feat(reporter): add suppressible Pro conversion CTA to human-facing reports

src/reporter/cta.ts

@@ -0,0 +1,48 @@
+/**
+ * Pro conversion CTA shown at the foot of human-facing reports (terminal,
+ * markdown, and — via renderMarkdownReport — the GitHub Action job summary).
+ *
+ * Deliberately NOT added to JSON or SARIF output: those are machine-consumed and
+ * must stay clean. The CTA leads with the privacy + low-noise wedge (the free,
+ * local-first, zero-account scanner stays the moat) and points at the real
+ * ECC Tools GitHub App. Suppressible via env so CI logs and scripted use can
+ * silence it.
+ */
+
+const OPT_OUT_ENV_VARS = ["ECC_NO_CTA", "AGENTSHIELD_NO_CTA"] as const;
+
+const PRO_URL = "https://github.com/apps/ecc-tools";
+
+export const PRO_CTA_PLAIN =
+  "Scans run locally; nothing leaves your machine. " +
+  `Track fleet posture and drift over time with ECC Tools Pro: ${PRO_URL}`;
+
+export const PRO_CTA_MARKDOWN =
+  "_Scans run locally; nothing leaves your machine. " +
+  `Track fleet posture and drift over time with [ECC Tools Pro](${PRO_URL})._`;
+
+/**
+ * True when the operator has opted out of the CTA via an env var. Any non-empty
+ * value other than "0" / "false" counts as opt-out.
+ */
+export function ctaSuppressed(env: NodeJS.ProcessEnv = process.env): boolean {
+  return OPT_OUT_ENV_VARS.some((key) => {
+    const value = env[key];
+    return (
+      value !== undefined &&
+      value !== "" &&
+      value !== "0" &&
+      value.toLowerCase() !== "false"
+    );
+  });
+}
+
+/** Plain-text CTA footer lines, or [] when suppressed. */
+export function proCtaPlainLines(env: NodeJS.ProcessEnv = process.env): ReadonlyArray<string> {
+  return ctaSuppressed(env) ? [] : [PRO_CTA_PLAIN];
+}
+
+/** Markdown CTA footer lines, or [] when suppressed. */
+export function proCtaMarkdownLines(env: NodeJS.ProcessEnv = process.env): ReadonlyArray<string> {
+  return ctaSuppressed(env) ? [] : ["---", "", PRO_CTA_MARKDOWN];
+}

src/reporter/json.ts

@@ -1,4 +1,5 @@
 import type { SecurityReport } from "../types.js";
+import { proCtaMarkdownLines } from "./cta.js";
 
 function formatRuntimeConfidence(value: string): string {
   switch (value) {
@@ -155,5 +156,11 @@ export function renderMarkdownReport(report: SecurityReport): string {
     lines.push("No security issues were detected in the scanned configuration.");
   }
 
+  const cta = proCtaMarkdownLines();
+  if (cta.length > 0) {
+    lines.push("");
+    lines.push(...cta);
+  }
+
   return lines.join("\n");
 }

src/reporter/terminal.ts

@@ -10,6 +10,7 @@ import type {
   CorpusValidationResult,
   DeepScanResult,
 } from "../types.js";
+import { proCtaPlainLines } from "./cta.js";
 
 /**
  * Render a security report to the terminal with colors and formatting.
@@ -125,6 +126,9 @@ export function renderTerminalReport(report: SecurityReport): string {
   // Footer
   lines.push(chalk.dim("  ─────────────────────────────────────────"));
   lines.push(chalk.dim("  AgentShield — Security auditor for AI agent configs"));
+  for (const cta of proCtaPlainLines()) {
+    lines.push(chalk.dim(`  ${cta}`));
+  }
   lines.push("");
 
   return lines.join("\n");

tests/reporter/cta.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from "vitest";
+import {
+  ctaSuppressed,
+  proCtaPlainLines,
+  proCtaMarkdownLines,
+  PRO_CTA_PLAIN,
+  PRO_CTA_MARKDOWN,
+} from "../../src/reporter/cta.js";
+
+describe("pro CTA", () => {
+  it("leads with the privacy wedge and points at the real ECC Tools app", () => {
+    expect(PRO_CTA_PLAIN).toMatch(/locally/i);
+    expect(PRO_CTA_PLAIN).toContain("https://github.com/apps/ecc-tools");
+    expect(PRO_CTA_MARKDOWN).toContain("[ECC Tools Pro](https://github.com/apps/ecc-tools)");
+  });
+
+  it("is shown by default", () => {
+    expect(ctaSuppressed({})).toBe(false);
+    expect(proCtaPlainLines({})).toEqual([PRO_CTA_PLAIN]);
+    expect(proCtaMarkdownLines({})).toContain(PRO_CTA_MARKDOWN);
+  });
+
+  it("is suppressed by ECC_NO_CTA / AGENTSHIELD_NO_CTA", () => {
+    expect(ctaSuppressed({ ECC_NO_CTA: "1" })).toBe(true);
+    expect(ctaSuppressed({ AGENTSHIELD_NO_CTA: "true" })).toBe(true);
+    expect(proCtaPlainLines({ ECC_NO_CTA: "1" })).toEqual([]);
+    expect(proCtaMarkdownLines({ AGENTSHIELD_NO_CTA: "yes" })).toEqual([]);
+  });
+
+  it("treats empty / 0 / false as not-suppressed", () => {
+    expect(ctaSuppressed({ ECC_NO_CTA: "" })).toBe(false);
+    expect(ctaSuppressed({ ECC_NO_CTA: "0" })).toBe(false);
+    expect(ctaSuppressed({ AGENTSHIELD_NO_CTA: "false" })).toBe(false);
+  });
+});

tests/reporter/json.test.ts

@@ -156,6 +156,14 @@ describe("renderMarkdownReport", () => {
     expect(output).toContain("# AgentShield Security Report");
   });
 
+  it("appends the Pro CTA footer (human-facing markdown only)", () => {
+    const output = renderMarkdownReport(makeReport());
+    expect(output).toContain("ECC Tools Pro");
+    expect(output).toContain("https://github.com/apps/ecc-tools");
+    // JSON output stays machine-clean: no marketing string.
+    expect(renderJsonReport(makeReport())).not.toContain("ECC Tools Pro");
+  });
+
   it("includes grade and score", () => {
     const output = renderMarkdownReport(makeReport());
     expect(output).toContain("**Grade:** B (80/100)");