@motivation-labs/crosscheck 0.5.0 → 0.6.0

package/dist/reviewers/codex.js

@@ -27,10 +27,10 @@ const TIER_TIMEOUT_MS = {
     balanced: 600_000,
     thorough: 1_200_000,
 };
-export async function runCodexReview(repoDir, baseBranch, prTitle, quality, overrideModel, authMode = 'subscription', onLog) {
+export async function runCodexReview(repoDir, baseBranch, prTitle, quality, vendor, stepInstructions, onLog) {
     // subscription auth has a fixed model set by ChatGPT plan; only override for api-key
-    const model = authMode === 'api-key'
-        ? (overrideModel ?? TIER_MODELS_API[quality.tier] ?? 'o4-mini')
+    const model = vendor.auth === 'api-key'
+        ? (vendor.model ?? TIER_MODELS_API[quality.tier] ?? 'o4-mini')
         : undefined;
     const tmpFile = join(mkdtempSync(join(tmpdir(), 'crosscheck-')), 'review.md');
     // --base and [PROMPT] are mutually exclusive in codex review;
@@ -39,9 +39,9 @@ export async function runCodexReview(repoDir, baseBranch, prTitle, quality, over
         ? `Focus areas: ${quality.focus.join(', ')}. `
         : '';
     const customNote = quality.custom_prompt ?? '';
-    // Adaptive instructions from ~/.crosscheck/instructions.md (managed by `crosscheck optimize`)
-    const adaptiveInstructions = readInstructions(repoDir);
-    const instructionsNote = [focusNote, customNote, adaptiveInstructions].filter(Boolean).join('\n\n');
+    // stepInstructions from workflow step takes precedence; fall back to ~/.crosscheck/instructions.md
+    const behaviorInstructions = stepInstructions !== undefined ? stepInstructions : readInstructions(repoDir);
+    const instructionsNote = [focusNote, customNote, behaviorInstructions].filter(Boolean).join('\n\n');
     mkdirSync(`${repoDir}/.codex`, { recursive: true });
     writeFileSync(`${repoDir}/.codex/instructions`, instructionsNote);
     try {

package/dist/reviewers/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/reviewers/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,yCAAyC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACpB,CAAC,qEAAqE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACV,CAAC;AAED,sFAAsF;AACtF,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,IAAI;CACf,CAAA;AAED,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,SAAS;CACpB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,OAAsB,EACtB,aAAsB,EACtB,WAAuC,cAAc,EACrD,KAA6B;IAE7B,qFAAqF;IACrF,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS;QAClC,CAAC,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAE7E,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,8FAA8F;IAC9F,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACtD,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnG,SAAS,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,aAAa,CAAC,GAAG,OAAO,sBAAsB,EAAE,gBAAgB,CAAC,CAAA;IAEjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACzD,KAAK,EAAE,CAAC,kCAAkC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAE7F,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,OAAO,EACP,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,EAClE;YACE,GAAG,EAAE,OAAO;YACZ,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,yEAAyE;gBACzE,IAAI,EAAE,GAAG,OAAO,sBAAsB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;aAC/D;SACF,CACF,CAAA;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACrD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAoG,CAAA;QAClH,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAA;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;YAC5B,CAAC,CAAC,mBAAmB,UAAU,uCAAuC,OAAO,CAAC,IAAI,GAAG;YACrF,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,EAAE;YAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,CAAA;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAA4C,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,mBAAmB,EAAE,CAAA;IACpF,CAAC;AACH,CAAC"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/reviewers/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnE,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IACD,yCAAyC;IACzC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACtB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QACpB,CAAC,qEAAqE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC1B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACV,CAAC;AAED,sFAAsF;AACtF,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,IAAI;CACf,CAAA;AAED,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,OAAO;IACb,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,SAAS;CACpB,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,OAAsB,EACtB,MAAyB,EACzB,gBAAyB,EACzB,KAA6B;IAE7B,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS;QACrC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAE7E,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACxC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9C,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,mGAAmG;IACnG,MAAM,oBAAoB,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC1G,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnG,SAAS,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,aAAa,CAAC,GAAG,OAAO,sBAAsB,EAAE,gBAAgB,CAAC,CAAA;IAEjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACzD,KAAK,EAAE,CAAC,kCAAkC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAE7F,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAA;QAC1D,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,OAAO,EACP,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,EAClE;YACE,GAAG,EAAE,OAAO;YACZ,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,yEAAyE;gBACzE,IAAI,EAAE,GAAG,OAAO,sBAAsB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;aAC/D;SACF,CACF,CAAA;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACrD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAoG,CAAA;QAClH,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,CAAA;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;YAC5B,CAAC,CAAC,mBAAmB,UAAU,uCAAuC,OAAO,CAAC,IAAI,GAAG;YACrF,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,EAAE;YAC3D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,CAAA;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACjF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAA4C,CAAA;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,mBAAmB,EAAE,CAAA;IACpF,CAAC;AACH,CAAC"}

package/dist/reviewers/fix.d.ts

@@ -0,0 +1,5 @@
+import type { Config } from '../config/schema.js';
+export declare function runFixStep(tmpDir: string, baseRef: string, prTitle: string, reviewComment: string, instructions: string, config: Config): Promise<{
+    appliedCount: number;
+}>;
+//# sourceMappingURL=fix.d.ts.map

package/dist/reviewers/fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix.d.ts","sourceRoot":"","sources":["../../src/reviewers/fix.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAgCjD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDnC"}

package/dist/reviewers/fix.js

@@ -0,0 +1,87 @@
+import { execSync, execFileSync } from 'child_process';
+import { writeFileSync } from 'fs';
+import { join } from 'path';
+const PROMPT_TEMPLATE = `You opened a pull request that received the following code review.
+
+PR title: {PR_TITLE}
+
+Code review comment:
+---
+{REVIEW_COMMENT}
+---
+
+Diff of your changes (base..head):
+---
+{DIFF}
+---
+
+{EXTRA_INSTRUCTIONS}
+
+Please address the issues raised in the review. Rules:
+- Only fix what the review explicitly calls out
+- Do not refactor unrelated code, rename variables, or add tests unless asked
+- If a comment requires deeper understanding of business logic, skip it
+- If the review has no actionable code changes, output exactly: NO_CHANGES
+
+For each file you need to change, output the complete new file content using this format:
+
+<file path="relative/path/to/file.ext">
+[complete file content]
+</file>
+
+Output ONLY <file> blocks or NO_CHANGES. No other text.`;
+export async function runFixStep(tmpDir, baseRef, prTitle, reviewComment, instructions, config) {
+    let diff = '';
+    try {
+        diff = execSync(`git diff origin/${baseRef}...HEAD`, { cwd: tmpDir, encoding: 'utf8' });
+    }
+    catch {
+        try {
+            diff = execSync('git diff HEAD~1', { cwd: tmpDir, encoding: 'utf8' });
+        }
+        catch { /* proceed with empty diff */ }
+    }
+    const prompt = PROMPT_TEMPLATE
+        .replace('{PR_TITLE}', prTitle)
+        .replace('{REVIEW_COMMENT}', reviewComment.slice(0, 8000))
+        .replace('{DIFF}', diff.slice(0, 16000))
+        .replace('{EXTRA_INSTRUCTIONS}', instructions ? `Additional instructions: ${instructions}` : '');
+    let output = '';
+    try {
+        // Pass prompt via stdin — same pattern as optimize.ts
+        output = execFileSync('claude', ['--print', '--output-format', 'text'], {
+            input: prompt,
+            encoding: 'utf8',
+            timeout: 180_000,
+            env: { ...process.env },
+            maxBuffer: 10 * 1024 * 1024,
+        }).trim();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/not logged in|auth|credential/i.test(msg)) {
+            throw new Error('claude auth failure during fix step — run: claude auth login');
+        }
+        throw err;
+    }
+    if (!output || output === 'NO_CHANGES')
+        return { appliedCount: 0 };
+    // Parse <file path="...">content</file> blocks
+    const fileRegex = /<file path="([^"]+)">([\s\S]*?)<\/file>/g;
+    let match;
+    let appliedCount = 0;
+    while ((match = fileRegex.exec(output)) !== null) {
+        const [, filePath, rawContent] = match;
+        // Reject paths that escape the repo (e.g. ../../etc/passwd)
+        if (filePath.includes('..') || filePath.startsWith('/'))
+            continue;
+        const absPath = join(tmpDir, filePath);
+        try {
+            writeFileSync(absPath, rawContent.replace(/^\n/, ''));
+            appliedCount++;
+        }
+        catch { /* skip unwritable paths */ }
+    }
+    return { appliedCount };
+}
+//# sourceMappingURL=fix.js.map

package/dist/reviewers/fix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix.js","sourceRoot":"","sources":["../../src/reviewers/fix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA4BgC,CAAA;AAExD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,OAAe,EACf,OAAe,EACf,aAAqB,EACrB,YAAoB,EACpB,MAAc;IAEd,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,mBAAmB,OAAO,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,eAAe;SAC3B,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC;SAC9B,OAAO,CAAC,kBAAkB,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SACzD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAElG,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,sDAAsD;QACtD,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE;YACtE,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,OAAO;YAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;YACvB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC,IAAI,EAAE,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;IAElE,+CAA+C;IAC/C,MAAM,SAAS,GAAG,0CAA0C,CAAA;IAC5D,IAAI,KAA6B,CAAA;IACjC,IAAI,YAAY,GAAG,CAAC,CAAA;IAEpB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,KAAK,CAAA;QACtC,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YACrD,YAAY,EAAE,CAAA;QAChB,CAAC;QAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAA;AACzB,CAAC"}

package/get-started.md

@@ -24,6 +24,7 @@
   - [impact](#crosscheck-impact)
 - [Configuration](#configuration)
 - [How it works](#how-it-works)
+- [Post-review auto-fix](#post-review-auto-fix)
 - [FAQ](#faq)
 
 ---
@@ -185,6 +186,43 @@ crosscheck review https://github.com/owner/repo/pull/123 --reviewer claude
 
 ## Step 3 — Choose a deployment mode
 
+### Personal vs team
+
+On first run, `crosscheck watch` (or `crosscheck serve`) will ask how you're using it:
+
+```
+How are you using crosscheck?
+
+  [1] personal  — monitor all your repos and orgs; review only PRs you author
+  [2] team      — monitor org repos only; review all PRs from any author
+
+  Choice [1]:
+```
+
+The choice is saved to `crosscheck.config.yml` as `deployment: personal` or `deployment: team`.
+
+**Personal mode** (default, recommended for individuals)
+- Monitors all repos under your personal GitHub account + all orgs you belong to
+- Only reviews PRs you authored — ignores everyone else's
+- Sets `routing.allowed_authors` to your GitHub login automatically
+
+**Team mode** (recommended for shared machines)
+- Monitors all orgs you belong to (no personal repos)
+- Reviews all PRs from any author — no author filter applied
+
+You can override the saved choice for a single session without touching the config:
+
+```bash
+crosscheck watch --personal   # personal mode this session only
+crosscheck watch --team       # team mode this session only
+```
+
+To re-run the prompt and permanently change your choice:
+
+```bash
+crosscheck watch --reconfigure
+```
+
 ### Watch mode — for your development machine
 
 Starts a local server and opens a tunnel via `localhost.run` (SSH, no install needed) so GitHub can reach your laptop. Registers webhooks automatically. Supports org-level coverage or per-repo. Runs while your terminal is open.
@@ -561,17 +599,25 @@ The monetary estimate formula: `(hours_saved × hourly_rate_usd) + (issues_caugh
 
 ## Configuration
 
-crosscheck looks for a config file in these locations (first found wins):
+crosscheck stores its config in `~/.crosscheck/config.yml` by default — persistent across projects, no per-repo file needed. It also looks in these locations (first found wins):
 
 1. `./crosscheck.config.yml`
 2. `./.crosscheck.yml`
-3. `~/.crosscheck/config.yml`
+3. `~/.crosscheck/config.yml` ← **default location**
+
+Run `crosscheck init` to generate `~/.crosscheck/config.yml` with all options documented.
 
-Run `crosscheck init` to generate a starter file with all options commented.
+Logs are written to `~/.crosscheck/logs/YYYY-MM-DD.ndjson` and retained for 30 days by default.
 
 ### Full reference
 
 ```yaml
+# ── Deployment ────────────────────────────────────────────────────────────────
+# Set automatically on first run. Re-run the prompt with: crosscheck watch --reconfigure
+# personal — monitor your repos + orgs; review only your PRs
+# team     — monitor org repos only; review all PRs from any author
+# deployment: personal
+
 # ── Mode ──────────────────────────────────────────────────────────────────────
 # single-vendor: one AI reviews all PRs
 # cross-vendor:  Claude ↔ Codex review each other
@@ -605,24 +651,43 @@ budget:
   per_review_usd: 2.00      # passed to claude --max-budget-usd
 
 # ── Orgs — covers all repos in each org with one webhook ─────────────────────
-# Takes priority over `repos` when both are set.
 orgs:
   - motivation-labs
   - codatta
 
+# ── Users — monitors all repos owned by personal GitHub accounts (non-org) ───
+# At startup, crosscheck enumerates each user's repos and registers webhooks.
+# Useful when your AI agents open PRs across many personal repos.
+# Combines with `orgs` and `repos` — all configured sources are additive.
+users:
+  - beingzy           # your personal account
+  # - my-agent-login  # a bot account that pushes to its own repos
+
 # ── Repos — for monitoring specific repos only ────────────────────────────────
-# Omit when using `orgs`. In watch mode, auto-detected from git remote if empty.
+# Omit when using `orgs`/`users`. Auto-detected from git remote if all are empty.
 repos:
   - owner: acme
     name: specific-repo
 
 # ── Routing ───────────────────────────────────────────────────────────────────
 routing:
+  # Origin is detected via a four-signal chain:
+  #   1. PR body patterns below (fastest)
+  #   2. Commit message Co-Authored-By: trailers (API call, non-fatal if it fails)
+  #   3. Branch prefix (claude/ or codex/)
+  #   4. author_routes fallback (last resort)
   codex_reviews_patterns:
-    - "Generated with \\[Claude Code\\]"
+    - "Generated with \\[Claude Code\\]"    # Claude Code attribution footer
+    - "Co-Authored-By: Claude"              # commit trailer
   claude_reviews_patterns:
-    - "Generated with \\[OpenAI Codex\\]"
-    - "Co-Authored-By: codex"
+    - "Generated with \\[OpenAI Codex\\]"   # Codex attribution footer
+    - "Co-Authored-By: codex"               # commit trailer
+
+  # Branch prefix detection (signal 3). Claude Code uses claude/, Codex uses codex/.
+  claude_branch_prefixes:
+    - "claude/"
+  codex_branch_prefixes:
+    - "codex/"
 
   # Restrict reviews to PRs opened by these GitHub logins.
   # Auto-filled with your GitHub login by `crosscheck init` or first `crosscheck watch`.
@@ -630,12 +695,11 @@ routing:
   allowed_authors:
     - your-github-login  # auto-detected from gh auth
 
-  # Author-based routing fallback — used when no body pattern matches.
+  # Author-based routing fallback (signal 4) — used when no pattern or prefix matches.
   # Maps GitHub login → vendor origin so crosscheck routes PRs even without
   # the attribution footer (e.g. when creating PRs via gh CLI directly).
   author_routes:
     your-github-login: claude   # your PRs → treated as Claude-authored → Codex reviews
-    - your-codex-bot-account
 
 # ── Tunnel (watch mode only) ──────────────────────────────────────────────────
 # localhost.run (default) — SSH tunnel, zero install, URL changes on reconnect.
@@ -653,6 +717,26 @@ impact:
   hourly_rate_usd: 150               # for --money estimate
   defect_cost_usd: 150               # per issue caught, for --money estimate
 
+# ── Post-review auto-fix ──────────────────────────────────────────────────────
+# Runs after each review. When issues are found, the authoring vendor opens a
+# fix PR targeting the original branch. You approve and merge it; the original
+# PR updates automatically.
+post_review:
+  auto_fix:
+    enabled: true
+    trigger: on_issues        # on_issues | always | never
+    min_severity: warning     # error | warning | info — skip cosmetic findings
+    # same-as-author: the vendor that wrote the PR also applies the fix
+    # In cross-vendor mode: Claude-authored → Claude fixes; Codex-authored → Codex fixes
+    fixer: same-as-author     # same-as-author | same-as-reviewer | codex | claude
+    delivery:
+      mode: pull_request      # pull_request | commit | comment
+      # pull_request → fix PR targets original branch; human approves before merge
+      # commit       → fixes pushed directly onto the original PR branch
+      # comment      → suggested fixes posted as review comments only
+      pr_title: "fix: address CR issues in #{original_pr_title}"
+      label: cr-autofix       # GitHub label applied to the fix PR
+
 # ── Server ────────────────────────────────────────────────────────────────────
 server:
   port: 7891
@@ -715,15 +799,38 @@ clone PR branch into temp directory
             ▼
     post comment to PR via GitHub API
     delete temp clone
+            │
+            ▼  post_review.auto_fix (if enabled and issues found)
+    authoring vendor reads review comment
+            │
+    ├─ claude --print ...  (Claude authored the PR)
+    │  or
+    └─ codex ...           (Codex authored the PR)
+            │
+            ▼
+    opens fix PR → fix/cr-<pr-number>-review-issues → original branch
+    (you review and merge the fix PR; original PR updates automatically)
 ```
 
 ### PR origin detection
 
+crosscheck uses a four-signal chain to determine whether a PR was authored by Claude Code, Codex, or a human:
+
+1. **PR body** — looks for attribution footers (e.g. `Generated with [Claude Code]`)
+2. **Commit messages** — scans all commit messages for `Co-Authored-By:` trailers
+3. **Branch prefix** — `claude/` → Claude origin; `codex/` → Codex origin
+4. **`author_routes`** — per-login fallback in config
+
+If none match, origin is `human` and the PR is skipped in cross-vendor mode.
+
 | Default pattern | Matches |
 |---|---|
-| `Generated with \[Claude Code\]` | PRs opened by Claude Code |
-| `Generated with \[OpenAI Codex\]` | PRs opened by Codex CLI |
-| `Co-Authored-By: codex` | Commits co-authored by Codex |
+| `Generated with \[Claude Code\]` | Claude Code attribution footer in PR body |
+| `Generated with \[OpenAI Codex\]` | Codex attribution footer in PR body |
+| `Co-Authored-By: Claude` | Commit trailers from Claude Code |
+| `Co-Authored-By: codex` | Commit trailers from Codex |
+| branch prefix `claude/` | Branch naming convention for Claude-authored PRs |
+| branch prefix `codex/` | Branch naming convention for Codex-authored PRs |
 
 ### Reviewer assignment
 
@@ -780,6 +887,39 @@ GitHub can fire both `opened` and `synchronize` events for the same push. crossc
 
 ---
 
+## Post-review auto-fix
+
+When `post_review.auto_fix.enabled` is `true` (the default), crosscheck completes the full loop automatically after every review that finds issues:
+
+```
+agent opens PR #42  →  opposite vendor reviews  →  issues found?
+                                                         │ yes
+                                        authoring vendor generates fixes
+                                                         │
+                                    fix PR #43 opened → feat/my-feature
+                                                         │
+                                    you review and merge PR #43
+                                                         │
+                                    PR #42 updates → you merge to main
+```
+
+**Key design decisions:**
+
+| Setting | Default | Why |
+|---|---|---|
+| `fixer: same-as-author` | the vendor that wrote the PR also fixes it | The authoring agent knows its own code and style best |
+| `delivery: pull_request` | opens a new PR, doesn't push directly | You stay in the loop — no code lands without your approval |
+| `trigger: on_issues` | only fires when the reviewer found warnings or worse | Skips the fix step on clean PRs |
+| `min_severity: warning` | ignores info/cosmetic findings | Avoids noisy fix PRs for style-only comments |
+
+**Fix PR branch naming:** `fix/cr-<original-pr-number>-review-issues`
+
+**Original PR number:** never changes. The fix PR targets the original branch; once merged, its commits appear in the original PR automatically.
+
+**To disable:** set `post_review.auto_fix.enabled: false` in your config, or set `trigger: never`.
+
+---
+
 ## FAQ
 
 ### How does crosscheck improve over time?
@@ -796,19 +936,38 @@ It picks automatically:
 
 The agent used for `optimize` is independent of which agent reviews your PRs — `optimize` is about improving the instructions, not reviewing code.
 
-### What is `~/.crosscheck/instructions.md` and can I edit it?
+### How do I customize reviewer behavior?
 
-Yes — it is a plain Markdown file that both `codex` and `claude` read before every review. On first use, crosscheck seeds it with safe defaults (no build-tool constraints, a focused review prompt, and the VERDICT format). You can edit it manually at any time. `crosscheck optimize --apply` rewrites it, so keep a backup or use version control if you've made custom edits you want to preserve.
+The primary place is the workflow file. Each step has an `instructions` field that is passed verbatim to the reviewer or fixer agent:
 
-To reset to defaults, delete the file:
+```yaml
+# .crosscheck/workflow.yml
+steps:
+  - name: review
+    type: review
+    reviewer: auto
+    instructions: |
+      Do not suggest TypeScript patterns — this is a Rust project.
+      Focus on memory safety and error handling.
+      ## Verdict
+      End with: VERDICT: APPROVE | NEEDS_WORK | BLOCK
+  - name: fix
+    type: fix
+    reviewer: origin
+    when: "review.verdict != 'APPROVE'"
+    instructions: "Only fix issues explicitly called out. Do not refactor unrelated code."
+```
+
+`~/.crosscheck/instructions.md` serves as a fallback when a workflow step has no `instructions:` field. `crosscheck optimize --apply` writes to that file to persist learned improvements across sessions.
+
+To reset instructions.md to defaults, delete the file:
 ```bash
 rm ~/.crosscheck/instructions.md
 ```
-The next review will re-seed it from the built-in defaults.
 
-### Can I have per-project instructions?
+### Can I have per-project workflow?
 
-Yes. Create `.crosscheck/instructions.md` in your repo root. crosscheck checks for a project-level file first and uses it instead of the user-level one. This lets you enforce project-specific constraints (e.g. "this is a Rust project — do not suggest TypeScript patterns") without affecting other repos.
+Yes. Create `.crosscheck/workflow.yml` in your repo root. crosscheck loads it automatically and uses it instead of the built-in default pipeline. This is the recommended way to customize reviewer behavior — it keeps all per-project settings in one file under version control.
 
 ### What is `AGENT.md`?
 
@@ -835,7 +994,7 @@ crosscheck fetches the PR base branch (e.g. `staging`) into the temp clone befor
 npm install -g smee-client
 ```
 
-Visit [smee.io/new](https://smee.io/new) and copy the channel URL. Then in `crosscheck.config.yml`:
+Visit [smee.io/new](https://smee.io/new) and copy the channel URL. Then in `~/.crosscheck/config.yml`:
 
 ```yaml
 tunnel:
@@ -843,8 +1002,18 @@ tunnel:
   smee_channel: https://smee.io/your-channel-id
 ```
 
-Register the smee channel URL as your GitHub webhook Payload URL once. crosscheck will forward events from the channel to the local server automatically. Unlike `localhost.run`, no re-registration is needed on restart.
+crosscheck registers the smee channel URL as your GitHub webhook automatically on first `watch` start. The channel URL never changes, so no re-registration is needed on restart. Unlike `localhost.run`, events are queued while you're offline and replayed when you reconnect.
+
+
+### Can I disable the auto-fix step?
+
+Yes. Set `post_review.auto_fix.enabled: false` in your config, or set `trigger: never`. You can also raise `min_severity` to `error` to limit fixes to blocking issues only.
+
+To push fixes directly without a separate PR (skipping your review), switch to `delivery: commit`. To get suggested fixes as review comments without any code push, use `delivery: comment`.
+
+### Why does the fixer use the same vendor that wrote the PR?
 
+The authoring agent has the most context about its own code — the same style, constraints, and intent behind the original changes. Using `fixer: same-as-author` keeps the feedback loop tight: the agent writes the code, another agent reviews it, the original agent fixes it. You can override this to `same-as-reviewer`, `codex`, or `claude` if you prefer a different arrangement.
 
 ### Does optimize run automatically?
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@motivation-labs/crosscheck",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Cross-vendor AI code review orchestrator — Claude Code ↔ Codex",
   "bin": {
     "crosscheck": "dist/cli.js"