@applesnort/crosscheck 0.2.0 → 0.2.1

package/bin/crosscheck.mjs

@@ -175,7 +175,11 @@ function collectFiles(targets) {
       }
       return;
     }
-    out.push(relative(process.cwd(), path) || path);
+    // Relative when the target is under cwd, absolute when it is not: a
+    // ../../../ chain is harder to read than the full path, and the model has
+    // to resolve whatever we print.
+    const rel = relative(process.cwd(), path);
+    out.push(!rel || rel.startsWith('..') ? path : rel);
   };
   for (const target of targets) {
     if (!existsSync(target)) {
@@ -278,23 +282,30 @@ async function runCommand(options, positional) {
   if (positional.length === 0) {
     fail('run needs at least one path to audit');
   }
+  // Resolve the target first: a bad path is the more fundamental error, and
+  // reporting a missing flag instead sends the user after the wrong problem.
+  const files = collectFiles(positional);
   if (!options.exec && !options['dry-run']) {
     fail("run needs --exec '<command>' (or --dry-run to see the prompts)");
   }
-  const files = collectFiles(positional);
   const lensDir = resolveLensDir(options.lenses);
   const lenses = loadLenses(lensDir);
   const overrides = {
     only: options.only?.split(',').map(s => s.trim()).filter(Boolean),
     skip: options.skip?.split(',').map(s => s.trim()).filter(Boolean)
   };
-  const { roster, skipped } = planRun(lenses, files, overrides);
+  const { roster, skipped, unmatched } = planRun(lenses, files, overrides);
 
   process.stderr.write(
     `crosscheck: ${files.length} file(s), lenses from ${lensDir}\n` +
     `  roster:  ${roster.map(l => l.name).join(', ') || '(none)'}\n` +
     (skipped.length
       ? skipped.map(s => `  skipped: ${s.lens} — ${s.reason}`).join('\n') + '\n'
+      : '') +
+    (unmatched.length
+      ? `  UNREVIEWED: ${unmatched.length} file(s) matched no lens in the ` +
+        `roster — ${unmatched.slice(0, 5).join(', ')}` +
+        (unmatched.length > 5 ? `, +${unmatched.length - 5} more` : '') + '\n'
       : ''));
 
   if (roster.length === 0) {

package/lib/config.mjs

@@ -0,0 +1,136 @@
+/*!
+ * Copyright (c) 2026 Joel Mangin. MIT License.
+ */
+// Project configuration.
+//
+// Retyping --exec on every invocation is friction that pushes people toward
+// shell aliases, which are invisible to everyone else on the team. A committed
+// config file makes the panel reproducible: the same command produces the same
+// roster and the same model for whoever runs it.
+//
+// Precedence is defaults < config file < command line, and the loaded path is
+// always reported — a run shaped by a file the user forgot about is exactly the
+// kind of silent behaviour this tool refuses everywhere else.
+
+export const CONFIG_FILENAMES = [
+  '.crosscheckrc.json',
+  '.crosscheckrc',
+  'crosscheck.config.json'
+];
+
+// Keys a config file may set. Anything else is a typo worth reporting rather
+// than ignoring: a misspelled `exec` that silently does nothing is worse than
+// an error.
+export const CONFIG_KEYS = new Set([
+  'exec', 'lenses', 'concurrency', 'only', 'skip', 'mixed',
+  'out', 'sarif', 'baseline', 'overlap'
+]);
+
+const LIST_KEYS = new Set(['only', 'skip']);
+
+export function validateConfig(raw, source = 'config') {
+  if (raw == null) {
+    return { config: {}, problems: [] };
+  }
+  if (typeof raw !== 'object' || Array.isArray(raw)) {
+    return {
+      config: {},
+      problems: [`${source}: expected a JSON object at the top level`]
+    };
+  }
+  const config = {};
+  const problems = [];
+  for (const [key, value] of Object.entries(raw)) {
+    if (key.startsWith('//') || key === '$schema') {
+      continue;
+    }
+    if (!CONFIG_KEYS.has(key)) {
+      problems.push(
+        `${source}: unknown key "${key}" — expected one of ` +
+        [...CONFIG_KEYS].sort().join(', '));
+      continue;
+    }
+    if (LIST_KEYS.has(key)) {
+      if (Array.isArray(value)) {
+        config[key] = value.map(String);
+      } else if (typeof value === 'string') {
+        config[key] = value.split(',').map(s => s.trim()).filter(Boolean);
+      } else {
+        problems.push(`${source}: "${key}" must be a list or a comma string`);
+      }
+      continue;
+    }
+    if (key === 'concurrency') {
+      const n = Number(value);
+      if (!Number.isInteger(n) || n < 1) {
+        problems.push(`${source}: "concurrency" must be a positive integer`);
+        continue;
+      }
+      config[key] = n;
+      continue;
+    }
+    if (key === 'mixed') {
+      if (typeof value !== 'boolean') {
+        problems.push(`${source}: "mixed" must be true or false`);
+        continue;
+      }
+      config[key] = value;
+      continue;
+    }
+    if (typeof value !== 'string' || value === '') {
+      problems.push(`${source}: "${key}" must be a non-empty string`);
+      continue;
+    }
+    config[key] = value;
+  }
+  return { config, problems };
+}
+
+// Command-line flags always win. `only`/`skip` arrive as comma strings from the
+// CLI and as lists from a file, so both are normalised to lists here.
+export function mergeConfig(fileConfig = {}, cliOptions = {}) {
+  const merged = { ...fileConfig };
+  for (const [key, value] of Object.entries(cliOptions)) {
+    if (value === undefined) {
+      continue;
+    }
+    merged[key] = LIST_KEYS.has(key) && typeof value === 'string'
+      ? value.split(',').map(s => s.trim()).filter(Boolean)
+      : value;
+  }
+  for (const key of LIST_KEYS) {
+    if (typeof merged[key] === 'string') {
+      merged[key] = merged[key].split(',').map(s => s.trim()).filter(Boolean);
+    }
+  }
+  return merged;
+}
+
+// Walk from `startDir` toward the filesystem root looking for a config file, so
+// running from a subdirectory of a project still picks up its settings.
+// `readFile` and `exists` are injected to keep this testable without a disk.
+export function findConfig(startDir, { exists, isRoot = null } = {}) {
+  if (typeof exists !== 'function') {
+    throw new Error('findConfig requires an exists() probe');
+  }
+  let dir = startDir;
+  const seen = new Set();
+  while (dir && !seen.has(dir)) {
+    seen.add(dir);
+    for (const name of CONFIG_FILENAMES) {
+      const candidate = dir.endsWith('/') ? `${dir}${name}` : `${dir}/${name}`;
+      if (exists(candidate)) {
+        return candidate;
+      }
+    }
+    if (isRoot?.(dir)) {
+      return null;
+    }
+    const parent = dir.replace(/\/[^/]*\/?$/, '');
+    if (parent === dir || parent === '') {
+      return null;
+    }
+    dir = parent;
+  }
+  return null;
+}

package/lib/prompt.mjs

@@ -11,6 +11,13 @@
 export const CONTRACT_LINE =
   'file:line — SEVERITY — issue — fix';
 
+// The frontmatter is routing metadata — globs, cites, owns — consumed by the
+// router before dispatch. Sending it to the model costs tokens on every call and
+// tells it nothing it needs, so the body is what gets inlined.
+export function stripFrontmatter(text) {
+  return String(text ?? '').replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').trim();
+}
+
 // A lens that reports on everything is useless, and a lens that quietly reviews
 // outside its remit corrupts the consensus signal — so both halves of its scope
 // are restated in the prompt, not just the part it owns.
@@ -33,10 +40,15 @@ export function buildLensPrompt(lens, files, options = {}) {
   parts.push(`You are running the **${lens.name}** audit lens.`);
 
   if (definition) {
+    const body = stripFrontmatter(definition);
+    if (!body) {
+      throw new Error(
+        `lens ${lens.name} has frontmatter but no body to adopt`);
+    }
     parts.push(
       'Adopt this lens completely — its method, its framing, its severity ' +
       'scale, and its output contract:\n\n' +
-      '--- BEGIN LENS DEFINITION ---\n' + definition.trim() +
+      '--- BEGIN LENS DEFINITION ---\n' + body +
       '\n--- END LENS DEFINITION ---');
   } else if (definitionPath) {
     parts.push(

package/lib/run.mjs

@@ -28,6 +28,11 @@ export function planRun(lenses, files, overrides = {}) {
   }
   const routed = routeRoster(lenses, files);
   const { roster, skipped } = applyOverrides(routed, overrides);
+  // A file that no rostered lens will read is a hole in the coverage. Reporting
+  // the file count without it lets a run look complete when part of the target
+  // was never examined.
+  const covered = new Set(roster.flatMap(l => l.files));
+  const unmatched = files.filter(f => !covered.has(f));
   if (overrides.only?.length) {
     const known = new Set((lenses ?? []).map(l => l.name));
     for (const name of overrides.only) {
@@ -36,7 +41,7 @@ export function planRun(lenses, files, overrides = {}) {
       }
     }
   }
-  return { roster, skipped };
+  return { roster, skipped, unmatched };
 }
 
 export function promptsFor(roster, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applesnort/crosscheck",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Run independent review lenses in parallel and merge their findings into one deduped, consensus-ranked report \u2014 with SARIF output.",
   "license": "MIT",
   "author": "Joel Mangin",