@applesnort/crosscheck 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -0,0 +1,135 @@
+# Changelog
+
+Notable changes to `@applesnort/crosscheck`. Format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning is
+[semver](https://semver.org/), pre-1.0, so a minor bump is where behaviour
+changes land.
+
+Entries before 0.7.0 were reconstructed from commit history after the fact, so
+they name what each version did rather than itemising every change in it.
+
+**Published to npm: 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.6.0, 0.7.0.** 0.4.0, 0.5.0,
+0.6.1 and 0.6.2 exist as versions in this repository but were never published,
+so a consumer resolving `@0.6` gets 0.6.0 and none of the fixes after it.
+
+## [0.7.1] — unreleased
+
+### Fixed
+
+- **crosscheck could not run on Windows at all.** The packaged lens directory
+  was resolved with `new URL(...).pathname`, which is a URL path rather than a
+  filesystem one: on Windows it carries a leading slash before the drive letter
+  (`/C:/Users/...`). `readdirSync` threw an uncaught `ENOENT` before any command
+  that loads the built-in lenses could do anything, so `run` and `lenses` died
+  on a raw Node stack trace.
+
+  The same bug broke **every platform** whenever the install path contained a
+  space, because a URL path keeps its percent-escapes: `/Users/me/my source/`
+  arrived as `/Users/me/my%20source/` and resolved to nothing.
+
+- Config discovery silently stopped working on Windows. `findConfig` walked
+  upward using `/` string surgery, so a Windows `cwd` never yielded a parent:
+  the search probed the starting directory and gave up. A project's
+  `.crosscheckrc.json` was ignored unless you happened to run from the repo
+  root — and nothing said so, which is the invisible behaviour this tool rejects
+  everywhere else.
+
+- Routing lost every directory-anchored glob on Windows. `collectFiles` reported
+  paths with the platform separator, and the matcher only understood `/`.
+  Extension globs matched anyway (`[^/]*` eats a backslash), so the roster
+  filled and no `UNREVIEWED` line appeared while `**/components/**`,
+  `**/migrations/**`, `**/views/**`, `**/pages/**` and `**/schema*` quietly
+  matched nothing. Coverage narrowed and the run still reported as complete.
+
+  Paths are now reported with `/` on every platform, which also makes a
+  path-mode run agree with the same run under `--diff` — git has always emitted
+  `/`.
+
+- SARIF `artifactLocation.uri` is a URI reference, so a Windows path was not
+  merely ugly: a backslash is not a separator there and GitHub code scanning
+  could not map a result back to its file.
+
+- `npm test` did not work on Windows. The script globbed `test/*.test.mjs`, and
+  neither `cmd.exe` nor PowerShell expands a glob for an external command, so
+  node received the pattern as a literal. It now uses Node's own test
+  discovery.
+
+### Changed
+
+- CI runs the suite on Windows and macOS as well as Linux. Nothing above would
+  have reached a user with a Windows job in the matrix, and nothing would catch
+  a regression without one.
+
+- The CLI smoke-test stubs are Node scripts rather than `#!/bin/sh` ones, and no
+  longer need an execute bit. The suite could not run on Windows either, which
+  is the other half of why none of this was caught.
+
+## [0.7.0] — 2026-08-13
+
+### Fixed
+
+- The `check`, `architect`, `security-check` and `taint` lenses now route
+  `.vue` and `.svelte` files. They globbed `.js`/`.ts` and friends but not
+  single-file components, so only `ux` matched one — a 2437-line Vue component
+  in a real review was read by the usability lens and by nothing else, with no
+  correctness, security or architecture pass over the largest file in the
+  project.
+
+  The run still reported as complete, because each lens that skipped the
+  component did so via "nothing in scope matches", which reads as a routing
+  decision rather than a hole.
+
+  This is a **behaviour change, not just a fix**: every lens now receives more
+  files on any project containing components, so runs there are slower and cost
+  more. That is why it is a minor bump rather than a patch.
+
+- `test/lenses.test.mjs` asserts the shipped lenses route both extensions. The
+  existing routing test only ever checked a plain `.js` file, which is why the
+  gap survived.
+
+Stylesheets remain deliberately unrouted; the CLI naming an unmatched `.css`
+file in its `UNREVIEWED` line is intended behaviour, not a further instance of
+this bug.
+
+## [0.6.2] — unpublished
+
+- Install the model CLI in the scaffolded workflow.
+
+## [0.6.1] — unpublished
+
+- Do not load the same lens directory twice.
+
+## [0.6.0] — 2026
+
+- Adoption in one command (`crosscheck init`): scaffold config, lenses and
+  workflow.
+
+## [0.5.0] — unpublished
+
+- Cost work: make a standing panel cheap enough to leave switched on.
+
+## [0.4.0] — unpublished
+
+- Review a change rather than a tree; verify findings before reporting them;
+  gate before dispatch.
+- Cancel superseded CI runs instead of queueing them.
+
+## [0.3.0] — 2026
+
+- Layer lens sources, so adding one lens costs one file instead of forking all
+  of them.
+- Document that a project's own lenses stay in that project.
+
+## [0.2.2] — 2026
+
+- `.crosscheckrc.json`, so a team shares one panel definition instead of a shell
+  alias nobody else can see.
+
+## [0.2.1] — 2026
+
+- Disclose unreviewed files; stop sending lens frontmatter to the model.
+- CLI smoke tests, and two bugs they found.
+
+## [0.2.0] — 2026
+
+- Publish under the `@applesnort` scope.

package/README.md

@@ -38,6 +38,11 @@ Set `exec` to whatever runs your model, then:
 crosscheck run --diff --dry-run
 ```
 
+Node 20 or newer, on Linux, macOS or Windows. On Windows, prefer setting `exec`
+in `.crosscheckrc.json` rather than passing it on the command line: `--exec` is
+handed to the shell, and `cmd.exe` does not treat single quotes as quoting, so
+the POSIX spelling `--exec 'claude -p'` arrives with the quotes still attached.
+
 ## In CI
 
 The scaffolded workflow reviews the diff against the base branch, and does two

package/bin/crosscheck.mjs

@@ -57,7 +57,8 @@ import { spawn, spawnSync } from 'node:child_process';
 import {
   existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync
 } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { formatScore, score } from '../lib/calibrate.mjs';
 import { findConfig, mergeConfig, validateConfig } from '../lib/config.mjs';
 import { parseFrontmatter, resolveLensSet } from '../lib/lenses.mjs';
@@ -153,7 +154,11 @@ function loadLensMeta(dir) {
   return meta;
 }
 
-const BUILTIN_LENS_DIR = new URL('../lenses/', import.meta.url).pathname;
+// fileURLToPath, not `.pathname`: a URL path is not a filesystem path. It keeps
+// percent-escapes, so any install directory containing a space resolves to
+// nothing, and on Windows it carries a leading slash before the drive letter.
+const BUILTIN_LENS_DIR = resolve(
+  fileURLToPath(new URL('../lenses/', import.meta.url)));
 
 // Lens sources, in increasing precedence: the packaged lenses, then ./lenses or
 // .crosscheck/lenses if present, then anything named by --lenses. Layering
@@ -183,9 +188,18 @@ function lensSources(option, { includeBuiltin = true } = {}) {
   if (dirs.length === 0) {
     fail('no lens directories to load (--no-builtin with no --lenses?)');
   }
-  const sources = dirs.map(dir => ({ origin: dir, lenses: loadLenses(dir) }));
+  // The same directory can arrive twice — ./lenses is auto-detected, and running
+  // from that project also names it via --lenses. Loading it twice makes every
+  // lens in it shadow itself, which reads as a configuration mistake that is not
+  // one. Keep the last occurrence, so an explicit --lenses still wins on order.
+  const seen = new Map();
+  for (const dir of dirs) {
+    seen.set(dir, true);
+  }
+  const uniqueDirs = [...seen.keys()];
+  const sources = uniqueDirs.map(dir => ({ origin: dir, lenses: loadLenses(dir) }));
   if (sources.every(source => source.lenses.length === 0)) {
-    fail(`no usable lens definitions found in: ${dirs.join(', ')}`);
+    fail(`no usable lens definitions found in: ${uniqueDirs.join(', ')}`);
   }
   return sources;
 }
@@ -220,6 +234,13 @@ function loadLenses(dir) {
   return lenses;
 }
 
+// Report one separator whatever the platform uses. git diff already speaks `/`,
+// so without this a path-mode run on Windows routed, cached, and reported
+// differently from the same run under --diff. Split on the platform separator
+// rather than replacing every backslash: on POSIX a backslash is a legal
+// character in a filename, and rewriting it would corrupt a real path.
+const toPosix = path => sep === '/' ? path : path.split(sep).join('/');
+
 // Expand the positional targets into a concrete file list. Directories are walked;
 // everything is reported relative to cwd so paths in findings match what the user
 // typed.
@@ -240,7 +261,7 @@ function collectFiles(targets) {
     // ../../../ chain is harder to read than the full path, and the model has
     // to resolve whatever we print.
     const rel = relative(process.cwd(), path);
-    out.push(!rel || rel.startsWith('..') ? path : rel);
+    out.push(toPosix(!rel || rel.startsWith('..') ? path : rel));
   };
   for (const target of targets) {
     if (!existsSync(target)) {
@@ -502,10 +523,20 @@ jobs:
         with:
           node-version: '22.x'
 
+      # EDIT THIS STEP. crosscheck never talks to a model, so whatever your
+      # \`exec\` command names has to exist on the runner. Nothing here is
+      # installed for you, and a missing command fails every lens with ENOENT.
+      #
+      #   Claude Code:  npm i -g @anthropic-ai/claude-code   (exec: claude -p)
+      #   llm:          pipx install llm                     (exec: llm -m ...)
+      #   your own:     whatever installs it
+      - name: Install the model CLI
+        run: npm i -g @anthropic-ai/claude-code
+
       - name: Review the change
         env:
-          # Provide whatever your --exec command needs. crosscheck itself never
-          # talks to a model.
+          # Whatever your exec command needs to authenticate. crosscheck reads no
+          # credentials of its own.
           ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
         run: |
           npx @applesnort/crosscheck run \\

package/lenses/architect.md

@@ -1,7 +1,7 @@
 ---
 name: architect
 summary: structure, data shape, coupling, and reversibility of decisions
-when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,sql,prisma,graphql}, "**/migrations/**", "**/schema*"]
+when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,sql,prisma,graphql,vue,svelte}, "**/migrations/**", "**/schema*"]
 owns: couplings and lock-in that make later change expensive
 not-owns: line-level correctness, style, security categories, usability
 cites: []

package/lenses/check.md

@@ -1,7 +1,7 @@
 ---
 name: check
 summary: correctness — boundaries, absent values, error paths, concurrency
-when: [**/*.{js,mjs,cjs,jsx,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift}]
+when: [**/*.{js,mjs,cjs,jsx,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,vue,svelte}]
 owns: defects that produce wrong behavior at runtime
 not-owns: style, naming, architecture, security categories, usability
 cites: []

package/lenses/security-check.md

@@ -1,7 +1,7 @@
 ---
 name: security-check
 summary: application security — trust boundaries, injection, secrets, exposure
-when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,sql}]
+when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,sql,vue,svelte}]
 owns: exploitable weaknesses reachable by an untrusted or under-privileged caller
 not-owns: general correctness, architecture preference, usability, styling
 cites: ["OWASP Top 10 (2021)", "OWASP ASVS", "CWE"]

package/lenses/taint.md

@@ -1,7 +1,7 @@
 ---
 name: taint
 summary: data flow from untrusted origin to dangerous operation, and what sanitises it
-when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift}]
+when: [**/*.{js,mjs,cjs,ts,tsx,py,go,rb,java,cs,rs,php,kt,swift,vue,svelte}]
 owns: untrusted values reaching an operation that interprets them, unsanitised
 not-owns: security policy, authentication design, crypto choice, correctness, architecture, usability
 cites: []

package/lib/config.mjs

@@ -130,6 +130,31 @@ export function mergeConfig(fileConfig = {}, cliOptions = {}) {
   return merged;
 }
 
+// Both separators are accepted throughout the walk. A Windows cwd is
+// `C:\repo\src` while a POSIX one is `/repo/src`, and this module stays pure —
+// it must not read the host platform to decide which shape it was handed.
+// Building the walk out of `/` alone meant the parent never resolved on
+// Windows: the search probed the starting directory and stopped, so a project
+// config was silently ignored unless you ran from the repo root.
+const TRAILING_SEPARATORS = /[\\/]+$/;
+
+function joinPath(dir, name) {
+  const base = dir.replace(TRAILING_SEPARATORS, '');
+  const separator = base.includes('\\') && !base.includes('/') ? '\\' : '/';
+  return `${base}${separator}${name}`;
+}
+
+function parentOf(dir) {
+  const base = dir.replace(TRAILING_SEPARATORS, '');
+  const cut = Math.max(base.lastIndexOf('/'), base.lastIndexOf('\\'));
+  if (cut < 0) {
+    return '';
+  }
+  // The parent of `/a` is the root, not the empty string, or the walk would
+  // skip a config sitting at `/`.
+  return cut === 0 ? base.slice(0, 1) : base.slice(0, cut);
+}
+
 // Walk from `startDir` toward the filesystem root looking for a config file, so
 // running from a subdirectory of a project still picks up its settings.
 // `readFile` and `exists` are injected to keep this testable without a disk.
@@ -142,7 +167,7 @@ export function findConfig(startDir, { exists, isRoot = null } = {}) {
   while (dir && !seen.has(dir)) {
     seen.add(dir);
     for (const name of CONFIG_FILENAMES) {
-      const candidate = dir.endsWith('/') ? `${dir}${name}` : `${dir}/${name}`;
+      const candidate = joinPath(dir, name);
       if (exists(candidate)) {
         return candidate;
       }
@@ -150,7 +175,7 @@ export function findConfig(startDir, { exists, isRoot = null } = {}) {
     if (isRoot?.(dir)) {
       return null;
     }
-    const parent = dir.replace(/\/[^/]*\/?$/, '');
+    const parent = parentOf(dir);
     if (parent === dir || parent === '') {
       return null;
     }

package/lib/lenses.mjs

@@ -150,8 +150,15 @@ export function globToRegExp(glob) {
   return new RegExp(`^${out}$`);
 }
 
+// Routing globs are written with `/`, and a Windows path arrives with `\`.
+// Extension globs matched either way — `[^/]*` eats a backslash — so a Windows
+// run filled its roster and announced no coverage hole while every
+// directory-anchored glob quietly stopped matching. Normalising here is safe
+// even where a backslash is a legal filename character: the worst case is that
+// one extra lens reads one extra file.
 export function matchesAny(file, globs) {
-  return (globs ?? []).some(g => globToRegExp(g).test(file));
+  const path = String(file ?? '').replace(/\\/g, '/');
+  return (globs ?? []).some(g => globToRegExp(g).test(path));
 }
 
 // lenses: [{name, when: [globs], ...}], files: [paths in scope]

package/lib/sarif.mjs

@@ -80,7 +80,10 @@ function resultFor(finding) {
     message: { text },
     locations: [{
       physicalLocation: {
-        artifactLocation: { uri: finding.file },
+        // A URI reference, not a filesystem path: a backslash is not a
+        // separator here, and a consumer will not map the result back to a
+        // file.
+        artifactLocation: { uri: finding.file.replace(/\\/g, '/') },
         region: { startLine: finding.line }
       }
     }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applesnort/crosscheck",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Run independent review lenses in parallel and merge their findings into one deduped, consensus-ranked report \u2014 with SARIF output.",
   "license": "MIT",
   "author": "Joel Mangin",
@@ -34,10 +34,11 @@
     "foreman.md",
     "PROVENANCE.md",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test"
   },
   "keywords": [
     "code-review",