Read waiver config from every live root (appRoot, contextRoot, repoRoot),
so monorepo projects whose config lives at the repo root reach the
overlay; serialize served roots and page identities repo-relative there.
Resolve each page URL to its actual serving file via the inject config's
resolved page list before applying file-scoped waivers; ambiguous URLs
keep the conservative common-ancestor fallback (PR #645 review
discussion r3840011436).
Honour detector.ignoreFiles: a wholly waived page now scans to zero
findings in the overlay, matching the CLI and the edit hook.
Guard the resolver call so a throwing resolver degrades to an unfiltered
scan instead of breaking the detect toggle.
Match design-system-color waivers by color value across hex and rgb()
spellings, and stop extracting font values for bounce-easing findings,
mirroring extractFindingIgnoreValue. Regenerate the browser bundle.
AI-assisted change: reviewed, planned, and implemented with Claude Code
under maintainer direction.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- The per-project state dir key is now the readable separator-mapped
slug plus an 8-hex sha256 of the resolved project path. The readable
part alone is lossy (/x/my.app and /x/my-app both mapped to -x-my-app
and shared hook state); the digest keeps distinct projects' cache and
pending state apart while the dir name stays human-scannable.
- Tilde roots now expand via os.homedir() instead of HOME/USERPROFILE
with a '.' fallback. When no home dir can be determined, expansion is
rejected and state falls back to the project-local default rather
than anchoring under the hook process's working directory.
- Tests updated to the digest-suffixed slug via a mirrored slugFor()
helper, plus two new cases: colliding readable slugs get distinct
state dirs, and the tilde form resolves identically to the explicit
homedir-joined form.
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Env files and settings JSON hand '~/caches' to Node unexpanded; without
this it would resolve to a literal '~' directory under the process cwd.
Mirrors the exact treatment IMPECCABLE_HOOK_LOG already gets in
writeAuditLog (HOME || USERPROFILE fallback), plus the Windows '~\'
spelling.
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- hookStateDir now trims the env value (stray whitespace in env files)
and path.resolve()s both the root and the cwd, so trailing separators
and relative segments slug to the same per-project dir.
- The #344/#305 persist gate also treats an existing (possibly
redirected) cache file as the opted-in marker. Without this, once
state relocated, clean-edit editCount bumps stopped persisting because
the project-local .impeccable/ dir never appears. No-op under stock
paths, where the cache file lives inside .impeccable/.
- New tests: slug normalization equivalences, whitespace trim, graceful
persistCache failure on an unusable root, and three runHook
end-to-end cases (findings persist + dedup through the redirect,
clean-edit editCount persistence, and the no-footprint no-op gate
holding under redirect).
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Honor an optional IMPECCABLE_CACHE_ROOT env var in getCachePath() /
getPendingPath(): when set, hook.cache.json and hook.pending.json land
under $IMPECCABLE_CACHE_ROOT/<project-slug>/ (slug = project path with
[:\/.] mapped to hyphens, mirroring Claude Code's ~/.claude/projects/
convention). Unset or blank env keeps stock project-local behavior.
User-authored config (config.json, config.local.json, design.json)
deliberately stays project-local - only disposable state relocates.
Also clears ambient IMPECCABLE_CACHE_ROOT at the top of hook.test.mjs so
a developer running the suite with the redirect active still gets
deterministic stock-path assertions; the new suite sets and restores the
var explicitly.
Prepared with AI assistance (Claude Code) under direction of
0xDarkMatter, per the maintainer-approved issue #422.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Collapse the nightly alternate plan into the shared event routing while preserving every GitHub output and schedule behavior. Strengthen the nightly characterization for all deterministic suites.\n\nAI assistance: prepared by OpenAI Codex under maintainer pbakaus's standing scheduled-refactor authorization.
Cursor's review caught the previous commit over-correcting. One tree listed
at two depths (prototype/*.html plus prototype/library/**/*.html) derived
two roots, and requiring a waiver to match under both stopped a normal
project-relative waiver like prototype/index.html from applying anywhere.
The rule both reviews were circling is simpler: one live session is served
by one server, so a single document root must sit at or above every
configured page. The only prefix the resolver can safely assert is the
deepest common ancestor of the glob roots. Nested roots collapse to their
shared tree, so normal waivers keep applying. Disjoint roots (src/ and
public/) share nothing, so no prefix is asserted and only the URL path
itself matches, which keeps the earlier fix intact: a src/foo.html waiver
still cannot hide a finding on a page served from public/foo.html.
This also deletes the match-under-every-root machinery from the previous
commit; with a single asserted prefix, plain matching is enough.
Also switches the new test file to derive the repo root from
import.meta.url rather than process.cwd(), per review.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Greptile's review found a real bug in the new resolver. When the live config
lists pages under more than one folder (src/**/*.html and public/**/*.html),
the overlay treated a URL like /foo.html as src/foo.html and public/foo.html
at the same time. A waiver written only for src/foo.html could then hide a
finding on the page actually served from public/foo.html. That fails in the
worst direction: a real finding disappears and nothing says so.
The overlay can never look up the right file. The live server does not serve
the pages; the project's own dev or static server does, and its URL-to-file
mapping is invisible from here. So the fix stops guessing: a file-scoped
waiver now applies only when it matches the URL path itself, which is true
whichever folder serves the page, or when it matches under every configured
folder, so no possible reading disagrees. Anything ambiguous shows the
finding, which is also what the CLI reports for the file really being served.
With a single configured root, the common case, nothing changes: the new
rule reduces to the old behaviour exactly. Multi-root projects keep three
ways to write a waiver that still applies: name the file under each folder,
use the bare path, or use **/.
Two new unit tests pin the ambiguous case and the safe spellings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The live overlay's detect scan ran unfiltered: requestDetectScan() posted
only { scanId }, so detector.ignoreRules and detector.ignoreValues in
.impeccable/config.json reached impeccable detect and the edit hook but
never the surface a designer actually watches.
The server now serializes the project's detector waivers into the /live.js
prelude (window.__IMPECCABLE_PROJECT_IGNORES__), read per request through
hook-lib's readConfig so config.local.json wins and edits land on the next
tab reload. A new script part, live-browser-ignores.js, resolves that
config against the page URL when a scan starts: ignoreRules suppress
outright, wildcard ignoreValues suppress their rule in the files their
globs name, and the remaining entries ride along as disabledValues for the
detector to match on each finding's own value. The detector bundle applies
those where the findings are assembled, since the overlay draws its own
markers from the collected findings.
Scope resolution mirrors cli/lib/impeccable-config.mjs deliberately: the
same glob dialect (globToRegex, including {a,b} alternation), the same
path-suffix matching as findingMatchesScopedIgnoreFile, and the same
refusal to apply an unscoped wildcard entry. The served-root prefixes that
bridge project-relative globs and site-relative URLs come from the inject
config's own files globs, never from the ignore globs; deriving them from
the ignore globs lets one entry scoped to prototype/library/** lend its
prefix to every page and suppress site-wide, which looks like success
because the numbers go down.
Known gaps, recorded in the detector comment: the motion value extractor
is not mirrored, so a value-scoped bounce-easing waiver only matches when
the finding carries ignoreValue directly, and design-system-color matches
on the normalized string without the CLI's color-equality fallback.
Tests: unit tests for the resolver part (stale globals, string ignoreRules,
malformed entries, directory URLs, percent-escapes, glob metacharacters,
the roots trap), an extension-mode puppeteer test that disabledValues
suppress exactly the waived findings, and the live-browser regression pin
now asserts the new scan config shape instead of { scanId }.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Main's #469 tests POSTed /heartbeat and /answer without ?key=, which the
gate now rejects, so those daemons looked dead. The e2e heartbeat counter
also has to match pathname rather than a suffix, now that the URL carries
the key.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
Bugbot caught that the exact-match allowlists 403 every request on --port 80
because browsers drop the default-port suffix; other ports stay strict.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
An unauthenticated POST /build-path wrote the flip event that makes --wait
instruct the agent to generate comps: same class as the /answer hole in #555.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthenticated POST /answer copied steer into the agent ANSWER line. The handler now requires the detached session key and rejects foreign Origin and Host.
Written with AI assistance under maintainer direction.
Co-authored-by: Cursor <cursoragent@cursor.com>
page.authenticate is page-wide, so a cross-origin redirect that then 401s would receive the original credentials. Attach Authorization only to requests for the scan origin.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
Strip basic-auth credentials from scan-target URLs before goto and finding output, and pass them to page.authenticate instead.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
ignore-value stored exact values for rules that cannot extract one, so the entries never matched. Refuse them and point at "*" --file.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dot-segment hrefs like /../outside.css could leave the project, and a process-wide warning set hid missing-sheet notices on later detectHtml calls.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
Root-relative hrefs like /static/app.css were treated as OS-absolute and silently dropped, hiding contrast findings.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
packages/* now includes nested package.json dirs under a matched
workspace package, and Impeccable projectRoots govern a path even when
package-manager workspaces exclude it.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
process.exit after a queued write truncated boot output on a backpressured pipe. Await the write callback, then close the fetch dispatcher.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
findDesignRoot continued past every workspace package.json to any
workspace-declaring ancestor. It now matches the boundary against that
ancestor's globs (including negations and globstars), so excluded and
stray packages do not inherit, while included workspaces still do.
Written with AI assistance (Cursor); reviewed by maintainer.
Co-authored-by: Cursor <cursoragent@cursor.com>
On Windows/Node 24, a live undici keep-alive from the update-check fetch aborted libuv during teardown after valid stdout. Destroy the dispatcher first, matching concept-seed.
AI assistance: implemented with Cursor Grok 4.6.
Co-authored-by: Cursor <cursoragent@cursor.com>
Update the grouped Bun dependencies while holding ai at 7.0.69 to avoid the automatic tool-execution behavior regression introduced in 7.0.70.
Prepared and validated with AI assistance.
Point installer readers to the harness-specific approval and verification steps on impeccable.style.\n\nAI-assisted: Codex prepared and verified this documentation update under direct maintainer instruction.
Keep Codex as its own Stop harness (decision/block) while taking main's Grok envelope detection and Stop cache sync.
Co-authored-by: Cursor <cursoragent@cursor.com>
The hook_event_name mapping (and its pre_tool_use entry) had no reader:
hook.mjs routes on the raw stdin via isStopEvent, and nothing downstream
keys on the normalized event name. The trailing-slash strip duplicated
the path.resolve every consumer already does. Pin the one commit-2
behavior that had no test: a Stop detector failure must leave the
remembered set alone.
Prepared with AI assistance.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A clean Stop never replaced remembered keys, so a finding that was fixed and then reintroduced stayed silent. Remember the live scan, including empty, and persist that write.
Prepared with AI assistance.
Co-authored-by: Cursor <cursoragent@cursor.com>
github-actions[bot]
Paul BakausandAbdul Wahab
dependabot[bot]andGitHub