fix(engine): address PR review comments

- Move output_format.h from userspace/falco/ to userspace/engine/ to
  fix reverse dependency (engine layer was including from app layer);
  update all include paths accordingly
- Add SPDX-License-Identifier to output_format.h
- Remove leftover m_first_event_in_category field from MarkdownFormatter
  (was set in begin_category() but never read)
- Emit deprecation warning to stderr when --markdown is used

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Paolo Polidori <paolo.polidori@sysdig.com>

Author: legobrick

cmake/modules/cxxopts.cmake

@@ -32,8 +32,8 @@ elseif(NOT TARGET cxxopts)
 
 	ExternalProject_Add(
 		cxxopts
-		URL "https://github.com/jarro2783/cxxopts/archive/refs/tags/v3.0.0.tar.gz"
-		URL_HASH "SHA256=36f41fa2a46b3c1466613b63f3fa73dc24d912bc90d667147f1e43215a8c6d00"
+		URL "https://github.com/jarro2783/cxxopts/archive/refs/tags/v3.3.1.tar.gz"
+		URL_HASH "SHA256=3bfc70542c521d4b55a46429d808178916a579b28d048bd8c727ee76c39e2072"
 		CONFIGURE_COMMAND ""
 		BUILD_COMMAND ""
 		INSTALL_COMMAND ""

userspace/engine/falco_engine.h

@@ -34,7 +34,7 @@ limitations under the License.
 #include "falco_source.h"
 #include "falco_load_result.h"
 #include "filter_details_resolver.h"
-#include "../falco/output_format.h"
+#include "output_format.h"
 
 //
 // This class acts as the primary interface between a program and the
@@ -63,7 +63,10 @@ class falco_engine {
 
 	// Print to stdout (using printf) a description of each field supported by this engine.
 	// If source is non-empty, only fields for the provided source are printed.
-	void list_fields(const std::string &source, bool verbose, bool names_only, output_format format) const;
+	void list_fields(const std::string &source,
+	                 bool verbose,
+	                 bool names_only,
+	                 output_format format) const;
 
 	// Provide an alternate rule reader, collector, and compiler
 	// to compile any rules provided via load_rules*

userspace/engine/field_formatter.h

@@ -57,7 +57,7 @@ class TextFieldFormatter : public FieldFormatter {
 
 	void begin() override;
 	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                     const std::set<std::string>& event_sources) override;
+	                      const std::set<std::string>& event_sources) override;
 	void print_field_name(const std::string& name) override;
 	void end() override;
 
@@ -72,7 +72,7 @@ class MarkdownFieldFormatter : public FieldFormatter {
 
 	void begin() override;
 	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                     const std::set<std::string>& event_sources) override;
+	                      const std::set<std::string>& event_sources) override;
 	void print_field_name(const std::string& name) override;
 	void end() override;
 
@@ -87,7 +87,7 @@ class JsonFieldFormatter : public FieldFormatter {
 
 	void begin() override;
 	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                     const std::set<std::string>& event_sources) override;
+	                      const std::set<std::string>& event_sources) override;
 	void print_field_name(const std::string& name) override;
 	void end() override;
 

userspace/falco/output_format.h userspace/engine/output_format.huserspace/falco/output_format.h renamed to userspace/engine/output_format.h

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 /*
 Copyright (C) 2026 The Falco Authors.
 

userspace/falco/app/actions/event_formatter.cpp

@@ -102,7 +102,6 @@ void MarkdownFormatter::begin_category(const std::string& category) {
 	printf("## %s\n\n", category.c_str());
 	printf("Default | Dir | Name | Params \n");
 	printf(":-------|:----|:-----|:-----\n");
-	m_first_event_in_category = true;
 }
 
 void MarkdownFormatter::print_event(const event_entry& e) {

userspace/falco/app/actions/event_formatter.h

@@ -23,7 +23,7 @@ limitations under the License.
 #include <memory>
 #include <nlohmann/json.hpp>
 
-#include "../../output_format.h"
+#include "../../../engine/output_format.h"
 
 struct ppm_param_info;
 struct ppm_event_info;
@@ -87,7 +87,6 @@ class MarkdownFormatter : public EventFormatter {
 
 private:
 	void print_param(const struct ppm_param_info* param);
-	bool m_first_event_in_category{true};
 };
 
 // JSON formatter

userspace/falco/app/options.cpp

@@ -30,7 +30,9 @@ limitations under the License.
 namespace falco {
 namespace app {
 
-static bool parse_output_format(const std::string& format_str, output_format& out, std::string& errstr) {
+static bool parse_output_format(const std::string &format_str,
+                                output_format &out,
+                                std::string &errstr) {
 	if(format_str.empty()) {
 		return true;
 	}
@@ -117,6 +119,7 @@ bool options::parse(int argc, char **argv, std::string &errstr) {
 		}
 	} else if(markdown) {
 		// If markdown flag is set and format is not specified, use MARKDOWN format
+		fprintf(stderr, "WARNING: --markdown is deprecated, use --format markdown instead.\n");
 		output_fmt = output_format::MARKDOWN;
 	}
 

userspace/falco/app/options.h

@@ -18,7 +18,7 @@ limitations under the License.
 #pragma once
 
 #include <libsinsp/event.h>
-#include "../output_format.h"
+#include "../../engine/output_format.h"
 
 #include <string>
 #include <vector>