scenescout 3.15.0 → 3.17.0

package/dist/engine/check.js

@@ -12,9 +12,11 @@
  */
 import { createHash } from "node:crypto";
 import { BROWSER_ENGINES } from "../browsers.js";
+import { BASELINE_MODES, baselineEvidence, baselineFingerprint, countStatuses, describeChange, parseThreshold, VISUAL_RULE, } from "./baseline.js";
 import { flowStepEvidence } from "./flow.js";
 import { parseLimitFlag } from "./limits.js";
-import { redactSecrets } from "./memory.js";
+import { redactRoute, redactSecrets } from "./memory.js";
+import { SARIF_ANCHOR_FALLBACKS, checkSarifAnchor, sarifFileFor, sarifLocation } from "./sarif.js";
 import { httpErrorDetail, httpStatusOf } from "./oracles.js";
 export const CHECK_SEVERITIES = ["high", "medium", "low"];
 export const FAIL_ON = [...CHECK_SEVERITIES, "never"];
@@ -65,7 +67,11 @@ export const CHECK_RULES = {
         title: "Control covered by pinned chrome",
         help: "A fixed or sticky element sits on top of the control, so clicks land on it instead.",
     },
-    "clipped-control": { severity: "medium", title: "Control unreachable", help: "The control is clipped inside a container that cannot scroll." },
+    "clipped-control": {
+        severity: "medium",
+        title: "Control unreachable",
+        help: "The control is clipped inside a container that cannot scroll and has no control beside it to page it.",
+    },
     "offpage-control": { severity: "medium", title: "Control outside the page", help: "The control is laid out where no scrolling can reach it." },
     "overlapping-controls": { severity: "low", title: "Controls overlap", help: "Two controls in the same layer cover most of each other." },
     "broken-image": { severity: "medium", title: "Broken image", help: "The browser could not render the image." },
@@ -78,7 +84,11 @@ export const CHECK_RULES = {
     contrast: { severity: "low", title: "Text contrast below WCAG", help: "Text needs 4.5:1 (3:1 when large) against its background." },
     "focus-indicator": { severity: "low", title: "No visible focus indicator", help: "Tabbing to the control changes nothing on screen." },
     "horizontal-scroll": { severity: "medium", title: "Page scrolls sideways", help: "Content is wider than the viewport." },
-    "tiny-target": { severity: "low", title: "Small click target", help: "Below the 24px WCAG 2.2 target-size minimum." },
+    "tiny-target": {
+        severity: "low",
+        title: "Small click target",
+        help: "Below the 24px WCAG 2.2 target-size minimum, measured on what the user clicks (a native input's label or drop zone), with another target inside its 24px circle.",
+    },
     "clipped-text": { severity: "low", title: "Text clipped", help: "Text is wider than its box and cut off without an ellipsis." },
     "image-aspect": { severity: "low", title: "Image distorted", help: "The rendered box does not match the image's proportions." },
     "flow-step-failed": {
@@ -86,6 +96,11 @@ export const CHECK_RULES = {
         title: "Saved flow broke",
         help: "A step of a flow saved in .scenescout/flows could not be done, or what it expected was not there. The evidence names the flow, the step and what happened instead.",
     },
+    [VISUAL_RULE]: {
+        severity: "high",
+        title: "Differs from its visual baseline",
+        help: "A page or element listed in the baselines' targets.json no longer looks like its baseline (--baseline compare): more of its pixels changed than --baseline-threshold allows, or its size changed. It is also filed when the page or element could not be captured at all, or its baseline cannot be used (half there, unreadable, or taken with other settings). An intended change is approved by running the check with --baseline update (and committing the new baseline, where the project keeps baselines in a folder it commits).",
+    },
 };
 /**
  * Rules whose measurement is exact and whose meaning depends on a convention
@@ -189,16 +204,34 @@ export function geometryRule(line) {
  *
  * A fact under a worth-a-look rule goes to `worthALook` instead, deduplicated
  * the same way; the two lists never share an entry.
+ *
+ * Visual baselines add one issue per target that is not met (baseline.ts
+ * decides which). Each target is its own fact already, so these skip the
+ * dedup, and their fingerprint comes from the target, not the evidence: the
+ * evidence carries this run's percentage, and the same target changing by a
+ * different amount is still the same alert.
+ *
+ * `--ignore-path` drops a fact on the route it names, or one rule there,
+ * before the fact is filed. A fact also seen on a route that is not exempted
+ * stays, on that route alone.
  */
-export function checkFindings(routes, origin, ignore = [], flows = []) {
+export function checkFindings(routes, origin, ignore = [], flows = [], baselines = null, ignorePaths = []) {
     const byKey = new Map();
     const looks = new Map();
+    /** A route (and, when named, one rule on it) that --ignore-path exempts. */
+    const exempt = (rule, route) => ignorePaths.some((e) => e.path === route && (e.rule === undefined || e.rule === rule));
+    /** Evidence as it is written: no origin, no secret, and bounded. */
+    const cleanEvidence = (evidence) => redactSecrets(withoutOrigin(evidence, origin)).slice(0, 300);
     const add = (rule, evidence, route, opts = {}) => {
-        if (ignore.includes(rule))
+        if (ignore.includes(rule) || exempt(rule, route))
             return;
-        const clean = redactSecrets(withoutOrigin(evidence, origin)).slice(0, 300);
+        const clean = cleanEvidence(evidence);
         const key = `${rule}\u0000${clean}`;
-        const found = byKey.get(key) ?? looks.get(key);
+        const issue = byKey.get(key);
+        // A fact a crawled page and a flow both show points at the flow: the flow is the file that reproduces it.
+        if (issue && opts.flow && !issue.flow)
+            issue.flow = opts.flow;
+        const found = issue ?? looks.get(key);
         if (found) {
             if (!found.routes.includes(route))
                 found.routes.push(route);
@@ -215,6 +248,7 @@ export function checkFindings(routes, origin, ignore = [], flows = []) {
             evidence: clean,
             routes: [route],
             ...(opts.embed ? { embed: opts.embed } : {}),
+            ...(opts.flow ? { flow: opts.flow } : {}),
             fingerprint,
         });
     };
@@ -251,19 +285,36 @@ export function checkFindings(routes, origin, ignore = [], flows = []) {
     }
     for (const f of flows) {
         for (const { path, violation } of f.violations)
-            add(violationRule(violation), violation.detail, path, { embed: violation.embed });
+            add(violationRule(violation), violation.detail, path, { embed: violation.embed, flow: f.file });
         // A refused step is not the app's defect: the check reports it as "could not run" (refusedFlowReason).
         if (f.outcome.status === "failed")
-            add("flow-step-failed", flowStepEvidence(f), f.outcome.path);
+            add("flow-step-failed", flowStepEvidence(f), f.outcome.path, { flow: f.file });
+    }
+    const visual = [];
+    if (baselines && !ignore.includes(VISUAL_RULE)) {
+        for (const r of baselines.results) {
+            if (exempt(VISUAL_RULE, r.path))
+                continue;
+            const evidence = baselineEvidence(r, baselines);
+            if (evidence === null)
+                continue;
+            visual.push({
+                rule: VISUAL_RULE,
+                severity: CHECK_RULES[VISUAL_RULE].severity,
+                evidence: cleanEvidence(evidence),
+                routes: [r.path],
+                fingerprint: baselineFingerprint(baselines.engine, r),
+            });
+        }
     }
     return {
-        issues: [...byKey.values()].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || a.rule.localeCompare(b.rule)),
+        issues: [...byKey.values(), ...visual].sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || a.rule.localeCompare(b.rule)),
         worthALook: [...looks.values()].sort((a, b) => a.rule.localeCompare(b.rule)),
     };
 }
 /** The defect tier of `checkFindings`: what counts, and what the gate reads. */
-export function issuesFromRoutes(routes, origin, ignore = [], flows = []) {
-    return checkFindings(routes, origin, ignore, flows).issues;
+export function issuesFromRoutes(routes, origin, ignore = [], flows = [], ignorePaths = []) {
+    return checkFindings(routes, origin, ignore, flows, null, ignorePaths).issues;
 }
 /**
  * Why a check has nothing to give a verdict on, or null when it measured the
@@ -299,15 +350,8 @@ export function withoutOwnResponse(r) {
     const own = httpErrorDetail("GET", r.url.replace(/#.*$/, ""), r.status);
     return { ...r, violations: r.violations.filter((v) => !(v.kind === "http_error" && v.detail === own)) };
 }
-/**
- * Routes are links the app printed, and a link can carry a token
- * (`?reset=…`, `?api_key=…`). Evidence is redacted where issues are built;
- * this does the same for every route string before anything is written.
- */
-export function redactRoute(route) {
-    // The trailing "[n secrets redacted]" note belongs to prose; in a route it would read as part of the path.
-    return redactSecrets(route).replace(/ \[\d+ secrets? redacted\]$/, "");
-}
+/** Lives beside redactSecrets so the baselines' file names (baseline.ts) use it too; exported here as before. */
+export { redactRoute };
 export function redactRoutes(routes) {
     const clean = redactRoute;
     return routes.map((r) => ({
@@ -317,6 +361,16 @@ export function redactRoutes(routes) {
         violations: r.violations.map((v) => ({ ...v, url: clean(v.url) })),
     }));
 }
+/**
+ * The same redaction for visual baselines: a target's path, and the reason a
+ * picture could not be taken, which can quote a URL the app redirected to.
+ */
+export function redactBaselineRun(run) {
+    return {
+        ...run,
+        results: run.results.map((r) => ({ ...r, path: redactRoute(r.path), ...(r.detail !== undefined ? { detail: redactSecrets(r.detail) } : {}) })),
+    };
+}
 /** The same redaction for what flows measured: the page paths and the request URLs their violations quote. */
 export function redactFlowRuns(runs) {
     return runs.map((f) => ({
@@ -367,6 +421,7 @@ export const CHECK_OPTION_NAMES = [
     "max-routes",
     "paths",
     "ignore",
+    "ignore-path",
     "flows",
     "retest",
     "flow-writes",
@@ -374,6 +429,10 @@ export const CHECK_OPTION_NAMES = [
     "gate-retests",
     "action-timeout-ms",
     "nav-timeout-ms",
+    "baseline",
+    "baselines",
+    "baseline-threshold",
+    "sarif-file-anchor",
 ];
 export const MAX_CHECK_ROUTES = 150;
 /** Link discovery rounds: each crawl reveals the routes its pages link to. Past a few, a site is paginating rather than revealing. */
@@ -457,6 +516,50 @@ export function parseCheckArgs(args, cwd) {
     const unknownRules = ignore.filter((r) => !CHECK_RULE_IDS.includes(r));
     if (unknownRules.length > 0)
         return { ok: false, error: `unknown rule(s) in --ignore: ${unknownRules.join(", ")}. Rules: ${CHECK_RULE_IDS.join(", ")}` };
+    const ignorePathList = list(flags.get("ignore-path"));
+    if (ignorePathList && ignorePathList.length === 0)
+        return { ok: false, error: "--ignore-path is empty" };
+    const ignorePaths = [];
+    const unknownPathRules = [];
+    const badPathEntries = [];
+    const ruleAfterPath = [];
+    for (const entry of ignorePathList ?? []) {
+        if (entry.startsWith("/")) {
+            // `/path:rule` would otherwise be a path that never matches. A colon is
+            // still allowed in a path when what follows it is not a rule id.
+            const suffix = entry.slice(entry.lastIndexOf(":") + 1);
+            if (entry.includes(":") && CHECK_RULE_IDS.includes(suffix)) {
+                ruleAfterPath.push(entry);
+                continue;
+            }
+            ignorePaths.push({ path: entry });
+            continue;
+        }
+        const colon = entry.indexOf(":");
+        const rule = colon > 0 ? entry.slice(0, colon) : "";
+        const path = colon > 0 ? entry.slice(colon + 1) : "";
+        if (path.startsWith("/") && CHECK_RULE_IDS.includes(rule)) {
+            ignorePaths.push({ path, rule: rule });
+            continue;
+        }
+        if (path.startsWith("/") && rule) {
+            unknownPathRules.push(rule);
+            continue;
+        }
+        badPathEntries.push(entry);
+    }
+    if (unknownPathRules.length > 0) {
+        return { ok: false, error: `unknown rule(s) in --ignore-path: ${unknownPathRules.join(", ")}. Rules: ${CHECK_RULE_IDS.join(", ")}` };
+    }
+    if (ruleAfterPath.length > 0) {
+        return { ok: false, error: `--ignore-path names a rule as rule:/path (got ${ruleAfterPath.join(", ")})` };
+    }
+    if (badPathEntries.length > 0) {
+        return {
+            ok: false,
+            error: `--ignore-path entries are paths starting with /, or one rule on a path as rule:/path (got ${badPathEntries.join(", ")})`,
+        };
+    }
     const retest = flags.get("retest") ?? "on";
     if (retest !== "on" && retest !== "off")
         return { ok: false, error: "--retest must be on or off" };
@@ -476,6 +579,22 @@ export function parseCheckArgs(args, cwd) {
     const gateRetests = oneOf("gate-retests", GATE_RETESTS, DEFAULT_SETTINGS.gateRetests);
     if (!gateRetests)
         return { ok: false, error: `--gate-retests must be one of ${GATE_RETESTS.join(", ")}` };
+    const baseline = oneOf("baseline", BASELINE_MODES, "off");
+    if (!baseline)
+        return { ok: false, error: `--baseline must be one of ${BASELINE_MODES.join(", ")}` };
+    const threshold = parseThreshold(flags.get("baseline-threshold"));
+    if (!threshold.ok)
+        return threshold;
+    const baselinesDir = flags.get("baselines");
+    if (baselinesDir !== undefined && baselinesDir.trim() === "")
+        return { ok: false, error: "--baselines needs a directory" };
+    // A setting that would do nothing is a mistake to point out, not to ignore: the check would run without the baselines asked for.
+    if (baseline === "off" && (baselinesDir !== undefined || flags.has("baseline-threshold"))) {
+        return { ok: false, error: "--baselines and --baseline-threshold apply only with --baseline compare or --baseline update" };
+    }
+    const anchor = flags.has("sarif-file-anchor") ? checkSarifAnchor(flags.get("sarif-file-anchor")) : undefined;
+    if (anchor && !anchor.ok)
+        return anchor;
     const resolve = (p) => resolveArgPath(cwd, p);
     return {
         ok: true,
@@ -492,11 +611,16 @@ export function parseCheckArgs(args, cwd) {
             maxRoutes,
             ...(paths ? { paths } : {}),
             ignore: ignore,
+            ignorePaths,
             ...(flows !== undefined ? { flows: flows === "off" ? "off" : resolve(flows) } : {}),
             retest: retest === "on",
             flowWrites,
             onRefusedStep,
             gateRetests,
+            baseline,
+            ...(baselinesDir !== undefined ? { baselinesDir: resolve(baselinesDir) } : {}),
+            baselineThreshold: threshold.value,
+            ...(anchor ? { sarifFileAnchor: anchor.value } : {}),
         },
     };
 }
@@ -550,10 +674,13 @@ export function describeSettings(result) {
 }
 const SARIF_LEVEL = { high: "error", medium: "warning", low: "note" };
 /**
- * SARIF 2.1.0, for code-scanning dashboards. A UI check has no source file to
- * point at, so each result's location is the route, relative to the checked
- * app (the APP base id). Fingerprints come from the evidence, not the
- * location, so a preview deployment on a new URL does not reopen every alert.
+ * SARIF 2.1.0, for code-scanning dashboards. Code scanning keeps a result
+ * only when its location is a repository file, so each result points at one
+ * (sarif.ts says which) and carries its routes in logical locations, in
+ * `properties.routes` and in its message. Fingerprints come from the
+ * evidence, not the location, so a preview deployment on a new URL does not
+ * reopen every alert; an unmet visual baseline's comes from its target and
+ * browser instead.
  */
 const RETEST_SARIF_RULE = {
     id: "open-finding-reproduces",
@@ -562,39 +689,39 @@ const RETEST_SARIF_RULE = {
     help: { text: "A finding an earlier run filed and left open failed the same way when its page loaded again. It gates according to --gate-retests." },
     defaultConfiguration: { level: "error" },
 };
-function sarifLocation(route) {
-    return route === SHARED_CHROME_ROUTE
-        ? {
-            physicalLocation: { artifactLocation: { uri: "", uriBaseId: "APP" } },
-            message: { text: "the app's shared shell, on every page that renders it" },
-        }
-        : { physicalLocation: { artifactLocation: { uri: route.replace(/^\//, ""), uriBaseId: "APP" } } };
+function routeLocation(file, route) {
+    return route === SHARED_CHROME_ROUTE ? sarifLocation(file, route, "the app's shared shell, on every page that renders it") : sarifLocation(file, route);
+}
+/** Where a result was seen, for its message: the first three routes and how many more. */
+function onRoutes(routes) {
+    return ` — on ${routes.slice(0, 3).join(", ")}${routes.length > 3 ? ` and ${routes.length - 3} more` : ""}`;
 }
-export function toSarif(result, toolVersion) {
+/** `files` defaults to package.json as the anchor, with no flows directory; the CLI always passes what it resolved. */
+export function toSarif(result, toolVersion, files = { anchor: SARIF_ANCHOR_FALLBACKS[0] }) {
     const used = [...new Set(result.issues.map((i) => i.rule))];
     const lookRules = [...new Set(result.worthALook.map((o) => o.rule))];
-    const base = new URL(result.url);
     const reproducing = retestGateFailures(result);
     const refused = result.flows.filter((f) => f.outcome.status === "refused");
     const issueResults = result.issues.map((i) => ({
         ruleId: i.rule,
         level: SARIF_LEVEL[i.severity],
         message: {
-            text: `${CHECK_RULES[i.rule].title}: ${i.evidence}${i.routes.length > 1 ? ` (on ${i.routes.length} routes)` : ""}${i.embed ? ` (in an embed of ${i.embed})` : ""}`,
+            text: `${CHECK_RULES[i.rule].title}: ${i.evidence}${i.embed ? ` (in an embed of ${i.embed})` : ""}${onRoutes(i.routes)}`,
         },
-        locations: i.routes.slice(0, 10).map(sarifLocation),
+        locations: i.routes.slice(0, 10).map((route) => routeLocation(sarifFileFor(files, i.flow), route)),
         partialFingerprints: { "scenescoutCheck/v1": i.fingerprint },
+        properties: { routes: i.routes, ...(i.flow ? { flow: i.flow } : {}) },
     }));
     // Always "note", whatever --fail-on says: a result a code-scanning dashboard shows, never one that reads as an error.
     const lookResults = result.worthALook.map((o) => ({
         ruleId: o.rule,
         level: "note",
         message: {
-            text: `Worth a look — ${WORTH_A_LOOK_RULES[o.rule].title}: ${o.evidence}${o.routes.length > 1 ? ` (on ${o.routes.length} routes)` : ""}. A defect only if your project uses ${o.convention}.`,
+            text: `Worth a look — ${WORTH_A_LOOK_RULES[o.rule].title}: ${o.evidence}${onRoutes(o.routes)}. A defect only if your project uses ${o.convention}.`,
         },
-        locations: o.routes.slice(0, 10).map(sarifLocation),
+        locations: o.routes.slice(0, 10).map((route) => routeLocation(files.anchor, route)),
         partialFingerprints: { "scenescoutCheck/v1": o.fingerprint },
-        properties: { tier: "worth-a-look", convention: o.convention },
+        properties: { tier: "worth-a-look", convention: o.convention, routes: o.routes },
     }));
     // Only the re-tests that fail the gate are results: a reviewer reading code scanning sees what failed it.
     const retestResults = reproducing.map((r) => ({
@@ -602,9 +729,10 @@ export function toSarif(result, toolVersion) {
         // The severity the finding was filed at, as the page rules map theirs; an unknown one reads as the worst.
         level: SARIF_LEVEL[CHECK_SEVERITIES.includes(r.severity) ? r.severity : "high"],
         message: {
-            text: `Open finding still reproduces: [${r.severity}] ${r.title} (${r.id}) — ${r.signatures.join(", ")} (gated by --gate-retests ${result.settings.gateRetests})`,
+            text: `Open finding still reproduces: [${r.severity}] ${r.title} (${r.id}) — ${r.signatures.join(", ")}${onRoutes([r.path])} (gated by --gate-retests ${result.settings.gateRetests})`,
         },
-        locations: [{ physicalLocation: { artifactLocation: { uri: r.path.replace(/^\//, ""), uriBaseId: "APP" } } }],
+        locations: [routeLocation(files.anchor, r.path)],
+        properties: { routes: [r.path] },
         partialFingerprints: { "scenescoutCheck/v1": createHash("sha256").update(`retest\u0000${r.id}`).digest("hex").slice(0, 32) },
     }));
     return {
@@ -648,7 +776,7 @@ export function toSarif(result, toolVersion) {
                         })),
                     },
                 ],
-                originalUriBaseIds: { APP: { uri: `${base.origin}/` } },
+                properties: { app: new URL(result.url).origin },
                 results: [...issueResults, ...lookResults, ...retestResults],
             },
         ],
@@ -679,6 +807,69 @@ function routeList(routes) {
     const shown = routes.slice(0, 3).map(code);
     return shown.join(", ") + (routes.length > 3 ? ` and ${routes.length - 3} more` : "");
 }
+const BASELINE_MARK = {
+    matches: "✓",
+    changed: "✗",
+    "no-baseline": "○",
+    unusable: "✗",
+    "not-captured": "⊘",
+    updated: "↻",
+};
+/** One target's line in the report. */
+function baselineLine(r, run) {
+    const what = `${BASELINE_MARK[r.status]} ${code(r.element)} on ${code(r.path)}`;
+    const notes = [r.platformNote, r.partial]
+        .filter(Boolean)
+        .map((n) => ` _(${cell(n)})_`)
+        .join("");
+    switch (r.status) {
+        case "matches":
+            return `- ${what}: ${run.mode === "update" ? `within the threshold of its baseline (${r.diff?.percent ?? 0}% changed), which was left as it was` : `matches (${r.diff?.percent ?? 0}% changed)`}${notes}`;
+        case "changed": {
+            const files = r.files ? ` — expected ${code(r.files.expected)}, now ${code(r.files.actual)}, diff ${code(r.files.diff)}` : "";
+            return `- ${what}: ${r.diff ? describeChange(r.diff, run.threshold) : "it no longer matches its baseline"}${files}${notes}`;
+        }
+        case "no-baseline":
+            return `- ${what}: no baseline yet${notes}`;
+        case "unusable":
+            return `- ${what}: its baseline cannot be used: ${cell(r.detail ?? "no reason given")}`;
+        case "not-captured":
+            return `- ${what}: could not be captured: ${cell(r.detail ?? "no reason given")}${run.mode === "update" ? "; its baseline was not written" : ""}`;
+        case "updated":
+            return `- ${what}: baseline written to ${code(r.baseline)} (${cell(r.detail ?? "updated")})${notes}`;
+    }
+}
+/** The report's section on visual baselines: every target and what became of it. */
+function formatBaselines(run) {
+    const c = countStatuses(run.results);
+    const counts = [
+        ["changed", "changed"],
+        ["unusable", "unusable"],
+        ["not-captured", "not captured"],
+        ["no-baseline", "no baseline yet"],
+        ["updated", "updated"],
+        ["matches", run.mode === "update" ? "left as they were" : "match"],
+    ]
+        .filter(([k]) => c[k] > 0)
+        .map(([k, label]) => `${c[k]} ${label}`)
+        .join(" · ");
+    const lines = [
+        `## Visual baselines (${run.results.length})`,
+        "",
+        `${run.mode === "update" ? "Updated" : "Compared"} in ${run.engine}, baselines in ${code(run.dir)} · ${run.threshold}% of a picture's pixels may change · ${counts}`,
+        "",
+        ...run.results.map((r) => baselineLine(r, run)),
+    ];
+    if (c.changed > 0)
+        lines.push("", "The pictures are beside this report, under `visual/` (in the job's artifact on CI): the baseline, the picture now, and the changed pixels in red.");
+    if (c["no-baseline"] > 0 || c.unusable > 0) {
+        lines.push("", "A target with no baseline yet is listed and never fails; one whose baseline cannot be used fails until it is taken again. Run the check with `--baseline update` to take them.");
+    }
+    if (run.results.some((r) => r.platformNote)) {
+        lines.push("", "_Some baselines were taken on another operating system. Each one draws text differently, so a change there may be the system's rather than the app's: take baselines where the check runs._");
+    }
+    return lines;
+}
 /** One markdown list item for an issue: its title, rule, evidence and routes. */
 export function issueLine(i) {
     return `**${CHECK_RULES[i.rule].title}** \`${i.rule}\`: ${cell(i.evidence)}${i.embed ? ` _(in an embed of ${i.embed}: its behaviour, not the app's)_` : ""} — ${routeList(i.routes)}`;
@@ -740,6 +931,8 @@ export function formatCheck(result) {
     lines.push(`${result.url} · ${result.routes.length} route(s) · mode ${result.mode} · gate: ${result.failOn === "never" ? "report only" : `fail on ${result.failOn}${result.failOn === "low" ? "" : " or worse"}`}`);
     lines.push("");
     const unaudited = unauditedRoutes(result.routes).length;
+    // Nothing compared is not a match: a target with no baseline yet is named beside the verdict, as an unmeasured design is.
+    const uncompared = result.baselines?.mode === "compare" ? countStatuses(result.baselines.results)["no-baseline"] : 0;
     const failingText = retestsFailing > 0
         ? `${failing} failing the gate (${failing - retestsFailing} issue(s), ${retestsFailing} re-tested finding(s))`
         : `${failing} issue(s) at the gate's severity`;
@@ -748,6 +941,7 @@ export function formatCheck(result) {
             ? `${couldNotRun > 0 ? "passed" : "**PASSED**"} — ${counts.high} high · ${counts.medium} medium · ${counts.low} low`
             : `${couldNotRun > 0 ? "failed" : "**FAILED**"} — ${failingText} · ${counts.high} high · ${counts.medium} medium · ${counts.low} low`) +
         (unaudited > 0 ? ` · design not measured on ${unaudited} route(s)` : "") +
+        (uncompared > 0 ? ` · ${uncompared} visual target(s) not compared: no baseline yet` : "") +
         (result.worthALook.length > 0 ? ` · ${result.worthALook.length} worth a look, never gated` : ""));
     // Right under the verdict: what a green check was allowed to do is part of what it means.
     lines.push("", `Settings — ${describeSettings(result)}`);
@@ -772,6 +966,8 @@ export function formatCheck(result) {
         for (const s of result.skippedFlows)
             lines.push(`- skipped ${code(s.file)}: ${cell(s.reason)}`);
     }
+    if (result.baselines)
+        lines.push("", ...formatBaselines(result.baselines));
     if (result.retest && result.retest.open > 0) {
         const { open, results } = result.retest;
         lines.push("", `## Open findings re-tested (${results.length} of ${open})`, "");
@@ -798,6 +994,10 @@ export function formatCheck(result) {
     }
     if (result.ignored.length > 0)
         lines.push("", `Rules ignored by --ignore: ${result.ignored.join(", ")}`);
+    if (result.ignoredPaths.length > 0) {
+        const shown = result.ignoredPaths.map((e) => (e.rule ? `${e.rule}:${e.path}` : e.path));
+        lines.push("", `Paths exempted by --ignore-path: ${shown.join(", ")}`);
+    }
     lines.push("", result.flows.length > 0
         ? "_A check visits pages, measures what loads and replays the flows saved for it. It does not explore, fill forms of its own accord or compare roles; an exploratory run does that._"
         : "_A check visits pages and measures what loads. It does not fill forms, click through flows or compare roles; an exploratory run does that. Flows saved in .scenescout/flows are replayed._");
@@ -826,6 +1026,7 @@ export function toSummaryJson(result, toolVersion) {
         unvisited: result.unvisited,
         ...(result.timeBudget ? { timeBudget: result.timeBudget } : {}),
         ignored: result.ignored,
+        ignoredPaths: result.ignoredPaths,
         flows: result.flows.map((f) => ({
             name: f.name,
             file: f.file,
@@ -837,6 +1038,7 @@ export function toSummaryJson(result, toolVersion) {
         })),
         skippedFlows: result.skippedFlows,
         retest: result.retest,
+        baselines: result.baselines ?? null,
         issues: result.issues,
         // Apart from `issues` and `counts`, which the gate reads: none of these is counted or gated.
         worthALook: result.worthALook,