skeptic-cli 0.5.0__py3-none-any.whl

skeptic/adapters/python/__init__.py

@@ -0,0 +1,27 @@
+from skeptic.adapters.python.bandit_adapter import run_bandit
+from skeptic.adapters.python.pip_audit_adapter import run_pip_audit
+from skeptic.adapters.python.pyright_adapter import run_pyright
+from skeptic.adapters.python.pytest_adapter import run_pytest
+from skeptic.adapters.python.ruff_adapter import run_ruff
+from skeptic.core.complexity import check_complexity
+from skeptic.core.solid import run_solid_checks
+
+FINDING_ADAPTERS = {
+    "ruff": run_ruff,
+    "pyright": run_pyright,
+    "bandit": run_bandit,
+    "pip-audit": run_pip_audit,
+    # Phase 3 milestone 2: structural SOLID checks. Not tool-specific (no
+    # external binary), lives in core/ - registered here purely so
+    # run_all_checks picks it up the same way as everything else. Findings
+    # show up in `skeptic check` output/--json but don't fail the gate yet -
+    # gate.py has no rule for tool="solid" until Phase 3 milestone 8 wires
+    # up architecture/ai_review thresholds in skeptic.yaml.
+    "solid": run_solid_checks,
+    # Phase 3 milestone 6 plumbing: McCabe complexity, feeding the Change
+    # Risk Score's "complexity" dimension. Same non-gated-yet status as
+    # "solid" above.
+    "complexity": check_complexity,
+}
+
+TEST_ADAPTER = ("pytest", run_pytest)

skeptic/adapters/python/bandit_adapter.py

@@ -0,0 +1,61 @@
+"""Wraps `bandit -r -f json` into the shared Finding schema."""
+from __future__ import annotations
+
+import json
+import subprocess
+
+from skeptic.core.models import Finding
+
+_SEVERITY_MAP = {
+    "HIGH": "critical",
+    "MEDIUM": "high",
+    "LOW": "medium",
+}
+
+
+def run_bandit(repo_path: str) -> list[Finding]:
+    proc = subprocess.run(
+        [
+            "bandit",
+            "-r",
+            repo_path,
+            "-f",
+            "json",
+            # Test code legitimately uses `assert` (bandit B101) as part of
+            # normal test authoring, not as a bypassable security control,
+            # and non-cryptographic `random` (B311) for fixture/test data.
+            # Scanning it produces noise, not signal. Cover both the common
+            # filename conventions (test_*.py / *_test.py) and files that
+            # live under a tests/ directory without matching those names
+            # (e.g. test support helpers like tests/utils/item.py) - real
+            # repos have both. Confirmed against tiangolo/full-stack-fastapi
+            # -template, which hits exactly this case.
+            "-x",
+            "*/test_*.py,*_test.py,*/tests/*,*/test/*",
+        ],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",  # bandit emits UTF-8 JSON regardless of system locale
+        check=False,  # bandit exits non-zero when it finds issues; expected
+    )
+    if not proc.stdout.strip():
+        if proc.returncode not in (0, 1):
+            raise RuntimeError(f"bandit failed to run: {proc.stderr.strip()}")
+        return []
+
+    raw = json.loads(proc.stdout)
+    findings: list[Finding] = []
+    for item in raw.get("results", []):
+        severity = _SEVERITY_MAP.get(item.get("issue_severity", "LOW"), "medium")
+        findings.append(
+            Finding(
+                tool="bandit",
+                language="python",
+                severity=severity,
+                file=item.get("filename", "unknown"),
+                line=item.get("line_number", 0),
+                message=item.get("issue_text", ""),
+                rule_id=item.get("test_id"),
+            )
+        )
+    return findings

skeptic/adapters/python/pip_audit_adapter.py

@@ -0,0 +1,56 @@
+"""Wraps `pip-audit -f json` into the shared Finding schema."""
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+from skeptic.core.models import Finding
+
+
+def run_pip_audit(repo_path: str) -> list[Finding]:
+    requirements_path = Path(repo_path) / "requirements.txt"
+    if requirements_path.exists():
+        cmd = ["pip-audit", "-f", "json", "-r", str(requirements_path)]
+    else:
+        # No requirements.txt - point pip-audit at the project directory
+        # itself so it can auto-detect a pyproject.toml/setup.py/setup.cfg
+        # and resolve dependencies directly. Most modern repos (uv, poetry,
+        # pdm) ship no requirements.txt at all; without this fallback they
+        # were silently treated as "0 vulnerabilities" when nothing had
+        # actually been checked. Confirmed against tiangolo/full-stack-
+        # fastapi-template, which is pyproject.toml/uv.lock-only.
+        cmd = ["pip-audit", "-f", "json", repo_path]
+
+    proc = subprocess.run(
+        cmd,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",  # pip-audit emits UTF-8 JSON regardless of system locale
+        check=False,
+    )
+    if not proc.stdout.strip():
+        # Either no supported project file was found (nothing to check) or
+        # no vulnerabilities were found - neither is a hard failure.
+        return []
+
+    try:
+        raw = json.loads(proc.stdout)
+    except json.JSONDecodeError:
+        return []
+
+    findings: list[Finding] = []
+    for dep in raw.get("dependencies", []):
+        for vuln in dep.get("vulns", []):
+            findings.append(
+                Finding(
+                    tool="pip-audit",
+                    language="python",
+                    severity="high",  # pip-audit doesn't provide severity by default; treat all as high
+                    file="requirements.txt" if requirements_path.exists() else "pyproject.toml",
+                    line=0,
+                    message=f"{dep.get('name')} {dep.get('version')}: {vuln.get('id')} - {vuln.get('description', '')[:200]}",
+                    rule_id=vuln.get("id"),
+                )
+            )
+    return findings

skeptic/adapters/python/pyright_adapter.py

@@ -0,0 +1,45 @@
+"""Wraps `pyright --outputjson` into the shared Finding schema."""
+from __future__ import annotations
+
+import json
+import subprocess
+
+from skeptic.core.models import Finding
+
+_SEVERITY_MAP = {
+    "error": "high",
+    "warning": "medium",
+    "information": "low",
+}
+
+
+def run_pyright(repo_path: str) -> list[Finding]:
+    proc = subprocess.run(
+        ["pyright", "--outputjson", repo_path],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",  # pyright emits UTF-8 JSON regardless of system locale -
+        # without this, Windows decodes with the locale codepage (e.g. cp1252) and
+        # any non-ASCII character in a diagnostic message (pyright uses U+00A0 for
+        # indentation) comes out as mojibake.
+        check=False,  # pyright exits non-zero when it finds errors; expected
+    )
+    if not proc.stdout.strip():
+        raise RuntimeError(f"pyright produced no output: {proc.stderr.strip()}")
+
+    raw = json.loads(proc.stdout)
+    findings: list[Finding] = []
+    for item in raw.get("generalDiagnostics", []):
+        severity = _SEVERITY_MAP.get(item.get("severity", "warning"), "medium")
+        findings.append(
+            Finding(
+                tool="pyright",
+                language="python",
+                severity=severity,
+                file=item.get("file", "unknown"),
+                line=(item.get("range") or {}).get("start", {}).get("line", 0) + 1,
+                message=item.get("message", ""),
+                rule_id=item.get("rule"),
+            )
+        )
+    return findings

skeptic/adapters/python/pytest_adapter.py

@@ -0,0 +1,59 @@
+"""Runs pytest with coverage and returns a TestResult."""
+from __future__ import annotations
+
+import json
+import subprocess
+import tempfile
+from pathlib import Path
+
+from skeptic.core.models import TestResult
+
+
+def run_pytest(repo_path: str) -> TestResult:
+    with tempfile.TemporaryDirectory() as tmp:
+        cov_json_path = Path(tmp) / "coverage.json"
+        report_json_path = Path(tmp) / "report.json"
+        proc = subprocess.run(
+            [
+                "pytest",
+                repo_path,
+                "--cov=" + repo_path,
+                "--cov-report=json:" + str(cov_json_path),
+                "-q",
+                "--json-report",
+                "--json-report-file=" + str(report_json_path),
+            ],
+            capture_output=True,
+            text=True,
+            encoding="utf-8",  # pytest's own text output isn't parsed, but keep it
+            # consistent with the JSON files below, which are always UTF-8
+            check=False,
+        )
+
+        passed = 0
+        failed_count = 0
+        if report_json_path.exists():
+            try:
+                report_data = json.loads(report_json_path.read_text(encoding="utf-8"))
+                summary = report_data.get("summary", {})
+                passed = summary.get("passed", 0)
+                # "failed" only counts outright failures; treat errors the same way
+                # since both mean the suite did not fully succeed.
+                failed_count = summary.get("failed", 0) + summary.get("error", 0)
+            except (json.JSONDecodeError, OSError):
+                pass
+        elif proc.returncode not in (0, 1):
+            # pytest itself failed to run (bad args, collection crash, missing
+            # plugin, etc.) rather than just reporting failing tests - surface
+            # that instead of silently returning a fake all-zero result.
+            raise RuntimeError(f"pytest failed to run: {proc.stderr.strip() or proc.stdout.strip()}")
+
+        coverage_percent = 0.0
+        if cov_json_path.exists():
+            try:
+                cov_data = json.loads(cov_json_path.read_text(encoding="utf-8"))
+                coverage_percent = cov_data.get("totals", {}).get("percent_covered", 0.0)
+            except (json.JSONDecodeError, OSError):
+                pass
+
+        return TestResult(passed=passed, failed=failed_count, coverage_percent=coverage_percent)

skeptic/adapters/python/ruff_adapter.py

@@ -0,0 +1,44 @@
+"""Wraps `ruff check --output-format=json` into the shared Finding schema."""
+from __future__ import annotations
+
+import json
+import subprocess
+
+from skeptic.core.models import Finding
+
+# Ruff doesn't have severity levels itself; treat all lint findings as "medium"
+# unless a rule code is one we know to be more serious.
+_HIGH_SEVERITY_PREFIXES = ("S",)  # flake8-bandit-equivalent rules, if enabled via ruff
+
+
+def run_ruff(repo_path: str) -> list[Finding]:
+    proc = subprocess.run(
+        ["ruff", "check", repo_path, "--output-format=json"],
+        capture_output=True,
+        text=True,
+        encoding="utf-8",  # ruff emits UTF-8 JSON regardless of system locale
+        check=False,  # ruff exits non-zero when it finds issues; that's expected
+    )
+    if proc.returncode not in (0, 1):
+        raise RuntimeError(f"ruff failed to run: {proc.stderr.strip()}")
+
+    if not proc.stdout.strip():
+        return []
+
+    raw = json.loads(proc.stdout)
+    findings: list[Finding] = []
+    for item in raw:
+        code = item.get("code") or ""
+        severity = "high" if code.startswith(_HIGH_SEVERITY_PREFIXES) else "medium"
+        findings.append(
+            Finding(
+                tool="ruff",
+                language="python",
+                severity=severity,
+                file=item.get("filename", "unknown"),
+                line=(item.get("location") or {}).get("row", 0),
+                message=item.get("message", ""),
+                rule_id=code or None,
+            )
+        )
+    return findings

skeptic/cli/main.py

@@ -0,0 +1,337 @@
+from __future__ import annotations
+
+import io
+import json as json_module
+import sys
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+from skeptic.adapters.python import FINDING_ADAPTERS, TEST_ADAPTER
+from skeptic.core.config import load_gate_config, write_starter_config
+from skeptic.core.gate import evaluate_gate
+from skeptic.core.risk_score import compute_risk_score
+from skeptic.core.runner import run_all_checks
+
+
+def _resilient_stdout():
+    """Wraps stdout so an unencodable character degrades to "?" instead of
+    crashing the whole command with UnicodeEncodeError - the same failure
+    class fixed earlier for the PASS/FAIL marks (legacy Windows codepages
+    like cp1252 can't represent many Unicode characters), but general this
+    time: tool finding messages can contain non-ASCII characters (pyright
+    uses U+00A0 for indentation) and --narrate prints arbitrary LLM output
+    (which routinely includes em dashes, smart quotes, etc.). Falls back to
+    plain sys.stdout when there's no underlying buffer to wrap (e.g. under
+    pytest's capture, which already injects its own safe stream)."""
+    if not hasattr(sys.stdout, "buffer"):
+        return sys.stdout
+    return io.TextIOWrapper(sys.stdout.buffer, encoding=sys.stdout.encoding or "utf-8", errors="replace")
+
+
+console = Console(file=_resilient_stdout())
+
+
+@click.group()
+def cli():
+    """skeptic - independent engineering quality gate for AI-generated code."""
+
+
+@cli.command()
+@click.argument("path", default=".")
+@click.option("--json", "as_json", is_flag=True, help="Output machine-readable JSON instead of formatted text.")
+@click.option(
+    "--narrate",
+    is_flag=True,
+    help="Explain SOLID findings in plain language via Gemini (opt-in: costs an API call per finding, "
+    "requires GEMINI_API_KEY, and never affects the pass/fail verdict - narration only explains, "
+    "it doesn't originate or override a finding).",
+)
+def check(path: str, as_json: bool, narrate: bool):
+    """Run the quality gate against a repo (defaults to current directory)."""
+    report = run_all_checks(path, FINDING_ADAPTERS, TEST_ADAPTER)
+    gate_config = load_gate_config(path)
+    result = evaluate_gate(report, gate_config)
+    risk_score = compute_risk_score(report)
+
+    narrations = _narrate_architecture_findings(report) if narrate else {}
+
+    if as_json:
+        click.echo(
+            json_module.dumps(
+                {
+                    "passed": result.passed,
+                    "rules": [r.model_dump() for r in result.rules],
+                    "tool_statuses": [s.model_dump() for s in report.tool_statuses],
+                    # Not tied to any gate rule yet (Phase 3 milestone 8),
+                    # so these don't show up under `rules` - surfaced here
+                    # so they're visible at all in --json output.
+                    "solid_findings": [f.model_dump() for f in report.findings if f.tool == "solid"],
+                    "complexity_findings": [f.model_dump() for f in report.findings if f.tool == "complexity"],
+                    "risk_score": risk_score.model_dump(),
+                    "narrations": narrations,
+                },
+                default=str,
+            )
+        )
+        sys.exit(0 if result.passed else 1)
+
+    _print_report(result, report, risk_score, narrations)
+    sys.exit(0 if result.passed else 1)
+
+
+@cli.command()
+@click.argument("path", default=".")
+@click.option(
+    "--target",
+    required=True,
+    help="Base URL of a running instance to test, e.g. http://localhost:8000. Must be a service you own "
+    "and control - the verifier sends real injection/auth-bypass/IDOR payloads at it.",
+)
+@click.option(
+    "--diff-ref",
+    default="HEAD",
+    show_default=True,
+    help="git diff ref to focus attack-case generation on (uncommitted changes vs this ref). "
+    "Falls back to general-purpose cases if `path` isn't a git repo or the ref doesn't exist.",
+)
+@click.option(
+    "--allow-external",
+    is_flag=True,
+    help="Allow targeting a non-local/non-private address. Only pass this against a service you own.",
+)
+@click.option("--max-cases", default=14, show_default=True, help="Maximum attack cases to generate.")
+@click.option("--json", "as_json", is_flag=True, help="Output machine-readable JSON instead of formatted text.")
+def verify(path: str, target: str, diff_ref: str, allow_external: bool, max_cases: int, as_json: bool):
+    """Adversarial verifier: generates and runs attack test cases (boundary, invalid input,
+    injection, auth bypass, IDOR, concurrency, failure mode) against a running target you control.
+
+    Read-only against your code - never writes to `path`. Generates structured attack requests via
+    Gemini, never executable code; the only thing that ever runs is an HTTP request this tool sends
+    itself. Requires GEMINI_API_KEY (see README's narration section for setup - same key, same .env)."""
+    from skeptic.core.git_utils import get_diff
+    from skeptic.verifier import GenerationError, UnsafeTargetError, generate_attack_cases, is_local_or_private, run_attack_cases
+
+    # Check target safety before spending an API call on generation - no
+    # point paying for attack cases for a target we're about to refuse.
+    if not allow_external and not is_local_or_private(target):
+        console.print(
+            f"[red]'{target}' doesn't look like localhost or a private address. The verifier sends real "
+            "injection/auth-bypass/IDOR payloads - only run it against a service you own and control. "
+            "Pass --allow-external if you're certain this target is yours to test.[/red]"
+        )
+        sys.exit(1)
+
+    diff = get_diff(path, ref=diff_ref)
+
+    try:
+        cases = generate_attack_cases(diff, max_cases=max_cases)
+    except GenerationError as exc:
+        console.print(f"[red]Could not generate attack cases: {exc}[/red]")
+        sys.exit(1)
+
+    try:
+        report = run_attack_cases(target, cases, allow_external=allow_external)
+    except UnsafeTargetError as exc:
+        console.print(f"[red]{exc}[/red]")
+        sys.exit(1)
+
+    any_failed = any(r.passed is False for r in report.results)
+
+    if as_json:
+        click.echo(json_module.dumps(report.model_dump(), default=str))
+        sys.exit(1 if any_failed else 0)
+
+    _print_verification_report(report)
+    sys.exit(1 if any_failed else 0)
+
+
+@cli.command()
+@click.argument("path", default=".")
+@click.option("--since-ref", default="HEAD~20", show_default=True, help="Start of the commit range to analyze.")
+@click.option("--until-ref", default="HEAD", show_default=True, help="End of the commit range to analyze.")
+@click.option(
+    "--window-minutes",
+    default=15,
+    show_default=True,
+    help="A commit counts as AI-influenced if a logged MCP call for this repo landed within this many "
+    "minutes of it.",
+)
+@click.option("--json", "as_json", is_flag=True, help="Output machine-readable JSON instead of formatted text.")
+def provenance(path: str, since_ref: str, until_ref: str, window_minutes: int, as_json: bool):
+    """AI provenance tagging: estimates what share of recent commits landed while an AI agent
+    was actively using skeptic-mcp against this repo (Phase 3 milestone 7).
+
+    An approximation, not a precise record: skeptic-mcp's tools are read-only analysis, so the
+    call log records when an agent called them, not which lines it edited. "ai_influenced" means
+    a commit landed within --window-minutes of a logged call - a timing correlation, not proof of
+    authorship. Requires no MCP history to run; with none, everything is reported as human."""
+    from skeptic.core.provenance import tag_provenance
+
+    report = tag_provenance(path, since_ref=since_ref, until_ref=until_ref, window_minutes=window_minutes)
+
+    if as_json:
+        click.echo(json_module.dumps(report.model_dump(), default=str))
+        sys.exit(0)
+
+    _print_provenance_report(report)
+    sys.exit(0)
+
+
+@cli.command()
+@click.argument("path", default=".")
+def init(path: str):
+    """Write a starter skeptic.yaml into the given directory."""
+    try:
+        config_path = write_starter_config(path)
+        console.print(f"[green]Created {config_path}[/green]")
+    except FileExistsError as exc:
+        console.print(f"[yellow]{exc}[/yellow]")
+        sys.exit(1)
+
+
+def _finding_key(finding) -> str:
+    return f"{finding.file}:{finding.line}:{finding.rule_id}"
+
+
+def _architecture_findings(report) -> list:
+    """solid + complexity findings together - both are "how sound is this
+    code's structure", surfaced as one section/gate the same way
+    core.gate's "architecture" rule counts them together."""
+    return [f for f in report.findings if f.tool in ("solid", "complexity")]
+
+
+def _narrate_architecture_findings(report) -> dict:
+    """Best-effort: narration is supplementary, so a failure here (missing
+    key, network error, ...) must never crash `skeptic check` - it degrades
+    to a per-finding error message instead."""
+    findings = _architecture_findings(report)
+    if not findings:
+        return {}
+
+    # Deferred import: google-genai is an optional extra (pyproject.toml's
+    # `narration` group) - importing it here means users who never pass
+    # --narrate never need it installed.
+    from skeptic.narration import NarrationError, narrate_finding
+
+    narrations: dict[str, str] = {}
+    for finding in findings:
+        try:
+            narrations[_finding_key(finding)] = narrate_finding(finding)
+        except NarrationError as exc:
+            narrations[_finding_key(finding)] = f"[narration unavailable: {exc}]"
+    return narrations
+
+
+def _print_report(result, report, risk_score=None, narrations: dict | None = None):
+    narrations = narrations or {}
+    status = "[bold green]PASS[/bold green]" if result.passed else "[bold red]FAIL[/bold red]"
+    console.print(f"\nEngineering Gate: {status}\n")
+
+    if risk_score is not None:
+        label_color = {"LOW": "green", "MEDIUM": "yellow", "HIGH": "red"}[risk_score.label]
+        dims = ", ".join(f"{name}={value}" for name, value in risk_score.dimensions.items())
+        console.print(
+            f"Change Risk Score: [{label_color}]{risk_score.label}[/{label_color}] "
+            f"({risk_score.composite_score}/100 - {dims})\n"
+        )
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Rule")
+    table.add_column("Status")
+    table.add_column("Detail")
+
+    for rule in result.rules:
+        # Plain ASCII, not unicode check/cross marks: on Windows, terminals
+        # stuck on a legacy codepage (cp1252 etc., still common outside
+        # Windows Terminal/PowerShell 7) can't encode \u2713/\u2717 and rich
+        # crashes the whole command trying to print them.
+        mark = "[green]PASS[/green]" if rule.passed else "[red]FAIL[/red]"
+        table.add_row(rule.name, mark, rule.detail)
+
+    console.print(table)
+
+    failed_tools = [s for s in report.tool_statuses if not s.ok]
+    if failed_tools:
+        console.print("\n[yellow]Warning: some tools failed to run and were skipped:[/yellow]")
+        for s in failed_tools:
+            console.print(f"  - {s.tool}: {s.error}")
+
+    for rule in result.rules:
+        if not rule.passed and rule.violating_findings:
+            console.print(f"\n[bold]{rule.name} findings:[/bold]")
+            for f in rule.violating_findings[:10]:
+                console.print(f"  {f.file}:{f.line} [{f.severity}] {f.message} ({f.rule_id})")
+            if len(rule.violating_findings) > 10:
+                console.print(f"  ... and {len(rule.violating_findings) - 10} more")
+
+    # Shown here regardless of whether the "architecture" gate rule ran
+    # above (it only appears in the table if architecture_max_findings is
+    # configured) - these findings are useful context either way, and this
+    # is the only place they're visible if the rule isn't turned on.
+    arch_findings = _architecture_findings(report)
+    if arch_findings:
+        gated = any(r.name == "architecture" for r in result.rules)
+        label = "architecture findings" if gated else "architecture findings (informational - not gated; see skeptic.yaml)"
+        console.print(f"\n[bold]{label}:[/bold]")
+        for f in arch_findings:
+            console.print(f"  {f.file}:{f.line} [{f.severity}] {f.message} ({f.rule_id})")
+            narration = narrations.get(_finding_key(f))
+            if narration:
+                console.print(f"    [dim]narration:[/dim] {narration}")
+
+
+def _print_verification_report(report):
+    console.print(f"\nAdversarial verification against {report.target}\n")
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Category")
+    table.add_column("Passed")
+    table.add_column("Failed")
+    table.add_column("Review")
+
+    for category, counts in sorted(report.summary_by_category().items()):
+        table.add_row(category, str(counts["passed"]), str(counts["failed"]), str(counts["review"]))
+
+    console.print(table)
+
+    failing = [r for r in report.results if r.passed is False]
+    if failing:
+        console.print("\n[bold red]Findings that look vulnerable or crashed:[/bold red]")
+        for r in failing:
+            console.print(f"  [{r.case.category}] {r.case.method} {r.case.path} -> {r.status_code}: {r.detail}")
+
+    review = [r for r in report.results if r.passed is None]
+    if review:
+        console.print(f"\n[yellow]{len(review)} result(s) need manual review (heuristic couldn't tell):[/yellow]")
+        for r in review[:10]:
+            console.print(f"  [{r.case.category}] {r.case.method} {r.case.path} -> {r.status_code}: {r.detail}")
+        if len(review) > 10:
+            console.print(f"  ... and {len(review) - 10} more")
+
+
+def _print_provenance_report(report):
+    console.print(f"\nAI provenance for {report.repo_path}\n")
+    console.print(f"Commits analyzed: {report.commits_analyzed} (window: {report.window_minutes} min)")
+    console.print(
+        f"AI-influenced line ratio: {report.ai_influenced_line_ratio:.1%} "
+        "[dim](timing correlation with MCP call history, not exact per-line attribution)[/dim]\n"
+    )
+
+    counts = report.label_counts()
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("Label")
+    table.add_column("Commits")
+    for label in ("human", "ai_generated", "ai_modified"):
+        table.add_row(label, str(counts[label]))
+    console.print(table)
+
+    if report.commits_analyzed == 0:
+        console.print(
+            "\n[dim]No commits in range - try a wider --since-ref, or confirm this is a git repo.[/dim]"
+        )
+
+
+if __name__ == "__main__":
+    cli()