Fix: Windows update line prompt (#760 )

Raw-mode readline is Unix-only; Windows TTY sessions now use the existing line-based prompt instead of aborting. AI assistance: Cursor Grok 4.6, under maintainer direction. Co-authored-by: Cursor <cursoragent@cursor.com>
Fix Windows CSP candidate path normalization (#778 )
2026-09-12 06:06:37 +03:00 · 2026-09-08 02:10:51 +05:00 · 2026-09-07 13:48:29 -07:00 · 2026-09-07 13:15:18 -07:00 · 2026-09-07 12:25:27 -07:00 · 2026-09-07 11:50:15 -07:00
200 changed files with 22313 additions and 266 deletions
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 license: Apache 2.0
 allowed-tools:
  - Bash(npx impeccable *)
@@ -17,9 +17,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.agent/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.agent/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.agent/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.agent/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.agent/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.agent/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.agent/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -2,7 +2,7 @@
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
 metadata:
-  version: 4.2.1
+  version: 4.2.2
 ---

 This skill gives you the tools and permission to create design that earns to be called out-of-distribution craft: Whereas before, your design work would have been safe, timid and measured, you now approach every design task as an award-winning design director with impeccable understanding for what makes exceptional design work: production-grade code, peak creativity, a clear POV, deep understanding of the needs of the client and users, and exceptional craft.
@@ -14,9 +14,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.agents/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.agents/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.agents/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.agents/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.agents/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.agents/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.agents/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 Codex: run live helper commands, the app dev server, and any dependency-installing setup with `sandbox_permissions: "require_escalated"` from the start; live mode depends on localhost and package-manager network access that the sandbox blocks.

 ## The contract (read once)
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -12,7 +12,7 @@
    {
      "name": "impeccable",
      "description": "Design fluency for frontend development. 1 skill with 23 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.",
-      "version": "4.2.1",
+      "version": "4.2.2",
      "author": {
        "name": "Paul Bakaus",
        "email": "paul@paulbakaus.com"
@@ -1,7 +1,7 @@
 {
  "name": "impeccable",
  "description": "Design fluency for frontend development. 1 skill with 23 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.",
-  "version": "4.2.1",
+  "version": "4.2.2",
  "author": {
    "name": "Paul Bakaus",
    "email": "paul@paulbakaus.com"
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -16,9 +16,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.claude/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.claude/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.claude/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.claude/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.claude/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.claude/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.claude/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -0,0 +1,6 @@
+{
+  "name": "impeccable",
+  "owner": { "name": "Renaissance Geek, Inc." },
+  "metadata": { "description": "Impeccable design tools for Cursor" },
+  "plugins": [{ "name": "impeccable", "source": "./cursor-plugin" }]
+}
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 license: Apache 2.0
 ---

@@ -14,9 +14,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.cursor/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.cursor/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.cursor/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.cursor/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.cursor/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.cursor/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.cursor/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 license: Apache 2.0
 ---
@@ -15,9 +15,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.dsh/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.dsh/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.dsh/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.dsh/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.dsh/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.dsh/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.dsh/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 ---

 This skill gives you the tools and permission to create design that earns to be called out-of-distribution craft: Whereas before, your design work would have been safe, timid and measured, you now approach every design task as an award-winning design director with impeccable understanding for what makes exceptional design work: production-grade code, peak creativity, a clear POV, deep understanding of the needs of the client and users, and exceptional craft.
@@ -13,9 +13,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.gemini/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.gemini/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.gemini/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.gemini/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.gemini/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.gemini/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.gemini/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -16,9 +16,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.github/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.github/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.github/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.github/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.github/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.github/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.github/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -11,6 +11,9 @@ on:
  schedule:
    - cron: '0 7 * * *'

+permissions:
+  contents: read
+
 concurrency:
  # Scheduled runs get their own group: the 07:00 UTC nightly and a push to
  # main share github.ref, and cancel-in-progress would let them kill each
@@ -34,12 +37,12 @@ jobs:
      live_svelte_adapter_deepseek: ${{ steps.plan.outputs.live_svelte_adapter_deepseek }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

@@ -59,15 +62,15 @@ jobs:
        node-version: [22.18.0, 24]
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node-version }}

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

@@ -96,13 +99,17 @@ jobs:
      - name: Build
        run: bun run build

+      - name: Validate VS Code package
+        run: bunx --package @vscode/vsce@3.9.2 vsce package --no-dependencies
+        working-directory: dist/vscode
+
      # `bun run build:extension` runs `cargo xtask bundle`: the rule core
      # compiled to wasm plus the page JS in browser-bundle/.
      - name: Install the pinned toolchain
        if: needs.changes.outputs.detector == 'true'
        run: rustup show && rustup target add wasm32-unknown-unknown

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        if: needs.changes.outputs.detector == 'true'

      - name: Install wasm-pack
@@ -140,7 +147,7 @@ jobs:
        run: git diff --exit-code -- .agents .claude .cursor .dsh .gemini .github/skills plugin extension/detector

      - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: impeccable-build-node-${{ matrix.node-version }}
          # Ship the packaged zips, not the unpacked Firefox staging tree.
@@ -157,14 +164,14 @@ jobs:
    if: needs.changes.outputs.rust == 'true'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # rust-toolchain.toml names the channel; `rustup show` installs it.
      # Never override the toolchain here.
      - name: Install the pinned toolchain
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Build
        run: cargo build --workspace --all-targets
@@ -181,10 +188,10 @@ jobs:
    if: needs.changes.outputs.rust == 'true'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Install the pinned toolchain
        run: rustup show
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      - run: cargo build --workspace --all-targets
      - run: cargo test --workspace --no-fail-fast

@@ -194,9 +201,9 @@ jobs:
    if: needs.changes.outputs.core == 'true'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
      - name: Exercise Windows launcher downloads and verification
@@ -213,15 +220,15 @@ jobs:
    if: needs.changes.outputs.oracle == 'true' || needs.changes.outputs.rust == 'true'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

@@ -231,7 +238,7 @@ jobs:
      - name: Install the pinned toolchain
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Build the engine from source
        run: cargo build --release -p impeccable
@@ -255,10 +262,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

@@ -291,15 +298,15 @@ jobs:
    if: needs.changes.outputs.cli_remote_e2e == 'true'
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

@@ -311,7 +318,7 @@ jobs:
      - name: Install the pinned toolchain
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Build the engine
        run: cargo build --release -p impeccable
@@ -337,20 +344,20 @@ jobs:
            fixtures: vite8-react-css-modules,vite8-react-insert,vite8-react-plain
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Cache fixture npm downloads
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.npm
          key: ${{ runner.os }}-fixture-npm-${{ hashFiles('tests/framework-fixtures/**/files/package.json') }}
@@ -358,7 +365,7 @@ jobs:
            ${{ runner.os }}-fixture-npm-

      - name: Cache Playwright Chromium
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('package.json', 'bun.lock') }}
@@ -376,7 +383,7 @@ jobs:
      - name: Install the pinned toolchain
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Build the engine
        run: cargo build --release -p impeccable
@@ -393,7 +400,7 @@ jobs:

      - name: Upload live E2E failure artifacts
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: live-e2e-smoke-${{ matrix.group }}-artifacts
          path: test-results/live-e2e
@@ -423,20 +430,20 @@ jobs:
            fixtures: vite8-react-tailwindv3,vite8-react-tailwindv4,vite8-react-ts,vite8-react-tsx-repeated-aside,vite8-react-unocss,vite8-react-vanilla-extract
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Cache fixture npm downloads
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.npm
          key: ${{ runner.os }}-fixture-npm-${{ hashFiles('tests/framework-fixtures/**/files/package.json') }}
@@ -444,7 +451,7 @@ jobs:
            ${{ runner.os }}-fixture-npm-

      - name: Cache Playwright Chromium
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('package.json', 'bun.lock') }}
@@ -462,7 +469,7 @@ jobs:
      - name: Install the pinned toolchain
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Build the engine
        run: cargo build --release -p impeccable
@@ -478,7 +485,7 @@ jobs:

      - name: Upload live E2E failure artifacts
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: live-e2e-full-${{ matrix.group }}-artifacts
          path: test-results/live-e2e
@@ -499,23 +506,23 @@ jobs:

      - name: Checkout repository
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Cache fixture npm downloads
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.npm
          key: ${{ runner.os }}-fixture-npm-${{ hashFiles('tests/framework-fixtures/**/files/package.json') }}
@@ -524,7 +531,7 @@ jobs:

      - name: Cache Playwright Chromium
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('package.json', 'bun.lock') }}
@@ -545,7 +552,7 @@ jobs:
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        if: ${{ env.ANTHROPIC_API_KEY != '' || env.DEEPSEEK_API_KEY != '' }}

      - name: Build the engine
@@ -576,23 +583,23 @@ jobs:

      - name: Checkout repository
        if: ${{ env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
        if: ${{ env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
        if: ${{ env.DEEPSEEK_API_KEY != '' }}
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Cache fixture npm downloads
        if: ${{ env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.npm
          key: ${{ runner.os }}-fixture-npm-${{ hashFiles('tests/framework-fixtures/**/files/package.json') }}
@@ -601,7 +608,7 @@ jobs:

      - name: Cache Playwright Chromium
        if: ${{ env.DEEPSEEK_API_KEY != '' }}
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('package.json', 'bun.lock') }}
@@ -622,7 +629,7 @@ jobs:
        if: ${{ env.DEEPSEEK_API_KEY != '' }}
        run: rustup show

-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        if: ${{ env.DEEPSEEK_API_KEY != '' }}

      - name: Build the engine
@@ -643,15 +650,15 @@ jobs:
      GOOGLE_CLOUD_API_KEY: ${{ secrets.GOOGLE_CLOUD_API_KEY }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

@@ -70,7 +70,7 @@ jobs:
    steps:
      # A fresh runner signs only this run's engine. It does not check out or
      # execute repository code with the Azure identity available.
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: unsigned-windows-x64
          path: unsigned
@@ -124,7 +124,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: impeccable-*
          path: artifacts
@@ -48,10 +48,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

@@ -8,6 +8,8 @@ on:
      - "cli/engine/**"
      - "skill/**"
      - "scripts/**"
+      - "docs/CURSOR-PLUGIN.md"
+      - "LICENSE"
      - "package.json"
      - "bun.lock"
  workflow_dispatch:
@@ -43,13 +45,14 @@ env:
    .veto
    .vibe
    plugin
+    cursor-plugin

 jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          # Optional PAT or GitHub App token. With the default GITHUB_TOKEN,
@@ -57,12 +60,12 @@ jobs:
          token: ${{ secrets.SYNC_GENERATED_OUTPUT_TOKEN || github.token }}

      - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -19,9 +19,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.grok/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.grok/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.grok/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.grok/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.grok/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.grok/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.grok/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 license: Apache 2.0
 ---

@@ -14,9 +14,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.hermes/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.hermes/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.hermes/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.hermes/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.hermes/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.hermes/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.hermes/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 license: Apache 2.0
 ---

@@ -14,9 +14,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.kiro/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.kiro/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.kiro/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.kiro/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.kiro/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.kiro/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.kiro/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -19,9 +19,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.opencode/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.opencode/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.opencode/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.opencode/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.opencode/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.opencode/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.opencode/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 license: Apache 2.0
 allowed-tools:
  - Bash(npx impeccable *)
@@ -17,9 +17,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.pi/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.pi/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.pi/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.pi/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.pi/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.pi/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.pi/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -19,9 +19,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.qoder/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.qoder/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.qoder/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.qoder/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.qoder/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.qoder/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.qoder/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -19,9 +19,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.rovodev/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.rovodev/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.rovodev/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.rovodev/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.rovodev/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.rovodev/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.rovodev/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -16,9 +16,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.trae-cn/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.trae-cn/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.trae-cn/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.trae-cn/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.trae-cn/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.trae-cn/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.trae-cn/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 argument-hint: "[shape · audit|critique · animate|bolder|colorize|delight|layout|overdrive|quieter|typeset · adapt|clarify|distill · harden|onboard|optimize|polish · init|document|extract|live] [target]"
 license: Apache 2.0
@@ -16,9 +16,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.trae/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.trae/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.trae/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.trae/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.trae/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.trae/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.trae/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 license: Apache 2.0
 ---

@@ -14,9 +14,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.veto/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.veto/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.veto/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.veto/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.veto/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.veto/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.veto/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -1,7 +1,7 @@
 ---
 name: impeccable
 description: Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
-version: 4.2.1
+version: 4.2.2
 user-invocable: true
 license: Apache 2.0
 allowed-tools:
@@ -18,9 +18,11 @@ Core principles:

 ## Setup

-1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.vibe/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.vibe/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.vibe/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it. If the launcher is refused, missing, or fails, tell the user before editing that context loading did not run. Read existing **PRODUCT.md** and **DESIGN.md** without inventing missing context, then continue with steps 2–3.
+1. Run `<skill-base-dir>/scripts/impeccable context` once per session, where `<skill-base-dir>` is the directory that contains this SKILL.md (the skill folder, not a plugin root two levels above it); keep cwd at the user's project. That base directory resolves every `.vibe/skills/impeccable/scripts/impeccable <verb>` command in this skill and its references, and `.vibe/skills/impeccable/scripts` is the fallback only when the runtime reports no base directory. On a Windows shell without `sh`, call `.vibe/skills/impeccable/scripts/impeccable.cmd` instead. The launcher runs a self-contained binary that ships next to it or is downloaded once on first run; no Node or other runtime is required. Pass a named source file or route as `--target <path>`. It loads PRODUCT.md, DESIGN.md, the matching surface brief, and native-platform guidance when applicable; follow its directives and do not rerun it.
 2. Load the request's playbook: its Commands-table reference for an explicit/implied sub-command, or [reference/new-work.md](reference/new-work.md) for a new surface or replacement visual world. Inspect target and incumbent visual truth before editing. When the app cannot run, start with committed visual-regression goldens or screenshot fixtures; verify target and freshness against current tokens, CSS, components, or assets, resolve conflicts, and compare theme/variant captures.
-3. After analysis and direction are resolved, load [reference/craft-floor.md](reference/craft-floor.md) immediately before editing UI. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+3. After resolving analysis and direction, read [reference/craft-floor.md](reference/craft-floor.md) immediately before any UI edit, including small refinements. It carries the quality floor, the absolute bans, and the reflexes no detector catches. Do not load it for planning-only work.
+
+**Launcher unavailable:** If refused, missing, or failed, **first send the user a message** that context loading did not run. Then read existing PRODUCT.md and DESIGN.md without inventing missing context, follow the applicable steps 2–3, and perform the requested work through permitted tools. Launcher failure alone does not block otherwise-permitted edits.

 ## How to design

@@ -42,6 +42,8 @@ On every boot the project is scanned for HTML files under common page roots (`pu

 ## CSP detection (first-time only)

+Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
+
 If `config.cspChecked === true`, skip this whole section; the user was already asked once.

 ```bash
@@ -4,6 +4,8 @@ Interactive live variant mode: select elements in the browser, pick a design act

 A running dev server with HMR (Vite, Next.js, Bun, etc.), OR a static HTML file open in the browser. If the dev server's default port is busy, the app is very likely ALREADY running; probe the default URL before spawning a second server.

+Live editing requires a local checkout; injection into deployed production sites (including HTTPS) is unsupported. For production inspection, use `.vibe/skills/impeccable/scripts/impeccable detect <url>` or the browser extension, not the live helper. Do not disable browser security or weaken production CSP to enable live mode.
+
 ## The contract (read once)

 Execute in order. No step skipped, no step reordered. Every tool output in live mode may carry an `_instructions` field: it is the authoritative next step for that exact situation, with real ids and paths substituted; when it conflicts with your recollection of this document, `_instructions` wins.
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -111,6 +111,22 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"

+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -509,7 +525,7 @@ dependencies = [

 [[package]]
 name = "impeccable"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "base64",
 "impeccable-browser",
@@ -528,7 +544,7 @@ dependencies = [

 [[package]]
 name = "impeccable-browser"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "base64",
 "impeccable-core",
@@ -542,7 +558,7 @@ dependencies = [

 [[package]]
 name = "impeccable-bundle"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "base64",
 "impeccable-core",
@@ -551,14 +567,14 @@ dependencies = [

 [[package]]
 name = "impeccable-common"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "libc",
 ]

 [[package]]
 name = "impeccable-comp"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "image",
 "once_cell",
@@ -570,7 +586,7 @@ dependencies = [

 [[package]]
 name = "impeccable-comp-verbs"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-common",
 "impeccable-comp",
@@ -583,24 +599,26 @@ dependencies = [

 [[package]]
 name = "impeccable-context"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "flate2",
 "impeccable-common",
 "impeccable-core",
 "once_cell",
 "regex",
+ "rustls-native-certs",
 "serde",
 "serde_json",
 "sha2",
 "tiny_http",
 "unicode-normalization",
 "ureq",
+ "webpki-roots 1.0.9",
 ]

 [[package]]
 name = "impeccable-core"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-core",
 "impeccable-foundation",
@@ -612,7 +630,7 @@ dependencies = [

 [[package]]
 name = "impeccable-detect"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-common",
 "impeccable-core",
@@ -624,7 +642,7 @@ dependencies = [

 [[package]]
 name = "impeccable-foundation"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "cssparser",
 "once_cell",
@@ -637,7 +655,7 @@ dependencies = [

 [[package]]
 name = "impeccable-hook"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-common",
 "impeccable-context",
@@ -651,7 +669,7 @@ dependencies = [

 [[package]]
 name = "impeccable-html"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "cssparser",
 "ego-tree",
@@ -672,7 +690,7 @@ dependencies = [

 [[package]]
 name = "impeccable-live"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "getrandom 0.2.17",
 "impeccable-common",
@@ -690,7 +708,7 @@ dependencies = [

 [[package]]
 name = "impeccable-skills"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-common",
 "impeccable-context",
@@ -709,7 +727,7 @@ dependencies = [

 [[package]]
 name = "impeccable-wasm"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-core",
 "impeccable-detect",
@@ -830,6 +848,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"

+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -1063,7 +1087,7 @@ dependencies = [
 "getrandom 0.2.17",
 "libc",
 "untrusted",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -1096,6 +1120,18 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.15.1"
@@ -1122,6 +1158,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"

+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -1142,6 +1187,29 @@ dependencies = [
 "tendril",
 ]

+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "selectors"
 version = "0.38.0"
@@ -1603,6 +1671,15 @@ dependencies = [
 "windows-targets",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -1681,7 +1758,7 @@ checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"

 [[package]]
 name = "xtask"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
 "impeccable-bundle",
 ]
@@ -6,7 +6,7 @@ resolver = "2"
 members = ["crates/*"]

 [workspace.package]
-version = "0.1.2"
+version = "0.1.3"
 edition = "2021"
 license = "Apache-2.0"
 publish = false
@@ -1 +1 @@
-0.1.2
+0.1.3
@@ -397,6 +397,8 @@ Installed hook surfaces:

 Every command goes through the launcher shipped in the skill's `scripts/` directory (`impeccable`, or `impeccable.cmd` on Windows), guarded so a missing launcher is a silent no-op. The launcher runs the engine binary that ships next to it, or downloads the pinned version once into `~/.impeccable/bin/`. No Node or other runtime is required for the hook or the skill.

+In Claude Code, installed command hooks run independently of model-tool approval. The first edit or Stop event can therefore download and cache the engine even if the session denies the model's launcher command. Review installed hooks before unattended runs; to disable all Claude Code hooks for a run, pass `--settings '{"disableAllHooks": true}'`. See [Claude Code's hook security guidance](https://code.claude.com/docs/en/hooks#security-considerations).
+
 The installer preserves unrelated hook entries and settings. If a hook manifest is malformed, install/update aborts by default; rerun with `--force` to back up the malformed file as `.bak` and replace it.

 On an interactive `install`/`update`, Impeccable explains the hook and offers to install it (default yes). Your choice is remembered per-developer in the gitignored `.impeccable/config.local.json`, so you are not asked again; `--no-hooks` skips it for that run without recording anything. Hook lifecycle settings live under the `hook` key of `.impeccable/config.json`; detector ignores live under `detector`, shared by `/impeccable hooks` and `npx impeccable detect`.
@@ -419,6 +421,8 @@ Codex requires one platform step that Impeccable cannot safely skip: open `/hook

 Full hook docs: [impeccable.style/docs/hooks](https://impeccable.style/docs/hooks).

+The Stop pass suppresses confirmed pre-existing findings when a verified before-edit baseline is available (currently Claude Edit/Write results for text scans). Other findings are marked new or attribution unknown; unknown is not evidence that your session caused the problem. Explicit `detect` scans remain unchanged.
+
 Manual copy commands are fallback/debug instructions. The normal path is:

 ```bash
@@ -426,6 +430,14 @@ npx impeccable install
 npx impeccable update
 ```

+## Live mode and production sites
+
+Live mode edits a local checkout through a development server or local static HTML. Injecting its localhost HTTP helper into a deployed production site, including an HTTPS site, is not supported. Do not disable browser security or weaken production CSP to make it work.
+
+Use live mode only in projects you trust to run locally. Applying copy edits automatically runs `package.json`'s optional `scripts["impeccable:manual-edit-validate"]` command in a shell, with your user permissions; review that script before using live mode in an unfamiliar checkout.
+
+For production inspection, use `npx impeccable detect https://example.com` or the browser extension. These inspect the rendered page; they do not provide live variant editing or write changes back to your source.
+
 ## CLI

 Impeccable includes a standalone CLI for detecting anti-patterns without an AI harness. `npx impeccable` is a small shim that runs the same engine binary the skill uses (installed as a platform-specific optional dependency, or fetched once into `~/.impeccable/bin/`); Node is needed only for `npx` itself, and you can also download the binary directly and put it on your PATH.
@@ -81,6 +81,7 @@ impeccable detect [options] [file-or-dir-or-url...]

 - Node.js 22.18+ to run `npx impeccable`. The engine itself is a self-contained binary and needs no runtime; the skill installed into your harness calls it directly.
 - For URL scans, an installed Chrome, Chromium, or Edge (set `IMPECCABLE_BROWSER` to point at one).
+- Behind a TLS-inspecting proxy, downloads trust your OS certificate store as well as the bundled Mozilla roots. Set `SSL_CERT_FILE` or `SSL_CERT_DIR` to use a specific CA bundle instead.

 Binary lookup order: `IMPECCABLE_BIN`, the platform package, `~/.impeccable/bin/<version>/`, then a download of the pinned version into that cache. Set `IMPECCABLE_BIN` to a local build to skip all of that.

@@ -9,7 +9,7 @@
        "@ai-sdk/google": "^4.0.8",
        "@ai-sdk/openai": "^4.0.7",
        "@anthropic-ai/claude-agent-sdk": "^0.3.165",
-        "@anthropic-ai/sdk": "^0.122.0",
+        "@anthropic-ai/sdk": "^0.123.0",
        "@babel/parser": "^8.0.4",
        "ai": "^7.0.14",
        "archiver": "^8.0.0",
@@ -19,46 +19,46 @@
        "zod": "^4.3.6",
      },
      "optionalDependencies": {
-        "@impeccable/cli-darwin-arm64": "0.1.2",
-        "@impeccable/cli-darwin-x64": "0.1.2",
-        "@impeccable/cli-linux-arm64": "0.1.2",
-        "@impeccable/cli-linux-x64": "0.1.2",
-        "@impeccable/cli-windows-x64": "0.1.2",
+        "@impeccable/cli-darwin-arm64": "0.1.3",
+        "@impeccable/cli-darwin-x64": "0.1.3",
+        "@impeccable/cli-linux-arm64": "0.1.3",
+        "@impeccable/cli-linux-x64": "0.1.3",
+        "@impeccable/cli-windows-x64": "0.1.3",
      },
    },
  },
  "packages": {
-    "@ai-sdk/anthropic": ["@ai-sdk/anthropic@4.0.44", "", { "dependencies": { "@ai-sdk/provider": "4.0.8", "@ai-sdk/provider-utils": "5.0.32" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-PZT62FpNvilIeyyk09+BxYnWmmqRWFLe7ers25OPI8SnQxwDSeXtUTxiZNSbZt4ywj53op/INhLR1z5uyL6tHA=="],
+    "@ai-sdk/anthropic": ["@ai-sdk/anthropic@4.0.49", "", { "dependencies": { "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-fzy2sLrs3vNsliIgx65fuovsa6a7OTXd6DllKUgLuVmPyqLnvoZCv9NlKgq+krzDzSxLb9d0zTaJJpsjBVLNyA=="],

    "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.55", "", { "dependencies": { "@ai-sdk/provider": "4.0.7", "@ai-sdk/provider-utils": "5.0.27", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-7WP/nlDz2BkXFlZzwF3w5JgCvktyHC++LP4PZ4mQpbvxrq+M7OdNslevlkuddHhJ+62BZu4oiL/afXlsWOSJZQ=="],

-    "@ai-sdk/google": ["@ai-sdk/google@4.0.56", "", { "dependencies": { "@ai-sdk/provider": "4.0.8", "@ai-sdk/provider-utils": "5.0.32" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-WsBlrDd1bG7JskRErnSsY0uhOuruSLH43gYeUnsyFsFeckCv3xHzJjWSZFQ/Bw28qeXMYeqQpHaUewY0QUPt4w=="],
+    "@ai-sdk/google": ["@ai-sdk/google@4.0.63", "", { "dependencies": { "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-SlKcqnN0oKC8JWahecs3IvFnIFgbrEE4i/bmom5xsPFUjkIVvXAJAhRzjfgfROSOOeyvouKUFPWJEjn11FWf3A=="],

-    "@ai-sdk/openai": ["@ai-sdk/openai@4.0.50", "", { "dependencies": { "@ai-sdk/provider": "4.0.8", "@ai-sdk/provider-utils": "5.0.32" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-e2Jepw5RbSwsCsPwyiNzdlmOHoCQefCziNp3k1UxfIv8QD0/p4SF6+cx7GuWX98jAVNiWLjRv1W3NVSmx3FuEQ=="],
+    "@ai-sdk/openai": ["@ai-sdk/openai@4.0.58", "", { "dependencies": { "@ai-sdk/provider": "4.0.10", "@ai-sdk/provider-utils": "5.0.36" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-oO3vH0e8lhN3OrANukokI2rvUJV+RVwTwJ2y+eSK+IiKlauFza2Yyl/7hjErqkjOt/eMOobhNijo+CFsFt8T+g=="],

-    "@ai-sdk/provider": ["@ai-sdk/provider@4.0.8", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-aWO7iwhFUGf347tCwNGggggfmZigaSu7TF739IZSrWWABUp7zkb4Cr3fMqvBe5EIS7ABJJu3Cadn0g/zs1G0QQ=="],
+    "@ai-sdk/provider": ["@ai-sdk/provider@4.0.10", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-fX2ENAc7iDpZ+Wp4+Rk06Usn/Ys7dI9uAkGv0jlF6XVrW13NkRWx5Ou+U6lIM2E1fTLkCs16GGrUAaVvroag7A=="],

-    "@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@5.0.32", "", { "dependencies": { "@ai-sdk/provider": "4.0.8", "@standard-schema/spec": "^1.1.0", "@workflow/serde": "4.1.0", "eventsource-parser": "^3.0.8", "undici": "^7.28.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-MZUhlINn6FzKIWuX3T36h+yM9d7bG+yatH+kC99ZCe0DHxXfP73KwaoLiLcZDPQDamFyO3umPPBLJieZJyG4DQ=="],
+    "@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@5.0.36", "", { "dependencies": { "@ai-sdk/provider": "4.0.10", "@standard-schema/spec": "^1.1.0", "@workflow/serde": "4.1.0", "eventsource-parser": "^3.0.8", "undici": "^7.29.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-MFXBn6XDyf37PNQAge/HTatPJE8Vmg/g/w4WPtjSV53jq8FKAzoaN5+43hsdQa9bqgN+/13jxug9ChvsG+godQ=="],

-    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.3.251", "", { "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.251", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.251", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.251", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.251", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.251", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.251", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.251", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.251" }, "peerDependencies": { "@anthropic-ai/sdk": ">=0.93.0", "@modelcontextprotocol/sdk": "^1.29.0", "zod": "^4.0.0" } }, "sha512-DqSi8mH2tQYRlVV0G+lJnQ/WbjJZ/a+8cJ3vPuYoqh8esIIvXHm1ZOXV1UPGsFYRnbBytEoiSGitguEXd+sQ+Q=="],
+    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.3.260", "", { "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.260", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.260", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.260", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.260", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.260", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.260", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.260", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.260" }, "peerDependencies": { "@anthropic-ai/sdk": ">=0.93.0", "@modelcontextprotocol/sdk": "^1.29.0", "zod": "^4.0.0" } }, "sha512-PmABtP4Rwd6l95itQrqzguv6rS9uACqikPB9g8BPeWRKZOpy3xpEOjJLYauof3BFk2wNZnfhr0Ttx8ttcZzq0w=="],

-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": ["@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.251", "", { "os": "darwin", "cpu": "arm64" }, "sha512-C23h+Dbddcc4gai95+lhm4/94am2IOq+bf3IdEDDS7EPqDQqajo2s5q1/ZSwq9rOc0RJLT7Ws72ZCzYJh67KSg=="],
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": ["@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.260", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0af2gRe6+sk13yYNX2gdDhcO15Kj1qd8B7ZQlv8mDt2lA1xFhTJqIvRwgrCHeCWZryWTmoRgtMoAfJOhQ9yn1g=="],

-    "@anthropic-ai/claude-agent-sdk-darwin-x64": ["@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.251", "", { "os": "darwin", "cpu": "x64" }, "sha512-HrLnb3ggk+vMbymUvbosgPmxWp4W6Ot+0mNVjoBYDn5OZrTV3C3LRtbWf7jwcGyKMcg0xJf0AqiudQ2BRrlr8A=="],
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": ["@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.260", "", { "os": "darwin", "cpu": "x64" }, "sha512-Tnxzv1//5SBT+IVSfIchpOEsg6tv+FADE1a9fSXYI81317IRMpFCQC9rgqxlRtY1Nh401zRzFvQdTz9QR4pmig=="],

-    "@anthropic-ai/claude-agent-sdk-linux-arm64": ["@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.251", "", { "os": "linux", "cpu": "arm64" }, "sha512-3E27F5j82EWOyEniRW7crmo0jWYYQmPDdP52jWq6Y6aytiyYIdUFMEGZZ6chVHNlZiU7GsjTa3teKk2xlQ68lQ=="],
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": ["@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.260", "", { "os": "linux", "cpu": "arm64" }, "sha512-sfZVBdAnuflSs+ru7U1DxIgjd9HPDmgvtA8hKZROfgNt8i2CYBfDHe4pLXkk/kS3nlOR+peJnjGVTFHW52s1mQ=="],

-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": ["@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.251", "", { "os": "linux", "cpu": "arm64" }, "sha512-RTUf7TPBUkQ6oV3pDkEdcD47I0uH0ZpvmZlXHnrLGznFqyLr+7XHupOxUMJD0Jwm9v5qeqpNiPAYB0dL4RYiHg=="],
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": ["@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.260", "", { "os": "linux", "cpu": "arm64" }, "sha512-ZLMbeLHVjkq5hmnpWK1Q2qGAztSPrnTtV+ufdPNf9rzYTYEJdLvEHMqmqlFE2VStOrFEpa7feftT3rcbobBJEw=="],

-    "@anthropic-ai/claude-agent-sdk-linux-x64": ["@anthropic-ai/claude-agent-sdk-linux-x64@0.3.251", "", { "os": "linux", "cpu": "x64" }, "sha512-qCD87XPjcNM1u4ukqmcgpHDl3Y6l+cW8j7kPzH91Y5yLBYJ5xYZA2KtJ7AYNEPOteVyOGJw/efmva0S8CRr0fg=="],
+    "@anthropic-ai/claude-agent-sdk-linux-x64": ["@anthropic-ai/claude-agent-sdk-linux-x64@0.3.260", "", { "os": "linux", "cpu": "x64" }, "sha512-JR6MS8KeETQoxSaNtBFqCFV66QM+gsNeuWjXIhac4wXb19gRGiOcsCjBqQU8kadUYCBUabd6lKN2edwG6ETSXg=="],

-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": ["@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.251", "", { "os": "linux", "cpu": "x64" }, "sha512-SzXrdy7jjrjJIuTG+VMRAY0YZ3G/8w21WuhAozwnvnEUAPo6NDv6lgFinu7NO8J6CPE+MK2sGze6JeCF+ljgUg=="],
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": ["@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.260", "", { "os": "linux", "cpu": "x64" }, "sha512-JL07je0d2g680Hbu0D9W4hGuZlUeQlhPQac+NPKTJAdJ21bH12JdaMO5QE9RDNIxjd1BaodqMOdTEhjrH1capQ=="],

-    "@anthropic-ai/claude-agent-sdk-win32-arm64": ["@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.251", "", { "os": "win32", "cpu": "arm64" }, "sha512-FH1ZLcyc97ie3h7CSlIxA1ppXILgf0V8sFQrWnHyKBrthJXQkMHXhsTq9OZV/2KhXslNf2hTe0gHpZ1nCL1Gmg=="],
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": ["@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.260", "", { "os": "win32", "cpu": "arm64" }, "sha512-Fixnzgzxc0W6uGAwlp/zhoKsY+oLwHwE7y57lV8JhbGWHzK2gWPA9Q1s6TrR8A9sKPhmmHy7BrgTUundH2y2cQ=="],

-    "@anthropic-ai/claude-agent-sdk-win32-x64": ["@anthropic-ai/claude-agent-sdk-win32-x64@0.3.251", "", { "os": "win32", "cpu": "x64" }, "sha512-/jmtFIvfF0UFMxSZ8WV2Aus8aGA3+8Ft6AHvWuBJkY5jM2ubfqi6GnBjKCAL831TTllp2rKZlViANtWWRBvpvg=="],
+    "@anthropic-ai/claude-agent-sdk-win32-x64": ["@anthropic-ai/claude-agent-sdk-win32-x64@0.3.260", "", { "os": "win32", "cpu": "x64" }, "sha512-relNUBdfUSHVYmB04Nle5zJDykdT+FFLwcgz/SJc87Tj68jKT4vRSTeoDrE32kdmwhjFQ15HvmLGib41b9+xTA=="],

-    "@anthropic-ai/sdk": ["@anthropic-ai/sdk@0.122.0", "", { "dependencies": { "json-schema-to-ts": "^3.1.1", "standardwebhooks": "^1.0.0" }, "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["zod"], "bin": { "anthropic-ai-sdk": "bin/cli" } }, "sha512-GGPNftt0caaz9MDlmNQGHX8855Ojaduyy5pm9Sm1h7HalCn0cWNb5/bweadJF+4yzbal+QL6ztBa09WAAOzLmQ=="],
+    "@anthropic-ai/sdk": ["@anthropic-ai/sdk@0.123.0", "", { "dependencies": { "json-schema-to-ts": "^3.1.1", "standardwebhooks": "^1.0.0" }, "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["zod"], "bin": { "anthropic-ai-sdk": "bin/cli" } }, "sha512-Y9oX9mPNGZClHQOFqrWRk43Srcu/UHuPq3rfxxOq7JgW0gi+lJA2MAOK4Ul3k/+AUrwRWFJvd0tK3oC0Pw25dw=="],

    "@babel/helper-string-parser": ["@babel/helper-string-parser@8.0.0", "", {}, "sha512-6mJgmFFFIIO82vvoLt9XtRC7/TkzXfts1t/SpRX4IHSzMgqoPYCWesVu1udUPUWioAE/2fcG6WuI8zrkE1gwrg=="],

@@ -72,15 +72,15 @@

    "@hono/node-server": ["@hono/node-server@1.19.14", "", { "peerDependencies": { "hono": "^4" } }, "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw=="],

-    "@impeccable/cli-darwin-arm64": ["@impeccable/cli-darwin-arm64@0.1.2", "", { "os": "darwin", "cpu": "arm64", "bin": { "impeccable-darwin-arm64": "bin/impeccable" } }, "sha512-aqhLCxzbi2TAIyMXf2gsS5dzmdb0i1DKjovztulx0xWi2Q9W/WkpDXVoZ4GUhYXlykyQSKbiWzdGWZY4kgyHug=="],
+    "@impeccable/cli-darwin-arm64": ["@impeccable/cli-darwin-arm64@0.1.3", "", { "os": "darwin", "cpu": "arm64", "bin": { "impeccable-darwin-arm64": "bin/impeccable" } }, "sha512-O3ktatN7bev/boHuSS0VWjW2K+ecIDfUZZA9IMs1NAFJTfGjy5SZvFcZ7GTa0fuBvtg8HMMdKVQL2B3ZD+Ec9w=="],

-    "@impeccable/cli-darwin-x64": ["@impeccable/cli-darwin-x64@0.1.2", "", { "os": "darwin", "cpu": "x64", "bin": { "impeccable-darwin-x64": "bin/impeccable" } }, "sha512-UkL4MNCsSKNcgmXEulr+QAnn1zF0mkJcpEsev7Y26bwkgtcPAPnf0g4aDKjX6ISM0QKMmncAzB2AUUK0HhcI+Q=="],
+    "@impeccable/cli-darwin-x64": ["@impeccable/cli-darwin-x64@0.1.3", "", { "os": "darwin", "cpu": "x64", "bin": { "impeccable-darwin-x64": "bin/impeccable" } }, "sha512-NMzJc+TnDTV9H0bzEFQ575TSB5bQGlkH5dfya+uPnkO0CiYMM1ZVdYnYjXmBbv2/VydzcKOwDi19thvzrXyKaQ=="],

-    "@impeccable/cli-linux-arm64": ["@impeccable/cli-linux-arm64@0.1.2", "", { "os": "linux", "cpu": "arm64", "bin": { "impeccable-linux-arm64": "bin/impeccable" } }, "sha512-cLyQPpJ9fXzdrOLfHDzhPyDwjya2pP3fCwoBczJgFAdOdy3dNFXNUzWj+4e25zmyEdLKwf2zMvz3UDs2nXXR2Q=="],
+    "@impeccable/cli-linux-arm64": ["@impeccable/cli-linux-arm64@0.1.3", "", { "os": "linux", "cpu": "arm64", "bin": { "impeccable-linux-arm64": "bin/impeccable" } }, "sha512-qWEh+MsEkz8/KJYU+BYjEgaVAT6Ulueoe5Z/+TQg/Lnxl3cs8AS7581lVtn6VN1LpKZxEwwgrBadl1K/KuF6QA=="],

-    "@impeccable/cli-linux-x64": ["@impeccable/cli-linux-x64@0.1.2", "", { "os": "linux", "cpu": "x64", "bin": { "impeccable-linux-x64": "bin/impeccable" } }, "sha512-Ui5CSigBC/R9ZonI19F4MjASDnz4gm6IRCDGOtsOFqcYevqgtgVWoGDWLwCRJUmhZonT5fLPC2lwkPqnBW7QRQ=="],
+    "@impeccable/cli-linux-x64": ["@impeccable/cli-linux-x64@0.1.3", "", { "os": "linux", "cpu": "x64", "bin": { "impeccable-linux-x64": "bin/impeccable" } }, "sha512-UU3LofYNqQzb4Q44NbJvIGLUc3RnRt4/2PVcmXDnf64U34XxP/eDI6ETmDCtLhD9DI7AXzGpuBBtsHpIxDszyQ=="],

-    "@impeccable/cli-windows-x64": ["@impeccable/cli-windows-x64@0.1.2", "", { "os": "win32", "cpu": "x64", "bin": { "impeccable-windows-x64": "bin/impeccable.exe" } }, "sha512-9UXf7f+6F+P45rUBJP5TdPqR9RbLACvUbB2Rz5bpAgjhDDi+TJ0A6KPF1o2BOefbA6DZezuZvAQC2wxS1h1K5w=="],
+    "@impeccable/cli-windows-x64": ["@impeccable/cli-windows-x64@0.1.3", "", { "os": "win32", "cpu": "x64", "bin": { "impeccable-windows-x64": "bin/impeccable.exe" } }, "sha512-TsnU/SeskD/SlNxcrwig4t+9Gjh0fIF0loHhCUbD8RToD0vSfyLV3kVgUYMFkTgu4vcLtBJZt3e4Fd9XeBkjig=="],

    "@jridgewell/gen-mapping": ["@jridgewell/gen-mapping@0.3.13", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.0", "@jridgewell/trace-mapping": "^0.3.24" } }, "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA=="],

@@ -94,7 +94,7 @@

    "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="],

-    "@puppeteer/browsers": ["@puppeteer/browsers@3.2.1", "", { "dependencies": { "modern-tar": "^0.8.0", "yargs": "^18.0.0" }, "peerDependencies": { "proxy-agent": ">=8.0.1", "yauzl": "^2.10.0 || ^3.4.0" }, "optionalPeers": ["proxy-agent", "yauzl"], "bin": { "browsers": "lib/main-cli.js" } }, "sha512-KDz+3qDRdBAlRlMjmKyj6dEs33YHTk/xRHEENSXq6TNnhgoU15ruSHtEBeVF6OZ9tBDY55Se4P0nFMNsipzU9A=="],
+    "@puppeteer/browsers": ["@puppeteer/browsers@3.2.2", "", { "dependencies": { "modern-tar": "^0.8.4", "yargs": "^18.0.0" }, "peerDependencies": { "proxy-agent": ">=8.0.1", "yauzl": "^2.10.0 || ^3.4.0" }, "optionalPeers": ["proxy-agent", "yauzl"], "bin": { "browsers": "lib/main-cli.js" } }, "sha512-q2BU4YfO9h/Wt7IcWPcggpOOqLk2Tbs1hDwolvKZrweRjy751OJBKMN9zO5bfD0pzU7X/tvKw/exQds4pM/LOg=="],

    "@stablelib/base64": ["@stablelib/base64@1.0.1", "", {}, "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ=="],

@@ -104,8 +104,6 @@

    "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],

-    "@types/trusted-types": ["@types/trusted-types@2.0.7", "", {}, "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw=="],
-
    "@vercel/oidc": ["@vercel/oidc@3.2.0", "", {}, "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug=="],

    "@workflow/serde": ["@workflow/serde@4.1.0", "", {}, "sha512-pav4F2BoirECWR7Nf1TKt+2eETcBj7jj4cBefQ8VXQCA6NPkaKeLfj/zMgi+3zYV5ZIBT4GuUiphsj0/b9hPQQ=="],
@@ -360,9 +358,9 @@

    "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="],

-    "puppeteer": ["puppeteer@25.9.0", "", { "dependencies": { "@puppeteer/browsers": "3.2.1", "chromium-bidi": "17.0.2", "devtools-protocol": "0.0.1666840", "lilconfig": "^3.1.3", "puppeteer-core": "25.9.0", "typed-query-selector": "^2.12.2" }, "bin": { "puppeteer": "lib/puppeteer/node/cli.js" } }, "sha512-2JqQszD2pyDTpIvBH1ZCXdrHgENVNdJIeOM6asbwHRgWknFiaLd1gNB91w/B/0hQHNpafkpxa90lPpBaJM87Hw=="],
+    "puppeteer": ["puppeteer@25.10.0", "", { "dependencies": { "@puppeteer/browsers": "3.2.2", "chromium-bidi": "17.0.2", "devtools-protocol": "0.0.1666840", "lilconfig": "^3.1.3", "puppeteer-core": "25.10.0", "typed-query-selector": "^2.12.2" }, "bin": { "puppeteer": "lib/puppeteer/node/cli.js" } }, "sha512-9ZfkiaZDQWpGPJp9XTS+Bkn/D78hPvYmtjPfIBeybn05oeY6Jj7aiSbYdfcSQD2UMvC0vE7Yi9PSDo179euRzw=="],

-    "puppeteer-core": ["puppeteer-core@25.9.0", "", { "dependencies": { "@puppeteer/browsers": "3.2.1", "chromium-bidi": "17.0.2", "devtools-protocol": "0.0.1666840", "typed-query-selector": "^2.12.2", "webdriver-bidi-protocol": "0.4.2", "ws": "^8.21.3" } }, "sha512-U61rCwSMha62CA/Opy6tCx2Fx+ck7ouiKnbpEApzSoLYMoEu9F71nuFpHL55vmIt33/GYm6eKZVhH2ev0nAIeg=="],
+    "puppeteer-core": ["puppeteer-core@25.10.0", "", { "dependencies": { "@puppeteer/browsers": "3.2.2", "chromium-bidi": "17.0.2", "devtools-protocol": "0.0.1666840", "typed-query-selector": "^2.12.2", "webdriver-bidi-protocol": "0.4.3", "ws": "^8.21.3" } }, "sha512-Hy5eMQshOEMil4JUUx03h5pw1HYkYCso1RG/gcpPlFSd4cYPOcopxcXEAxpLPOkOPJb9LIJtwxuj66bSdvknFg=="],

    "qs": ["qs@6.15.1", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg=="],

@@ -412,7 +410,7 @@

    "strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="],

-    "svelte": ["svelte@5.56.10", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "@jridgewell/sourcemap-codec": "^1.5.0", "@sveltejs/acorn-typescript": "^1.0.10", "@types/estree": "^1.0.5", "@types/trusted-types": "^2.0.7", "acorn": "^8.12.1", "aria-query": "5.3.1", "axobject-query": "^4.1.0", "clsx": "^2.1.1", "devalue": "^5.8.1", "esm-env": "^1.2.1", "esrap": "^2.2.12", "is-reference": "^3.0.3", "locate-character": "^3.0.0", "magic-string": "^0.30.11", "zimmerframe": "^1.1.2" } }, "sha512-Lcxbj8I/KAbpY+VjtY4ENQBV0dDCipfGAhqb51XQZ67CIQqXgsv/8dPkbILaj4Fb6/b6JAEM/PIVbILXgDQy2g=="],
+    "svelte": ["svelte@5.57.0", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "@jridgewell/sourcemap-codec": "^1.5.0", "@sveltejs/acorn-typescript": "^1.0.10", "@types/estree": "^1.0.5", "acorn": "^8.12.1", "aria-query": "5.3.1", "axobject-query": "^4.1.0", "clsx": "^2.1.1", "devalue": "^5.8.1", "esm-env": "^1.2.1", "esrap": "^2.2.12", "is-reference": "^3.0.3", "locate-character": "^3.0.0", "magic-string": "^0.30.11", "zimmerframe": "^1.1.2" } }, "sha512-NdbDn7fl4be1ViUG0oq/lvG6OZy3oENolV2ONjiqqsfVoeAfzaQAKUcEX3MrQod/Bebv1PgwET9rfXhgn9s4Kg=="],

    "tar-stream": ["tar-stream@3.1.8", "", { "dependencies": { "b4a": "^1.6.4", "bare-fs": "^4.5.5", "fast-fifo": "^1.2.0", "streamx": "^2.15.0" } }, "sha512-U6QpVRyCGHva435KoNWy9PRoi2IFYCgtEhq9nmrPPpbRacPs9IH4aJ3gbrFC8dPcXvdSZ4XXfXT5Fshbp2MtlQ=="],

@@ -436,7 +434,7 @@

    "vary": ["vary@1.1.2", "", {}, "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="],

-    "webdriver-bidi-protocol": ["webdriver-bidi-protocol@0.4.2", "", {}, "sha512-VSV+fzfChirL3e7jay2yUC7B4HQCGtEWEg/MSSQbK+qWbqeGlRLlXTzPpYr3XGUvbpDHumWZBJxgesg4N7dbtA=="],
+    "webdriver-bidi-protocol": ["webdriver-bidi-protocol@0.4.3", "", {}, "sha512-uuN0goWfxP22B7J/uAgBpOYNPttC+XVseYE+rSY5+rQ+YBeVz/VORw8WbmLVcqW78zNg5A4qnjNXYUWR3il2ig=="],

    "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],

@@ -456,7 +454,7 @@

    "zip-stream": ["zip-stream@7.0.5", "", { "dependencies": { "compress-commons": "^7.0.0", "normalize-path": "^3.0.0", "readable-stream": "^4.0.0" } }, "sha512-dSvYKdvLsAHCDqPOhIwk/q5CvuWtTB3Dgpoe0uVEFjTzIOAmsQpprX25InCvrvJsirEbu1OHyy67n/kAj1Sw/w=="],

-    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+    "zod": ["zod@4.5.4", "", {}, "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA=="],

    "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],

@@ -21,5 +21,7 @@ once_cell = { workspace = true }
 sha2 = "0.10"
 flate2 = { version = "1", default-features = false, features = ["zlib-rs"] }
 ureq = { version = "2", default-features = false, features = ["tls", "json"] }
+rustls-native-certs = "0.8"
+webpki-roots = "1"
 tiny_http = "0.12"
 unicode-normalization = "0.1.25"
@@ -47,7 +47,7 @@ fn card_base(env: &Env) -> String {
 }

 fn agent(timeout: Duration) -> ureq::Agent {
-    ureq::AgentBuilder::new().timeout_connect(timeout).timeout(timeout).build()
+    crate::http::agent_builder().timeout_connect(timeout).timeout(timeout).build()
 }

 /// URLSearchParams serialization (application/x-www-form-urlencoded).
@@ -468,7 +468,7 @@ fn fetch_latest_skill_version(env: &Env) -> Option<String> {
        .cloned()
        .unwrap_or_else(|| "https://impeccable.style".to_string());
    let host = host.strip_suffix('/').unwrap_or(&host).to_string();
-    let agent = ureq::AgentBuilder::new()
+    let agent = crate::http::agent_builder()
        .timeout(std::time::Duration::from_millis(FETCH_TIMEOUT_MS))
        .build();
    let res = agent.get(&format!("{}/api/version", host)).call().ok()?;
@@ -3,7 +3,7 @@
 use crate::context::resolve_project_root;
 use crate::jsp;
 use crate::target_args::TargetOptions;
-use crate::target_slug::slug_from_target;
+use crate::target_slug::{legacy_slug_from_target, slug_from_target};
 use crate::util::{exists, iso_now, js_trim, json_pretty, node_read_error, read_dir_names, safe_read, Env};
 use impeccable_common::Io;
 use serde_json::{Map, Value};
@@ -393,6 +393,51 @@ fn coerce_slug(value: Option<&str>, cwd: &str) -> Option<String> {
    slug_from_target(Some(v), cwd)
 }

+fn slug_candidates(value: Option<&str>, cwd: &str) -> Vec<String> {
+    let Some(v) = value.filter(|v| !v.is_empty()) else {
+        return vec![];
+    };
+    if is_ready_slug(v) {
+        return vec![v.to_string()];
+    }
+    let mut slugs = Vec::new();
+    if let Some(slug) = slug_from_target(Some(v), cwd) {
+        slugs.push(slug);
+    }
+    if let Some(legacy) = legacy_slug_from_target(Some(v), cwd) {
+        if !slugs.contains(&legacy) {
+            slugs.push(legacy);
+        }
+    }
+    slugs
+}
+
+fn read_newest_safe_snapshot_for_slugs(
+    slugs: &[String],
+    target_identity: Option<&str>,
+    cwd: &str,
+    env: &Env,
+) -> Option<Snapshot> {
+    let current = slugs.first().and_then(|slug| read_newest_snapshot(slug, cwd, env));
+    let legacy = target_identity.and_then(|identity| {
+        slugs.get(1).and_then(|slug| read_newest_snapshot_for_identity(slug, Some(identity), cwd, env))
+    });
+    current.into_iter().chain(legacy).max_by(|a, b| a.path.cmp(&b.path))
+}
+
+fn read_newest_snapshot_for_identity_slugs(
+    slugs: &[String],
+    target_identity: Option<&str>,
+    cwd: &str,
+    env: &Env,
+) -> Option<Snapshot> {
+    let current = slugs.first().and_then(|slug| read_newest_snapshot_for_identity(slug, target_identity, cwd, env));
+    let legacy = target_identity.and_then(|identity| {
+        slugs.get(1).and_then(|slug| read_newest_snapshot_for_identity(slug, Some(identity), cwd, env))
+    });
+    current.into_iter().chain(legacy).max_by(|a, b| a.path.cmp(&b.path))
+}
+
 pub fn run(args: &[String], io: &mut Io) -> i32 {
    let cwd = io.cwd.to_string_lossy().into_owned();
    let env = io.env.clone();
@@ -493,26 +538,30 @@ pub fn run(args: &[String], io: &mut Io) -> i32 {
        "latest" => {
            let target = rest.first().map(String::as_str).unwrap_or("");
            let format = rest.get(1).map(String::as_str);
-            let slug_opt = coerce_slug(rest.first().map(String::as_str), &cwd);
+            let slugs = slug_candidates(rest.first().map(String::as_str), &cwd);
            // JS: format && format !== '--json'  (format truthy = non-empty)
            let bad_format = format.map(|f| !f.is_empty() && f != "--json").unwrap_or(false);
-            let Some(slug) = slug_opt.filter(|_| !bad_format) else {
+            if slugs.is_empty() || bad_format {
                io.err("usage: latest <slug-or-target> [--json]\n");
                return 1;
-            };
+            }
            let format_is_json = format == Some("--json");
            let target_fingerprint = fingerprint_target(target, &cwd);
            let target_path = resolve_local_target_path(target, &cwd);
            let target_identity = resolve_target_identity(target, &cwd);
            let ready_slug = is_ready_slug(target);
-            let Some(newest_for_slug) = read_newest_snapshot(&slug, &cwd, &env) else {
+            let Some(newest_for_slug) =
+                read_newest_safe_snapshot_for_slugs(&slugs, target_identity.as_deref(), &cwd, &env)
+            else {
                return 2;
            };
-            let mut latest = read_newest_snapshot_for_identity(&slug, target_identity.as_deref(), &cwd, &env);
+            let mut latest =
+                read_newest_snapshot_for_identity_slugs(&slugs, target_identity.as_deref(), &cwd, &env);
            if latest.is_none() && !ready_slug {
-                // Legacy snapshots have no identity; preserve their old explicit
-                // path/URL behavior only when no known identity was selected.
-                latest = read_newest_snapshot_for_identity(&slug, None, &cwd, &env);
+                // Identity-less snapshots are safe only under the new/current
+                // collision-resistant slug. A pre-hash slug suffix alone cannot
+                // prove which long target owned the historical snapshot.
+                latest = slugs.first().and_then(|slug| read_newest_snapshot_for_identity(slug, None, &cwd, &env));
            }
            let latest = latest.unwrap_or(newest_for_slug);
            if meta_closed(&latest) {
@@ -520,10 +569,6 @@ pub fn run(args: &[String], io: &mut Io) -> i32 {
            }
            let recorded_target_identity = snapshot_target_identity(&latest);
            let matching_identity = recorded_target_identity == target_identity;
-            if ready_slug && recorded_target_identity.is_none() {
-                io.err("ambiguous legacy snapshot target; use an explicit ./path or full URL\n");
-                return 2;
-            }
            if ready_slug && target_path.as_deref().map(exists).unwrap_or(false) && !matching_identity {
                io.err("ambiguous snapshot slug; use an explicit ./path or remove the local name collision\n");
                return 2;
@@ -564,17 +609,16 @@ pub fn run(args: &[String], io: &mut Io) -> i32 {
        "close" => {
            let slug_arg = rest.first().map(String::as_str).unwrap_or("");
            let snapshot_file = rest.get(1).map(String::as_str);
-            let slug = coerce_slug(rest.first().map(String::as_str), &cwd);
+            let slugs = slug_candidates(rest.first().map(String::as_str), &cwd);
            let snapshot_file_ok = snapshot_file.map(|s| !s.is_empty()).unwrap_or(false);
-            if slug.is_none() || !snapshot_file_ok || rest.len() > 2 {
+            if slugs.is_empty() || !snapshot_file_ok || rest.len() > 2 {
                io.err("usage: close <resolved-target> <snapshot-file>\n");
                return 1;
            }
-            let slug = slug.unwrap();
            let snapshot_file = snapshot_file.unwrap();
            if jsp::basename(snapshot_file) != snapshot_file
                || !is_snapshot_name(snapshot_file)
-                || !snapshot_file.ends_with(&format!("__{}.md", slug))
+                || !slugs.iter().any(|slug| snapshot_file.ends_with(&format!("__{}.md", slug)))
            {
                return 2;
            }
@@ -592,6 +636,10 @@ pub fn run(args: &[String], io: &mut Io) -> i32 {
            // JS #660: a slug + filename does not prove ownership; require the
            // resolved target to match a modern snapshot's recorded identity.
            let recorded_target_identity = snapshot_target_identity(&snapshot);
+            let legacy_match = slugs.get(1).is_some_and(|slug| snapshot_file.ends_with(&format!("__{}.md", slug)));
+            if legacy_match && recorded_target_identity.is_none() {
+                return 2;
+            }
            if let Some(rid) = &recorded_target_identity {
                if Some(rid.clone()) != resolve_target_identity(slug_arg, &cwd) {
                    return 2;
@@ -610,12 +658,34 @@ pub fn run(args: &[String], io: &mut Io) -> i32 {
            }
        }
        "trend" => {
-            let slug = coerce_slug(rest.first().map(String::as_str), &cwd).unwrap_or_else(|| "null".to_string());
+            let mut slugs = slug_candidates(rest.first().map(String::as_str), &cwd);
+            if slugs.is_empty() {
+                slugs.push("null".to_string());
+            }
            let limit: f64 = match rest.get(1).filter(|s| !s.is_empty()) {
                Some(l) => js_number(l),
                None => 5.0,
            };
-            let all = list_snapshots(&format!("__{}.md", slug), &cwd, &env);
+            let target = rest.first().map(String::as_str).unwrap_or("");
+            let target_identity = resolve_target_identity(target, &cwd);
+            let mut all: Vec<String> = slugs
+                .first()
+                .into_iter()
+                .flat_map(|slug| list_snapshots(&format!("__{}.md", slug), &cwd, &env))
+                .collect();
+            if let Some(legacy) = slugs.get(1) {
+                all.extend(
+                    list_snapshots(&format!("__{}.md", legacy), &cwd, &env)
+                        .into_iter()
+                        .filter(|path| {
+                            read_snapshot_at(path)
+                                .and_then(|snapshot| snapshot_target_identity(&snapshot))
+                                .as_deref()
+                                == target_identity.as_deref()
+                        }),
+                );
+            }
+            all.sort();
            let slice = js_slice_last(&all, limit);
            let rows: Vec<Value> = slice
                .iter()
@@ -807,4 +877,80 @@ mod tests_660 {
        assert!(out.contains("\"body\":"));
        let _ = std::fs::remove_dir_all(&cwd);
    }
+
+    #[test]
+    fn explicit_long_targets_find_and_close_pre_hash_snapshots() {
+        let cwd = tmp();
+        let dir = jsp::join(&[&cwd, ".impeccable", "critique"]);
+        std::fs::create_dir_all(&dir).unwrap();
+        let target = "https://example.com/a-very-long-directory-structure-with-many-segments/component-name";
+        let legacy_slug = legacy_slug_from_target(Some(target), &cwd).unwrap();
+        assert_ne!(legacy_slug, slug_from_target(Some(target), &cwd).unwrap());
+        let name = format!("2026-05-12T18-30-00Z__{legacy_slug}.md");
+        let identity = resolve_target_identity(target, &cwd).unwrap();
+        let body = format!(
+            "---\ntarget_identity: {}\nslug: {}\n---\n# Legacy critique\n",
+            serde_json::to_string(&identity).unwrap(),
+            legacy_slug
+        );
+        std::fs::write(jsp::join(&[&dir, &name]), body).unwrap();
+
+        let (code, out, _) = run_capture(&cwd, &["latest", target, "--json"]);
+        assert_eq!(code, 0);
+        assert!(out.contains(&name));
+
+        let (code, out, _) = run_capture(&cwd, &["trend", target, "5"]);
+        assert_eq!(code, 0);
+        assert!(out.contains(&legacy_slug));
+
+        let (code, _, _) = run_capture(&cwd, &["close", target, &name]);
+        assert_eq!(code, 0);
+        assert!(std::fs::read_to_string(jsp::join(&[&dir, &name])).unwrap().contains("closed: true"));
+
+        let _ = std::fs::remove_dir_all(&cwd);
+    }
+
+    #[test]
+    fn pre_hash_slug_collisions_require_matching_identity() {
+        let cwd = tmp();
+        let dir = jsp::join(&[&cwd, ".impeccable", "critique"]);
+        std::fs::create_dir_all(&dir).unwrap();
+        let target = "https://example.com/first-prefix-that-is-long-enough/a-very-long-shared-tail/component-name";
+        let collision = "https://example.com/second-prefix-that-is-long-enough/a-very-long-shared-tail/component-name";
+        let legacy_slug = legacy_slug_from_target(Some(target), &cwd).unwrap();
+        assert_eq!(legacy_slug, legacy_slug_from_target(Some(collision), &cwd).unwrap());
+        assert_ne!(slug_from_target(Some(target), &cwd), slug_from_target(Some(collision), &cwd));
+
+        let unidentified_name = format!("2026-05-12T18-30-00Z__{legacy_slug}.md");
+        let unidentified_body = format!("---\nslug: {legacy_slug}\n---\n# Ambiguous legacy critique\n");
+        std::fs::write(jsp::join(&[&dir, &unidentified_name]), unidentified_body).unwrap();
+
+        assert_eq!(run_capture(&cwd, &["latest", target]).0, 2);
+        assert_eq!(run_capture(&cwd, &["latest", collision]).0, 2);
+        assert_eq!(run_capture(&cwd, &["trend", target, "5"]).1.trim(), "[]");
+        assert_eq!(run_capture(&cwd, &["close", target, &unidentified_name]).0, 2);
+        let (code, out, _) = run_capture(&cwd, &["latest", &legacy_slug]);
+        assert_eq!(code, 0);
+        assert!(out.contains("# Ambiguous legacy critique"));
+        assert!(run_capture(&cwd, &["trend", &legacy_slug, "5"]).1.contains(&legacy_slug));
+        assert_eq!(run_capture(&cwd, &["close", &legacy_slug, &unidentified_name]).0, 0);
+
+        let identified_name = format!("2026-05-12T18-31-00Z__{legacy_slug}.md");
+        let identity = resolve_target_identity(target, &cwd).unwrap();
+        let identified_body = format!(
+            "---\ntarget_identity: {}\nslug: {}\n---\n# Identified legacy critique\n",
+            serde_json::to_string(&identity).unwrap(),
+            legacy_slug
+        );
+        std::fs::write(jsp::join(&[&dir, &identified_name]), identified_body).unwrap();
+
+        assert_eq!(run_capture(&cwd, &["latest", target]).0, 0);
+        assert_eq!(run_capture(&cwd, &["latest", collision]).0, 2);
+        assert!(run_capture(&cwd, &["trend", target, "5"]).1.contains("target_identity"));
+        assert_eq!(run_capture(&cwd, &["trend", collision, "5"]).1.trim(), "[]");
+        assert_eq!(run_capture(&cwd, &["close", collision, &identified_name]).0, 2);
+        assert_eq!(run_capture(&cwd, &["close", target, &identified_name]).0, 0);
+
+        let _ = std::fs::remove_dir_all(&cwd);
+    }
 }
@@ -167,7 +167,11 @@ fn walk(root: &str, dir: &str, depth: usize, hits: &mut Hits) {
        let Ok(bytes) = std::fs::read(&abs) else { continue };
        let slice = if bytes.len() > MAX_READ_BYTES { &bytes[..MAX_READ_BYTES] } else { &bytes[..] };
        let body = String::from_utf8_lossy(slice);
-        visit(root, &abs, &jsp::relative("/", root, &abs), &body, hits);
+        // Candidate patterns use '/', while native Windows relative paths
+        // use '\\'. Normalize once for classification and portable signals;
+        // to_posix preserves literal backslashes in Unix filenames.
+        let rel = jsp::to_posix(&jsp::relative("/", root, &abs));
+        visit(root, &abs, &rel, &body, hits);
    }
 }

@@ -197,3 +201,88 @@ pub fn run(_args: &[String], io: &mut Io) -> i32 {
    io.out(&format!("{}\n", json_pretty(&v)));
    0
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    static NEXT_FIXTURE: AtomicUsize = AtomicUsize::new(0);
+
+    struct Fixture(PathBuf);
+
+    impl Fixture {
+        fn new() -> Self {
+            loop {
+                let root = std::env::temp_dir().join(format!(
+                    "impeccable-csp-761-{}-{}",
+                    std::process::id(), NEXT_FIXTURE.fetch_add(1, Ordering::Relaxed),
+                ));
+                match std::fs::create_dir(&root) {
+                    Ok(()) => return Self(root),
+                    // Never reuse or remove files left by another run.
+                    Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                    Err(e) => panic!("create CSP fixture: {e}"),
+                }
+            }
+        }
+
+        fn scan(&self, path: &str, body: &str) -> Value {
+            let file = self.0.join(path);
+            std::fs::create_dir_all(file.parent().unwrap()).unwrap();
+            std::fs::write(file, body).unwrap();
+            detect_csp(self.0.to_str().unwrap())
+        }
+    }
+
+    impl Drop for Fixture {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn nested_csp_candidates_use_portable_paths() {
+        // Exercise the filesystem walker and native path.relative semantics,
+        // not just regexes with pre-normalized input. Windows CI reproduces #761.
+        for (path, body, shape) in [
+            ("packages/app/src/security/csp.ts", "buildCSPConfig()", "append-arrays"),
+            ("packages/app/src/next-config.ts", "createBaseNextConfig()", "append-arrays"),
+            ("apps/web/svelte.config.js", "kit: { csp: { directives: {} } }", "append-arrays"),
+            ("apps/web/nuxt.config.ts", "'nuxt-security'; contentSecurityPolicy", "append-arrays"),
+            ("apps/web/next.config.mjs", "'Content-Security-Policy': 'script-src self; connect-src self'", "append-string"),
+            ("next.config.mjs", "'Content-Security-Policy': 'script-src self; connect-src self'", "append-string"),
+            ("apps/web/src/middleware.ts", "headers.set('Content-Security-Policy', policy)", "middleware"),
+            ("apps/web/src/layout.astro", "<meta http-equiv='Content-Security-Policy'>", "meta-tag"),
+        ] {
+            assert_eq!(Fixture::new().scan(path, body), serde_json::json!({
+                "shape": shape, "signals": [path],
+            }), "{path}");
+        }
+    }
+
+    #[test]
+    fn unrelated_nested_files_are_not_csp_candidates() {
+        for (path, body) in [
+            ("packages/app/src/utils/csp.ts", "buildCSPConfig()"),
+            ("apps/web/not-svelte.config.js", "kit: { csp: { directives: {} } }"),
+            ("apps/web/next.config.mjs", "'Content-Security-Policy': 'script-src self'"),
+        ] {
+            assert_eq!(Fixture::new().scan(path, body), serde_json::json!({
+                "shape": null, "signals": [],
+            }), "{path}");
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn posix_backslashes_remain_literal_filename_characters() {
+        let result = Fixture::new().scan(
+            "packages/app/src/config\\notes.ts", "buildCSPConfig()",
+        );
+        assert_eq!(result, serde_json::json!({
+            "shape": "append-arrays", "signals": ["packages/app/src/config\\notes.ts"],
+        }));
+    }
+}
@@ -294,7 +294,7 @@ pub fn run(args: &[String], io: &mut Io) -> i32 {
            }
        }
    }
-    let agent = ureq::AgentBuilder::new().build();
+    let agent = crate::http::agent_builder().build();
    let response = if !refs.is_empty() {
        let boundary = format!("----impeccable{:x}", crate::util::now_ms() as u64);
        let mut body: Vec<u8> = Vec::new();
@@ -0,0 +1,104 @@
+//! One TLS trust configuration for every HTTPS request the engine makes.
+//!
+//! `ureq`'s default rustls config trusts only the Mozilla roots compiled in
+//! through `webpki-roots`. On a machine where an endpoint security agent
+//! inspects TLS (Aikido, Zscaler, Netskope: routine in managed corporate
+//! setups), every connection terminates at a proxy whose root lives in the
+//! OS trust store and nowhere else, so `update` and `install` failed with
+//! `invalid peer certificate: UnknownIssuer` while curl and npm on the same
+//! machine succeeded (#757).
+//!
+//! The store built here is the union of the OS trust store
+//! (`rustls-native-certs`: the macOS Keychain, the Windows store, the
+//! OpenSSL paths on Linux) and the bundled Mozilla roots. A union, not a
+//! replacement: a container without `ca-certificates`, or a store that
+//! fails to load, verifies against the bundled roots exactly as before.
+//! `SSL_CERT_FILE` / `SSL_CERT_DIR` stand in for the OS store, as they do
+//! for OpenSSL and curl; the bundled roots stay either way.
+
+use std::sync::Arc;
+
+use once_cell::sync::Lazy;
+use ureq::rustls::pki_types::CertificateDer;
+use ureq::rustls::{self, ClientConfig, RootCertStore};
+
+/// `ureq::AgentBuilder::new()` with the engine's trust store installed.
+/// Every HTTPS call site builds its agent from this; the plain-HTTP calls
+/// to the live server on localhost do not need it.
+pub fn agent_builder() -> ureq::AgentBuilder {
+    ureq::AgentBuilder::new().tls_config(tls_config())
+}
+
+fn tls_config() -> Arc<ClientConfig> {
+    static CONFIG: Lazy<Arc<ClientConfig>> = Lazy::new(|| {
+        // Mirrors ureq's own default config (provider and protocol versions);
+        // only the root store differs.
+        let config =
+            ClientConfig::builder_with_provider(rustls::crypto::ring::default_provider().into())
+                .with_protocol_versions(&[&rustls::version::TLS12, &rustls::version::TLS13])
+                .expect("the ring provider supports TLS 1.2 and 1.3")
+                .with_root_certificates(root_store(rustls_native_certs::load_native_certs().certs))
+                .with_no_client_auth();
+        Arc::new(config)
+    });
+    CONFIG.clone()
+}
+
+/// The bundled Mozilla roots plus every parsable certificate in `native`.
+/// Unparsable entries are dropped, so one broken certificate in the OS
+/// store cannot take the bundled roots down with it.
+fn root_store(native: Vec<CertificateDer<'static>>) -> RootCertStore {
+    let mut store = RootCertStore {
+        roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+    };
+    store.add_parsable_certificates(native);
+    store
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ureq::rustls::pki_types::pem::PemObject;
+
+    /// Self-signed CA minted for this test (P-256, v3, CA:TRUE): the shape
+    /// of the root a TLS-inspecting proxy installs into the OS store.
+    const PROXY_ROOT_PEM: &str = "-----BEGIN CERTIFICATE-----
+MIIBdTCCARugAwIBAgIJANhTZvQvv7HJMAoGCCqGSM49BAMCMB0xGzAZBgNVBAMM
+EmltcGVjY2FibGUgdGVzdCBDQTAgFw0yNjA5MDcwNjQxMjdaGA8yMTI2MDgxNDA2
+NDEyN1owHTEbMBkGA1UEAwwSaW1wZWNjYWJsZSB0ZXN0IENBMFkwEwYHKoZIzj0C
+AQYIKoZIzj0DAQcDQgAEYVZtCOXaZsY71/0Roy62iBVcyx8UfMDkPbEbf/IEw5Bm
+yNBfKTFS/8FbRBMWHXOwNE0Ns1BLVOB1oQ1XFC5Bz6NCMEAwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFONzBxi7ewOfuP6cBIIqsxu
+3pEiMAoGCCqGSM49BAMCA0gAMEUCIQD98Q0ZRe8ceuopnUwQKYleZd5IzfWhhpmO
+tB0WGTOG3QIgdJa8gBPU9Y6WsrursItsnUeGTYHKDCZZ6MjlekLFuoc=
+-----END CERTIFICATE-----
+";
+
+    fn bundled() -> usize {
+        webpki_roots::TLS_SERVER_ROOTS.len()
+    }
+
+    #[test]
+    fn bundled_roots_alone_when_the_os_store_is_empty() {
+        assert_eq!(root_store(Vec::new()).len(), bundled());
+    }
+
+    #[test]
+    fn os_store_root_joins_the_bundled_roots() {
+        let proxy = CertificateDer::from_pem_slice(PROXY_ROOT_PEM.as_bytes()).unwrap();
+        assert_eq!(root_store(vec![proxy]).len(), bundled() + 1);
+    }
+
+    #[test]
+    fn unparsable_os_store_entry_is_dropped() {
+        let junk = CertificateDer::from(b"not a certificate".to_vec());
+        assert_eq!(root_store(vec![junk]).len(), bundled());
+    }
+
+    #[test]
+    fn agent_builds_from_this_hosts_store() {
+        // Runs the real rustls-native-certs load: it must not panic, and the
+        // shared config must be accepted by a ureq agent.
+        let _agent = agent_builder().build();
+    }
+}
@@ -5,6 +5,7 @@
 pub mod jsp;
 pub mod util;
 pub mod url;
+pub mod http;
 pub mod provider;
 pub mod hook_markers;
 pub mod target_args;
@@ -1,7 +1,7 @@
 //! JS: lib/surface-briefs.mjs

 use crate::jsp;
-use crate::target_slug::slug_from_target;
+use crate::target_slug::{legacy_slug_from_target, slug_from_target};
 use crate::url;
 use crate::util::{exists, js_trim, read_dir_names, safe_read};
 use serde_json::{Map, Value};
@@ -87,6 +87,16 @@ pub fn surface_brief_path_for_target(target: Option<&str>, project_root: &str) -
    Some(jsp::join(&[&get_surface_brief_dir(project_root), &format!("{}.md", slug)]))
 }

+fn legacy_surface_brief_path_for_target(target: Option<&str>, project_root: &str) -> Option<String> {
+    let normalized = normalize_surface_target(target, project_root)?;
+    let slug_input = match normalized.strip_prefix("route:") {
+        Some(rest) => format!("route{}", rest),
+        None => normalized.clone(),
+    };
+    let slug = legacy_slug_from_target(Some(&slug_input), project_root)?;
+    Some(jsp::join(&[&get_surface_brief_dir(project_root), &format!("{}.md", slug)]))
+}
+
 #[derive(Debug, Clone)]
 pub struct SurfaceBrief {
    pub path: Option<String>,
@@ -260,10 +270,17 @@ pub fn resolve_surface_brief(project_root: &str, target: Option<&str>) -> Surfac
        return SurfaceResolution { brief: None, candidates: briefs, reason: "invalid-target" };
    };
    let exact_path = surface_brief_path_for_target(Some(&normalized), project_root);
-    if let Some(exact) = briefs
+    let legacy_path = legacy_surface_brief_path_for_target(Some(&normalized), project_root);
+    let exact = briefs
        .iter()
        .find(|b| b.path == exact_path && (b.targets.is_empty() || b.targets.contains(&normalized)))
-    {
+        .or_else(|| {
+            // Pre-hash long slugs can collide because they contain only the
+            // target suffix. Require the legacy brief's metadata to prove it
+            // belongs to this target before accepting that compatibility path.
+            briefs.iter().find(|b| b.path == legacy_path && b.targets.contains(&normalized))
+        });
+    if let Some(exact) = exact {
        return SurfaceResolution { brief: Some(exact.clone()), candidates: briefs, reason: "slug" };
    }
    let mapped: Vec<SurfaceBrief> = briefs.iter().filter(|b| b.targets.contains(&normalized)).cloned().collect();
@@ -309,3 +326,76 @@ pub fn write_surface_brief(
    std::fs::write(&file_path, content).map_err(|e| e.to_string())?;
    Ok(file_path)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicUsize, Ordering};
+
+    static TMP_SEQ: AtomicUsize = AtomicUsize::new(0);
+
+    #[test]
+    fn resolves_pre_hash_long_slug_briefs() {
+        let root = std::env::temp_dir().join(format!(
+            "impeccable-surface-legacy-{}-{}",
+            std::process::id(),
+            TMP_SEQ.fetch_add(1, Ordering::Relaxed)
+        ));
+        let root = root.to_string_lossy().into_owned();
+        let target = "src/a-very-long-directory-structure-with-many-segments/component-name.tsx";
+        let legacy = legacy_surface_brief_path_for_target(Some(target), &root).unwrap();
+        let current = surface_brief_path_for_target(Some(target), &root).unwrap();
+        assert_ne!(legacy, current);
+
+        std::fs::create_dir_all(get_surface_brief_dir(&root)).unwrap();
+        let normalized = normalize_surface_target(Some(target), &root).unwrap();
+        let legacy_body = format!(
+            "---\nprimary_target: {}\n---\n# Legacy brief\n",
+            serde_json::to_string(&normalized).unwrap()
+        );
+        std::fs::write(&legacy, legacy_body).unwrap();
+
+        let resolved = resolve_surface_brief(&root, Some(target));
+        assert_eq!(resolved.reason, "slug");
+        assert_eq!(resolved.brief.unwrap().path.as_deref(), Some(legacy.as_str()));
+
+        std::fs::write(&current, "# Current brief\n").unwrap();
+        let resolved = resolve_surface_brief(&root, Some(target));
+        assert_eq!(resolved.brief.unwrap().path.as_deref(), Some(current.as_str()));
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    #[test]
+    fn rejects_unmapped_pre_hash_slug_collisions() {
+        let root = std::env::temp_dir().join(format!(
+            "impeccable-surface-legacy-collision-{}-{}",
+            std::process::id(),
+            TMP_SEQ.fetch_add(1, Ordering::Relaxed)
+        ));
+        let root = root.to_string_lossy().into_owned();
+        let target = "src/first-prefix-that-is-long-enough/a-very-long-shared-tail/component-name.tsx";
+        let collision = "src/second-prefix-that-is-long-enough/a-very-long-shared-tail/component-name.tsx";
+        let legacy = legacy_surface_brief_path_for_target(Some(target), &root).unwrap();
+        assert_eq!(legacy, legacy_surface_brief_path_for_target(Some(collision), &root).unwrap());
+        assert_ne!(
+            surface_brief_path_for_target(Some(target), &root),
+            surface_brief_path_for_target(Some(collision), &root)
+        );
+
+        std::fs::create_dir_all(get_surface_brief_dir(&root)).unwrap();
+        std::fs::write(&legacy, "# Unmapped legacy brief\n").unwrap();
+        assert_eq!(resolve_surface_brief(&root, Some(target)).reason, "not-found");
+
+        let normalized = normalize_surface_target(Some(target), &root).unwrap();
+        let legacy_body = format!(
+            "---\nprimary_target: {}\n---\n# Mapped legacy brief\n",
+            serde_json::to_string(&normalized).unwrap()
+        );
+        std::fs::write(&legacy, legacy_body).unwrap();
+        assert_eq!(resolve_surface_brief(&root, Some(target)).reason, "slug");
+        assert_eq!(resolve_surface_brief(&root, Some(collision)).reason, "not-found");
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+}
@@ -2,11 +2,27 @@

 use crate::jsp;
 use crate::util::js_trim;
+use sha2::{Digest, Sha256};

 const SLUG_MAX: usize = 50;
+const SLUG_HASH_LEN: usize = 8;

 /// JS: slugFromTarget(resolved, { cwd })
 pub fn slug_from_target(resolved: Option<&str>, cwd: &str) -> Option<String> {
+    slug_from_target_using(resolved, cwd, kebab)
+}
+
+/// Compatibility key used by releases that truncated normalized targets to
+/// their last 50 characters without a hash suffix.
+pub(crate) fn legacy_slug_from_target(resolved: Option<&str>, cwd: &str) -> Option<String> {
+    slug_from_target_using(resolved, cwd, legacy_kebab)
+}
+
+fn slug_from_target_using(
+    resolved: Option<&str>,
+    cwd: &str,
+    slugger: fn(&str) -> Option<String>,
+) -> Option<String> {
    let resolved = resolved?;
    let trimmed = js_trim(resolved);
    if trimmed.is_empty() {
@@ -15,7 +31,7 @@ pub fn slug_from_target(resolved: Option<&str>, cwd: &str) -> Option<String> {
    let lower = trimmed.to_ascii_lowercase();
    if lower.starts_with("http://") || lower.starts_with("https://") {
        let (host, pathname) = parse_url_host_path(trimmed)?;
-        return kebab(&format!("{}{}", host, pathname));
+        return slugger(&format!("{}{}", host, pathname));
    }
    let abs = if jsp::is_absolute(trimmed) { trimmed.to_string() } else { jsp::resolve(cwd, &[trimmed]) };
    let mut rel = jsp::relative(cwd, cwd, &abs);
@@ -25,7 +41,7 @@ pub fn slug_from_target(resolved: Option<&str>, cwd: &str) -> Option<String> {
    if rel.is_empty() || rel == "." {
        return None;
    }
-    kebab(&rel)
+    slugger(&rel)
 }

 /// Minimal WHATWG URL parse for http(s): returns (hostname lowercased, pathname).
@@ -37,6 +53,30 @@ pub fn parse_url_host_path(s: &str) -> Option<(String, String)> {

 /// JS: kebab(value)
 pub fn kebab(value: &str) -> Option<String> {
+    let u = normalized_kebab(value)?;
+    if u.len() <= SLUG_MAX {
+        Some(u)
+    } else {
+        let digest = Sha256::digest(u.as_bytes());
+        let hash = format!("{digest:x}");
+        let tail_len = SLUG_MAX - SLUG_HASH_LEN - 1;
+        let tail = &u[u.len() - tail_len..];
+        let tail = tail.strip_prefix('-').unwrap_or(tail);
+        Some(format!("{tail}-{}", &hash[..SLUG_HASH_LEN]))
+    }
+}
+
+fn legacy_kebab(value: &str) -> Option<String> {
+    let u = normalized_kebab(value)?;
+    if u.len() <= SLUG_MAX {
+        Some(u)
+    } else {
+        let tail = &u[u.len() - SLUG_MAX..];
+        Some(tail.strip_prefix('-').unwrap_or(tail).to_string())
+    }
+}
+
+fn normalized_kebab(value: &str) -> Option<String> {
    let lower = value.to_lowercase();
    // replace runs of / \ . with '-'
    let mut s = String::with_capacity(lower.len());
@@ -81,13 +121,37 @@ pub fn kebab(value: &str) -> Option<String> {
    // strip leading/trailing '-' (JS: /^-|-$/g -> one at each end; after collapse there is at most one)
    let u = u.strip_prefix('-').unwrap_or(&u).to_string();
    let u = u.strip_suffix('-').unwrap_or(&u).to_string();
-    if u.is_empty() {
-        return None;
+    (!u.is_empty()).then_some(u)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{kebab, legacy_kebab, SLUG_MAX};
+
+    #[test]
+    fn truncated_slugs_keep_distinct_full_inputs_distinct() {
+        let suffix = "a".repeat(SLUG_MAX);
+        let alpha = kebab(&format!("alpha-prefix-{suffix}")).unwrap();
+        let beta = kebab(&format!("beta-prefix-{suffix}")).unwrap();
+
+        assert_ne!(alpha, beta);
+        assert!(alpha.len() <= SLUG_MAX);
+        assert!(beta.len() <= SLUG_MAX);
+        assert_eq!(alpha, kebab(&format!("alpha-prefix-{suffix}")).unwrap());
    }
-    if u.len() <= SLUG_MAX {
-        Some(u)
-    } else {
-        let tail = &u[u.len() - SLUG_MAX..];
-        Some(tail.strip_prefix('-').unwrap_or(tail).to_string())
+
+    #[test]
+    fn non_truncated_slugs_are_unchanged() {
+        assert_eq!(kebab("Button.Primary"), Some("button-primary".to_string()));
+        assert_eq!(kebab(&"a".repeat(SLUG_MAX)), Some("a".repeat(SLUG_MAX)));
+    }
+
+    #[test]
+    fn legacy_kebab_preserves_the_previous_truncation_key() {
+        let value = "a-very-long-directory-structure-with-many-segments-component-name.tsx";
+        assert_eq!(
+            legacy_kebab(value),
+            Some("ry-structure-with-many-segments-component-name-tsx".to_string())
+        );
    }
 }
@@ -7,6 +7,7 @@ use impeccable_core::js;
 use serde_json::{Map, Value};

 use crate::hook_lib::*;
+use crate::stop_baseline;
 use crate::util::{
    exists, iso_now, jsp, node_read_error, now_ms, str_field, truthy_value, utf16_len,
 };
@@ -237,11 +238,19 @@ pub fn run_hook(rt: &Runtime, stdin: &str) -> RunResult {
            }
        }

+        let use_html_engine = match configured {
+            Some(c) => c.engine == "html",
+            None => ext == ".html" || ext == ".htm",
+        };
        if primary_files.contains(file_path) {
+            if harness == "claude" {
+                stop_baseline::capture(rt, &event, &mut cache, &session_id, file_path, use_html_engine);
+            }
            let edit_count = bump_edit_count(&mut cache, &session_id, file_path);
            cache_dirty = true;
            audit.insert("editCount".into(), Value::from(edit_count as u64));
            if edit_count > EDIT_COUNT_THRESHOLD as f64 {
+                stop_baseline::invalidate(&mut cache, &session_id, file_path);
                let just_crossed = edit_count == (EDIT_COUNT_THRESHOLD + 1) as f64;
                if just_crossed && suppression_winner.is_none() {
                    suppression_winner = Some(file_path.clone());
@@ -266,10 +275,6 @@ pub fn run_hook(rt: &Runtime, stdin: &str) -> RunResult {
                };
            }
        };
-        let use_html_engine = match configured {
-            Some(c) => c.engine == "html",
-            None => ext == ".html" || ext == ".htm",
-        };
        let mut detector_threw = false;
        let findings: Vec<Finding> = if use_html_engine {
            match detector_detect_html(rt, file_path, &scan) {
@@ -282,6 +287,9 @@ pub fn run_hook(rt: &Runtime, stdin: &str) -> RunResult {
        } else {
            detector_detect_text(&content, file_path, &scan)
        };
+        if !detector_threw && !use_html_engine {
+            stop_baseline::reconcile(&mut cache, &session_id, file_path, &findings);
+        }
        let raw_count = findings.len();
        let filtered = filter_findings(findings, &config);
        let (immediate, deferred) = if tiered {
@@ -660,6 +668,9 @@ pub fn run_stop_hook(rt: &Runtime, stdin: &str) -> RunResult {
    let mut fresh_groups: Vec<Group> = Vec::new();
    let mut scanned = 0usize;
    let mut cache_dirty = false;
+    let mut pre_existing = 0usize;
+    let mut new_findings = 0usize;
+    let mut unknown = 0usize;
    for file_path in &touched {
        if scanned >= STOP_MAX_FILES {
            break;
@@ -705,8 +716,15 @@ pub fn run_stop_hook(rt: &Runtime, stdin: &str) -> RunResult {
        } else {
            detector_detect_text(&content, file_path, &scan)
        };
+        if !use_html_engine {
+            stop_baseline::reconcile(&mut cache, &session_id, file_path, &findings);
+        }
        let filtered = filter_findings(findings, &config);
-        let fresh = dedupe_against_cache(&filtered, &mut cache, &session_id, file_path);
+        let classified = stop_baseline::classify(&cache, &session_id, file_path, use_html_engine, filtered.clone());
+        pre_existing += classified.pre_existing;
+        new_findings += classified.new;
+        unknown += classified.unknown;
+        let fresh = dedupe_against_cache(&classified.findings, &mut cache, &session_id, file_path);
        // JS: sync to the live scan, including empty. Remembering only
        // `fresh` (or skipping the write on a clean Stop) left stale keys in
        // place, so a finding that was fixed and later reintroduced never
@@ -721,6 +739,9 @@ pub fn run_stop_hook(rt: &Runtime, stdin: &str) -> RunResult {
        }
    }
    audit.insert("scannedFiles".into(), Value::from(scanned));
+    audit.insert("preExistingFindings".into(), Value::from(pre_existing));
+    audit.insert("newFindings".into(), Value::from(new_findings));
+    audit.insert("unknownFindings".into(), Value::from(unknown));
    if fresh_groups.is_empty() {
        if cache_dirty {
            persist_cache(rt, &project_cwd, &cache);
@@ -735,19 +756,52 @@ pub fn run_stop_hook(rt: &Runtime, stdin: &str) -> RunResult {
        );
    }
    let short = footer_mode_short(&mut cache, &session_id);
-    let reserve = design_note_reserve(rt, &scan, &mut cache, &session_id);
-    let rendered = render_grouped_template(
+    let first_unknown = fresh_groups.iter().flat_map(|group| &group.findings)
+        .position(|f| f.name.starts_with("[attribution unknown]"));
+    let mut attribution_note = if first_unknown.is_some() {
+        format!("{ENVELOPE_PREFIX} {}", stop_baseline::UNKNOWN_NOTE)
+    } else {
+        String::new()
+    };
+    // Findings and attribution take priority. Append the lower-priority stale
+    // DESIGN.md notice only if it fits, without consuming its session flag.
+    let render = |note: &str, render_config: &HookConfig| render_grouped_template(
        rt,
        &fresh_groups,
-        &config,
+        render_config,
        &RenderOpts {
            cwd: Some(project_cwd.clone()),
            short_footer: short,
-            reserve_chars: reserve,
+            reserve_chars: if note.is_empty() { 0.0 } else { (utf16_len(note) + 2) as f64 },
        },
    );
+    let mut rendered = render(&attribution_note, &config);
+    if !attribution_note.is_empty() && !rendered.lines().any(|line| {
+        line.starts_with("- ") && (line.contains("[attribution unknown]") || line.contains("[new]"))
+    }) {
+        // At the minimum budget, a grouped header and policy footer may crowd
+        // out even the first finding. Shorten the notice before losing it.
+        attribution_note = format!("{ENVELOPE_PREFIX} {}", stop_baseline::COMPACT_UNKNOWN_NOTE);
+        rendered = render(&attribution_note, &config);
+    }
+    // maxFindings / maxChars may also remove all unknown findings. Do not
+    // attach their guidance to an output that only shows confirmed new debt.
+    let shows_unknown = rendered.lines().any(|line| {
+        line.starts_with("- ") && line.contains("[attribution unknown]")
+    });
+    if !shows_unknown {
+        if let Some(prefix @ 1..) = first_unknown {
+            // Reclaim the unused notice budget for the known-new prefix.
+            // Keep the unknown suffix omitted: simply expanding the budget
+            // could reveal an unknown finding without its required guidance.
+            let mut visible_config = config.clone();
+            visible_config.limits.max_findings = cap_of(&config).min(prefix) as f64;
+            rendered = render("", &visible_config);
+        }
+    }
+    let text = if shows_unknown { format!("{attribution_note}\n\n{rendered}") } else { rendered };
    let text =
-        append_design_system_note_once(rt, &rendered, &scan, &mut cache, &session_id, &config);
+        append_design_system_note_once(rt, &text, &scan, &mut cache, &session_id, &config);
    commit_footer_shown(rt, &mut cache, &session_id, &text);
    persist_cache(rt, &project_cwd, &cache);
    let all: usize = fresh_groups.iter().map(|g| g.findings.len()).sum();
@@ -1314,7 +1314,7 @@ pub struct RenderOpts {
    pub reserve_chars: f64,
 }

-fn cap_of(config: &HookConfig) -> usize {
+pub(crate) fn cap_of(config: &HookConfig) -> usize {
    let mf = config.limits.max_findings;
    let mf = if mf == 0.0 || mf.is_nan() {
        DEFAULT_MAX_FINDINGS
@@ -14,6 +14,7 @@ pub mod admin;
 pub mod before_edit;
 pub mod hook;
 pub mod hook_lib;
+mod stop_baseline;
 pub mod util;

 use impeccable_common::Io;
@@ -0,0 +1,279 @@
+//! Conservative Stop attribution. Never use HEAD as a session baseline: the
+//! working tree may already be dirty. Only a verified first Edit/Write preimage
+//! from the tool result establishes a baseline, and only for the pure text
+//! detector. DOM and design-system findings can depend on other files.
+
+use impeccable_core::findings::Finding;
+use serde_json::{json, Map, Value};
+use sha2::{Digest, Sha256};
+
+use crate::hook_lib::{
+    detector_detect_text, ensure_file, sessions, Cache, HookScanOptions, Runtime,
+};
+
+const FIELD: &str = "stopBaseline";
+const MAX_BYTES: usize = 512 * 1024;
+const MAX_FINDINGS: usize = 256;
+pub const UNKNOWN_NOTE: &str = "Findings marked attribution unknown may predate this session; do not treat them as regressions or broaden the task without asking.";
+pub const COMPACT_UNKNOWN_NOTE: &str = "Unknown findings may predate this session; ask before expanding scope.";
+
+fn independent(finding: &Finding) -> bool {
+    !finding.antipattern.starts_with("design-system-")
+}
+
+// Exclude line numbers so an unrelated insertion/deletion does not make old
+// debt new. Preserve multiplicity so adding an identical occurrence is new.
+// Hash the detector identity rather than storing source or snippets in cache.
+fn key(finding: &Finding) -> String {
+    let identity = json!([finding.antipattern, finding.snippet, finding.extras]);
+    format!("{:x}", Sha256::digest(identity.to_string().as_bytes()))
+}
+
+fn counts(findings: &[Finding]) -> Map<String, Value> {
+    let mut counts = Map::new();
+    for finding in findings.iter().filter(|f| independent(f)) {
+        let key = key(finding);
+        let count = counts.get(&key).and_then(Value::as_u64).unwrap_or(0);
+        counts.insert(key, Value::from(count + 1));
+    }
+    counts
+}
+
+fn entry<'a>(cache: &'a Cache, session: &str, file: &str) -> Option<&'a Map<String, Value>> {
+    sessions(cache)?
+        .get(session)?
+        .get("files")?
+        .get(file)?
+        .as_object()
+}
+
+fn baseline(cache: &Cache, session: &str, file: &str) -> Option<Map<String, Value>> {
+    let value = entry(cache, session, file)?.get(FIELD)?;
+    if value.get("version")?.as_u64()? != 1
+        || value.get("engine")?.as_str()? != env!("CARGO_PKG_VERSION")
+    {
+        return None;
+    }
+    let counts = value.get("counts")?.as_object()?;
+    if counts.len() > MAX_FINDINGS
+        || counts.iter().any(|(k, v)| {
+            k.len() != 64
+                || !k.bytes().all(|b| b.is_ascii_hexdigit())
+                || !matches!(v.as_u64(), Some(1..=256))
+        })
+    {
+        return None;
+    }
+    Some(counts.clone())
+}
+
+/// Called before the first primary edit is recorded. An entry without a
+/// baseline (old cache, co-scan, incomplete payload) must stay unknown rather
+/// than adopting a later, already-edited file as its starting point.
+pub fn capture(
+    rt: &Runtime,
+    event: &Map<String, Value>,
+    cache: &mut Cache,
+    session: &str,
+    file: &str,
+    html: bool,
+) {
+    if html || session.is_empty() || session == "unknown" || entry(cache, session, file).is_some() {
+        return;
+    }
+    let Some(response) = event.get("tool_response").and_then(Value::as_object) else {
+        return;
+    };
+    let Some(path) = response.get("filePath").and_then(Value::as_str) else {
+        return;
+    };
+    let cwd = event
+        .get("cwd")
+        .and_then(Value::as_str)
+        .unwrap_or(&rt.proc_cwd);
+    if rt.resolve(&[cwd, path]) != file || response.get("userModified") == Some(&Value::Bool(true))
+    {
+        return;
+    }
+    let Some(tool) = event.get("tool_name").and_then(Value::as_str) else {
+        return;
+    };
+    let original = match response.get("originalFile") {
+        Some(Value::String(text)) if text.len() <= MAX_BYTES => text.as_str(),
+        // null on an update may mean "too large", not an empty original.
+        Some(Value::Null)
+            if tool == "Write"
+                && response.get("type").and_then(Value::as_str) == Some("create") =>
+        {
+            ""
+        }
+        _ => return,
+    };
+    let expected = match tool {
+        "Edit" => {
+            let Some(old) = response.get("oldString").and_then(Value::as_str) else {
+                return;
+            };
+            let Some(new) = response.get("newString").and_then(Value::as_str) else {
+                return;
+            };
+            if old.is_empty() || new.len() > MAX_BYTES || !original.contains(old) {
+                return;
+            }
+            match response.get("replaceAll").and_then(Value::as_bool) {
+                Some(true) => {
+                    let occurrences = original.matches(old).count();
+                    let size = original.len() - occurrences * old.len()
+                        + occurrences.saturating_mul(new.len());
+                    if size > MAX_BYTES {
+                        return;
+                    }
+                    original.replace(old, new)
+                }
+                Some(false) if original.matches(old).count() == 1 => original.replacen(old, new, 1),
+                _ => return,
+            }
+        }
+        "Write" => {
+            if !matches!(
+                response.get("type").and_then(Value::as_str),
+                Some("create" | "update")
+            ) {
+                return;
+            }
+            let Some(content) = response.get("content").and_then(Value::as_str) else {
+                return;
+            };
+            if content.len() > MAX_BYTES {
+                return;
+            }
+            content.to_string()
+        }
+        _ => return,
+    };
+    if expected.len() > MAX_BYTES
+        || std::fs::metadata(file)
+            .map(|m| m.len() > MAX_BYTES as u64)
+            .unwrap_or(true)
+    {
+        return;
+    }
+    // A formatter, stale event, or concurrent write invalidates attribution.
+    if std::fs::read_to_string(file).ok().as_deref() != Some(expected.as_str()) {
+        return;
+    }
+    let findings = detector_detect_text(original, file, &HookScanOptions::default());
+    if findings.len() > MAX_FINDINGS {
+        return;
+    }
+    ensure_file(cache, session, file).insert(
+        FIELD.into(),
+        json!({
+            "version": 1, "engine": env!("CARGO_PKG_VERSION"), "counts": counts(&findings),
+        }),
+    );
+}
+
+/// Once existing debt disappears, it cannot exempt a later reintroduction.
+pub fn reconcile(cache: &mut Cache, session: &str, file: &str, findings: &[Finding]) {
+    let Some(mut old) = baseline(cache, session, file) else {
+        return;
+    };
+    let current = counts(findings);
+    old.retain(|key, value| {
+        let count = current
+            .get(key)
+            .and_then(Value::as_u64)
+            .unwrap_or(0)
+            .min(value.as_u64().unwrap_or(0));
+        *value = Value::from(count);
+        count > 0
+    });
+    ensure_file(cache, session, file).get_mut(FIELD).unwrap()["counts"] = Value::Object(old);
+}
+
+/// Do not retain an exemption through edits we deliberately stop scanning.
+pub fn invalidate(cache: &mut Cache, session: &str, file: &str) {
+    ensure_file(cache, session, file).remove(FIELD);
+}
+
+#[derive(Default)]
+pub struct Classified {
+    pub findings: Vec<Finding>,
+    pub pre_existing: usize,
+    pub new: usize,
+    pub unknown: usize,
+}
+
+pub fn classify(
+    cache: &Cache,
+    session: &str,
+    file: &str,
+    html: bool,
+    findings: Vec<Finding>,
+) -> Classified {
+    let mut baseline = if html {
+        None
+    } else {
+        baseline(cache, session, file)
+    };
+    let mut result = Classified::default();
+    for mut finding in findings {
+        let known = baseline.as_mut().filter(|_| independent(&finding));
+        if let Some(counts) = known {
+            let key = key(&finding);
+            let count = counts.get(&key).and_then(Value::as_u64).unwrap_or(0);
+            if count > 0 {
+                counts.insert(key, Value::from(count - 1));
+                result.pre_existing += 1;
+                continue;
+            }
+            result.new += 1;
+            finding.name = format!("[new] {}", finding.name);
+        } else {
+            result.unknown += 1;
+            finding.name = format!("[attribution unknown] {}", finding.name);
+        }
+        result.findings.push(finding);
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use impeccable_core::findings::finding;
+
+    #[test]
+    fn stop_baseline_dependency_sensitive_findings_stay_unknown() {
+        let mut cache = Cache::new();
+        let font = finding("design-system-font", "a.css", "font-family: serif", 1.0);
+        let css = finding("side-tab", "a.html", "border-left: 4px solid red", 1.0);
+        ensure_file(&mut cache, "s", "a.css").insert(
+            FIELD.into(),
+            json!({
+                "version": 1, "engine": env!("CARGO_PKG_VERSION"), "counts": {},
+            }),
+        );
+        // Even a known text preimage cannot establish the state of DESIGN.md
+        // before the session, or of the stylesheets a DOM scan reads.
+        assert_eq!(classify(&cache, "s", "a.css", false, vec![font]).unknown, 1);
+        assert_eq!(classify(&cache, "s", "a.css", true, vec![css]).unknown, 1);
+    }
+
+    #[test]
+    fn stop_baseline_old_engine_and_malformed_cache_stay_unknown() {
+        let mut cache = Cache::new();
+        let f = finding("side-tab", "a.css", "border-left: 4px solid red", 1.0);
+        for record in [
+            json!({"version": 1, "engine": "0.0.0", "counts": {}}),
+            json!({"version": 1, "engine": env!("CARGO_PKG_VERSION"), "counts": {"bad": -1}}),
+        ] {
+            ensure_file(&mut cache, "s", "a.css").insert(FIELD.into(), record);
+            assert_eq!(
+                classify(&cache, "s", "a.css", false, vec![f.clone()]).unknown,
+                1
+            );
+        }
+    }
+}
@@ -124,6 +124,350 @@ fn stop_event(cwd: &str, session: &str) -> String {
 const GRADIENT_CSS: &str = ".title { background: linear-gradient(90deg, #f472b6, #a78bfa); -webkit-background-clip: text; color: transparent; }\n";
 const SIDE_TAB_CSS: &str = ".card { border-left: 4px solid #6366f1; border-radius: 8px; }\n";

+fn edit_with_original(cwd: &str, file: &str, session: &str, before: &str, old: &str, new: &str) -> String {
+    json!({
+        "session_id": session, "cwd": cwd, "hook_event_name": "PostToolUse",
+        "tool_name": "Edit", "tool_input": {"file_path": file, "old_string": old, "new_string": new},
+        "tool_response": {"filePath": file, "originalFile": before, "oldString": old,
+            "newString": new, "replaceAll": false, "userModified": false},
+    }).to_string()
+}
+
+#[test]
+fn stop_baseline_import_only_edit_does_not_blame_existing_font() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    // This is the actual working-tree preimage, not HEAD (which might differ).
+    let before = "import dead from 'dead';\nconst report = `<style>body { font-family: Fraunces; }</style>`;\n";
+    let after = before.replacen("import dead from 'dead';\n", "", 1);
+    let file = t.write("query.ts", &after);
+    let r = rt(&cwd);
+    assert!(detector_detect_text(before, &file, &HookScanOptions::default()).iter().any(|f| f.antipattern == "overused-font"));
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", before, "import dead from 'dead';\n", ""));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert!(stop.stdout.is_empty(), "{}", stop.stdout);
+    assert_eq!(stop.audit["preExistingFindings"], json!(1));
+    assert!(!t.read(".impeccable/hook.cache.json").contains("const report"), "do not persist source contents");
+    assert!(!t.exists(".impeccable/config.local.json"), "baseline is not an ignore");
+    assert!(detector_detect_text(&after, &file, &HookScanOptions::default()).iter().any(|f| f.antipattern == "overused-font"), "explicit scans stay unchanged");
+}
+
+#[test]
+fn stop_baseline_reports_new_findings_and_keeps_first_preimage() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    let file = t.write("card.css", SIDE_TAB_CSS);
+    let r = rt(&cwd);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", ".card {}\n", ".card {}\n", SIDE_TAB_CSS));
+    let second = format!("/* later */\n{SIDE_TAB_CSS}");
+    t.write("card.css", &second);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", SIDE_TAB_CSS, SIDE_TAB_CSS, &second));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert!(stop.stdout.contains("[side-tab]"));
+    assert!(stop.stdout.contains("[new]"), "{}", stop.stdout);
+    assert_eq!(stop.audit["newFindings"], json!(1));
+}
+
+#[test]
+fn stop_baseline_missing_or_mismatched_preimage_stays_unknown() {
+    for original in [None, Some("not the actual preimage")] {
+        let t = Tmp::new();
+        let cwd = t.path();
+        t.write("package.json", "{}");
+        let file = t.write("card.css", SIDE_TAB_CSS);
+        let r = rt(&cwd);
+        let event = original.map(|before| edit_with_original(&cwd, &file, "s1", before, ".card {}", SIDE_TAB_CSS))
+            .unwrap_or_else(|| edit_event(&cwd, &file, "s1"));
+        hook::run_hook(&r, &event);
+        let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+        assert!(stop.stdout.contains("[attribution unknown]"), "{}", stop.stdout);
+        assert!(stop.stdout.contains("may predate this session"));
+        assert_eq!(stop.audit["unknownFindings"], json!(1));
+    }
+}
+
+#[test]
+fn stop_baseline_existing_debt_fixed_then_reintroduced_is_new() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    let clean = ".card {}\n";
+    let file = t.write("card.css", clean);
+    let r = rt(&cwd);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", SIDE_TAB_CSS, SIDE_TAB_CSS, clean));
+    t.write("card.css", SIDE_TAB_CSS);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", clean, clean, SIDE_TAB_CSS));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert!(stop.stdout.contains("[new]"), "{}", stop.stdout);
+    assert_eq!(stop.audit["preExistingFindings"], json!(0));
+}
+
+#[test]
+fn stop_baseline_late_preimage_does_not_relabel_unknown_debt() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    let file = t.write("card.css", SIDE_TAB_CSS);
+    let r = rt(&cwd);
+    hook::run_hook(&r, &edit_event(&cwd, &file, "s1"));
+    let second = format!("/* later */\n{SIDE_TAB_CSS}");
+    t.write("card.css", &second);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", SIDE_TAB_CSS, SIDE_TAB_CSS, &second));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert_eq!(stop.audit["unknownFindings"], json!(1));
+    assert_eq!(stop.audit["preExistingFindings"], json!(0));
+}
+
+#[test]
+fn stop_baseline_keeps_indirect_stylesheet_findings_unknown() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    t.write("src/styles.css", SIDE_TAB_CSS);
+    let before = "import './styles.css';\nexport const Card = () => <div>Before</div>;\n";
+    let after = before.replace("Before", "After");
+    let file = t.write("src/Card.tsx", &after);
+    let r = rt(&cwd);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", before, "Before", "After"));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert!(stop.stdout.contains("[side-tab]"), "{}", stop.stdout);
+    assert_eq!(stop.audit["unknownFindings"], json!(1));
+    assert_eq!(stop.audit["preExistingFindings"], json!(0));
+}
+
+#[test]
+fn stop_baseline_extra_identical_occurrence_is_not_suppressed() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    // The text detector deduplicates identical snippets within two lines.
+    let after = format!("{SIDE_TAB_CSS}\n\n\n{SIDE_TAB_CSS}");
+    let file = t.write("card.css", &after);
+    let r = rt(&cwd);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", SIDE_TAB_CSS, SIDE_TAB_CSS, &after));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert_eq!(stop.audit["preExistingFindings"], json!(1));
+    assert_eq!(stop.audit["newFindings"], json!(1));
+}
+
+#[test]
+fn stop_baseline_write_create_is_new_but_missing_update_preimage_is_unknown() {
+    for (kind, expected) in [("create", "newFindings"), ("update", "unknownFindings")] {
+        let t = Tmp::new();
+        let cwd = t.path();
+        t.write("package.json", "{}");
+        let file = t.write("card.css", SIDE_TAB_CSS);
+        let r = rt(&cwd);
+        let event = json!({"cwd": cwd, "session_id": "s1", "tool_name": "Write",
+            "tool_input": {"file_path": file, "content": SIDE_TAB_CSS},
+            "tool_response": {"type": kind, "filePath": file, "content": SIDE_TAB_CSS, "originalFile": null}}).to_string();
+        hook::run_hook(&r, &event);
+        let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+        assert_eq!(stop.audit[expected], json!(1));
+    }
+}
+
+#[test]
+fn stop_baseline_unknown_notice_respects_small_output_budget() {
+    for (budget, stale) in [(500, false), (500, true), (8000, true)] {
+        let t = Tmp::new();
+        let cwd = t.path();
+        t.write("package.json", "{}");
+        t.write(".impeccable/config.json", &json!({"hook":{"limits":{"maxChars":budget}}}).to_string());
+        let file = t.write("card.css", SIDE_TAB_CSS);
+        let r = rt(&cwd);
+        hook::run_hook(&r, &edit_event(&cwd, &file, "s1"));
+        if stale {
+            // Make the notice eligible only at Stop; no sleeps or clock races.
+            t.write("DESIGN.md", "---\nname: Test\n---\n");
+            let sidecar = t.write(".impeccable/design.json", "{}");
+            std::fs::File::options().write(true).open(sidecar).unwrap()
+                .set_modified(std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_600_000_000)).unwrap();
+            assert!(design_system_options(&read_config(&cwd), &cwd).md_newer_than_json());
+        }
+        let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+        let output: Value = serde_json::from_str(&stop.stdout).unwrap();
+        let text = output["hookSpecificOutput"]["additionalContext"].as_str().unwrap();
+        assert!(text.encode_utf16().count() <= budget, "{text}");
+        assert!(text.contains("may predate this session"));
+        assert!(text.contains("[side-tab]"), "{text}");
+        assert!(text.contains("[attribution unknown]"), "{text}");
+        assert!(text.contains("card.css"), "{text}");
+        if stale {
+            assert_eq!(text.contains("DESIGN.md is newer"), budget > 500, "{text}");
+            let cache: Value = serde_json::from_str(&t.read(".impeccable/hook.cache.json")).unwrap();
+            assert_eq!(cache["sessions"]["s1"]["designNoteShown"] == json!(true), budget > 500);
+        }
+    }
+}
+
+#[test]
+fn stop_baseline_deduplicated_unknown_does_not_add_notice_to_new_finding() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    let r = rt(&cwd);
+    let old = t.write("old/card.css", SIDE_TAB_CSS);
+    hook::run_hook(&r, &edit_event(&cwd, &old, "s1"));
+    assert!(hook::run_stop_hook(&r, &stop_event(&cwd, "s1")).stdout.contains("[attribution unknown]"));
+    let new = t.write("new/card.css", SIDE_TAB_CSS);
+    // Use a verified create event (an empty Edit preimage is not trusted).
+    let create = json!({"cwd": cwd, "session_id": "s1", "tool_name": "Write",
+        "tool_input": {"file_path": new, "content": SIDE_TAB_CSS},
+        "tool_response": {"type": "create", "filePath": new, "content": SIDE_TAB_CSS, "originalFile": null}}).to_string();
+    hook::run_hook(&r, &create);
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert_eq!(stop.audit["unknownFindings"], json!(1), "audit retains the full scan");
+    assert!(stop.stdout.contains("[new]"), "{}", stop.stdout);
+    assert!(!stop.stdout.contains("may predate this session"), "{}", stop.stdout);
+}
+
+#[test]
+fn stop_baseline_capped_unknown_does_not_add_notice_to_new_finding() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    t.write(".impeccable/config.json", r#"{"hook":{"limits":{"maxFindings":1}}}"#);
+    let r = rt(&cwd);
+    let new = t.write("new/card.css", SIDE_TAB_CSS);
+    hook::run_hook(&r, &edit_with_original(&cwd, &new, "s1", ".card {}", ".card {}", SIDE_TAB_CSS));
+    let old = t.write("old/card.css", SIDE_TAB_CSS);
+    hook::run_hook(&r, &edit_event(&cwd, &old, "s1"));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert_eq!(stop.audit["unknownFindings"], json!(1));
+    assert!(stop.stdout.contains("[new]"), "{}", stop.stdout);
+    assert!(!stop.stdout.contains("[attribution unknown]"), "{}", stop.stdout);
+    assert!(!stop.stdout.contains("may predate this session"), "{}", stop.stdout);
+}
+
+#[test]
+fn stop_baseline_small_grouped_output_keeps_finding_and_attribution() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    t.write(".impeccable/config.json", r#"{"hook":{"limits":{"maxChars":500}}}"#);
+    let r = rt(&cwd);
+    for path in ["one/card.css", "two/card.css"] {
+        let file = t.write(path, SIDE_TAB_CSS);
+        hook::run_hook(&r, &edit_event(&cwd, &file, "s1"));
+    }
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    let output: Value = serde_json::from_str(&stop.stdout).unwrap();
+    let text = output["hookSpecificOutput"]["additionalContext"].as_str().unwrap();
+    assert!(text.encode_utf16().count() <= 500, "{text}");
+    assert!(text.contains("[side-tab]"), "{text}");
+    assert!(text.contains("[attribution unknown]"), "{text}");
+    assert!(text.contains("may predate this session"), "{text}");
+}
+
+#[test]
+fn stop_baseline_dropped_notice_reclaims_its_rendering_budget() {
+    for max_findings in [1, 5] {
+        let t = Tmp::new();
+        let cwd = t.path();
+        t.write("package.json", "{}");
+        t.write(".impeccable/config.json", &json!({"hook":{"limits":{"maxChars":500,"maxFindings":max_findings}}}).to_string());
+        let r = rt(&cwd);
+        let new = t.write("new/card.css", SIDE_TAB_CSS);
+        hook::run_hook(&r, &edit_with_original(&cwd, &new, "s1", ".card {}", ".card {}", SIDE_TAB_CSS));
+        let old = t.write("old/card.css", SIDE_TAB_CSS);
+        hook::run_hook(&r, &edit_event(&cwd, &old, "s1"));
+        let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+        let output: Value = serde_json::from_str(&stop.stdout).unwrap();
+        let text = output["hookSpecificOutput"]["additionalContext"].as_str().unwrap();
+        let groups: Vec<Group> = [(new, "[new]"), (old, "[attribution unknown]")].into_iter().map(|(file_path, label)| {
+            let mut findings = detector_detect_text(SIDE_TAB_CSS, &file_path, &HookScanOptions::default());
+            for f in &mut findings { f.name = format!("{label} {}", f.name); }
+            Group { file_path, findings }
+        }).collect();
+        let mut config = read_config(&cwd);
+        // Unknown is not displayed at this budget. All available space goes
+        // to the known-new prefix, rather than a discarded notice.
+        config.limits.max_findings = 1.0;
+        let expected = render_grouped_template(&r, &groups, &config, &RenderOpts {
+            cwd: Some(cwd), short_footer: false, reserve_chars: 0.0,
+        });
+        assert_eq!(text, expected, "maxFindings={max_findings}");
+        assert!(text.contains("[new] Side-tab accent border"), "{text}");
+        assert!(!text.contains("may predate this session"), "{text}");
+    }
+}
+
+#[test]
+fn stop_baseline_uses_dirty_worktree_not_git_head() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    t.write("card.css", ".card {}\n");
+    std::fs::create_dir(t.0.join("empty-hooks")).unwrap();
+    let hooks = format!("core.hooksPath={}/empty-hooks", cwd);
+    let git = |args: &[&str]| {
+        let result = std::process::Command::new("git").current_dir(&t.0)
+            .args(["-c", "user.name=Test", "-c", "user.email=test@example.invalid",
+                "-c", "commit.gpgsign=false", "-c", &hooks])
+            .args(args).output().unwrap();
+        assert!(result.status.success(), "{}", String::from_utf8_lossy(&result.stderr));
+    };
+    git(&["init", "--quiet"]);
+    git(&["add", "card.css", "package.json"]);
+    git(&["commit", "--quiet", "-m", "clean baseline"]);
+    // The user introduced this debt before the agent session; HEAD is clean.
+    let before = format!("/* unrelated */\n{SIDE_TAB_CSS}");
+    let file = t.write("card.css", SIDE_TAB_CSS);
+    let r = rt(&cwd);
+    hook::run_hook(&r, &edit_with_original(&cwd, &file, "s1", &before, "/* unrelated */\n", ""));
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert_eq!(stop.audit["preExistingFindings"], json!(1));
+    assert!(stop.stdout.is_empty());
+}
+
+#[test]
+fn stop_baseline_untrusted_shapes_do_not_suppress_findings() {
+    for variant in ["modified", "wrong-path", "no-session", "oversized", "ambiguous", "other-provider"] {
+        let t = Tmp::new();
+        let cwd = t.path();
+        t.write("package.json", "{}");
+        let file = t.write("card.css", SIDE_TAB_CSS);
+        let mut event: Value = serde_json::from_str(&edit_with_original(&cwd, &file, "s1", SIDE_TAB_CSS, SIDE_TAB_CSS, SIDE_TAB_CSS)).unwrap();
+        match variant {
+            "modified" => event["tool_response"]["userModified"] = json!(true),
+            "wrong-path" => event["tool_response"]["filePath"] = json!("another.css"),
+            "no-session" => event["session_id"] = Value::Null,
+            "oversized" => event["tool_response"]["originalFile"] = json!("x".repeat(512 * 1024 + 1)),
+            "ambiguous" => {
+                let repeated = SIDE_TAB_CSS.repeat(2);
+                t.write("card.css", &repeated);
+                event["tool_response"]["originalFile"] = json!(repeated);
+            }
+            _ => {},
+        }
+        let r = if variant == "other-provider" { rt_with(&cwd, env(&[("IMPECCABLE_HOOK_HARNESS", "codex")])) } else { rt(&cwd) };
+        hook::run_hook(&r, &event.to_string());
+        let session = if variant == "no-session" { "unknown" } else { "s1" };
+        let stop = hook::run_stop_hook(&r, &stop_event(&cwd, session));
+        assert!(stop.stdout.contains("[attribution unknown]"), "{variant}: {}", stop.stdout);
+        assert_eq!(stop.audit["preExistingFindings"], json!(0), "{variant}");
+    }
+}
+
+#[test]
+fn stop_baseline_scan_suppression_discards_exemptions() {
+    let t = Tmp::new();
+    let cwd = t.path();
+    t.write("package.json", "{}");
+    let file = t.write("card.css", SIDE_TAB_CSS);
+    let r = rt(&cwd);
+    let event = edit_with_original(&cwd, &file, "s1", SIDE_TAB_CSS, SIDE_TAB_CSS, SIDE_TAB_CSS);
+    for _ in 0..=EDIT_COUNT_THRESHOLD {
+        hook::run_hook(&r, &event);
+    }
+    let stop = hook::run_stop_hook(&r, &stop_event(&cwd, "s1"));
+    assert_eq!(stop.audit["unknownFindings"], json!(1));
+    assert_eq!(stop.audit["preExistingFindings"], json!(0));
+}
+
 fn audit_str<'a>(a: &'a Map<String, Value>, k: &str) -> Option<&'a str> {
    a.get(k).and_then(Value::as_str)
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Abdul WahabandCursor	b83a0480f6	Fix: Windows update line prompt (#760 ) Raw-mode readline is Unix-only; Windows TTY sessions now use the existing line-based prompt instead of aborting. AI assistance: Cursor Grok 4.6, under maintainer direction. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-08 02:10:51 +05:00
Paul BakausandGitHub	ea8bfc1d99	Fix Windows CSP candidate path normalization (#778 ) * Test nested Windows CSP candidate paths Regression coverage for #761 before the path-normalization fix. AI assistance: Codex, under maintainer direction. * Fix Windows CSP candidate path normalization Normalize native relative paths before slash-based CSP classification and signal output. Preserve literal Unix backslashes. AI assistance: Codex, under maintainer direction. * Avoid reusing stale CSP test fixtures Retry an unused test directory on AlreadyExists without deleting or reading any pre-existing fixture contents. AI assistance: Codex, under maintainer direction.	2026-09-07 13:48:29 -07:00
Abdul Wahab GitHub Claude Fable 5.1	bd6964c35b	Trust the OS certificate store for engine HTTPS requests (#757 ) (#759 ) The engine verified TLS against the Mozilla roots bundled through webpki-roots only, so behind a TLS-inspecting proxy (Aikido, Zscaler, Netskope) whose root lives in the OS trust store, `impeccable update` and `install` failed with `invalid peer certificate: UnknownIssuer` while curl and npm on the same machine succeeded. crates/context/src/http.rs builds one rustls ClientConfig per process: the OS trust store (rustls-native-certs: Keychain, Windows store, the OpenSSL paths on Linux) merged with the bundled roots. A union, not a replacement, so a container without ca-certificates or a store that fails to load still verifies exactly as before. SSL_CERT_FILE and SSL_CERT_DIR replace the OS store the way they do for OpenSSL and curl. Every HTTPS call site (bundle and signature downloads, /api/version, /api/commands, the roll API, image generation) builds its agent from this module; the plain-HTTP live-server calls on localhost are untouched. Verified against a local HTTPS server signed by a throwaway CA: trusted through SSL_CERT_FILE the update check reaches it; without it the same server is rejected as UnknownIssuer; with SSL_CERT_FILE pointing at that CA or at a missing file, impeccable.style still verifies through the bundled roots. cargo test --workspace and the oracle corpus (832) pass. Written with AI assistance (Claude Code). Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-07 13:15:18 -07:00
Paul BakausandGitHub	44e825090e	Set registered VS Code publisher identity (#777 ) Use renaissance-geek for the Impeccable extension and guard the publisher identity in packaging tests. AI assistance: Codex, under maintainer direction.	2026-09-07 12:25:27 -07:00
Paul BakausandGitHub	8b39f41949	Add native Cursor marketplace plugin packaging (#776 ) * Add native Cursor marketplace plugin packaging AI assistance: Codex, under maintainer direction. * Document verified Cursor plugin installation and smoke tests AI assistance: Codex, under maintainer direction. * Fix Cursor plugin sync for license changes AI assistance: Codex, under maintainer direction.	2026-09-07 11:50:15 -07:00
Paul BakausandGitHub	4957fd7069	Add declarative VS Code skill extension packaging (#775 ) * Add declarative VS Code skill extension packaging Stage a launcher-only Copilot skill bundle, validate relocation and VSIX packaging, and keep project-install hooks out of the extension. AI assistance: Codex, under maintainer direction. * Document verified Copilot extension smoke test Record the successful read-only VS Code 1.136.1 run and the reload required after initial workspace trust. Keep minimum-version and remote smoke gaps explicit. AI assistance: Codex, under maintainer direction. * Fix VS Code packaging test version source Derive the provider fixture version from the skill manifest and assert the packaged skill and extension versions agree. AI assistance: Codex, under maintainer direction.	2026-09-07 11:40:31 -07:00
Paul BakausandGitHub	93bfe70c58	Fix truncated surface-brief slug collisions (#774 ) * Fix truncated slug collisions Prepared with AI assistance under maintainer-authorized automation. * Preserve legacy long-slug reads Prepared with AI assistance under maintainer-authorized automation. * Harden legacy slug compatibility Require target metadata before reading collision-prone legacy brief and critique paths. Add regressions for two long targets with the same pre-hash suffix.\n\nPrepared with AI assistance. * Keep explicit access to legacy critiques Allow identity-less pre-hash snapshots to be read by their exact legacy slug while keeping path and URL fallback identity-gated. Document the compatibility boundary and extend collision coverage.\n\nPrepared with AI assistance.	2026-09-07 11:40:05 -07:00
dependabot[bot]andGitHub	4db7f6ba4b	Build(deps-dev): Bump compatible Bun dependencies (#772 ) Accept eight grouped dependency updates while retaining ai 7.0.69 and its private provider stack pending provider-backed tool-loop regression validation. Frozen install, Rust engine build and workspace tests, full Bun/Node suite with local engine oracle, extension build/lint, browser probe, and exact-head CI passed. AI-assisted dependency maintenance by Codex.	2026-09-07 10:12:34 -07:00
dependabot[bot]andGitHub	731e2b1e67	Build(deps): Bump actions/download-artifact to 8.0.1 (#773 ) Validated release workflow inputs, signing boundaries, full SHA pins, and exact-head required CI checks. v8 enforces artifact digest mismatches as errors; no workflow input migration required. AI-assisted dependency review and validation by Codex.	2026-09-07 10:05:05 -07:00
github-actions[bot]	dbdc470e70	Sync generated provider output	2026-09-07 03:34:57 +00:00
Paul BakausandGitHub	8426ac2f9a	Clarify launcher-refusal fallback and correct behavior tests (#756 ) * Clarify permitted work after launcher refusal Correct behavior-test skill metadata and DeepSeek output limits; document the measured remaining Gemini warning-order failure and hook download trust boundary. AI assistance: Codex, under pbakaus direction. * Clarify behavior harness host-modeling scope AI assistance: Codex, under pbakaus direction. * Preserve planning-only scope after launcher refusal Clarify applicable setup steps and cover denied-launcher planning. Retain the observed playbook-read failure under issue #744 rather than weakening its assertion. AI assistance: Codex, under pbakaus direction. * Test planning fallback warning order Require an assistant warning after context launcher denial and before fallback context reads. Cover silent, late, and unrelated warnings with deterministic tests; retain the observed Sonnet omission under #744. AI assistance: Codex, under pbakaus direction.	2026-09-06 20:34:28 -07:00
Paul BakausandGitHub	36e4cea693	Pin workflow actions and document live-edit script trust (#755 ) Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate. AI assistance: Codex, under maintainer direction.	2026-09-06 18:04:55 -07:00
Paul BakausandGitHub	c4a4f035ed	Fix: distinguish existing Stop findings from new debt (#754 ) Use verified first-edit baselines to distinguish pre-existing text findings from new or unknown Stop findings. Preserve dirty worktrees, bound notice rendering, and keep explicit scans unchanged. Verified with the full Rust and Bun/Node suites and real Claude Code edit-to-Stop sessions. Related to #522; keep it open until an engine release ships the fix. AI assistance: Codex, under maintainer direction.	2026-09-06 16:59:51 -07:00
github-actions[bot]	457d152292	Sync generated provider output	2026-09-06 23:20:59 +00:00
Paul BakausandGitHub	dfb33f7d57	Docs: clarify live mode development scope (#753 ) Document the local-development boundary and route production inspection to URL detection or the extension. Keep manual CSP allowances development-only. Related to #539. AI assistance: Codex, under maintainer direction.	2026-09-06 16:20:27 -07:00
Paul BakausandGitHub	f64da20b07	Release: engine 0.1.3, CLI 4.0.4 and skill 4.2.2 (#752 ) * Release: prepare engine 0.1.3, CLI 4.0.4 and skill 4.2.2 Ship the merged DeepSeek Harness, picker and launcher-refusal fixes. Intentionally refresh generated provider and plugin release metadata. Keep this branch off main until all engine binaries and npm platform packages exist; refresh bun.lock after publication. AI assistance: Codex, under maintainer direction. * Release: lock published engine 0.1.3 packages Refresh exact platform package resolutions after publication. All five npm binaries match the checksum-verified release assets. Addresses both lockfile review findings. AI assistance: Codex.	2026-09-06 15:43:17 -07:00
@@ -1 +1 @@
 .1.2
 .1.3