fix(cli): print recursive SARIF to stdout and keep status text off it - #565

Problem

skillspector scan <collection> --recursive --format sarif > results.sarif does not produce a SARIF file. stdout contains only the human-readable progress and summary, and the merged SARIF log is never printed:

$ skillspector scan ./multi --recursive --no-llm --format sarif
Multi-skill directory detected: 2 skills found

  [1/2] Scanning a (a/)
         Score: 0/100 (LOW)
...
═══ Multi-Skill Summary ═══
...
$ echo $?
0

The --help text for --output says "If not specified, prints to stdout." #467 fixed this for --format json (combined document to stdout, status text to stderr). SARIF is the other format tools parse from stdout, and it was left on the old routing, so several single-skill paths also print status text ahead of the log:

In each case json.loads(stdout) fails at character 0.

Fix

• Add _MACHINE_READABLE_FORMATS = {json, sarif} and use it at the five places that currently check format == FormatChoice.json to send status text to stderr.
• In _scan_multi_skill, build the merged SARIF log whether or not --output is set. With --output it is written to the file as before; without it, it is printed. This mirrors what fix(cli): emit recursive JSON reports to stdout #467 did for the JSON branch.

--output behaviour, the SARIF content, the output bound and exit codes are unchanged. Markdown and terminal routing are untouched.

Tests (tests/unit/test_cli.py)

• test_recursive_single_skill_advisory_does_not_pollute_stdout and test_multi_skill_advisory_does_not_pollute_stdout: the existing JSON tests from fix(cli): emit recursive JSON reports to stdout #467, now parametrized over json and sarif (the json in their names was dropped).
• test_recursive_sarif_without_output_writes_only_the_log_to_stdout: recursive, verbose, no --output. stdout must pass validate_sarif_report and contain the aggregate run; progress, "Running scan" and the summary must be on stderr.
• test_transitive_failure_warning_stays_off_sarif_stdout: SARIF variant of test_transitive_resolver_failure_preserves_direct_report.

Against unmodified cli.py (Windows 11, Python 3.12.10, main at 4148ab3):

E           json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
E           json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
E           json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
E       assert 'Transitive scan failed' not in 'Warning: Tr... }\n  ]\n}\n'
FAILED tests/unit/test_cli.py::test_recursive_single_skill_advisory_does_not_pollute_stdout[sarif]
FAILED tests/unit/test_cli.py::test_multi_skill_advisory_does_not_pollute_stdout[sarif]
FAILED tests/unit/test_cli.py::test_recursive_sarif_without_output_writes_only_the_log_to_stdout
FAILED tests/unit/test_cli.py::test_transitive_failure_warning_stays_off_sarif_stdout
4 failed, 2 passed

With the fix: 6 passed. Every changed line runs in these tests (checked with branch coverage).

I also re-ran the first four rows against the real CLI. After the fix, stdout passes validate_sarif_report in every row (for ./multi --recursive it holds 3 runs: two skills plus the aggregate), and the status text shows up on stderr.

Suite

pytest -m "not integration and not provider" -p no:randomly, same machine:

The +4 are the new SARIF cases. The failures and errors are the same on both sides and Windows-only (release and compare_scan_accuracy harnesses, CRLF fixtures, a backslash inside a POSIX file name, and parametrized test IDs over the Windows environment-variable length limit).

ruff check src/ tests/: All checks passed. ruff format --check src/ tests/: 246 files already formatted.

🤖 Generated with Claude Code