@applesnort/crosscheck 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -8,11 +8,63 @@ changes land.
 Entries before 0.7.0 were reconstructed from commit history after the fact, so
 they name what each version did rather than itemising every change in it.
 
-**Published to npm: 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.6.0.** 0.4.0, 0.5.0, 0.6.1 and
-0.6.2 exist as versions in this repository but were never published, so a
-consumer resolving `@0.6` gets 0.6.0 and none of the fixes after it.
+**Published to npm: 0.2.0, 0.2.1, 0.2.2, 0.3.0, 0.6.0, 0.7.0.** 0.4.0, 0.5.0,
+0.6.1 and 0.6.2 exist as versions in this repository but were never published,
+so a consumer resolving `@0.6` gets 0.6.0 and none of the fixes after it.
 
-## [0.7.0] — unreleased
+## [0.7.1] — unreleased
+
+### Fixed
+
+- **crosscheck could not run on Windows at all.** The packaged lens directory
+  was resolved with `new URL(...).pathname`, which is a URL path rather than a
+  filesystem one: on Windows it carries a leading slash before the drive letter
+  (`/C:/Users/...`). `readdirSync` threw an uncaught `ENOENT` before any command
+  that loads the built-in lenses could do anything, so `run` and `lenses` died
+  on a raw Node stack trace.
+
+  The same bug broke **every platform** whenever the install path contained a
+  space, because a URL path keeps its percent-escapes: `/Users/me/my source/`
+  arrived as `/Users/me/my%20source/` and resolved to nothing.
+
+- Config discovery silently stopped working on Windows. `findConfig` walked
+  upward using `/` string surgery, so a Windows `cwd` never yielded a parent:
+  the search probed the starting directory and gave up. A project's
+  `.crosscheckrc.json` was ignored unless you happened to run from the repo
+  root — and nothing said so, which is the invisible behaviour this tool rejects
+  everywhere else.
+
+- Routing lost every directory-anchored glob on Windows. `collectFiles` reported
+  paths with the platform separator, and the matcher only understood `/`.
+  Extension globs matched anyway (`[^/]*` eats a backslash), so the roster
+  filled and no `UNREVIEWED` line appeared while `**/components/**`,
+  `**/migrations/**`, `**/views/**`, `**/pages/**` and `**/schema*` quietly
+  matched nothing. Coverage narrowed and the run still reported as complete.
+
+  Paths are now reported with `/` on every platform, which also makes a
+  path-mode run agree with the same run under `--diff` — git has always emitted
+  `/`.
+
+- SARIF `artifactLocation.uri` is a URI reference, so a Windows path was not
+  merely ugly: a backslash is not a separator there and GitHub code scanning
+  could not map a result back to its file.
+
+- `npm test` did not work on Windows. The script globbed `test/*.test.mjs`, and
+  neither `cmd.exe` nor PowerShell expands a glob for an external command, so
+  node received the pattern as a literal. It now uses Node's own test
+  discovery.
+
+### Changed
+
+- CI runs the suite on Windows and macOS as well as Linux. Nothing above would
+  have reached a user with a Windows job in the matrix, and nothing would catch
+  a regression without one.
+
+- The CLI smoke-test stubs are Node scripts rather than `#!/bin/sh` ones, and no
+  longer need an execute bit. The suite could not run on Windows either, which
+  is the other half of why none of this was caught.
+
+## [0.7.0] — 2026-08-13
 
 ### Fixed
 

package/README.md

@@ -38,6 +38,11 @@ Set `exec` to whatever runs your model, then:
 crosscheck run --diff --dry-run
 ```
 
+Node 20 or newer, on Linux, macOS or Windows. On Windows, prefer setting `exec`
+in `.crosscheckrc.json` rather than passing it on the command line: `--exec` is
+handed to the shell, and `cmd.exe` does not treat single quotes as quoting, so
+the POSIX spelling `--exec 'claude -p'` arrives with the quotes still attached.
+
 ## In CI
 
 The scaffolded workflow reviews the diff against the base branch, and does two

package/bin/crosscheck.mjs

@@ -57,7 +57,8 @@ import { spawn, spawnSync } from 'node:child_process';
 import {
   existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync
 } from 'node:fs';
-import { dirname, join, relative, resolve } from 'node:path';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { formatScore, score } from '../lib/calibrate.mjs';
 import { findConfig, mergeConfig, validateConfig } from '../lib/config.mjs';
 import { parseFrontmatter, resolveLensSet } from '../lib/lenses.mjs';
@@ -153,7 +154,11 @@ function loadLensMeta(dir) {
   return meta;
 }
 
-const BUILTIN_LENS_DIR = new URL('../lenses/', import.meta.url).pathname;
+// fileURLToPath, not `.pathname`: a URL path is not a filesystem path. It keeps
+// percent-escapes, so any install directory containing a space resolves to
+// nothing, and on Windows it carries a leading slash before the drive letter.
+const BUILTIN_LENS_DIR = resolve(
+  fileURLToPath(new URL('../lenses/', import.meta.url)));
 
 // Lens sources, in increasing precedence: the packaged lenses, then ./lenses or
 // .crosscheck/lenses if present, then anything named by --lenses. Layering
@@ -229,6 +234,13 @@ function loadLenses(dir) {
   return lenses;
 }
 
+// Report one separator whatever the platform uses. git diff already speaks `/`,
+// so without this a path-mode run on Windows routed, cached, and reported
+// differently from the same run under --diff. Split on the platform separator
+// rather than replacing every backslash: on POSIX a backslash is a legal
+// character in a filename, and rewriting it would corrupt a real path.
+const toPosix = path => sep === '/' ? path : path.split(sep).join('/');
+
 // Expand the positional targets into a concrete file list. Directories are walked;
 // everything is reported relative to cwd so paths in findings match what the user
 // typed.
@@ -249,7 +261,7 @@ function collectFiles(targets) {
     // ../../../ chain is harder to read than the full path, and the model has
     // to resolve whatever we print.
     const rel = relative(process.cwd(), path);
-    out.push(!rel || rel.startsWith('..') ? path : rel);
+    out.push(toPosix(!rel || rel.startsWith('..') ? path : rel));
   };
   for (const target of targets) {
     if (!existsSync(target)) {

package/lib/config.mjs

@@ -130,6 +130,31 @@ export function mergeConfig(fileConfig = {}, cliOptions = {}) {
   return merged;
 }
 
+// Both separators are accepted throughout the walk. A Windows cwd is
+// `C:\repo\src` while a POSIX one is `/repo/src`, and this module stays pure —
+// it must not read the host platform to decide which shape it was handed.
+// Building the walk out of `/` alone meant the parent never resolved on
+// Windows: the search probed the starting directory and stopped, so a project
+// config was silently ignored unless you ran from the repo root.
+const TRAILING_SEPARATORS = /[\\/]+$/;
+
+function joinPath(dir, name) {
+  const base = dir.replace(TRAILING_SEPARATORS, '');
+  const separator = base.includes('\\') && !base.includes('/') ? '\\' : '/';
+  return `${base}${separator}${name}`;
+}
+
+function parentOf(dir) {
+  const base = dir.replace(TRAILING_SEPARATORS, '');
+  const cut = Math.max(base.lastIndexOf('/'), base.lastIndexOf('\\'));
+  if (cut < 0) {
+    return '';
+  }
+  // The parent of `/a` is the root, not the empty string, or the walk would
+  // skip a config sitting at `/`.
+  return cut === 0 ? base.slice(0, 1) : base.slice(0, cut);
+}
+
 // Walk from `startDir` toward the filesystem root looking for a config file, so
 // running from a subdirectory of a project still picks up its settings.
 // `readFile` and `exists` are injected to keep this testable without a disk.
@@ -142,7 +167,7 @@ export function findConfig(startDir, { exists, isRoot = null } = {}) {
   while (dir && !seen.has(dir)) {
     seen.add(dir);
     for (const name of CONFIG_FILENAMES) {
-      const candidate = dir.endsWith('/') ? `${dir}${name}` : `${dir}/${name}`;
+      const candidate = joinPath(dir, name);
       if (exists(candidate)) {
         return candidate;
       }
@@ -150,7 +175,7 @@ export function findConfig(startDir, { exists, isRoot = null } = {}) {
     if (isRoot?.(dir)) {
       return null;
     }
-    const parent = dir.replace(/\/[^/]*\/?$/, '');
+    const parent = parentOf(dir);
     if (parent === dir || parent === '') {
       return null;
     }

package/lib/lenses.mjs

@@ -150,8 +150,15 @@ export function globToRegExp(glob) {
   return new RegExp(`^${out}$`);
 }
 
+// Routing globs are written with `/`, and a Windows path arrives with `\`.
+// Extension globs matched either way — `[^/]*` eats a backslash — so a Windows
+// run filled its roster and announced no coverage hole while every
+// directory-anchored glob quietly stopped matching. Normalising here is safe
+// even where a backslash is a legal filename character: the worst case is that
+// one extra lens reads one extra file.
 export function matchesAny(file, globs) {
-  return (globs ?? []).some(g => globToRegExp(g).test(file));
+  const path = String(file ?? '').replace(/\\/g, '/');
+  return (globs ?? []).some(g => globToRegExp(g).test(path));
 }
 
 // lenses: [{name, when: [globs], ...}], files: [paths in scope]

package/lib/sarif.mjs

@@ -80,7 +80,10 @@ function resultFor(finding) {
     message: { text },
     locations: [{
       physicalLocation: {
-        artifactLocation: { uri: finding.file },
+        // A URI reference, not a filesystem path: a backslash is not a
+        // separator here, and a consumer will not map the result back to a
+        // file.
+        artifactLocation: { uri: finding.file.replace(/\\/g, '/') },
         region: { startLine: finding.line }
       }
     }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@applesnort/crosscheck",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Run independent review lenses in parallel and merge their findings into one deduped, consensus-ranked report \u2014 with SARIF output.",
   "license": "MIT",
   "author": "Joel Mangin",
@@ -38,7 +38,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test"
   },
   "keywords": [
     "code-review",