OutputBuilder

Escape sequences removed on the way into the -o file. Colorize only ever emits the SGR form (\e[…m), but the text being colorized comes out of the scanned repo, so the pattern covers the rest of the escape space too — a route or param string carrying \e[2J, \e[?1049h, \ec or an OSC-8 hyperlink would otherwise be replayed by the terminal of whoever cats the report. Three alternatives, matched in order: CSI (parameter bytes, intermediate bytes, then a final byte in @–~), OSC (terminated by BEL or ST), and every other escape — optional intermediates and one final byte. CSI and OSC come first so their introducers aren't consumed as a bare two-character escape.

A ? in a Noir URL is not always a query separator — it is also route syntax (Express /geo/:ip?, F# /legacy(/?), a regex route /grp/(?:a|b)/(.*)?). Only a ? that introduces a key=value pair before the next path separator opens a query string. Shared by bake_endpoint, which appends to a URL, and the builders that take one apart, so the two can never disagree about where the route ends.

scheme://authority at the head of an absolute endpoint URL.

Tech analyzers that raised during the scan being reported. Carried as a property rather than a third print argument: only three of the thirty builders have anywhere to put it, and the other twenty-seven would have grown a parameter they ignore. Defaults to empty so a builder constructed directly (specs, library callers) reports a clean scan.

Tech analyzers that raised during the scan being reported. Carried as a property rather than a third print argument: only three of the thirty builders have anywhere to put it, and the other twenty-seven would have grown a parameter they ignore. Defaults to empty so a builder constructed directly (specs, library callers) reports a clean scan.

The block form of NoirLogger#debug, not the String one: bake_endpoint runs once per endpoint for most builders, and the String overload would build all seven of these messages on every call only for the logger to drop them with debug off.

Two-argument entry point every -f format answers to, so Noir::OutputFormats.render can hand each builder the same pair. Formats with nothing to say about passive findings inherit this and implement only print(endpoints).