Declare UTF-8 on the generated live and detector JavaScript responses and cover both endpoints with integration assertions.\n\nAI-assisted: prepared with Codex under @pbakaus direction.
Update the public init description and migrate the repository product record to the current stamped schema without changing its established product truths.\n\nAI-assisted: prepared with Codex under @pbakaus direction.
Resolve the CLI entry path through realpath and cover linked skill directories on Unix and Windows junctions.
AI-assisted change: implemented with Codex under @pbakaus direction.
Preserve critique trend history while closing the exact processed snapshot. Track target identity and content freshness for local files and URLs, isolate colliding streams, and prevent legacy snapshots from resurfacing after a modern close.
Validated with 50 focused tests, a clean 17-provider build, 834 core tests, passing GitHub CI and Cursor Bugbot, Greptile 5/5, and zero unresolved review threads.
AI-assisted maintainer repair: implemented and reviewed with Codex under @pbakaus direction.
Makes plugin instructions execute the installed plugin copy, safely quotes paths containing spaces, removes the broad Node pre-approval, and ships guarded generated plugin output.\n\nAI-assisted maintainer conflict resolution, review, and validation by Codex under maintainer direction.
Resolves the embed helper with a filesystem path, reports fallback accurately, and adds regression coverage while leaving generated harness output to the post-merge sync.\n\nAI-assisted maintainer repair, review, and validation by Codex under maintainer direction.
Centralize raster prompt lookup and PNG chunk parsing while preserving read, scan, replacement, and sidecar behavior.
AI-assisted merge: reviewed and executed by Codex under explicit interactive maintainer direction.
Correct the article before award-winning in the source skill introduction. Generated provider copies will refresh through the post-merge sync.
AI-assisted merge: reviewed and executed by Codex under maintainer direction.
Treat the leading system face as primary so later Roboto fallbacks do not trigger overused-font, while named web-font primaries still flag.
AI-assisted merge: reviewed and executed by Codex under maintainer direction.
Store direction contracts in development-only surface briefs and guard against browser-delivered leakage with regression coverage.
AI-assisted merge: reviewed and executed by Codex under maintainer direction.
Make policy and merge-conflict blockers age as contributor work, keep maintainer-policy decisions out of ready state, auto-close regular contributors unless explicitly exempted, and mark new or reopened issues for triage.
AI-assisted change: implemented and validated by Codex under maintainer direction.
Documents the existing Hermes Agent provider, including profile-aware global installation and project trust behavior. Contributed by the Hermes Agent maintainer.\n\nAI-assisted change: repaired, validated, and merged by Codex under maintainer direction.
Update marked, the coordinated provider packages, Anthropic SDKs, and Puppeteer. Keep ai at the known-good 7.0.69 until provider-backed behavior validation can confirm the post-7.0.70 tool-loop path.
AI-assisted dependency maintenance performed by Codex.
The generated browser bundle is rebuilt from the merged engine sources in the next commit's build step (both branches had regenerated it).
AI-assisted (Claude Code).
Closes the residual page-inference edge (no recorded artifact, no index.html, several root HTML files) by making the conservative refusal self-correcting instead of adding more inference; the gate never falsely passes in that configuration, only asks for the page.
AI-assisted (Claude Code).
Greptile's fourth finding on the seam: the no-artifact path was depth-limited. The page default (index.html, or the one .html at the root) now applies before unreferencedPlates, so the link-following path, which is exact and unbounded, handles every build that has a page; the bounded walk is only the no-page fallback.
AI-assisted (Claude Code).
Bugbot on #599: path.resolve treated /assets/hero.css as filesystem-absolute. Both the working directory and the artifact's directory are tried; unreadable candidates skip.
AI-assisted (Claude Code).
Greptile's third P1 on the same seam: a stylesheet linked from the artifact but outside the bounded walk's root, depth, or file limit was still invisible. The hrefs the artifact itself declares are resolved against its directory and joined to the corpus, which closes every variant.
AI-assisted (Claude Code).
Greptile's follow-up P1 on #599: with --artifact set, only that HTML file was read, so a plate referenced exclusively from a linked stylesheet still read as unused. The bounded source walk now runs either way.
AI-assisted (Claude Code).
Greptile P1 on #599: unreferencedPlates read a plate referenced only from assets/hero.css as unused and the hero gate refused a valid build. The extension filter already keeps binaries out of the walk.
AI-assisted (Claude Code).
- keyChroma re-encodes with the PNG's tEXt chunks intact (the embedded prompt survived generation but not keying)
- organic-clip-path counts relative curve commands too (path data letters are only commands, so the match is case-insensitive)
- buried-raster normalizes percentage alphas (parseFloat('80%') read as 80) and reads 4- and 8-digit hex alpha instead of treating #rrggbbaa as opaque
- the extension-injected-node skip in checkQuality runs before any finding is pushed (a low-opacity injected raster was recorded, then returned by the skip)
- fake-mode plates carry impeccable:fake tEXt and the plates gate's crop-identity refusal skips them (fake mode IS the crop by design; the refusal is for models shipping the comp's pixels as artwork)
Findings by cursor[bot] and Copilot on PR #599; detector engines rebuilt (build:browser, build:extension).
AI-assisted (Claude Code).
CI resolves playwright but has no downloaded chromium; launch threw instead of falling back to the catalog ranking, and every spec gate downstream failed. Launch failures now return the no-browser path (and the browser test skips instead of asserting).
AI-assisted (Claude Code).
Paul's decision on the tenth sweep's design question: hard vetoes (missing region, contradicted plate or text, SVG illustration, clipped plate, invented ink) stay unconditional; at overall >= HERO_MIN the numeric readings (ink colour, letter-spacing, line pitch, strip heights, box positions) print as advisories with the pass and belong to the polish pass. Every sweep-10 sample closes its hero under this condition, which settles 07 without another paid round.
Ninth-sweep defects: codeDrawn / container / bleed now persist into spec.json with WARN lines (an overridden refusal used to vanish from the record); font-match probes os.tmpdir() and points TMPDIR at .impeccable/tmp when the sandbox /tmp is unwritable (every ninth-sweep rank silently fell back to the catalog).
AI-assisted (Claude Code).
Bugbot on PR #665: the skipScan guard emptied only the analytic
collectBrowserFindings pass, and scan()'s detached visual-contrast
stage then repopulated an ignoreFiles-waived page with contrast
markers and a second non-zero results post. Hoist the guard into
skipScanActive() and honor it in scan() and the async collector;
regenerate the browser bundle.
Adds a browser-backed regression test that reproduces the leak
(second results post carrying low-contrast findings) and pins the
zero contract; drops a tautological assert flagged in review.
AI-assisted change: implemented with Claude Code under maintainer
direction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
serve-question answered POST /build-path with 200 and only then wrote the
flip file. The caller is a separate process, so the response could reach it
while the server was still preempted before the write landed: a poller that
trusted the 200 could look for the flip file and miss it.
Measured on a loaded machine, the old order lost that race 29 times out of
40; writing first and answering after loses it 0 times out of 40. This is
what made tests/serve-question.test.mjs fail intermittently in CI on the
Node 22 job while passing on Node 24.
AI-assisted change: diagnosed and implemented with Claude Code under
maintainer direction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Read waiver config from every live root (appRoot, contextRoot, repoRoot),
so monorepo projects whose config lives at the repo root reach the
overlay; serialize served roots and page identities repo-relative there.
Resolve each page URL to its actual serving file via the inject config's
resolved page list before applying file-scoped waivers; ambiguous URLs
keep the conservative common-ancestor fallback (PR #645 review
discussion r3840011436).
Honour detector.ignoreFiles: a wholly waived page now scans to zero
findings in the overlay, matching the CLI and the edit hook.
Guard the resolver call so a throwing resolver degrades to an unfiltered
scan instead of breaking the detect toggle.
Match design-system-color waivers by color value across hex and rgb()
spellings, and stop extracting font values for bounce-easing findings,
mirroring extractFindingIgnoreValue. Regenerate the browser bundle.
AI-assisted change: reviewed, planned, and implemented with Claude Code
under maintainer direction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- The per-project state dir key is now the readable separator-mapped
slug plus an 8-hex sha256 of the resolved project path. The readable
part alone is lossy (/x/my.app and /x/my-app both mapped to -x-my-app
and shared hook state); the digest keeps distinct projects' cache and
pending state apart while the dir name stays human-scannable.
- Tilde roots now expand via os.homedir() instead of HOME/USERPROFILE
with a '.' fallback. When no home dir can be determined, expansion is
rejected and state falls back to the project-local default rather
than anchoring under the hook process's working directory.
- Tests updated to the digest-suffixed slug via a mirrored slugFor()
helper, plus two new cases: colliding readable slugs get distinct
state dirs, and the tilde form resolves identically to the explicit
homedir-joined form.
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Env files and settings JSON hand '~/caches' to Node unexpanded; without
this it would resolve to a literal '~' directory under the process cwd.
Mirrors the exact treatment IMPECCABLE_HOOK_LOG already gets in
writeAuditLog (HOME || USERPROFILE fallback), plus the Windows '~\'
spelling.
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- hookStateDir now trims the env value (stray whitespace in env files)
and path.resolve()s both the root and the cwd, so trailing separators
and relative segments slug to the same per-project dir.
- The #344/#305 persist gate also treats an existing (possibly
redirected) cache file as the opted-in marker. Without this, once
state relocated, clean-edit editCount bumps stopped persisting because
the project-local .impeccable/ dir never appears. No-op under stock
paths, where the cache file lives inside .impeccable/.
- New tests: slug normalization equivalences, whitespace trim, graceful
persistCache failure on an unusable root, and three runHook
end-to-end cases (findings persist + dedup through the redirect,
clean-edit editCount persistence, and the no-footprint no-op gate
holding under redirect).
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paul BakausandGitHub
github-actions[bot]
Abdul WahabandGitHub
oleg kovalandGitHub
jesusdizvalls-cellandGitHub
MorganandGitHub
TekniumandGitHub
dependabot[bot]andGitHub
Paul BakausandGitHub
