Use exact-pinned esbuild so the committed bundle is reproducible across CI runners, generate and ship complete dependency licenses, keep the bundle under a size ceiling, and route degraded scans through the shared operational-failure exit handling.
AI assistance: Codex audited PR #693 and implemented this hardening.
Greptile caught that editing the bundle entry did not refresh the committed vendor file, and neither build nor the detector suite would notice. --check compares a fresh rebuild, bun run build runs that check, and the detector suite now triggers on the entry.
AI-assisted.
Co-authored-by: Cursor <cursoragent@cursor.com>
Skill and plugin copies of the detector had no htmlparser2/css-select/css-tree/domutils, so HTML scans silently fell back to regex and exited 0. Bundle those parsers into the engine tree and exit 1 if the fallback still fires.
AI assistance: Cursor Grok 4.6 implemented this change.
Co-authored-by: Cursor <cursoragent@cursor.com>
Since the jsdom removal the static HTML/CSS analysis is fast (~4ms/file) and
covers every rule, so the regex-only `--fast` path only loses coverage (it
ran ~10 of 41 rules) for no real speed win. It's a foot-gun: a `--fast` scan
can read "clean" because most rules silently don't run.
Deprecate gracefully rather than hard-remove: the flag is still accepted (so
existing CI scripts don't break) but ignored, with a one-line stderr notice,
and the full scan always runs. Dropped from --help and the example. Removed
the `--fast` suggestion from the many-files warning and from critique.md's
scan guidance.
Ships to users via a CLI release (npm) and rides the next skill release in
the bundled detector. Tests updated to assert the deprecation behavior.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Paul Bakaus
