packlight-cli 0.0.0-stage → 0.1.1

package/dist/report/fix.d.ts

@@ -0,0 +1,46 @@
+import type { BudgetObservation, Inventory, Kind } from '../core/types.js';
+import { type ListingEntry, type Suggestion } from './suggest.js';
+/** The listing for the scan's scope: its own project's newest, else the newest anywhere. */
+export declare function newestBudget(inv: Inventory): BudgetObservation | undefined;
+export interface ListingProjection {
+    chars: number;
+    described: number;
+    dropped: number;
+}
+export interface FixPlan {
+    /** Archive targets, plugin-level (CEO O3). */
+    ids: string[];
+    /** Targets by kind, and everything they turn off counting plugin parts. */
+    byKind: Partial<Record<Kind, number>>;
+    turnsOff: number;
+    listing: {
+        before: ListingProjection;
+        after: ListingProjection;
+        observedAt: string | null;
+    } | null;
+    /** Skills that get their description back in the listing. */
+    descriptionsBack: number;
+    /** Fewer characters in every session: the listing, agent descriptions, MCP tool lists and session-start hook text. */
+    sessionCharsSaved: number;
+    /** Unused items packlight may not remove; the totals count them on top of the archive (cumulative). */
+    byHand: {
+        items: ByHand[];
+        descriptionsBack: number;
+        sessionCharsSaved: number;
+    } | null;
+}
+/** The skill listing as entries, in the order Claude Code logged it, without the items in `gone`. */
+export declare function listingEntries(inv: Inventory, b: BudgetObservation, gone?: Set<string>): ListingEntry[];
+export interface ByHand {
+    id: string;
+    name: string;
+    kind: Kind;
+    where: string;
+    turnsOff: number;
+}
+/**
+ * One-click fix: archive every suggested item (plugin-level), and say what it buys. Suggestions already exclude
+ * anything used, kept, too new or ambiguous. Items only removable by hand (claude.ai synced skills, the Claude
+ * app's own plugins) that pass the same rules are listed separately with what removing them too would buy.
+ */
+export declare function fixPlan(inv: Inventory, sug: Map<string, Suggestion>, keptIds?: Set<string>): FixPlan;

package/dist/report/fix.js

@@ -0,0 +1,116 @@
+import { MIN_DAYS, MIN_SESSIONS, simulateListing } from './suggest.js';
+/** The listing for the scan's scope: its own project's newest, else the newest anywhere. */
+export function newestBudget(inv) {
+    const own = inv.projectScope !== 'global' ? inv.budget[inv.projectScope] : undefined;
+    return own ?? Object.values(inv.budget).sort((a, b) => (a.timestamp ?? '').localeCompare(b.timestamp ?? '')).at(-1);
+}
+/** The skill listing as entries, in the order Claude Code logged it, without the items in `gone`. */
+export function listingEntries(inv, b, gone = new Set()) {
+    const byKey = new Map();
+    for (const i of inv.items)
+        for (const k of i.logKeys)
+            if (!byKey.has(k))
+                byKey.set(k, i);
+    const priority = new Set(inv.listingPriority ?? []);
+    const lines = b.entries ?? [...b.withDescription.map(name => ({ name, chars: 0, described: true })), ...b.dropped.map(name => ({ name, chars: 0, described: false }))];
+    const out = [];
+    for (const l of lines) {
+        const it = byKey.get(l.name);
+        if (it && gone.has(it.id))
+            continue;
+        const nameChars = l.name.length + 3;
+        const full = l.described && l.chars ? l.chars : it?.standingChars ? it.standingChars : l.chars || nameChars;
+        // Skills Claude Code counts as used, and its own bundled skills (no file packlight knows), go first.
+        out.push({ name: l.name, nameChars, fullChars: Math.max(full, nameChars), priority: priority.has(l.name) || !it });
+    }
+    return out;
+}
+/**
+ * One-click fix: archive every suggested item (plugin-level), and say what it buys. Suggestions already exclude
+ * anything used, kept, too new or ambiguous. Items only removable by hand (claude.ai synced skills, the Claude
+ * app's own plugins) that pass the same rules are listed separately with what removing them too would buy.
+ */
+export function fixPlan(inv, sug, keptIds = new Set()) {
+    const plugins = new Map(inv.items.filter(i => i.kind === 'plugin').map(p => [p.plugin, p]));
+    const pluginOf = (i) => (i.plugin && i.kind !== 'plugin' ? plugins.get(i.plugin) ?? i : i);
+    const partsOf = (p) => inv.items.filter(m => m.plugin === p.plugin && m.kind !== 'plugin');
+    const inScope = (i) => inv.projectScope === 'global' || i.projectRoot === null || i.projectRoot === inv.projectScope;
+    const targets = new Map();
+    for (const i of inv.items) {
+        if (i.kind === 'instructions' || !inScope(i) || !sug.get(i.id)?.suggested)
+            continue;
+        const t = pluginOf(i);
+        if (sug.get(t.id)?.suggested)
+            targets.set(t.id, t);
+    }
+    // By hand: the suggestion rules minus the removal method. A plugin qualifies only when no part was used or kept.
+    const qualifiesByHand = (i) => {
+        const s = sug.get(i.id);
+        return !!s && s.reason === 'manual' && !i.removal.suite && i.enabled && !keptIds.has(i.id) && !i.usage.total && !i.usage.ambiguous && !i.usage.uncertain
+            && s.windowSessions >= MIN_SESSIONS && s.windowDays >= MIN_DAYS && !s.unreadableLines;
+    };
+    const hand = new Map();
+    for (const i of inv.items) {
+        if (i.kind === 'instructions' || !inScope(i) || targets.has(i.id))
+            continue;
+        const t = pluginOf(i);
+        if (hand.has(t.id) || targets.has(t.id))
+            continue;
+        if (t.kind === 'plugin' ? qualifiesByHand(t) && partsOf(t).every(m => !m.usage.total && !keptIds.has(m.id)) : t === i && qualifiesByHand(i))
+            hand.set(t.id, t);
+    }
+    const expand = (set) => {
+        const gone = new Set();
+        for (const t of set) {
+            gone.add(t.id);
+            if (t.kind === 'plugin')
+                for (const m of partsOf(t))
+                    gone.add(m.id);
+        }
+        return gone;
+    };
+    const gone = expand(targets.values());
+    const goneWithHand = expand([...targets.values(), ...hand.values()]);
+    const b = newestBudget(inv);
+    const cap = b && b.dropped.length ? b.listingChars : Number.MAX_SAFE_INTEGER;
+    const before = b ? simulateListing(listingEntries(inv, b), cap) : null;
+    const outcome = (g) => {
+        let listing = null;
+        let descriptionsBack = 0;
+        if (b && before) {
+            const staying = listingEntries(inv, b, g);
+            const { describedNames, ...after } = simulateListing(staying, cap);
+            void describedNames;
+            // Archived skills that were name-only also leave the dropped count; only skills that stay can "come back".
+            const had = new Set(before.describedNames);
+            descriptionsBack = Math.max(0, staying.filter(e => !had.has(e.name)).length - after.dropped);
+            listing = after;
+        }
+        const goneItems = inv.items.filter(i => g.has(i.id));
+        // Agent descriptions and MCP tool names and instructions load every session in full; skills go through the listing above.
+        // Without a capped listing (Codex), every skill line goes straight out of the session.
+        const agentChars = goneItems.filter(i => i.kind === 'agent' || i.kind === 'mcp' || (inv.agent === 'codex' && (i.kind === 'skill' || i.kind === 'command'))).reduce((n, i) => n + i.standingChars, 0);
+        const hookChars = goneItems.filter(i => i.kind === 'hook' && i.hook?.event === 'SessionStart' && i.usage.hook?.firings)
+            .reduce((n, i) => n + i.usage.hook.injectedChars / i.usage.hook.firings, 0);
+        return { listing, descriptionsBack, sessionCharsSaved: Math.round((listing && before ? before.chars - listing.chars : 0) + agentChars + hookChars) };
+    };
+    const auto = outcome(gone);
+    const withHand = hand.size ? outcome(goneWithHand) : null;
+    const byKind = {};
+    for (const t of targets.values())
+        byKind[t.kind] = (byKind[t.kind] ?? 0) + 1;
+    const strip = (p) => ({ chars: p.chars, described: p.described, dropped: p.dropped });
+    return {
+        ids: [...targets.keys()],
+        byKind,
+        turnsOff: gone.size,
+        listing: before && auto.listing ? { before: strip(before), after: auto.listing, observedAt: b.timestamp } : null,
+        descriptionsBack: auto.descriptionsBack,
+        sessionCharsSaved: auto.sessionCharsSaved,
+        byHand: withHand ? {
+            items: [...hand.values()].map(t => ({ id: t.id, name: t.source === 'claude.ai connector' && t.description ? `${t.name.slice(0, 8)}… (${t.description.replace(/^Tools: /, '').split(', ').slice(0, 2).join(', ')})` : t.name, kind: t.kind, where: t.removal.where ?? '', turnsOff: t.kind === 'plugin' ? partsOf(t).length : 1 })),
+            descriptionsBack: withHand.descriptionsBack,
+            sessionCharsSaved: withHand.sessionCharsSaved,
+        } : null,
+    };
+}

package/dist/report/logo.d.ts

@@ -0,0 +1,7 @@
+export declare const BRAND_GREEN = "#3fae6e";
+/** The mark as standalone SVG markup. `tile` puts it on a rounded square (app icon, favicon). */
+export declare function logoSvg(opts: {
+    ink: string;
+    tile?: string;
+    id?: string;
+}): string;

package/dist/report/logo.js

@@ -0,0 +1,23 @@
+// packlight's mark: a solid front-view backpack with a small handle, low side pockets and a green front pocket.
+// The flap, clasp and pocket outline are cut out with a mask, so they show whatever sits behind the mark.
+// client.ts draws the same shapes with DOM calls (it cannot import); keep the two in step.
+export const BRAND_GREEN = '#3fae6e';
+/** The mark as standalone SVG markup. `tile` puts it on a rounded square (app icon, favicon). */
+export function logoSvg(opts) {
+    const id = opts.id ?? 'pl-cut';
+    const glyph = `<defs><mask id="${id}" maskUnits="userSpaceOnUse" x="0" y="0" width="64" height="64">`
+        + '<rect width="64" height="64" fill="#fff"/>'
+        + '<path d="M15.5 34v19M48.5 34v19" stroke="#000" stroke-width="2.5"/>'
+        + '<path d="M22 15.5v7.5a5 5 0 0 0 5 5h10a5 5 0 0 0 5-5v-7.5" fill="none" stroke="#000" stroke-width="3"/>'
+        + '<rect x="29" y="23" width="6" height="8" rx="2" fill="#000"/>'
+        + '<rect x="22" y="39" width="20" height="20" rx="4" fill="none" stroke="#000" stroke-width="3"/>'
+        + `</mask></defs><g mask="url(#${id})" fill="${opts.ink}">`
+        + `<path d="M28 13v-2a4 4 0 0 1 8 0v2" fill="none" stroke="${opts.ink}" stroke-width="4"/>`
+        + '<rect x="10" y="35" width="10" height="17" rx="3.5"/><rect x="44" y="35" width="10" height="17" rx="3.5"/>'
+        + '<rect x="16" y="12" width="32" height="47" rx="7"/></g>'
+        + `<rect x="24.5" y="41.5" width="15" height="17.5" rx="2" fill="${BRAND_GREEN}"/>`;
+    const body = opts.tile
+        ? `<rect width="64" height="64" rx="14" fill="${opts.tile}"/><g transform="translate(5 4) scale(.84)">${glyph}</g>`
+        : glyph;
+    return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">${body}</svg>`;
+}

package/dist/report/model.d.ts

@@ -0,0 +1,103 @@
+import { type PacklightPaths } from '../archive/paths.js';
+import { MESSAGES } from '../core/messages.js';
+import type { Inventory, Item } from '../core/types.js';
+import { type FixPlan } from './fix.js';
+import { type Suggestion } from './suggest.js';
+export interface ReportItem extends Omit<Item, 'declarations' | 'descHash' | 'targetFingerprint' | 'logKeys'> {
+    logKeys: string[];
+    suggestion: Suggestion;
+    keptAt?: string;
+    /** Kept, but its files changed since (design-delta D2 correction). */
+    keptUpdatedSince?: boolean;
+    /** Archived by packlight and installed again since (doctor check 8). */
+    cameBack?: string;
+}
+export interface Finding {
+    level: 'high' | 'medium' | 'good';
+    title: string;
+    body: string;
+}
+export interface ReportData {
+    version: 1;
+    scanId: string;
+    createdAt: string;
+    agent: string;
+    scope: string;
+    home: string;
+    window: Inventory['window'];
+    sessions: number;
+    linesUnreadable: number;
+    coverage: Inventory['coverage'];
+    hasLogs: boolean;
+    projects: {
+        root: string;
+        name: string;
+        sessions: number;
+    }[];
+    items: ReportItem[];
+    budget: Inventory['budget'];
+    listingPriority: string[];
+    /** What the scope's newest session started with, by source (characters). */
+    sessionLoad: SessionLoad | null;
+    /** The one-click fix: every suggested item, and what archiving them buys. */
+    fix: FixPlan;
+    thresholds: {
+        sessions: number;
+        days: number;
+    };
+    previous?: {
+        scanId: string;
+        createdAt: string;
+        hookStartChars: number;
+        dropped: number | null;
+        budgetTimestamp: string | null;
+    };
+    current: {
+        hookStartChars: number;
+    };
+    archived: {
+        opId: string;
+        itemId: string;
+        itemName: string;
+        kind: string;
+        method: string;
+        status: string;
+        archivedAt: string;
+        where: string;
+    }[];
+    /** Marks from the newest picks file saved for the previous scan (design-delta DE4 reopened). */
+    savedPicks?: {
+        scanId: string;
+        file: string;
+        marks: Record<string, 'archive' | 'keep'>;
+    };
+    findings: Finding[];
+    messages: typeof MESSAGES & {
+        applyCommand: string;
+        reportCommand: string;
+        pasteCommand: string;
+        fixCommand: string;
+        invoke: string;
+    };
+}
+/** Characters hooks add at each session start: the sum of each start hook's average injection. */
+export declare function hookStartChars(inv: Inventory): number;
+export interface SessionLoad {
+    skillListing: number;
+    mcpTools: number;
+    mcpToolCount: number;
+    mcpInstructions: number;
+    hookStart: number;
+    agents: number;
+    observedAt: string | null;
+    agentsMd?: number;
+    pluginInstructions?: number;
+    measuredTokens?: number;
+    measuredSessions?: number;
+}
+/** Rough tokens for a number of characters: about 4 per token for English text (labelled "about" wherever shown). */
+export declare const CHARS_PER_TOKEN = 4;
+/** Characters of setup a session starts with; for Codex the measured first request, converted back to characters. */
+export declare const loadTotal: (l: SessionLoad) => number;
+export declare function sessionLoad(inv: Inventory): SessionLoad | null;
+export declare function buildReport(inv: Inventory, paths: PacklightPaths): ReportData;

package/dist/report/model.js

@@ -0,0 +1,194 @@
+import { lstatSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, join, sep } from 'node:path';
+import { readKeeps, findPicksFile, parsePicks } from '../archive/apply.js';
+import { listManifests } from '../archive/journal.js';
+import { downloadsDir, readScan } from '../archive/paths.js';
+import { MESSAGES, APPLY_COMMAND, FIX_COMMAND, INVOKE, PASTE_COMMAND, REPORT_COMMAND } from '../core/messages.js';
+import { fixPlan, newestBudget } from './fix.js';
+import { MIN_DAYS, MIN_SESSIONS, suggestions } from './suggest.js';
+/** Characters hooks add at each session start: the sum of each start hook's average injection. */
+export function hookStartChars(inv) {
+    return Math.round(inv.items
+        .filter(i => i.kind === 'hook' && i.enabled && i.hook?.event === 'SessionStart' && i.usage.hook && i.usage.hook.firings > 0)
+        .reduce((n, i) => n + i.usage.hook.injectedChars / i.usage.hook.firings, 0));
+}
+/** Rough tokens for a number of characters: about 4 per token for English text (labelled "about" wherever shown). */
+export const CHARS_PER_TOKEN = 4;
+/** Characters of setup a session starts with; for Codex the measured first request, converted back to characters. */
+export const loadTotal = (l) => (l.measuredTokens ? l.measuredTokens * CHARS_PER_TOKEN : l.skillListing + l.mcpTools + l.mcpInstructions + l.hookStart + l.agents + (l.agentsMd ?? 0) + (l.pluginInstructions ?? 0));
+export function sessionLoad(inv) {
+    if (inv.agent === 'codex') {
+        const s = inv.codexStart;
+        if (!s)
+            return null;
+        const t = [...s.firstRequestTokens].sort((a, b) => a - b);
+        return {
+            skillListing: s.skillListingChars, mcpTools: 0, mcpToolCount: 0, mcpInstructions: 0, hookStart: 0, agents: 0, observedAt: s.timestamp,
+            agentsMd: s.agentsMdChars, pluginInstructions: s.pluginInstructionChars + s.appInstructionChars,
+            ...(t.length ? { measuredTokens: t[Math.floor(t.length / 2)], measuredSessions: t.length } : {}),
+        };
+    }
+    const tl = inv.toolListing?.[inv.projectScope] ?? Object.values(inv.toolListing ?? {}).sort((a, b) => (a.timestamp ?? '').localeCompare(b.timestamp ?? '')).at(-1);
+    const b = newestBudget(inv);
+    if (!tl && !b)
+        return null;
+    const servers = Object.values(tl?.servers ?? {});
+    return {
+        skillListing: b?.listingChars ?? 0,
+        mcpTools: servers.reduce((n, s) => n + s.chars, 0),
+        mcpToolCount: servers.reduce((n, s) => n + s.tools, 0),
+        mcpInstructions: servers.reduce((n, s) => n + s.instructionChars, 0),
+        hookStart: hookStartChars(inv),
+        // Agent descriptions load every session too: global ones and the scanned project's own.
+        agents: Math.round(inv.items.filter(i => i.kind === 'agent' && i.enabled && (i.projectRoot === null || i.projectRoot === inv.projectScope)).reduce((n, i) => n + i.standingChars, 0)),
+        observedAt: tl?.timestamp ?? b?.timestamp ?? null,
+    };
+}
+function previousScan(paths, inv) {
+    let ids;
+    try {
+        ids = readdirSync(paths.scans).filter(id => id < inv.scanId).sort().reverse();
+    }
+    catch {
+        return undefined;
+    }
+    for (const id of ids) {
+        const s = readScan(paths, id);
+        if (s && s.agent === inv.agent && s.projectScope === inv.projectScope)
+            return s;
+    }
+    return undefined;
+}
+function findings(inv, items) {
+    const out = [];
+    const settings = (() => { try {
+        return JSON.parse(readFileSync(join(inv.home, '.claude', 'settings.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    } })();
+    if (typeof settings.model === 'string' && /sonnet|haiku/i.test(settings.model)) {
+        out.push({ level: 'high', title: `Your default model is set to "${settings.model}"`, body: 'Every new session starts on a smaller model unless you pick another one. Remove "model" from ~/.claude/settings.json, or set it to the model you mean.' });
+    }
+    const perSession = (i) => (inv.sessionsInWindow ? i.usage.total / inv.sessionsInWindow : 0);
+    // Heavy servers barely used: their tool list loads every session whether or not a tool is called.
+    const heavy = items.filter(i => i.kind === 'mcp' && i.standingChars >= 2000 && i.usage.total > 0 && i.usage.total <= Math.max(2, inv.sessionsInWindow / 50))
+        .sort((a, b) => b.standingChars - a.standingChars);
+    if (heavy.length && inv.sessionsInWindow) {
+        const name = (i) => (i.source === 'claude.ai connector' && i.description ? `${i.name.slice(0, 8)}… (${i.description})` : i.name);
+        out.push({ level: 'medium', title: `${heavy.length} MCP server${heavy.length === 1 ? ' loads' : 's load'} a lot every session and ${heavy.length === 1 ? 'is' : 'are'} rarely called`,
+            body: heavy.map(i => `${name(i)}: ${(i.standingChars / 1000).toFixed(1)}k chars every session, called ${i.usage.total === 1 ? 'once' : `${i.usage.total} times`} in ${inv.sessionsInWindow} sessions.`).join(' ') + ' Turn one off where you added it and back on when you need it.' });
+    }
+    for (const h of items.filter(i => i.kind === 'hook' && i.usage.hook && i.usage.hook.firings > 0)) {
+        const u = h.usage.hook;
+        const per = u.injectedChars / u.firings;
+        if (h.hook?.event === 'SessionStart' && per > 5000)
+            out.push({ level: 'high', title: `${h.name} adds ${Math.round(per / 100) / 10}k characters at every session start`, body: `It fired ${u.firings} times in this scan. That text sits in the context of every session.` });
+        if (perSession(h) > 50)
+            out.push({ level: 'medium', title: `${h.name} fires about ${Math.round(perSession(h))} times per session`, body: `Each firing adds about ${Math.round(per)} characters and takes ${u.avgDurationMs} ms on average.` });
+        if (u.p95DurationMs > 1000)
+            out.push({ level: 'medium', title: `${h.name} is slow`, body: `One in twenty runs takes ${(u.p95DurationMs / 1000).toFixed(1)} s or longer.` });
+    }
+    const off = items.filter(i => i.kind === 'plugin' && !i.enabled && i.path);
+    if (off.length)
+        out.push({ level: 'medium', title: `${off.length} plugin${off.length === 1 ? ' is' : 's are'} turned off but still installed`, body: `${off.map(p => p.name).join(', ')}. They load nothing, but stay in the plugin cache.` });
+    const broken = [];
+    const skillsDir = join(inv.home, '.claude', 'skills');
+    try {
+        for (const name of readdirSync(skillsDir)) {
+            const p = join(skillsDir, name);
+            if (lstatSync(p).isSymbolicLink()) {
+                try {
+                    statSync(p);
+                }
+                catch {
+                    broken.push(name);
+                }
+            }
+        }
+    }
+    catch { /* no skills folder */ }
+    if (broken.length)
+        out.push({ level: 'medium', title: `${broken.length} skill link${broken.length === 1 ? ' points' : 's point'} nowhere`, body: `${broken.join(', ')} in ~/.claude/skills ${broken.length === 1 ? 'is a link' : 'are links'} to a folder that no longer exists.` });
+    const shared = items.filter(i => i.usage.ambiguous);
+    if (shared.length)
+        out.push({ level: 'medium', title: `${shared.length} items share a name or command with another item`, body: 'Their usage cannot be told apart, so packlight never suggests them. Compare them in the Items tab.' });
+    const mcpNames = new Map();
+    for (const m of items.filter(i => i.kind === 'mcp' && !i.plugin))
+        mcpNames.set(m.name, (mcpNames.get(m.name) ?? 0) + 1);
+    const twice = [...mcpNames].filter(([, n]) => n > 1).map(([n]) => n);
+    if (twice.length)
+        out.push({ level: 'medium', title: `${twice.length} MCP server${twice.length === 1 ? ' is' : 's are'} configured more than once`, body: twice.join(', ') });
+    const back = items.filter(i => i.cameBack);
+    if (back.length)
+        out.push({ level: 'medium', title: `${back.length} archived item${back.length === 1 ? ' came' : 's came'} back`, body: `${back.map(i => i.name).join(', ')}: archived by packlight and installed again since, probably by an updater.` });
+    if (inv.coverage.uncertain)
+        out.push({ level: 'high', title: 'Usage may be incomplete', body: `${inv.coverage.reasons.join('; ')}. Nothing is suggested from usage until packlight can read these logs.` });
+    return out;
+}
+export function buildReport(inv, paths) {
+    const keeps = readKeeps(paths).keeps;
+    const sug = suggestions(inv, new Set(Object.keys(keeps)));
+    // Only this agent's archives: a manifest belongs to Codex when the item came from a .codex folder.
+    const fromCodex = (where) => where.includes(`${sep}.codex${sep}`);
+    const manifests = listManifests(paths).filter(m => fromCodex(m.originalPath ?? m.settingsFile ?? '') === (inv.agent === 'codex'));
+    const openArchives = new Map(manifests.filter(m => m.status === 'archived').map(m => [m.itemId, m]));
+    const items = inv.items.map(({ declarations, descHash, targetFingerprint, ...rest }) => {
+        const k = keeps[rest.id];
+        const m = openArchives.get(rest.id);
+        return {
+            ...rest,
+            suggestion: sug.get(rest.id),
+            ...(k ? { keptAt: k.keptAt, keptUpdatedSince: k.fingerprintAtKeep !== targetFingerprint } : {}),
+            ...(m && m.method !== 'manual' ? { cameBack: m.archivedAt } : {}),
+        };
+    });
+    const prev = previousScan(paths, inv);
+    const prevBudget = prev ? newestBudget(prev) : undefined;
+    let savedPicks;
+    if (prev) {
+        const file = findPicksFile(downloadsDir(inv.home));
+        if (file) {
+            try {
+                const p = parsePicks(readFileSync(file, 'utf8'));
+                if (p.scanId === prev.scanId) {
+                    const marks = {};
+                    for (const x of p.picks)
+                        if (x.action === 'archive' || x.action === 'keep')
+                            marks[x.id] = x.action;
+                    savedPicks = { scanId: p.scanId, file: basename(file), marks };
+                }
+            }
+            catch { /* not a picks file packlight can read */ }
+        }
+    }
+    return {
+        version: 1,
+        scanId: inv.scanId,
+        createdAt: inv.createdAt,
+        agent: inv.agent,
+        scope: inv.projectScope,
+        home: inv.home,
+        window: inv.window,
+        sessions: inv.sessionsInWindow,
+        linesUnreadable: inv.linesUnreadable,
+        coverage: inv.coverage,
+        hasLogs: inv.sessions.length > 0,
+        projects: inv.projects.filter(p => p.exists).map(p => ({ root: p.root, name: basename(p.root), sessions: p.sessions })),
+        items,
+        budget: inv.budget,
+        listingPriority: inv.listingPriority ?? [],
+        fix: fixPlan(inv, sug, new Set(Object.keys(keeps))),
+        sessionLoad: sessionLoad(inv),
+        thresholds: { sessions: MIN_SESSIONS, days: MIN_DAYS },
+        ...(prev ? { previous: { scanId: prev.scanId, createdAt: prev.createdAt, hookStartChars: hookStartChars(prev), dropped: prevBudget?.dropped.length ?? null, budgetTimestamp: prevBudget?.timestamp ?? null } } : {}),
+        current: { hookStartChars: hookStartChars(inv) },
+        archived: manifests.map(m => ({
+            opId: m.opId, itemId: m.itemId, itemName: m.itemName, kind: m.kind, method: m.method, status: m.status, archivedAt: m.archivedAt,
+            where: m.originalPath ?? (m.settingsFile ? `${m.settingsFile} ${m.jsonPointer}` : m.manualSteps ?? ''),
+        })),
+        ...(savedPicks ? { savedPicks } : {}),
+        findings: findings(inv, items),
+        messages: { ...MESSAGES, applyCommand: APPLY_COMMAND, reportCommand: REPORT_COMMAND, pasteCommand: PASTE_COMMAND, fixCommand: FIX_COMMAND, invoke: INVOKE },
+    };
+}

package/dist/report/render.d.ts

@@ -0,0 +1,9 @@
+import type { ReportData } from './model.js';
+/** No network at all (acceptance criterion 5): inline style and script only, images only as data: URIs. */
+export declare const CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:";
+/**
+ * JSON that is safe inside a <script> element: "<", ">" and "&" are escaped so no description can close the
+ * element or open a comment, and the line separators JavaScript treats as newlines are escaped too (CEO F4).
+ */
+export declare function scriptSafeJson(value: unknown): string;
+export declare function renderReport(data: ReportData): string;

package/dist/report/render.js

@@ -0,0 +1,45 @@
+import { clientMain } from './client.js';
+import { logoSvg } from './logo.js';
+import { STYLES } from './styles.js';
+import { simulateListing } from './suggest.js';
+/** No network at all (acceptance criterion 5): inline style and script only, images only as data: URIs. */
+export const CSP = "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:";
+// A tile, so the tab icon reads on light and dark browser chrome alike.
+const ICON = 'data:image/svg+xml,' + encodeURIComponent(logoSvg({ ink: '#f4efe0', tile: '#18181b' }));
+/**
+ * JSON that is safe inside a <script> element: "<", ">" and "&" are escaped so no description can close the
+ * element or open a comment, and the line separators JavaScript treats as newlines are escaped too (CEO F4).
+ */
+export function scriptSafeJson(value) {
+    return JSON.stringify(value)
+        .replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028').replace(/\u2029/g, '\\u2029');
+}
+const escapeText = (s) => s.replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+export function renderReport(data) {
+    const scope = data.scope === 'global' ? 'all projects' : data.scope.split(/[\\/]/).pop() ?? data.scope;
+    const title = `packlight: ${scope}, ${new Date(data.createdAt).toLocaleDateString('en-GB', { day: 'numeric', month: 'short', year: 'numeric' })}`;
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta http-equiv="Content-Security-Policy" content="${CSP}">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>${escapeText(title)}</title>
+<link rel="icon" href="${ICON}">
+<style>${STYLES}</style>
+</head>
+<body>
+<a class="sr" href="#main">Skip to the report</a>
+<div id="app"><noscript>This report needs JavaScript, which runs only inside this file and makes no network requests.</noscript></div>
+<div id="live" class="sr" aria-live="polite"></div>
+<script id="packlight-data" type="application/json">${scriptSafeJson(data)}</script>
+<script>
+const simulateListing = ${simulateListing.toString()};
+(${clientMain.toString()})();
+</script>
+</body>
+</html>
+`;
+}

package/dist/report/styles.d.ts

@@ -0,0 +1 @@
+export declare const STYLES: string;