Two review findings:
- restoreSvelteMarkup visited an {#each} key with outer scopes only, so a
contract prop sharing a loop binding name rewrote the key: with prop
name -> user.name and loop context "name", the key (name.id) became
(user.name.id) in the accepted route. The key evaluates per item, so it
is now visited with the loop context and index bound. Regression test
verified failing on the previous code.
- enterLiveRoot silently kept the ambient working directory when the
resolved appRoot no longer existed or chdir failed, letting a helper
derive server, session, and source paths from the wrong project. Both
cases now exit with a clear error naming the app root and the --target
escape hatch.
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
removeSelectorAt walked backward to find the rule prelude and stopped at
any '>', added so the walk would not escape past the <style> open tag.
That same character is the CSS child combinator, so pruning one unused
selector from a list like '.wrap > .orphan, .orphan' cut the prelude
mid-list; when every remaining fragment equaled the flagged selector, the
whole-rule branch then deleted from the cut point and left a dangling
'.wrap >' in source. A '>' now bounds the walk only when it actually
closes a <style ...> tag; combinators are walked through.
Regression tests cover a mid-list combinator prune and the dangling-
fragment shape (verified failing on the previous code).
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Addresses two cursor findings on extractMatchingSourceCss plus an adjacent
hazard in the same removal machinery:
- Class matching is token-bounded, never substring: .btn no longer seeds
.btn-primary and .stage no longer seeds .stages. A falsely seeded
selector was an accept-time deletion of a hand-written rule, since any
seeded selector the variant does not re-declare is removed as
superseded.
- Tag rules that style the pick (h1, a, p) now seed the preview stub, so
unclassed selections start from the real cascade. They are excluded
from the supersedable set: tag rules style shared elements across the
route and must never be removal candidates.
- Supersession removal is now bounded by ownership: a seeded class
selector whose class is still used by markup OUTSIDE the replaced
region survives the accept, because removing it would strip styling
from markup the accept never touched.
Tests cover substring non-matches, tag seeding with a tag-free
supersedable set, and a shared-class accept where .card is used both
inside the pick and elsewhere.
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Field session on a nested SvelteKit app surfaced a self-reinforcing leak:
localStorage is per-origin, two projects reused 127.0.0.1:5174, and a
React project's leftover cycling session was resumed inside the Svelte
project. Its checkpoints then materialized a ghost session in the new
project's durable store that kept reattaching after every discard, and a
stale adapter module 401'd on live.js, hiding the picker.
Four fixes:
- Server: only session-creating events (generate, steer) may mint a
journal. Progress events (checkpoints, mount acks, accept/discard) for
unknown ids are refused with 404 unknown_session and never enqueued, so
foreign browser state cannot create ghost sessions. Browser sends are
gated so progress never overtakes its own creating POST (the Go-time
checkpoint and generate are concurrent fetches; the first sweep caught
the out-of-order arrival breaking every SvelteKit flow). Steer
checkpoints now follow the steer event for the same reason.
- Browser: saved sessions carry the server's appRoot; a session stamped
by another project is dropped at load time. Unstamped legacy state is
caught by the unknown_session refusal, which clears local state and
re-arms the picker with an explanatory toast.
- SvelteKit adapter: the layout import carries a token-derived revision
query so a helper restart changes the module specifier and no Vite
client/SSR cache can serve an adapter with a rotated-out token;
live-inject --port reads the running helper's token from server.json
instead of writing an unauthenticated live.js URL; script load failures
log an actionable console error; and adapter removal is byte-exact
(the old regex swallowed the next line's indentation).
- live.mjs resolves surface briefs from appRoot, then contextRoot, then
repoRoot, matching context.mjs in nested-app repos.
Tests: server unknown-session rejection units, adapter revision/
byte-exact-removal units, and a foreign-session e2e scenario that seeds
another project's localStorage state and asserts it is cleared, no ghost
journal materializes, and picking still works.
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
A codex session declared the decision board dead while the user was
still reading it, then proceeded without their choice. The wait's
liveness probe was process.kill(pid, 0) with every error treated as
gone, but a sandboxed exec cannot signal a process outside its sandbox:
EPERM arrives for a living server. Liveness now leads with the page's
own heartbeat in the state file, falls back to the kill probe, and
reads EPERM specifically as exists-but-unsignalable. The exit-2 message
also stopped inviting the wrong recovery: it now states this is a
server failure, not a user decision, and orders a restart and reopen,
never an unattended proceed while the user's browser session is open.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The static engine's checkHtmlPatterns ran its CSS-property regexes over
the entire source string, so documentation ABOUT css flagged as css:
impeccable.style's changelog line naming background-clip: text inside a
<code> tag tripped gradient-text, the purple hexes in a <pre> sample
read as the AI palette, and a commented-out stripe rule counted as a
live one. The browser path shared the exposure through outerHTML.
The fix is engine-level, not a per-rule patch. The pattern pass now
scans scoped corpora: styleText carries <style> block contents,
style="" attribute values, and the linked stylesheets the static engine
already reads for the cascade; classText carries class attribute values
for the utility-class scans. The static engine builds both from its
parsed document, so escaped code samples never contribute; other
callers fall back to a tag-scoped extraction in
buildHtmlPatternCorpora, and bare CSS input stays its own style text so
direct callers keep working. The pulsing-dot and marquee scanners take
a second markup argument for the parts that really are markup: landmark
ranges, Tailwind class positions, the <marquee> tag itself.
Rendered-text checks (theater phrases) and markup-shaped checks (svg
scenes, img hover classes) keep the full source on purpose. No registry
ids change; this is scoping, not a new rule.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two field observations. Greenfield projects with no framework never got
asked what to build on: the interview covered product truth and banned
aesthetic questions, and the model silently picked a scaffold the user
never chose. Init now asks once, static HTML, a named framework, or a
delegated choice plus any deploy constraint, and records the outcome
under a new optional Stack section, including the delegation itself, so
later work knows the choice was offered.
And the medium guidance named raster a dozen times while naming WebGL
once, so models never reached for vector or GPU code unprompted. The
affinity now runs both ways at the decision point: precise geometry,
shape systems, diagrams, expressive motion, shaders, and anything
interactive are vector and GPU territory, where a raster flattens what
should move, scale, and respond. The sketchy-SVG ban states its own
scope: it bans SVG imitating pictures, never SVG doing geometry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Stagings now honour approval ratings exactly as world challengers do, a
3-star earning a second ticket and a 1-star marginal keep leaving the
pool, which matters more here because per-surface staging pools are
small enough that an unweighted shuffle repeats a weak staging often.
Each ticket carries its index into the deterministic ranking so the
id-dedupe cannot silently collapse the doubled odds into a no-op, and
an all-marginal pool still deals rather than starving. The composition
catalog validates the new grades: 1-3, approved entries only. Tests
cover the weighting, the dedupe subtlety, and the fallback.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The github and cursor providers previously received only the generated
degraded/ inline fallbacks. Both harnesses support real custom subagents,
so the build now emits them from the same skill/agents/ source:
- GitHub Copilot: .github/agents/impeccable-<role>.agent.md with portable
frontmatter only (name + description; omitting tools grants all tools,
and Copilot has no documented model/effort/max-turns equivalents).
- Cursor: .cursor/agents/impeccable-<role>.md with name, description,
model: inherit, is_background: false, and readonly derived from the
agent's tool list (true only for the finish reviewer, which declares
neither Write nor Edit). effort/max-turns are skipped because Cursor's
effort option requires an explicit model id.
Agent bodies now also resolve {{scripts_path}} and strip rule markers in
the shared agentFormat pipeline, which fixes the previously unresolved
placeholder in the emitted Claude asset-producer agent.
The CLI installer places agents per scope: project installs write
<repo>/.github/agents/ and <repo>/.cursor/agents/; user-level installs
write ~/.copilot/agents/ (Copilot's user dir, not ~/.github/) and
~/.cursor/agents/, overwriting stale impeccable-* copies. Because
Copilot lets user-level agents shadow same-named project ones, a project
install warns when shadowing copies exist; Cursor gives project agents
precedence, so no warning there.
new-work.md and visualize.md extend their harness-naming clauses with
the Cursor and Copilot invocations. The degraded/ fallbacks keep
shipping for surfaces where the model still fails to delegate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fixes#439. When a cycling session is abandoned and the wrapped region is
then edited or regenerated out of the source file, the resumed page used
to sit in GENERATING forever with the picker disarmed; the only recovery
was a manual live-complete --discarded. Now a resumed CYCLING session
whose wrapper cannot be found in source retries the read a few times
(HMR or an agent write may be mid-flight), then discards itself, clears
local state, and re-arms the picker with a toast. GENERATING restores
are exempt: deferred-wrapper flows legitimately have no wrapper in
source until the agent's write lands.
The browser tags the discard event orphaned:true; the server terminalizes
that session directly (phase discarded) and keeps the event out of the
agent poll queue, since there is no source cleanup left to perform and
the normal discard flow would just fail against the missing scaffolding.
New e2e scenario on vite8-react-plain drives the full repro: cycle,
revert source externally, reload, assert self-discard, terminal durable
phase, and a working picker afterward.
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
A trailing --target, an empty --target=, or --target followed by another
flag used to degrade into implicit root selection, letting a mutating
helper (poll, accept, complete) act on the most recent live app instead
of the one the caller tried to name. consumeTargetArg now throws on those
shapes and enterLiveRoot exits with a clear error before any session
state can be touched. Unit tests cover the malformed shapes and a
subprocess test proves the helper body never runs.
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Addresses two cursor review findings:
- {#each} bodies whose bound values appear in attributes (href={link.href},
src={item.img}) now record attr slots; the browser hydrates them from the
rendered attribute so component previews no longer mount with empty links.
Single-expression attributes hydrate exactly; mixed values stay unhydrated
as before. A new slot classifier also refuses shapes that would crash a
shallow hydration item (deep paths, method calls, bare item renders) and
routes them to source-preview mode instead.
- Style directives now run the mixed loop/outer identifier check before the
free-identifier param check, so style:width={base + r.pct} falls back
instead of minting a broken param.
Tests: attr-slot analysis units, crashy/lossy fallback units, an attribute-
bound anchor in the stateful SvelteKit fixture asserted through accept, and
a mountedDomProbe e2e hook that reads the hydrated href off the mounted
variant DOM (verified to fail when hydration is disabled).
AI-assisted (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
greptile-apps[bot]: the legacy fallback (server.json without port or
token) accepted a pid-only record on Windows without identity. Every
server.json this codebase has ever written records port and token, so a
record without them is malformed or foreign; it now classifies as not
live and resolution falls to the durable-session tier, the correct
recovery path for a crashed helper. The ps-based identity heuristic is
gone with it: authentication or nothing.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
greptile-apps[bot] escalated the identity ladder to a pid AND port both
coincidentally reused by different processes. The definitive terminator
was available all along: the helper serves an authenticated endpoint and
server.json records the token, so the probe now requires a 200 from
/status?token=... over HTTP. Nothing but our helper can answer that,
which closes the entire misidentification class rather than the next
rung. The regression test hosts its responder in a child process (the
probe is execFileSync, so a same-process responder can never accept
while the parent's event loop is blocked; production helpers are always
separate processes).
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
greptile-apps[bot]: the win32 branch skipped the port probe entirely
(bash /dev/tcp is not portable), so a reused pid on Windows still
classified as a running helper. The probe is now a spawned node
one-liner that behaves identically on every platform, which also drops
the bash dependency for minimal Linux environments; the ps identity
check remains only for legacy server.json records without a port.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
cursor[bot]: an expression mixing loop bindings with outer free names
(fmt(r.label) where fmt lives in the route script) was left verbatim, so
the detached preview referenced an undeclared identifier and failed at
mount, past the compile gate, because globals make it legal to the
compiler. Such expressions now mark the analysis unsupported and the
session takes source-preview mode. A globals allowlist makes Math/JSON
and friends count as neither free nor bound, which also fixes a latent
bug where a pure-global expression minted a nonsense prop.
Won't-fix on the same pass: the live-setup.md filename cross-reference
matches the repo's established reference-link convention.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Field failure (Codex session, 2026-07-28): the agent kept the seeded
stub style block and appended its own second top-level style element in
all three variants. Svelte forbids that, so the user saw a red Vite
compile overlay; the mount-ack loop then self-healed (failure event,
repair, republish, clean accept), but the overlay window is exactly the
kind of thing the user should never see.
The publish gate closes the class: a done reply for a component session
now compile-checks every variant with the app's own compiler BEFORE the
revision bump and the browser broadcast. Failures bounce as a 422 with
file, line, and message plus _instructions; live-poll surfaces the
details in the thrown reply error. The browser never imports a variant
that cannot compile.
Also: the stub guard comments warn that all CSS belongs in the single
existing style block, worded to never contain the literal "<style"
sequence (a mention inside a CSS comment truncates the string surgery
agents use to find the block; the fake test agent caught exactly that).
The JIT svelte instructions carry the same warning.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
The prompt behind a generated image was recorded three different ways,
a sidecar in the eval harness, nothing in the skill's API tool, nothing
for native tools, so intent survived or vanished depending on where you
ran. One dependency-free script now embeds the prompt inside the image
itself, PNG tEXt or JPEG COM with a sidecar fallback for other formats,
idempotent, and reads it back from any impeccable-generated file. The
API tool embeds automatically; the prose directs every native-tool
generation through it; copies between machines and harnesses keep their
intent. Comps meanwhile are declared the build thread's own work, never
delegated, and the comp-skeleton guidance now asks for the surface's
actual regions instead of prescribing navs onto pages that have none.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two findings from the first human-validated probe. The comps rendered
as scene vignettes because the generation prompts led with the world's
atmosphere; the model painted the fish market instead of the fish
market's website. The comp guidance now demands the page's literal
skeleton in the prompt, nav and its items, headline block, sections in
order, footer, with a self-check: a render that could hang as a poster
is not a comp. And generation context is part of the asset: the thread
that wrote a prompt knows what the image contains and why, so build-
critical imagery prefers the build thread, and subagent-produced assets
must carry their prompts, via the tool's new sidecar or the manifest,
read by the builder before composing.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The failed gallery batch bound its seed, ran the reviewer, and still
shipped CSS bevels imitating enamel: the matrix's material row was
defined against the approved comp, and comp-less runs left it with no
reference. The rows now fall back to the contract's OWN-WORLD and the
world's real materials, with faked physicality contradicted on its
face; imitation material is the single most reliable mark of
machine-made design.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Transcript archaeology on the failed gallery batch split the binding
break three ways. One model authored a complete, correct contract that
Astro then erased: the compiler strips a slot's leading comment while
keeping deeper ones, so the contract now belongs to the root layout's
body as its first child, and the first production build gets grepped
for the seed key, because a contract the build erased is a contract
nobody can audit. Another model simply skipped the roll and built the
exact category default the seed exists to refuse; the roll step now
states outright that it has no substitute and no skip condition. The
third failure was the worker watchdog, fixed separately.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two probe runs on two different harnesses built complete pages and
declared done without ever entering the finish sequence: the reference
was read once near turn four and the finish choreography had fallen out
of attention thirty turns later. The one text a model rereads on every
edit is its own artifact, so the direction contract now closes with a
FINISH line naming the exit condition verbatim: unreviewed and
undocumented is unfinished; this build ends with the finish review, the
verdict, and DESIGN.md. A page that looks complete with that line
undischarged is not done, it is abandoned at the finish line.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A sandboxed harness rejected view_image on an absolute path to a mock
the model had itself just produced under .impeccable/mocks/, killing
the run. The relative-path rule existed only for downloaded quality-bar
cards; it now covers every image the flow produces or references, in
the comp round and in the asset producer's comparison step.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
cursor[bot]: discoverAppCandidates only matched dev-config markers while
the upward walk also honors an existing .impeccable/live/config.json,
so booting from a repo root without --target missed a nested
live-configured static site and fell through to the wrong root. Both
paths now share isAppRoot; regression test covers the static-site shape.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
cursor[bot]: the background-terminal notify regex predated
variant_mount_failed (and manual_edit_apply / prefetch), so on Cursor a
failed mount exited the one-shot poll without waking the agent and the
error card sat unanswered. The pattern now lists every type the
dispatch loop handles.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
greptile-apps[bot] re-raised the residual with a repro: a stale
server.json pid reused by an unrelated node process passed the
command-name check. The decisive signal is the recorded PORT: a real
helper is listening on it, a pid squatter is not. hasLiveServer now
probes 127.0.0.1:<port> (bash /dev/tcp, sync, ~ms, win32-guarded with
the previous behavior); the multi-app preference test runs a real
listener instead of faking liveness with a bare pid.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Field feedback from two more Codex sessions drove both changes.
JIT instructions (live/instructions.mjs): every event live-poll prints
now carries _instructions, the authoritative next step for that exact
situation with real ids, paths, and line numbers substituted, and only
the active path's rules (a svelte-component session never sees JSX
guidance). The boot payload carries loop instructions the same way.
Instructions are versioned with the scripts, so they cannot drift from
behavior, and live.md's plumbing can keep shrinking toward contract plus
craft guidance. The Codex poll-discipline failure observed in the field
("the long poll was started, but I yielded the task instead of actively
servicing its result") gets a named anti-pattern in both the harness
policy and the boot instructions.
LLM e2e agent: default provider/model moves from Claude Haiku 4.5 to
OpenAI gpt-5.6-terra at medium reasoning effort via an Anthropic-shaped
shim over the ai SDK (the three call sites stay provider-agnostic;
Anthropic and DeepSeek remain selectable). The harness should exercise
the model tier that actually drives live sessions. Both the react and
sveltekit fixtures pass end to end with terra driving the trimmed
live.md and the new _instructions.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Rating grades quality, breadth says whether a world can serve an
arbitrary build at all; while they shared one field, the only way to
hold a narrow world back was calling it marginal, which made excellent
but narrow unrecordable and corrupted the ratings as a calibration
signal for the next authoring round. Both axes now exclude
independently, either kind of hold keeps its approval for direct
briefs, an all-niche tier falls back rather than starving, and
stagings honour the same gate with the same fallback. Tests cover the
niche exclusion at strength, the fallback parity with marginal-only
tiers, and the staging gate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
First-time setup (config schema, framework table, adapters, drift, the
whole CSP flow) moves to reference/live-setup.md, loaded only when the
boot reports config_missing/config_invalid or cspChecked is absent.
The per-session prose is compressed without dropping any pinned phrase,
MUST rule, schema, or example; the boot payload documentation now names
the inlined surface brief. All live-reference pins and both prose gates
pass.
This work was produced with AI assistance (Claude Code).
Co-Authored-By: Claude Code <noreply@anthropic.com>
Paul BakausandGitHub
github-actions[bot]
