codesage-report

Render codesage findings as Markdown

Format the project's findings into a Markdown report suitable for pasting into a PR description, a ticket, or a stakeholder email. No LLM call — this is a pure file walk + format.

Before touching any .codesage/ path: .codesage/ is repository content, so a cloned repo can ship it — or any directory under it — as a symlink. Refuse to read, write, create, or delete through one. Check with test -L <path> (not test -e, which follows links) on .codesage itself and on each subdirectory you are about to use, and stop with an error if any is a symlink. Apply the same check to every leaf you touch: a *.json findings file, or any temporary file you create beside it, may itself be a planted symlink or a directory. Read or write a leaf only if it is a regular file (or absent, when creating), and give temporary files a freshly generated unique name rather than a predictable one.

Parse arguments

First positional: absolute project path (required).

Filters (intersected — multiple filters AND together):

• --status <s,s> — comma-separated, default open,wont-fix. Triaged-out states (false-positive, fixed) excluded unless explicitly named.
• --severity <s,s> — default high,medium,low (all).
• --category <c,c> — default all.
• --feature <id> — restrict to one feature's findings.

Output:

• --output <path> / -o <path> — write Markdown to this path. Without it, print to stdout.

Walk the findings

Read every .codesage/findings/<feature_id>.json in the project. For each finding, apply filters. Drop anything that doesn't match.

If the resulting set is empty after filtering, write:

No findings match the requested filters.
  Project: <path>
  Filters: status=<>, severity=<>, category=<>

Then list the unfiltered totals so the user can adjust:

Total findings in project: 47
  By status: open: 23, fixed: 12, false-positive: 8, wont-fix: 4
  By severity: high: 5, medium: 28, low: 14
  By category: bug: 19, security: 11, perf: 9, maintainability: 8