[WenJing95]

Summary

The threat model footer joins scope paths with ", " and runs the result through report._text, which collapses whitespace. So paths like "a,b.ts" and "a b" blur together, and an exclusion of " " shows as exclusions: none.

Changes

_scope_lines now formats each path with report._path_text, same as report.md. Added a test for both scopes.

Testing

Tests pass.

Risk and rollout

Plain paths look the same. Ambiguous ones get quoted

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.