fix(scan report): handle large alert output

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

Summary

Remove unbounded argument spreads from scan report width calculation and table assembly. Add a 200,000-alert renderer regression that checks the count and first and last package rows. Narrow full reports with a structural alerts check before rendering.

Validation

• git diff --check passed.
• Local focused tests and lint were not run. The normal managed pnpm wrapper rejects its configured token. CI will validate the regression and lint.

---

Note

Low Risk
Localized CLI report formatting fix and safer typing for short/minimal report payloads; no auth, network, or policy logic changes.

Overview
Fixes plain-text scan reports crashing or failing when a scan has a very large number of alerts (e.g. hundreds of thousands), by removing patterns that pass unbounded values through function argument spreads.

formatAlertTable now computes column widths with nested loops instead of Math.max(...cells.map(...)) per column. toPlainTextReport appends table lines with a loop instead of lines.push(...formatAlertTable(rows)).

For non-short text output, outputGeneratedScanReport uses a new isFullScanReport type guard ('alerts' in report) before calling toPlainTextReport, and otherwise prints OK/ERR—replacing an unsafe as ScanReport cast when the generated data is only { healthy: boolean }.

A unit test renders 200,000 alerts and asserts the summary count and first/last package names without hitting argument-limit errors.

^{Reviewed by Cursor Bugbot for commit 6d325f1. Configure here.}