@0xcraft/powershot 1.1.0 → 1.1.2

package/README.md

@@ -20,13 +20,14 @@ PowerShot reviews the failure modes that plausible-looking generated code tends
 hide: invented APIs, undeclared dependencies, dropped guards, swallowed errors,
 tests that prove nothing, bent expectations, stale callers, and duplicated helpers.
 
-It asks compilers, parsers, manifests, reference graphs, and pre/post ASTs first.
-Optional model judges only handle questions that still require judgement.
+It asks self-contained parsers, manifests, and pre/post ASTs first, then uses compiler
+types and reference graphs when the environment can supply them. Optional model judges
+only handle questions that still require judgement.
 
 <table>
   <tr>
     <td width="33%"><strong>Deterministic first</strong><br>Local checks need no model, key, tokens, or network calls.</td>
-    <td width="33%"><strong>Honest completion</strong><br>A partial run cannot present itself as a clean verdict.</td>
+    <td width="33%"><strong>Honest coverage</strong><br>Portable, full, partial, and failed runs stay distinguishable.</td>
     <td width="33%"><strong>CI-native output</strong><br>One run emits terminal, Markdown, JSON, SARIF, manifest, and Code Quality reports.</td>
   </tr>
 </table>
@@ -89,7 +90,7 @@ flowchart LR
 
 1. **Snapshot** resolves the exact tree the review is about.
 2. **Ground** builds the available type, syntax, dependency, and reference oracles.
-3. **Plan** assigns checks and missing capabilities to each file individually.
+3. **Plan** assigns baseline checks and enriched semantic capabilities to each file individually.
 4. **Verify** runs deterministic checks and records what actually executed.
 5. **Judge** optionally reviews bounded bundles of related files.
 6. **Manifest** decides whether the result is complete, partial, or failed.
@@ -108,8 +109,11 @@ Every finding says where it came from:
 | `verified` | `firm` | A deterministic heuristic fired; inspect the evidence |
 | `judged` | `firm` or `tentative` | A model supplied the judgement and provenance |
 
-PowerShot stays silent when a required oracle is unavailable. The missing capability
-is written to the manifest instead of being counted as a pass.
+Portable coverage is the default: self-contained oracles run without bootstrapping the
+reviewed repository, while unavailable compiler/reference depth stays visible in the
+manifest and reports. Set `"coverage": "strict"`, or explicitly select a check with
+`--checks`, when a missing semantic oracle must make the run partial. An unavailable
+oracle is never counted as a pass in either profile.
 
 ## Deterministic checks
 
@@ -174,33 +178,38 @@ commands.
 
 ```mermaid
 flowchart LR
-    START["Selected files and checks"] --> ACCOUNT{"Everything accounted for?"}
-    ACCOUNT -- "yes" --> FINDINGS{"Findings?"}
+    START["Selected files and checks"] --> ACCOUNT{"Required work accounted for?"}
+    ACCOUNT -- "yes" --> DEPTH{"Enriched semantic depth available?"}
+    DEPTH -- "yes" --> FULL["full coverage"]
+    DEPTH -- "no · portable policy" --> PORTABLE["portable coverage · gaps named"]
+    FULL --> FINDINGS{"Findings?"}
+    PORTABLE --> FINDINGS
     FINDINGS -- "no" --> CLEAN["exit 0 · complete and clean"]
     FINDINGS -- "yes" --> FOUND["exit 1 · complete with findings"]
-    ACCOUNT -- "capability or budget gap" --> PARTIAL["exit 3 · partial"]
+    ACCOUNT -- "required oracle or budget gap" --> PARTIAL["exit 3 · partial"]
     ACCOUNT -- "required stage failed" --> FAILED["exit 3 · failed"]
 
     classDef neutral fill:#172033,stroke:#57a6ff,color:#f0f6fc,stroke-width:2px
     classDef good fill:#17251f,stroke:#4ac58b,color:#f0f6fc,stroke-width:2px
     classDef warn fill:#2a2117,stroke:#f2b84b,color:#f0f6fc,stroke-width:2px
     classDef bad fill:#2a191b,stroke:#ff675c,color:#f0f6fc,stroke-width:2px
-    class START,ACCOUNT,FINDINGS neutral
+    class START,ACCOUNT,DEPTH,FINDINGS neutral
     class CLEAN good
-    class FOUND,PARTIAL warn
+    class FULL,PORTABLE,FOUND,PARTIAL warn
     class FAILED bad
 ```
 
 | Exit | Contract |
 |---:|---|
-| `0` | Review completed and found nothing at the selected severity |
-| `1` | Review completed and reported findings |
+| `0` | Review completed in full or portable coverage and found nothing at the selected severity |
+| `1` | Review completed in full or portable coverage and reported findings |
 | `2` | Command or Git input was invalid |
 | `3` | Review is incomplete; findings may be missing |
 
-“No findings” and “PowerShot could not look” are intentionally different pipeline
-outcomes. Use `--format manifest` to inspect file dispositions, executed checks,
-skips, failures, judge units, and `notLookedAt`.
+“No findings in portable coverage”, “No findings”, and “PowerShot could not look” are
+intentionally different outcomes. Use `--format manifest` to inspect `coverage`, file
+dispositions, executed and unavailable checks, failures, judge units, and
+`notLookedAt`.
 
 ## CI integration
 
@@ -220,6 +229,18 @@ The composite action is the shortest setup for GitHub:
     fail-on-findings: 'true'
 ```
 
+The default portable profile needs no install from the checked-out repository. That is
+the safe default for private monorepos and fork pull requests: do not expose a package
+registry credential merely to enrich a review of untrusted code. If a trusted job
+already has dependencies, PowerShot uses their TypeScript declarations automatically.
+Set `"coverage": "strict"` when missing compiler/reference oracles must block instead.
+
+PowerShot discovers `tsconfig.json` and `tsconfig.*.json` along the ancestor chain of
+each changed file. One review can use several independent package projects, skip
+empty solution configs in favour of their leaf configs, and type-check test files
+that a production config excludes. Discovery is change-scoped: unrelated packages
+and configless source trees are not crawled just to build the TypeScript ground.
+
 `@v1` follows compatible `1.x` releases. Pin the action to a full commit SHA in a
 protected required workflow when immutable dependencies are required.
 
@@ -252,6 +273,7 @@ Anthropic, OpenAI, and Gemini providers are supported.
   "judges": {
     "enable": ["plausible-logic", "test-adequacy", "intent"]
   },
+  "coverage": "portable",
   "minSeverity": "low",
   "ignore": ["**/generated/**"],
   "promptCache": true
@@ -286,8 +308,11 @@ psh review --verify-only --absorb /tmp/powershot-findings.json
 | C | Syntax-backed checks that do not require exception semantics |
 | Solidity | Declared syntax-backed checks |
 
-PowerShot loads a bounded number of grammars per run. Unsupported or unavailable
-coverage is named in the manifest.
+Every declared language is parsed in disposable, language-isolated workers. Sources
+are sent in bounded batches, so a mixed-language monorepo does not accumulate every
+compiled WASM grammar in one process. If a declared parser cannot run, the review
+fails loudly; it is never silently waived. All eleven packs plus TypeScript and
+JavaScript are exercised together by the integration suite.
 
 ## Project guide
 

package/dist/cli/reports.js

@@ -1,4 +1,5 @@
 import { writeFileSync } from 'node:fs';
+import { unavailableCoverage } from '#app/manifest.js';
 import { dim } from '#app/report/ansi.js';
 import { codeQuality } from '#app/report/codequality.js';
 import { compact } from '#app/report/compact.js';
@@ -44,6 +45,8 @@ export function renderReport(format, result, manifest, target) {
         ...result.stats,
         state: manifest.state,
         notLookedAt: manifest.notLookedAt,
+        coverage: manifest.coverage,
+        unavailableCoverage: unavailableCoverage(manifest),
     });
 }
 export function publishReports(options) {

package/dist/cli/review-command.js

@@ -5,7 +5,7 @@ import { loadConfig, policyChanged } from '#app/config.js';
 import { absorbDelegated, delegateBrief } from '#app/delegate.js';
 import { baseRefOf, checkRange, headSha, repoRoot, shaOf } from '#app/git.js';
 import { JUDGES } from '#app/judges/prompts.js';
-import { RunManifest, coverageProblems, hashOf, writeManifest } from '#app/manifest.js';
+import { RunManifest, coverageProblems, hashOf, unavailableCoverage, writeManifest } from '#app/manifest.js';
 import { Trace } from '#app/otel.js';
 import { PACKAGE_VERSION } from '#app/package-meta.js';
 import { dim, yellow } from '#app/report/ansi.js';
@@ -225,6 +225,7 @@ export async function runReviewCommand(command, values, positionals) {
         },
         files: result.plan?.items() ?? [],
         skippedChecks: result.skippedChecks ?? [],
+        unavailableChecks: result.unavailableChecks ?? [],
         findings: {
             total: result.findings.length,
             verified: result.stats.verified,
@@ -246,7 +247,12 @@ export async function runReviewCommand(command, values, positionals) {
         record.notLookedAt.push(failure);
         process.stderr.write(yellow(' ◇ manifest') + dim(' ' + gaps.join('; ')) + '\n');
     }
-    session?.saveReport(result.findings, { state: record.state, notLookedAt: record.notLookedAt });
+    session?.saveReport(result.findings, {
+        state: record.state,
+        notLookedAt: record.notLookedAt,
+        coverage: record.coverage,
+        unavailableCoverage: unavailableCoverage(record),
+    });
     writeManifest(root, record);
     publishReports({
         format: values.format,

package/dist/cli/session-command.js

@@ -42,6 +42,8 @@ export function runSessionCommand(positionals) {
             started: session.started,
             state: session.report.state ?? 'unknown',
             notLookedAt: session.report.notLookedAt ?? ['session predates verdict recording'],
+            coverage: session.report.coverage,
+            unavailableCoverage: session.report.unavailableCoverage,
         }));
         process.stdout.write(output + '\n');
         return 0;

package/dist/config.js

@@ -9,6 +9,7 @@ const DEFAULTS = {
     // security may duplicate SAST; convention needs repository idioms in the diff
     judges: ['plausible-logic', 'test-adequacy', 'intent'],
     minSeverity: 'low',
+    coverage: 'portable',
     // findings in vendored trees are not decisions made by this repository
     ignore: [
         '**/node_modules/**', '**/dist/**', '**/build/**', '**/*.generated.*', '**/*.min.js',
@@ -33,6 +34,7 @@ export function policyChanged(root, baseRef) {
 }
 const KEYS = new Set([...Object.keys(DEFAULTS), 'checks']);
 const PROVIDERS = new Set(['anthropic', 'openai', 'gemini']);
+const COVERAGE = new Set(['portable', 'strict']);
 /** A misspelled name in the config is the quietest way to get a clean review. */
 export function validateConfig(raw, known) {
     const problems = [];
@@ -50,6 +52,9 @@ export function validateConfig(raw, known) {
     if (raw.minSeverity !== undefined && !SEVERITIES.includes(raw.minSeverity)) {
         problems.push('minSeverity "' + String(raw.minSeverity) + '" is not one of: ' + SEVERITIES.join(', '));
     }
+    if (raw.coverage !== undefined && !COVERAGE.has(String(raw.coverage))) {
+        problems.push('coverage "' + String(raw.coverage) + '" is not one of: ' + [...COVERAGE].join(', '));
+    }
     for (const [field, names] of [['verifiers', known.verifiers], ['judges', known.judges]]) {
         const value = raw[field];
         if (value === undefined)