fix: resolve circular import and improve --check-overrides output UX

src/cli/overrides.ts

@@ -5,7 +5,7 @@ import type { OverrideFinding } from "../overrides/index.js";
 import { createAuditLog } from "../audit-log/index.js";
 import type { AuditLogHandle } from "../audit-log/index.js";
 import { EXIT_OK, EXIT_FINDINGS, EXIT_ERROR } from "../types.js";
-import { renderOverrideFindings } from "../output/formatters.js";
+import { renderOverrideFindings } from "../output/override-findings-terminal.js";
 import type { Logger } from "../overrides/context.js";
 
 interface RunArgs {

src/index.ts

@@ -617,9 +617,13 @@ if (parsedArgs) {
       if (!(options.json || options.sarif || options.cdx) || options.verbose) {
         const offline = !!options.offline || !!options.offlineDb;
         if (options.verbose) {
+          const overrideCount = options.checkOverrides ? overrideFindings.length : 0;
           printSummary(scanState.sorted, packages.length, scanInput);
-          printActionSummary(scanState.sorted);
-          printSuggestedFixCommands(scanState.sorted, scanInput, { offline });
+          const pmLabel = scanState.suggestedFixCommands
+            ? `${chalk.cyan(scanState.suggestedFixCommands.packageManager)} ${chalk.gray(`(${scanState.suggestedFixCommands.sourceLabel})`)}`
+            : undefined;
+          printActionSummary(scanState.sorted, overrideCount, pmLabel);
+          printSuggestedFixCommands(scanState.sorted, scanInput, { offline, overrideCount });
           printSuggestedFixCommandSkips(scanState.sorted, scanInput, { offline });
           if (scanInput.skippedDependencies.length > 0) {
             printSkippedDependencies(scanInput.skippedDependencies);
@@ -634,16 +638,19 @@ if (parsedArgs) {
               logInfo(`No findings met the table threshold of ${scanState.minSeverity}. Re-run with --all to show everything.`, options);
             }
           }
+          if (options.checkOverrides && overrideFindings.length > 0) {
+            console.log(renderOverrideFindings(overrideFindings, { verbose: true }));
+          }
           printCoverage([...scanInput.notes, ...scanState.coverage]);
-          printFinalStatus(scanState.sorted);
+          printFinalStatus(scanState.sorted, overrideCount);
         } else {
-          printCompactOutput(scanState.sorted, scanInput, { offline, all: !!options.all });
-        }
-        // Override hygiene section: --check-overrides collects these and threads
-        // them to JSON/SARIF/HTML; render them in the terminal too so the feature
-        // is visible in a plain scan, not only in machine output (#35).
-        if (options.checkOverrides) {
-          console.log(renderOverrideFindings(overrideFindings));
+          const compactPmLabel = scanState.suggestedFixCommands
+            ? `${chalk.cyan(scanState.suggestedFixCommands.packageManager)} ${chalk.gray(`(${scanState.suggestedFixCommands.sourceLabel})`)}`
+            : undefined;
+          printCompactOutput(scanState.sorted, scanInput, { offline, all: !!options.all, packageManager: compactPmLabel });
+          if (options.checkOverrides) {
+            console.log(renderOverrideFindings(overrideFindings, { verbose: false }));
+          }
         }
       }
     }

src/output/formatters.ts

@@ -14,16 +14,6 @@ import { getPrimaryParent } from "../utils/finding.js";
 import { calculatePathCoverage, formatDependencyPath } from "../utils/path-coverage.js";
 import { pluralize } from "../utils/string.js";
 
-export function formatSeverityLabel(severity: string): string {
-  const lower = severity.toLowerCase();
-  if (lower === "critical") return chalk.redBright(severity);
-  if (lower === "high") return chalk.red(severity);
-  if (lower === "medium") return chalk.yellow(severity);
-  if (lower === "low") return chalk.blueBright(severity);
-  if (lower === "unknown") return chalk.magenta(severity);
-  return severity;
-}
-
 export function formatRelationshipLabel(value: string): string {
   if (value.startsWith("direct")) return chalk.green(value);
   if (value.startsWith("transitive")) return chalk.yellow(value);
@@ -349,4 +339,3 @@ export function countUniqueAdvisories(findings: Finding[]): number {
   return new Set(findings.flatMap(f => f.vulnerabilities.map(v => v.id))).size;
 }
 
-export { renderOverrideFindings } from "./override-findings-terminal.js";

src/output/html-reporter.ts

@@ -206,13 +206,13 @@ button.header-link:hover{color:#58a6ff;border-color:#58a6ff}
 .override-hygiene table tbody tr{border-bottom:1px solid #21262d}
 .override-hygiene table tbody tr:last-child{border-bottom:none}
 .override-hygiene table tbody tr.severity-group{background:#1c2128}
-.override-hygiene table tbody tr.severity-group th{font-weight:600;color:#e6edf3;padding:10px 14px}
+.override-hygiene table tbody tr.severity-group th{font-weight:600;color:#e6edf3;padding:10px 14px;text-align:left}
 .override-hygiene table tbody tr.finding td{padding:11px 14px;font-size:12px;color:#e6edf3;vertical-align:middle}
-.override-hygiene table tbody tr.finding.critical{border-left:3px solid #f85149}
-.override-hygiene table tbody tr.finding.high{border-left:3px solid #fb8500}
-.override-hygiene table tbody tr.finding.medium{border-left:3px solid #e3b341}
-.override-hygiene table tbody tr.finding.low{border-left:3px solid #388bfd}
-.override-hygiene table tbody tr.finding.info{border-left:3px solid #8b949e}`;
+.override-hygiene table tbody tr.critical{border-left:3px solid #f85149}
+.override-hygiene table tbody tr.high{border-left:3px solid #fb8500}
+.override-hygiene table tbody tr.medium{border-left:3px solid #e3b341}
+.override-hygiene table tbody tr.low{border-left:3px solid #388bfd}
+.override-hygiene table tbody tr.unknown{border-left:3px solid #8b949e}`;
 
 export function renderHtmlReport(data: ReportData): string {
 
@@ -330,10 +330,10 @@ ${findingRowsHtml}
     </tbody>
   </table>
 </div>
-${noticesHtml}
-
 ${renderOverrideFindingsHtml(data.overrideFindings)}
 
+${noticesHtml}
+
 <div class="report-footer">
   <span>Generated by <strong>cve-lite v${escapeHtml(data.cliVersion)}</strong></span>
   <span>${escapeHtml(data.lockfileSource)} &nbsp;·&nbsp; ${data.findings.length} findings &nbsp;·&nbsp; ${data.packageCount} packages</span>

src/output/override-findings-html.ts

@@ -1,4 +1,6 @@
 import type { OverrideFinding } from "../overrides/types.js";
+import type { SeverityLabel } from "../types.js";
+import { SEVERITY_ORDER } from "../utils/severity.js";
 
 function esc(s: string): string {
   return s
@@ -8,7 +10,6 @@ function esc(s: string): string {
     .replace(/"/g, """);
 }
 
-const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"] as const;
 
 export function renderOverrideFindingsHtml(
   findings: ReadonlyArray<OverrideFinding> | undefined
@@ -28,22 +29,28 @@ export function renderOverrideFindingsHtml(
 `;
   }
 
-  const grouped = new Map<typeof SEVERITY_ORDER[number], OverrideFinding[]>();
+  const grouped = new Map<SeverityLabel, OverrideFinding[]>();
   for (const sev of SEVERITY_ORDER) grouped.set(sev, []);
-  for (const f of findings) grouped.get(f.severity as typeof SEVERITY_ORDER[number])?.push(f);
+  for (const f of findings) grouped.get(f.severity)?.push(f);
 
   const rows: string[] = [];
   for (const sev of SEVERITY_ORDER) {
     const bucket = grouped.get(sev) ?? [];
     if (bucket.length === 0) continue;
-    rows.push(`  <tr class="severity-group"><th colspan="4">${esc(sev.toUpperCase())} (${bucket.length})</th></tr>`);
+    rows.push(`  <tr class="severity-group ${esc(sev)}"><th>${esc(sev.toUpperCase())} (${bucket.length})</th><td></td><td></td><td></td></tr>`);
     for (const f of bucket) {
+      const location = f.location.jsonPath
+        ? `${esc(f.location.file)} › ${esc(f.location.jsonPath)}`
+        : esc(f.location.file);
+      const fixHtml = f.fix?.runnableCommand
+        ? `<div class="fix-cmd-inline" style="margin-top:6px"><code>${esc(f.fix.runnableCommand)}</code><button class="copy-btn" data-cmd="${esc(f.fix.runnableCommand)}">Copy</button></div>`
+        : "";
       rows.push(
         `  <tr class="finding ${esc(f.severity)}">` +
           `<td>${esc(f.ruleId)}</td>` +
           `<td>${esc(f.package.name)}</td>` +
-          `<td>${esc(f.location.file)}${f.location.jsonPath ? esc(f.location.jsonPath) : ""}</td>` +
-          `<td>${esc(f.message)}</td>` +
+          `<td>${location}</td>` +
+          `<td>${esc(f.message)}${fixHtml}</td>` +
         `</tr>`
       );
     }

src/output/override-findings-terminal.ts

@@ -1,42 +1,128 @@
 import type { OverrideFinding } from "../overrides/types.js";
+import type { SeverityLabel } from "../types.js";
+import { chalk, stripAnsi } from "../utils/chalk.js";
+import { formatSeverityLabel, SEVERITY_ORDER } from "../utils/severity.js";
+import { pluralize } from "../utils/string.js";
 
-const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"] as const;
-
-export function renderOverrideFindings(findings: ReadonlyArray<OverrideFinding>): string {
-  if (findings.length === 0) {
-    return "No override hygiene findings.";
-  }
+const COL_RULE_MAX = 8;
+const COL_PKG_MAX = 30;
+const COL_MSG_MAX = 50;
 
+export function renderOverrideFindings(
+  findings: ReadonlyArray<OverrideFinding>,
+  options?: { verbose?: boolean },
+): string {
   const lines: string[] = [];
   lines.push("");
-  lines.push("Override hygiene");
-  lines.push("================");
+  if (options?.verbose) {
+    lines.push(chalk.bold.cyan("🔍 Override Hygiene"));
+  } else {
+    lines.push("────────────────────────────────");
+    lines.push(chalk.bold("🔍 Override Hygiene"));
+    lines.push("────────────────────────────────");
+  }
   lines.push("");
 
-  const grouped = new Map<typeof SEVERITY_ORDER[number], OverrideFinding[]>();
-  for (const sev of SEVERITY_ORDER) grouped.set(sev, []);
-  for (const f of findings) {
-    grouped.get(f.severity as typeof SEVERITY_ORDER[number])?.push(f);
+  if (findings.length === 0) {
+    lines.push(chalk.greenBright("✔ No override hygiene issues found."));
+    return lines.join("\n");
   }
 
+  const grouped = new Map<SeverityLabel, OverrideFinding[]>();
+  for (const sev of SEVERITY_ORDER) grouped.set(sev, []);
+  for (const f of findings) grouped.get(f.severity)?.push(f);
+
   for (const sev of SEVERITY_ORDER) {
     const bucket = grouped.get(sev) ?? [];
     if (bucket.length === 0) continue;
-    lines.push(`${sev.toUpperCase()} (${bucket.length})`);
-    lines.push("-".repeat(`${sev.toUpperCase()} (${bucket.length})`.length));
-    for (const f of bucket) {
-      lines.push(`  ${f.ruleId}  ${f.package.name}`);
-      lines.push(`    ${f.location.file}${f.location.jsonPath ? `${f.location.jsonPath}` : ""}`);
-      lines.push(`    ${f.message}`);
-      if (f.fix) {
-        lines.push(`    fix: autofix available (${f.fix.patch.length} op${f.fix.patch.length === 1 ? "" : "s"})`);
-        if (f.fix.runnableCommand) {
-          lines.push(`    run: ${f.fix.runnableCommand}`);
-        }
+
+    lines.push(`${formatSeverityLabel(sev.toUpperCase())} (${bucket.length})`);
+
+    const sorted = [...bucket].sort((a, b) => a.ruleId.localeCompare(b.ruleId));
+
+    const ruleWidth = Math.min(COL_RULE_MAX, Math.max(4, ...sorted.map(f => f.ruleId.length)));
+    const pkgWidth = Math.min(COL_PKG_MAX, Math.max(7, ...sorted.map(f => f.package.name.length)));
+    const msgWidth = Math.min(COL_MSG_MAX, Math.max(7, ...sorted.map(f =>
+      Math.min(COL_MSG_MAX, Math.max(f.message.length, locationString(f).length)),
+    )));
+
+    const hr = (l: string, m: string, r: string) =>
+      l + "─".repeat(ruleWidth + 2) + m + "─".repeat(pkgWidth + 2) + m + "─".repeat(msgWidth + 2) + r;
+
+    lines.push(hr("┌", "┬", "┐"));
+    lines.push(tableRow(["Rule", "Package", "Message"], [ruleWidth, pkgWidth, msgWidth]));
+    lines.push(hr("├", "┼", "┤"));
+
+    for (let i = 0; i < sorted.length; i++) {
+      const f = sorted[i]!;
+      const msgLines = wrapText(f.message, msgWidth);
+      const locLines = wrapText(locationString(f), msgWidth);
+
+      lines.push(tableRow([chalk.gray(f.ruleId), chalk.whiteBright(f.package.name), msgLines[0] ?? ""], [ruleWidth, pkgWidth, msgWidth]));
+      for (let m = 1; m < msgLines.length; m++) {
+        lines.push(tableRow(["", "", msgLines[m]!], [ruleWidth, pkgWidth, msgWidth]));
+      }
+      for (const locLine of locLines) {
+        lines.push(tableRow(["", "", chalk.gray(locLine)], [ruleWidth, pkgWidth, msgWidth]));
+      }
+
+      if (i < sorted.length - 1) lines.push(hr("├", "┼", "┤"));
+    }
+
+    lines.push(hr("└", "┴", "┘"));
+
+    const seenRules = new Set<string>();
+    for (const f of sorted) {
+      if (f.fix?.runnableCommand && !seenRules.has(f.ruleId)) {
+        seenRules.add(f.ruleId);
+        lines.push(chalk.bold.cyan(`> ${f.fix.runnableCommand}`));
       }
-      lines.push("");
     }
+
+    lines.push("");
   }
 
+  const worstSev = SEVERITY_ORDER.find(s => (grouped.get(s) ?? []).length > 0);
+  const footerColor = worstSev === "critical" || worstSev === "high" ? chalk.redBright : chalk.yellow;
+  lines.push(footerColor(`${findings.length} override hygiene ${pluralize(findings.length, "issue")} found.`));
+  lines.push("");
+  lines.push(chalk.gray("────────────────────────────────"));
+
   return lines.join("\n");
 }
+
+function locationString(f: OverrideFinding): string {
+  return f.location.jsonPath
+    ? `${f.location.file} › ${f.location.jsonPath}`
+    : f.location.file;
+}
+
+function tableRow(cells: string[], widths: number[]): string {
+  return "│" + cells.map((c, i) => padCell(c, widths[i]!)).join("│") + "│";
+}
+
+function padCell(value: string, width: number): string {
+  const truncated = truncate(value, width);
+  const visible = stripAnsi(truncated).length;
+  return ` ${truncated}${" ".repeat(Math.max(0, width - visible))} `;
+}
+
+function truncate(value: string, width: number): string {
+  const plain = stripAnsi(value);
+  if (plain.length <= width) return value;
+  return plain.slice(0, Math.max(0, width - 1)) + "…";
+}
+
+function wrapText(text: string, width: number): string[] {
+  if (text.length <= width) return [text];
+  const lines: string[] = [];
+  let remaining = text.trim();
+  while (remaining.length > width) {
+    let breakAt = remaining.lastIndexOf(" ", width);
+    if (breakAt <= 0) breakAt = width;
+    lines.push(remaining.slice(0, breakAt).trimEnd());
+    remaining = remaining.slice(breakAt).trimStart();
+  }
+  if (remaining.length > 0) lines.push(remaining);
+  return lines.length > 0 ? lines : [text];
+}