universal security scanner for vibe-coded apps
+
+Usage:
+  easyvibegate [path] [options]
+
+Just run \`easyvibegate\` in your project for a guided, beginner-friendly wizard.
+Level 0 (static, any stack) always runs. Level 1/2 need opt-in.
+A fix plan (ai-fix-prompt.md) is always written next to the report.
+
+Options:
+  -o, --output <dir>     Report directory (default: <project>/easyvibegate-report)
+  -f, --format <fmt>     all | md | json | none (default: all)
+      --ci               Non-interactive: no wizard, no prompts, quiet output
+  -c, --config <file>    Path to a easyvibegate config JSON
+
+  Level 1:
+      --deps             Run the dependency vulnerability audit
+
+  Level 2 (live probe — only against apps you own):
+      --url <appUrl>     Probe a running app: headers, exposed files, unauth endpoints
+      --supabase-url <u> Override the detected Supabase URL
+      --supabase-key <k> Override the detected Supabase anon key
+      --idor-tokens a,b  Two bearer tokens for the IDOR differential probe
+      --i-own-this       Authorize probing without interactive prompts (for CI)
+  -y, --yes              Assume yes to all consent prompts
+
+  Other:
+      --lang <ru|en>     Interface language (default: ru; use "en" for English)
+      --no-wizard        Skip the guided wizard; run directly and print results
+
+  -h, --help             Show help
+  -v, --version          Show version
+
+Exit codes (every mode): 2 = critical, 1 = warnings, 3 = a check did not complete, 0 = clean.
+Ethics: the live probe sends real requests. Only run it against systems you own.
+`;
+function parseArgs(argv) {
+    const a = {
+        path: '.',
+        format: 'all',
+        ci: false,
+        iOwnThis: false,
+        yes: false,
+        deps: false,
+        noWizard: false,
+        wizard: false,
+        badIdorTokens: false,
+        noReport: false,
+        unknown: [],
+        argErrors: [],
+        help: false,
+        version: false,
+    };
+    let sawPath = false;
+    let endOfFlags = false;
+    let i = 0;
+    // Read a required value; error if it's missing or looks like another flag.
+    const need = (name) => {
+        const v = argv[i + 1];
+        if (v === undefined || v.startsWith('-')) {
+            a.argErrors.push(`${name} needs a value`);
+            return undefined;
+        }
+        i++;
+        return v;
+    };
+    for (; i < argv.length; i++) {
+        const arg = argv[i];
+        if (endOfFlags) {
+            if (!sawPath) {
+                a.path = arg;
+                sawPath = true;
+            }
+            else
+                a.argErrors.push(`unexpected extra path "${arg}"`);
+            continue;
+        }
+        if (arg === '--') {
+            endOfFlags = true;
+            continue;
+        }
+        switch (arg) {
+            case '-h':
+            case '--help':
+                a.help = true;
+                break;
+            case '-v':
+            case '--version':
+                a.version = true;
+                break;
+            case '--ci':
+                a.ci = true;
+                break;
+            case '-o':
+            case '--output':
+                a.output = need('--output') ?? a.output;
+                break;
+            case '-f':
+            case '--format': {
+                const v = need('--format')?.toLowerCase();
+                if (v === undefined)
+                    break;
+                if (v === 'all' || v === 'md' || v === 'json' || v === 'none')
+                    a.format = v;
+                else
+                    a.argErrors.push(`--format must be one of all|md|json|none (got "${v}")`);
+                break;
+            }
+            case '--no-report':
+                a.noReport = true;
+                break;
+            case '-c':
+            case '--config':
+                a.config = need('--config');
+                break;
+            case '--url':
+                a.appUrl = need('--url');
+                break;
+            case '--supabase-url':
+                a.supabaseUrl = need('--supabase-url');
+                break;
+            case '--supabase-key':
+                a.supabaseKey = need('--supabase-key');
+                break;
+            case '--i-own-this':
+                a.iOwnThis = true;
+                break;
+            case '-y':
+            case '--yes':
+                a.yes = true;
+                break;
+            case '--deps':
+                a.deps = true;
+                break;
+            case '--no-wizard':
+            case '--scan':
+                a.noWizard = true;
+                break;
+            case '--wizard':
+                a.wizard = true;
+                break;
+            case '--lang': {
+                const v = need('--lang')?.toLowerCase();
+                if (v === undefined)
+                    break;
+                if (v === 'ru' || v === 'en')
+                    a.lang = v;
+                else
+                    a.argErrors.push(`--lang must be ru or en (got "${v}")`);
+                break;
+            }
+            case '--idor-tokens': {
+                const v = need('--idor-tokens');
+                if (v === undefined)
+                    break;
+                const parts = v.split(',').map((s) => s.trim()).filter(Boolean);
+                if (parts.length === 2)
+                    a.idorTokens = [parts[0], parts[1]];
+                else
+                    a.badIdorTokens = true;
+                break;
+            }
+            default:
+                if (arg.startsWith('-'))
+                    a.unknown.push(arg);
+                else if (!sawPath) {
+                    a.path = arg;
+                    sawPath = true;
+                }
+                else
+                    a.argErrors.push(`unexpected extra path "${arg}" — scan one project at a time`);
+        }
+    }
+    // Cross-option validation.
+    if (a.noReport)
+        a.format = 'none'; // wins regardless of flag order
+    if (a.wizard && a.noWizard)
+        a.argErrors.push('--wizard and --no-wizard cannot be combined');
+    if (a.output !== undefined && a.output.trim() === '')
+        a.argErrors.push('--output needs a directory path');
+    const httpish = (u) => /^https?:\/\//i.test(u);
+    if (a.appUrl && !httpish(a.appUrl))
+        a.argErrors.push('--url must start with http:// or https://');
+    if (a.supabaseUrl && !httpish(a.supabaseUrl))
+        a.argErrors.push('--supabase-url must start with http:// or https://');
+    if (!!a.supabaseUrl !== !!a.supabaseKey)
+        a.argErrors.push('--supabase-url and --supabase-key must be provided together');
+    if (a.idorTokens && !a.appUrl)
+        a.argErrors.push('--idor-tokens requires --url (the running app to probe)');
+    return a;
+}
+function ask(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    return new Promise((res) => {
+        let done = false;
+        const finish = (v) => { if (!done) {
+            done = true;
+            rl.close();
+            res(v);
+        } };
+        rl.question(question, finish);
+        rl.once('close', () => finish('')); // Ctrl-D / EOF = "no", never a silent hang
+    });
+}
+async function main() {
+    const args = parseArgs(process.argv.slice(2));
+    if (args.help) {
+        process.stdout.write(HELP);
+        return;
+    }
+    if (args.version) {
+        process.stdout.write(`easyvibegate ${VERSION}\n`);
+        return;
+    }
+    // Fail loudly on bad usage instead of silently doing the wrong thing.
+    if (args.unknown.length > 0) {
+        process.stderr.write(`easyvibegate: unknown option(s): ${args.unknown.join(', ')}\nRun with --help.\n`);
+        process.exit(2);
+    }
+    if (args.badIdorTokens) {
+        process.stderr.write('easyvibegate: --idor-tokens needs exactly two comma-separated tokens (tokenA,tokenB).\n');
+        process.exit(2);
+    }
+    if (args.argErrors.length > 0) {
+        process.stderr.write(`easyvibegate: ${args.argErrors.join('; ')}\nRun with --help.\n`);
+        process.exit(2);
+    }
+    const root = resolve(args.path);
+    if (!existsSync(root) || !statSync(root).isDirectory()) {
+        process.stderr.write(`easyvibegate: path not found or not a directory: ${root}\n`);
+        process.exit(2);
+    }
+    // An explicitly requested config must exist and be valid — silently falling
+    // back to defaults would apply different ignore rules than the user asked for.
+    if (args.config !== undefined) {
+        const problem = validateConfigFile(resolve(args.config));
+        if (problem) {
+            process.stderr.write(`easyvibegate: --config ${args.config}: ${problem}\n`);
+            process.exit(2);
+        }
+    }
+    const autoYes = args.iOwnThis || args.yes;
+    const lang = pickLang(args.lang);
+    // Reports land next to the scanned project by default, so scanning several
+    // projects from one shell never overwrites another project's report.
+    const outDir = args.output !== undefined ? resolve(args.output) : join(root, 'easyvibegate-report');
+    // Use the friendly wizard when a human runs it in a terminal without
+    // automation flags; --wizard forces it. Either way the pipeline below is shared.
+    // --ci is a non-interactive contract: never ask questions there.
+    const useWizard = !args.ci && (args.wizard || (!args.noWizard && !autoYes && !!process.stdin.isTTY));
+    // Asking for a live check in a run that can never confirm ownership is a
+    // misconfigured invocation, not a clean scan. Fail on the flags rather than
+    // silently skipping the very check the run was set up to perform.
+    const canConfirmOwnership = autoYes || useWizard || !!process.stdin.isTTY;
+    if (!canConfirmOwnership) {
+        const requested = [args.appUrl ? '--url' : '', args.supabaseUrl ? '--supabase-url' : ''].filter(Boolean);
+        if (requested.length > 0) {
+            process.stderr.write(`easyvibegate: ${requested.join(' and ')} asks for a live check, but this run is non-interactive and cannot confirm you own the target.\n` +
+                'Add --i-own-this to assert ownership, or run it in a terminal.\n');
+            process.exit(2);
+        }
+    }
+    let result;
+    if (useWizard) {
+        result = await runWizard({
+            path: args.path,
+            config: args.config,
+            lang,
+            appUrl: args.appUrl,
+            deps: args.deps,
+            idorTokens: args.idorTokens,
+            supabaseUrl: args.supabaseUrl,
+            supabaseKey: args.supabaseKey,
+            autoYes,
+        });
+    }
+    else {
+        const interactive = !!process.stdin.isTTY && !args.ci && !autoYes;
+        const log = (m) => { if (!args.ci)
+            process.stderr.write(color.gray(`  ${m}\n`)); };
+        const consent = async (req) => {
+            if (autoYes)
+                return true;
+            if (!interactive) {
+                process.stderr.write(color.gray(`  skipped ${req.kind} probe of ${req.target} — needs --i-own-this or an interactive terminal\n`));
+                return false;
+            }
+            const ans = await ask(color.yellow(`  Probe ${req.kind} → ${req.target}?\n    (${req.detail}) [y/N] `));
+            return /^y(es)?$/i.test(ans.trim());
+        };
+        result = await runFlow({
+            root,
+            configPath: args.config,
+            appUrl: args.appUrl,
+            supabaseUrl: args.supabaseUrl,
+            supabaseKey: args.supabaseKey,
+            runDeps: args.deps,
+            idorTokens: args.idorTokens,
+            consent,
+            log,
+        });
+    }
+    // ---- One shared pipeline: console, reports, verdict, exit code. ----
+    const summary = summarize(result.findings, result.runs);
+    if (!args.ci)
+        process.stdout.write(renderConsole(result, summary, lang) + '\n');
+    if (args.format !== 'none') {
+        const problem = prepareOutputDir(outDir);
+        if (problem) {
+            process.stderr.write(`easyvibegate: --output ${outDir}: ${problem}\n`);
+            process.exit(2);
+        }
+        const written = [];
+        if (args.format === 'all' || args.format === 'md') {
+            const p = join(outDir, 'report.md');
+            writeFileSync(p, renderMarkdown(result, summary, lang), 'utf8');
+            written.push(p);
+        }
+        if (args.format === 'all' || args.format === 'json') {
+            const p = join(outDir, 'report.json');
+            writeFileSync(p, renderJson(result, summary), 'utf8');
+            written.push(p);
+        }
+        // The fix plan is the whole point — always produce it alongside a report.
+        writeFileSync(join(outDir, 'ai-fix-prompt.md'), buildAiFixPrompt(result, summary, lang), 'utf8');
+        if (!args.ci && written.length) {
+            process.stdout.write(color.gray(`  report: ${written.join(', ')}\n`));
+            process.stdout.write(color.gray(`  badge:  ${badgeMarkdown(summary)}\n\n`));
+        }
+    }
+    if (!args.ci) {
+        process.stdout.write(renderVerdict(summary, lang) + '\n\n');
+        if (args.format !== 'none')
+            process.stdout.write(renderNextSteps(summary, outDir, lang));
+    }
+    // Same contract in every mode: 2 critical, 1 warning, 3 incomplete, 0 clean.
+    process.exit(exitCodeFor(summary));
+}
+/** Create the report dir and clear our own stale files, or explain why we cannot. */
+function prepareOutputDir(dir) {
+    try {
+        if (existsSync(dir) && !statSync(dir).isDirectory())
+            return 'exists and is not a directory';
+        mkdirSync(dir, { recursive: true });
+        // Old report.md next to a fresh report.json told two different stories.
+        for (const name of ['report.md', 'report.json', 'ai-fix-prompt.md']) {
+            const p = join(dir, name);
+            if (existsSync(p))
+                rmSync(p, { force: true });
+        }
+        return null;
+    }
+    catch (e) {
+        return e instanceof Error ? e.message : String(e);
+    }
+}
+/** Returns a human message when an explicitly given config is unusable. */
+function validateConfigFile(path) {
+    if (!existsSync(path))
+        return 'file not found';
+    if (!statSync(path).isFile())
+        return 'not a file';
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (e) {
+        return `invalid JSON (${e instanceof Error ? e.message : String(e)})`;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        return 'must be a JSON object';
+    const cfg = parsed;
+    const known = ['ignore', 'ignorePaths'];
+    for (const key of known) {
+        const v = cfg[key];
+        if (v === undefined)
+            continue;
+        if (!Array.isArray(v) || v.some((x) => typeof x !== 'string'))
+            return `"${key}" must be an array of strings`;
+    }
+    // A typo like "ignorePath" would silently do nothing — say so instead.
+    const unknown = Object.keys(cfg).filter((k) => !known.includes(k));
+    if (unknown.length)
+        return `unknown key(s): ${unknown.join(', ')} (expected ${known.join(', ')})`;
+    return null;
+}
+main().catch((err) => {
+    process.stderr.write(`easyvibegate: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
+    process.exit(1);
+});

package/dist/cli/wizard.js

@@ -0,0 +1,196 @@
+import { resolve } from 'node:path';
+import { createInterface } from 'node:readline';
+import { scanStatic } from '../engine/scan.js';
+import { runFlow } from '../orchestrator/flow.js';
+import { discoverSupabase } from '../engine/checkers/backend/supabase.js';
+import { discoverFirebase } from '../engine/checkers/backend/firebase.js';
+import { summarize } from '../engine/report.js';
+import { t } from '../engine/i18n.js';
+import { color } from '../engine/util/color.js';
+/**
+ * Normalize what a person types as a URL. Returns null if it cannot be one.
+ * Loopback and private hosts default to http:// — a dev server is almost never
+ * https, and silently guessing https makes the whole probe fail.
+ */
+export function normalizeUrl(input) {
+    const raw = input.trim();
+    if (raw === '' || /\s/.test(raw))
+        return null;
+    const hostPart = raw.replace(/^[a-z]+:\/\//i, '').split(/[/:?#]/)[0] ?? '';
+    const isLocal = /^(localhost|127(\.\d+){3}|0\.0\.0\.0|\[::1\]|10(\.\d+){3}|192\.168(\.\d+){2}|172\.(1[6-9]|2\d|3[01])(\.\d+){2})$/i.test(hostPart);
+    const withScheme = /^https?:\/\//i.test(raw) ? raw : `${isLocal ? 'http' : 'https'}://${raw}`;
+    try {
+        const u = new URL(withScheme);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:')
+            return null;
+        const host = u.hostname;
+        if (!(host === 'localhost' || host.startsWith('[') || /^[^.]+\.[^.]+/.test(host) || /^\d+(\.\d+){3}$/.test(host)))
+            return null;
+        return u.toString().replace(/\/$/, '');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read every line from a non-TTY stdin up front, so piped answers are not lost.
+ * An empty stream is zero answers, not one blank line: `''.split('\n')` yields
+ * `['']`, which reads as a deliberate Enter and would accept a question's
+ * default — opting into a network action nobody asked for. The trailing newline
+ * of a normal stream is dropped for the same reason.
+ */
+async function readPipedLines() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    const text = Buffer.concat(chunks).toString('utf8');
+    if (text === '')
+        return [];
+    return text.replace(/\r?\n$/, '').split('\n');
+}
+/**
+ * The beginner-friendly guided run: plain questions, plain answers.
+ * It only gathers input and runs the checks — writing reports, the verdict and
+ * the exit code stay in the CLI's single shared pipeline.
+ */
+export async function runWizard(args) {
+    const root = resolve(args.path);
+    const lang = args.lang;
+    const w = (s = '') => process.stdout.write(s + '\n');
+    const tty = !!process.stdin.isTTY;
+    const piped = tty ? [] : await readPipedLines();
+    let pipeIdx = 0;
+    const rl = tty ? createInterface({ input: process.stdin, output: process.stdout }) : null;
+    let inputEnded = false;
+    rl?.on('close', () => { inputEnded = true; });
+    /** Returns null when there is no answer left (EOF / Ctrl-D / exhausted pipe). */
+    const ask = (question) => {
+        if (inputEnded)
+            return Promise.resolve(null);
+        if (!rl) {
+            if (pipeIdx >= piped.length) {
+                inputEnded = true;
+                return Promise.resolve(null);
+            }
+            const line = piped[pipeIdx++] ?? '';
+            process.stdout.write(question + line + '\n');
+            return Promise.resolve(line.trim());
+        }
+        return new Promise((res) => {
+            let done = false;
+            const finish = (v) => { if (!done) {
+                done = true;
+                res(v);
+            } };
+            rl.question(question, (a) => finish(a.trim()));
+            // Ctrl-D closes the interface: answer "no input" instead of crashing the
+            // next question with ERR_USE_AFTER_CLOSE.
+            rl.once('close', () => { inputEnded = true; finish(null); });
+        });
+    };
+    /** No answer means "no" — never opt into a network action on EOF. */
+    const askYesNo = async (question, def) => {
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const raw = await ask(`${question} ${def ? '[Y/n]' : '[y/N]'} `);
+            if (raw === null)
+                return false;
+            const ans = raw.toLowerCase();
+            if (ans === '')
+                return def;
+            if (/^(y|yes|д|да|1)/.test(ans))
+                return true;
+            if (/^(n|no|н|нет|0)/.test(ans))
+                return false;
+            w(color.yellow(`  ${t(lang, 'wiz.answerUnclear', { input: raw })}`));
+        }
+        return false;
+    };
+    w();
+    w(`  ${color.bold('🛡  EasyVibeGate')}`);
+    w(color.gray(`  ${t(lang, 'wiz.sub1')}`));
+    w(color.gray(`  ${t(lang, 'wiz.sub2')}`));
+    w();
+    w(color.gray(`  ${t(lang, 'wiz.project', { root })}`));
+    w();
+    // Step 1 — static code review (always, safe).
+    w(`  ${color.bold(t(lang, 'wiz.step1'))}${color.gray(t(lang, 'wiz.step1hint'))}`);
+    const staticResult = await scanStatic(root, { configPath: args.config });
+    const s0 = summarize(staticResult.findings, staticResult.runs);
+    w(color.gray(`  ${t(lang, 'wiz.step1result', { files: staticResult.fileCount, crit: s0.counts.critical, warn: s0.counts.warning })}`));
+    w();
+    // Step 2 — dependencies (an explicit --deps already answers this).
+    w(`  ${color.bold(t(lang, 'wiz.step2'))}`);
+    const runDeps = args.deps ? true : await askYesNo(t(lang, 'wiz.qDeps'), true);
+    if (args.deps)
+        w(color.gray(`  --deps → ${t(lang, 'wiz.fromFlag')}`));
+    w();
+    // Step 3 — live checks (opt-in, own project only).
+    w(`  ${color.bold(t(lang, 'wiz.step3'))}${color.gray(t(lang, 'wiz.step3hint'))}`);
+    const sb = args.supabaseUrl && args.supabaseKey
+        ? { url: args.supabaseUrl, anonKey: args.supabaseKey, keyKind: 'jwt-anon' }
+        : discoverSupabase(staticResult.files);
+    const fb = discoverFirebase(staticResult.files);
+    let approveSupabase = false;
+    let approveFirebase = false;
+    if (sb) {
+        w(color.gray(t(lang, 'wiz.sbFound', { url: sb.url })));
+        w(color.gray(t(lang, 'wiz.sbDesc1')));
+        w(color.gray(t(lang, 'wiz.sbDesc2')));
+        approveSupabase = args.autoYes ? true : await askYesNo(t(lang, 'wiz.qSb'), false);
+        w();
+    }
+    if (fb) {
+        w(color.gray(t(lang, 'wiz.fbFound', { id: fb.projectId })));
+        approveFirebase = args.autoYes ? true : await askYesNo(t(lang, 'wiz.qFb'), false);
+        w();
+    }
+    // A URL from the command line wins; otherwise ask — and never silently discard
+    // a non-empty answer that merely lacks a scheme.
+    let appUrl = args.appUrl;
+    if (!appUrl) {
+        for (let attempt = 0; attempt < 2 && !appUrl; attempt++) {
+            const raw = await ask(t(lang, 'wiz.qUrl'));
+            if (raw === null || raw === '')
+                break; // EOF or empty = deliberately skip
+            const normalized = normalizeUrl(raw);
+            if (normalized) {
+                appUrl = normalized;
+                if (normalized !== raw)
+                    w(color.gray(`  → ${t(lang, 'wiz.urlNormalized', { url: normalized })}`));
+            }
+            else {
+                w(color.yellow(`  ${t(lang, 'wiz.urlInvalid', { input: raw })}`));
+            }
+        }
+    }
+    // Probing a live host always needs ownership confirmation, even from --url.
+    let approveLive = !!appUrl;
+    if (appUrl && !args.autoYes) {
+        approveLive = await askYesNo(t(lang, 'wiz.qOwn', { url: appUrl }), false);
+    }
+    rl?.close();
+    w();
+    const consent = async (req) => {
+        switch (req.kind) {
+            case 'supabase': return approveSupabase;
+            case 'firebase': return approveFirebase;
+            case 'live': return approveLive;
+            case 'idor': return approveLive && !!args.idorTokens;
+            default: return false;
+        }
+    };
+    const log = (m) => process.stdout.write(color.gray(`  … ${m}\n`));
+    w(`  ${color.bold(t(lang, 'wiz.running'))}`);
+    return runFlow({
+        root,
+        configPath: args.config,
+        appUrl: approveLive ? appUrl : undefined,
+        supabaseUrl: args.supabaseUrl,
+        supabaseKey: args.supabaseKey,
+        runDeps,
+        idorTokens: args.idorTokens,
+        precomputedStatic: staticResult,
+        consent,
+        log,
+    });
+}

package/dist/engine/aifix.js

@@ -0,0 +1,65 @@
+import { sortFindings, whereOf } from './report.js';
+import { t } from './i18n.js';
+import { VERSION } from './version.js';
+const LABEL = { critical: 'CRITICAL', warning: 'WARNING', info: 'INFO', advisory: 'ADVISORY' };
+/**
+ * Assemble a single "master fix prompt" to paste into Cursor/Claude/an AI agent.
+ * Actionable findings become numbered fix tasks; advisories become a manual
+ * verification checklist. Secrets are never included in raw form.
+ */
+export function buildAiFixPrompt(result, summary, lang = 'en') {
+    const all = sortFindings(result.findings);
+    const actionable = all.filter((f) => f.severity === 'critical' || f.severity === 'warning');
+    const advisories = all.filter((f) => f.severity === 'advisory');
+    const lines = [];
+    lines.push(t(lang, 'aifix.title'));
+    lines.push('');
+    lines.push(`Project: \`${result.root}\` · scanned by EasyVibeGate ${VERSION} at ${new Date().toISOString()}`);
+    lines.push('');
+    lines.push(t(lang, 'aifix.intro', { crit: summary.counts.critical, warn: summary.counts.warning, score: summary.score, gate: summary.gate.toUpperCase() }));
+    lines.push('');
+    lines.push(`## ${t(lang, 'aifix.rules')}`);
+    lines.push(t(lang, 'aifix.rule1'));
+    lines.push(t(lang, 'aifix.rule2'));
+    lines.push(t(lang, 'aifix.rule3'));
+    lines.push(t(lang, 'aifix.rule4'));
+    lines.push(t(lang, 'aifix.rule5'));
+    lines.push(t(lang, 'aifix.rule6'));
+    lines.push('');
+    lines.push(`## ${t(lang, 'aifix.issues')}`);
+    lines.push('');
+    if (actionable.length === 0) {
+        lines.push(t(lang, 'aifix.none'));
+    }
+    actionable.forEach((f, i) => {
+        lines.push(`### ${i + 1}. [${LABEL[f.severity]}] ${f.title}`);
+        lines.push(`- ${t(lang, 'aifix.location')}: \`${whereOf(f)}\``);
+        lines.push(`- ${t(lang, 'aifix.problem')}: ${f.detail}`);
+        lines.push(`- ${t(lang, 'aifix.fix')}: ${f.fix}`);
+        lines.push('');
+    });
+    if (advisories.length > 0) {
+        lines.push(`## ${t(lang, 'aifix.manual')}`);
+        lines.push('');
+        for (const f of advisories)
+            lines.push(`- ${f.title}: ${f.detail}`);
+        lines.push('');
+    }
+    // Checks that did not complete — the AI must not read a failed check as "clean".
+    const notDone = result.runs.filter((r) => r.status === 'failed' || r.status === 'partial' || r.status === 'unsupported');
+    if (notDone.length > 0) {
+        lines.push(`## ${t(lang, 'aifix.incomplete')}`);
+        lines.push('');
+        for (const r of notDone)
+            lines.push(`- \`${r.id}\` — ${r.status}${r.note ? ` (${r.note})` : ''}`);
+        lines.push('');
+        lines.push(t(lang, 'aifix.incompleteTask'));
+        lines.push('');
+    }
+    lines.push(`## ${t(lang, 'aifix.done')}`);
+    lines.push(t(lang, 'aifix.done1'));
+    lines.push(t(lang, 'aifix.done2'));
+    lines.push(t(lang, 'aifix.done3'));
+    lines.push('');
+    return lines.join('\n');
+}