fix: Omit label host counts when API token lacks visibility

Author: TsekNet

internal/output/markdown.go

@@ -201,13 +201,23 @@ func collectFootnotes(results []diff.DiffResult) []string {
 }
 
 func renderLabelsMarkdown(results []diff.DiffResult) string {
-	validSeen := make(map[string]string)
+	type labelEntry struct {
+		Name      string
+		HostCount uint
+	}
+	var validLabels []labelEntry
+	validSeen := make(map[string]bool)
 	missingSeen := make(map[string]string)
+	anyNonZero := false
 
 	for _, result := range results {
 		for _, l := range result.Labels.Valid {
-			if _, ok := validSeen[l.Name]; !ok {
-				validSeen[l.Name] = fmt.Sprintf("- ✅ `%s` (%d hosts)\n", l.Name, l.HostCount)
+			if !validSeen[l.Name] {
+				validSeen[l.Name] = true
+				validLabels = append(validLabels, labelEntry{l.Name, l.HostCount})
+				if l.HostCount > 0 {
+					anyNonZero = true
+				}
 			}
 		}
 		for _, l := range result.Labels.Missing {
@@ -217,13 +227,17 @@ func renderLabelsMarkdown(results []diff.DiffResult) string {
 		}
 	}
 
-	if len(validSeen) == 0 && len(missingSeen) == 0 {
+	if len(validLabels) == 0 && len(missingSeen) == 0 {
 		return ""
 	}
 
 	var sb strings.Builder
-	for _, line := range validSeen {
-		sb.WriteString(line)
+	for _, l := range validLabels {
+		if anyNonZero {
+			sb.WriteString(fmt.Sprintf("- ✅ `%s` (%d hosts)\n", l.Name, l.HostCount))
+		} else {
+			sb.WriteString(fmt.Sprintf("- ✅ `%s`\n", l.Name))
+		}
 	}
 	for _, line := range missingSeen {
 		sb.WriteString(line)