JSON output

bonsai-lint --format json .

{
  "thresholds": {
    "go": 15,
    "java": 15,
    "php": 15,
    "python": 15,
    "typescript": 15,
    "vue": 15
  },
  "breaches": 3,
  "findings": [
    {
      "path": "packages/billing/src/invoice-mapper.service.ts",
      "line": 47,
      "end_line": 112,
      "name": "InvoiceMapperService::mapLineItems",
      "score": 69,
      "language": "typescript",
      "domain": "root"
    },
    {
      "path": "services/api/src/Controller/CheckoutController.php",
      "line": 207,
      "end_line": 268,
      "name": "CheckoutController::applyDiscounts",
      "score": 25,
      "language": "php",
      "domain": "root"
    },
    {
      "path": "packages/web/src/parser/lexer.js",
      "line": 19,
      "end_line": 140,
      "name": "Lexer",
      "score": 22,
      "language": "typescript",
      "domain": "root"
    }
  ],
  "loose_entries": []
}

findings is already ranked, worst first, so a consumer does not have to sort it. thresholds is keyed by language id and reports what the scan actually applied, which is the domain’s threshold rather than the root’s when the scan was scoped to one. breaches counts the findings over that threshold; with --all the array also carries everything under it, and breaches still counts only the ones that failed.

loose_entries lists the baseline entries looser than the code, the ones named on stderr. Each has the domain whose baseline holds it (null for a --baseline PATH file), the path and unit it is keyed by, its recorded score, a reason (lower, not_over_threshold, suppressed or unmatched), the unit’s current score and, for not_over_threshold, its threshold. strict says whether the entry’s baseline is strict. The exit code follows breaches and the strict entries. A scan that judged no baseline lists none.

domain names the domain a file resolved to, or root when there is no bonsai-lint.toml declaring any. path is always forward-slashed, so a report generated on Windows compares against one generated in CI. line is the unit’s signature and end_line its last line.