Both review bots found real gaps in the first pass: candidates were
verified as local branch names only, so an origin/HEAD target with no
local checkout fell through, and stripOrigin() dropped upstreams on any
remote not named origin (fork workflows tracking upstream/release).
Candidates now carry a display name plus the revs to try in order: the
upstream's remote rev wins outright (it tracks the actual merge target,
so it beats a possibly stale local branch of the same name), origin/HEAD
tries the local branch then the remote-tracking ref, and the
conventional names each try local then origin/<name>. git.base keeps
reporting the friendly branch name while the diff runs against whichever
rev resolved. Two new failing-first tests: remote-only default branch,
and an upstream on a remote named upstream with no local base branch.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
context-signals hardcoded ['main', 'master'] as diff-base candidates, so
repos integrating through develop (or any other branch) diffed against
the wrong base: git.changedFiles carried the entire divergence and
downstream commands scanned the wrong set (issue #302).
The base is now detected, most specific signal first: the branch's
configured upstream (@{u}; a branch pushed with -u tracks itself and is
skipped by the self-check), then the remote's default-branch symref
(origin/HEAD), then the conventional integration names including
develop. The conventional fallbacks are withheld when the current branch
is itself one of them, so sitting on main in a repo that also has
develop keeps the working-tree scope instead of diffing two integration
branches against each other.
Five tests (three failing-first): develop-based feature branch,
origin/HEAD detection with a non-standard default name, upstream
tracking, on-the-integration-branch fallback, and the
integration-vs-integration guard.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
compileProviderBlocks only processes standalone-line blocks, so the
inline codex spans leaked literal tags into every provider's agent
output, degraded fallbacks included.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Harnesses with no subagent capability now run each role inline from the
same single source. The build emits reference/degraded/<role>.md for every
agent in skill/agents/ (role name is the agent name minus the impeccable-
prefix), stripping frontmatter and prepending the inline-substitution
preamble. These pass through the same provider-block compilation and
placeholder replacement as ordinary reference files, so <codex> blocks and
{{placeholders}} resolve per target, and they land in the committed harness
dirs on build:release like every reference file.
Repoint the three capability-first fallback sites in the prose at the
generated files: new-work.md reviewer and documenter fallbacks, and
visualize.md asset-producer fallback.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Probe attribution on Opus 5 showed the screenshot bound working (42
to 16) while the real burner ran free: five rounds of node -e
micro-edits, eight rebuilds, and inline defect hunts absorbed the
reviewer's and documenter's jobs until the turn cap killed the run
mid-hunt. The two-round ceiling now names scans, micro-edits, and
rebuilds; after the second round the build thread stops polishing and
ships the rest through the reviewer (one batched fix pass, one
rebuild, stop) and the documenter.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both review bots caught real hazards in the migration: a symlinked
~/.opencode/skills (shared skill storage) would have its target emptied
through the link, and in a home-rooted repo that path is a live
project-scope install, not a stranded pre-#406 global copy. The
migration now requires a real directory (lstat), compares the
just-written dir by realpath instead of string, and skips entirely when
the home dir is itself a repo. Two regression tests cover the symlink
and dotfiles-repo shapes.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
npx impeccable install --providers=opencode --scope=global wrote to
~/.opencode/skills, but OpenCode discovers global skills from its config
directory: $OPENCODE_CONFIG_DIR/skills, else $XDG_CONFIG_HOME/opencode/
skills, else ~/.config/opencode/skills. The install succeeded and
`opencode debug skill` never listed it (issue #406, diagnosed by
@dergachoff).
HOME_SKILLS_DIR_OVERRIDES entries become functions of the home dir (the
Pi override from #327 was the only entry and is unchanged in behavior),
with OpenCode resolving through the env chain above. Detection gains a
resolver-based GLOBAL_HARNESS_HINTS entry so a machine with only
~/.config/opencode (no legacy ~/.opencode) still routes global installs
to OpenCode. After a global install, the skills just written are removed
from the stranded ~/.opencode/skills location; sibling skills and the
rest of ~/.opencode stay untouched, and the empty skills dir is pruned.
Four new CLI tests (failing-first): default config-dir install,
OPENCODE_CONFIG_DIR and XDG_CONFIG_HOME precedence, legacy-copy
migration with sibling preservation, and config-dir-only detection.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Copilot's review point stands: reference files load per-command, so a
bare "see optimize.md" / "typeset.md" is not meaningful in the routed
context. The guidance reads self-contained now.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Review bots caught two real gaps in the pseudo-stripe wiring: findings
had no source line (so line-scoped impeccable-disable directives could
not match them), and the scanner read commented-out CSS as live rules.
scanCssTextForPseudoStripe now blanks comment bodies byte-for-byte
(preserving offsets) and returns each rule's selector offset; the three
regex-engine call sites convert that to a real line, including the
whole-file line for component style blocks and CSS-in-JS templates. The
HTML path ignores the new field. Tests now assert every finding's line
against the selector's actual position and cover a commented-out stripe.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
From issue #395, the items still present after the v4 consolidation:
- optimize.md led its interactivity section with FID, retired as a Core
Web Vital in March 2024 when INP replaced it. The section heading and
both metric lists now name INP.
- optimize.md recommended react-virtualized, superseded by react-window
from the same author; the line now points at react-window and TanStack
Virtual, matching overdrive.md.
- overdrive.md's WebGPU support matrix predated Firefox 141/147 shipping
it on Windows/macOS and Safari 26 shipping it across Apple platforms.
- audit.md listed "missing will-change" as a defect while animate.md and
optimize.md both instruct applying it sparingly and never preemptively;
the audit line now flags overuse instead of absence.
- harden.md allowed 14px mobile body text while typeset.md sets a 16px
ordinary floor; harden now matches the floor, reserving 14px for
secondary text, and names the iOS Safari input-zoom consequence.
The issue's other items (Framer Motion naming, Popmotion, polish
duration cap, humor guidance, HSL phrasing in quieter) were already
resolved by the v4 reference rewrite.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Cursor Bugbot correctly noted classic VuePress keeps theme layouts,
components, and styles under .vuepress/, which the walker scanned before
the hidden-dir rule. Same treatment as .vitepress and .storybook.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The side-tab silhouette drawn as an absolutely-positioned ::before/
::after bar carries no border token, so the regex engine's line matchers
never saw it in .css/.scss files, component style blocks, or CSS-in-JS
templates — while the identical construction on a full HTML page was
flagged via checkHtmlPatterns (issue #394). Wire the existing
scanCssTextForPseudoStripe scanner into all three regex-engine paths.
New fixtures (pseudo-stripe.css, pseudo-stripe.vue) pin four flag shapes
(inset shorthand, longhand pins, bottom edge, height:100%) and six pass
shapes (neutral divider, wide panel, static, hairline, hover-conditional
underline, non-full-height badge), attributed per case via data-case
selectors in the finding snippet.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Greptile's review correctly flagged a regression in the blanket
hidden-dir skip: .vitepress/theme/*.vue and .storybook/ preview files are
real UI source that the walker scanned before this branch. Both the
walker and the scan-target filter now carry a two-entry allowlist
(HIDDEN_SOURCE_DIRS) for those conventional locations; every other
hidden dir keeps being skipped.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Review bots (Greptile, Copilot) correctly noted the aggregate count
assertion could pass if one FLAG case stopped emitting while a PASS case
started. Each flag case now carries a distinct width/radius combination
and the test deep-equals the sorted snippet list, so every finding
attributes to exactly one case.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The documented abort flow in reference/live.md (live-poll.mjs --reply <id>
error "...") reset the browser bar to PICKING but left the localStorage
checkpoint written for the GENERATING phase in place. Every reload then
resurrected a dead session the server no longer knew about, and the page
stayed wedged until the user hand-cleared the impeccable-live* keys in
the console (issue #362, diagnosed by @yourcodekitten).
An agent error reply is terminal for the session it names: when the id
matches the current session, run the same markSessionHandled + cleanup
teardown as 'discarded' (cleanup includes clearSession); when it matches
a stored-but-not-current checkpoint (the error raced a reload), drop that
checkpoint too. Errors that name no session keep the existing UI-only
reset, and the accept-cleanup and steer branches are untouched.
Regression guard added to tests/live-browser-regression.test.mjs.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
When impeccable (or any agent tool) is installed into a project's
.claude/.cursor/.codex tree, a root scan descended into the vendored skill
code and reported the detector's own example strings as findings, and
context-signals returned installed-skill files as scan candidates whenever
the harness tree appeared in the branch diff (issue #303).
Rather than growing SKIP_DIRS by a denylist of harness names that drifts
as new tools appear, the walker now skips every hidden directory during
recursion — which already covered .git/.next/.nuxt/.svelte-kit/.turbo/
.vercel, and covers all present and future harness installs plus
.impeccable itself. SKIP_DIRS shrinks to the four non-hidden entries.
An explicitly passed hidden target still scans: only child entries are
name-checked, never the root the walker is given.
scanTargets() applies the same rule to git-changed files (directory
segments only, so root dotfiles keep their existing behavior), and falls
through to source-dir targeting when the only dirty files are vendored.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The static-html engine never emitted side-tab for `border-left: 4px solid
purple` (or any named color outside a hardcoded 9-name list) in .html
files: extractStaticColor's regex dropped the color token from border
shorthands, the side defaulted to neutral black, and checkBorders skipped
it. The same declaration in a .css file was flagged by the regex engine,
so the two engines disagreed while both exited cleanly (issue #359).
Build the extraction alternation from the same CSS_NAMED_COLORS table
parseAnyColor resolves against (longest-first, whole-token), so the set of
names the extractor recognizes and the set the parser can resolve cannot
drift apart again. STATIC_NAMED_COLORS shrinks to the one keyword
parseAnyColor deliberately refuses (`transparent` as zero-alpha), since
parseAnyColor already covers every real named color in the table.
New two-column fixture (named-color-borders.html) covers the issue
reproducers: purple shorthand + radius, rebeccapurple (substring-safe
matching), crimson top stripe, bare 3px teal, var() resolving to a named
color, and an inline style attribute — with neutral named colors
(dimgray, gainsboro, black), thin, and uniform borders as pass cases.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Opus 5 turned the iterate-with-screenshots-until-it-meets-the-bar
instruction into 42 screenshot trips and 150 tool calls per build,
about forty dollars of cache churn a page, before ever reaching the
reviewer. Verification now batches: one desktop-and-mobile round after
the full build, fixes applied together, one confirming round, ceiling
two. Craft-floor's checks share those renders instead of earning
separate trips; per-tweak iteration is live mode's channel.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The "Codex project hooks reference hook.mjs in the .codex skill payload"
test asserted dist/codex/.codex/skills/impeccable/{SKILL.md,hook.mjs}
exist. dist/ is gitignored, and CI's test:core step runs before the
Build step, so the fresh checkout has no dist/ when the assertion runs.
It only passed locally against a stale dist/. This turned every
sync-generated-output push on main red.
The dist/codex bundle's self-consistency is already covered by
build.test.js, which runs an actual build into a temp dir and verifies
the codex payload lands at .codex/skills/. Drop the two dist assertions;
the test keeps verifying the tracked outputs (the .codex/hooks.json path
and the .agents/skills payload) that exist at test:core time.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Flags the decorative low-opacity chromatic radial-gradient "spotlight"
washed behind a hero or section and fading to transparent, an AI-slop
reflex the saturated radial-halo gate lets slip (e.g. rgba(80,111,255,
0.26) -> transparent on a mobile hero).
Gates: a non-repeating radial-gradient whose last stop is transparent,
whose visible stops are all low-opacity (alpha < 0.45) with at most two
of them, at least one chromatic (channel spread >= 24 exempts neutral
vignettes), on a decorative-scale surface (width >= 240, height >= 160,
exempting badges/avatars/small lights). The alpha band is disjoint from
radial-halo (>= 0.7), so the two never double-report.
Wired into both element loops (static-html + injected browser) with the
pure checkRadialSpotlight shared by both adapters. TDD fixture with 5
flag / 9 pass shapes. Browser-path sweep over the eval corpus: 29 hits
on 11 pages, 0 false positives. Count 59 -> 60.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The committed .codex/hooks.json hardcoded .agents/skills/impeccable/scripts/
hook.mjs. On a .codex-directory install the skill payload lives at .codex/
skills/..., so the guarded command ([ ! -f X ] || node X) found no file and
silently no-opped, leaving the design detector dead for those users.
Derive the hook payload path from the emitting provider's own configDir rather
than hardcoding .agents:
- buildCodexHooksManifest(skillDir) now builds `${skillDir}/skills/impeccable/
scripts/hook.mjs`; hooksJsonFor threads each provider's configDir through. The
Codex provider (configDir .codex) emits .codex/skills; the root sync and the
self-consistent dist/codex bundle both point at their own payload.
- CLI installer: project-scope hook rewriting now derives the provider's own
project-relative path instead of preserving the bundle token. The Codex bundle
ships a .codex/skills command, but the CLI lays the skill at .agents/skills, so
the installed .codex/hooks.json is rewritten to .agents/skills (Claude keeps
its ${CLAUDE_PROJECT_DIR} token; global installs keep the absolute rewrite).
Per-provider hook payload path after the fix:
Emission hook path
dist/codex/.codex/hooks.json .codex/skills/impeccable/scripts/hook.mjs
root .codex/hooks.json (build sync) .codex/skills/impeccable/scripts/hook.mjs
CLI .agents (codex) project install .agents/skills/impeccable/scripts/hook.mjs
CLI .agents (codex) global install <home>/.agents/skills/.../hook.mjs (abs)
.claude / .cursor unchanged
Tests: extended hook-build (codex-dir -> .codex/skills, agents-dir -> .agents/
skills) and skills-cli (bundle ships .codex/skills, install rewrites to .agents/
skills). Regenerated tracked .codex/hooks.json via build:release.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
From the paired Opus and Codex manual-run analyses. DESIGN.md moves to
the end of the flow and into a shipped documenter subagent that derives
the system from the built artifact: a rulebook written before the build
gets defended against reality, and a half-stable DESIGN.md hands the
design-system detector an unstable target that buries the build in
noise and invites laundering. The finish reviewer gains the handoff
that failed three times live: the parent captures desktop and mobile
screenshots and passes paths, the reviewer never attempts to render
and names missing inputs in one line, the parent verifies the
five-section return and respawns once on empty. Fidelity against the
approved comp joins its checks; the card keeps commitment only. The
comp ingredient inventory becomes a written gate with raster-by-default
materials and no gradient-as-texture, comps persist under
.impeccable/mocks, the degraded seed names the sandboxed-exec cause,
and the finish line is explicit: a clean detector pass is not finished.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tests/live-tanstack-adapter.test.mjs (added in 4cd5ea75) was never listed in
scripts/test-suites.mjs, so the test-suites registry guard failed and the file
never ran in any suite. Add it to the live suite's node command list. Pre-existing
housekeeping, independent of the detector fixes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fixes three detector bugs that surfaced on real-world (Shopify) URL scans:
#407 — DOM named-property shadowing crash. On a <form> with a named control
like <input name="id"> (every Shopify product form), HTMLFormElement's
[LegacyOverrideBuiltIns] behavior makes `form.id` return the input element, not
the id string, so `elId.startsWith(...)` throws and aborts the whole scan. Read
the id via getAttribute whenever `el.id` is not a string, at all three sites:
checkQuality (checks.mjs) and collectBrowserFindings + generateSelector
(browser/injected/index.mjs). Regenerated the browser bundle.
#408 — tiny-text / undersized-ui-text flagged non-rendered elements. On sites
that set html{font-size:62.5%} the root computes to 10px, so <script>/<style>/
<title>/<noscript> and display:none / visibility:hidden blocks — whose JS/CSS/
JSON-LD text clears the hasDirectText gate — produced dozens of phantom "10px
body text" findings. Added isNonRenderedText() (tag list + head descendants +
display/visibility) and gated both text-size floors on it.
#409 — contrast rules misjudged gradients. Case A: background-clip:text paints
its glyphs with the element's own gradient, not a backdrop, so measuring the
never-painted `color` against those stops is a guaranteed false positive; skip
the backdrop-contrast checks when bgClip is 'text' (the gradient-text pattern
flag still fires). Case B: a translucent gradient stop (e.g. a 9%-alpha accent
glow) was treated as an opaque accent; composite alpha stops over the resolved
surface beneath the gradient in resolveGradientStops(), dropping the stop rather
than guessing when that surface is unresolvable.
Fixtures + tests: shadowed-form-id.html (browser, #407), nonrendered-text.html
(#408), and gradient-clipped + alpha-glow cases added to color.html (#409).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The release-gate audit traced four ways the roll's output was defeated
downstream of a perfectly healthy seed. Gemini's harness keeps only the
tail of tool output, so the header-only ASSIGNED INDEX never reached
the model in 18 of 18 samples; the seed now restates the assignment
and key at the end of its output. Astro strips frontmatter comments,
so half the anthropic contracts vanished from built artifacts; the
contract now must survive the production build as an HTML comment in
emitted markup. A brief that paints its own picture (the album named
Soft Cathedrals) converged every arm regardless of assigned index; its
literal reading now joins the rut with at most one candidate. And Opus
under 4.0.1 skipped the seed 42% of the time while hand-authoring
plausible contracts; the finish reviewer now verifies FORM carries a
corroborable seed key before any craft point.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paul's call: the build-exhaustion failure only exists inside eval
workers with hard turn budgets no real harness exposes, and the clause
doubled as a hedge door for skipping the comp round. The eval-side fix
belongs in the worker's max-turns, not in skill prose.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The release-gate campaign confirmed two skill bugs with transcripts.
Sandboxed harnesses reject absolute paths, so following the CHOSEN
CARD directive with the absolute card-base path failed view_image; the
directive and the quality-bar clause now say download into the
workspace and open the relative path. And under the openai worker's
turn cap, models spent the budget on init, cards, and comp generation
and never built the page (a third of small-n supplement slices); the
visualize mandate gains its one exception: at a hard cap the shipped
page outranks optional imagery.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paul's call: the reviewer-local authorization patch covered one
command while the harness gate silently disables every shipped
subagent, critique panels and the manual-edit applier included. The
argument now lives beside the autonomy counter in context.mjs, emitted
as tool-result content every run: invoking the skill is the user
request such gates ask for; spawn where a reference directs; the
in-thread substitute is for absent capability only and gets disclosed
in one line. new-work keeps the reviewer mechanics and drops the
now-central argument.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A live session on a harness whose guidance gates subagent use on user
request resolved the conflict silently against the skill: it never
spawned the reviewer, stretched the no-subagents fallback to cover
permission hesitancy, and self-reviewed with all the context that made
its choices feel correct. Three tightenings: invoking the skill IS the
user request that authorizes its shipped subagents; the fallback is
for harnesses lacking the capability, not for hesitancy; a substituted
review gets disclosed in one line at finish, never silently.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three browser-side fixes for the same 3.5-to-4.0.1 regression.
- Source-preview targets no longer source-inject per variant_progress
checkpoint. Immediate injection raced framework (React/Vue) ownership and
triggered removeChild errors, which surfaced as static previews. HMR now
owns reconciliation while variants stream in; source injection runs only on
the final done (its 750ms settle + retry ladder stays for non-HMR harnesses
like Cursor). Progress counts still advance from the variant observer, and
the svelte-component progressive path is unchanged.
- The agent-phase progress bar advances monotonically. A behind/resumed
checkpoint re-broadcasts an earlier phase (the server regresses the snapshot
phase to generating), which moved the visible bar backward; a phase rank
table now blocks a known-lower phase from overwriting a known-higher one.
- The server-lost toast now frames the drop as resumable (session saved,
reopen or restart live-poll.mjs) instead of "Session ended", which had led
agents to rationalize bailing to direct edits.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
