repotoire 0.9.0

//! Diff command — compare findings between two analysis states
//!
//! Shows new findings, fixed findings, and score delta.

use anyhow::{Context, Result};
use std::path::Path;
use std::time::Instant;

use crate::models::{Finding, FindingsSummary, Grade, HealthReport, Severity};
use console::style;
use serde_json::json;

use super::diff_hunks::{Attribution, DiffHunks};

/// Check if two findings refer to the same logical issue.
///
/// Uses fuzzy matching: same detector, same file, line within ±3.
/// File-level findings (no line) match if detector and file match.
fn findings_match(a: &Finding, b: &Finding) -> bool {
    a.detector == b.detector
        && a.affected_files.first() == b.affected_files.first()
        && match (a.line_start, b.line_start) {
            (Some(la), Some(lb)) => la.abs_diff(lb) <= 3,
            (None, None) => true,
            _ => false,
        }
}

/// Result of diffing two sets of findings (raw, before attribution).
#[derive(Debug)]
struct DiffResult {
    base_ref: String,
    head_ref: String,
    new_findings: Vec<Finding>,
    fixed_findings: Vec<Finding>,
    score_before: Option<f64>,
    score_after: Option<f64>,
}

/// A finding with its attribution (how it relates to the diff).
#[derive(Debug, Clone)]
pub struct AttributedFinding {
    pub finding: Finding,
    pub attribution: Attribution,
}

/// Result of a smart diff with attribution.
#[derive(Debug)]
pub struct SmartDiffResult {
    pub base_ref: String,
    pub head_ref: String,
    pub files_changed: usize,
    pub new_findings: Vec<AttributedFinding>,
    pub all_new_count: usize,
    pub fixed_findings: Vec<Finding>,
    pub score_before: Option<f64>,
    pub score_after: Option<f64>,
    /// Accounted suppressions (`// repotoire:ignore[detector] — <reason>`) that matched a finding
    /// in the head analysis. Empty when nothing was suppressed with a recognised reason. Surfaced
    /// in `--format json` so the (later) harvest pipeline has signal; `accepted-risk` events are
    /// flagged `harvestable: false`.
    pub suppression_events: Vec<crate::models::SuppressionEvent>,
    /// Count of `Tier::Blocking` findings suppressed with a bare `// repotoire:ignore` (no
    /// accounted reason). Non-zero means the gate still fails ("suppressed without an accounted
    /// reason") even though the finding is absent from `new_findings`.
    pub suppressed_unaccounted_blocking_count: usize,
}

impl SmartDiffResult {
    pub fn score_delta(&self) -> Option<f64> {
        match (self.score_before, self.score_after) {
            (Some(before), Some(after)) => Some(after - before),
            _ => None,
        }
    }

    /// Extract just the Finding structs (for APIs that need &[Finding]).
    pub fn findings_only(&self) -> Vec<Finding> {
        self.new_findings
            .iter()
            .map(|af| af.finding.clone())
            .collect()
    }

    /// Extract hunk-level findings only.
    pub fn hunk_findings(&self) -> Vec<Finding> {
        self.new_findings
            .iter()
            .filter(|af| af.attribution == Attribution::InChangedHunk)
            .map(|af| af.finding.clone())
            .collect()
    }
}

/// Compute the diff between baseline and head findings.
fn diff_findings(
    baseline: &[Finding],
    head: &[Finding],
    base_ref: &str,
    head_ref: &str,
    score_before: Option<f64>,
    score_after: Option<f64>,
) -> DiffResult {
    let new_findings: Vec<Finding> = head
        .iter()
        .filter(|h| !baseline.iter().any(|b| findings_match(b, h)))
        .cloned()
        .collect();

    let fixed_findings: Vec<Finding> = baseline
        .iter()
        .filter(|b| !head.iter().any(|h| findings_match(b, h)))
        .cloned()
        .collect();

    DiffResult {
        base_ref: base_ref.to_string(),
        head_ref: head_ref.to_string(),
        new_findings,
        fixed_findings,
        score_before,
        score_after,
    }
}

// ---------------------------------------------------------------------------
// Output formatters
// ---------------------------------------------------------------------------

fn severity_icon(severity: &Severity) -> &'static str {
    match severity {
        Severity::Critical => "[C]",
        Severity::High => "[H]",
        Severity::Medium => "[M]",
        Severity::Low => "[L]",
        Severity::Info => "[I]",
    }
}

/// A finding's tier as it should be presented in the diff: `Blocking` findings lead the report;
/// everything else (Advisory, Deep) is shown under "Advisory".
fn is_blocking(finding: &Finding) -> bool {
    finding.tier >= crate::models::Tier::Blocking
}

/// Render a `SourceSpan` as `path:line` (just the start line — that's what reads in a terminal).
fn span_loc(span: &crate::models::SourceSpan) -> String {
    format!("{}:{}", span.file.display(), span.line_start)
}

/// Mask a secret value, keeping only its last 4 characters visible.
/// Used for the inline `Evidence::Secret` rendering — the format name already says *what* it is;
/// the masked tail is enough to find it in the file without leaking it into a CI log.
fn mask_secret(raw: &str) -> String {
    let trimmed = raw
        .trim()
        .trim_matches(|c| c == '"' || c == '\'' || c == '`');
    let n = trimmed.chars().count();
    if n <= 4 {
        "****".to_string()
    } else {
        let tail: String = trimmed.chars().skip(n.saturating_sub(4)).collect();
        format!("****…{tail}")
    }
}

/// Render a finding's evidence inline as a single human-readable line (or `None` if it has none).
fn render_evidence_inline(finding: &Finding) -> Option<String> {
    use crate::models::Evidence;
    match finding.evidence.as_ref()? {
        Evidence::TaintPath {
            source,
            sink,
            sink_kind,
            ..
        } => Some(format!(
            "tainted flow: {} → {} sink at {}",
            span_loc(source),
            sink_kind,
            span_loc(sink)
        )),
        Evidence::Secret { span, format, .. } => {
            let masked = span
                .snippet
                .as_deref()
                .map(mask_secret)
                .unwrap_or_else(|| "(redacted)".to_string());
            Some(format!("{format}: {masked} at {}", span_loc(span)))
        }
        Evidence::ConfigFact { span, rule } => Some(format!("{rule} at {}", span_loc(span))),
    }
}

/// Format a single finding line for text output.
fn format_finding_line(out: &mut String, finding: &Finding, _no_emoji: bool) {
    let file = finding
        .affected_files
        .first()
        .map(|p| p.display().to_string())
        .unwrap_or_default();
    let line = finding
        .line_start
        .map(|l| format!(":{l}"))
        .unwrap_or_default();
    out.push_str(&format!(
        "  {} {:<40} {}{}\n",
        severity_icon(&finding.severity),
        &finding.title.chars().take(40).collect::<String>(),
        file,
        line
    ));
}

/// Format a blocking finding: the headline line, then its evidence indented underneath, then the
/// suppress-with-a-reason instruction (the only legitimate way to make the gate pass without a fix).
fn format_blocking_finding(out: &mut String, finding: &Finding, no_emoji: bool) {
    format_finding_line(out, finding, no_emoji);
    if let Some(ev) = render_evidence_inline(finding) {
        out.push_str(&format!("      {}\n", style(ev).dim()));
    }
    out.push_str(&format!(
        "      {}\n",
        style(format!(
            "fix it, or — if it's an accepted risk — // repotoire:ignore[{}] — <reason>",
            finding.detector
        ))
        .dim()
    ));
}

/// Severity × confidence weight, for ordering findings within a section (most-worth-a-glance first).
fn severity_confidence_rank(finding: &Finding) -> f64 {
    let sev = match finding.severity {
        Severity::Critical => 5.0,
        Severity::High => 4.0,
        Severity::Medium => 3.0,
        Severity::Low => 2.0,
        Severity::Info => 1.0,
    };
    sev * finding.confidence.unwrap_or(0.5)
}

/// Sort attributed findings by [`severity_confidence_rank`], highest first.
fn sort_by_rank_desc(findings: &mut [&AttributedFinding]) {
    findings.sort_by(|a, b| {
        severity_confidence_rank(&b.finding)
            .partial_cmp(&severity_confidence_rank(&a.finding))
            .unwrap_or(std::cmp::Ordering::Equal)
    });
}

/// Render the diff result as colored terminal text.
///
/// Leads with `Blocking` findings (each with its evidence inline) under the "🛑 Blocking" header,
/// then the `Advisory` findings, then — only when `show_score` is set — the score delta.
/// When `no_emoji` is true, plain ASCII markers are used instead of emoji.
pub fn format_text(result: &SmartDiffResult, no_emoji: bool, show_score: bool) -> String {
    let mut out = String::new();

    // Header
    out.push_str(&format!(
        "Repotoire Diff: {}..{} ({} files changed)\n\n",
        result.base_ref, result.head_ref, result.files_changed,
    ));

    // ── Blocking — leads the report ─────────────────────────────────────
    let mut blocking: Vec<_> = result
        .new_findings
        .iter()
        .filter(|af| is_blocking(&af.finding))
        .collect();
    sort_by_rank_desc(&mut blocking);

    if blocking.is_empty() {
        let check = if no_emoji { "[ok]" } else { "\u{2705}" };
        out.push_str(&format!(
            "{} {}\n\n",
            check,
            style("Nothing in this change trips the gate.").green()
        ));
        if result.suppressed_unaccounted_blocking_count > 0 {
            out.push_str(&format!(
                "{}\n\n",
                style(format!(
                    "(but {} blocking finding{} suppressed with a bare `// repotoire:ignore` — \
                     the gate still fails; use `// repotoire:ignore[detector] — <reason>`)",
                    result.suppressed_unaccounted_blocking_count,
                    if result.suppressed_unaccounted_blocking_count == 1 {
                        " is"
                    } else {
                        "s are"
                    }
                ))
                .red()
            ));
        }
    } else {
        let stop = if no_emoji { "" } else { "\u{1f6d1} " };
        out.push_str(&format!(
            "{}{}\n",
            stop,
            style(format!(
                "Blocking — fix before this merges ({} finding{})",
                blocking.len(),
                if blocking.len() == 1 { "" } else { "s" }
            ))
            .red()
            .bold()
        ));
        for af in &blocking {
            format_blocking_finding(&mut out, &af.finding, no_emoji);
        }
        out.push('\n');
    }

    // ── Advisory ────────────────────────────────────────────────────────
    let mut advisory: Vec<_> = result
        .new_findings
        .iter()
        .filter(|af| !is_blocking(&af.finding))
        .collect();
    sort_by_rank_desc(&mut advisory);

    if !advisory.is_empty() {
        out.push_str(&format!(
            "{}\n",
            style(format!(
                "Advisory ({} finding{})",
                advisory.len(),
                if advisory.len() == 1 { "" } else { "s" }
            ))
            .bold()
        ));
        // A per-line attribution marker only when the set is mixed (hunk + non-hunk) — keeps the
        // common "all in your changes" case uncluttered.
        let mixed = advisory
            .iter()
            .any(|af| af.attribution != Attribution::InChangedHunk)
            && advisory
                .iter()
                .any(|af| af.attribution == Attribution::InChangedHunk);
        for af in &advisory {
            format_finding_line(&mut out, &af.finding, no_emoji);
            if mixed && af.attribution != Attribution::InChangedHunk {
                out.push_str(&format!(
                    "      {}\n",
                    style("(pre-existing — not introduced by this change)").dim()
                ));
            }
        }
        out.push('\n');
    }

    // Findings filtered out of the report by the attribution scope (`--all` shows them).
    let hidden = result
        .all_new_count
        .saturating_sub(result.new_findings.len());
    if hidden > 0 {
        let info_icon = if no_emoji { "i" } else { "\u{2139}\u{fe0f}" };
        out.push_str(&format!(
            "{} {} finding{} in other files (use --all to see)\n\n",
            style(info_icon).dim(),
            hidden,
            if hidden == 1 { "" } else { "s" }
        ));
    }

    // Fixed findings
    if !result.fixed_findings.is_empty() {
        let prefix = if no_emoji { "" } else { "\u{2728} " };
        out.push_str(&format!(
            "{}{} finding{} fixed\n",
            prefix,
            result.fixed_findings.len(),
            if result.fixed_findings.len() == 1 {
                ""
            } else {
                "s"
            }
        ));
    }

    // ── Score (de-emphasised — only on request) ─────────────────────────
    if show_score {
        if let (Some(before), Some(after)) = (result.score_before, result.score_after) {
            let delta = after - before;
            let delta_str = if delta >= 0.0 {
                style(format!("+{:.1}", delta)).green().to_string()
            } else {
                style(format!("{:.1}", delta)).red().to_string()
            };
            out.push_str(&format!(
                "\nScore: {:.1} \u{2192} {:.1} ({})\n",
                before, after, delta_str,
            ));
        }
    }

    out
}

/// Render the diff result as clean Markdown (no ANSI escapes).
pub fn format_markdown(result: &SmartDiffResult) -> String {
    let mut out = String::new();

    out.push_str(&format!(
        "# Repotoire Diff: {}..{} ({} files changed)\n\n",
        result.base_ref, result.head_ref, result.files_changed,
    ));

    let hunk_findings: Vec<_> = result
        .new_findings
        .iter()
        .filter(|af| af.attribution == Attribution::InChangedHunk)
        .collect();
    let file_findings: Vec<_> = result
        .new_findings
        .iter()
        .filter(|af| af.attribution == Attribution::InChangedFile)
        .collect();
    let unrelated_findings: Vec<_> = result
        .new_findings
        .iter()
        .filter(|af| af.attribution == Attribution::InUnchangedFile)
        .collect();

    if result.new_findings.is_empty() && result.all_new_count > 0 {
        out.push_str("**No new findings in your changes.**\n\n");
        out.push_str(&format!(
            "> {} finding{} in other files (use `--all` to see)\n\n",
            result.all_new_count,
            if result.all_new_count == 1 { "" } else { "s" }
        ));
    } else if result.new_findings.is_empty() {
        out.push_str("**No new findings.**\n\n");
    } else {
        if !hunk_findings.is_empty() {
            out.push_str(&format!(
                "## Your Changes ({} finding{})\n\n",
                hunk_findings.len(),
                if hunk_findings.len() == 1 { "" } else { "s" }
            ));
            out.push_str("| Severity | Finding | Location |\n");
            out.push_str("|----------|---------|----------|\n");
            for af in &hunk_findings {
                format_markdown_row(&mut out, &af.finding);
            }
            out.push('\n');
        }

        if !file_findings.is_empty() {
            out.push_str(&format!(
                "## Pre-existing ({} in changed files)\n\n",
                file_findings.len()
            ));
            out.push_str("| Severity | Finding | Location |\n");
            out.push_str("|----------|---------|----------|\n");
            for af in &file_findings {
                format_markdown_row(&mut out, &af.finding);
            }
            out.push('\n');
        }

        if !unrelated_findings.is_empty() {
            out.push_str(&format!(
                "## Unrelated ({} in unchanged files)\n\n",
                unrelated_findings.len()
            ));
            out.push_str("| Severity | Finding | Location |\n");
            out.push_str("|----------|---------|----------|\n");
            for af in &unrelated_findings {
                format_markdown_row(&mut out, &af.finding);
            }
            out.push('\n');
        }
    }

    // Score delta
    if let (Some(before), Some(after)) = (result.score_before, result.score_after) {
        let delta = after - before;
        let sign = if delta >= 0.0 { "+" } else { "" };
        out.push_str(&format!(
            "**Score:** {:.1} \u{2192} {:.1} ({}{:.1})\n\n",
            before, after, sign, delta,
        ));
    }

    if !result.fixed_findings.is_empty() {
        out.push_str(&format!(
            "{} finding{} fixed\n",
            result.fixed_findings.len(),
            if result.fixed_findings.len() == 1 {
                ""
            } else {
                "s"
            }
        ));
    }

    out
}

/// Format a single finding as a Markdown table row.
fn format_markdown_row(out: &mut String, finding: &Finding) {
    let file = finding
        .affected_files
        .first()
        .map(|p| p.display().to_string())
        .unwrap_or_default();
    let line = finding
        .line_start
        .map(|l| format!(":{l}"))
        .unwrap_or_default();
    let title: String = finding
        .title
        .chars()
        .take(60)
        .collect::<String>()
        .replace('|', "\\|");
    out.push_str(&format!(
        "| {} | {} | `{}{}` |\n",
        finding.severity, title, file, line
    ));
}

/// Render the diff result as pretty-printed JSON.
pub fn format_json(result: &SmartDiffResult) -> String {
    let all_findings = result.findings_only();
    let new_summary = FindingsSummary::from_findings(&all_findings);
    let fixed_summary = FindingsSummary::from_findings(&result.fixed_findings);

    let score_delta = result.score_delta();

    let new_findings_json: Vec<serde_json::Value> = result
        .new_findings
        .iter()
        .map(|af| {
            json!({
                "detector": af.finding.detector,
                "severity": af.finding.severity.to_string(),
                "tier": af.finding.tier.to_string(),
                "evidence": af.finding.evidence,
                "confidence": af.finding.confidence,
                "suppressed": af.finding.suppressed,
                "suppression_reason": af.finding.suppression_reason,
                "title": af.finding.title,
                "description": af.finding.description,
                "file": af.finding.affected_files.first().map(|p| p.display().to_string()).unwrap_or_default(),
                "line": af.finding.line_start,
                "attribution": match af.attribution {
                    Attribution::InChangedHunk => "in_changed_hunk",
                    Attribution::InChangedFile => "in_changed_file",
                    Attribution::InUnchangedFile => "in_unchanged_file",
                },
            })
        })
        .collect();

    let fixed_findings_json: Vec<serde_json::Value> = result
        .fixed_findings
        .iter()
        .map(|f| {
            json!({
                "detector": f.detector,
                "severity": f.severity.to_string(),
                "title": f.title,
                "file": f.affected_files.first().map(|p| p.display().to_string()).unwrap_or_default(),
                "line": f.line_start,
            })
        })
        .collect();

    let output = json!({
        "base_ref": result.base_ref,
        "head_ref": result.head_ref,
        "files_changed": result.files_changed,
        "total_new_findings": result.all_new_count,
        "new_findings": new_findings_json,
        "fixed_findings": fixed_findings_json,
        "suppression_events": result.suppression_events,
        "suppressed_unaccounted_blocking_count": result.suppressed_unaccounted_blocking_count,
        "score_before": result.score_before,
        "score_after": result.score_after,
        "score_delta": score_delta,
        "summary": {
            "new": {
                "critical": new_summary.critical,
                "high": new_summary.high,
                "medium": new_summary.medium,
                "low": new_summary.low,
            },
            "fixed": {
                "critical": fixed_summary.critical,
                "high": fixed_summary.high,
                "medium": fixed_summary.medium,
                "low": fixed_summary.low,
            },
        },
    });

    serde_json::to_string_pretty(&output).expect("JSON serialization should not fail")
}

/// Render the diff result as SARIF 2.1.0 (only hunk-level findings).
///
/// Builds a temporary `HealthReport` containing only the hunk findings,
/// then delegates to the existing SARIF reporter.
pub fn format_sarif(result: &SmartDiffResult) -> anyhow::Result<String> {
    let hunk_findings = result.hunk_findings();
    let report = HealthReport {
        overall_score: result.score_after.unwrap_or(0.0),
        grade: Grade::default(),
        structure_score: 0.0,
        quality_score: 0.0,
        architecture_score: None,
        findings_summary: FindingsSummary::from_findings(&hunk_findings),
        findings: hunk_findings,
        total_files: 0,
        total_functions: 0,
        total_classes: 0,
        total_loc: 0,
        suppression_events: Vec::new(),
        suppressed_unaccounted_blocking_count: 0,
    };

    crate::reporters::report_with_format(&report, crate::reporters::OutputFormat::Sarif)
}

/// Run analysis inline and cache results so diff can load them.
fn run_inline_analysis(repo_path: &Path, repotoire_dir: &Path) -> Result<()> {
    let session_dir = repotoire_dir.join("session");
    let mut engine = match crate::engine::AnalysisEngine::load(&session_dir, repo_path, false) {
        Ok(e) => e,
        Err(_) => crate::engine::AnalysisEngine::new(repo_path, false)?,
    };

    let config = crate::engine::AnalysisConfig::default();
    let result = engine.analyze(&config)?;

    // Build a HealthReport for cache_results
    let findings_summary = FindingsSummary::from_findings(&result.findings);
    let report = crate::models::HealthReport {
        overall_score: result.score.overall,
        grade: result.score.grade,
        structure_score: result.score.breakdown.structure.final_score,
        quality_score: result.score.breakdown.quality.final_score,
        architecture_score: Some(result.score.breakdown.architecture.final_score),
        findings: result.findings.clone(),
        findings_summary,
        total_files: result.stats.files_analyzed,
        total_functions: result.stats.total_functions,
        total_classes: result.stats.total_classes,
        total_loc: result.stats.total_loc,
        suppression_events: result.suppression_events.clone(),
        suppressed_unaccounted_blocking_count: result.suppressed_unaccounted_blocking.len(),
    };

    super::analyze::output::cache_results(repotoire_dir, &report, &result.findings)?;

    if let Err(e) = engine.save(&session_dir) {
        tracing::debug!("Failed to save session after inline analysis: {e}");
    }

    Ok(())
}

/// Load baseline and head findings from cache, returning them along with scores.
fn load_baseline_and_head(
    repotoire_dir: &Path,
    _repo_path: &Path,
    _base_ref: Option<&str>,
) -> Result<(Vec<Finding>, Vec<Finding>, Option<f64>, Option<f64>)> {
    // Load baseline findings from snapshot (saved by a previous `analyze`)
    let baseline_path = repotoire_dir.join("baseline_findings.json");
    let baseline = if baseline_path.exists() {
        use super::analyze::output::CacheLoadOutcome;
        let outcome = super::analyze::output::load_cached_findings_outcome_from(&baseline_path);
        match outcome {
            CacheLoadOutcome::Findings(v) => v,
            outcome @ CacheLoadOutcome::Corrupt { .. } => {
                // Bug 3 surface: a corrupt baseline cache previously
                // degraded silently to "no baseline" (every finding
                // shown as new). Surface the warning on stdout and
                // continue with an empty baseline, equivalent to
                // first-run UX. Bailing here is wrong because the
                // outer auto-re-analyze fallback can't actually
                // overwrite a stale baseline (`cache_results` only
                // snapshots `last_findings.json` into
                // `baseline_findings.json`, never overwrites it
                // unconditionally), so we'd loop the same error.
                //
                // The outcome is reused (not re-fetched) so the
                // underlying `tracing::warn!` events emit once per
                // invocation, not twice.
                if let Some(msg) = outcome.user_warning() {
                    println!("{}", msg);
                }
                println!(
                    "  Treating as first-run (no baseline); all findings will appear as new. \
                     Delete the corrupt file or run `repotoire analyze` twice to rebuild it."
                );
                Vec::new()
            }
            CacheLoadOutcome::Missing | CacheLoadOutcome::VersionMismatch { .. } => Vec::new(),
        }
    } else {
        // No baseline yet — treat everything as new (first-run scenario)
        Vec::new()
    };

    let score_before = load_score_from(&if baseline_path.exists() {
        repotoire_dir.join("baseline_health.json")
    } else {
        repotoire_dir.join("last_health.json")
    });

    // Load current findings from cache (from the most recent `analyze` run)
    let head = {
        use super::analyze::output::CacheLoadOutcome;
        let last_findings = repotoire_dir.join("last_findings.json");
        let outcome = super::analyze::output::load_cached_findings_outcome_from(&last_findings);
        match outcome {
            CacheLoadOutcome::Findings(v) => v,
            outcome @ CacheLoadOutcome::Corrupt { .. } => {
                // Same single-call discipline as the baseline branch
                // above: reuse `outcome` so we don't double-log.
                if let Some(msg) = outcome.user_warning() {
                    println!("{}", msg);
                }
                anyhow::bail!(
                    "current findings cache is corrupt; re-run `repotoire analyze` to regenerate it"
                );
            }
            CacheLoadOutcome::Missing | CacheLoadOutcome::VersionMismatch { .. } => {
                anyhow::bail!(
                    "No current analysis found. Run 'repotoire analyze' to generate findings."
                );
            }
        }
    };
    let score_after = load_cached_score(repotoire_dir);

    Ok((baseline, head, score_before, score_after))
}

/// Send telemetry event for the diff run.
fn send_diff_telemetry(
    telemetry: &crate::telemetry::Telemetry,
    repo_path: &Path,
    result: &SmartDiffResult,
) {
    if let crate::telemetry::Telemetry::Active(ref state) = *telemetry {
        if let Some(distinct_id) = &state.distinct_id {
            let repo_id = crate::telemetry::config::compute_repo_id(repo_path);
            let event = crate::telemetry::events::DiffRun {
                repo_id,
                score_before: result.score_before.unwrap_or(0.0),
                score_after: result.score_after.unwrap_or(0.0),
                score_delta: result.score_delta().unwrap_or(0.0),
                findings_added: result.all_new_count as u64,
                findings_removed: result.fixed_findings.len() as u64,
                version: env!("CARGO_PKG_VERSION").to_string(),
                ..Default::default()
            };
            let props = serde_json::to_value(&event).unwrap_or_default();
            crate::telemetry::posthog::capture_queued("diff_run", distinct_id, props);
        }
    }
}

/// Format the diff result and write it to the output destination.
fn emit_output(
    result: &SmartDiffResult,
    format: crate::reporters::OutputFormat,
    no_emoji: bool,
    show_score: bool,
    output: Option<&Path>,
    start: Instant,
) -> Result<()> {
    use crate::reporters::OutputFormat;

    let output_str = match format {
        OutputFormat::Json => format_json(result),
        OutputFormat::Sarif => format_sarif(result)?,
        OutputFormat::Markdown => format_markdown(result),
        _ => format_text(result, no_emoji, show_score),
    };

    if let Some(out_path) = output {
        std::fs::write(out_path, &output_str)?;
        eprintln!("Report written to: {}", out_path.display());
    } else {
        println!("{}", output_str);
    }

    // Summary (text mode only)
    if !matches!(
        format,
        OutputFormat::Json | OutputFormat::Sarif | OutputFormat::Markdown
    ) {
        let elapsed = start.elapsed();
        let prefix = if no_emoji { "" } else { "✨ " };
        eprintln!(
            "{}Diff complete in {:.2}s ({} new, {} fixed)",
            prefix,
            elapsed.as_secs_f64(),
            result.new_findings.len(),
            result.fixed_findings.len()
        );
    }

    Ok(())
}

/// Check whether new findings in changed hunks should fail the gate.
///
/// `--fail-on-tier <tier>` (the 0.9.0 gate) fails iff a new finding in the changed hunks is at
/// that tier or higher. A `Blocking` finding suppressed with a *bare* `// repotoire:ignore`
/// (no accounted reason) is hidden from the reported set but still fails the gate — see
/// `suppressed_unaccounted_blocking_count` and design §3 ("a `Blocking` finding suppressed only
/// by `DisplayOnly` is *not* gate-suppressed"). `--fail-on <severity>` is the deprecated
/// severity-based predecessor; passing both is an error.
fn check_fail_threshold(
    fail_on: Option<Severity>,
    fail_on_tier: Option<crate::models::Tier>,
    result: &SmartDiffResult,
) -> Result<()> {
    if fail_on.is_some() && fail_on_tier.is_some() {
        anyhow::bail!("--fail-on and --fail-on-tier are mutually exclusive; use --fail-on-tier");
    }

    if let Some(tier) = fail_on_tier {
        let tripped = result
            .hunk_findings()
            .iter()
            .filter(|f| f.tier >= tier)
            .count();
        if tripped > 0 {
            anyhow::bail!(
                "Failing due to --fail-on-tier={}: {} new {}+ finding(s) in changed hunks",
                tier,
                tripped,
                tier
            );
        }
        // A `Blocking` finding suppressed without an accounted reason still fails the gate at
        // any `--fail-on-tier` (Blocking >= every tier). The finding is absent from
        // `new_findings` (hidden from the report), so it can only be caught here.
        if result.suppressed_unaccounted_blocking_count > 0 {
            anyhow::bail!(
                "Failing due to --fail-on-tier={}: {} blocking finding(s) suppressed without an \
                 accounted reason — name a reason: `// repotoire:ignore[<detector>] — <reason>`",
                tier,
                result.suppressed_unaccounted_blocking_count
            );
        }
        return Ok(());
    }

    if let Some(threshold) = fail_on {
        eprintln!("warning: --fail-on is deprecated; use --fail-on-tier blocking");
        let hunk_findings = result.hunk_findings();
        let new_summary = FindingsSummary::from_findings(&hunk_findings);
        let should_fail = match threshold {
            Severity::Critical => new_summary.critical > 0,
            Severity::High => new_summary.critical > 0 || new_summary.high > 0,
            Severity::Medium => {
                new_summary.critical > 0 || new_summary.high > 0 || new_summary.medium > 0
            }
            Severity::Low | Severity::Info => {
                new_summary.critical > 0
                    || new_summary.high > 0
                    || new_summary.medium > 0
                    || new_summary.low > 0
            }
        };
        if should_fail {
            anyhow::bail!(
                "Failing due to --fail-on={}: {} new finding(s) in changed hunks",
                threshold,
                hunk_findings.len()
            );
        }
    }
    Ok(())
}

/// Options controlling side effects of `compute_smart_diff`.
///
/// The `repotoire diff` command sets both true; the Claude Code hook sets both false.
#[derive(Debug, Clone, Copy)]
pub(crate) struct SmartDiffOptions {
    /// If true, run a full inline analysis when no cache is found (slow path used by `repotoire diff`).
    /// If false, return `Ok(None)` instead — the hook context where we never block on a 14s analyze.
    pub allow_inline_analysis: bool,
    /// If true, emit a PostHog `diff_run` telemetry event on success.
    pub emit_telemetry: bool,
}

impl Default for SmartDiffOptions {
    fn default() -> Self {
        Self {
            allow_inline_analysis: true,
            emit_telemetry: true,
        }
    }
}

/// Compute a smart diff against a cached baseline.
///
/// Returns:
/// - `Ok(Some(result))` — baseline was loaded (or auto-analysis ran when allowed) and diff produced.
/// - `Ok(None)` — no baseline cached AND `options.allow_inline_analysis == false` (hook path: skip silently).
/// - `Err(_)` — git not present, repo path bad, or analysis failed.
pub(crate) fn compute_smart_diff(
    repo_path: &Path,
    base_ref: Option<&str>,
    all: bool,
    changed: bool,
    working_tree: bool,
    options: SmartDiffOptions,
    telemetry: &crate::telemetry::Telemetry,
) -> Result<Option<SmartDiffResult>> {
    let repo_path = repo_path
        .canonicalize()
        .context("Cannot resolve repository path")?;

    if !repo_path.join(".git").exists() {
        anyhow::bail!(
            "diff requires a git repository (no .git found in {})",
            repo_path.display()
        );
    }

    // Resolve cache dir without creating it (creating is the caller's choice).
    let repotoire_dir = crate::cache::paths::cache_dir(&repo_path);

    let load_result = load_baseline_and_head(&repotoire_dir, &repo_path, base_ref);
    let (baseline, head, score_before, score_after) = match load_result {
        Ok(t) => t,
        // A *corrupt* findings cache is a loud failure (Audit pass 2): `load_baseline_and_head`
        // has already printed the user-facing warning — propagate the error so `repotoire diff`
        // exits non-zero. Do NOT fall through to the auto-analyze path: re-running `analyze`
        // would silently overwrite the corrupt file and mask the problem. A *missing* cache
        // (the arm below) is a different, benign case where auto-analyzing is the right call.
        Err(e) if e.to_string().contains("findings cache is corrupt") => return Err(e),
        Err(e) => {
            tracing::debug!("load_baseline_and_head failed: {e}");
            if !options.allow_inline_analysis {
                // Hook path: never trigger an inline analyze. Skip silently.
                return Ok(None);
            }
            // `repotoire diff` path: ensure cache dir exists, run inline analysis, retry load.
            let repotoire_dir = crate::cache::ensure_cache_dir(&repo_path)
                .context("Failed to create cache directory")?;
            eprintln!("No cached analysis found, running analysis...");
            run_inline_analysis(&repo_path, &repotoire_dir)?;
            load_baseline_and_head(&repotoire_dir, &repo_path, base_ref)
                .context("Analysis completed but could not load findings")?
        }
    };

    let base_label = base_ref.unwrap_or(if working_tree { "HEAD" } else { "cached" });
    let head_label = if working_tree { "working-tree" } else { "HEAD" };
    let raw_diff = diff_findings(
        &baseline,
        &head,
        base_label,
        head_label,
        score_before,
        score_after,
    );

    let effective_base = base_ref.unwrap_or(if working_tree { "HEAD" } else { "HEAD~1" });
    let hunks = if working_tree {
        DiffHunks::from_git_diff_worktree(&repo_path, effective_base)
    } else {
        DiffHunks::from_git_diff(&repo_path, effective_base)
    }
    .unwrap_or_else(|e| {
        tracing::debug!("git diff -U0 failed: {e}, attributing all as InUnchangedFile");
        DiffHunks::parse_diff("")
    });

    let all_attributed: Vec<AttributedFinding> = raw_diff
        .new_findings
        .into_iter()
        .map(|f| {
            let attr = f
                .affected_files
                .first()
                .map(|path| hunks.attribute(path, f.line_start))
                .unwrap_or(Attribution::InUnchangedFile);
            AttributedFinding {
                finding: f,
                attribution: attr,
            }
        })
        .collect();

    let all_new_count = all_attributed.len();

    let filtered: Vec<AttributedFinding> = if all {
        all_attributed
    } else if changed {
        all_attributed
            .into_iter()
            .filter(|af| af.attribution != Attribution::InUnchangedFile)
            .collect()
    } else {
        all_attributed
            .into_iter()
            .filter(|af| af.attribution == Attribution::InChangedHunk)
            .collect()
    };

    // The suppression audit trail is "this run" = the head analysis, persisted alongside
    // `last_findings.json` by `cache_results`.
    let (suppression_events, suppressed_unaccounted_blocking_count) =
        super::analyze::output::load_suppression_audit_from(
            &repotoire_dir.join("last_findings.json"),
        );

    let result = SmartDiffResult {
        base_ref: raw_diff.base_ref,
        head_ref: raw_diff.head_ref,
        files_changed: hunks.changed_file_count(),
        new_findings: filtered,
        all_new_count,
        fixed_findings: raw_diff.fixed_findings,
        score_before: raw_diff.score_before,
        score_after: raw_diff.score_after,
        suppression_events,
        suppressed_unaccounted_blocking_count,
    };

    if options.emit_telemetry {
        send_diff_telemetry(telemetry, &repo_path, &result);
    }

    Ok(Some(result))
}

pub struct RunArgs<'a> {
    pub repo_path: &'a Path,
    pub base_ref: Option<String>,
    pub format: crate::reporters::OutputFormat,
    pub fail_on: Option<crate::models::Severity>,
    pub fail_on_tier: Option<crate::models::Tier>,
    pub no_emoji: bool,
    /// Show the health-score delta block (it is de-emphasised — hidden by default in text output).
    pub show_score: bool,
    pub output: Option<&'a Path>,
    pub all: bool,
    pub changed: bool,
    /// Attribute findings to changes vs the working tree (incl. uncommitted + untracked),
    /// not just `<ref>..HEAD`. When set and `base_ref` is `None`, the baseline is `HEAD`.
    pub working_tree: bool,
    pub telemetry: &'a crate::telemetry::Telemetry,
}

/// Run the diff command (presentation wrapper around `compute_smart_diff`).
pub fn run(args: RunArgs<'_>) -> Result<()> {
    let RunArgs {
        repo_path,
        base_ref,
        format,
        fail_on,
        fail_on_tier,
        no_emoji,
        show_score,
        output,
        all,
        changed,
        working_tree,
        telemetry,
    } = args;
    let start = Instant::now();
    let result = compute_smart_diff(
        repo_path,
        base_ref.as_deref(),
        all,
        changed,
        working_tree,
        SmartDiffOptions::default(),
        telemetry,
    )?;
    let result =
        result.expect("compute_smart_diff returns Some when allow_inline_analysis is true");

    emit_output(&result, format, no_emoji, show_score, output, start)?;
    check_fail_threshold(fail_on, fail_on_tier, &result)?;
    Ok(())
}

/// Load cached health score from last_health.json.
fn load_cached_score(repotoire_dir: &Path) -> Option<f64> {
    load_score_from(&repotoire_dir.join("last_health.json"))
}

/// Load health score from a specific JSON file.
fn load_score_from(path: &Path) -> Option<f64> {
    let data = std::fs::read_to_string(path).ok()?;
    let json_val: serde_json::Value = serde_json::from_str(&data).ok()?;
    json_val.get("health_score").and_then(|v| v.as_f64())
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::models::Severity;
    use std::path::PathBuf;

    fn make_finding(detector: &str, file: &str, line: Option<u32>) -> Finding {
        Finding {
            detector: detector.to_string(),
            affected_files: vec![PathBuf::from(file)],
            line_start: line,
            severity: Severity::Medium,
            title: "test".to_string(),
            ..Default::default()
        }
    }

    #[test]
    fn test_exact_match() {
        let a = make_finding("dead_code", "src/foo.rs", Some(10));
        let b = make_finding("dead_code", "src/foo.rs", Some(10));
        assert!(findings_match(&a, &b));
    }

    #[test]
    fn fail_on_tier_blocking_trips_only_on_new_blocking() {
        use crate::models::Tier;

        let make_attr = |detector: &str, tier: Tier| AttributedFinding {
            finding: Finding {
                tier,
                ..make_finding(detector, "src/web.rs", Some(5))
            },
            attribution: Attribution::InChangedHunk,
        };

        let mut result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![
                make_attr("xss", Tier::Advisory),
                make_attr("command_injection", Tier::Blocking),
            ],
            all_new_count: 2,
            fixed_findings: vec![],
            score_before: Some(96.0),
            score_after: Some(95.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        // A new Blocking finding in the changed hunks trips --fail-on-tier blocking.
        assert!(check_fail_threshold(None, Some(Tier::Blocking), &result).is_err());

        // Drop the Blocking finding — only Advisory left — and it passes.
        result
            .new_findings
            .retain(|af| af.finding.tier != Tier::Blocking);
        assert!(check_fail_threshold(None, Some(Tier::Blocking), &result).is_ok());
        // ...but --fail-on-tier advisory still trips on the remaining Advisory finding.
        assert!(check_fail_threshold(None, Some(Tier::Advisory), &result).is_err());

        // Passing both --fail-on and --fail-on-tier is an error.
        let err = check_fail_threshold(Some(Severity::High), Some(Tier::Blocking), &result)
            .expect_err("both flags should be rejected");
        assert!(err.to_string().contains("mutually exclusive"));
    }

    #[test]
    fn fail_on_tier_trips_on_unaccounted_blocking_suppression() {
        use crate::models::Tier;

        // No findings in `new_findings`, but a Blocking finding was suppressed with a bare
        // `// repotoire:ignore` (no accounted reason): the gate must still fail — at every
        // `--fail-on-tier`, since Blocking >= every tier. See design §3.
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![],
            all_new_count: 0,
            fixed_findings: vec![],
            score_before: Some(96.0),
            score_after: Some(96.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 1,
        };

        let err = check_fail_threshold(None, Some(Tier::Blocking), &result)
            .expect_err("an unaccounted blocking suppression must fail --fail-on-tier blocking");
        assert!(err
            .to_string()
            .contains("suppressed without an accounted reason"));
        // Also fails under a wider tier.
        assert!(check_fail_threshold(None, Some(Tier::Advisory), &result).is_err());
        // ...but with no `--fail-on-tier` set, this alone does not fail.
        assert!(check_fail_threshold(None, None, &result).is_ok());
    }

    #[test]
    fn test_fuzzy_line_match_within_tolerance() {
        let a = make_finding("dead_code", "src/foo.rs", Some(10));
        let b = make_finding("dead_code", "src/foo.rs", Some(13)); // +3
        assert!(findings_match(&a, &b));

        let c = make_finding("dead_code", "src/foo.rs", Some(7)); // -3
        assert!(findings_match(&a, &c));
    }

    #[test]
    fn test_fuzzy_line_beyond_tolerance() {
        let a = make_finding("dead_code", "src/foo.rs", Some(10));
        let b = make_finding("dead_code", "src/foo.rs", Some(14)); // +4
        assert!(!findings_match(&a, &b));
    }

    #[test]
    fn test_different_detector_no_match() {
        let a = make_finding("dead_code", "src/foo.rs", Some(10));
        let b = make_finding("magic_number", "src/foo.rs", Some(10));
        assert!(!findings_match(&a, &b));
    }

    #[test]
    fn test_different_file_no_match() {
        let a = make_finding("dead_code", "src/foo.rs", Some(10));
        let b = make_finding("dead_code", "src/bar.rs", Some(10));
        assert!(!findings_match(&a, &b));
    }

    #[test]
    fn test_file_level_findings_match() {
        let a = make_finding("circular_dependency", "src/foo.rs", None);
        let b = make_finding("circular_dependency", "src/foo.rs", None);
        assert!(findings_match(&a, &b));
    }

    #[test]
    fn test_line_vs_no_line_no_match() {
        let a = make_finding("dead_code", "src/foo.rs", Some(10));
        let b = make_finding("dead_code", "src/foo.rs", None);
        assert!(!findings_match(&a, &b));
    }

    #[test]
    fn test_diff_new_and_fixed() {
        let baseline = vec![
            make_finding("dead_code", "src/foo.rs", Some(10)),
            make_finding("magic_number", "src/bar.rs", Some(20)),
        ];
        let head = vec![
            make_finding("dead_code", "src/foo.rs", Some(11)), // shifted by 1, same issue
            make_finding("xss", "src/web.rs", Some(5)),        // new
        ];

        let result = diff_findings(&baseline, &head, "main", "HEAD", Some(96.0), Some(95.5));

        assert_eq!(result.new_findings.len(), 1);
        assert_eq!(result.new_findings[0].detector, "xss");

        assert_eq!(result.fixed_findings.len(), 1);
        assert_eq!(result.fixed_findings[0].detector, "magic_number");

        let delta = result.score_after.unwrap() - result.score_before.unwrap();
        assert!((delta - (-0.5)).abs() < f64::EPSILON);
    }

    #[test]
    fn test_diff_no_changes() {
        let findings = vec![make_finding("dead_code", "src/foo.rs", Some(10))];
        let result = diff_findings(&findings, &findings, "main", "HEAD", None, None);
        assert!(result.new_findings.is_empty());
        assert!(result.fixed_findings.is_empty());
        assert!(result.score_before.is_none());
        assert!(result.score_after.is_none());
    }

    #[test]
    fn test_format_json_structure() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 2,
            new_findings: vec![AttributedFinding {
                finding: make_finding("xss", "src/web.rs", Some(5)),
                attribution: Attribution::InChangedHunk,
            }],
            all_new_count: 1,
            fixed_findings: vec![make_finding("dead_code", "src/old.rs", Some(10))],
            score_before: Some(96.0),
            score_after: Some(95.5),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let json_str = format_json(&result);
        let parsed: serde_json::Value = serde_json::from_str(&json_str).expect("valid JSON");

        assert_eq!(parsed["base_ref"], "main");
        assert_eq!(parsed["head_ref"], "HEAD");
        assert_eq!(parsed["files_changed"], 2);
        assert_eq!(parsed["new_findings"].as_array().unwrap().len(), 1);
        assert_eq!(parsed["new_findings"][0]["attribution"], "in_changed_hunk");
        assert_eq!(parsed["fixed_findings"].as_array().unwrap().len(), 1);
        assert_eq!(parsed["score_delta"], -0.5);
    }

    #[test]
    fn test_format_json_carries_tier_evidence_and_suppression_events() {
        use crate::models::{Evidence, SourceSpan, SuppressionEvent, Tier};

        let mut blocking = make_finding("command_injection", "src/app.js", Some(10));
        blocking.tier = Tier::Blocking;
        blocking.confidence = Some(0.97);
        blocking.evidence = Some(Evidence::ConfigFact {
            span: SourceSpan {
                file: PathBuf::from("src/app.js"),
                line_start: 10,
                line_end: 10,
                snippet: None,
            },
            rule: "gha_untrusted_input_to_run".to_string(),
        });

        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![AttributedFinding {
                finding: blocking,
                attribution: Attribution::InChangedHunk,
            }],
            all_new_count: 1,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(80.0),
            suppression_events: vec![SuppressionEvent {
                detector: "command-injection".into(),
                reason: "accepted-risk".into(),
                file: PathBuf::from("src/legacy.js"),
                line: Some(3),
                fingerprint: "abc123".into(),
                harvestable: false,
            }],
            suppressed_unaccounted_blocking_count: 1,
        };

        let json_str = format_json(&result);
        let parsed: serde_json::Value = serde_json::from_str(&json_str).expect("valid JSON");

        let f = &parsed["new_findings"][0];
        assert_eq!(f["tier"], "blocking");
        assert_eq!(f["confidence"].as_f64(), Some(0.97));
        assert_eq!(
            f["evidence"]["config_fact"]["rule"],
            "gha_untrusted_input_to_run"
        );
        assert_eq!(f["suppressed"], false);

        let events = parsed["suppression_events"]
            .as_array()
            .expect("suppression_events array");
        assert_eq!(events.len(), 1);
        assert_eq!(events[0]["reason"], "accepted-risk");
        assert_eq!(events[0]["harvestable"], false);
        assert_eq!(parsed["suppressed_unaccounted_blocking_count"], 1);
    }

    #[test]
    fn test_format_text_no_new_findings() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![],
            all_new_count: 0,
            fixed_findings: vec![],
            score_before: Some(97.0),
            score_after: Some(97.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let text = format_text(&result, true, false);
        assert!(text.contains("Nothing in this change trips the gate."));
        assert!(!text.contains("--all"));
        assert!(!text.contains("Score:"), "score is hidden unless --score");
    }

    #[test]
    fn test_format_text_filtered_hint() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![],
            all_new_count: 5,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(88.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let text = format_text(&result, true, false);
        assert!(text.contains("Nothing in this change trips the gate."));
        assert!(text.contains("5 findings in other files"));
        assert!(text.contains("--all"));
    }

    #[test]
    fn test_format_json_total_new_findings() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![],
            all_new_count: 3,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(90.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let json_str = format_json(&result);
        let parsed: serde_json::Value = serde_json::from_str(&json_str).unwrap();
        assert_eq!(parsed["total_new_findings"], 3);
    }

    #[test]
    fn test_format_markdown_structure() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![AttributedFinding {
                finding: make_finding("xss", "src/web.rs", Some(5)),
                attribution: Attribution::InChangedHunk,
            }],
            all_new_count: 1,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(88.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let md = format_markdown(&result);
        assert!(md.starts_with("# Repotoire Diff:"));
        assert!(md.contains("## Your Changes"));
        assert!(md.contains("| Severity |"));
        assert!(md.contains("`src/web.rs:5`"));
        assert!(!md.contains("\x1b[")); // no ANSI escapes
    }

    #[test]
    fn test_format_markdown_no_findings() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![],
            all_new_count: 0,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(90.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let md = format_markdown(&result);
        assert!(md.contains("**No new findings.**"));
    }

    #[test]
    fn test_format_markdown_filtered_hint() {
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 2,
            new_findings: vec![],
            all_new_count: 4,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(88.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let md = format_markdown(&result);
        assert!(md.contains("**No new findings in your changes.**"));
        assert!(md.contains("4 finding"));
        assert!(md.contains("`--all`"));
    }

    #[test]
    fn diff_text_leads_with_blocking_when_present() {
        use crate::models::{Evidence, SourceSpan, Tier};

        let mut blocking = make_finding("command_injection", "src/app.js", Some(30));
        blocking.tier = Tier::Blocking;
        blocking.severity = Severity::Critical;
        blocking.title = "Tainted input flows to exec()".to_string();
        blocking.evidence = Some(Evidence::TaintPath {
            source: SourceSpan {
                file: PathBuf::from("src/app.js"),
                line_start: 12,
                line_end: 12,
                snippet: None,
            },
            sink: SourceSpan {
                file: PathBuf::from("src/app.js"),
                line_start: 30,
                line_end: 30,
                snippet: None,
            },
            sink_kind: "exec".to_string(),
            flow: vec![],
            sanitizers_seen: vec![],
        });

        let advisory = make_finding("magic_number", "src/util.js", Some(7));

        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 2,
            new_findings: vec![
                AttributedFinding {
                    finding: blocking,
                    attribution: Attribution::InChangedHunk,
                },
                AttributedFinding {
                    finding: advisory,
                    attribution: Attribution::InChangedHunk,
                },
            ],
            all_new_count: 2,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(80.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let text = console::strip_ansi_codes(&format_text(&result, true, true)).to_string();
        let blocking_pos = text.find("Blocking").expect("blocking header present");
        let advisory_pos = text.find("Advisory").expect("advisory header present");
        let score_pos = text.find("Score:").expect("score block present");
        assert!(
            blocking_pos < advisory_pos,
            "blocking section should come before advisory section"
        );
        assert!(
            advisory_pos < score_pos,
            "advisory section should come before the score block"
        );
        // Evidence rendered inline.
        assert!(
            text.contains("src/app.js:12") && text.contains("src/app.js:30"),
            "taint-path evidence should show source → sink spans, got:\n{text}"
        );
        assert!(text.contains("exec"), "sink kind should be shown");
    }

    #[test]
    fn diff_text_says_clean_when_no_blocking() {
        let advisory = make_finding("magic_number", "src/util.js", Some(7));
        let result = SmartDiffResult {
            base_ref: "main".to_string(),
            head_ref: "HEAD".to_string(),
            files_changed: 1,
            new_findings: vec![AttributedFinding {
                finding: advisory,
                attribution: Attribution::InChangedHunk,
            }],
            all_new_count: 1,
            fixed_findings: vec![],
            score_before: Some(90.0),
            score_after: Some(89.0),
            suppression_events: Vec::new(),
            suppressed_unaccounted_blocking_count: 0,
        };

        let text = format_text(&result, true, false);
        assert!(
            text.contains("Nothing in this change trips the gate."),
            "no-blocking output should say the gate is clear, got:\n{text}"
        );
    }
}