@applesnort/crosscheck 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -0,0 +1,83 @@
+# Changelog
+
+Notable changes to `@applesnort/crosscheck`. Format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning is
+[semver](https://semver.org/), pre-1.0, so a minor bump is where behaviour
+changes land.
+
+Entries before 0.7.0 were reconstructed from commit history after the fact, so
+they name what each version did rather than itemising every change in it.
+
+**Published to npm: 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.6.0.** 0.4.0, 0.5.0, 0.6.1 and
+0.6.2 exist as versions in this repository but were never published, so a
+consumer resolving `@0.6` gets 0.6.0 and none of the fixes after it.
+
+## [0.7.0] — unreleased
+
+### Fixed
+
+- The `check`, `architect`, `security-check` and `taint` lenses now route
+  `.vue` and `.svelte` files. They globbed `.js`/`.ts` and friends but not
+  single-file components, so only `ux` matched one — a 2437-line Vue component
+  in a real review was read by the usability lens and by nothing else, with no
+  correctness, security or architecture pass over the largest file in the
+  project.
+
+  The run still reported as complete, because each lens that skipped the
+  component did so via "nothing in scope matches", which reads as a routing
+  decision rather than a hole.
+
+  This is a **behaviour change, not just a fix**: every lens now receives more
+  files on any project containing components, so runs there are slower and cost
+  more. That is why it is a minor bump rather than a patch.
+
+- `test/lenses.test.mjs` asserts the shipped lenses route both extensions. The
+  existing routing test only ever checked a plain `.js` file, which is why the
+  gap survived.
+
+Stylesheets remain deliberately unrouted; the CLI naming an unmatched `.css`
+file in its `UNREVIEWED` line is intended behaviour, not a further instance of
+this bug.
+
+## [0.6.2] — unpublished
+
+- Install the model CLI in the scaffolded workflow.
+
+## [0.6.1] — unpublished
+
+- Do not load the same lens directory twice.
+
+## [0.6.0] — 2026
+
+- Adoption in one command (`crosscheck init`): scaffold config, lenses and
+  workflow.
+
+## [0.5.0] — unpublished
+
+- Cost work: make a standing panel cheap enough to leave switched on.
+
+## [0.4.0] — unpublished
+
+- Review a change rather than a tree; verify findings before reporting them;
+  gate before dispatch.
+- Cancel superseded CI runs instead of queueing them.
+
+## [0.3.0] — 2026
+
+- Layer lens sources, so adding one lens costs one file instead of forking all
+  of them.
+- Document that a project's own lenses stay in that project.
+
+## [0.2.2] — 2026
+
+- `.crosscheckrc.json`, so a team shares one panel definition instead of a shell
+  alias nobody else can see.
+
+## [0.2.1] — 2026
+
+- Disclose unreviewed files; stop sending lens frontmatter to the model.
+- CLI smoke tests, and two bugs they found.
+
+## [0.2.0] — 2026
+
+- Publish under the `@applesnort` scope.

package/bin/crosscheck.mjs

@@ -183,9 +183,18 @@ function lensSources(option, { includeBuiltin = true } = {}) {
   if (dirs.length === 0) {
     fail('no lens directories to load (--no-builtin with no --lenses?)');
   }
-  const sources = dirs.map(dir => ({ origin: dir, lenses: loadLenses(dir) }));
+  // The same directory can arrive twice — ./lenses is auto-detected, and running
+  // from that project also names it via --lenses. Loading it twice makes every
+  // lens in it shadow itself, which reads as a configuration mistake that is not
+  // one. Keep the last occurrence, so an explicit --lenses still wins on order.
+  const seen = new Map();
+  for (const dir of dirs) {
+    seen.set(dir, true);
+  }
+  const uniqueDirs = [...seen.keys()];
+  const sources = uniqueDirs.map(dir => ({ origin: dir, lenses: loadLenses(dir) }));
   if (sources.every(source => source.lenses.length === 0)) {
-    fail(`no usable lens definitions found in: ${dirs.join(', ')}`);
+    fail(`no usable lens definitions found in: ${uniqueDirs.join(', ')}`);
   }
   return sources;
 }
@@ -502,10 +511,20 @@ jobs:
         with:
           node-version: '22.x'
 
+      # EDIT THIS STEP. crosscheck never talks to a model, so whatever your
+      # \`exec\` command names has to exist on the runner. Nothing here is
+      # installed for you, and a missing command fails every lens with ENOENT.
+      #
+      #   Claude Code:  npm i -g @anthropic-ai/claude-code   (exec: claude -p)
+      #   llm:          pipx install llm                     (exec: llm -m ...)
+      #   your own:     whatever installs it
+      - name: Install the model CLI
+        run: npm i -g @anthropic-ai/claude-code
+
       - name: Review the change
         env:
-          # Provide whatever your --exec command needs. crosscheck itself never
-          # talks to a model.
+          # Whatever your exec command needs to authenticate. crosscheck reads no
+          # credentials of its own.
           ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
         run: |
           npx @applesnort/crosscheck run \\

package/lenses/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 summary: structure, data shape, coupling, and reversibility of decisions
-when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,sql,prisma,graphql}, "**/migrations/**", "**/schema*"]
+when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,sql,prisma,graphql,vue,svelte}, "**/migrations/**", "**/schema*"]
 owns: couplings and lock-in that make later change expensive
 not-owns: line-level correctness, style, security categories, usability
 cites: []

package/lenses/check.md

@@ -1,7 +1,7 @@
 ---
 name: check
 summary: correctness — boundaries, absent values, error paths, concurrency
-when: [**/*.{js,mjs,cjs,jsx,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift}]
+when: [**/*.{js,mjs,cjs,jsx,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,vue,svelte}]
 owns: defects that produce wrong behavior at runtime
 not-owns: style, naming, architecture, security categories, usability
 cites: []

package/lenses/security-check.md

@@ -1,7 +1,7 @@
 ---
 name: security-check
 summary: application security — trust boundaries, injection, secrets, exposure
-when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,sql}]
+when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,sql,vue,svelte}]
 owns: exploitable weaknesses reachable by an untrusted or under-privileged caller
 not-owns: general correctness, architecture preference, usability, styling
 cites: ["OWASP Top 10 (2021)", "OWASP ASVS", "CWE"]

package/lenses/taint.md

@@ -1,7 +1,7 @@
 ---
 name: taint
 summary: data flow from untrusted origin to dangerous operation, and what sanitises it
-when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift}]
+when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,vue,svelte}]
 owns: untrusted values reaching an operation that interprets them, unsanitised
 not-owns: security policy, authentication design, crypto choice, correctness, architecture, usability
 cites: []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applesnort/crosscheck",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Run independent review lenses in parallel and merge their findings into one deduped, consensus-ranked report \u2014 with SARIF output.",
   "license": "MIT",
   "author": "Joel Mangin",
@@ -34,6 +34,7 @@
     "foreman.md",
     "PROVENANCE.md",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {