fapony 0.1.0

package/src/install/types.ts

@@ -0,0 +1,69 @@
+// src/install/types.ts — shared types + constants for install providers
+
+import { join } from "node:path";
+
+/** Repo root (parent of src/) — absolute path to this fapony checkout,
+ *  so `claude mcp add` works even before `bun link`. Same pattern as src/update.ts.
+ *  Note: this file lives in src/install/, so ../.. reaches the repo root. */
+export const INSTALL_ROOT = join(import.meta.dir, "..", "..");
+
+export const MCP_KEY = "fapony";
+
+export const MCP_CONFIG = {
+  type: "local",
+  command: ["bun", "run", "fapony.ts", "mcp"],
+};
+
+/** ZCode uses the stdio MCP shape: command is a string, args is an array.
+ *  See ~/.zcode/cli/plugins/cache/zcode-plugins-official/zcode-guide/...
+ *  (do not use OpenCode-style `command: [...]` in ZCode's JSON editor). */
+export const ZCODE_MCP_CONFIG = {
+  type: "stdio",
+  command: "bun",
+  args: ["run", join(INSTALL_ROOT, "fapony.ts"), "mcp"],
+};
+
+export const CODEX_MCP_ENTRY = `[mcp_servers.fapony]
+command = "bun"
+args = ["run", "${INSTALL_ROOT}/fapony.ts", "mcp"]
+type = "stdio"
+`;
+
+/** Cursor's stdio MCP shape (mcpServers.fapony in ~/.cursor/mcp.json):
+ *  command is a string, args is an array — same as ZCode, not OpenCode's
+ *  `command: [...]`. */
+export const CURSOR_MCP_ENTRY = {
+  command: "bun",
+  args: ["run", join(INSTALL_ROOT, "fapony.ts"), "mcp"],
+};
+
+export interface ClaudeRunResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+export interface InstallDeps {
+  /** Run argv synchronously. Defaults to Bun.spawnSync. Injected in tests. */
+  run?: (argv: string[]) => ClaudeRunResult;
+  exit?: (code: number) => never;
+  /** Override os.homedir() for tests. */
+  homedir?: () => string;
+  /** Prompt the user (question → answer). Injected in tests; when absent,
+   *  detect/prompt path prints results and exits instead of asking. */
+  ask?: (question: string, defaultVal?: string) => Promise<string>;
+  /** Check if a command is on PATH. Defaults to `command -v` with allowlist. */
+  checkCmd?: (cmd: string) => boolean;
+}
+
+/** Default process exit. Shared by all providers — do not duplicate. */
+export function defaultExit(code: number): never {
+  return process.exit(code);
+}
+
+export type SkillLinkAction = "linked" | "already" | "conflict";
+
+export interface SkillLinkResult {
+  name: string;
+  action: SkillLinkAction;
+}

package/src/install/utils.ts

@@ -0,0 +1,29 @@
+// src/install/utils.ts — shared utilities for install providers
+
+/**
+ * Compute a line-by-line JSON diff between two objects.
+ * Used by OpenCode and ZCode providers for dry-run output.
+ */
+export function computeDiff(
+  before: Record<string, unknown>,
+  after: Record<string, unknown>,
+): string {
+  const beforeStr = JSON.stringify(before, null, 2);
+  const afterStr = JSON.stringify(after, null, 2);
+  const beforeLines = beforeStr.split("\n");
+  const afterLines = afterStr.split("\n");
+
+  const diff: string[] = [];
+  const max = Math.max(beforeLines.length, afterLines.length);
+  for (let i = 0; i < max; i++) {
+    const b = beforeLines[i];
+    const a = afterLines[i];
+    if (b !== a) {
+      if (b !== undefined) diff.push(`- ${b}`);
+      if (a !== undefined) diff.push(`+ ${a}`);
+    } else {
+      diff.push(`  ${b}`);
+    }
+  }
+  return diff.join("\n");
+}

package/src/install/zcode.ts

@@ -0,0 +1,120 @@
+// src/install/zcode.ts — ZCode install provider
+//
+// Reads/writes ~/.zcode/cli/config.json (fallback ~/.agents/mcp.json) directly.
+// ZCode has no `zcode mcp add` CLI.
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { agentsSkillsDir, linkSkills, reportSkills } from "./skills.js";
+import {
+  defaultExit,
+  type InstallDeps,
+  MCP_KEY,
+  ZCODE_MCP_CONFIG,
+} from "./types.js";
+import { computeDiff } from "./utils.js";
+
+/** Resolve the active ZCode config file. Primary: ~/.zcode/cli/config.json.
+ *  Fallback: ~/.agents/mcp.json (only when primary is absent). */
+export function findZcodeConfig(
+  getHome: () => string,
+): { path: string; key: "mcp.servers" | "mcpServers" } | null {
+  const primary = join(getHome(), ".zcode", "cli", "config.json");
+  if (existsSync(primary)) return { path: primary, key: "mcp.servers" };
+  const fallback = join(getHome(), ".agents", "mcp.json");
+  if (existsSync(fallback)) return { path: fallback, key: "mcpServers" };
+  return null;
+}
+
+function getZcodeServers(
+  cfg: Record<string, unknown>,
+  key: "mcp.servers" | "mcpServers",
+): Record<string, unknown> | undefined {
+  if (key === "mcpServers") {
+    return cfg.mcpServers as Record<string, unknown> | undefined;
+  }
+  const mcp = cfg.mcp as Record<string, unknown> | undefined;
+  return mcp?.servers as Record<string, unknown> | undefined;
+}
+
+function setZcodeServers(
+  cfg: Record<string, unknown>,
+  key: "mcp.servers" | "mcpServers",
+  servers: Record<string, unknown>,
+): Record<string, unknown> {
+  if (key === "mcpServers") {
+    return { ...cfg, mcpServers: servers };
+  }
+  const mcp = (cfg.mcp as Record<string, unknown>) ?? {};
+  return { ...cfg, mcp: { ...mcp, servers } };
+}
+
+function isZcodeConfigured(
+  servers: Record<string, unknown> | undefined,
+): boolean {
+  if (!servers) return false;
+  const entry = servers[MCP_KEY];
+  if (!entry || typeof entry !== "object") return false;
+  const cfg = entry as Record<string, unknown>;
+  if (cfg.type !== "stdio" && cfg.type !== undefined) return false;
+  if (cfg.command !== ZCODE_MCP_CONFIG.command) return false;
+  if (!Array.isArray(cfg.args)) return false;
+  return JSON.stringify(cfg.args) === JSON.stringify(ZCODE_MCP_CONFIG.args);
+}
+
+export function cmdInstallZcode(dryRun: boolean, deps: InstallDeps = {}): void {
+  const exitFn = deps.exit ?? defaultExit;
+  const getHome = deps.homedir ?? homedir;
+
+  const found = findZcodeConfig(getHome);
+  if (!found) {
+    console.error(
+      `ZCode config not found — open ZCode at least once to create ~/.zcode/cli/config.json`,
+    );
+    exitFn(1);
+    return;
+  }
+
+  let before: Record<string, unknown>;
+  try {
+    before = JSON.parse(readFileSync(found.path, "utf-8")) as Record<
+      string,
+      unknown
+    >;
+  } catch (e) {
+    console.error(`failed to parse ${found.path}: ${(e as Error).message}`);
+    exitFn(1);
+    return;
+  }
+
+  const servers = getZcodeServers(before, found.key) ?? {};
+  if (isZcodeConfigured(servers)) {
+    console.error(`✓ mcp.${MCP_KEY} already configured — no change needed`);
+    console.error(`  (${found.path})`);
+    const skillsDir = agentsSkillsDir(getHome);
+    reportSkills(linkSkills(skillsDir, dryRun), skillsDir, dryRun);
+    return;
+  }
+
+  const after = setZcodeServers(before, found.key, {
+    ...servers,
+    [MCP_KEY]: ZCODE_MCP_CONFIG,
+  });
+
+  if (dryRun) {
+    console.error(`── dry-run: would write ${found.key}.${MCP_KEY} ──`);
+    console.error(`  (${found.path})`);
+    console.log(computeDiff(before, after));
+    return;
+  }
+
+  writeFileSync(found.path, `${JSON.stringify(after, null, 2)}\n`);
+  console.error(`✓ added mcp.${MCP_KEY} to ${found.path}`);
+  if (found.key === "mcpServers") {
+    console.error(`  (fallback path: ~/.agents/mcp.json)`);
+  }
+  console.error(`  restart ZCode to load the MCP server`);
+  const skillsDir = agentsSkillsDir(getHome);
+  reportSkills(linkSkills(skillsDir, dryRun), skillsDir, dryRun);
+}

package/src/install.ts

@@ -0,0 +1,176 @@
+// src/install.ts — `fapony install --platform opencode|claude|cursor|zcode|codex` command.
+// opencode: adds mcp.fapony config to ~/.config/opencode/opencode.json or opencode.jsonc.
+// claude: shells out to `claude mcp add` (never parses/writes ~/.claude.json directly).
+// cursor: writes mcpServers.fapony to ~/.cursor/mcp.json directly and merges the
+//         fapony stop hook into the stop array in ~/.cursor/hooks.json.
+// zcode: reads/writes ~/.zcode/cli/config.json (fallback ~/.agents/mcp.json) directly,
+//        and symlinks skills into ~/.agents/skills.
+// codex: reads/writes ~/.codex/config.toml directly.
+// All platforms are idempotent + support --dry-run.
+// Claude/OpenCode also get skill/<name>/ symlinked into ~/.claude/skills so
+// `fapony update` reaches them without a second copy to keep in sync.
+// ZCode gets skill/<name>/ symlinked into ~/.agents/skills.
+
+import { createInterface } from "node:readline";
+import { cmdInstallClaude } from "./install/claude.js";
+import { cmdInstallCodex } from "./install/codex.js";
+import { cmdInstallCursor } from "./install/cursor.js";
+import { detectClients } from "./install/detect.js";
+import { cmdInstallOpencode } from "./install/opencode.js";
+import { defaultExit, type InstallDeps } from "./install/types.js";
+import { cmdInstallZcode } from "./install/zcode.js";
+import { ask } from "./setup.js";
+import { isAffirmative } from "./util.js";
+
+export {
+  claudeAddArgs,
+  claudeGetArgs,
+  claudeGetPointsToFapony,
+  cmdInstallClaude,
+} from "./install/claude.js";
+export { cmdInstallCodex } from "./install/codex.js";
+export { cmdInstallCursor } from "./install/cursor.js";
+export { detectClients } from "./install/detect.js";
+export { cmdInstallOpencode } from "./install/opencode.js";
+export {
+  agentsSkillsDir,
+  claudeSkillsDir,
+  linkSkills,
+} from "./install/skills.js";
+export {
+  type ClaudeRunResult,
+  INSTALL_ROOT,
+  type InstallDeps,
+} from "./install/types.js";
+export { cmdInstallZcode } from "./install/zcode.js";
+
+export async function cmdInstall(
+  args: string[],
+  deps: InstallDeps = {},
+): Promise<void> {
+  const platform = args.find((a) => !a.startsWith("--"));
+  const dryRun = args.includes("--dry-run");
+  const installAll = args.includes("--all");
+
+  // --- explicit platform: original behavior, unchanged ---
+  if (platform === "claude") {
+    cmdInstallClaude(dryRun, deps);
+    return;
+  }
+  if (platform === "cursor") {
+    cmdInstallCursor(dryRun, deps);
+    return;
+  }
+  if (platform === "zcode") {
+    cmdInstallZcode(dryRun, deps);
+    return;
+  }
+  if (platform === "codex") {
+    cmdInstallCodex(dryRun, deps);
+    return;
+  }
+  if (platform === "opencode") {
+    cmdInstallOpencode(dryRun, deps);
+    return;
+  }
+  if (platform !== undefined) {
+    console.error(
+      `usage: fapony install --platform opencode|claude|cursor|zcode|codex [--dry-run]`,
+    );
+    console.error(
+      `  supported platforms: opencode, claude, cursor, zcode, codex`,
+    );
+    (deps.exit ?? defaultExit)(1);
+    return;
+  }
+
+  // --- no platform: detect + prompt ---
+  const detected = detectClients(deps);
+  const found = detected.filter((d) => d.installed);
+  const notFound = detected.filter((d) => !d.installed);
+
+  const foundNames = found.map((d) => d.platform).join(", ");
+  const notFoundNames = notFound.map((d) => d.platform).join(", ");
+  console.error(
+    `  detected: ${foundNames || "(none)"}${notFoundNames ? `        not found: ${notFoundNames}` : ""}`,
+  );
+  console.error(
+    `  (not found = no config file yet — or, for claude, the CLI is not on PATH.`,
+  );
+  console.error(`   open the app once, or force with --platform <name>)`);
+
+  if (found.length === 0) {
+    console.error();
+    console.error(
+      `  no MCP client found (looked for claude on PATH; config files for cursor, opencode, zcode, codex).`,
+    );
+    console.error(
+      `  open the app once, then re-run — or force with: fapony install --platform <name>`,
+    );
+    return;
+  }
+
+  // --all: install everything detected without prompting (works in CI/non-TTY).
+  if (installAll) {
+    console.error();
+    for (const client of found) {
+      installPlatform(client.platform, dryRun, deps);
+    }
+    return;
+  }
+
+  // Non-TTY without --all: print results + hint, don't install anything.
+  if (!process.stdin.isTTY) {
+    console.error();
+    console.error(
+      `  stdin is not a terminal — re-run with --all, or --platform <name>`,
+    );
+    return;
+  }
+
+  // Build the ask function: injected (tests) or real readline (production).
+  // Mirrors cmdSetup's seam — one readline for the whole loop, closed after.
+  const rl = deps.ask
+    ? null
+    : createInterface({ input: process.stdin, output: process.stdout });
+  const askFn =
+    deps.ask ??
+    ((question: string, defaultVal?: string) => ask(rl!, question, defaultVal));
+
+  // Prompt each detected client.
+  try {
+    console.error();
+    for (const client of found) {
+      const answer = await askFn(`install into ${client.platform}?`, "Y");
+      if (isAffirmative(answer)) {
+        installPlatform(client.platform, dryRun, deps);
+      }
+    }
+  } finally {
+    rl?.close();
+  }
+}
+
+function installPlatform(
+  platform: string,
+  dryRun: boolean,
+  deps: InstallDeps,
+): void {
+  switch (platform) {
+    case "claude":
+      cmdInstallClaude(dryRun, deps);
+      break;
+    case "cursor":
+      cmdInstallCursor(dryRun, deps);
+      break;
+    case "opencode":
+      cmdInstallOpencode(dryRun, deps);
+      break;
+    case "zcode":
+      cmdInstallZcode(dryRun, deps);
+      break;
+    case "codex":
+      cmdInstallCodex(dryRun, deps);
+      break;
+  }
+}

package/src/lint-baseline.ts

@@ -0,0 +1,260 @@
+// src/lint-baseline.ts — `fapony lint-baseline`: separate "was red before" from "I made it red".
+//
+// warning กับ error ที่แดงอยู่ก่อนหน้า agent เข้ามา ทำให้ agent ต้อง `fix all` ก่อน
+// แล้วงานจริงถูกกลบใน diff ก้อนเดียว (SPEC-convention-debt §4 — จากปากเจ้าของ:
+// "138 จุดใน ~40 ไฟล์ที่ไม่เกี่ยวกับงาน") ตัวเลขของรีโปที่แดงอยู่แล้ว 212 จุด —
+// agent ที่ไม่ได้ทำอะไรผิดต้องเห็น **0**
+//
+// กลไก — ไม่รู้จัก eslint: รันคำสั่งที่รีโปบอก (--cmd หรือ evidence.json ชื่อ "lint"),
+// parse เป็นชุด `path:rule-id` (**ไม่ใช่เลขบรรทัด** — บรรทัดขยับทุกครั้งที่แก้ไฟล์),
+// เก็บ baseline ไว้ที่ base_sha · ผลลัพธ์ไม่เข้า state.db (2 ตารางห้ามเพิ่ม) —
+// เป็นไฟล์ชั่วคราวใต้ state dir และถูกทิ้งเมื่อ --diff รายงานแล้ว · รายงานอย่างเดียว
+// ไม่ block — agent ตัดสินเองว่าจะแก้ของเก่าด้วยไหม
+
+import { execSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join, relative } from "node:path";
+import { faponyDir } from "./db/load.js";
+import { assertSafe } from "./safety.js";
+
+const USAGE =
+  'usage: fapony lint-baseline --capture [--cmd "<lint command>"]\n' +
+  '       fapony lint-baseline --diff [--cmd "<lint command>"]\n' +
+  '       (without --cmd, uses the evidence.json command named "lint")';
+
+interface BaselineFile {
+  worktree: string;
+  baseSha: string;
+  ts: string;
+  pairs: string[];
+}
+
+function worktreeOf(cwd: string): string {
+  const p = Bun.spawnSync(["git", "rev-parse", "--show-toplevel"], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  if (p.exitCode !== 0) {
+    console.error("lint-baseline: not a git repository");
+    process.exit(1);
+  }
+  return p.stdout.toString().trim();
+}
+
+function gitSha(cwd: string): string {
+  const p = Bun.spawnSync(["git", "rev-parse", "HEAD"], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  return p.exitCode === 0 ? p.stdout.toString().trim().slice(0, 12) : "none";
+}
+
+function baselinePath(worktree: string): string {
+  const key = worktree.replace(/[^A-Za-z0-9._-]+/g, "_");
+  return join(faponyDir(), "lint-baseline", `${key}.json`);
+}
+
+function readEvidenceLintCmd(worktree: string): string | null {
+  const evidence = join(worktree, ".fapony", "evidence.json");
+  try {
+    const parsed = JSON.parse(readFileSync(evidence, "utf-8")) as {
+      commands?: { name?: string; cmd?: string }[];
+    };
+    const hit = (parsed.commands ?? []).find(
+      (c) => c.name === "lint" && typeof c.cmd === "string" && c.cmd.length > 0,
+    );
+    return hit?.cmd ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function runLint(cmd: string, worktree: string): string {
+  // --cmd / evidence.json is the repo's own declaration — same trust as
+  // `fapony report` running an allowlisted command; deny rules still apply.
+  assertSafe(cmd.split(/\s+/));
+  try {
+    return execSync(cmd, {
+      cwd: worktree,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 120_000,
+    });
+  } catch (e) {
+    const err = e as { stdout?: string; stderr?: string };
+    // linters exit non-zero when they find anything — stdout IS the result
+    const out = `${err.stdout ?? ""}\n${err.stderr ?? ""}`;
+    if (out.trim().length === 0) throw e;
+    return out;
+  }
+}
+
+// --- parsers: eslint JSON first, unix one-liner fallback ---
+
+interface Finding {
+  file: string;
+  rule: string;
+}
+
+function parseEslintJson(output: string, worktree: string): Finding[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(output);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  const out: Finding[] = [];
+  for (const f of parsed) {
+    const o = f as {
+      filePath?: string;
+      messages?: { ruleId?: string | null }[];
+    };
+    if (typeof o.filePath !== "string") continue;
+    const rel = relative(worktree, o.filePath);
+    for (const m of o.messages ?? []) {
+      out.push({
+        file: rel.startsWith("..") ? o.filePath : rel,
+        rule: m.ruleId ?? "syntax-error",
+      });
+    }
+  }
+  return out;
+}
+
+// `/abs/file.ts:12:5: message (rule-id)` or trailing ` rule-id` — eslint -f unix,
+// and close cousins (golangci-lint, shellcheck -f gcc, …)
+const UNIX_LINE_RE = /^(.+?):\d+:\d+:\s+.*?\(?([A-Za-z0-9_@][\w@/.-]*)\)?\s*$/;
+
+function parseUnixLines(output: string, worktree: string): Finding[] {
+  const out: Finding[] = [];
+  for (const line of output.split("\n")) {
+    if (!line.trim()) continue;
+    const m = UNIX_LINE_RE.exec(line.trim());
+    if (!m) continue;
+    const raw = m[1];
+    const abs = raw.startsWith("/") ? raw : join(worktree, raw);
+    const rel = relative(worktree, abs);
+    out.push({ file: rel.startsWith("..") ? raw : rel, rule: m[2] });
+  }
+  return out;
+}
+
+function parseFindings(
+  output: string,
+  worktree: string,
+): {
+  findings: Finding[];
+  format: string;
+} {
+  const asJson = parseEslintJson(output, worktree);
+  if (asJson.length > 0) return { findings: asJson, format: "eslint-json" };
+  const asLines = parseUnixLines(output, worktree);
+  if (asLines.length > 0) return { findings: asLines, format: "unix-lines" };
+  return { findings: [], format: output.trim() ? "unknown" : "empty" };
+}
+
+function capturePairs(
+  cmd: string,
+  worktree: string,
+): {
+  pairs: Set<string>;
+  format: string;
+} {
+  const output = runLint(cmd, worktree);
+  const { findings, format } = parseFindings(output, worktree);
+  if (format === "unknown") {
+    console.error(
+      "lint-baseline: could not parse the lint output.\n" +
+        "Supported: eslint `-f json` (default in most setups), or one-line\n" +
+        "`path:line:col: message (rule-id)` output (eslint -f unix).\n" +
+        'Try: --cmd "pnpm exec eslint . -f unix"',
+    );
+    process.exit(1);
+  }
+  return { pairs: new Set(findings.map((f) => `${f.file}:${f.rule}`)), format };
+}
+
+export function lintBaseline(args: string[], cwd: string): void {
+  const mode = args.find((a) => a === "--capture" || a === "--diff");
+  if (!mode || args.includes("-h") || args.includes("--help")) {
+    console.log(USAGE);
+    return;
+  }
+  const cmdIdx = args.indexOf("--cmd");
+  let cmd: string | undefined = cmdIdx >= 0 ? args[cmdIdx + 1] : undefined;
+  if (!cmd || cmd.startsWith("--")) cmd = undefined;
+  const worktree = worktreeOf(cwd);
+  if (!cmd) {
+    const fromEvidence = readEvidenceLintCmd(worktree);
+    if (fromEvidence) cmd = fromEvidence;
+  }
+  if (!cmd) {
+    console.error(
+      'lint-baseline: no lint command — pass --cmd "<lint command>" or add\n' +
+        '{ "name": "lint", "cmd": "..." } to .fapony/evidence.json',
+    );
+    process.exit(1);
+  }
+  console.log(`lint command: ${cmd} (worktree ${worktree})`);
+
+  if (mode === "--capture") {
+    const { pairs, format } = capturePairs(cmd, worktree);
+    const file = baselinePath(worktree);
+    mkdirSync(join(file, ".."), { recursive: true });
+    const payload: BaselineFile = {
+      worktree,
+      baseSha: gitSha(worktree),
+      ts: new Date().toISOString(),
+      pairs: [...pairs].sort(),
+    };
+    writeFileSync(file, `${JSON.stringify(payload, null, 2)}\n`);
+    console.log(
+      `captured ${pairs.size} finding(s) (${format}) at ${payload.baseSha} — baseline stored, not in state.db`,
+    );
+    return;
+  }
+
+  // --diff
+  const file = baselinePath(worktree);
+  let baseline: BaselineFile;
+  try {
+    baseline = JSON.parse(readFileSync(file, "utf-8")) as BaselineFile;
+  } catch {
+    console.error(
+      "lint-baseline: no baseline captured — run `fapony lint-baseline --capture` first",
+    );
+    process.exit(1);
+  }
+  const { pairs, format } = capturePairs(cmd, worktree);
+  const mine = [...pairs].filter((p) => !baseline.pairs.includes(p)).sort();
+  const fixed = baseline.pairs.filter((p) => !pairs.has(p)).length;
+  console.log(
+    `baseline ${baseline.pairs.length} finding(s) at ${baseline.baseSha} · now ${pairs.size} (${format})`,
+  );
+  if (mine.length === 0) {
+    console.log("new findings introduced by this work: 0 — clean");
+  } else {
+    console.log(`new findings introduced by this work: ${mine.length}`);
+    for (const p of mine.slice(0, 40)) console.log(`  ${p}`);
+    if (mine.length > 40) console.log(`  … +${mine.length - 40} more`);
+  }
+  if (fixed > 0) {
+    console.log(`(also fixed ${fixed} pre-existing finding(s) — thank you)`);
+  }
+  // temporary by design (SPEC §4) — the baseline has served its run
+  rmSync(file, { force: true });
+  console.log("baseline discarded — capture again for the next unit of work");
+}
+
+export function cmdLintBaseline(args: string[]): void {
+  lintBaseline(args, process.cwd());
+}