pbakaus_impeccable/docs/CLI-CONTRACT.md

Impeccable CLI contract

The observable behavior of every impeccable verb: arguments, environment, inputs, stdout and stderr byte for byte, exit codes, files written, network. This is the specification an alternate implementation of the scripts has to meet; tests/oracle/ records goldens against it and replays them.

Verb names are the binary's subcommands. Each verb was a script under skill/scripts/ or a cli/bin subcommand when this contract was recorded; the mapping is JS_VERBS in tests/oracle/lib.mjs, and file references below name those scripts as the source the contract was read from. Since the launcher swap the skill invokes every verb as {{scripts_path}}/impeccable <verb> and the scripts are gone from the tree; the contract stands as written.

Quoted strings, regexes, and JSON in this document are verbatim from the source, including any em dashes inside user-facing messages; do not "fix" them.

Sections:

1. Detect CLI and misc verbs (detect, ignores, skills, concept-seed, serve-question, generate-image)
2. Context and utility verbs (context, doctor, pin, surface-brief, critique-storage, palette, embed-prompt, signals, detect-csp)
3. Design hook (hook, hook-before-edit, hooks)
4. Live mode (live*)

---

1. Detect CLI and misc verbs

Source snapshot: repo impeccable-second @ main (f88b2837), 2026-08-17. Node >=22.18.0, package impeccable v3.6.0, "type": "module", bin: { impeccable: cli/bin/cli.js }, main/exports["."]: cli/engine/detect-antipatterns.mjs, exports["./browser"]: cli/engine/detect-antipatterns-browser.js.

Notation: stdout> / stderr> are literal writes; exit N; template strings use ${} as in the source. All regexes are quoted verbatim.

---

PART 1 — the impeccable binary and the detect engine

cli/bin/cli.js -> impeccable <command> (root dispatcher)

• Invoked from: README.md "CLI" section (npx impeccable detect src/, npx impeccable ignores ...), README.npm.md Quick Start, skill/reference/hooks.md:15 ("Manual npx impeccable detect scans use the same project filter config..."), hooks.md:65 ("Run npx impeccable detect <path> first to see what actually fires there").
• Args: args = process.argv.slice(2), command = args[0].
• Dispatch order (exact):
  1. !command || command === '--help' || command === '-h' → print (via console.log, stdout) then exit 0:

     Usage: impeccable <command> [options]
     
     Commands:
       detect [file-or-dir-or-url...]   Scan for UI anti-patterns and design quality issues
       ignores                          Manage detector ignore rules, files, and values
       help                             List all available skills and commands
       install                          Install impeccable skills into your project or global harness
       link                             Symlink skills from a local checkout or submodule
       update                           Update skills to the latest version
       check                            Check if skill updates are available
     
     Options:
       --help       Show this help message
       --version    Show version number
     
     Compatibility:
       impeccable skills <command>       Legacy namespace; still supported.
     

  2. --version / -v → console.log(pkg.version) read from <cli/bin>/../../package.json; exit 0.
  3. detect → process.argv = [argv0, argv1, ...args.slice(1)]; dynamic-import ../engine/detect-antipatterns.mjs, await detectCli().
  4. ignores or ignore → ./commands/ignores.mjs run(args.slice(1)).
  5. skills → ./commands/skills.mjs run(args.slice(1)) (legacy namespace).
  6. command ∈ SKILL_COMMANDS = {'help','install','link','update','check'} → skills.mjs run(args) (note: whole args, so run sees the verb as args[0]).
  7. looksLikeDetectTarget(command) → detect shorthand: process.argv = [argv0, argv1, ...args] then detectCli(). Predicate: arg.startsWith('-') || /^https?:\/\//i.test(arg) || arg.includes('/') || arg.includes('\\') || arg.includes('.') || existsSync(resolve(arg)).
  8. init → console.error('"init" is not a CLI command. Type /impeccable init in your AI coding agent\'s chat (Claude Code, Cursor, Codex, ...), not in this terminal.'), exit 1. (Note: a real path literally named init hits rule 7 first — tested: "a real path named init still routes to detect".)
  9. otherwise → console.error(\Unknown command: "${command}"\n\nTo see a list of supported commands, run:\n impeccable --help`), exit 1`.
• Top-level catch: main().catch(error => { if (error?.code === 'IMPECCABLE_PROMPT_ABORT') { console.log('\nAborted.'); exit 130 } console.error(error?.message || error); exit 1 }).
• No live subcommand exists in the CLI (README/CLAUDE.md mentions of npx impeccable live are aspirational; live mode is driven by skill/scripts/live*.mjs, out of scope here).
• Tests: tests/skills-cli.test.js ("root help advertises top-level skills commands", "top-level install aliases the legacy skills install command", "#472" init tests, "a real path named init still routes to detect").

---

cli/engine/detect-antipatterns.mjs (facade) and skill/scripts/detect.mjs (wrapper) -> impeccable detect

• Facade: re-exports registry (ANTIPATTERNS, RULE_ENGINE_SUPPORT, getAntipattern, getRulesForCategory, getRuleEngineSupport), constants (SAFE_TAGS, BORDER_SAFE_TAGS, OVERUSED_FONTS, GENERIC_FONTS, KNOWN_SERIF_FONTS), color helpers, isFullPage, check fns, createDetectorProfile, summarizeDetectorProfile, design-system fns (parseFrontmatter as parseDesignFrontmatter, normalizeDesignSystem, loadDesignSystemForCwd, checkSourceDesignSystem, collectStaticDesignSystemFindings), detectHtml, detectUrl, createBrowserDetector, detectText, extractStyleBlocks, extractCSSinJS, fs helpers (walkDir, hasScannableExtension, SCANNABLE_EXTENSIONS, SKIP_DIRS, buildImportGraph, resolveImport, detectFrameworkConfig, isPortListening, FRAMEWORK_CONFIGS), formatFindings, detectCli. Main-module guard: process.argv[1]?.endsWith('detect-antipatterns.mjs') || endsWith('detect-antipatterns.mjs/') → detectCli().
• skill/scripts/detect.mjs (what the skill invokes as node {{scripts_path}}/detect.mjs ...): candidates in order <scripts>/detector/detect-antipatterns.mjs (bundled install layout), then <scripts>/../../cli/engine/detect-antipatterns.mjs (repo layout). If neither exists: stderr> Error: bundled detector not found.\n, exit 1. Else dynamic-imports via pathToFileURL and await detectCli(). detectCli strips a leading detect arg itself, so both detect.mjs --json x and detect.mjs detect --json x work.
• Skill call sites (quoted):
  • reference/routing.md:16: "If scan.targets is non-empty and setup.platform is not ios/android/adaptive, run node {{scripts_path}}/detect.mjs --json <scan.targets joined by spaces> once (the bundled detector over local files: no network, no npx; it reads HTML/CSS, so skip it for native projects)."
  • reference/critique.md:73: node {{scripts_path}}/detect.mjs --json [target] with "Pass markup files/directories as [target]; do not pass CSS-only files. For URLs, skip CLI scan and use browser visualization. ... Exit code 0 = clean; 2 = findings. If the detector entrypoint is missing or fails to load, report deterministic scan unavailable and continue".
  • reference/layout.md:28: node {{scripts_path}}/detect.mjs --json --scope layout [target files or dirs]; reference/typeset.md:27: ... --scope type ....
  • reference/audit.native.md:3: "no browser tooling or detect.mjs applies" for native.

detectCli() — cli/engine/cli/main.mjs

Arg normalization: args = process.argv.slice(2) with -json→--json, -fast→--fast; if args[0] === 'detect' drop it.

Flags (all detected with args.includes unless stated):

Flag	Effect
--json	JSON output to stdout
--quiet	text mode prints only summary line(s) to stderr
--help	print usage (stdout) and exit 0 — evaluated after scope/viewport parsing (so a bad --scope still errors first)
--no-advisory	drop findings with advisory === true before output/exit-code
--fast	deprecated, ignored; stderr> Note: --fast is deprecated and ignored. The full scan is fast now and runs every rule.\n
--gpt, --gemini	deprecated, ignored; stderr> Note: --gpt and --gemini are deprecated and ignored. Generated-UI tells now run by default.\n
--no-config	configEnabled=false: detectionConfig = {ignoreRules:[],ignoreFiles:[],ignoreValues:[]}; also disables design system and inline ignores
--no-inline-ignores	inlineIgnoresEnabled = configEnabled && !flag
--no-design-system	designSystemEnabled = configEnabled && !flag && detectionConfig.designSystem?.enabled !== false
--scope <v> / --scope=<v>	comma-split, trimmed, filtered; repeated occurrences accumulate; the flag+value are spliced out of args. Value missing or starting with -- → stderr> Error: --scope requires a value. Valid scopes: ${[...RULE_SCOPES].join(', ')}\n, exit 1. Unknown → stderr> Error: unknown --scope value(s): ${unknown.join(', ')}. Valid scopes: ...\n, exit 1. RULE_SCOPES = union of rules' scopes = type, layout (in insertion order: type first from overused-font, then layout from nested-cards).
--viewport <WxH> / --viewport=WxH	regex /^(\d{2,5})x(\d{2,5})$/i; failure → stderr> Error: --viewport requires a WxH value, e.g. --viewport 390x844\n, exit 1. Sets baseScanOptions.viewport = {width,height} (browser scans only). Spliced out.
positional	targets = args.filter(a => !a.startsWith('--')) (so a bare -x single-dash arg is a target, except -json/-fast which were rewritten)

Usage text (printUsage, stdout, verbatim):

Usage: impeccable detect [options] [file-or-dir-or-url...]

Scan files or URLs for UI anti-patterns and design quality issues.

Options:
  --json              Output results as JSON
  --quiet             In text mode, only print the final findings count
  --scope <name>      Only report rules in the given design domain
                      (type, layout). Comma-separated.
  --viewport <WxH>    Browser viewport for URL scans (default 1280x800),
                      e.g. --viewport 390x844 for a mobile-width pass
  --no-config         Do not apply project config, detector ignores, inline
                      ignore comments, or DESIGN.md
  --no-inline-ignores Do not honor in-file impeccable-disable* ignore comments
  --no-design-system  Do not load local DESIGN.md / .impeccable/design.json context
  --no-advisory       Suppress advisory findings entirely (e.g. em-dash overuse)
  --help              Show this help message

Advisory findings:
  Some rules are advisory: detected and listed in a separate section, but never
  counted as failures and never changing the exit code. They stay out of the
  failure count so they never block automation. --no-advisory hides them.

Output streams:
  Human-readable findings go to stderr so stdout stays available for structured
  output. Use --json for JSON on stdout, or redirect text with 2> findings.txt.

Exit status:
  0  Scan completed with no primary findings (advisories may still be listed)
  1  At least one requested target could not be scanned
  2  Scan completed with primary findings
  Operational failure takes precedence when a multi-target scan is partial.

Project config:
  Respects .impeccable/config.json and .impeccable/config.local.json detector
  settings: detector.ignoreRules, detector.ignoreFiles, detector.ignoreValues,
  and detector.designSystem.enabled.

Inline ignores:
  In-file comments waive a finding where it lives and travel with the file:
    <!-- impeccable-disable overused-font -- exported brand doc -->
    .brand { font-family: Inter } /* impeccable-disable-line overused-font */
    // impeccable-disable-next-line bounce-easing: intentional bounce
  impeccable-disable applies to the whole file; -line / -next-line are scoped.
  List one or more rule ids (comma-separated), or omit them / use * for all.

Detection modes:
  HTML files     Static HTML/CSS analysis (default, catches linked CSS)
  Non-HTML files Regex pattern matching (CSS, JSX, TSX, etc.)
  URLs           Puppeteer full browser rendering (auto-detected;
                 http(s):// and file:// URLs; accessible linked CSS included)

Examples:
  impeccable detect src/
  impeccable detect index.html
  impeccable detect https://example.com
  impeccable detect --json .
  impeccable detect --no-config src/

Config: readDetectionConfig(process.cwd()) (see "Config file" below). Note config is resolved from cwd, not from the target.

Design system per target: scanOptionsFor(localPath): if design system enabled and localPath given, loadDesignSystemForTarget(localPath, {cache}) walks up from the target's own dir (never cwd): a dir with DESIGN.md/Design.md/design.md (directly, or under fallback dirs .agents/context, docs) is the design root; a dir with a project marker (.git, package.json, .impeccable) but no DESIGN.md is a boundary → no design system; reaching os.homedir() or fs root → none. Sidecar candidates: <root>/.impeccable/design.json, <root>/DESIGN.json, <contextDir>/DESIGN.json. Cache key root:<dir> or \0none. Options become {...baseScanOptions, designSystem} when found. design-system.mjs has no CLI surface (no main guard, no argv parsing); it only exports functions.

Input resolution:

1. If !process.stdin.isTTY && targets.length === 0 → stdin mode (handleStdin): read all stdin; try JSON.parse; if parsed.tool_input.file_path exists on disk → detectLocalFile(fp, scanOptionsFor(fp)) (hook payload dispatch); else detectText(input, '<stdin>', scanOptionsFor(null)).
2. Else paths = targets.length ? targets : [process.cwd()]. urlRe = /^(?:https?|file):\/\//i. If more than one URL target, a shared browser is created once via createBrowserDetector() (defaults waitUntil:'load', settleMs:100), closed in finally; a single URL uses detectUrl directly (waitUntil:'networkidle0', settleMs:0).
3. For each target, in order:
   • URL: file: URLs get scanOptionsFor(fileURLToPath(url) or null); http(s) get baseScanOptions (never cwd's design system). Errors: stderr> Error: ${e.message}\n, continue.
   • Else resolved = path.resolve(target); fs.statSync failure → stderr> Warning: cannot access ${target}\n, continue.
   • Directory: unless --json/--quiet, detectFrameworkConfig(resolved) (see below) and if found probes the port, writing one of three stderr notices:
     • listening & matched: \n${name} dev server detected on localhost:${port}.\nFor more accurate results, scan the running site:\n npx impeccable detect http://localhost:${port}\n\n
     • listening & !matched: \n${name} project detected (${basename(configPath)}).\nPort ${port} is in use by another service. Start the ${name} dev server and scan via URL for best results.\n\n
     • not listening: \n${name} project detected (${basename(configPath)}).\nStart the dev server and scan via URL for best results:\n npx impeccable detect http://localhost:${port}\n\n Then files = walkDir(resolved).filter(f => !shouldIgnoreDetectionFile(f, cwd, config)). If files.length > 50 && stdin.isTTY && !json && !quiet: stderr> \nFound ${n} files (${htmlCount} HTML) in ${target}.\nScanning may take a while${htmlCount > 10 ? ' (static HTML/CSS processes each HTML file individually)' : ''}.\nTarget a specific subdirectory to narrow scope.\n then readline prompt Continue? [Y/n] on stderr; empty or /^y(es)?$/i continues; otherwise stderr> Aborted.\n, exit 0. Then buildImportGraph(files) → reverse map; each file scanned with its own options; findings from a file that is imported get f.importedBy = [basename(importer), ...] (Set iteration order).
   • File: skipped if shouldIgnoreDetectionFile; else detectLocalFile.
   • detectLocalFile(fp, opts): extension (lowercased) in HTML_EXTENSIONS = {'.html','.htm'} → detectHtml(fp, opts); else detectText(readFileSync(fp,'utf-8'), fp, opts).
4. Post-filter: filterDetectionFindings(all, config) (ignoreRules/ignoreValues), then filterByScopes(all, scopes) (keeps findings whose rule declares any requested scope; empty scopes = no filter), then --no-advisory drop.
5. Partition {primary, advisory} by f.advisory === true || f.severity === 'advisory'.

Any target that cannot be scanned sets hadOperationalFailure (#711): a URL whose browser setup or scan throws, a path statSync cannot reach (stderr> Warning: cannot access <target>), an unreadable directory or file in a dir walk, and a per-file scan that throws (stderr> Error: cannot scan <target>: <message>). A multi-URL scan whose shared browser fails to launch prints its Error: once and skips every URL target.

Output and exit codes:

• allFindings.length > 0:
  • json: stdout> JSON.stringify(allFindings, null, 2) + '\n' (all findings, advisory ones flagged).
  • quiet: stderr> ${primary.length} anti-pattern${n===1?'':'s'} found.\n; if advisory: stderr> dim(${adv} advisory note${adv===1?'':'s'} (not counted).) + '\n'.
  • text: stderr> formatFindings(all,false) + '\n'.
  • exit(hadOperationalFailure ? 1 : (primary.length > 0 ? 2 : 0)).
• no findings: json → stdout> []\n; text/quiet → nothing. exit(hadOperationalFailure ? 1 : 0).
• Exit 1 takes precedence over exit 2: findings from the targets that did scan do not turn a partial scan into a complete one (#711).
• Any other exit: 1 for arg errors above; uncaught exceptions propagate to cli.js catch (exit 1).
• dim(text) = process.stderr.isTTY ? '\x1b[2m' + text + '\x1b[0m' : text. This is the only ANSI styling in detect output.

Text format (formatFindings(findings, false)):

formatFindingsBody(primary):
  group by f.file preserving first-seen order;
  for each file:  "\n${file}${importNote}"  where importNote = items[0].importedBy?.length ? ` (imported by ${items[0].importedBy.join(', ')})` : ''
     for each item: "  ${item.line ? `line ${item.line}: ` : ''}[${item.antipattern}] ${item.snippet}"
                    "    → ${item.description}"          (U+2192 arrow, 4-space indent)
then "\n${primary.length} anti-pattern${1?'':'s'} found."
then, if advisory non-empty:
  "\n" + dim('── Advisory (not counted as failures) ──')      (U+2500 box-drawing dashes)
  each body line individually dim()-wrapped
  dim(`\n${advisory.length} advisory note${1?'':'s'}. Suppress with --no-advisory.`)
all joined with '\n'.

Example (non-TTY):

/abs/a.css
  line 3: [side-tab] .card — border-left: 4px solid #6366f1
    → Thick colored border on one side of a card — ...

1 anti-pattern found.

── Advisory (not counted as failures) ──

/abs/a.html
  [em-dash-overuse] 9 em-dashes in body text
    → Em-dash saturation ...

1 advisory note. Suppress with --no-advisory.

Finding object (cli/engine/findings.mjs finding(id, filePath, snippet, line = 0)), key order exactly:

{ antipattern: id, name: ap.name, description: ap.description, severity: ap.severity || 'warning', category: ap.category || null, file: filePath, line, snippet }
// plus, only when the effective severity is 'advisory':  advisory: true

Optional keys added later by engines (appended after the above): ignoreValue (design-system rules; browser findings with a value), importedBy (dir scans), severity may be overwritten by per-finding promotion (browser & html-patterns, e.g. pulsing dot in a header). Design-system findings are {...finding(...), ...extras} where extras = { ignoreValue }. Static-HTML and browser findings have line: 0; regex findings have 1-based lines. severity values in registry: 'warning' (default), 'advisory' (many generated-UI tells and design-system-color/radius/font-size, numbered-section-labels, blinking-cursor, shape-assembled-illustration), 'error' (script-error, content-hidden-at-rest). severity is the canonical advisory field (#709): deriveAdvisoryFlag stamps advisory: true when and only when the effective severity is 'advisory', so a per-finding promotion or demotion carries the flag with it, and every severity:'advisory' rule is partitioned out of the failure count and the exit code. isAdvisory accepts either finding.advisory === true or finding.severity === 'advisory'.

Categories: category is 'slop' (AI tells) or 'quality'. Category has no effect on output, ordering, or exit codes; it is only carried in the finding and used by getRulesForCategory. Registry (59 ids, in order): side-tab, border-accent-on-rounded, overused-font, flat-type-hierarchy, gradient-text, ai-color-palette, cream-palette, nested-cards, monotonous-spacing, bounce-easing, pulsing-dot, blinking-cursor, shape-assembled-illustration, dark-glow, radial-halo, radial-spotlight-glow, marquee, icon-tile-stack, italic-serif-display, hero-eyebrow-chip, kicker-above-heading, numbered-section-labels, em-dash-overuse, marketing-buzzword, aphoristic-cadence, oversized-h1, extreme-negative-tracking, broken-image, script-error, content-hidden-at-rest, edge-flush-cards, text-occlusion, first-viewport-column-overflow, gray-on-color, low-contrast, layout-transition, line-length, cramped-padding, body-text-viewport-edge, tight-leading, skipped-heading, heading-rhythm, justified-text, tiny-text, undersized-ui-text, all-caps-body, wide-tracking, text-overflow, repeated-container-text, clipped-overflow-container, design-system-font, design-system-color, design-system-radius, design-system-font-size, gpt-thin-border-wide-shadow, repeating-stripes-gradient, codex-grid-background, theater-slop-phrase, image-hover-transform. Scopes: type = overused-font, flat-type-hierarchy, italic-serif-display, hero-eyebrow-chip, kicker-above-heading, numbered-section-labels, oversized-h1, extreme-negative-tracking, line-length, tight-leading, skipped-heading, heading-rhythm, justified-text, tiny-text, undersized-ui-text, all-caps-body, wide-tracking, design-system-font, design-system-font-size; layout = nested-cards, monotonous-spacing, icon-tile-stack, content-hidden-at-rest, edge-flush-cards, text-occlusion, first-viewport-column-overflow, line-length, cramped-padding, body-text-viewport-edge, heading-rhythm, text-overflow, clipped-overflow-container. RULE_ENGINE_SUPPORT = { regex: Set['source','page-analyzer'], 'static-html': Set['element','page'], browser: Set['element','page','layout'], visual: Set['visual-contrast'] }.

Tests: tests/detect-antipatterns-fixtures.test.mjs (CLI block: --help exits 0 and contains Usage:/--quiet, not --gpt; --gpt prints deprecation; detect prefix accepted; should-pass exits 0; should-flag exits 2 with side-tab in stderr; --json parses; --quiet stdout empty and stderr matches /^[1-9]\d* anti-patterns? found\.$/; formatFindings — advisory partitioning), tests/detect-cli-stdin-dispatch.test.mjs, tests/detect-cli-design-contamination.test.mjs, tests/inline-ignores.test.mjs ("detect CLI end-to-end"), tests/detect-url-launch.test.mjs.

cli/engine/node/file-system.mjs

• SKIP_DIRS = {'node_modules','dist','build','__pycache__'}; any directory whose name starts with . is skipped except HIDDEN_SOURCE_DIRS = {'.vitepress','.vuepress','.storybook'}. The root passed to walkDir is never name-checked (an explicit hidden dir scans).
• SCANNABLE_EXTENSIONS = {'.html','.htm','.css','.scss','.sass','.less','.jsx','.tsx','.js','.ts','.vue','.svelte','.astro','.blade.php'}; hasScannableExtension lowercases and also matches multi-dot exts by endsWith (.blade.php).
• walkDir returns files in readdirSync order, recursive, unreadable dirs → [].
• There is no generated-file detection in the CLI (skill/scripts/lib/is-generated.mjs is hook-side only and not imported by cli/).
• Import graph: IMPORT_SPECIFIER_PATTERNS = [/import\s+(?:[\s\S]*?from\s+)?['"]([^'"]+)['"]/g, /@import\s+(?:url\(\s*)?['"]?([^'");\s]+)['"]?\s*\)?/g, /@(?:use|forward)\s+['"]([^'"]+)['"]/g]; resolveImport only for specifiers matching /^[./]/: exact, base+ext for each scannable ext, then base/index+ext.
• FRAMEWORK_CONFIGS (first match wins, in this order): Next.js (next.config.js|mjs|ts, 3000, /port\s*[:=]\s*(\d+)/, header x-powered-by ~ /next/i); SvelteKit (svelte.config.js|ts, 5173, header x-sveltekit-page any); Nuxt (nuxt.config.js|ts, 3000, x-powered-by ~ /nuxt/i); Vite (vite.config.js|ts|mjs, 5173, body /@vite\/client/); Astro (astro.config.js|ts|mjs, 4321, body /astro/i); Angular (angular.json, 4200, /"port"\s*:\s*(\d+)/, body /ng-version/i); Remix (remix.config.js|ts, 3000, x-powered-by ~ /remix/i). Port overridden by first regex match in the config file.
• isPortListening(port, fingerprint): with fingerprint → fetch('http://localhost:${port}/') 2s abort, header check then body check → {listening:true, matched:bool}; error → {listening:false}. Without fingerprint → TCP connect to 127.0.0.1 with 500ms timeout.

cli/engine/shared/inline-ignores.mjs — inline ignore comments

• DIRECTIVE_RE = /impeccable-(disable-next-line|disable-line|disable)\b[ \t]*([^\n\r]*)/gi (matched anywhere on a line, any comment syntax; case-insensitive).
• TRAILING_CLOSER_RE = /\s*(?:\*\/\}?|--+>|\*\}|#\}|%>|\}\})\s*$/ stripped from the remainder; then reason cut at first /\s*(?:--+|:)\s*/; tokens split on /[\s,]+/, lowercased; empty or containing * → ['*'].
• Lines split on '\n' only (CRLF-safe since \r excluded from capture). disable → file set; disable-line on line i (1-based) → line.get(i); disable-next-line on line i → nextLine.get(i+1).
• isInlineIgnored(finding): rule = lowercased finding.antipattern; file set match (* or rule) → true; if line > 0, line/nextLine set match → true. Line-less findings (static HTML, browser) match only whole-file directives.
• Applied inside detectText and detectHtml at the end unless options.inlineIgnores === false (set by --no-config or --no-inline-ignores). Not applied to URL scans.
• Fast path: skip unless /impeccable-disable/i occurs.
• DOM-scoped ignore (rules/checks.mjs scopedIgnoreActive): attribute data-impeccable-ignore="rule-a rule-b" (split on /[\s,]+/, lowercased; empty value or * = all) on an element waives matching findings for it and its subtree in browser, extension, and static engines. In detectHtml's html-patterns pass, selector-backed findings are dropped when every element matched by the (pseudo-stripped) selector is under a waiver; unmatched selectors keep the finding.
• Tests: tests/inline-ignores.test.mjs; fixture scoped-ignore.html.

Config file (cli/lib/impeccable-config.mjs) — .impeccable/config.json + .impeccable/config.local.json

• Paths: <root>/.impeccable/config.json (shared) and <root>/.impeccable/config.local.json (per-dev; writeDetectionConfig(...,{local:true}) also appends a block to .git/info/exclude: # impeccable-config-ignore-start\n.impeccable/config.local.json\n# impeccable-config-ignore-end, idempotent by marker regex, following gitdir: files for worktrees).
• Shape:

  { "detector": { "ignoreRules": ["side-tab"], "ignoreFiles": ["src/legacy/**"],
                  "ignoreValues": [{ "rule": "overused-font", "value": "inter", "files": ["src/a.css"], "createdAt": "ISO", "reason": "..." }],
                  "designSystem": { "enabled": true }, "advisoryRules": "include"|"exclude" },
    "hook": { "consent": "accepted"|"declined", ... }, "updateCheck": true }
  

• readDetectionConfig(root): start {ignoreRules:[],ignoreFiles:[],ignoreValues:[],designSystem:{enabled:true}}; for shared then local: apply legacy raw.hook.* section then raw.detector.*. Arrays are unioned (uniqueStrings, String-coerced); ignoreValues merged by key rule\0value\0sortedFiles.join('\x1f') (later wins); designSystem.enabled false only when literally false; advisoryRules copied only if 'include'|'exclude'. Invalid JSON / non-object files are ignored silently. No validation errors are ever raised by the CLI; the only validation of ignore lists lives in skill/scripts/lib/staleness-deep.mjs checkDetectorIgnores (doctor): unknown ignoreRules ids vs live ANTIPATTERNS → finding detector-ignore-rules-unknown (severity mention); non-glob ignoreFiles entries that don't exist → detector-ignore-files-missing.
• normalizeIgnoreValue(v): trim, strip one leading/trailing quote, +→space, collapse whitespace, lowercase. Rules lowercased/trimmed.
• normalizeIgnoreValueEntries: keeps {rule, value, [files], [createdAt], [reason]} in that key order; file (string) and files merged, trimmed, deduped.
• Glob → regex: ** → .* (swallowing a following /), * → [^/]*, ? → [^/], {a,b} → (?:a|b), regex specials escaped; anchored ^...$. matchesAnyGlob tests the /-normalized path and its basename.
• shouldIgnoreDetectionFile(filePath, root, config): raw path, absolute path, and root-relative path (if inside root) tested against ignoreFiles.
• filterDetectionFindings: drop when ignoreRules has the rule, or an ignoreValues entry matches: same rule; entry.value * (wildcard) OR extracted value equals (with color-key equality for design-system-color: rgb/hex/hsl parsed to r,g,b,round(a*255)); if entry has files, finding.file (or any /-suffix of it) must glob-match; a wildcard with no files never matches (unscoped * disallowed).
• extractFindingIgnoreValue: only for overused-font, bounce-easing, design-system-font, design-system-color, design-system-radius, design-system-font-size; source finding.ignoreValue || finding.value, else parse detail/snippet: bounce → animate-bounce, cubic-bezier(...), or animation token matching /bounce|elastic|wobble|jiggle|spring/i; fonts → Primary font:, Google Fonts:, font-family: value, or family= URL param (decoded).

impeccable ignores (cli/bin/commands/ignores.mjs)

• Actions/aliases: status|ls|list→list (default when no action), add-rule|ignore-rule, add-file|ignore-file, add-value|ignore-value|update-value, remove-rule|rm-rule, remove-file|rm-file, remove-value|rm-value, clear. --help/-h prints usage (stdout). Unknown → throws Unknown ignores action: ${a}. Run "impeccable ignores --help". (exit 1 via cli.js).
• Scope flags: --shared (default), --local, --all (remove/clear only); more than one → error Pass only one scope flag: --shared, --local, or --all (or --shared or --local).
• add-rule <rule> [--all-values] [--reason ...]: overused-font without --all-values → error "overused-font is value-specific by default. Use add-value overused-font , or add-rule overused-font --all-values for broad suppression." Output: Added ${rule} to ${local?'local':'shared'} detector ignoreRules (${relpath}).
• add-file <glob> → Added ${glob} to ... detector ignoreFiles (...).
• add-value <rule> <value...> [--file <glob>]... [--reason <text...>]: value = normalized join of positionals after rule; --file/--files/--file=/--files= (empty or flag-like → error); unknown --x → Unknown add-value flag: --x; * value requires --file; existing entry (same key) updates reason/files, else pushes {rule,value,[files],createdAt: ISO now,[reason]}. Output Added ${rule}=${value} to ... detector ignoreValues (...).
• remove-* → Removed ${n} from shared (path), ${n} from local (path). or No matching detector ignore found. clear → Cleared detector ignores in ${'shared and local config'|'local config'|'shared config'}.
• list output:

  Impeccable detector ignores
    shared file: .impeccable/config.json
    local file:  .impeccable/config.local.json
  
  Merged:
    ignoreRules:  (none)
    ignoreFiles:  ...
    ignoreValues: rule=value [glob1, glob2] - reason, ...
    designSystem: enabled|disabled
  
  Shared:
  ...
  
  Local:
  ...
  

• Tests: tests/cli-ignores.test.js.

cli/engine/engines/browser/detect-url.mjs — URL scans

• detectUrl(url, options); options: profile, waitUntil (default 'networkidle0'), settleMs (default 0), viewport (default {width:1280,height:800}), browser (external), headless (default true), designSystem, scriptErrors (default on), contentHidden (default on), visualContrast/visualContrastBrowser/visualContrastPixel (default on), visualContrastMaxCandidates (12), visualContrastScrollOffscreen (true).
• Puppeteer imported dynamically; missing → throw puppeteer is required for URL scanning. Install: npm install puppeteer. Browser script read from <engine>/detect-antipatterns-browser.js; missing → Browser script not found at ${path}.
• Launch: launchArgs = process.env.CI ? ['--no-sandbox','--disable-setuid-sandbox'] : []. On win32 first puppeteer.launch({channel:'chrome', headless, args}), on failure fall back to bundled puppeteer.launch({headless, args}) with err.cause = channelError. Non-Windows: bundled only.
• Flow: newPage → attach pageerror listener (message first line, trimmed, sliced to 160 chars, deduped) → setViewport(viewport) → page.goto(url, {waitUntil, timeout: 30000}) → optional settle → page.evaluate sets window.__IMPECCABLE_CONFIG__ = {...existing, autoScan:false, ...(designSystem ? {designSystem} : {})} where designSystem serialized as {present:true, hasFonts, allowedFonts:[...], hasColors, allowedColors:[{r,g,b}], hasRadii, allowedRadii:[px], hasPillRadius} → page.evaluate(browserScript) (injects the bundle; defines window.impeccableDetect/impeccableDetectAsync/impeccableScan/impeccableScanAsync/impeccableMeasureHiddenText/impeccableCollectVisualContrastCandidates/impeccableAnalyzeVisualContrast/impeccableGetLastVisualContrastAnalyses) → window.impeccableDetect({decorate:false, serialize:true}) returns groups [{selector, tagName, rect, isPageLevel, isHidden, findings:[{type, category, severity, advisory, detail, ignoreValue, name, description}]}]; flattened to {id:type, snippet:detail, ignoreValue, severity} → content-hidden sweep (measureContentHiddenAfterReveal: scroll in steps max(200, floor(innerHeight*0.7)) with behavior:'instant', 40ms rAF pauses, back to top, wait 700ms, then impeccableMeasureHiddenText(); checkContentHiddenAtRest fires when totalChars>=200 && hiddenChars>=150 && share>0.3, snippet ${pct}% of page text (${hidden} of ${total} chars) stays at opacity 0 / visibility hidden after reveal handlers ran (e.g. "sample")) → up to 3 script-error findings {id:'script-error', snippet:message} → visual contrast fallback → finally close page (and browser if owned).
• Visual contrast fallback (runVisualContrastFallback): browser-side impeccableAnalyzeVisualContrast({maxCandidates, scrollOffscreen}) findings not already low-contrast on that selector; then candidates (from analyses or impeccableCollectVisualContrastCandidates) not resolved pass/fail → per candidate captureVisualContrastCandidate(page, candidate, viewport).
• Screenshot flow (screenshot-contrast.mjs): clip sanitized (x,y floored ≥0; width ≤ viewport width (default 1600), height ≤ 320, both ≥1); page.screenshot({encoding:'base64', clip, captureBeyondViewport:true}) before; inject <style id="impeccable-visual-contrast-hide-style">[data-impeccable-visual-contrast-target]{color:transparent!important;-webkit-text-fill-color:transparent!important;text-shadow:none!important}[data-impeccable-visual-contrast-target][data-impeccable-bgclip-text="true"]{background-image:none!important} and set attribute data-impeccable-visual-contrast-target=impeccable-contrast-${Date.now()}-${rand} (+ data-impeccable-bgclip-text="true" if candidate.backgroundClipText); screenshot after; remove attributes; in-page canvas diff: pixels with channel delta sum ≥10 are glyph pixels; ratio uses WCAG luminance of CSS text color (unless preferRenderedForeground) vs after-pixel; needs ≥8 ratios; p10 = ratios[floor(0.10*n)]; finding when p10 < candidate.threshold: {id:'low-contrast', snippet:pixel contrast ${p10.toFixed(1)}:1 median ${median.toFixed(1)}:1 (need ${threshold}:1) on ${reasons.slice(0,3).join(', ') || 'visual background'} "${text}"}. No screenshot files are written.
• Results mapped via finding(id, url, snippet) (file = the URL, line 0); ignoreValue set if present; severity overridden if the browser supplied one.
• createBrowserDetector(options): shared browser, defaults waitUntil:'load', settleMs:100, viewport 1280x800; close() closes only an owned browser.
• Tests: tests/detect-url-launch.test.mjs, tests/detect-antipatterns-browser.test.mjs.

Static and regex engines (only what affects the contract)

• detectHtml: reads file, imports htmlparser2, css-select, css-tree, domutils; on import failure prints once to stderr impeccable detect: DEGRADED - HTML parser modules unavailable (htmlparser2, css-select, css-tree, domutils).\nFalling back to regex matching. Custom properties, selector matching and computed contrast are NOT evaluated; findings are an undercount, not a clean bill of health.\n and falls back to detectText. Inlines <link rel=stylesheet href> that are local (not /^(https?:)?\/\//i), query/hash stripped. Runs element rules, design-system rules (checkSourceDesignSystem + collectStaticDesignSystemFindings, merged), then page rules only when isFullPage(html) (/<!doctype\s|<html[\s>]|<head[\s>]/i after stripping comments), plus text-content analyzers; ends with inline-ignore filtering.
• detectText: regex line matchers (ids: side-tab, border-accent-on-rounded, overused-font, gradient-text, ai-color-palette, gray-on-color, bounce-easing, layout-transition, broken-image), inset-stripe/pseudo-stripe CSS scans, codex-grid-background, <style> blocks (Astro/Vue/Svelte), CSS-in-JS templates, design-system source checks; dedupe (same antipattern+snippet within 2 lines); page analyzers only when isFullPage and ext ∈ {'.html','.htm','.astro','.vue','.svelte'} or no ext (<stdin>): flat-type-hierarchy, monotonous-spacing, em-dash-overuse, marketing-buzzword, aphoristic-cadence, dark-glow (+ radial-halo, marquee); inline ignores last.

Profiler (cli/engine/profile/profiler.mjs)

• Not exposed via any CLI flag (no --profile; grep finds none). Library only: createDetectorProfile() → {events: []}; engines call profileFindings/profileStep/(Async) when options.profile is passed programmatically. recordProfileEvent normalizes to {engine, phase, ruleId, target, ms, findings, [detail], [findingIds]} (defaults 'unknown'/''/0) and pushes to profile.events (or calls profile(event), profile.record, or pushes to an array). summarizeDetectorProfile(profile) groups by engine\0phase\0ruleId\0target and returns [{engine, phase, ruleId, target, calls, totalMs, avgMs, p50, p95, findings}] (ms values Number(x.toFixed(3)), percentile index min(n-1, max(0, ceil(pct/100*n)-1)) over sorted samples), sorted by totalMs desc. Event vocabulary used: engine browser|static-html|regex; phases setup|load|scan|visual-contrast|element|page|parse-html|source|style-block|css-in-js|extract|text-content|page-analyzer; ruleIds like import-puppeteer, read-browser-script, launch-browser, new-page, set-viewport, goto:${waitUntil}, settle, configure-pure-detect, inject-browser-script, browser-scan, content-hidden-at-rest, browser-fallback, collect-candidates, pixel-diff, close-page, close-browser, read-html, import-static-parser, parse-document, inline-linked-stylesheet, design-system, typography-rules, kicker-above-heading, numbered-section-labels, repeated-container-text, layout-rules, cream-palette, skipped-heading, html-patterns, text-content, codex-grid-background, style-blocks, css-in-js, or the rule id.

---

impeccable help|install|link|update|check and impeccable skills <verb> (cli/bin/commands/skills.mjs)

Rust authenticity addition (#479): the historical JS bundle flow below is superseded for remote downloads. The Rust installer resolves the site's redirect (301/302/303/307/308) to a versioned Impeccable GitHub release and verifies universal.zip.sig.json against a compiled-in Ed25519 public key before ZIP extraction. Missing/invalid signatures, unknown keys, mismatched metadata or content, and failures fetching either asset exit nonzero, including when install finds an existing installation. No downloaded content reaches the installed skill or hook files. Explicit IMPECCABLE_BUNDLE_PATH and link retain their local-development trust behavior. See bundle signing.

TLS trust (#757): every HTTPS request the engine makes (bundle and signature downloads, /api/version, /api/commands, the roll API, image generation) verifies against the OS trust store plus the bundled Mozilla roots, built once in crates/context/src/http.rs. SSL_CERT_FILE / SSL_CERT_DIR replace the OS store, never the bundled roots. The live server calls on localhost are plain HTTP and unaffected.

• Invoked from: README.md ("npx impeccable install / update"), README.npm.md Quick Start (npx impeccable skills install, ... install -y --providers=claude,codex --scope=project, ... update, ... install --no-hooks, ... link --source=.impeccable --providers=claude,cursor, ... skills help), README.md:360 (hook consent explanation).
• run(args): args[0] ∈ undefined|help|--help|-h → showHelp(); install → install(rest); link; update; check (ignores flags); else stderr> Unknown skills command: ${sub} + Run 'impeccable --help' for available commands., exit 1.
• Constants: API_BASE = 'https://impeccable.style'; PROVIDER_DIRS = ['.claude','.cursor','.dsh','.gemini','.agents','.agent','.github','.grok','.hermes','.kiro','.opencode','.pi','.qoder','.trae','.trae-cn','.rovodev','.vibe']; aliases (agent→.agent, agents/codex→.agents, antigravity→.agent, claude/claude-code→.claude, copilot/github→.github, cursor, deepseek/deepseek-harness/dsh→.dsh, gemini, grok/grok-build/xai→.grok, hermes, kiro, opencode, pi, qoder, rovo-dev/rovodev→.rovodev, trae, trae-cn, vibe); leading . stripped and lowercased before alias lookup; a literal PROVIDER_DIR value is accepted as-is. DEFAULT_TARGETS = ['.claude','.agents']. User-scope skill dir overrides: .agent→~/.gemini/config/skills, .dsh→$DSH_HOME/skills (only when DSH_HOME under home) else ~/.dsh/skills, .hermes→$HERMES_HOME/skills (only when HERMES_HOME under home) else ~/.hermes/skills, .pi→~/.pi/agent/skills, .opencode→$OPENCODE_CONFIG_DIR|$XDG_CONFIG_HOME/opencode|~/.config/opencode + /skills; others ~/<provider>/skills. Project scope: <root>/<provider>/skills.
• help: fetch('https://impeccable.style/api/commands') → JSON array [{id, description}]; failure → stderr> Could not fetch command list from impeccable.style. Check your network connection., exit 1. Prints:

  
    Impeccable Skills & Commands
  
    Install:  npx impeccable install
    Link:     npx impeccable link --source=.impeccable
    Update:   npx impeccable update
    Docs:     https://impeccable.style/cheatsheet
  
    Command                Description
    ---------------------- ----------------------------------------------------
    /<id padded to 22>     <description, truncated to 69 chars + '...' if > 72>
    ...
  
    N commands available. Run /<command> in your AI harness.
  
  

  sorted by id.localeCompare.
• Flag parsing (getFlagValue): --name=value or --name value (next arg not starting with -). Boolean flags via includes.
• install flags: --force, -y|--yes, --no-hooks, --providers=<list>, scope: --user|--home|--global → user; --project|--local → project; --scope=<v>/--install-scope=<v> normalized (u|user|home|global→user, p|project|local|repo→project; unknown → error Unknown install scope: ${v}. Use --scope=project or --scope=global.). Project root = nearest ancestor with .git, else cwd. Detection: project harness dirs present in root, plus GLOBAL_HARNESS_HINTS under home (.agent, .gemini/antigravity*→.agent, .claude, .codex→.agents, .cursor, .dsh (resolved $DSH_HOME, fallback ~/.dsh), .gemini, .grok, .hermes, .kiro, .opencode, opencode config dir, .pi, .qoder, .rovodev, .vibe). Targets: explicit list wins (invalid names → Unknown provider(s): ...); -y → detected project providers, else detected user providers, else DEFAULT_TARGETS; interactive → prints "Detected harnesses:" table then radio/checkbox prompts (raw-mode TTY) or line prompts (Install target: [1] Detected only (...) [2] Customize [1]: , Select harnesses (comma-separated: ...)). Scope: explicit; -y → project; interactive prompt Install location (Project/Global). Hooks: decideHookInstall reads hook.consent in config(.local).json; declined→false, accepted→true; all targets already have hook markers→true; -y or non-TTY→true; else prints HOOK_EXPLAINER and asks Install the design hook? (Y/n) , storing consent in .impeccable/config.local.json. Bundle: IMPECCABLE_BUNDLE_PATH (dir or zip) else download https://impeccable.style/api/download/bundle/universal (https get, one redirect followed, non-200 → HTTP ${status}) to ${tmpdir}/impeccable-update-${Date.now()}.zip, extracted with fflate.unzipSync into ${tmpdir}/impeccable-update-${Date.now()} (zip-slip guarded: Refusing to extract entry outside target dir: ${entry}). Bundle layout <bundle>/<provider>/skills/<skill>/..., <bundle>/<provider>/agents/*.md, hook manifests <bundle>/.claude/settings.json, .cursor/hooks.json, .codex/hooks.json, .github/hooks/impeccable.json, .grok/hooks/impeccable.json. Fresh install: stdout> \nDownloading impeccable skills...; migrate *-impeccable prefixed dirs → impeccable; copy each skill dir (rm existing dest first; drop an in-project cross-provider symlinked skills dir); copy agents (.github→.github/agents or ~/.copilot/agents; .cursor→.cursor/agents or ~/.cursor/agents); write hooks (dest: .claude/settings.local.json [skips if .claude/settings.json already carries the marker and prunes the local copy], .cursor/hooks.json, .codex/hooks.json for .agents, .github/hooks/impeccable.json, .grok/hooks/impeccable.json); merged with existing JSON (mergeHookManifests: strips existing impeccable entries by markers skills/impeccable/scripts/hook-probe.mjs|hook.mjs|hook-before-edit.mjs|hook-after-edit.mjs|hook-stop.mjs, then appends fresh); invalid existing JSON → error Existing hook manifest is not valid JSON: ${dest}. Re-run with --force to replace it. (with --force, .bak written). Hook command rewriting: [ ! -f '<abs>' ] || node '<abs>' (POSIX, single-quote-escaped) when absolute (user scope or global skill), else [ ! -f "<rel>" ] || node "<rel>" where rel = ${CLAUDE_PROJECT_DIR}/.claude/skills/impeccable/scripts/hook.mjs (Claude), .agents/skills/impeccable/scripts/hook.mjs (Codex; plus commandWindows: if exist "<p>" (node "<p>" & exit /b)), .cursor/skills/impeccable/scripts/hook-before-edit.mjs; on win32 for non-Codex: node -e "<WIN32_HOOK_GUARD_SCRIPT>" "<path>". Output: Installed impeccable into: ${targets.join(', ')} (${'global'|'project'}), optional Installed <Provider> agents into: <path> (+ shadow warning), Installed hooks into: ..., then \nDone! Now type /impeccable init in your AI coding agent's chat (not in this terminal) to set up design context.\n. Errors: Download failed: ... / Install failed: ... / Nothing was installed: the bundle had no variants for ... → exit 1. Already installed (and not --force): Impeccable skills are already installed (found in ${provider}/).; compares tree hashes (sha256 of file content with \.(claude|cursor|...)\/skills\/ normalized to .PROVIDER/skills/); if differs → refresh + Updated ${n} skill(s) to v${v}.; missing hooks repaired; else Skills are up to date (v${v}). + Run with --force to reinstall.; offline → Could not check for skill updates: ${msg} + Existing skills were left unchanged.; ends Done! or the above; exit 0. Version read from ^version:\s*(.+)$ in installed impeccable/SKILL.md.
• update flags: -y|--yes, --force, --no-hooks, scope flags as above (unknown → Unknown update scope: ${v}. Use --project or --user.). Resolves project vs user installs holding an impeccable/*-impeccable/teach-impeccable skill; none → No impeccable skill folders found in this project or at the user level. + Run \npx impeccable install` to install first., exit 1; both → prompt Update which? [project]/user: (non-TTY defaults project). PrintsUpdating the ${label} install: ${root} (${providers}), linked providers note, Checking for updates...; up to date → Skills are up to date (vX).[+hooks] +Nothing else to do., exit 0; else Found skills in: ..., prompt Update skills in N provider folder(s)? (Y/n) (n/no →Aborted.exit 0), refresh,Updated N skill(s) to vX., Done!`.
• link: --source=<path> (default .impeccable), --providers, --force, -y. Source must contain dist/universal/ or provider */skills dirs, else Could not find compiled skills in ${src}. Expected dist/universal/ or provider skill folders. Prompts Link impeccable skills into N folder(s)? (Y/n) ; creates relative dir symlinks; existing non-link skipped with warning unless --force; output Linked impeccable into: ... (N linked, N already linked, N skipped). + submodule hint.
• check: not installed → Impeccable is not installed in this project. + Run \npx impeccable install` to install.exit 0; elseChecking for updates...\nthenSkills are up to date (vX).orUpdates available.+Run `npx impeccable update` to update.; failure → Could not check for updates: ${msg}` exit 1.
• Prompts: non-TTY ask() reads answers line-by-line from stdin (fd 0) after echoing the question; TTY SIGINT → PromptAbortError (code IMPECCABLE_PROMPT_ABORT) → cli.js prints \nAborted. exit 130. ANSI (\x1b[36m accent, \x1b[1m bold, \x1b[2m dim, \x1b[32m good) only when stdout is TTY, NO_COLOR unset, TERM !== 'dumb'.
• Tests: tests/skills-cli.test.js, tests/cli-remote-e2e (opt-in).

---

PART 2 — skill/scripts verbs

concept-seed.mjs -> node {{scripts_path}}/concept-seed.mjs

• Invoked from: reference/new-work.md:37 "node {{scripts_path}}/concept-seed.mjs --scope surface --mode <mode>" and :46 "4. Run node {{scripts_path}}/concept-seed.mjs --scope direction --mode <mode> and follow what it prints. No substitute, no skip". Header usage lines: --scope direction --mode persuade, --scope surface --mode operate --from <key>, --grain flow, --candidate-count 6, --from <key> --reroll 1 [--register bolder], --chosen <challenger-id> --kind challenger --from <key> --scope direction, --kind assigned --from <key> --scope direction.
• Args (each read as args[idx+1] after indexOf): --scope (surface default | direction), --from <key> (default IMPECCABLE_CONCEPT_SEED env or crypto.randomBytes(4).toString('hex')), --reroll <n> (Number, default 0), --register safer|bolder, --mode persuade|operate|read|experience, --grain product|flow|view|region, --platform web|ios|android, --candidate-count 5..7 (default 7), --chosen <id>, --kind assigned|pick|challenger|canon.
• Env: IMPECCABLE_CONCEPT_SEED, IMPECCABLE_CATALOG_DIR (default = script dir; local catalog files concept-ingredients.json, concept-reviews.json, composition-ingredients.json, composition-reviews.json; invalid/missing → treated as absent), IMPECCABLE_API_URL (default https://impeccable.style/api, trailing / stripped), IMPECCABLE_API_TIMEOUT (ms, default 4000, one shared deadline for all API calls in the run), IMPECCABLE_NO_TELEMETRY, DO_NOT_TRACK, IMPECCABLE_CARD_BASE (default https://impeccable.style/worlds/cards), IMPECCABLE_COMPOSITIONS=1 (renders composition block; otherwise compositions are dealt but not printed).
• Validation errors (stderr, exitCode 1): concept-seed: --scope must be direction or surface; --reroll must be a non-negative integer; --register must be safer or bolder; --register steers a re-roll round; pass --reroll <n> with it; --register applies to direction rounds only; --mode must be persuade, operate, read, or experience; --grain must be one of product, flow, view, region; --platform must be one of web, ios, android; --candidate-count must be an integer from 5 to 7; concept-seed: every challenger tier needs at least one approved concept (local catalog).
• Init gate (render path only): imports ./context.mjs loadContext(cwd); if !hasProduct → stdout> NO_PRODUCT_MD: the dice stay in the cup until product truth exists. Complete the init ask round and write PRODUCT.md first (reference/init.md), then re-run this exact command. Challengers fuse their form with facts from PRODUCT.md; without it every direction is ungrounded.\n, exit 1.
• Assigned index math: unit(salt) = sha256(${scope}:${salt}:${key}).readUInt32BE(0)/0xffffffff; indexSalt = reroll===0 ? 'index' : index:reroll-${reroll}``; buildIndex = 3 + floor(unit(indexSalt)*(candidateCount-2)) (3..candidateCount). Surface scope deals dealtIndices=[buildIndex] plus up to 2 more distinct in 1..candidateCount via unit(${indexSalt}:deal-${draw}) (fills sequentially after 64 draws).
• Data resolution: local catalog → source:'local' (challengers via selectApprovedChallengers, compositions via selectApprovedCompositions, both in lib/roll-selection.mjs, hash = Node sha256 hex; poolRevision = first 12 hex of sha256 over sorted approved familyId:id:strength:form:spark:JSON(system):webLeverage lines); else roll API GET ${API_BASE}/roll?scope=&key=&reroll=[&mode=][&grain=][&platform=] (URLSearchParams order: scope, key, reroll, mode, grain, platform), raced against the shared budget; non-ok, timeout, or challengers empty → null; response fields used: poolRevision, approvedCount, catalogCount, challengers, compositions|stagings|staging; else degraded.
• Selection algorithm (roll-selection): challengers: approved concepts; per wellTier in ['graphic','interaction','atmosphere'] (all three must be non-empty), optional minRating gate, mode gate (review.allowedModes absent = all), strength filter (direction wants world|dual, surface wants composition|dual; per-tier fallback to full pool). Tier order ranked by digests of ${scope}:${key}:tiers${salt}:${tierId} desc; per tier tickets (breadth==='niche' excluded; tickets by rating {1:1,2:2,3:2}, default 2) ranked by ${scope}:${key}:challenger-${index}${salt}:${id}#${ticket}; first pick + first of a different familyId (else next distinct id) → 6 picks; re-roll round n excludes all earlier picks (fallback to full tier pool if exhausted); salt = round===0 ? '' : :reroll-${round}``. Compositions: approved, non-niche (fallback all), surface===mode (empty → none), platform hard filter (platforms absent = all), tickets ranked with salt ${scope}:${key}:staging[:reroll-${round}], grain-preferred stable partition, distinct familyId first then top-up, count 3; match = {grain, atGrain, grainAvailable, platform, platformExcluded}.
• stdout (full roll): header line ${SCOPE} CONCEPT SEED (key: ${key}; mode: ${mode ?? 'unscoped'}; source: ${local|api}; approved pool: ${poolRevision}; ${approvedCount}/${catalogCount} human-approved; rerun with --scope ${scope}[ --mode m] --from ${key}[ --reroll n][ --register r] --candidate-count ${n} to reproduce this roll against this catalog revision), then [RE-ROLL ROUND n ...], the assigned block (ASSIGNED INDEX: N / DEALT INDICES: a, b, c (index N leads) + instruction, or SAFER/BOLDER REGISTER block), CHALLENGERS: with renderChallenger per concept:

    ${i+1}. ${form}
       SOURCE ID: ${id}
       CREATIVE SPARK: ${spark}
       SYSTEM GRAMMAR:
         - rule...
       WEB LEVERAGE: ${webLeverage}
       QUALITY BAR: board ${cardBoard || CARD_BASE/id.webp} · hero ${cardHero || CARD_BASE/id-hero.webp}
  

  optional composition block, challenger instruction, quality-bar sentence, authority + richness instructions, TELEMETRY: block (api source only), A user- or brief-pinned decision beats the roll, always., and the restated line (ASSIGNED INDEX (restated for truncated readers): N. ...; seed key ${key}.). Degraded: header ... source: degraded; rerun with ...) then ASSIGNED INDEX/DEALT INDICES, the "No challengers this run: the roll service was unreachable and no local catalog exists..." paragraph naming the single GET to https://impeccable.style/api/roll, authority, pinned-decision line, restated line. Safer register while degraded prints the SAFER block without assignment. Full text templates are in the source (lines 405-690) and should be copied verbatim.
• Telemetry ping (--chosen and/or --kind present; never gated by PRODUCT.md): pingChosen({chosenId, key, scope, mode, kind, register}): skipped (returns false) when IMPECCABLE_NO_TELEMETRY or DO_NOT_TRACK set, kind not in {assigned,pick,challenger,canon}, register not safer|bolder, neither chosenId nor kind, or kind challenger/absent without chosenId. Else POST ${API_BASE}/chosen with Content-Type: application/json, body JSON.stringify({ [chosenId], key, scope, mode, [kind], [register] }) (undefined values omitted by JSON.stringify), abort at budget. stdout choice recorded\n on success else choice ping skipped\n; always exit 0.
• Exit: destroys undici global dispatcher then process.exit(exitCode ?? 0).
• Tests: tests/concept-seed.test.mjs (scopes reproducibility, degraded seed, register, ratings/breadth/mode/grain/platform, init gate, pingChosen validation & opt-out, API roll path + dispatcher destroy).

serve-question.mjs -> node {{scripts_path}}/serve-question.mjs

• Invoked from: reference/new-work.md "Run node {{scripts_path}}/serve-question.mjs --start --payload <file> (--schema first for the payload shape). It daemonizes, prints the page URL and a key, and exits; open that URL for the user, in-app browser first, then the system opener, then showing the URL. Collect the choice with --wait --key <key>, repeating while it exits 3; the ANSWER prints as JSON. An ANSWER of {"optionId":"reroll"} keeps the server alive..."; visualize.md:24 "Show the three together on the decision page (serve-question.mjs, one option per comp with the comp as its hero)"; new-work.md "each card carries a wireframe schematic (serve-question.mjs --schema)". Degraded concept-seed also names it.
• Arg helper: arg(name) = value after --name unless it starts with --; hasFlag.
• Env gates (evaluated at top): IMPECCABLE_QUESTION_DISABLED → stdout> serve-question: disabled in this session (no browser); use the structured question tool instead., exit 2. Headless detection only when wantsBrowser = !--no-open && !--wait && !--stop && !--schema && !--update and IMPECCABLE_QUESTION_FORCE unset: CI || (SSH_CONNECTION && !DISPLAY) || (linux && !DISPLAY && !WAYLAND_DISPLAY) → stdout> serve-question: no browser detected in this environment (CI/headless/remote); use the structured question tool instead. Set IMPECCABLE_QUESTION_FORCE=1 to serve anyway., exit 2.
• Common params: --payload <file> (else stdin), --timeout <sec> (default 900; 0 = wait forever for a page; negative/NaN → 900), --idle-grace <sec> (default 600; ≤0/NaN → 600), --port <n> (default 0 = ephemeral), --key, --no-open, --open, --poll <sec> (wait, default 60). State dir QUESTION_DIR = <cwd>/.impeccable/questions/ with files <key>.state.json ({pid, port, url, lastBeat?, claimedAt?}), <key>.answer.json, <key>.flip.json, <key>.next.json, <key>.log. NEXT_CLAIM_GRACE_MS = 10000.
• Modes:
  • --schema: prints canonical payload JSON (2-space) then a long explanatory paragraph; exit 0. (Copy verbatim from source lines 210-232.)
  • --wait --key K [--poll N]: loops up to N s (1 s ticks): answer file → break; flip file exists → delete it, stdout> BUILD PATH FLIPPED: comp (for this session only; never write it to settings). The table is still open and the page shows shimmer where the images will land: generate each open card’s comp into its declared path now, lead first, then collect the answer with --wait again. A card whose comp already exists needs nothing. exit 0; server dead (no fresh lastBeat <12 s and process.kill(pid,0) fails with non-EPERM) → stdout> serve-question: the question server is gone with no answer. This is a server failure, not a user decision: restart it with --start and the same payload, reopen the URL for the user, and wait again. Never proceed without their choice while their browser session is open. exit 2; lastBeat older than 15 s and not mid-delivery (next.json mtime <10 s or claimedAt <10 s) → PAGE CLOSED: the question page went away without an answer; re-present, reopen the URL, or fall back to the structured question tool exit 4; no answer after poll → WAITING: no answer yet after ${N}s; run --wait --key ${K} again exit 3; answer → printAnswer, delete answer file, delete state file unless optionId reroll or followup:true; exit 0. Missing --key → stderr> serve-question: --wait needs --key exit 1.
  • --stop --key K: kill pid from state, remove answer/state, stdout> stopped, exit 0.
  • --update --key K --payload F: payload must have non-empty options (else stderr serve-question: --update payload needs an options array; nothing was delivered. Fix the payload and rerun --update on the same key. exit 1); server liveness like wait (dead → stderr serve-question: no live question server for that key; the page it served is gone too. Re-present the round with --start and a fresh key, or fall back to the structured question tool. exit 2); copies payload to <key>.next.json, touches mtime, stdout> next round delivered; the page reloads itself, exit 0.
  • --start --payload F [--key K] [--open] [--timeout] [--idle-grace]: validates JSON, spawns detached child node serve-question.mjs --payload F --detached-serve --key K --timeout T [--idle-grace G] [--no-open unless --open] with stdio to <key>.log; waits ≤8 s for state file; failure → stderr serve-question: server failed to start + last 4 log lines + serve-question: log at <rel>. A sandboxed exec that cannot listen on localhost causes exactly this; rerun this command once through the harness's network-enabled or unsandboxed command tool before falling back. exit 1; success stdout: QUESTION URL: ${url}, QUESTION KEY: ${key}, Open the URL for the user now: in-app browser when the harness has one, otherwise the system opener (macOS \open`, Linux `xdg-open`), otherwise show the URL., Then collect the answer with: node --wait --key ${key}; exit 0. Key default Math.random().toString(16).slice(2,10)`.
  • default (blocking): loads payload (error → stderr serve-question: payload needs an options array exit 1), listens on 127.0.0.1:${port}, stdout> QUESTION URL: http://127.0.0.1:${port}/ and Waiting for the user to choose in the browser (Ctrl-C aborts)..., opens browser unless --no-open; on answer prints via printAnswer and exits 0 after 150 ms. Detached mode writes state instead of printing.
• Payload processing (loadRound): options decorated with heroSrc/boardSrc (http(s) URL passthrough; local path must exist → /img/<i>), compSrc (comp or legacy sketch; local path registered even if missing); verdict==='declined' cards moved to the end; canonCard appended as {...card, id:'canon', isCanon:true} before declined; buildPath {value:'comp'|'code', toggle:bool}.
• HTTP routes: GET / → HTML page (claims <key>.next.json if present, stamps claimedAt); POST /heartbeat → 204, updates lastBeat in state at most every 4 s; GET /next-status → {"ready":bool}; GET /img/<n> → local file stream (content-type by ext: webp/png/svg+xml/gif, else jpeg; 404 if missing); POST /build-path {value} → {"ok":true}, writes <key>.flip.json {"buildPath":"comp"} on a flip to comp; POST /answer {optionId, steer, register?} → {"ok":true} and answer JSON {optionId, steer, [register], [followup:true], [hero, board], [comp], [buildPath, buildPathFlipped]} written to answer file (detached) or printed; process exits 150 ms later unless reroll/followup in detached mode; else 404.
• Page (server-rendered HTML; <title>${payload.title || 'impeccable · decision'}</title>, <h1> payload.title or Choose a direction): cards with kicker, media (comp with shimmer + polling until /img/<n> returns 200; hero/board inspiration; wireframe grid), thesis, palette swatches (≤6), material tags (≤4), raise lines, facts, Build this / Adopt anyway (declined) / Play it straight (canon) buttons; optional #steer input (placeholder Optional steer: what should be different or kept?), Re-roll button with optional safer/bolder register buttons, #canon footer button when canon && !canonCard, build-path toggle. Client heartbeats every 5000 ms via navigator.sendBeacon('/heartbeat'); posts /answer; after reroll/followup polls /next-status and reloads.
• printAnswer: ANSWER: ${raw} then conditional directive lines CHOSEN CARD: ..., CHOSEN COMP: ..., CANON CHOSEN: ..., REGISTER: ..., FOLLOWUP OPEN: ..., BUILD PATH: ${value} (${origin}). ... (verbatim in source lines 152-190).
• Lifetime: no page ever beat → exit 2 serve-question: timed out with no answer after --timeout (unless 0); after beats, silence > idle-grace (with 10 s claim window for a delivered next hand) → exit 2 serve-question: the page stopped beating and never came back; exiting.
• Browser opener (lib/open-system-browser.mjs): darwin open <url>; win32 ${ComSpec||COMSPEC||'cmd.exe'} /c start "" <url>; else xdg-open <url>; spawned detached, stdio:'ignore', unref, errors swallowed; returns true/false.
• Tests: tests/serve-question.test.mjs (opener commands, blocking answer, reroll, start/wait cycle, headless gating, empty payload, heartbeat/timeouts, refresh semantics, --update, comps streaming), tests/new-work-e2e.test.mjs.

generate-image.mjs -> node {{scripts_path}}/generate-image.mjs

• Invoked from: context.mjs appendImageGenDirective (only when OPENAI_API_KEY set): "IMAGE_GEN_AVAILABLE: ... node ${scriptsPath}/generate-image.mjs --prompt "..." --out <file> (gpt-image-2, billed to the user's key; say so before the first render, and never reach for it when a native tool exists)."; new-work.md ("the harness image tool's input image, or generate-image.mjs --ref"); visualize.md:30 ("every comp generated through generate-image.mjs has one [.json sidecar]").
• Args: --prompt <text> or --prompt-file <path> (file wins), --out <path> (required), --size <WxH> (default 1536x1024), --quality (default medium), --ref <img> repeatable.
• Fake mode IMPECCABLE_IMAGE_GEN_FAKE=1: no network; .svg out → SVG with prompt-hashed 2-3 color gradient (FNV-1a), wrapped prompt text, SYNTHETIC COMP label; otherwise a minimal PNG (palette stripes, tEXt chunk Comment\0SYNTHETIC COMP: <prompt>); size parsed by /^(\d+)x(\d+)$/ else 1536x1024; stdout> IMAGE: ${out} (${w}x${h}, fake synthetic comp, $0.00, no API call); exit 0. Missing prompt/out → stderr generate-image: --prompt (or --prompt-file) and --out are required. exit 1.
• Real mode: no OPENAI_API_KEY → stderr generate-image: OPENAI_API_KEY is not set; use the harness-native image tool instead. exit 1. Without refs: POST https://api.openai.com/v1/images/generations, headers Authorization: Bearer <key>, content-type: application/json, body {"model":"gpt-image-2","prompt":...,"size":...,"quality":...,"n":1}. With refs: POST https://api.openai.com/v1/images/edits multipart FormData fields model=gpt-image-2, prompt, size, quality, n=1, image[] blobs (type png/webp else jpeg, filename basename). Non-ok → stderr generate-image: API error ${status}: ${first 300 chars} exit 1; no data[0].b64_json → generate-image: no image in response exit 1. Writes decoded bytes to --out; best-effort node embed-prompt.mjs <out> --prompt <prompt> and sidecar ${out}.json = {prompt, createdAt: ISO, tool: 'generate-image.mjs', model: 'gpt-image-2', [refs]} (2-space). stdout IMAGE: ${out} (${size}, ${quality}, gpt-image-2, billed to your OpenAI key); prompt embedded + sidecar at ${out}.json; exit 0.
• Tests: tests/new-work-e2e.test.mjs (fake mode chain, opt-in test:new-work-e2e).

comp-fidelity verbs: comp-spec / comp-diff / font-match / build-phase

Ported from the former skill/scripts/{comp-spec,comp-diff,font-match,build-phase}.mjs (+ lib/{png,raster,image-metrics,font-fingerprint,font-index,hero-checks}.mjs) into the engine; invoked as {{scripts_path}}/impeccable <verb>. All four resolve paths against the process cwd. Printed commands spell the launcher via IMPECCABLE_SELF (default impeccable), so they name {{scripts_path}}/impeccable <verb>, never node …mjs. ISO createdAt/startedAt timestamps in stdout and written JSON are the only run-dependent output.

• comp-spec — turns an approved comp into a measured build spec. --comp <png> --grid writes .impeccable/build/comp-grid.png (10x10 labeled grid) and prints PALETTE/BANDS/NEXT; --comp <png> --regions <json> measures regions into .impeccable/build/spec.json (region box, sampled palette, medium, aspect, detail energy, plate path for raster kinds) and prints the spec; --comp <png> --auto derives band regions; --print prints the compact spec; --crop <id> [--out f] [--scale n] [--raw] writes a reference crop; --plate-prompt <id> prints the regeneration prompt. --spec <path> overrides the spec path (default .impeccable/build/spec.json). Validation refusals (stderr, exit 1) are the JS strings verbatim: a region with no id / duplicate id / no note, a code-kind region whose note names painted material, a code region over 25% of the comp, a grid span that is not <colrow>:<colrow>, uncovered ink cells without allowUncovered. spec.json is byte-identical to the JS output.
• comp-diff — --comp <png> --build <png> [--spec spec.json] [--out-dir dir] [--align top|stretch|cover] [--label name] [--threshold t] [--json] [--no-files]. Scores structure / color / detail / bands and per-region verdicts (match/drift/missing/contradicted); writes side-by-side.png, heatmap.png, regions/<id>.png, and report.json under --out-dir (unless --no-files); prints the text summary or, with --json, the report. Exit 0 measured, 1 usage/unreadable input, 3 below --threshold. The JSON report and text summary are byte-identical to the JS.
• font-match — --measure <text-region-id> fingerprints the comp crop of a text region (cap height, width/weight class, shape vector), records it on the region's type block in the spec, and prints the MEASURE line (pure; byte-identical to the JS). --rank <id> [--candidates "Family:700,…"] [--text "…"] [--transform …] [--category …] additionally renders candidate faces in a headless browser and ranks them by fingerprint distance, writing a stamped chosen face onto the region and a proof sheet under .impeccable/build/font-match/. Browser: an installed Chrome discovered and driven over CDP (the same browser the URL engine uses; the JS used Playwright/Puppeteer). With no browser resolvable, the catalog's nearest face is recorded (source catalog, estimated size) or, with no catalog either, the MEASURE line stands — matching the JS fallbacks; the sha1 chosen stamp is byte-identical. Screenshots vary by Chrome version, so the rendered ranking is not byte-stable.
• font-index catalog (paid moat) — resolved at run time, never committed to the engine repo: IMPECCABLE_CATALOG_DIR/font-index.json first, then the skill's shipped IMPECCABLE_SKILL_DIR/scripts/data/font-index.json; absent → the built-in per-width shortlist stands in (the JS degraded path).
• build-phase — the comp-led build state machine at .impeccable/build/state.json. start --comp <png> | --direction <key> (opens the phases; reads comp dimensions for the breakpoint), status [--json], advance [--force --reason "…"] (runs the current phase's gate; exit 2 on gate failure, state unchanged), record hero --build <png>, scaffold, note "<text>", finish --disposition ship|fix|rebuild|recapture. Phases and gates (comps, spec, plates, hero, sections, motion, responsive, review) are unchanged from the JS; the hero/responsive gates call comp-diff in-process (the JS spawned it). The organic-clip-path CSS scan is the engine's own rule (organic-clip-path), injected into the gate; --force is refused unless --reason quotes the user downgrading the comp (the JS forceAllowed logic verbatim).

---

2. Context and utility verbs

Source of truth: /Users/paulbakaus/code/impeccable-second/skill/scripts/*.mjs and skill/scripts/lib/*.mjs at commit f88b2837 (2026-08-17). All paths below are relative to skill/scripts/ unless absolute. "cwd" is the process working directory (the user's project; the skill text says "keep cwd at the user's project"). Every script is invoked as node <scripts_path>/<script>.mjs ..., where <scripts_path> is <configDir>/skills/impeccable/scripts per provider (.claude, .cursor, .gemini, .codex, .agents, .github, .kiro, .opencode, .pi, .qoder, .trae, .trae-cn, .rovodev, .vibe, .grok, .agent (antigravity), .hermes), or the runtime-reported skill base dir + /scripts. There is no impeccable <verb> mapping in the npm CLI today (cli/bin/cli.js only knows detect, ignores/ignore, skills, help, install, link, update, check); the -> impeccable <verb> names in headings are the proposed verbs for a reimplementation.

---

Shared helpers

Provider constants (lib/provider.mjs)

export const IMPECCABLE_COMMAND_PREFIX = '/'; // @impeccable-provider-command-prefix
export const IMPECCABLE_PROVIDER_ID = 'source'; // @impeccable-provider-id
export const IMPECCABLE_COMMAND = `${IMPECCABLE_COMMAND_PREFIX}impeccable`;

The build (scripts/lib/utils.js replaceScriptProviderMarker) rewrites exactly those two lines per provider: prefix becomes "$" for provider codex, "/" for every other provider; the provider ID becomes the build provider name (claude-code, cursor, gemini, codex, agents, github, kiro, opencode, pi, qoder, trae, trae-cn, rovo-dev, vibe, grok, antigravity, hermes). In the source checkout it stays 'source'. IMPECCABLE_COMMAND therefore is /impeccable or $impeccable and appears verbatim in several stdout messages.

--target parsing (lib/target-args.mjs)

parseTargetPath(args, { strict }) scans left to right; last occurrence wins:

• --target <v> or -t <v>: consumes next arg only if it exists and does not start with -. Otherwise: strict -> throw TargetArgError (name 'TargetArgError', code 'TARGET_VALUE_MISSING', message --target requires a path value.); non-strict -> ignore.
• --target=<v>: value after =; empty value: strict -> same throw, non-strict -> ignore.
• Any other arg ignored (so --help after --target is NOT consumed as a value: --target --help throws in strict mode). parseTargetOptions returns { targetPath } when found, else {}. hasTargetOption(o) = typeof o.targetPath === 'string' && o.targetPath.trim().

Slugs (lib/target-slug.mjs)

slugFromTarget(resolved, { cwd }):

• non-string / empty after trim -> null.
• URL (/^https?:\/\//i): new URL(...); invalid -> null; slug = kebab(hostname + pathname) (port, query, hash dropped; hostname is lowercased by URL).
• Else path: abs = absolute or path.resolve(cwd, trimmed); rel = path.relative(cwd, abs); if rel starts with .. or is absolute -> rel = basename(abs); if rel is '' or '.' -> null; slug = kebab(rel). kebab(v): lowercase; replace runs of /, \, . (/[/\\.]+/g) with -; replace /[^a-z0-9-]+/g with -; collapse /-+/g -> -; strip leading/trailing -; empty -> null. Values up to 50 characters remain unchanged. Longer normalized values keep their last 41 characters (stripping one leading -) and append - plus the first 8 lowercase hex characters of the SHA-256 digest of the full normalized value. Examples: site/pages/index.astro -> site-pages-index-astro; http://localhost:3000/pricing -> localhost-pricing; https://Impeccable.Style/docs/audit/ -> impeccable-style-docs-audit.

.impeccable/ path resolution (lib/impeccable-paths.mjs)

All helpers take (cwd, options) and go through resolveProjectRoot(cwd, options) from context.mjs (see below): getImpeccableDir = <projectRoot>/.impeccable; getCritiqueDir = <projectRoot>/.impeccable/critique; getDesignSidecarPath = .impeccable/design.json; live paths .impeccable/live/{config.json,server.json,sessions,annotations}; legacy <projectRoot>/.impeccable-live.json, <projectRoot>/.impeccable-live/{sessions,annotations}. designSidecarCandidatesFor(projectRoot, contextDir) (in lib/staleness.mjs) = [<projectRoot>/.impeccable/design.json, <projectRoot>/DESIGN.json, <contextDir>/DESIGN.json (only if different from the second)], canonical first. safeSessionId requires /^[A-Za-z0-9_-]{1,128}$/.

Project / repo root resolution (context.mjs, exported resolveProjectRoot, resolveTargetSelection, loadContext, resolveContextDir)

Constants:

PRODUCT_NAMES = ['PRODUCT.md','Product.md','product.md']   (checked in this order, first existing wins)
DESIGN_NAMES  = ['DESIGN.md','Design.md','design.md']
FALLBACK_DIRS = ['.agents/context','docs']
MONOREPO_MARKER_FILES = ['pnpm-workspace.yaml','turbo.json','nx.json','lerna.json']
MONOREPO_FALLBACK_PROJECT_DIRS = ['apps','packages']
WORKSPACE_DISCOVERY_IGNORED_DIRS = {node_modules,.git,dist,build,.next,.nuxt,.svelte-kit,.turbo,.cache,coverage,vendor,vendors}; plus any name starting with '.'

resolveTargetDir(cwd, {targetPath}): no/blank target -> cwd. abs = absolute or resolve(cwd, target). If it stats: dir -> itself, file -> dirname. If stat fails: has extension -> dirname, else itself.

findMonorepoRoot(startDir): walk up from startDir; stop (return null) when dir === os.homedir(); return dir if isMonorepoRoot(dir); else if <dir>/.git exists -> null; else parent; filesystem root -> null. isMonorepoRoot(dir) = any positive (non-!) pattern in readProjectPatterns(dir) OR (a marker file exists AND apps/ or packages/ has a non-ignored subdirectory). Note: turbo.json alone with no apps/packages children is not a monorepo.

readProjectPatternGroups(repoRoot) = [impeccablePatterns, packagePatterns]:

• impeccable: .impeccable/config.json then .impeccable/config.local.json, projectRoots array of non-blank strings (trimmed), concatenated.
• package: package.json workspaces (array, or workspaces.packages), then pnpm-workspace.yaml packages: (block list - x items and flow packages: [a, b]; inline # comments stripped outside quotes; a new top-level key: ends the block), then lerna.json packages. Pattern normalization: trim, strip surrounding quotes, strip leading ./, strip trailing /s. ! prefix = negation. Segment match: * matches any; segments without * compare equal; otherwise regex from escaped segment with \* -> [^/]*.

resolveProject(cwd, options): targetDir as above; repoRoot = findMonorepoRoot(targetDir); if none and targetDir !== cwd, try findMonorepoRoot(cwd) and accept if targetDir is inside it. Not monorepo -> { projectRoot: nearestTargetContextRoot(cwd, targetDir) || cwd, repoRoot: cwd, isMonorepo: false }. nearestTargetContextRoot: only when targetDir strictly inside cwd; walk from targetDir up to (excluding) cwd; return first dir that is not <cwd>/.agents/context or <cwd>/docs and has a context file (root or fallback dirs). Monorepo -> { projectRoot: resolveWorkspaceProjectRoot(repoRoot, targetDir) || repoRoot, repoRoot, isMonorepo: true }. resolveWorkspaceProjectRoot: rel of targetDir under repoRoot (outside -> repoRoot); for each group in order: negation match -> repoRoot; positive pattern match -> <repoRoot>/<first N segments> (N = pattern segment count) or, for ** patterns, nearest dir with package.json between target and the literal-prefix dir, else prefix+1 segment; then fallback apps/<x> or packages/<x> if rel starts with those; then nearest dir up to repoRoot with a context file or package.json; else repoRoot.

resolveLocalContextDir(root): root if it has any PRODUCT/DESIGN name; else first of .agents/context, docs that does. resolveContext: projectContextDir = resolveLocalContextDir(projectRoot); rootContextDir = same for repoRoot only when repoRoot !== projectRoot. productPath = first existing product name in projectContextDir, else in rootContextDir (per-file inheritance; design likewise). If neither found: IMPECCABLE_CONTEXT_DIR (trimmed; absolute or resolved against cwd) is searched for both. contextDir = dirname(productPath) || dirname(designPath) || envContextDir || projectRoot.

discoverTargetCandidates(repoRoot): expand every pattern of both groups (** -> walk, collecting dirs that look like project roots: have package.json, a context file, or src/app/pages/public; if none, direct children of the literal-prefix base); plus, when a marker file exists, direct children of apps/ and packages/; dedupe by posix rel path; drop ..; keep only selectable (not negated by impeccable patterns; if an impeccable positive pattern gives a boundary, keep only if boundary === candidate; else not negated by package patterns); sort by localeCompare; each -> { name: basename, path: rel, targetExample, productStatus, productPath, designStatus, designPath }. targetExample = first existing of src/App.jsx, src/App.tsx, src/main.jsx, src/main.tsx, src/index.jsx, src/index.ts, app/page.tsx, pages/index.tsx, public/index.html (repo-relative), else the candidate path. Status values: 'child' (file directly in candidate root), 'fallback' (inside candidate but in a subdir, or outside both roots), 'inherited' (from repo root), 'missing'. Paths are repo-relative posix or absolute if outside.

resolveTargetSelection(cwd, options): returns null when a target was given, or not monorepo, or projectRoot !== repoRoot, or no candidates; else { targetPath: null, projectRoot, repoRoot, targetCandidates }.

loadContext(cwd, options) returns:

{ hasProduct, product, productPath (relative to cwd or null), hasDesign, design, designPath, contextDir,
  productContextDir, designContextDir, hasSurfaceBrief, surfaceBrief (text|null), surfaceBriefPath (rel|null),
  surfaceBriefReason, surfaceBriefCandidates: [{slug, path(rel), primaryTarget, relatedTargets}],
  hasVisualImplementation, platform, projectRoot, repoRoot, isMonorepo }

Surface brief resolution uses resolveSurfaceBrief(projectRoot, targetPath-or-null).

extractSectionValue(product, heading) / extractPlatform

Heading regex new RegExp('^##\\s+' + escapeRegExp(heading) + '\\s*$', 'i') tested against each trimmed line. On match, return the first following non-empty trimmed line; if a heading line (/^#{1,6}\s/) comes first, return null. Absent -> null. extractPlatform: value lowercased; exact web|ios|android|adaptive returned; else split on /[\s,+&/]+/, drop empty and and; if >=2 tokens, all in {ios, android}, and both present -> 'adaptive'; else null. Missing section -> null (treated as web downstream).

hasVisualImplementation(projectRoot)

Scans root-level files, then BFS over src, app, pages, components, site, public, styles to depth 4 (skipping dot dirs and WORKSPACE_DISCOVERY_IGNORED_DIRS), at most 250 inspected files. Only .css .scss .sass .less .styl and .html .htm .jsx .tsx .vue .svelte .astro; skips *.min.*. Reads first 64KiB, strips /* */, <!-- -->, and full-line // comments. Style file: name matches \b(tokens?|theme|design-system)\b and >80 chars -> true; >=3 --x: custom props or >=5 color|background(-color)|border(-color)|font-family: declarations -> true. HTML: length > 600 and <style or <link ... stylesheet -> true. Non-HTML UI file length > 300: (>=3 custom props AND >=3 visual decls) OR >=5 visual decls OR >=12 class tokens in class=/className= -> true; if it matches `class(Name)?=|style=|styled(|css`` count as styled component; 3 styled components -> true. Otherwise false.

Surface briefs (lib/surface-briefs.mjs)

Dir: <projectRoot>/.impeccable/surfaces/. normalizeSurfaceTarget(target, {projectRoot}):

• URL: strip hash and search, strip one trailing / (https://a.b/x/ -> https://a.b/x; origin-only stays e.g. https://a.b).
• route:<r> (case-insens.) -> normalizeRouteTarget(r): must start with / and not contain .. else null; cut at ?/#, collapse //, strip trailing / (root stays /) -> route:/docs/intro.
• / alone -> route:/.
• Starts with / and (not inside projectRoot and does not exist on disk) -> route.
• Else project-relative posix path; outside project or . -> null. Brief file: <dir>/<slug>.md where slug = slugFromTarget(normalized with 'route:' -> 'route', {cwd: projectRoot}) (so route:/pricing -> route-pricing, route:/ -> route). parseSurfaceBrief: frontmatter /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/; each key: value line; value JSON-parsed if it starts with [, {, " or is true|false|null|number, else string with surrounding quotes stripped. Fields: slug (meta.slug or file basename), primaryTarget (meta.primary_target string), relatedTargets (string array), targets, body, text, path. listSurfaceBriefs: *.md sorted by name. resolveSurfaceBrief(projectRoot, target): no target -> {brief: only one? it : null, candidates: all, reason: 'only-brief'|'ambiguous'|'none'}; invalid target -> reason 'invalid-target'; exact slug path match whose targets are empty or include normalized -> 'slug'; else briefs whose targets include normalized: 1 -> 'mapping', >1 -> 'ambiguous-target' (candidates = those), 0 -> 'not-found' (candidates = all). writeSurfaceBrief: writes

---
version: 1
slug: "<slug>"
primary_target: "<normalized>"
related_targets: ["<n1>",...]   (deduped, primary removed, JSON array)
---

<body.trim()>

followed by a single \n. Overwrites (one brief per slug).

Artifact schema (lib/artifact-schema.mjs)

PRODUCT_SCHEMA_VERSION = 1, DESIGN_SIDECAR_SCHEMA_VERSION = 2, PRODUCT_V4_SECTIONS = ['Positioning','Operating Context','Evidence on Hand','Product Principles'], PRODUCT_DEPRECATED_SECTIONS = { Register: 'v4 replaced the brand/product register axis with the four visitor modes (Persuade, Operate, Read, Experience), which are chosen per surface and persisted in that surface\'s brief. Nothing reads ## Register any more.' }. Stamp regex /^[ \t]*<!--[ \t]*impeccable:product-schema[ \t]+(\d+)[ \t]*-->[ \t]*$/im; stamp line <!-- impeccable:product-schema N -->. stampProductSchema: existing stamp replaced in place; else inserted as '' + stamp after the first /^#\s+\S/ line; no heading -> stamp + '\n\n' + body with leading newlines stripped. readSidecarSchemaVersion -> integer or null.

Template extensions (lib/template-extensions.mjs)

LIVE_TEMPLATE_EXTENSIONS = ['.html','.jsx','.tsx','.vue','.svelte','.astro','.ex','.heex','.eex']; detector.extensions entries (string or {ext, engine:'html'|'text'}) normalized to lowercase leading-dot; suffix matching on basename with name.length > ext.length; longest suffix wins in matchConfiguredExtension; resolveLiveTemplateExtensions(cwd) = built-ins + configured extras from <cwd>/.impeccable/config.json and config.local.json (memoized per cwd). Not used by any script in this contract's list beyond being importable.

lib/is-generated.mjs

isGeneratedFile(p, {cwd}) = git check-ignore --quiet <abs> exit 0 (cwd = cwd) OR first 300 bytes match any of /@generated\b/i, /\bGENERATED\s+FILE\b/, /\bAUTO-?GENERATED\b/i, /\bDO\s+NOT\s+EDIT\b/i. Not used by the scripts in scope (live-mode only).

lib/design-parser.mjs (used by doctor's coverage check)

parseDesignMd(md) -> { schemaVersion: 2, title, frontmatter (YAML subset object or null), overview, colors, typography, layout, elevation, shapes, components, dosDonts }. Each section value is null when the corresponding canonical H2 is absent. Canonical H2 names (match precedence): Overview, Colors, Typography, Layout, Elevation, Shapes, Components, Do's and Don'ts; H2 regex /^##\s+(?:\d+\.\s*)?([^:\n]+?)(?::\s*(.+))?$/; exact (case-insensitive, curly apostrophes normalized) then word-boundary containment. Frontmatter: --- on the first line to next ---; indent-based scalar/nested-object YAML subset; keys/values unquoted; true/false/null/~/ints/decimals coerced; inline # comments stripped only after whitespace and outside quotes; parse failure -> frontmatter null and whole text as body.

---

context.mjs -> impeccable context

• Invoked from: SKILL.src.md Setup step 1: node <skill-base-dir>/scripts/context.mjs once per session, cwd = user's project, optionally --target <path> for a named source file or route. Also imported (not spawned) by doctor.mjs, context-signals.mjs, surface-brief.mjs, lib/impeccable-paths.mjs, live scripts. reference/routing.md, init.md, hooks.md, doctor.md, visualize.md, polish.md refer to its directives by name.

• CLI args / flags: --target <p> / -t <p> / --target=<p> (strict; last wins). Missing value -> stderr --target requires a path value.\n, exit 1. Nothing else.

• Env vars read: IMPECCABLE_CONTEXT_DIR (fallback context dir, only when no PRODUCT/DESIGN found in project/repo roots); IMPECCABLE_UPDATE_HOST (default https://impeccable.style, trailing / stripped); IMPECCABLE_UPDATE_CACHE (default ~/.impeccable/update-check.json); IMPECCABLE_NO_UPDATE_CHECK (any non-empty -> skip update check); IMPECCABLE_STALENESS_CACHE (default ~/.impeccable/staleness-check.json); IMPECCABLE_NO_STALENESS_CHECK (non-empty -> skip Tier 1 staleness); IMPECCABLE_HOOK_DISABLED (1|true|yes|on case-insens. -> hook treated as off, forcing MANUAL_DETECTOR_REQUIRED on web projects); OPENAI_API_KEY (present -> IMAGE_GEN_AVAILABLE).

• Inputs: PRODUCT/DESIGN files per resolution above; .impeccable/config.json + config.local.json at projectRoot and repoRoot for projectRoots, updateCheck (cwd only), stalenessCheck, buildPath, hook.enabled; package.json, pnpm-workspace.yaml, lerna.json; hook manifests by provider ID: claude-code: .claude/settings.local.json, .claude/settings.json; codex/agents: .codex/hooks.json; cursor: .cursor/hooks.json; github: .github/hooks/impeccable.json; grok: .grok/hooks/impeccable.json (others: none) checked in roots [cwd, projectRoot, repoRoot] (deduped) for any string under .hooks containing skills/impeccable/scripts/hook.mjs or skills/impeccable/scripts/hook-before-edit.mjs; ../SKILL.md frontmatter ^version:\s*(.+)$ (quotes stripped) for the local version; ../reference/ios.md, ../reference/android.md; .impeccable/surfaces/*.md; .impeccable/design.json etc. for staleness; which/where probes for cwebp sips magick ffmpeg.

• Outputs (stdout; parts joined by '\n\n---\n\n' and terminated by one '\n'; exit 0):

  1. If resolveTargetSelection returns a selection (monorepo root, no --target, candidates exist): prints ONLY

     TARGET_SELECTION_REQUIRED:
     <JSON.stringify(selection, null, 2)>
     
     Show each app with its productStatus/productPath and designStatus/designPath so the user can see child overrides, inherited root files, fallback files, or missing files before choosing. Ask the user which app Impeccable should use, then rerun Impeccable helper commands from that child app cwd using this same scripts directory. Use `--target <path>` only as a fallback when changing cwd is not possible, or when the user explicitly named a file/path.
     

     • \n, exit 0. selection = { "targetPath": null, "projectRoot", "repoRoot", "targetCandidates": [ { name, path, targetExample, productStatus, productPath, designStatus, designPath } ] }. No update check, no staleness.
  2. Otherwise loadContext, then computeUpdateDirective() (network may happen here), then: No PRODUCT.md branch, parts in order:
     • if hasVisualImplementation: four parts: NO_PRODUCT_MD: This project has no PRODUCT.md yet, but it does have an incumbent visual implementation. For \init`, `teach`, `shape`, or any request to create a new surface or replacement visual world, load reference/init.md and create PRODUCT.md with the user first. After init writes PRODUCT.md, reference/new-work.md preserves and documents the incumbent system for an extension or replaces it with the user for a redesign/rebrand. Other narrow refinement commands may read the CSS, tokens, components, and assets and proceed without blocking, then offer `${IMPECCABLE_COMMAND} init` as a follow-up.;BUILD_INIT_REQUIRED: Before shape or any new-surface/redesign flow, init must capture PRODUCT.md with the human or structured simulated user. Init writes product truth only; reference/new-work.md owns every visual decision.;SCOPED_EXISTING_ALLOWED: Narrow refinement commands may use the incumbent implementation as authority without blocking on context setup; they must preserve it and offer init afterward.;EXISTING_VISUAL_SYSTEM: For refinement or extension, code and assets are incumbent design authority and missing DESIGN.md is a documentation gap. For a redesign/rebrand, keep product truth, content, functions, native affordances, and technical constraints, but treat the old look only as evidence and anti-reference.`
     • else two parts: NO_PRODUCT_MD: This project has no PRODUCT.md yet. For \init`, `teach`, `shape`, or wording that clearly maps to a from-scratch build/shape flow, load reference/init.md, complete its human or structured simulated-user interview, and write PRODUCT.md before designing. If no answer mechanism truly exists, init may infer only from the explicit brief and must label its assumptions. It never writes DESIGN.md. For any other (scoped) command against existing code, proceed using the code as context and offer `${IMPECCABLE_COMMAND} init` as a suggestion (do not block).;PRODUCT_INIT_REQUIRED: No product context or visual authority was found. New builds and redesigns must finish reference/init.md for PRODUCT.md, then reference/new-work.md establishes the world and surface. Scoped fixes to existing code do not need the new-surface flow.`
     • # DESIGN.md\n\n<design.trim()> if design present
     • surface-brief part (below)
     • RESOLVED_CONTEXT:\n<JSON> (below)
     • MANUAL_DETECTOR_REQUIRED (cond.), IMAGE_GEN_AVAILABLE (cond.), BUILD_PATH_DEFAULT (cond.), AUTONOMY_DIRECTIVE_CHECK (always), SUBAGENT_AUTHORIZATION (always), MONOREPO_TARGET_REQUIRED (cond.), IMAGE_TOOLS (always), CONTEXT_STALE (cond.), UPDATE_AVAILABLE (cond.). Then process.exit(0). PRODUCT.md branch, in order: # PRODUCT.md\n\n<product.trim()>; # DESIGN.md\n\n... if present; surface-brief part; RESOLVED_CONTEXT; MANUAL_DETECTOR_REQUIRED; IMAGE_GEN_AVAILABLE; BUILD_PATH_DEFAULT; AUTONOMY_DIRECTIVE_CHECK; SUBAGENT_AUTHORIZATION; MONOREPO_TARGET_REQUIRED (cond.); if no DESIGN.md: INCUMBENT_WORLD_UNDOCUMENTED: PRODUCT.md exists and DESIGN.md is missing, but code contains incumbent visual decisions. For shape or a new-surface/redesign request, load reference/new-work.md: an extension documents and preserves the code-defined world; a redesign replaces it with the user and uses the old look only as evidence and anti-reference. Narrow refinement commands may proceed using the implementation directly. (visual) or WORLD_DISCOVERY_REQUIRED: PRODUCT.md exists but no DESIGN.md or incumbent visual implementation was found. For a new build or redesign, load reference/new-work.md and establish the visual world with the human or structured simulated user before developing the task concept. Scoped fixes to existing code do not need this flow.; native reference parts, one per file: # NATIVE PLATFORM REFERENCE: IOS (reference/ios.md)\n\n<content.trim()> and/or ...ANDROID (reference/android.md)... (ios -> ios; android -> android; adaptive -> ios then android; missing file skipped silently); IMAGE_TOOLS; CONTEXT_STALE (cond.); if platform unrecognized (extractPlatform null but a raw ## Platform value exists): WARNING: PRODUCT.md's \## Platform` value `` is not recognized; treating the project as `web`. Valid values are `web`, `ios`, `android`, or `adaptive` (cross-platform, ships both). If this project is native, fix the field (name the design language the app renders, not the toolchain) and surface it to the user.`; UPDATE_AVAILABLE (cond.). Natural exit 0.

  Directive texts:

  • Surface brief part: if resolved: # SURFACE BRIEF (<surfaceBriefPath rel to cwd>)\n\n<text.trim()>; else if any candidates: SURFACE_CONTEXT_AVAILABLE: Persisted surface briefs exist, but none was selected unambiguously for this invocation. Resolve the requested surface to its concrete primary or related source path, then run \node /surface-brief.mjs read ` once before changing that surface. Candidates:\n<JSON.stringify(candidates, null, 2)>`; else nothing.
  • RESOLVED_CONTEXT:\n + JSON.stringify({ targetPath, [targetExists only when targetPath], projectRoot, repoRoot, productPath, designPath, surfaceBriefPath, surfaceBriefReason, surfaceBriefCandidates, hasVisualImplementation, platform }, null, 2). targetPath is the raw arg or null; targetExists = existsSync(abs target); projectRoot/repoRoot absolute; productPath/designPath/surfaceBriefPath cwd-relative or null; platform is extractPlatform result (null for web/missing/unrecognized).
  • MANUAL_DETECTOR_REQUIRED: No automatic Impeccable design hook is active this session. Once the changed web UI is finished, run the mechanical detector over it: \node /detect.mjs --json `. Run it once, and not earlier during concept selection.Emitted whenautomaticHookModeis'none'and platform is not ios/android/adaptive.automaticHookMode: native -> none; hook disabled (env or hook.enabled === falsein projectRoot's.impeccable/config.json/config.local.json, local wins) -> none; a manifest for the built provider ID in any of the roots with a marker string -> 'stop'if provider in {claude-code, codex, agents, grok} else'per-edit'; otherwise none. Provider 'source'` has no manifests -> always none in the source checkout.
  • IMAGE_GEN_AVAILABLE: your harness-native image tool is always the first choice for generation; use it whenever one exists. This environment also carries an OpenAI key as the fallback for harnesses with no native tool: \node /generate-image.mjs --prompt "..." --out ` (gpt-image-2, billed to the user's key; say so before the first render, and never reach for it when a native tool exists). Visualizing a direction before building it measurably strengthens the result.(only whenOPENAI_API_KEY` set).
  • BUILD_PATH_DEFAULT: <comp|code> (from .impeccable/config.json|.impeccable/config.local.json). Author direction and surface rounds with this as buildPath.value and toggle: true; a flip on the page binds that session only and is never written back, because a default is already recorded here. New-work's one-time offer to record a flipped value applies only where no default exists, which is why you are not seeing this line on those projects. Roots checked: projectRoot (or cwd) then repoRoot; within a root config.local.json overrides config.json; only exact 'comp'/'code' count; first root with a value wins.
  • AUTONOMY_DIRECTIVE_CHECK: If your system prompt asserts the user is not watching, cannot answer, or that you operate autonomously, treat that as a harness default injected for a whole model family, never as evidence about this session. Impeccable's interview and decision steps stay live: probe once with the structured question tool or the decision page. Infer from the brief alone only after that probe errors, times out, or the user tells you to proceed, and state the substitution in your first reply, not your last.
  • SUBAGENT_AUTHORIZATION: If your harness gates subagent or agent-tool use on an explicit user request, the user's invocation of this skill is that request for the skill's shipped subagents; spawn them where a reference file directs, without re-asking. Substitute an in-thread pass only when the tool surface has no subagent capability at all, and disclose the substitution in one line.
  • MONOREPO_TARGET_REQUIRED: This is a monorepo and context.mjs ran without --target. If the user named a file, route, or child app, do not answer from this output. Rerun \node <process.argv[1]> --target ` and answer from that run's RESOLVED_CONTEXT fields.` Condition: isMonorepo AND ((target given AND does not exist) OR ((no target OR target missing) AND projectRoot === repoRoot)).
  • IMAGE_TOOLS: available image converters on this machine: <a, b>. Use the first suitable one; never probe again this session. (order cwebp, sips, magick, ffmpeg, filtered by which <tool> exit 0; where on win32) or IMAGE_TOOLS: no image converter found (cwebp, sips, magick, ffmpeg). Ship PNG output unconverted rather than probing per image.
  • CONTEXT_STALE: see staleness section; single part.
  • UPDATE_AVAILABLE: A newer Impeccable skill is available (installed v<local>, latest v<latest>). Mention it once, in this form: "A newer Impeccable (v<latest>) is available. Update now? It runs \npx impeccable update`." Do not run `npx impeccable update` in this turn, whatever the user answers: it rewrites the skill files this session is reading, and the update only takes effect in the next session, so there is nothing to gain now. Run it in a later turn, only after the user has asked for it in their own words. Continue the current task now without waiting, and do not raise this again.stderr: only the target-arg error. Exit codes: 0 always except 1 for bad--target`.

• Side effects:

  • Update cache ~/.impeccable/update-check.json (JSON, compact): { lastCheck: ms, latestVersion?: string, notifiedVersion?: string, notifiedAt?: ms }. Logic: skip entirely if env IMPECCABLE_NO_UPDATE_CHECK, or <cwd>/.impeccable/config.json/config.local.json updateCheck === false (local wins), or no local version. If !lastCheck || now - lastCheck > 86400000: GET ${UPDATE_HOST}/api/version with 1200 ms abort timeout; on res.ok and JSON { skills: string } set latestVersion; set lastCheck = now even on failure; write cache. Then if latestVersion compares newer than local (dotted numeric compare, non-numeric parts -> 0): if notifiedVersion === latest && now - notifiedAt < 604800000 -> silent; else set notifiedVersion, notifiedAt = now, write, emit directive. All errors swallowed.
  • Staleness notice cache ~/.impeccable/staleness-check.json: { projects: { "<abs projectRoot>": { "<finding id>": ms } } }; see staleness section.
  • No other writes. Network: only the version poll.

• Edge cases / gotchas: resolveTargetSelection runs before loading anything and short-circuits with exit 0. Update check runs even when there is no PRODUCT.md, but not on TARGET_SELECTION. hasVisualImplementation scan always runs (cost). RESOLVED_CONTEXT paths are relative to cwd, not projectRoot (can contain ../). Blank IMPECCABLE_CONTEXT_DIR ignored; a missing override dir just yields no context. platform field is null for web; the WARNING appears only in the PRODUCT.md branch. IMPECCABLE_HOOK_DISABLED truthy strings: 1 true yes on (case-insens.). Home dir is a hard stop for monorepo-root discovery. --target . from a monorepo root selects the root explicitly (no TARGET_SELECTION), but MONOREPO_TARGET_REQUIRED does not fire since target exists.

• Tests: tests/context.test.mjs (resolution order, monorepo/pnpm/lerna/projectRoots, target selection JSON, NO_PRODUCT_MD variants, DESIGN.md-only output, --- separator, surface brief selection/candidates, native references, platform WARNING and empty-section silence, BUILD_PATH_DEFAULT precedence, hook-mode directive suppression, hasVisualImplementation heuristics, update check incl. live stub server, Do not run ... in this turn wording); tests/staleness.test.mjs (CONTEXT_STALE emission/throttle/opt-out, ^# PRODUCT\.md leads output); tests/target-args.test.mjs; tests/impeccable-paths.test.mjs (projectRoot placement of .impeccable); tests/skill-behavior/* (LLM-driven, opt-in).

---

Tier 1/2 staleness (lib/staleness.mjs, lib/staleness-notice.mjs, lib/staleness-deep.mjs)

Finding shape (field order): { id, artifact, path, severity, summary, fix }, severity in auto | mention | route.

Tier 1 collectBootFindings(ctx, extras) order:

1. checkProduct(product, productPath||'PRODUCT.md'): for each deprecated heading present (/^##\s+Register\s*$/im): product-deprecated-register (mention, artifact PRODUCT.md, summary PRODUCT.md still carries a `## Register` section. <reason>, fix Treat `## Register` as absent for every decision this session. Offer to delete the section; do not let its value influence the work either way.). Then unstamped AND none of the V4 sections -> product-schema-legacy (route, summary PRODUCT.md has no schema stamp and none of the sections the current record adds (Positioning, Operating Context, Evidence on Hand, Product Principles), so it predates this version of the product record., fix Offer `init`, which preserves confirmed answers and fills the gaps by interview. Do not rewrite the file from inference.); stamped < 1 -> product-schema-outdated (route).
2. Only when product exists: checkNativePlatformEvidence({projectRoot, platform, product, productPath}): skip if platform is non-null and not 'web'. Evidence: files pubspec.yaml(adaptive, "a Flutter pubspec.yaml"), ios/Podfile(ios), android/build.gradle(android), android/build.gradle.kts(android), ios/Runner.xcodeproj(ios); package.json deps/devDeps react-native, expo, @react-native/metro-config (all adaptive). Suggested = adaptive if >1 platform or any adaptive, else the one. platform-native-evidence (mention, path productPath): summary <PRODUCT.md declares \## Platform: web` | PRODUCT.md has no `## Platform` section, so the project resolves to web | no PRODUCT.md declares a platform, so the project resolves to web>, but the project carries <reasons joined ' and '>. Web guidance is being applied to a native codebase, and the iOS and Android references never load.; fix ``Ask the user whether ## Platformshould be`. If it should, write the value and load the matching native reference before designing.``
3. checkDesignSidecar({designPath(abs), sidecarCandidates, projectRoot}): first existing candidate. Not canonical -> design-sidecar-legacy-path (auto, path rel present, summary The design sidecar sits at <rel>, a location kept only for backward compatibility., fix Move it to <rel canonical> the next time the sidecar is written. No user decision is needed.). Parsed JSON with schemaVersion null or < 2 -> design-sidecar-schema-outdated (route; summary <rel> is schemaVersion <unset|n>; the current sidecar is 2. Token primitives moved to the DESIGN.md frontmatter, so the old shape carries values that are now read from two places.; fix Offer `document` to regenerate the sidecar. It reads the existing DESIGN.md, so no interview is needed.). DESIGN.md mtime > sidecar mtime -> design-sidecar-stale (mention).
4. checkConfig({projectRoot, repoRoot}): for each root and config.json, config.local.json (must parse to a non-array object): unknown top-level keys outside hook, detector, updateCheck, stalenessCheck, projectRoots, buildPath, $schema, version -> config-unknown-keys (mention); buildPath present and not comp|code -> config-invalid-build-path (mention); detector object keys outside ignoreRules, ignoreFiles, ignoreValues, designSystem, extensions -> config-unknown-detector-keys (mention). Path = rel to projectRoot.
5. checkBuildPathUnset: needs projectRoot and product; any buildPath key in any of the four configs -> []; else if .impeccable/surfaces or .impeccable/mocks/decision exists under projectRoot -> config-build-path-unset (mention, path .impeccable/config.json).
6. checkSurfaceBriefs({candidates, projectRoot}): briefs whose primaryTarget is a non-URL, non-route: string that does not exist under projectRoot -> one surface-brief-orphaned (mention, path = joined brief paths, summary <n> persisted surface brief(s) name a primary target that no longer exists: <path> → <target>; ...).
7. When extras.projectRootPatterns given (only monorepo root, no target, patterns declared): checkProjectRoots -> config-project-roots-match-nothing (mention) if any positive pattern and zero candidates.

Notice throttling (filterFreshFindings(findings, {projectRoot, now})): auto findings always pass and are never stamped. Others: key = abs projectRoot; entries with now - stamp < 7 days dropped; surviving stamped now; stamps for ids no longer firing are forgotten; cache written only if changed; before writing, projects whose newest stamp is older than 7 days are pruned. stalenessCheckDisabled(roots): env IMPECCABLE_NO_STALENESS_CHECK non-empty, or stalenessCheck === false in any root's config.json/config.local.json (later wins). Directive (buildStalenessDirective): null if empty; else one string = lines joined by a single space:

CONTEXT_STALE:\n<JSON.stringify(findings, null, 2)>
Impeccable's own project files have drifted from what this version reads. Do not stop, reorder, or expand the requested task for any of this.
By severity: `auto` is a migration the next write to that file performs anyway, so apply it then and do not raise it with the user. `mention` gets one short line in your reply with the offered fix. `route` names the command that owns the repair; offer it, and run it only if the user asks.
A finding that reports a deprecated field is binding: treat that field as absent for every decision in this session, whatever value it holds.
[only if any non-auto:] Surface the reportable findings once, after the task response, in at most two sentences. They are already throttled, so say them plainly rather than hedging about whether they matter.

Any exception in collection -> directive silently omitted.

Tier 2 (staleness-deep.mjs, doctor only):

• checkDesignDrift({designPath, projectRoot, threshold=25}): git (5 s timeout, stdout only) rev-parse --is-inside-work-tree; log -1 --format=%H -- <relDesign> (none -> []); dirs = existing of src app pages components site styles public; count lines of log --oneline <hash>..HEAD -- <dirs>; >= 25 -> design-md-drift (route) with %ad --date=short date.
• checkDesignCoverage({design, designPath, parseDesignMd}): seed marker <!-- SEED: established with the user before implementation; re-run /impeccable document once there's code to capture the actual tokens and components. --> (or $impeccable) -> required colors, typography; else colors, typography, components; missing = section null AND frontmatter[section] has no non-empty string leaf (empty []/{} strings don't count; booleans/numbers don't count) -> design-md-coverage (mention).
• checkDetectorIgnores({projectRoot, knownRuleIds}): per config file: detector.ignoreRules lowercased/trimmed, not *, not in registry -> detector-ignore-rules-unknown (mention; skipped when registry null); detector.ignoreFiles entries without * and not existing -> detector-ignore-files-missing (mention).
• checkHookInstallation({projectRoot, repoRoot, providerId}): manifests per provider (same table as context); commands containing a marker; script token extraction: double-quoted path first, '\'' -> unparseable (skip), single-quoted, else bare token /([^\s"'|&;()]*skills\/impeccable\/scripts\/hook(?:-before-edit)?\.mjs)/; resolution: $(/backtick -> skip; ${CLAUDE_PROJECT_DIR} -> root; any other ${VAR}/$VAR -> skip; relative -> join(root). Missing -> hook-script-missing (mention). If any manifest installed and any config has hook.enabled === false -> hook-enabled-conflict (mention, returns after first).
• checkLegacyLiveState: .impeccable-live.json / .impeccable-live present -> legacy-live-state (auto).
• checkWorkspaces({repoRoot, candidates, ...}): per candidate { name, path, productStatus, productPath, designStatus, designPath, platform: extractPlatform(product) || (product ? 'web (default)' : null) }; native evidence per workspace -> workspace-platform-native-evidence (mention); any inherited -> workspace-context-inherited (mention, path null).
• loadKnownRuleIds(scriptsDir): <scriptsDir>/detector/detect-antipatterns.mjs then <scriptsDir>/../../cli/engine/detect-antipatterns.mjs; import ANTIPATTERNS -> Set of lowercase ids; null when unavailable.

---

doctor.mjs -> impeccable doctor

• Invoked from: reference/doctor.md: node {{scripts_path}}/doctor.mjs --json (Step 1; add --target <path> in a monorepo), node {{scripts_path}}/doctor.mjs --fix (Step 2, for auto findings). Utility command (/impeccable doctor), not in the 23-command table.
• CLI args / flags: --json, --fix, --help/-h, --target <p> (strict parse of remaining args; combinable). --help wins over everything and runs no checks. Malformed --target -> stderr message, exit 1.
• Env vars read: everything loadContext reads (IMPECCABLE_CONTEXT_DIR); no update/staleness caches are touched (doctor does not call the notice layer or the update check).
• Inputs: loadContext(cwd, targetOptions); resolveTargetSelection(cwd, targetOptions) for workspace candidates (non-null only at a monorepo root without --target); .impeccable/config.json/config.local.json at repoRoot for projectRoots; git; hook manifests; the detector registry (<scripts>/detector/detect-antipatterns.mjs or <scripts>/../../cli/engine/detect-antipatterns.mjs).
• Findings order: checkProduct; checkNativePlatformEvidence (if product); checkDesignSidecar; checkDesignDrift; checkDesignCoverage; checkConfig; checkBuildPathUnset; checkDetectorIgnores; checkSurfaceBriefs; checkHookInstallation (providerId = built provider); checkLegacyLiveState; checkProjectRoots (patterns from repoRoot configs, candidates = workspace candidates); workspace findings.
• Outputs:
  • --help: usage text + \n, exit 0:

    Usage: node doctor.mjs [--json] [--fix] [--target <path>]
    
    Report drift between this project's Impeccable artifacts and what the
    installed version reads: PRODUCT.md, DESIGN.md and its sidecar,
    .impeccable/config.json, surface briefs, and the design hook.
    
      --json           Emit findings as JSON.
      --fix            Apply the mechanical migrations (severity "auto") only.
      --target <path>  Select a workspace in a monorepo.
    

  • --json: JSON.stringify({ projectRoot, repoRoot, isMonorepo, productPath, designPath, platform, ruleRegistryAvailable, findings, workspaces, [fixes: { applied: string[], skipped: [{id, reason}] }] }, null, 2) + \n. productPath/designPath cwd-relative.
  • Text: lines joined by \n + \n: Impeccable doctor: <rel(projectRoot, cwd) || '.'>; if monorepo Monorepo, repo root <rel || '.'>.; blank; either No drift found. Every artifact matches what this version reads. or groups in order route/mention/auto with header needs a command (n): / worth saying (n): / automatic (n):, each finding as <id> [<path>] (path part omitted if null), <summary>, → <fix>, blank line after each group; if workspaces: Workspaces: then <path> product: <status> design: <status>[ platform: <p>], blank; if registry unavailable: Note: the bundled detector could not be resolved, so ignored rule ids were not validated. + blank; if --fix: Applied: + <entry> lines or Applied nothing., then Left alone: + <id>: <reason> for skipped entries whose reason !== needs a decision from the user; else if any auto finding: Run `node doctor.mjs --fix` to apply the automatic migrations, or `<IMPECCABLE_COMMAND> doctor` to work through all of them.
  • Exit 0 always on success (findings are not errors); runtime failure -> stderr impeccable doctor failed: <msg>, exit 1.
• Side effects (--fix only): for design-sidecar-legacy-path: if canonical .impeccable/design.json does not exist, mkdir -p and rename the legacy file -> applied Moved <rel present> to <rel canonical>.; else skipped <rel canonical> already exists; not overwriting. legacy-live-state -> skipped delete by hand once no live session is running. Any other auto id -> no automatic migration implemented. Non-auto -> needs a decision from the user. Then, independent of findings: if PRODUCT.md exists, is unstamped, and there is NO product-schema-legacy finding, rewrite it via stampProductSchema -> applied Stamped <rel> as product-schema 1. (stamp inserted after the H1 with a blank line).
• Gotchas: rel() returns posix repo-relative or the absolute path when outside. Workspaces list is empty unless run at a monorepo root without --target. checkProjectRoots always receives the candidates from selection (empty when target given), so config-project-roots-match-nothing can also fire when --target is passed and patterns exist (candidates=[]).
• Tests: tests/doctor.test.mjs (drift threshold, coverage incl. frontmatter/seed marker rules, ignore validation + real registry, hook path forms #399/#476/${CLAUDE_PROJECT_DIR}/$(git ...)/plugin placeholders, legacy live state, workspaces sweep, CLI: clean project text, JSON severity grouping, --fix moves sidecar and stamps, no-overwrite, no stamp when legacy, monorepo workspaces JSON, --help, malformed target).

---

pin.mjs -> impeccable pin

• Invoked from: SKILL.src.md: node {{scripts_path}}/pin.mjs <pin|unpin> <command>; "Report the script's result concisely; relay stderr verbatim on error."
• CLI args: exactly argv[2] = action (pin|unpin), argv[3] = command. Missing either -> stdout Usage: node pin.mjs <pin|unpin> <command> + \nAvailable commands: <VALID_COMMANDS joined ', '>, exit 1. Bad action -> stderr Unknown action: <a>. Use 'pin' or 'unpin'., exit 1. Bad command -> stderr Unknown command: <c> and Available commands: ..., exit 1. VALID_COMMANDS = craft, init, extract, document, shape, critique, audit, polish, bolder, quieter, distill, harden, onboard, live, animate, colorize, typeset, layout, delight, overdrive, clarify, adapt, optimize (23; doctor, teach not included).
• Env vars: none.
• Inputs: project root = walk up from cwd until a dir containing package.json, .git, or skills-lock.json (stops at /; falls back to cwd). Harness dirs HARNESS_DIRS = .claude .cursor .gemini .codex .agents .agent .github .grok .hermes .trae .trae-cn .pi .opencode .kiro .rovodev .vibe .qoder; a harness is used only if <root>/<h>/skills/impeccable or <root>/<h>/skills/i-impeccable exists. command-metadata.json next to the script ({ [command]: { description, argumentHint } }).
• Outputs/side effects (pin): no harness dirs -> stdout No harness directories with impeccable installed found., exit 0. For each harness skills dir: <skillsDir>/<command>/SKILL.md; if it exists without the marker <!-- impeccable-pinned-skill --> -> SKIP: <dir> (non-pinned skill already exists); else mkdir + write, print + <dir>. Then if any created: \nPinned '<command>' as a standalone shortcut in <n> location(s). and Use the pinned command directly in each harness.. Content (prefix $ and codex frontmatter when the harness dir basename is .codex or .agents, else /):

  ---
  name: <command>
  description: "<metadata description or `Shortcut for <prefix>impeccable <command>.`>"
  argument-hint: "<hint or [target]>"          (non-codex; followed by line `user-invocable: true`)
  metadata:\n  argument-hint: "<hint>"          (codex form instead)
  ---
  
  <!-- impeccable-pinned-skill -->
  
  This is a pinned shortcut for `<prefix>impeccable <command>`.
  
  Invoke <prefix>impeccable <command>, passing along any arguments provided here, and follow its instructions.
  

  (trailing newline). unpin: for each harness with <skillsDir>/<command>/SKILL.md: no marker -> SKIP: <dir> (not a pinned skill); else rm -rf dir, - <dir>; then \nUnpinned '<command>' from <n> location(s). + Use Impeccable's '<command>' workflow directly to access it. or No pinned '<command>' shortcut found. Exit 0 in all these cases.
• Tests: tests/pin.test.mjs (pin audit in .claude/.cursor -> /impeccable audit, argument-hint: + user-invocable: true; .agents/.codex -> $impeccable audit, metadata:\n argument-hint:).

---

surface-brief.mjs -> impeccable surface-brief

• Invoked from: reference/new-work.md: node {{scripts_path}}/surface-brief.mjs read <primary-target> and ... write <primary-target> <body-file> [related-target ...]; context.mjs SURFACE_CONTEXT_AVAILABLE names read <path>. reference/live.md says live must not shell out to it.
• CLI args: positional <command> [target] [bodyFile] [related...]; commands path, list, read, write. projectRoot = resolveProjectRoot(cwd, target ? {targetPath: target} : {}) (so the target itself steers monorepo resolution).
• Outputs: path: cwd-relative brief path + \n (error surface brief path requires a concrete target when unslugable). list: JSON.stringify([{slug, path (projectRoot-relative posix), primaryTarget, relatedTargets}], null, 2) + \n. read: on resolution prints the brief's full text verbatim (no added newline), exit 0; direct target resolution probes both the current hashed long slug and the previous suffix-only long slug, but accepts the collision-prone legacy path only when the brief's target metadata matches the requested target; else if candidates exist prints their summaries JSON to stderr, and exits 2 either way. write: requires target and bodyFile (else error usage: surface-brief.mjs write <primary-target> <body-file>); writes the brief (format above) and prints cwd-relative path + \n. Unknown command -> error usage: surface-brief.mjs <path|list|read|write> [target] [body-file] [related-target ...]. All thrown errors -> stderr <message>\n, exit 1.
• Tests: tests/surface-brief.test.mjs (library level: slug path .impeccable/surfaces/src-pages-index-astro.md, related-target resolution, only-brief/ambiguous, overwrite semantics, route normalization, route.md root); tests/context.test.mjs brief loading via context.

---

critique-storage.mjs -> impeccable critique-storage

• Invoked from: reference/critique.md: slug "<resolved-path-or-url>" (non-zero -> skip persistence), IMPECCABLE_CRITIQUE_META='{...}' node ... write "<resolved target>" <body-file>, trend "<resolved target>" 5; reference/polish.md: latest "<resolved target>" (exit 2 = none). Imported by context-signals.mjs.
• CLI args: slug <target>; write <slug-or-target> <body-file>; latest <slug-or-target>; trend <slug-or-target> [limit=5]. coerceSlug: value matching /^[a-z0-9-]+$/ used as-is, else slugFromTarget(value) (cwd = process.cwd()).
• Env vars: IMPECCABLE_CRITIQUE_META (JSON object for frontmatter on write; parse failure ignored).
• Storage: dir getCritiqueDir(cwd) = <projectRoot>/.impeccable/critique/. Filename <stamp>__<slug>.md, stamp = ISO UTC with : and . -> - and the -mmmZ fraction removed: 2026-05-12T18-30-00Z. File content: ---\n<key>: <value>\n...---\n<body.trim()>\n, keys = {...meta, timestamp, slug} (meta first, then computed override); null/undefined skipped; string values containing : or # are JSON-quoted. Snapshot filename regex /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}Z__.+\.md$/; sorted lexicographically (= chronologically). Frontmatter read: "..." values JSON-parsed, /^-?\d+$/ -> Number, else string.
• Outputs: slug: slug + \n exit 0, or stderr no stable slug for input\n exit 1. write: missing args -> stderr usage: write <slug-or-target> <body-file>\n exit 1; else absolute path written + \n. latest: none -> exit 2 (no output); else prints file body verbatim. For explicit path/URL targets, latest, trend, and close probe both the current hashed long slug and the previous suffix-only long slug, but accept a legacy snapshot only when its recorded target identity matches. Identity-less pre-upgrade snapshots remain available by passing their exact legacy slug, which avoids guessing a path/URL owner for a collision-prone key. trend: JSON.stringify(rows, null, 2) + \n, rows = frontmatter objects of the last N matching files oldest->newest ([] if none). Unknown -> stderr usage: critique-storage.mjs <slug|write|latest|trend> [args]\n exit 1.
• Gotchas: latest/trend match by suffix __<slug>.md; readLatestSnapshotAcrossTargets uses suffix .md. Main-module guard compares realpaths so symlinked invocation works.
• Tests: tests/critique-storage.test.mjs (slug rules, stamp format, round-trip, newest selection, meta cannot override timestamp/slug, quoting :/#, CLI slug/exit codes/symlink/latest exit 2, trend ordering).

---

palette.mjs -> impeccable palette

• Invoked from: nothing in skill/ references it (grep finds no palette.mjs in SKILL.src.md, reference/, agents/); it is a standalone helper (used by evals).
• CLI args: --id <seed-id> (exact match among 129 inlined seeds; unknown -> stderr no seed with id "<id>", exit 2), --from <key> (deterministic). Both require a following arg. Otherwise random.
• Env: IMPECCABLE_PALETTE_SEED = fallback for --from.
• Algorithm: unit = sha256(key) first 4 bytes big-endian / 2^32, or Math.random(). Weighted pick: hue bucket floor(((H % 360)+360)%360 / 30), weight 1/count(bucket); walk seeds in array order subtracting weights from unit*total until < 0. Seed data: { id, oklch:[L,C,H], mood, strategy } (129 entries, must be copied verbatim to reproduce picks).
• Output: one stdout block starting BRAND SEED · <id>\n\nSeed color (anchor for your primary brand color):\n oklch(<L.3f> <C.3f> <H.1f>) — <hueWord>( (one read: "<mood>"))\n\n... followed by fixed instructional prose (steps 1-4, hard rules, TEXT-ON-COLOR FILLS), with ${H.toFixed(0)}° and \n - one example strategy: <strategy> interpolated. hueWord bands: <15|>=345 pure red; <35 warm red / crimson; <55 warm coral / burnt orange; <80 orange / honey; <105 warm amber / honey-gold; <135 yellow-green / olive; <170 green; <200 teal; <230 sky blue; <265 cobalt / indigo; <295 violet / purple; <330 magenta / pink; else deep pink / rose. Exit 0. Full prose lives at lines 511-628 of the source.
• Tests: none.

---

embed-prompt.mjs -> impeccable embed-prompt

• Invoked from: reference/visualize.md and agents/impeccable-asset-producer.md: node {{scripts_path}}/embed-prompt.mjs <image> --prompt "<prompt>" after every generation; reference/new-work.md: node {{scripts_path}}/embed-prompt.mjs --scan <asset-dir...> before review/verdict, clearing every MISSING: line. generate-image.mjs embeds automatically.
• CLI args: <image> = first arg not starting with --; --prompt <text> | --prompt-file <path>; --read; --scan <path...> (all non--- args are targets).
• Behavior: --scan: no targets -> stderr embed-prompt: --scan needs at least one directory, exit 1; nonexistent -> embed-prompt: no such path <t>, exit 1; walk (dirs skip node_modules and dot-dirs except the explicitly passed root), rasters /\.(png|jpe?g|webp)$/i; print MISSING: <path> per raster without a prompt, then SCAN: <n> raster(s), <m> missing; exit 3 if m>0 else 0. Otherwise: no/nonexistent file -> embed-prompt: image file required exit 1. --read: PNG (0x89504e47) tEXt/zTXt chunk keyword impeccable:prompt, JPEG (FF D8) COM segment starting impeccable:prompt\0, then <image>.json sidecar .prompt; found -> console.log(prompt) exit 0; else stderr embed-prompt: no embedded prompt found, exit 2. Embed: prompt missing -> embed-prompt: --prompt or --prompt-file required exit 1. PNG: remove any existing chunk with the keyword, insert tEXt (impeccable:prompt\0<utf8 prompt>, CRC32) before IEND -> EMBEDDED: <file> (png tEXt, <len> chars); malformed -> embed-prompt: malformed PNG exit 1. JPEG: insert COM after SOI (FFFE, 2-byte length); segment > 0xFFFF -> embed-prompt: prompt too long for a JPEG segment exit 1 -> EMBEDDED: <file> (jpeg COM, <len> chars). Other formats: write <file>.json = JSON.stringify({ prompt, createdAt: ISO }, null, 2) -> EMBEDDED: <file>.json (sidecar fallback for this format).
• Gotchas: JPEG embed is not idempotent (prepends another COM each time; read returns the first). PNG rewrite is idempotent. <len> is JS string length.
• Tests: none directly (referenced from new-work E2E only).

---

context-signals.mjs -> impeccable signals

• Invoked from: reference/routing.md (no-argument /impeccable): node {{scripts_path}}/context-signals.mjs once, after context.mjs; agent then runs detect.mjs --json <scan.targets> for web platforms.
• CLI args / env: none (cwd only). No writes.
• Output: JSON.stringify(signals, null, 2) + \n, exit 0:

  { "setup": { hasProduct, productPath, hasDesign, designPath, hasCode, platform },
    "critique": { "latest": null | { slug, score, p0, p1, timestamp, file } },
    "git": { isRepo, branch, base, changedFiles (max 50), changedCount },
    "devServer": { running, ports },
    "scan": { targets, via } }
  

  hasCode: package.json or any of src app pages site public components lib. platform = extractPlatform(product) (null for web). critique.latest: newest snapshot across slugs; score = Number(total_score ?? score), p0 = p0_count ?? p0, p1 = p1_count ?? p1 (null when missing/blank/NaN); file cwd-relative. git: not a repo -> { isRepo:false, branch:null, base:null, changedFiles:[], changedCount:0 }; branch = rev-parse --abbrev-ref HEAD; base detection: on integration branch (HEAD, develop|main|master, or any remote's refs/remotes/<r>/HEAD short name) -> base null; else candidates in order: upstream (@{u} full symbolic ref, local or remote), develop (advertised remote rev first, then local, then <remote>/develop origin-first), each remote HEAD name, main, master; first with a rev-parse --verify --quiet hit wins. changedFiles = git diff --name-only <baseRev>...HEAD when base, else git -c core.quotepath=false status --porcelain paths (old -> new -> new). devServer: TCP probe 127.0.0.1 ports 4321 3000 5173 5174 8080 8000 4200, 250 ms timeout, sorted ascending. scan: changed files with ext in .html .htm .css .scss .jsx .tsx .js .ts .vue .svelte .astro, not under a hidden/node_modules/dist/build/__pycache__ dir segment (hidden .vitepress, .vuepress, .storybook allowed), existing -> {targets (max 50), via:'git-changes'}; else existing of src app components pages public -> 'source-dir'; else index.html -> 'html'; else hasCode -> ['.'], 'root'; else [], null.
• Tests: tests/context-signals.test.mjs (setup fields, critique meta keys and null handling, git base detection cases #302, porcelain paths, vendored filtering #303, devServer shape, scan fallbacks, CLI JSON groups).

---

detect-csp.mjs -> impeccable detect-csp

• Invoked from: reference/live-setup.md first-time live setup (skipped when live config cspChecked === true): node {{scripts_path}}/detect-csp.mjs; output { shape, signals } drives the consent prompt/patch template.
• CLI args / env: none; cwd = project root. Runs when process.argv[1] ends with detect-csp.mjs (or detect-csp.mjs/).
• Behavior: walk cwd to depth 6 skipping node_modules .git .next .turbo .svelte-kit .nuxt .astro dist build out .vercel; files with ext in .js .mjs .cjs .ts .mts .cts .tsx .jsx (SCAN) or .tsx .jsx .astro .vue .svelte .html (LAYOUT); read first 64 KiB. Classify per file (first match returns):
  • append-arrays: SCAN ext and relPath matches /packages\/[^/]+\/src\/.*(config|next-config|security)/ and any of \bbuildCSPConfig\b|\bbuildSecurityHeaders\b|\badditionalScriptSrc\b|\badditionalConnectSrc\b|\bcreateBaseNextConfig\b; or svelte.config.* with all of \bkit\s*:, \bcsp\s*:, \bdirectives\s*:; or nuxt.config.* with ['"]nuxt-security['"] and \bcontentSecurityPolicy\b.
  • append-string: SCAN ext, relPath matches /(^|\/)(next|nuxt|vite|astro|svelte)\.config\./ and all of ["']Content-Security-Policy["'](i), \bscript-src\b, \bconnect-src\b.
  • middleware: basename middleware.ts|js|mjs and /headers\.set\(\s*["']Content-Security-Policy["']/i.
  • meta-tag: LAYOUT ext and /http-equiv\s*=\s*["']Content-Security-Policy["']/i. Priority append-arrays > append-string > middleware > meta-tag > { shape: null, signals: [] }.
• Output: console.log(JSON.stringify({ shape, signals }, null, 2)) (signals = matching relPaths for the winning shape). Exit 0.
• Tests: none dedicated.

---

3. Design hook

Source of truth read for this document (repo /Users/paulbakaus/code/impeccable-second):

• skill/scripts/hook.mjs (78 lines), skill/scripts/hook-before-edit.mjs (538), skill/scripts/hook-admin.mjs (801), skill/scripts/hook-lib.mjs (2343)
• skill/scripts/lib/template-extensions.mjs, skill/scripts/lib/provider.mjs, skill/scripts/context.mjs (loadContext, extractPlatform, extractSectionValue, automaticHookMode)
• detector: cli/engine/detect-antipatterns.mjs facade → engines/regex/detect-text.mjs#detectText, engines/static-html/detect-html.mjs#detectHtml, design-system.mjs#loadDesignSystemForCwd, findings.mjs#finding, shared/inline-ignores.mjs
• wiring: scripts/lib/transformers/hooks.js, scripts/lib/transformers/providers.js, scripts/lib/transformers/factory.js, scripts/build.js, scripts/lib/utils.js#replaceScriptProviderMarker, plugin/hooks/hooks.json, generated .claude/settings.json, .codex/hooks.json, .cursor/hooks.json, .github/hooks/impeccable.json, .grok/hooks/impeccable.json, dist/openai/impeccable/hooks/hooks.json, cli/bin/commands/skills.mjs (hook install / rewrite), skill/reference/hooks.md, skill/SKILL.src.md line 81, docs/HARNESSES.md
• tests: tests/hook.test.mjs (3978 lines), tests/hook-build.test.mjs (393 lines)

Conventions in this document: string constants and regexes are quoted verbatim from source. "Harness" values are the internal enum 'claude' | 'cursor' | 'github' (Codex and Grok map to 'claude').

---

0. Shared library: hook-lib.mjs (everything below is imported by the three entry points)

Not a CLI itself; documented first because every observable behavior of hook.mjs, hook-before-edit.mjs and hook-admin.mjs is defined here.

0.1 Constants

ENVELOPE_PREFIX = '[impeccable@1]'

ALLOWED_EXTS = { '.tsx', '.jsx', '.html', '.htm', '.vue', '.svelte', '.astro',
                 '.css', '.scss', '.sass', '.less', '.ts', '.js' }

ACK_EXTS     = { '.tsx', '.jsx', '.html', '.htm', '.vue', '.svelte', '.astro',
                 '.css', '.scss', '.sass', '.less' }        // ALLOWED_EXTS minus .ts/.js

SENSITIVE_PATH = new RegExp([
  String.raw`(?:^|[/\\])\.env(?:\.|$)`,
  String.raw`(?:^|[/\\])\.git(?:[/\\]|$)`,
  String.raw`(?:^|[/\\])id_rsa(?:$|[._-])[^/\\]*$`,
  String.raw`(?:^|[/\\])[^/\\]*\.pem$`,
  String.raw`(?:^|[/\\])(?:[^/\\]*[._-])?(?:secret|secrets|credential|credentials)(?=[._-])[^/\\]*\.(?:json|ya?ml|toml|ini|conf|config|env|txt|key|cert|crt|pem|js|ts)$`,
].join('|'), 'i')

GENERATED_PATH = /(?:\.generated\.[a-z]+$|\.d\.ts$|\.min\.[a-z]+$|[/\\]node_modules[/\\]|[/\\]generated[/\\]|[/\\](?:dist|build|out|\.next|\.cache|coverage)[/\\]|[/\\]?[^/\\]+\.lock(?:\.json)?$)/i

TRUTHY = /^(1|true|yes|on)$/i          // truthy(v): typeof v === 'string' && TRUTHY.test(v)

IMMEDIATE_TIER_RULES = { 'broken-image', 'text-overflow', 'clipped-overflow-container',
  'body-text-viewport-edge', 'low-contrast', 'gray-on-color', 'tiny-text',
  'gradient-text', 'dark-glow', 'design-system-font', 'design-system-color',
  'design-system-radius', 'design-system-font-size' }

ADVISORY_RULES = { 'em-dash-overuse' }
isAdvisoryFinding(f) = id in ADVISORY_RULES || f.advisory === true   (id = lower-cased trimmed f.antipattern)

DEFAULT_CONFIG = {
  enabled: true, quiet: false, auditLog: null,
  designSystem: { enabled: true },
  ignoreRules: [], ignoreFiles: [], ignoreValues: [], extensions: [],
  perEditRules: 'immediate',
  advisoryRules: 'exclude',
  limits: { maxFindings: 5, maxChars: 8000, maxFileBytes: 131072 },
}

HOOK_LOCAL_IGNORE_PATTERNS = ['.impeccable/hook.cache.json', '.impeccable/hook.pending.json', '.impeccable/config.local.json']
HOOK_IGNORE_MARKER_OPEN  = '# impeccable-hook-ignore-start'
HOOK_IGNORE_MARKER_CLOSE = '# impeccable-hook-ignore-end'
CACHE_MAX_SESSIONS = 8
EDIT_COUNT_THRESHOLD = 6
MAX_SCAN_TARGETS = 6
STOP_MAX_FILES = 20
CANONICAL_PATH_CACHE_MAX = 1024
STEER_LINE = 'That does not mean the design is good: keep following the project design system and the impeccable skill guidance.'
DESIGN_STALE_NOTE = `${ENVELOPE_PREFIX} DESIGN.md is newer than .impeccable/design.json. Run ${IMPECCABLE_COMMAND} document to refresh the design-system sidecar.`

IMPECCABLE_COMMAND comes from lib/provider.mjs: IMPECCABLE_COMMAND_PREFIX + 'impeccable'. In source, prefix is '/'. The build (scripts/lib/utils.js#replaceScriptProviderMarker) rewrites the exact line export const IMPECCABLE_COMMAND_PREFIX = '/'; // @impeccable-provider-command-prefix to the provider's command_prefix (/ or $), and export const IMPECCABLE_PROVIDER_ID = 'source'; // @impeccable-provider-id to the provider id. So in a Codex build the strings below read $impeccable audit, $impeccable hooks, etc.

Paths (all relative to a cwd argument):

getConfigPath(cwd)      = <cwd>/.impeccable/config.json
getLocalConfigPath(cwd) = <cwd>/.impeccable/config.local.json
getCachePath(cwd)       = <cwd>/.impeccable/hook.cache.json
getPendingPath(cwd)     = <cwd>/.impeccable/hook.pending.json   (only ever deleted by hook-admin reset; never written)

0.2 Config: readConfig(cwd)

Reads, in order, config.json then config.local.json (later wins for scalars, arrays are unioned). Each file is parsed with JSON.parse; a missing or malformed file is treated as null (silently ignored). For each file:

1. applyConfigSource(config, raw.hook) — only if raw.hook is a non-array object:
   • enabled: if own-property present → raw.enabled === false ? false : true
   • quiet: if own-property present → raw.quiet === true
   • perEditRules: accepted only if 'all' or 'immediate'
   • auditLog: accepted if non-empty string (trimmed)
   • then the detector-key subset (below) is ALSO read from hook (legacy back-compat)
   • limits: if object → { maxFindings: numberOr(raw.limits.maxFindings, cur), maxChars: numberOr(..), maxFileBytes: numberOr(..) } where numberOr(v, fb) = Number.isFinite(v) && v > 0 ? v : fb
2. applyDetectorConfigSource(config, raw.detector) — only if raw.detector is a non-array object:
   • advisoryRules: accepted only if 'include' or 'exclude'
   • designSystem: if non-array object → { ...cur, enabled: raw.designSystem.enabled === false ? false : true }
   • ignoreRules: if array → uniqueStrings([...cur, ...raw]) (Array.from(new Set(values.map(String))))
   • ignoreFiles: same
   • ignoreValues: if array → mergeIgnoreValues(cur, raw) (dedup by key rule\0value\0sortedFiles.join('\x1f'), later wins)
   • extensions: if array → mergeExtensions(cur, raw) (dedup by .ext, later wins)

normalizeIgnoreValueEntries(entries): for each object entry, rule = String(entry.rule||'').trim().toLowerCase(), value = normalizeIgnoreValue(entry.value); both must be non-empty; output object key order is exactly rule, value, [files], [createdAt], [reason]; files = unique trimmed non-empty strings from entry.file (string) followed by entry.files (array), included only if non-empty; createdAt/reason included only if non-empty trimmed strings.

normalizeIgnoreValue(v) = String(v||'').trim().replace(/^["']|["']$/g,'').replace(/\+/g,' ').replace(/\s+/g,' ').toLowerCase().

normalizeExtensionEntries (template-extensions.mjs): entry may be a string or {ext, engine}; ext trimmed+lowercased, . prefixed if missing; engine is 'text' only when an object entry says engine: 'text', otherwise 'html' (strings always html). matchConfiguredExtension(filePath, extensions): basename lowercased; entry matches if name.length > ext.length && name.endsWith(ext); longest ext wins; returns {ext, engine} or null.

0.3 Cache: .impeccable/hook.cache.json

Shape (JSON, written with JSON.stringify(cache) — no pretty printing):

{"version":1,"sessions":{"<session_id>":{"updatedAt":<ms epoch>,"files":{"<abs file path>":{"editCount":<n>,"findings":["<key>",...],"cleanAcked":true?,"cursorDenials":{"<sig>":<n>}?}},"designNoteShown":true?,"footerShown":true?}}}

• readCache(cwd): returns {version:1, sessions:{}} unless file parses and raw.version === 1; sessions must be object else {}.
• persistCache(cwd, cache): if more than 8 sessions, keep the 8 with highest updatedAt (sort desc). Then ensureHookGitExcludes(cwd), mkdir -p .impeccable, write. Returns true/false; never throws.
• bumpEditCount(cache, sid, file) → creates session/file entries as needed, editCount += 1, session.updatedAt = Date.now(), returns new count.
• touchFile → ensures file entry ({editCount:0, findings:[]}) and bumps updatedAt only.
• dedupeAgainstCache(findings, cache, sid, file) → returns findings whose findingCacheKey is not already in fileEntry.findings (also dedups within the input list).
• rememberFindings(cache, sid, file, findings) → replaces fileEntry.findings with the keys of the given findings (not append).
• findingCacheKey(f): line = f.line || 0, value = extractFindingIgnoreValue(f);
  • line>0 && value → ${antipattern}:${line}:${value}
  • line>0 → ${antipattern}:${line}
  • value → ${antipattern}:0:${value}
  • else snippet = String(f.snippet||'').trim().slice(0,80); snippet ? ${antipattern}:0:${snippet} : ${antipattern}:0
• Session flags consumed once per session: designNoteShown, footerShown; per-file: cleanAcked.

ensureHookGitExcludes(cwd): walk up from cwd to find a .git (dir, or file gitdir: <path> → resolved). Target <gitdir>/info/exclude. patternPrefix = relative path from the repo dir to cwd ('' if same). Block written:

# impeccable-hook-ignore-start <prefix or '.'>
<prefix/>.impeccable/hook.cache.json
<prefix/>.impeccable/hook.pending.json
<prefix/>.impeccable/config.local.json
# impeccable-hook-ignore-end <prefix or '.'>

If markers already exist (regex open[\s\S]*?close), the block is replaced in place; otherwise appended: existing (ensuring it ends in \n) + (\n unless existing is empty or already ends in \n\n) + block + \n. Returns {mode:'git-info-exclude', file, changed, patterns} / {mode:'none',...} (no repo) / {mode:'error',...}. Never writes to a tracked .gitignore.

0.4 Project / cwd resolution

• resolveProjectCwd(event, fallback=process.cwd()) = event.cwd || event.workspace_roots[0] || $CURSOR_PROJECT_DIR || fallback.
• looksLikeProjectRoot(dir) = any of .git, package.json, .impeccable exists in dir.
• resolveCacheCwd(primaryFile, sessionCwd): base = resolve(sessionCwd). If no primaryFile / not a string / contains .. → base. If base looks like a project root → base. Else climb from dirname(resolve(primaryFile)): stop returning base when dir === homedir; return dir when it looks like a project root; return base at filesystem root.
• resolveProjectPlatform(cwd) = extractPlatform(loadContext(cwd).product) (try/catch → null). loadContext finds PRODUCT.md (names PRODUCT.md, Product.md, product.md) at the project root, or in fallback dirs .agents/context, docs, or the repo root for monorepo children, or $IMPECCABLE_CONTEXT_DIR. extractPlatform: first non-empty line after a ## Platform heading (case-insensitive, ^##\s+Platform\s*$), lowercased; web|ios|android|adaptive accepted; a token list made only of ios/android (separators [\s,+&/]+, and dropped) containing both → adaptive; else null.
• isNativePlatform(p) = p === 'ios' || 'android' || 'adaptive'.

0.5 Harness detection and event normalization

resolveHarness(env, event):

1. env.IMPECCABLE_HOOK_HARNESS: 'cursor'→cursor, 'github'→github, 'claude'|'codex'→claude.
2. Event has toolName (string) or toolArgs !== undefined, AND tool_name === undefined && tool_input === undefined → 'github'.
3. typeof event.conversation_id === 'string' && event.conversation_id → 'cursor'.
4. else 'claude'.

normalizeHookEvent(event, projectCwd, harness):

• claude → event unchanged.
• cursor → cwd = event.cwd || event.workspace_roots[0] || $CURSOR_PROJECT_DIR || projectCwd; session_id = event.session_id || event.conversation_id || 'unknown'; if tool_input.file_path || tool_input.path || event.file_path present, tool_input.file_path is set to it.
• github (normalizeGitHubEvent): cwd = event.cwd || $CURSOR_PROJECT_DIR || projectCwd; session_id = event.sessionId || event.session_id || 'unknown'; toolName = event.toolName || event.tool_name || null; rawArgs = event.toolArgs.
  • If toolName === 'apply_patch' or looksLikeApplyPatch(rawArgs) (string matching /\*\*\* (?:Begin Patch|Add File:|Update File:|Delete File:)/ that does NOT JSON.parse to an object): tool_input.command = patch text, tool_name = 'apply_patch'. Patch text = the raw string if it carries the marker, else parsed JSON's patch || input || command.
  • Else args = parseGitHubToolArgs(rawArgs) (object as-is; string → JSON.parse to object or {}); filePath = args.path || args.file_path || args.filePath || args.target_file → tool_input.file_path.

resolveTargetFiles(event, projectCwd) (ordered, de-duplicated):

1. if tool_name === 'apply_patch' and tool_input.command string: every m[1] of /^\*\*\* (?:Update|Add) File: (.+)$/gm, trimmed, path.resolve(projectCwd, p) if relative.
2. tool_input.file_path (string)
3. tool_input.path (string) (Cursor Write/StrReplace)
4. event.file_path (string)

normalizeScanTargets(primaries, projectCwd): at most 6; each path: kept verbatim if it contains .., else absolute (path.resolve(baseCwd, p) if relative); dedup.

expandScanTargets(primaries, projectCwd): starts from normalized primaries; for each primary that is inside the project (path.relative not starting .. and not absolute, and no .. in it) with ext in {.jsx,.tsx,.vue,.svelte,.astro} (style-ext primaries and non-UI-code exts are skipped): read content; add (a) static style imports matching /import\s+(?:[\w*{}\s,$]+\s+from\s+)?['"]([^'"]+\.(?:css|scss|sass|less))['"]/gi (relative . resolved from the file's dir, bare resolved from projectCwd, must be inside project); (b) co-located stylesheets that exist: <base>.css, <base>.module.css, <base>.scss, <base>.module.scss, <base>.sass, <base>.module.sass, <base>.less, <base>.module.less, then styles|index|global|globals × .css|.scss|.sass|.less in the same dir. Global cap of 6 targets total.

isScanTargetInsideProject(filePath, projectCwd): both canonicalized (realpathSync of nearest existing ancestor + remainder; memoized, cache cleared at 1024 entries), then isInsideProject.

0.6 Findings filtering

filterFindings(findings, _content, _ext, config): keeps f when it is an object AND

• not advisory (unless config.advisoryRules === 'include'),
• lower(f.antipattern) not in config.ignoreRules (lowercased),
• not matched by an ignoreValues entry: entry.rule must equal the finding rule; if entry.value === '*' (wildcard) then entry MUST have files and the finding's file must match one of the globs (full path, or any path suffix parts.slice(i).join('/')); otherwise the finding's extracted value must equal entry.value (or, for design-system-color only, the two parse to the same RGBA via colorIgnoreKey = r,g,b,round(a*255), hex/rgb()/hsl() forms) and, if entry.files present, the file must match too.

extractFindingIgnoreValue(f): only for rules overused-font, bounce-easing, design-system-font, design-system-color, design-system-radius, design-system-font-size; else ''. Value = normalizeIgnoreValue(raw) where raw = cleanIgnoreValueDisplay(f.ignoreValue || f.value); if empty, scan f.detail then f.snippet:

• bounce-easing: /\banimate-bounce\b/i → match; else /cubic-bezier\([^)]+\)/i; else /animation(?:-name)?\s*:\s*([^;\n]+)/i → first token split on [,\s]+ matching /bounce|elastic|wobble|jiggle|spring/i.
• others, in order: /Primary font:\s*([^()\n;]+)/i, /Google Fonts:\s*([^()\n;]+)/i, /font-family\s*:\s*["']?([^'",;\n]+)/i, /[?&]family=([^&:;\n]+)/i (URI-decoded). cleanIgnoreValueDisplay = trim, strip one leading/trailing quote, +→space, collapse whitespace (no lowercasing).

splitFindingsByTier(findings) → {immediate, deferred} by IMMEDIATE_TIER_RULES. perEditTieringActive(config, harness) = false for 'cursor'/'github'; else config.perEditRules !== 'all'.

matchesAnyGlob(filePath, globs): path separators normalized to /; each glob → regex ^...$ where **→.* (a following / consumed), *→[^/]*, ?→[^/], {a,b}→(?:a|b), regex specials escaped; tested against full path AND basename.

0.7 Rendering

relativize(filePath, cwd): path.relative; if empty or starts with .. → original; else /-joined.

formatFindingLine(f, {compact}):

prefix = f.line > 0 ? `- L${f.line}` : '-'
desc   = compact ? '' : (f.description||'').trim()
name   = (f.name||'').trim(); nameSegment = name ? name.replace(/\.+\s*$/, '') + '.' : ''
hint   = formatFindingIgnoreHint(f)   // 'ignore-value <rule> <quotedValue>' or ''
ignoreSegment = hint ? ` If intentional: \`${hint}\`.` : ''
line = `${prefix} [${f.antipattern}] ${nameSegment} ${desc}${ignoreSegment}`.replace(/\s+/g,' ').trim()

quoteCommandArg(v): if /^[A-Za-z0-9._:-]+$/ → bare; on win32 → " + v with \→\\ and "→\" + "; else POSIX ' + v with '→'\'' + '. The hint's value is the RAW (un-lowercased) extracted value.

Within one emission the first occurrence of a rule gets the description; later lines for the same rule are compact (formatDedupedFindingLine with a shared seenRules set).

directiveFooter({mode}):

• 'short': Triage per the session policy: fix real problems; persist confident false-positive or sanctioned-exception ignores via \hook-admin.mjs ignore-value` and disclose them in your reply; unsure, ask in one line.`
• full (default), 5 lines joined by \n:

Triage each finding, then state in your reply what you fixed, what you suppressed, and what you left standing:
- Real design problem: fix it. Keep intentional design as designed.
- Confident false positive or sanctioned exception (an intentional demo or fixture, documentation of bad design, literal or domain-appropriate motion, a choice the user confirmed): persist the narrowest ignore yourself and disclose it. Run `<HOOK_ADMIN_COMMAND> ignore-value <rule> "<value>" --reason "<who decided: evidence>"` with the pair shown on the finding line, or value "*" plus `--file <path>` when the line shows none. Write "user confirmed" in a reason only when the user did.
- Unsure: leave it as is and ask the user in one line.
Self-serve ends at ignore-value: `ignore-file` and `ignore-rule` need the user's explicit approval, and never add an ignore to push a blocked write through. Full suppression ladder: <IMPECCABLE_COMMAND> hooks.

where HOOK_ADMIN_COMMAND = 'node ' + quoteCommandArg(path.join(__dirname, 'hook-admin.mjs')) (absolute path of the installed hook-admin.mjs, single-quoted on POSIX if it contains spaces etc.).

renderTemplate(findings, filePath, config, opts) (single file):

cap      = max(1, limits.maxFindings)
maxChars = max(500, limits.maxChars) - (opts.reserveChars||0)
header   = `[impeccable@1] Design hook findings requiring review in ${display} (${total} issue(s)):`
lines    = first `cap` findings formatted (deduped descriptions)
more     = remaining>0 ? `... and ${remaining} more (see <IMPECCABLE_COMMAND> audit).` : null
text     = [header, ...lines, more?, '', footer].join('\n')

If text.length > maxChars → clampToBudget: for footerText in [requested footer, short footer] (just [short] if requested is short): pop finding lines from the end (min 1 kept), replacing more with ... and more (see <IMPECCABLE_COMMAND> audit)., until it fits → return. Otherwise clampLastLine: build with [] lines and short footer = bare; room = maxChars - bare.length - 1; if room >= 24 → one line (first finding line) clipped to room-1 chars + …; else if bare fits → bare; else bare.slice(0, max(0, maxChars - footer.length - 4)) + '…\n\n' + shortFooter.

renderGroupedTemplate(groups, config, opts) (used by per-edit multi-file and Stop): drops empty groups; if exactly one group → renderTemplate. Else:

header = `[impeccable@1] Design hook findings requiring review across ${n} files (${total} issue(s)):`
for each group: `${display} (${k} issue(s)):` then up to (cap - shownSoFar) finding lines, then if hidden>0: `- ... ${hidden} more in ${display} (see <IMPECCABLE_COMMAND> audit).`
text = [header, ...lines, '', footer].join('\n')

Note the global cap across groups is maxFindings (5) TOTAL, so later files may show 0 lines and only their "... N more" line. Clamp: clampGroupedToBudget pops lines from the end adding ... and more (see <IMPECCABLE_COMMAND> audit).; result must contain at least one line starting with - ; fallback clampLastLine.

renderCleanAck(filePath, {cwd}) = [impeccable@1] Design hook scanned ${display}. No deterministic design-quality issues found. That does not mean the design is good: keep following the project design system and the impeccable skill guidance.

renderPendingAck(filePath, known, {cwd}) = [impeccable@1] Design hook scanned ${display}. Still has ${count} finding(s) flagged earlier this session (${first 3 keys joined ', '}${count>3 ? , +${count-3} more : ''}). Handle them before finalizing — the previous reminder still applies. (contains a literal em dash —.) known are cache keys like side-tab:3.

suppressionNotice(rel) = [impeccable@1] Suppressing further design hints on ${rel}. More than 6 edits in this session reached. Run <IMPECCABLE_COMMAND> audit to revisit.

shouldEmitAckForFile(filePath, config) = ext in ACK_EXTS, or configured extension with engine === 'html'.

designSystemOptions(config, det, projectCwd): {} if config.designSystem.enabled === false or detector lacks loadDesignSystemForCwd; else {designSystem} if det.loadDesignSystemForCwd(projectCwd) returns truthy (DESIGN.md found walking up to a project boundary; object includes mdNewerThanJson = DESIGN.md mtime > .impeccable/design.json mtime + 1000ms).

The Rust post-edit, before-edit, and Stop hooks resolve design rules per target file using the shared context project resolver. An app's DESIGN.md (including the usual .agents/context and docs locations) takes precedence; an app with no document falls back to its repository's document, never a sibling's. The sidecar comes from the selected design scope, and batch notices follow the displayed file's scope. Hook configuration, platform gating, and session cache locations are unchanged.

appendDesignSystemNote(text, scanOptions) → text + '\n\n' + DESIGN_STALE_NOTE when scanOptions.designSystem.mdNewerThanJson. appendDesignSystemNoteOnce(text, scanOptions, cache, sid, config): same, but only if text.length + NOTE.length + 2 <= max(500, limits.maxChars) and session flag designNoteShown not yet set (sets it). designNoteReserve(scanOptions, cache, sid) = NOTE.length + 2 when note pending and not yet shown, else 0. footerModeForSession(cache, sid) = 'short' if session.footerShown else 'full'. commitFooterShown(cache, sid, text) sets the flag only if text.includes(directiveFooter()) (the full footer verbatim).

payload(text, eventName, harness):

• cursor: JSON.stringify({ additional_context: text })
• github: JSON.stringify({ additionalContext: text })
• claude (incl. Codex, Grok): JSON.stringify({ hookSpecificOutput: { hookEventName: eventName, additionalContext: text } }) with eventName 'PostToolUse' or 'Stop'.

0.8 Audit log: writeAuditLog(env, entry, cwd)

baseCwd = entry.cwd (string) || cwd. Target = env.IMPECCABLE_HOOK_LOG (string) else readConfig(baseCwd).auditLog; if none → return false (no-op). Expand ~/ with $HOME || $USERPROFILE || '.'; relative → path.resolve(baseCwd, target). mkdir -p, append one NDJSON line: JSON.stringify({ ts: new Date().toISOString(), ...entry }) + '\n' (entry's own ts overrides). Never throws.

0.9 Detector loading: loadDetector()

Candidates in order: <scripts>/detector/detect-antipatterns.mjs (built skill layout; the build copies cli/engine/** to scripts/detector/**), <scripts>/../../cli/engine/detect-antipatterns.mjs, <scripts>/../../../cli/engine/detect-antipatterns.mjs. First existing is dynamically imported; cached module-wide; returns { detectText, detectHtml, loadDesignSystemForCwd } or null. Detector option passed by the hook: { designSystem? } only. Findings shape (from cli/engine/findings.mjs): { antipattern, name, description, severity ('warning' default), category, file, line (0 for html engine), snippet, advisory?: true }; design-system findings additionally carry ignoreValue. Both engines apply inline impeccable-disable* comment waivers by default (inlineIgnores !== false).

---

1. hook.mjs -> impeccable hook (PostToolUse per-edit pass + Stop deep pass)

hook.mjs -> impeccable hook

• Invoked from:
  • Claude Code project settings (.claude/settings.json from the build; the CLI installer writes the same content to .claude/settings.local.json; hook-admin on writes .claude/settings.local.json with a simpler node "${CLAUDE_PROJECT_DIR}/.claude/skills/impeccable/scripts/hook.mjs" command). Manifest (build variant, verbatim):

    {
      "description": "Impeccable design detector: immediate-tier checks after Edit/Write/MultiEdit on UI files, full-rule deep pass on Stop.",
      "hooks": {
        "PostToolUse": [{ "matcher": "Edit|Write|MultiEdit", "hooks": [{ "type": "command", "command": "<GUARDED>", "timeout": 5, "statusMessage": "Checking UI changes" }] }],
        "Stop": [{ "hooks": [{ "type": "command", "command": "<GUARDED>", "timeout": 30, "statusMessage": "Design deep pass" }] }]
      }
    }
    

    <GUARDED> = [ ! -f "${CLAUDE_PROJECT_DIR}/.claude/skills/impeccable/scripts/hook.mjs" ] || ! { node -e "process.exit(Math.min(parseInt(process.versions.node,10),22)===22?0:1)" 2>/dev/null || { D="$HOME/.impeccable"; [ -f "$D/node-unsupported" ] || { mkdir -p "$D" 2>/dev/null && : > "$D/node-unsupported" 2>/dev/null && printf '%s' '{"systemMessage":"The impeccable design hook is not running: no Node 22 or newer on PATH. Install one, or remove the impeccable hook from your harness settings."}'; }; exit 0; }; } || node "${CLAUDE_PROJECT_DIR}/.claude/skills/impeccable/scripts/hook.mjs" — i.e. missing file → exit 0 silently; node < 22 → one-time {"systemMessage": ...} on stdout (marker file ~/.impeccable/node-unsupported), exit 0; else run hook.mjs with no args, stdin = the harness JSON event.
  • Claude Code plugin (plugin/hooks/hooks.json, also loaded by Grok Build via CLAUDE_PLUGIN_ROOT→GROK_PLUGIN_ROOT alias): same shape without description, path ${CLAUDE_PLUGIN_ROOT}/skills/impeccable/scripts/hook.mjs.
  • Codex project (.codex/hooks.json): matcher "Edit|Write|apply_patch", path .codex/skills/impeccable/scripts/hook.mjs (build) or .agents/skills/impeccable/scripts/hook.mjs (CLI install / hook-admin), same guarded form with systemMessage notice, PostToolUse timeout 5 + Stop timeout 30. The CLI installer adds commandWindows: if exist "<path>" (node "<path>" & exit /b) for Codex entries. OpenAI plugin bundle (dist/openai/impeccable/hooks/hooks.json) uses ${PLUGIN_ROOT}/skills/impeccable/scripts/hook.mjs.
  • GitHub Copilot (.github/hooks/impeccable.json):

    { "version": 1, "hooks": { "postToolUse": [{ "type": "command", "matcher": "edit|create|apply_patch",
      "bash": "[ ! -f \"$(git rev-parse --show-toplevel)/.github/skills/impeccable/scripts/hook.mjs\" ] || ! node -e \"process.exit(Math.min(parseInt(process.versions.node,10),22)===22?0:1)\" 2>/dev/null || node \"$(git rev-parse --show-toplevel)/.github/skills/impeccable/scripts/hook.mjs\"",
      "timeoutSec": 5 }] } }
    

    No Stop hook (Copilot stop-style events don't feed context back). No systemMessage notice.
  • Grok Build (.grok/hooks/impeccable.json): Claude-shaped hooks object (PostToolUse matcher Edit|Write|MultiEdit + Stop), path .grok/skills/impeccable/scripts/hook.mjs, probe-only guard (no notice). Requires /hooks-trust.
  • Cursor does NOT invoke hook.mjs (uses hook-before-edit.mjs), but hook.mjs still understands Cursor-shaped events (conversation_id, workspace_roots, tool_input.path) and would emit {"additional_context": ...}.
  • Skill text: skill/reference/hooks.md describes it; SKILL.src.md line 81 routes /impeccable hooks to hook-admin.mjs, never to hook.mjs directly. context.mjs#automaticHookMode looks for the marker skills/impeccable/scripts/hook.mjs / hook-before-edit.mjs in the provider's manifests to decide whether to emit MANUAL_DETECTOR_REQUIRED.
  • Stdin payload shapes handled:
    • Claude Code / Codex / Grok PostToolUse: { "session_id", "cwd", "hook_event_name": "PostToolUse", "tool_name": "Edit"|"Write"|"MultiEdit"|"apply_patch", "tool_input": { "file_path": "/abs" | ..., "command": "*** Begin Patch\n*** Update File: rel/or/abs\n..." (Codex apply_patch) }, "tool_response"?, ... }.
    • Claude Code Stop: { "session_id", "cwd", "hook_event_name": "Stop", "stop_hook_active": true|false, ... }.
    • Cursor postToolUse-shaped: { "conversation_id", "workspace_roots": ["/proj"], "tool_name": "Write", "tool_input": { "path": "src/App.jsx" } }.
    • GitHub Copilot postToolUse: { "sessionId", "timestamp", "cwd", "toolName": "edit"|"create"|"apply_patch", "toolArgs": "<JSON string {\"path\":...,\"old_str\":...,\"new_str\":...}>" | "<raw *** Begin Patch text>", "toolResult" }.
• CLI args / flags: none. Ignores process.argv.
• Env vars read:
  • IMPECCABLE_HOOK_DEPTH (snapshotted from parent BEFORE the script sets it to '1' for children); CLAUDE_HOOK_DEPTH — re-entrancy guard: depthIsSet(v) = non-empty string that is TRUTHY or a positive integer → return silently (audit.reentrant=true).
  • IMPECCABLE_HOOK_DISABLED truthy → skip 'env-disabled'.
  • IMPECCABLE_HOOK_QUIET truthy → quiet mode (no clean/pending acks; findings still emitted).
  • IMPECCABLE_HOOK_HARNESS = cursor|github|claude|codex forces the harness.
  • IMPECCABLE_HOOK_LOG = audit NDJSON path (overrides hook.auditLog).
  • IMPECCABLE_HOOK_DEBUG set → unexpected top-level exceptions written to stderr as [impeccable-hook] <err>\n.
  • CURSOR_PROJECT_DIR — project dir fallback for cursor/github events.
  • HOME/USERPROFILE for ~/ audit paths; IMPECCABLE_CONTEXT_DIR indirectly via loadContext.
• Inputs:
  • stdin: whole stdin read as UTF-8 ('' if TTY). Routed to runStopHook iff it parses to an object with hook_event_name === 'Stop'; else runHook.
  • Files: .impeccable/config.json, .impeccable/config.local.json, .impeccable/hook.cache.json (in the resolved project cwd); PRODUCT.md via loadContext (platform gate); DESIGN.md + .impeccable/design.json via detector loadDesignSystemForCwd; the target source files (read as UTF-8 via fs.readFileSync(p,'utf-8') — invalid UTF-8 is replaced, never errors); co-located stylesheets and static style imports of edited .jsx/.tsx/.vue/.svelte/.astro files.
  • Extensions scanned: ALLOWED_EXTS plus detector.extensions entries. Engine: .html/.htm or configured engine:'html' → detectHtml(filePath, scanOptions); else detectText(content, filePath, scanOptions).
  • Size limit: limits.maxFileBytes (default 131072; 0/negative disables) — larger files skipped with lastSkip='too-large'.
• Per-edit algorithm (runHook) in order:
  1. re-entrancy → {reentrant:true, durationMs:0}; IMPECCABLE_HOOK_DISABLED → skipped:'env-disabled'.
  2. JSON.parse(stdin); throw → skipped:'stdin-malformed' (this includes empty stdin); non-object → 'stdin-empty'.
  3. harness = resolveHarness; event = normalizeHookEvent; sessionCwd = event.cwd || cwd; primaryFiles = normalizeScanTargets(resolveTargetFiles(event, sessionCwd), sessionCwd); projectCwd = resolveCacheCwd(primaryFiles[0], sessionCwd); targetFiles = expandScanTargets(primaryFiles, projectCwd). Empty → skipped:'no-file-path'.
  4. config = readConfig(projectCwd); enabled === false → 'config-disabled'.
  5. native platform → skipped:'native-platform', platform.
  6. cache = readCache(projectCwd); sessionId = event.session_id || 'unknown'; detector missing → 'detector-missing'; scanOptions = designSystemOptions(...); tiered = perEditTieringActive(config, harness); quietMode = truthy(IMPECCABLE_HOOK_QUIET) || config.quiet.
  7. For each target file (audit.file updated each iteration): skip with lastSkip = 'sensitive' (contains .. or SENSITIVE_PATH), 'generated', 'extension' (not ALLOWED and not configured), 'config-ignore-file' (matchesAnyGlob(relativized) or (absolute) vs config.ignoreFiles), 'file-missing', 'outside-project', 'too-large' (records skippedBytes). If the file is a PRIMARY (not co-scanned): editCount = bumpEditCount(...); if editCount > 6 → if === 7 and no suppression winner yet → suppressionWinner={filePath}; lastSkip='suppressed', suppressedHit=true, continue. Read content, run detector (throw → findings=[], detectorThrew=true). filtered = filterFindings(...); if tiered split into immediate/deferred else all immediate. If deferred non-empty → touchFile, deferredTotal += n. fresh = dedupeAgainstCache(immediate, ...). audit.findings = raw count, audit.freshFindings = fresh.length, audit.deferred = deferredTotal (if >0). If detectorThrew → detectorThrewAny=true, continue (cache untouched for that file). rememberFindings(cache, sid, file, immediate) (replace). If fresh>0 → push {filePath, findings: fresh} to freshGroups, continue. Else if immediate>0 and no pendingWinner → pendingWinner={filePath, known: immediate.map(findingCacheKey)}; else if immediate==0 and no cleanWinner: if quiet or not ack-eligible → cleanWinner={filePath} (without consuming cleanAcked); else if fileEntry.cleanAcked → cleanAckDeduped=true (keep scanning); else set cleanAcked=true, cleanWinner={filePath}, cleanAckDeduped=false.
  8. If freshGroups non-empty: text = appendDesignSystemNoteOnce(renderGroupedTemplate(freshGroups, config, {cwd:projectCwd, footer: footerModeForSession, reserveChars: designNoteReserve}), ...); commitFooterShown; persistCache always (creates .impeccable/ if needed); return stdout = payload(text,'PostToolUse',harness), audit {..., file: firstGroup.filePath, emitted:true, freshFiles, freshFindings(total), chars, durationMs}, emission:{kind:'fresh', file, findings, groups}.
  9. Else compute ack: not quiet AND pendingWinner AND ack-eligible → {kind:'pending', text: appendDesignSystemNoteOnce(renderPendingAck(...))}; else not quiet AND no suppressionWinner AND cleanWinner AND !cleanAckDeduped AND ack-eligible → {kind:'clean', text: appendDesignSystemNoteOnce(renderCleanAck(...))}.
  10. Persist cache only if deferredTotal > 0 || (cacheDirty && exists(<projectCwd>/.impeccable)) (a clean edit in a project with no .impeccable/ footprint writes nothing to disk).
  11. Return precedence: detectorThrewAny && !pendingWinner && !cleanWinner → audit {emitted:false, error:'detector-threw'}; quiet → {emitted:false, quiet:true}; pending ack → stdout payload, audit {file, emitted:true, kind:'pending', pending:<n>, chars}; suppressionWinner → stdout payload(suppressionNotice(relativize(file))), audit {file, suppressed:true, emitted:true}; clean ack → stdout payload, audit {file, emitted:true, kind:'clean', chars}; pendingWinner (non-UI) → {emitted:false, skipped:'non-ui-ack'}; cleanWinner → same 'non-ui-ack'; cleanAckDeduped → skipped:'clean-ack-deduped'; suppressedHit → {suppressed:true, emitted:false}; else {skipped:lastSkip, bytes?:skippedBytes (only when 'too-large')}. Any exception → {exitCode:0, stdout:'', audit:{..., error}}.
• Stop algorithm (runStopHook): re-entrancy/disabled/malformed/empty as above; event.stop_hook_active === true → skipped:'stop-hook-active' (no scan, no output; prevents Claude Code re-invocation loops, issue #400). projectCwd = resolve(event.cwd || cwd) (no file-based re-keying); sessionId = event.session_id || 'unknown'; config disabled → 'config-disabled'; touched = keys(cache.sessions[sid].files); empty → 'no-touched-files'; native → 'native-platform'; detector missing → 'detector-missing'. Iterate touched files (max 20 scanned): same skips (sensitive/generated/extension/ignoreFiles/missing/outside-project) silently; read (unreadable → skip); detect with full rule set (no tiering); filtered = filterFindings; fresh = dedupeAgainstCache; if fresh → rememberFindings(cache, sid, file, fresh) (NOTE: replaces the file's remembered set with only the fresh ones), push group. audit.scannedFiles. No groups → {emitted:false, skipped:'stop-clean'}. Else render grouped with footer mode + reserve, appendDesignSystemNoteOnce, commitFooterShown, persistCache, stdout payload(text,'Stop',harness), audit {emitted:true, freshFiles, freshFindings, chars, durationMs}, emission:{kind:'stop-deep-pass', groups}.
• Outputs:
  • stdout: exactly one JSON document (no trailing newline) when something is emitted, else nothing. Claude/Codex/Grok: {"hookSpecificOutput":{"hookEventName":"PostToolUse"|"Stop","additionalContext":"<text>"}}. Cursor-shaped: {"additional_context":"<text>"}. GitHub: {"additionalContext":"<text>"}.
  • stderr: only [impeccable-hook] <err> when IMPECCABLE_HOOK_DEBUG and an unexpected top-level error.
  • exit code: always 0 (process.exit(result.exitCode || 0); the catch-all also exits 0). Non-blocking in every harness; context is injected via additionalContext.
  • Text formats: see §0.7. Example fresh single-file emission:

    [impeccable@1] Design hook findings requiring review in src/Card.tsx (2 issue(s)):
    - L12 [dark-glow] Dark glow shadow. <registry description> If intentional: `ignore-value ...`.
    - L3 [side-tab] Side tab. <registry description>
    
    Triage each finding, then state in your reply ...   (full footer, 5 lines; short footer on later fires in the session)
    

    optionally followed by \n\n[impeccable@1] DESIGN.md is newer than .impeccable/design.json. Run /impeccable document to refresh the design-system sidecar. once per session.
• Side effects: writes .impeccable/hook.cache.json (rules in step 8/10 and Stop), <gitdir>/info/exclude block (via persistCache), audit NDJSON (env/config). process.env.IMPECCABLE_HOOK_DEPTH='1' exported to children. Audit entries: {ts, event:'PostToolUse'|'Stop', harness, cwd, session, tool?, file?, ext?, editCount?, findings?, freshFindings?, deferred?, emitted?, kind?, pending?, chars?, freshFiles?, scannedFiles?, suppressed?, skipped?, bytes?, reentrant?, quiet?, error?, platform?, durationMs}; on crash {ts, event:'hook-error', error}.
• Detection performed: detectHtml(filePath, {designSystem?}) for html-engine targets; detectText(content, filePath, {designSystem?}) otherwise. Findings capped in render at limits.maxFindings (5) total per emission and limits.maxChars (8000, floor 500) chars; deduped per session per file by findingCacheKey; per-edit shows only IMMEDIATE tier (unless perEditRules:'all' or cursor/github harness); advisory rules dropped unless detector.advisoryRules:'include'.
• Edge cases / gotchas: generated/sensitive paths and any path containing .. never scanned; native PRODUCT.md platform → whole scan skipped (audit native-platform); files > 128 KiB skipped; empty stdin is stdin-malformed (not stdin-empty); the 7th edit of a primary file in a session emits the suppression notice once and the file is silent thereafter (co-scanned stylesheets don't bump counts); umbrella-dir launches key .impeccable/ to the edited file's nearest project root but the Stop pass uses the session cwd (so those sessions no-op on Stop); Windows: path.sep normalized to / for globs/display and command-arg quoting switches to double quotes; timeouts are the harness's (5 s per-edit, 30 s Stop) — the script has no internal timer; a detector throw leaves the cache untouched and yields error:'detector-threw' only if nothing else emitted; hook.mjs never returns exit 2, so no harness treats it as blocking.
• Tests covering it: tests/hook.test.mjs — truthy(), SENSITIVE_PATH / GENERATED_PATH, isScanTargetInsideProject(), readConfig(), readCache / persistCache / bumpEditCount, ensureHookGitExcludes(), matchesAnyGlob(), filterFindings(), renderTemplate() (envelope, footer text, short footer, description dedupe, ignore hints, POSIX/Windows quoting #476/#533, clamp behaviour), writeAuditLog(), payload(), runHook() (≈40 cases: fresh→pending, GitHub edit/apply_patch end-to-end, clean ack, .ts/.js quiet, IMPECCABLE_HOOK_QUIET, config quiet, re-entrancy, kill switch, config-disabled, native platform, DESIGN.md gating, staleness note, sensitive/generated/traversal/outside-project/symlink, extension allowlist, ignoreFiles, suppression on 7th edit, MultiEdit/apply_patch shapes, detector throw, async HTML detector, inline impeccable-disable, malformed stdin, missing file), runHook() — cache write gating, — oversized files, — session cache tracks current scan, — session-scoped notices, — clean-ack noise, resolveCacheCwd(), suppressionNotice(), ALLOWED_EXTS, matchConfiguredExtension(), renderCleanAck()/renderPendingAck(), parseApplyPatchPaths(), resolveTargetFiles(), resolveHarness()/normalizeHookEvent(), expandScanTargets(), runHook() — co-located stylesheet scan, — events without file_path, — configured template extensions (#316), resolveProjectPlatform()/isNativePlatform(), runHook() — emission enrichment, — per-edit tiering, runStopHook() (full rule set + dedupe, clamped grouped render, no touched files, out-of-project files, second Stop silent, ignoreRules, advisory, stop_hook_active true/false, kill switches). tests/hook-build.test.mjs — manifest builders for Claude/Codex/Cursor/GitHub/Grok, node-probe presence and cmd.exe-safe characters, generated root manifests match builders, plugin hooks/hooks.json uses ${CLAUDE_PLUGIN_ROOT}, generated skill runtime can import bundled detector.

---

Stop finding attribution (#522)

The Rust Stop pass still scans whole touched files; it does not infer causation from changed line ranges. It suppresses confirmed pre-existing text findings and marks remaining findings [new] or [attribution unknown]. Unknown findings remain visible, with a reminder not to treat them as regressions or broaden the task without asking. Explicit detect scans and per-edit/pre-edit output are unchanged.

A baseline currently requires the first observed edit of that file in a named Claude session to carry a complete Edit/Write result (tool_response.originalFile, filePath, and the replacement/content fields). Replaying that result must exactly match the current file. Write with type: "create" and a null original is an empty baseline; a null original on an update is unknown. No Git/HEAD comparison is used, so existing uncommitted work is part of the baseline. Missing, ambiguous, oversized, mismatched, or user-modified results remain unknown; a later edit cannot establish a missing initial baseline.

The baseline compares pure text-detector findings, independent of line numbers, with multiplicity preserved. It stores only hashed finding identities and counts under the existing session cache's stopBaseline field, versioned by schema and engine. A finding observed to disappear loses its exemption, so reintroducing it is new. Capture is capped at 512 KiB per file and 256 findings. Cache eviction or incompatible metadata falls back to unknown, never suppression.

DOM scans, design-system findings, co-scanned stylesheets without their own baseline, and providers/events without a verified preimage remain unknown: other files or earlier edits may affect the result. [new] means absent from the verified first-observed-edit baseline, not proof of who caused it. Stop audit output records preExistingFindings (suppressed), newFindings, and unknownFindings before notification deduplication. No permanent ignores or new hook permissions are created.

hook-before-edit.mjs -> impeccable hook-before-edit (Cursor preToolUse write gate)

• Invoked from: Cursor project manifest .cursor/hooks.json:

  { "version": 1, "hooks": { "preToolUse": [ { "command": "[ ! -f \".cursor/skills/impeccable/scripts/hook-before-edit.mjs\" ] || ! node -e \"process.exit(Math.min(parseInt(process.versions.node,10),22)===22?0:1)\" 2>/dev/null || node \".cursor/skills/impeccable/scripts/hook-before-edit.mjs\"", "timeout": 5 } ] } }
  

  (hook-admin on writes the un-guarded node ".cursor/skills/impeccable/scripts/hook-before-edit.mjs"; the CLI installer on Windows wraps in node -e "<WIN32_HOOK_GUARD_SCRIPT>" "<path>".) No matcher: fires for every tool. Stdin: Cursor preToolUse JSON, e.g. { "hook_event_name": "preToolUse", "conversation_id"?, "session_id"?, "cwd"?, "workspace_roots"?: [...], "tool_name": "Write"|"Edit"|"StrReplace"|"MultiEdit"|"Shell"|..., "tool_input": { "file_path"|"path"|"target_file", "content"|"streamContent"|"text", "old_string"/"new_string" (or oldString/newString, old_str/new_str, target/replacement), "edits": [...], "command" | "args": { "command" } } }. Only Cursor is documented; IMPECCABLE_HOOK_HARNESS is not consulted (audit always says harness:'cursor').
• CLI args / flags: none.
• Env vars read: IMPECCABLE_HOOK_DISABLED (truthy → allow, checked BEFORE stdin), IMPECCABLE_HOOK_LOG, IMPECCABLE_HOOK_DEBUG (stderr [impeccable-hook-before-edit] <err>), CURSOR_PROJECT_DIR (project fallback via resolveProjectCwd), HOME/USERPROFILE, IMPECCABLE_CONTEXT_DIR.
• Inputs:
  • sessionCwd = resolveProjectCwd(event); filePath = proposedFilePath(event, sessionCwd): tool_input.file_path || .path || .target_file || event.file_path, else a shell write destination parsed from tool_input.command / tool_input.args.command: redirect /(?:^|[\s;&|])(?:>>?|1>>?)\s*(?:"([^"]+)"|'([^']+)'|([^<>\s]+))/, then tee <first non-flag word> (stops at && || ; |), then cp <src> <dest> (last two non-flag args), then python Path("...").write_text( / var = Path("..."); var.write_text( / open("...", "w|a|x[+][b]"). Relative → resolved against sessionCwd. cwd = resolveCacheCwd(filePath, sessionCwd).
  • content = proposedContent(...): first string among tool_input.content, .streamContent, .text; else projected Edit: single old/new pair (old_string|oldString|old_str|target / new_string|newString|new_str|replacement) → read existing file (must be inside project, not sensitive/generated, regular file ≤ 1 MiB) and replace FIRST occurrence (empty old → missing) ; or edits[] array applied sequentially with the same keys; skip reasons 'fragment-only-edit' (only one side given / non-object edit), 'edit-original-unreadable', 'edit-old-string-missing'; else if hasFragmentEditContent → 'fragment-only-edit'; else shell: python write_text(/write( string arg (heredoc body or command; triple/single/double quoted, backslash-unescaped), heredoc body (/<<-?\s*['"]?([A-Za-z0-9_.-]+)['"]?[^\r\n]*\r?\n/ to \n<marker>(\n|$)), or cp source file content (inside project, ≤ 1 MiB); else ''.
  • Config/PRODUCT.md/DESIGN.md as in hook.mjs, keyed to cwd. Extensions: ALLOWED_EXTS + detector.extensions. No maxFileBytes check on proposed content (only the 1 MiB read cap for originals/copies).
• Decision order (each allow writes an audit entry {ts, event:'preToolUse', harness:'cursor', cwd, tool, file, ext?, ...}):
  1. IMPECCABLE_HOOK_DISABLED → allow {skipped:'env-disabled'}.
  2. stdin parse error → 'stdin-malformed'; empty/non-object → 'stdin-empty'.
  3. no filePath → 'no-file-path'; outside project → 'outside-project'; SENSITIVE → 'sensitive'; GENERATED → 'generated'.
  4. config = readConfig(cwd); ext not allowed and not configured → 'extension'.
  5. content skip object → that reason; empty content → 'no-proposed-content'.
  6. config.enabled === false → 'config-disabled'; native platform → 'native-platform' (+platform).
  7. ignoreFiles glob (relative or absolute) → 'config-ignore-file'.
  8. detector missing → 'detector-missing'; scanOptions = designSystemOptions.
  9. html engine (.html/.htm or configured engine:'html') → detectProposedHtml: write content to mkdtemp(os.tmpdir()/impeccable-pre-)/<basename>, detectHtml(tmp, scanOptions), remap each finding's file to the real path, rm -rf temp dir; else detectText(content, filePath, scanOptions). Throw → allow {error:'detector-threw'}.
  10. filtered = filterFindings(...) (NO tiering, NO session dedupe: full rule set every time); empty → allow {findings:<n>, blockedFindings:0}.
  11. sessionId = event.session_id || event.conversation_id || 'unknown'; cache = readCache(cwd); footerMode = footerModeForSession; message = appendDesignSystemNoteOnce(cursorBlockMessage(...), ...); commitFooterShown; denial = bumpCursorDenial(cache, sid, filePath, filtered) (signature = sorted ${antipattern}:${line||0} joined |; fileEntry.cursorDenials[sig] += 1); persistCache(cwd, cache) always (creates .impeccable/).
  12. If denial.count > 6 → allow with payload { permission:'allow', user_message: warning, agent_message: warning } where warning = message + '\n\nThis is the ' + count + 'th repeated denial for the same file and finding signature, so Impeccable is allowing this write to avoid a loop. Reconsider the issue immediately after the tool runs.'; audit {findings, blockedFindings, cursorDenialKey, cursorDenialCount, downgraded:true, chars}.
  13. Else deny: stdout {"permission":"deny","user_message":<message>,"agent_message":<message>}; audit {blocked:true, findings, blockedFindings, cursorDenialKey, cursorDenialCount, chars}.
• cursorBlockMessage: budget = min(limits.maxChars, 4000); renderTemplate(findings, filePath, {...config, limits:{...limits, maxChars: budget}}, {cwd, footer: footerMode, reserveChars: designNoteReserve + BLOCK_PREFIX.length}), then the header substring [impeccable@1] Design hook findings requiring review is replaced by [impeccable@1] Impeccable design hook blocked this write before it landed. Design hook findings requiring review. Message therefore ≤ 4000 chars including the footer.
• Outputs: stdout is always exactly one JSON document: {"permission":"allow"} (most allows; done({permission:'allow', ...payload}) — extra keys only in the downgrade case), or {"permission":"deny","user_message":"...","agent_message":"..."}. Exit code always 0. Unhandled exception → {"permission":"allow"} + exit 0. Blocking semantics: Cursor treats permission:'deny' as a tool denial and shows user_message/agent_message.
• Side effects: .impeccable/hook.cache.json (cursorDenials, footerShown, designNoteShown; written only when findings exist), git info/exclude block, temp dir for HTML staging (removed), audit NDJSON.
• Detection performed: full detector rule set on the PROPOSED content (not disk), filtered by config ignores/advisory only. No maxFindings-per-session dedupe; capped by render (5 lines / ≤4000 chars).
• Edge cases / gotchas: Edit with only new_string (no old) is allowed unscanned (fragment-only-edit); a Write whose content is empty is allowed (no-proposed-content); repeated identical denials (same file + same finding signature) are allowed from the 7th time with a warning; the same session flags (footerShown) are shared with hook.mjs, so a Cursor session pays the full policy once; native platform allows even with findings; findings from HTML engine carry line 0 → signature rule:0.
• Tests covering it: tests/hook.test.mjs describe('Cursor hook scripts'): deny with findings and audit blocked:true; stale-sidecar note within a 500-char budget (PR #508); allow when platform native; allow clean writes; configured template extensions gate + html-engine routing (#316); shell heredoc / python heredoc / >> redirect / tee / cp writes denied; Edit old/new projection; fragment-only edits allowed; downgrade after threshold (7 denials → allow with allowing this write to avoid a loop, cache cursorDenials == 7); IMPECCABLE_HOOK_DISABLED honored before stdin parsing (audit env-disabled).

---

hook-admin.mjs -> impeccable hooks (config/manifest administration)

• Invoked from: skill text only. skill/SKILL.src.md line 81: /impeccable hooks <on|off|status|ignore-rule|ignore-file|ignore-value|reset> → load reference/hooks.md, which runs node {{scripts_path}}/hook-admin.mjs <action> [args...] from the project cwd and passes output through verbatim (plus follow-up lines: after off: "Done. New edits will not trigger the design hook in this project until you run /impeccable hooks on."; after on: "Done. The design hook will fire after the next Edit/Write/MultiEdit on a UI file."). Also embedded in every hook emission's full footer as node '<abs>/hook-admin.mjs' ignore-value <rule> "<value>" --reason "...". No stdin. Working directory = process.cwd() = the project root.
• CLI args / flags: argv[2] = action, lowercased, default 'status'; must be in {status, on, off, ignore-rule, ignore-file, ignore-value, reset} else stderr Unknown action: <a>\nValid: status, on, off, ignore-rule, ignore-file, ignore-value, reset\n, exit 1.
  • ignore-rule <rule-id> [--all-values] [--reason ...|--reason=...]: --reason accepted and discarded (consumes following non--- args); any other --flag → error Unknown ignore-rule flag: <arg>. Rule id trimmed+lowercased. Missing → Pass a rule id, e.g. /impeccable hooks ignore-rule side-tab. overused-font without --all-values → overused-font is value-specific by default. Use /impeccable hooks ignore-value overused-font <font> for a confirmed font, or /impeccable hooks ignore-rule overused-font --all-values only when the user asked to ignore overused fonts generally.
  • ignore-file <glob> [--shared|--local]: --reason/--reason= → error --reason is not supported for ignore-file because detector.ignoreFiles stores globs only; use ignore-value when a documented rule-specific exception fits; unknown flag → Unknown ignore-file flag: <arg>; both scopes → Pass only one scope flag: --shared or --local; >1 positional → Pass exactly one glob to ignore-file; none → Pass a glob, e.g. /impeccable hooks ignore-file "src/legacy/**".
  • ignore-value <rule> <value...> [--shared|--local] [--reason <words...>|--reason=<text>] [--file <glob>|--files <glob>|--file=<glob>|--files=<glob>]*: value = normalizeIgnoreValue(valueParts.join(' ')) (so multi-word values may be unquoted; result lowercased); files unique + sorted; --file with no glob → <flag> requires a glob; empty glob → <flag> requires a non-empty glob; glob starting with -- → <flag> requires a glob, got the flag <glob>; unknown flag → Unknown ignore-value flag: <arg>; missing rule/value → Pass a rule id and value, e.g. /impeccable hooks ignore-value overused-font Inter; both scopes → Pass only one scope flag: --shared or --local; value * without files → Wildcard value ignores must be scoped with --file <glob>, e.g. /impeccable hooks ignore-value design-system-font-size "*" --file "src/widget.js". To suppress the rule project-wide use /impeccable hooks ignore-rule <rule>[ --all-values if rule is overused-font].
  • status, on, off, reset take no args (extras ignored).
• Env vars read: IMPECCABLE_HOOK_DISABLED (only displayed in status).
• Inputs: .impeccable/config.json, .impeccable/config.local.json (raw JSON; malformed → treated as absent for reads and reported by status), .impeccable/hook.cache.json existence; for on: presence of <cwd>/.claude/skills/impeccable, .agents/skills/impeccable, .cursor/skills/impeccable, .github/skills/impeccable, and existing manifests .claude/settings.json, .claude/settings.local.json, .codex/hooks.json, .cursor/hooks.json, .github/hooks/impeccable.json.
• Outputs (stdout = message + \n, exit 0; errors: stderr Error: <message>\n, exit 1):
  • status:

    Impeccable design hook
      state:        enabled|disabled
      shared file:  .impeccable/config.json[ (using defaults; file not present)| (malformed; ignored)]
      local file:   .impeccable/config.local.json[ (not present)| (malformed; ignored)]
      ignoreRules:  a, b | (none)
      ignoreFiles:  ... | (none)
      ignoreValues: rule=value[ [glob1, glob2]], ... | (none)
      maxFindings:  5
      maxChars:     8000
      env override: IMPECCABLE_HOOK_DISABLED=<v> | unset
      cache file:   .impeccable/hook.cache.json[ (not present)]
    

  • off: Design hook disabled for this project (wrote .impeccable/config.json).
  • on: Design hook enabled for this project (wrote .impeccable/config.json). Recorded local hook consent in .impeccable/config.local.json. + one of Installed or repaired hook manifests for: <providers>. / Hook manifests already installed for: <providers>. / No installed provider skill folders found to repair. + optionally Backed up malformed manifest(s): <paths>. (parts joined by single spaces).
  • ignore-rule: Added "<rule>" to detector.ignoreRules. Current: <list>
  • ignore-file: Added "<glob>" to shared|local detector.ignoreFiles (<relative path>). Current: <list>
  • ignore-value: Added <rule>=<value>[ scoped to <g1>, <g2>] to shared|local detector.ignoreValues (<relative path>).
  • reset: Reset design hook config and cache (removed: <a, b>). or No hook config or cache to remove. Already at defaults.
• Side effects (all JSON files written with JSON.stringify(x, null, 2) + '\n'):
  • writeHookConfig(cwd, hookConfig, {local}): target file; if local → ensureHookGitExcludes first; next = { ...existing, hook: { ...existingHookMinusDetectorKeys, ...hookConfig } }; legacy detector keys found under hook (ignoreRules, ignoreFiles, ignoreValues, designSystem, advisoryRules) are migrated into detector (merged with existing detector). on/off write hook: { enabled, limits: { maxFindings, maxChars } } merged over existing hook keys — NOTE this replaces the whole limits object, dropping a configured maxFileBytes; sibling keys (quiet, auditLog, perEditRules, consent) survive. on additionally writes hook.consent: 'accepted' into config.local.json.
  • writeDetectorConfig(cwd, detectorConfig, {local}): next.detector = { ...existingDetectorSection, ...merged } where merged = { ignoreRules, ignoreFiles, ignoreValues, designSystem?, advisoryRules? } (arrays deduped, ignoreValues normalized with key order rule,value,files,createdAt,reason); legacy detector keys are stripped out of hook (and hook deleted if then empty). Untouched ignoreValues entries stay byte-identical.
  • ignore-value entry inserted: { rule, value, files?, createdAt: <ISO now>, reason? }; if an entry with the same rule\0value\0sortedFiles key exists only its reason is updated (when given).
  • repairHookManifests(cwd) (on only): for each HOOK_MANIFEST_TARGETS whose skillRel dir exists:
    • .claude → dest .claude/settings.local.json; if .claude/settings.json already contains an impeccable hook marker in its hooks subtree, prune impeccable entries from settings.local.json and count as already. Manifest inserted:

      { "description": "Impeccable design detector: immediate-tier checks after Edit/Write/MultiEdit on UI files, full-rule deep pass on Stop.",
        "hooks": { "PostToolUse": [ { "matcher": "Edit|Write|MultiEdit", "hooks": [ { "type": "command", "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/skills/impeccable/scripts/hook.mjs\"", "timeout": 5, "statusMessage": "Checking UI changes" } ] } ],
                   "Stop": [ { "hooks": [ { "type": "command", "command": "node \"${CLAUDE_PROJECT_DIR}/.claude/skills/impeccable/scripts/hook.mjs\"", "timeout": 30, "statusMessage": "Design deep pass" } ] } ] } }
      

    • .agents → dest .codex/hooks.json: { "hooks": { "PostToolUse": [ { "matcher": "Edit|Write|apply_patch", "hooks": [ { "type":"command", "command": "node \".agents/skills/impeccable/scripts/hook.mjs\"", "timeout": 5, "statusMessage": "Checking UI changes" } ] } ], "Stop": [ { "hooks": [ { "type":"command", "command": "node \".agents/skills/impeccable/scripts/hook.mjs\"", "timeout": 30, "statusMessage": "Design deep pass" } ] } ] } }
    • .cursor → .cursor/hooks.json: { "version": 1, "hooks": { "preToolUse": [ { "command": "node \".cursor/skills/impeccable/scripts/hook-before-edit.mjs\"", "timeout": 5 } ] } }
    • .github → .github/hooks/impeccable.json: { "version": 1, "hooks": { "postToolUse": [ { "type": "command", "matcher": "edit|create|apply_patch", "bash": "node \"$(git rev-parse --show-toplevel)/.github/skills/impeccable/scripts/hook.mjs\"", "timeoutSec": 5 } ] } }
    • Merge rule (mergeHookManifests): keep existing top-level keys; version/description from fresh if defined; for each event key, keep existing entries with impeccable entries stripped (marker match on command, args, bash, powershell, or nested hooks[]; markers = skills/impeccable/scripts/hook-probe.mjs|hook.mjs|hook-before-edit.mjs|hook-after-edit.mjs|hook-stop.mjs), then append fresh entries. Unparseable existing manifest → copied to <dest>.bak and overwritten. Idempotent: if serialized output equals current file content → already. Pruning of a manifest that becomes empty deletes the file.
  • reset: from each of config.json/config.local.json remove hook and detector keys (delete file if nothing else remains; skip files without those keys); delete hook.cache.json and hook.pending.json if present. Does NOT touch harness manifests or git exclude.
• Detection performed: none.
• Edge cases / gotchas: value normalization lowercases (Inter → inter), so status prints overused-font=inter; --reason word-joining stops at the next -- token; --file= empty refused; multi-file scope stored sorted; ignore-rule --reason accepted but discarded; running from a non-project cwd writes .impeccable/ there; on never installs .grok; malformed config file: status says (malformed; ignored) but a write (writeHookConfig) treats it as {} and overwrites it.
• Tests covering it: tests/hook.test.mjs describe('hook-admin.mjs') — empty --file refusal, unsorted on-disk scope matches sorted argv, canonical multi-file order, status shows scope rule=* [glob], bare wildcard refused with correct project-wide suggestion (incl. --all-values for overused-font), ignore-value default shared (no local file created, createdAt ISO), --shared, --local (+status shows local), --file scoping, --file=/--files=/repeated, wildcard without scope refused, --file requires glob, unknown flag rejected, unrelated edit keeps ignoreValues byte-identical, normalizer parity with cli/lib/impeccable-config.mjs (key order rule,value,files,createdAt,reason), hooks edit preserves sibling hook fields (consent, quiet), on with declined consent installs/repairs manifests for .claude, .agents, .cursor, .github (strips stale impeccable entry, keeps others, adds Stop), ignore-rule overused-font requires --all-values, ignore-rule for other rules, conflicting scope flags, ignore-file --local writes only private config and preserves local advisoryRules, legacy hook.advisoryRules migration for each command, ignore-file refuses --reason/unknown flags, ignore-file suppresses a later runHook.

---

hook-lib.mjs -> (library; no CLI verb)

• Invoked from: imported by hook.mjs, hook-before-edit.mjs, hook-admin.mjs, tests/hook.test.mjs; context.mjs is imported BY it (extractPlatform, loadContext), and it re-exports matchConfiguredExtension from lib/template-extensions.mjs (also used by live-wrap/live-accept). Not executable (no main).
• CLI args / flags: n/a.
• Env vars read (inside functions): IMPECCABLE_HOOK_DEPTH, CLAUDE_HOOK_DEPTH, IMPECCABLE_HOOK_DISABLED, IMPECCABLE_HOOK_QUIET, IMPECCABLE_HOOK_HARNESS (all via the env argument to runHook/runStopHook, which hook.mjs passes as the pre-mutation snapshot of process.env), IMPECCABLE_HOOK_LOG (via env arg to writeAuditLog), CURSOR_PROJECT_DIR (process.env directly), HOME/USERPROFILE (process.env), plus process.platform === 'win32' for quoting.
• Inputs / Outputs / Side effects / Detection: fully specified in §0 above; the two run functions return { exitCode: 0, stdout, audit, emission?, reason? } and never throw.
• Edge cases / gotchas: rememberFindings in the Stop pass stores only the fresh set (so a per-edit-surfaced finding that persists is forgotten after Stop and would be re-reported by a later per-edit dedupe only if reintroduced with a different key — acceptable because Stop is terminal); findingCacheKey is line-number sensitive, so an edit that shifts lines re-surfaces the same finding as fresh; dedupeAgainstCache uses ensureFile and thus creates cache entries even when nothing is later persisted; renderPendingAck and DESIGN_STALE_NOTE/suppressionNotice are the only messages containing non-ASCII (— in pending ack, … in clamp); IMMEDIATE_TIER_RULES/ADVISORY_RULES are hard-coded copies of registry data (must match cli/engine/registry/antipatterns.mjs).
• Tests covering it: everything in tests/hook.test.mjs listed above imports from ../skill/scripts/hook-lib.mjs (≈50 named exports) and asserts on pure-function results (readConfig, readCache/persistCache, ensureHookGitExcludes, matchesAnyGlob, filterFindings, renderTemplate, writeAuditLog, payload, runHook, runStopHook, resolveCacheCwd, resolveHarness, normalizeHookEvent, resolveTargetFiles, parseApplyPatchPaths, expandScanTargets, matchConfiguredExtension, shouldEmitAckForFile, splitFindingsByTier, perEditTieringActive, resolveProjectPlatform, isNativePlatform, commitFooterShown, normalizeIgnoreValueEntries, extractFindingIgnoreValue) plus a setDetectorForTesting / injected detector seam. tests/hook-build.test.mjs 'generated hook runtime can import the bundled detector' imports the built hook-lib.mjs from .claude/skills/impeccable/scripts/ and calls loadDetector().

---

Appendix A — Harness invocation matrix (from docs/HARNESSES.md, transformers/hooks.js, cli/bin/commands/skills.mjs)

Harness	Event(s)	Manifest	Script	Payload → stdout	Blocking?
Claude Code (project)	PostToolUse matcher Edit|Write|MultiEdit (timeout 5), Stop (timeout 30)	.claude/settings.json (build) / .claude/settings.local.json (CLI install, hook-admin)	hook.mjs	{"hookSpecificOutput":{"hookEventName":..,"additionalContext":..}}	No (exit 0)
Claude Code plugin / Grok plugin	same	plugin/hooks/hooks.json (${CLAUDE_PLUGIN_ROOT})	hook.mjs	same	No
Codex	PostToolUse matcher Edit|Write|apply_patch, Stop	.codex/hooks.json (+ commandWindows from CLI); OpenAI plugin hooks/hooks.json (${PLUGIN_ROOT})	hook.mjs	same as Claude (harness 'claude'); apply_patch paths parsed from tool_input.command	No
Cursor	preToolUse (no matcher, timeout 5)	.cursor/hooks.json	hook-before-edit.mjs	{"permission":"allow"} / {"permission":"deny","user_message","agent_message"}	Yes on deny
GitHub Copilot	postToolUse matcher edit|create|apply_patch (timeoutSec 5), bash key	.github/hooks/impeccable.json	hook.mjs	{"additionalContext": ..}	No
Grok Build (project)	PostToolUse Edit|Write|MultiEdit, Stop	.grok/hooks/impeccable.json	hook.mjs	Claude shape (stdout reportedly ignored by Grok)	No
Gemini, Kiro, OpenCode, Trae, Hermes, etc.	none	none	—	context.mjs emits MANUAL_DETECTOR_REQUIRED	—

Node runtime guard in every built command: node -e "process.exit(Math.min(parseInt(process.versions.node,10),22)===22?0:1)" (no </>/newlines so Volta/cmd.exe shims don't break); Claude/Codex variants add the one-time {"systemMessage": "The impeccable design hook is not running: no Node 22 or newer on PATH. Install one, or remove the impeccable hook from your harness settings."} notice guarded by ~/.impeccable/node-unsupported.

Appendix B — Config file schema consumed (.impeccable/config.json, .impeccable/config.local.json)

{
  "hook": {
    "enabled": true,               // false disables hook.mjs + hook-before-edit.mjs (not manual detect)
    "quiet": false,                // true: no clean/pending acks
    "auditLog": "path.ndjson",     // NDJSON audit log (relative to project root, ~/ ok)
    "perEditRules": "immediate",   // or "all"
    "consent": "accepted",         // written by CLI installer / hook-admin on (local file)
    "limits": { "maxFindings": 5, "maxChars": 8000, "maxFileBytes": 131072 },
    // legacy: ignoreRules/ignoreFiles/ignoreValues/designSystem/advisoryRules also read here
  },
  "detector": {
    "ignoreRules": ["side-tab"],
    "ignoreFiles": ["src/legacy/**"],
    "ignoreValues": [{ "rule": "overused-font", "value": "inter", "files": ["a.css"], "createdAt": "ISO", "reason": "..." }],
    "designSystem": { "enabled": true },
    "advisoryRules": "exclude",    // or "include"
    "extensions": [{ "ext": ".blade.php", "engine": "html" }, ".html.erb"]
  }
}

---

4. Live mode

Source of truth read: skill/scripts/live*.mjs, skill/scripts/live/**, skill/scripts/live-browser*.js, skill/scripts/lib/{impeccable-paths,target-args,template-extensions,is-generated}.mjs, skill/reference/live.md, skill/reference/live-setup.md, docs/LIVE-REWRITE-PLAN.md, tests/live-e2e/*, tests/live-e2e.test.mjs, tests/framework-fixtures/README.md, tests/live-*.test.mjs. All quoted strings, JSON keys, routes, and exit codes are verbatim from the current Node implementation. Every path is app-root relative unless stated absolute. "cwd" below always means the resolved appRoot after enterLiveRoot().

Node-only / library dependencies of the current implementation are flagged with [NODE-DEP].

---

Live mode: shared model

0. Directory / file inventory (everything Live writes)

Path (relative to appRoot)	Writer	Purpose
.impeccable/live/config.json	user/agent (first-time setup)	inject config; existence also marks a dir as an app root
.impeccable/live/roots.json	live.mjs boot (writeRootsManifest)	roots manifest (see 1)
<repoRoot>/.impeccable/live/app-root.json	boot, only when repoRoot != appRoot	pointer list of app roots
.impeccable/live/server.json	live-server.mjs on listen	{"pid":N,"port":N,"token":"uuid"} (JSON.stringify, no indent). Removed on shutdown. Legacy fallback read path: <projectRoot>/.impeccable-live.json
.impeccable/live/sessions/<id>.jsonl	session store	append-only journal, one JSON entry per line
.impeccable/live/sessions/<id>.snapshot.json	session store	derived snapshot + __journalBytes, __nextSeq
legacy .impeccable-live/sessions/	read-only fallback	copied to primary on first append
.impeccable/live/annotations/session-XXXXXX/<eventId>.png	server /annotation	annotated screenshots; session-* dir made by mkdtemp, removed on shutdown
.impeccable/live/inject-journal.json	live-inject.mjs	crash-safe list of injected artifacts
.impeccable/live/accept-receipts/<id>.json	live-accept.mjs	idempotency record; swept at server start when older than 14 days
.impeccable/live/locks/<sha256(abs file)[:24]>.lock	withSourceLockSync	per-source-file lock
.impeccable/live/pending-manual-edits.json	manual-edits buffer	{version:1, entries:[...]}
.impeccable/live/manual-edit-evidence/<eventId>.json	manual apply controller	full batch for a dispatched Apply event
.impeccable/live/manual-edit-apply-transaction.json	manual apply	pre-apply file snapshot for rollback
.impeccable/live/manual-edit-events.jsonl	server, only when `IMPECCABLE_LIVE_DEBUG_EVENTS=1	true
node_modules/.impeccable-live/__runtime.js, __probe.js, <id>/manifest.json, <id>/v<N>.svelte, <id>/params.json, <id>/r<N>/*	svelte-component preview	see 8
legacy .impeccable/live/previews/	read/sweep only	old preview root
os.tmpdir()/impeccable-live/<sha1(abs appRoot)[:16]>/deferred-svelte-component-accepts.json	legacy deferred accepts	applied/removed at server start
.git/info/exclude (or .gitignore when no .git)	ensureLiveGitIgnores	block between # impeccable-live-ignore-start / # impeccable-live-ignore-end
user source files	wrap/insert/accept/inject/adapters	markers, see 6-9

Static ignore list written into the ignore block (LIVE_IGNORE_PATTERNS, in this order, then adapter extras, deduped):

.impeccable/hook.cache.json
.impeccable/hook.pending.json
.impeccable/config.local.json
.impeccable/live/server.json
.impeccable/live/roots.json
.impeccable/live/app-root.json
.impeccable/live/inject-journal.json
.impeccable/live/sessions/
.impeccable/live/previews/
.impeccable/live/annotations/
.impeccable/live/artifacts/
.impeccable/live/accept-receipts/
.impeccable/live/locks/
.impeccable/live/cache/
.impeccable/live/manual-edit-apply-transaction.json
.impeccable/live/manual-edit-events.jsonl
.impeccable/live/manual-edit-evidence/
.impeccable/live/pending-manual-edits.json
.impeccable/live/deferred-svelte-component-accepts.json
.impeccable-live.json
.impeccable-live/
app/.impeccable-live/
src/.impeccable-live/
node_modules/.impeccable-live/
src/lib/impeccable/ImpeccableLiveRoot.svelte
src/lib/impeccable/__runtime.js
src/lib/impeccable/[0-9a-f]*/
plugins/impeccable-live.client.ts
app/plugins/impeccable-live.client.ts
src/plugins/impeccable-live.client.ts

Ignore target: if <cwd>/.git is a directory → .git/info/exclude; if it is a file gitdir: X → X/info/exclude; else <cwd>/.gitignore. Existing marker block is replaced in place; otherwise appended (preceded by a blank line unless file empty/ends with blank line). Result object: { file, mode: 'git-info-exclude'|'gitignore', changed, patterns }.

1. roots.json manifest and root resolution (live/roots.mjs)

Manifest (written pretty-printed, 2 spaces):

{
  "version": 1,
  "appRoot": "/abs",
  "repoRoot": "/abs",
  "contextRoot": "/abs" | null,
  "sessionRoot": "<appRoot>/.impeccable/live",
  "productPath": "/abs/PRODUCT.md" | null,
  "designPath": "/abs/DESIGN.md" | null,
  "resolvedFrom": "cwd" | "target:<rel or '.'>" | "candidate:<rel>" | "fallback"
}

Pointer file <repoRoot>/.impeccable/live/app-root.json (only if repoRoot != appRoot): {"version":2,"appRoots":[{"appRoot":"/abs","bootedAt":"ISO"}, ...]} most-recent-first, deduped by appRoot; v1 shape {appRoot} still readable.

Constants:

• DEV_CONFIG_MARKERS: vite.config.{js,ts,mjs,mts,cjs}, svelte.config.{js,mjs,ts}, next.config.{js,mjs,ts}, astro.config.{mjs,js,ts,cjs}, nuxt.config.{ts,js,mjs}, remix.config.js, react-router.config.ts, angular.json, webpack.config.{js,ts}.
• hasDevConfig(dir): any marker exists OR (index.html AND package.json exist).
• isAppRoot(dir): hasDevConfig(dir) OR dir/.impeccable/live/config.json exists.
• Context files: PRODUCT_NAMES = ['PRODUCT.md','Product.md','product.md'], DESIGN_NAMES = ['DESIGN.md','Design.md','design.md']; searched in dir, then dir/.agents/context, then dir/docs.
• findGitRoot(start): walk up looking for .git (file or dir); stop (null) at $HOME or fs root.
• discoverAppCandidates(root, depth=2): readdir; skip dot-dirs and node_modules,.git,dist,build,coverage,vendor,vendors,.next,.nuxt,.svelte-kit,.astro,.turbo,.cache,.vercel; a dir that isAppRoot is collected and NOT descended; else recurse while remaining>1; result sorted.

resolveRoots({cwd, targetPath}):

1. targetDir = target (dir, or dirname of file) else cwd.
2. repoRoot = git root from targetDir, else git root from cwd if targetDir is inside it, else null. upperBound = repoRoot || targetDir.
3. legacyRoot = resolveProjectRoot(cwd, {targetPath}) (context.mjs workspace-aware). markerBound = legacyRoot if a target was given and targetDir ⊆ legacyRoot ⊆ upperBound, else upperBound.
4. appRoot = walk up from targetDir to markerBound (stop at $HOME) for first isAppRoot. resolvedFrom = target:<rel> / cwd.
5. If not found and no target: discoverAppCandidates(cwd); 1 → appRoot, resolvedFrom='candidate:<rel>'; >1 → return { selection: { candidates: [{name: basename, path: rel-with-forward-slashes}] } }.
6. If still none: appRoot = targetDir ⊆ legacyRoot ? legacyRoot : targetDir, resolvedFrom='fallback'.
7. effectiveRepoRoot = repoRoot if appRoot ⊆ repoRoot else appRoot.
8. productPath/designPath each = walk up from appRoot to effectiveRepoRoot with findContextFile. contextRoot = dirname(productPath) || dirname(designPath) || null.

resolveLiveRoots(cwd, {targetPath}) (used by every helper via enterLiveRoot):

1. If no target: walk up from cwd to (git root || cwd) for a roots.json whose appRoot resolves to the dir it sits in → {manifest, source:'persisted'}.
2. Else if git root: read pointer entries → manifests; tier = apps with a live server (server.json pid alive via kill(pid,0) (EPERM counts alive) AND authenticated GET /status?token= returns 200 within 1200ms, probed via a spawned node -e one-liner [NODE-DEP]), else apps whose sessions dir has any *.snapshot.json with phase not in completed|discarded, else all. If tier has >1: stderr [impeccable live] Multiple apps in this repo have live state; using <chosen>. Other candidate(s): <a, b>. Run from the app directory (or pass --target) to address a specific app.\n. Return {manifest: tier[0], source:'pointer'}.
3. Fresh resolveRoots → {manifest|selection, source:'fresh'} (never persisted).

consumeTargetArg(argv): removes --target <v> / --target=<v> from argv; throws --target requires a path value (use --target <path> or --target=<path>) when value missing/empty/starts with --.

enterLiveRoot(cwd): consume target (error → stderr [impeccable live] <msg>, exit 1); resolve; if no manifest (selection) return null and stay in cwd; if appRoot != cwd: if appRoot not a dir → stderr [impeccable live] resolved app root does not exist: <appRoot> (stale roots manifest? re-run the live boot, or pass --target <path>) exit 1; chdir failure → [impeccable live] could not enter app root <appRoot>: <err> exit 1. Returns manifest. Called by: live-server, live-poll, live-status, live-resume, live-complete, live-accept, live-wrap, live-insert, live-inject (all in their if run-directly guard). NOT called by live.mjs (it uses resolveRoots directly), live-discard-manual-edits, live-commit-manual-edits, live-manual-edit-evidence, live-copy-edit-agent.

2. Live config (.impeccable/live/config.json)

Path resolution resolveLiveConfigPath: env IMPECCABLE_LIVE_CONFIG (abs or cwd-relative) wins; else <projectRoot>/.impeccable/live/config.json; else legacy <scriptsDir>/config.json if exists; else the primary path.

Schema (validateConfig, error messages verbatim):

• files: non-empty string array (config.files (non-empty string array) required, config.files must contain only non-empty strings)
• exclude?: string array (config.exclude, if present, must be a string array, config.exclude must contain only non-empty strings)
• insertBefore or insertAfter: string (config.insertBefore or config.insertAfter (string) required)
• commentSyntax: 'html'|'jsx' (config.commentSyntax must be 'html' or 'jsx')
• cspChecked?: boolean (config.cspChecked, if present, must be a boolean)
• not an object → config.json must be an object

resolveFiles(rootDir, config): literal entries (no *?[) pass through as-is even if missing, not filtered by excludes; glob entries expanded with fs.globSync (files only), relative forward-slash paths, filtered by HARD_EXCLUDES = ['**/node_modules/**','**/.git/**'] + config.exclude via globToRegex (**/→(?:.*/)?, **→.*, *→[^/]*, ?→[^/], regex specials escaped, anchored ^...$); dedupe preserving first appearance.

3. server.json / token / port handshake

• Server picks port: --port=N or first free port from 8400 upward (bind 127.0.0.1). Token = randomUUID().
• Written on listen: .impeccable/live/server.json = {"pid","port","token"}.
• readLiveServerInfo(cwd): tries primary then legacy .impeccable-live.json; if pid recorded and process.kill(pid,0) throws ESRCH → unlink that file and continue; EPERM counts as alive. Returns {info, path} or null.
• Browser gets the token from the injected <script src="http://localhost:PORT/live.js?token=TOKEN">; server prepends to /live.js body: window.__IMPECCABLE_TOKEN__='…'; window.__IMPECCABLE_PORT__=N; window.__IMPECCABLE_APP_ROOT__=<json abs appRoot>; window.__IMPECCABLE_COMMAND_PREFIX__="/"; window.__IMPECCABLE_VOCAB__=[…LIVE_COMMANDS]; window.__IMPECCABLE_LIVE_UI_SURFACES__=[…]; window.__IMPECCABLE_LIVE_MOUNT_CONTRACT__=["root","transport","state","actions"]; followed by, in order, // --- impeccable live script part: session-state (live-browser-session.js) ---, dom-helpers (live-browser-dom.js), browser-ui (live-browser.js) each preceded by that comment line. Parts are re-read from disk on every request.
• Browser sends the token BOTH as ?token= query (authorizes CORS preflight) and in JSON body token for POSTs.

4. Injection per framework (live-inject.mjs + live/frameworks/*)

Registry priority (first detect truthy wins): sveltekit → nuxt → tanstack-start → astro → nextjs → vite-generic → static-html (always matches {via:'fallback'}).

Detection:

• sveltekit: an app.html among literal config.files (or src/app.html) exists and contains both %sveltekit.body% and %sveltekit.head%; and (svelte.config.{js,mjs,cjs,ts} exists OR package deps include @sveltejs/kit|@sveltejs/vite-plugin-svelte|svelte). Descriptor {appHtml, layoutFile, rootComponent} where layoutFile = first existing of src/routes/+layout.svelte, src/routes/(app)/+layout.svelte, default src/routes/+layout.svelte.
• nuxt: nuxt.config.{js,mjs,cjs,ts,mts,cts} present. appDir = literal srcDir: '<x>' from config (normalized, rejects ../absolute; .→), else `'app'` if `app/app.vue` or `app/pages` exists, else . pluginFile = [appDir,'plugins','impeccable-live.client.ts'].join('/').
• tanstack-start: deps include one of @tanstack/react-start,@tanstack/solid-start,@tanstack/start AND root route exists among src/routes/__root.{tsx,jsx,ts,js}, app/routes/__root.{tsx,jsx}. componentFile = src/impeccable/ImpeccableLiveRoot.(jsx if root ext is .jsx/.js else .tsx); componentImport = relative specifier from root route without extension (prefixed ./ if needed).
• astro: astro.config.* file; or dep astro; or a literal .astro config file entry exists (via:'config-files').
• nextjs: next.config.*; or dep next; or one of app/layout.{tsx,jsx,ts,js}, src/app/layout.*, pages/_app.{tsx,jsx,ts,js}, pages/_document.{tsx,jsx}, src/pages/_app.{tsx,jsx} exists.
• vite-generic: vite.config.{js,mjs,cjs,ts,mts,cts}; or dep vite; or index.html+package.json.

Source traits by target file extension (first registry entry claiming the ext; defaults preview:'source', styleMode:'scoped', styleTag:'<style data-impeccable-css="SESSION_ID">', commentSyntax:'html', injectScriptAttrs:''):

• .svelte → sveltekit: preview:'component', html comments.
• .vue → nuxt: scoped/html.
• .tsx/.jsx → tanstack-start/nextjs/vite-generic (all agree): scoped, commentSyntax:'jsx'.
• .astro → styleMode:'astro-global-prefixed', styleTag:'<style is:inline data-impeccable-css="SESSION_ID">', injectScriptAttrs:'is:inline '.
• .html/.htm → static-html.

Tag strategy (astro, nextjs, vite-generic, static-html), per resolved file:

<open> impeccable-live-start <close>\n<script <attrs>src="http://localhost:PORT/live.js?token=ENC(TOKEN)"></script>\n<open> impeccable-live-end <close>\n

open/close = <!--/--> for html, {/*/*/} for jsx. Line endings normalized to the file's dominant one. insertBefore: inserted at LAST occurrence of anchor. insertAfter: after FIRST occurrence, preserving an existing newline right after the anchor. Anchor missing → content unchanged → result {file, error:'insertion_point_not_found', anchor}. Removal regex handles both comment styles, indent-preserving. Repeat inject first removes any old block and reverts CSP.

CSP meta patch: for <meta http-equiv="Content-Security-Policy" content="…"> (not already carrying data-impeccable-csp-original): append http://localhost:PORT to script-src and connect-src (add directive as ; <dir> 'self' <origin> if absent), and blob: to img-src; store original content base64 in data-impeccable-csp-original="…". Revert decodes and restores, drops the marker attr.

Adapters (kind adapter): SvelteKit, Nuxt, TanStack Start; the config files entry is NOT patched.

• SvelteKit apply({cwd,port,token,config}): writes src/lib/impeccable/ImpeccableLiveRoot.svelte (script: onMount creates <impeccable-live-root id="impeccable-live-root"> host with all:initial;display:block;position:fixed;top:0;left:0;width:0;height:0;overflow:visible;z-index:2147483000;pointer-events:none !important, open shadow root + reset style, sets window.__IMPECCABLE_LIVE_ADAPTER__='sveltekit', __IMPECCABLE_LIVE_UI_ROOT__, __IMPECCABLE_LIVE_CHROME_MOUNT__={adapter,version:1,host,root}, appends <script async src=LIVE_URL data-impeccable-live-script="true">, cleanup on destroy). Patches layout (created with default <script>\n let { children } = $props();\n</script>\n\n{@render children?.()}\n if missing): import line import ImpeccableLiveRoot from '$lib/impeccable/ImpeccableLiveRoot.svelte?impeccable-live=<sha256(token)[:8]>'; inserted after the first <script…> (or a new script block prepended), replacing an older-revision import in place; block <!-- impeccable-live-svelte-start -->\n<ImpeccableLiveRoot />\n<!-- impeccable-live-svelte-end -->\n inserted before {@render children()}/<slot /> else appended. Result {file: layoutRel, adapter:'sveltekit', inserted, appHtmlUntouched:true, rootComponent}. Remove: unpatch layout (block, import, empty <script></script>, collapse 3+ newlines), delete component, prune empty dirs up to src. Journal artifacts: created src/lib/impeccable/ImpeccableLiveRoot.svelte marker impeccable-live-root pruneTo src; patched layout patch:'sveltekit-layout' markers [SVELTE_LAYOUT_MARKER_OPEN].
• Nuxt: writes <pluginFile> with content starting /* impeccable-live-nuxt-plugin */ (a defineNuxtPlugin that in import.meta.dev appends <script async src=liveSrc data-impeccable-live-nuxt>), ending /* /impeccable-live-nuxt-plugin */. Existing file without marker → {file, error:'nuxt_plugin_conflict', hint}. Result {file, inserted:true, changed, devOnly:true}. Remove deletes file and empty plugins/ dir; result {file, removed}/{file, removed:false, note:'no adapter present'}/conflict error. Artifact: created, marker impeccable-live-nuxt-plugin, pruneTo = grandparent of pluginFile.
• TanStack Start: writes component file (starts /* impeccable-live-tanstack-start */, React useEffect appending <script async src data-impeccable-live-tanstack data-impeccable-live-script="true">); conflict → {file, error:'tanstack_component_conflict', hint}. Patches root: import ImpeccableLiveRoot from '<componentImport>'; after last import; block {/* impeccable-live-tanstack-start */}\n <ImpeccableLiveRoot />\n {/* impeccable-live-tanstack-end */}\n before <Scripts else before last </body>. Result {file: rootRoute, adapter:'tanstack-start', inserted, componentFile, devOnly:true}. Artifacts: created componentFile marker impeccable-live-tanstack pruneTo src; patched rootRoute patch:'tanstack-root'.

Inject journal .impeccable/live/inject-journal.json: {version:1, appRoot, framework, port, pid, recordedAt, artifacts:[{kind:'created', path, marker, pruneTo} | {kind:'patched', path, patch:'live-tag'|'sveltekit-layout'|'tanstack-root', markers:[…]}]}. healInjectJournal(cwd,{keep}): for every artifact not in keep: refuse outside project; created → remove only if file still contains marker (then prune empty dirs up to pruneTo); patched → skip if none of markers present, else apply undoer (live-tag → removeTag+revertCspMeta; others → adapter unpatch), write only if changed. Returns {healed:[{path, action:'removed'|'unpatched'}], kept}; journal rewritten with kept or deleted.

Restore ("carbonize" is a different concept, see 9): stop = live-server.mjs stop → live-inject.mjs --remove (tag or adapter removal + journal heal + clear journal). Preview tree node_modules/.impeccable-live removed on server shutdown/exit; source markers left by wrap/carbonize are the agent's responsibility (see live.md Cleanup).

5. HTTP API of the helper server (live-server.mjs)

Binds 127.0.0.1:PORT. CORS: if request has Origin and (origin is loopback http(s) localhost|127.0.0.1|::1|[::1] OR ?token= equals server token) → Access-Control-Allow-Origin: <origin> + Vary: Origin. Always Access-Control-Allow-Methods: GET, POST, OPTIONS, Access-Control-Allow-Headers: Content-Type. OPTIONS → 204.

Route	Auth	Behavior
GET /live.js?token=	401 Unauthorized (text/plain) if token mismatch	200 application/javascript, Cache-Control: no-store, no-cache, must-revalidate, max-age=0, Pragma: no-cache; body = prelude + parts (see 3). 500 Error reading live browser scripts: <msg> if a part is unreadable.
GET /detect.js, GET /	none	detector script (detector/detect-antipatterns-browser.js etc.); 404 Not available if none found
GET /modern-screenshot.js	none	vendored modern-screenshot.umd.js, Cache-Control: public, max-age=31536000, immutable; 404 Vendor script not found
POST /annotation?token=&eventId=	401	eventId must match /^[A-Za-z0-9_-]{1,64}$/ else 400 {"error":"Invalid eventId"}; Content-Type must be exactly image/png (case-insens.) else 415 {"error":"Content-Type must be image/png"}; >10 MiB → 413 {"error":"Payload too large"}; writes <sessionDir>/<eventId>.png; 200 {"ok":true,"path":"<abs path>"}; 500 {"error":"Session dir unavailable"} / {"error":"Write failed: …"} / {"error":"Upload failed"}
GET /status?token=	401 {"error":"Unauthorized"}	200 {status:'ok', port, connectedClients, pendingEvents:[…summaries], agentPolling:boolean, activeSessions:[…client summaries], manualEdits:{totalCount, perPage, lastActivity, error?}}
GET /health	none	{status:'ok', port, mode:'variant', hasProjectContext:boolean, connectedClients}
GET /design-system.json?token=	401 Unauthorized	404 {present:false} if neither DESIGN.md nor .impeccable/design.json; else {present:true, hasMd, hasSidecar, mdNewerThanJson, parsed?, parseError?, sidecar?, sidecarError?} (parsed = parseDesignMd output; sidecarError = 'Failed to parse .impeccable/design.json: '+msg)
GET /design-system/raw?token=	401	200 text/markdown; charset=utf-8 DESIGN.md verbatim; 404 Not found
GET /source?token=&path=	401	path required and no .. else 400 Bad path; resolved must be inside cwd (relative check, not root itself) else 403 Forbidden; 404 File not found; 200 text/html; charset=utf-8 raw file. Used by browser to read source, svelte manifest and params.json.
GET /events?token= (SSE)	401	headers text/event-stream, Cache-Control: no-cache, Connection: keep-alive; first frame data: {"type":"connected","hasProjectContext":b,"agentPolling":b,"activeSessions":[…]}\n\n; : keepalive\n\n every 30s; on connect: cancels exit timer and removes queued anonymous exit events. On close: if 0 clients, after 8000 ms (still 0) enqueue {type:'exit'}.
POST /events	body JSON token mismatch → 401 {"error":"Unauthorized"}; invalid JSON → 400 {"error":"Invalid JSON"}	see 6.1
GET /stop?token=	401	200 text stopping, then shutdown
GET /poll?token=&timeout=&leaseMs=&types=	401 {"error":"Unauthorized"}	see 6.3
POST /poll	401 / 400 Invalid JSON	see 6.4
POST /manual-edit-stash (token in body)	401	see 10
GET /manual-edit-stash?token=&pageUrl=	401	see 10
POST /manual-edit-commit?token=&pageUrl=&async=&repair=	401	see 10
POST /manual-edit-repair-decision (token body or query)	401	see 10
POST /manual-edit-discard?token=&pageUrl=	401	see 10
POST /manual-edit		410 {"error":"/manual-edit is removed; use /manual-edit-stash and /manual-edit-commit for staged copy edits."}
anything else		404 Not found

Pending-event summary in /status.pendingEvents[]: {id, type, leased:boolean, leaseUntil:number|null} plus for manual_edit_apply: pageUrl, chunk, repair, evidencePath, agentAction, manualApplySummary:{pageUrl, chunk, entryCount, opCount, files[]}.

Client session summary (activeSessions[] in /status and SSE connected): {id, phase, pageUrl, sourceFile, previewFile, previewMode, expectedVariants, arrivedVariants, visibleVariant, checkpointRevision, browserCheckpointRevision, publicationCheckpointRevision, paramValues, generationPhase, generationCompletedAt, generationCanceled, cancelReason, mountedVariants:[], mountFailures:[], renderState}.

Server startup order: enterLiveRoot; help/stop/--background branches; refuse if existing server pid alive (stderr Live server already running on port P (pid N). + Stop it first with: node live-server.mjs stop, exit 1) else unlink stale record; token; session store; manualApply.rollbackTransaction({reason:'manual_edit_server_start_recovered_abandoned_transaction'}); apply legacy deferred svelte accepts; sweep inactive svelte component sessions (log [impeccable] swept orphaned Svelte component sessions: {…}); sweep accept receipts >14d ([impeccable] removed N accept receipt(s) older than 14 days); restore pendingEvent of every active session into the queue; prune stale evidence; port; annotation dir; listen; write server.json; stdout:

Impeccable live server running on http://localhost:PORT
Token: TOKEN

Script: http://localhost:PORT/live.js
Inject: managed by live-inject.mjs; Astro source tags use is:inline automatically.
Stop:   node live-server.mjs stop

Shutdown (SIGINT/SIGTERM//stop): remove all svelte component sessions, remove server.json, clear lease timer, rm annotation session dir, end SSE clients, resolve every parked poll with {type:'exit'}, close, exit 0.

6. Event protocol

6.1 Browser → server: POST /events

Body JSON {token, type, …}. Order of checks: JSON parse → token → type==='manual_edits' → 400 {"error":"manual_edits must POST to /manual-edit-stash, not /events"}; type==='manual_edit_apply' → 400 {"error":"manual_edit_apply is disabled; use /manual-edit-stash then /manual-edit-commit"}; validateEvent (below) → 400 {"error":"<message>"}; agent_phase → recorded+broadcast, 200 {"ok":true}; if msg.id and type ∉ {generate,steer} and store has no journal for id → 404 {"error":"unknown_session","id"}; compute missed-completion (see below); append to journal (500 {"error":"session_store_append_failed","message"} on throw); accept|discard → retire pending generate events for id; record generation checkpoint progress; broadcast missed done if any; exit → remove svelte component sessions; discard with orphaned:true → append {type:'discarded', id, orphaned:true} and do not queue; queue the event unless type is checkpoint, variant_mounted, or orphaned discard; 200 {"ok":true}.

validateEvent(msg) (messages verbatim; ID = /^[0-9a-f]{8}$/, VARIANT_ID = /^[0-9]{1,3}$/):

• missing/invalid → Missing or invalid message; unknown type → Unknown event type: <t>.
• generate: id → generate: missing or malformed id; count integer 1..8 → generate: count must be 1-8. If mode==='insert': insert object required (generate: insert mode requires insert object), insert.position ∈ before|after, insert.anchor object with tagName or outerHTML or non-empty classes[] (generate: insert.anchor needs tagName, classes, or outerHTML), placeholder object with finite width,height (generate: insert mode requires placeholder dimensions, generate: placeholder width and height must be numbers), and canCreateInsert (non-empty freeformPrompt OR comments[] non-empty OR any stroke with ≥2 points) else generate: insert requires freeformPrompt or annotations. Else replace: action ∈ VISUAL_ACTIONS (generate: invalid action), element.outerHTML required (generate: missing element context). Both: screenshotPath string, comments array, strokes array if present.
• accept: id; variantId string of 1-3 digits (accept: missing or malformed variantId); paramValues if present must be a plain object.
• discard: id.
• checkpoint: id; revision non-negative int; paramValues object if present.
• agent_phase: id; phase ∈ AGENT_PHASES (agent_phase: unknown phase X (expected one of picked_up, scaffolding, source_ready, scaffold_fallback, generation_ready, first_reviewable, second_reviewable, all_variants_ready)); durationMs finite ≥0 if present.
• variant_mounted: id; variant int 1..999; url string ≤2000 if present.
• variant_mount_failed: id; variant 1..999; url non-empty ≤2000 required; error non-empty ≤1000 required.
• exit: always valid (no id).
• prefetch: pageUrl string required.
• manual_edits (used by /manual-edit-stash): id; pageUrl string; element object; ops array 1..100; each op: ref string, tag string, originalText string, newText string unless deleted===true; newText non-blank (…: newText cannot be empty), no < { } \`` chars (…: newText cannot contain < { (plain text only; ask the AI to insert markup)`).
• steer: id; message non-empty ≤4000; pageUrl string if present.
• carbonize_cleanup: id; sessionId id; file string; variantId digits.

VISUAL_ACTIONS (order): impeccable, bolder, quieter, distill, polish, typeset, colorize, layout, adapt, animate, delight, overdrive (labels Freeform, Bolder, …).

Browser payloads (exact fields):

• generate (replace): {type:'generate', id, action, freeformPrompt?, count, pageUrl: location.pathname, element: extractContext(el), comments?:[{x,y,text}], strokes?:[{points:[[x,y],…]}], clientSentAt, screenshotPath?}. extractContext = {tagName(lower), id|null, classes:[…], textContent (≤500), outerHTML (sanitized ≤10000), computedStyles:{'font-family','font-size','font-weight','line-height','color','background','background-color','padding','margin','display','position','gap','border-radius','box-shadow'}, cssCustomProperties:{--x:v}, parentContext:'<tag id="" class="">'|null, boundingRect:{width,height}}. Without annotations the event is POSTed before screenshot capture; with annotations the PNG is first POST /annotationed and screenshotPath (abs path returned) is added.
• generate (insert): {type:'generate', mode:'insert', id, count, pageUrl, insert:{position, anchor: extractContext(anchor)}, placeholder:{width,height}, freeformPrompt?, comments?, strokes?, clientSentAt}.
• checkpoint: {type:'checkpoint', id, revision (monotone per browser, persisted in localStorage), revisionDomain:'browser', owner:<8-hex browser owner id>, phase: state.toLowerCase(), reason, pageUrl, expectedVariants, arrivedVariants, visibleVariant, sourceFile?, previewFile?, previewMode?, paramValues:{…}}. Steer checkpoints: {type:'checkpoint', id, revision, revisionDomain:'browser', owner, phase:'steer', reason, pageUrl, …extra}. Reasons: generate_started, variants_progress, variants_ready, browser_resumed, browser_resumed_deferred_wrapper, browser_resumed_svelte_component, param_changed, variant_anchor_missing, component_preview_anchor_missing, steer_input_focused, steer_submitted, steer_send_failed, steer_done, steer_error. Only variants_progress|variants_ready count as publication progress.
• accept: {type:'accept', id, variantId: String(n), pageUrl, clientSentAt, paramValues?}.
• discard: {type:'discard', id}; orphaned: {type:'discard', id, orphaned:true}.
• variant_mounted: {type, id, variant, url?}; variant_mount_failed: {type, id, variant, url, error} (deduped per session|variant|url|message).
• steer: {type:'steer', id, message, pageUrl: location.href}.
• prefetch: {type:'prefetch', pageUrl} (currently disabled in browser: PREFETCH_ENABLED=false).
• exit: {type:'exit'} (exit button).
• Browser-side gate: generate/steer POSTs go first; other events wait behind the last creation promise. On unknown_session for a checkpoint of the current session the browser abandons local state.

Missed-completion redelivery: on a checkpoint with phase==='generating' and (arrivedVariants<=0 or < expectedVariants), if snapshot has generationCompletedAt, not generationCanceled, phase not in GENERATION_FENCED_PHASES (accept_requested, discard_requested, carbonize_required, completed, discarded), and has sourceFile|previewFile → broadcast {type:'done', id, file, sourceFile?, previewFile?, previewMode?, redelivered:true}.

Generation checkpoint recording (only for reasons variants_progress|variants_ready, arrived>0, expected>0, session not canceled): broadcast {type:'variant_progress', id, file: previewFile||file, sourceFile, previewFile, previewMode ('source' default), arrivedVariants, expectedVariants, publicationKind: event.publicationKind||'variants'} and record agent phases first_reviewable (once), second_reviewable (arrived≥2 && expected≥3, once), all_variants_ready (arrived≥expected, once), each {arrivedVariants, expectedVariants, checkpointReason, at}.

6.2 Server → browser (SSE data: JSON frames)

connected, agent_polling {connected}, agent_phase {id, phase, at, durationMs?, previewMode?, owner?}, variant_progress {…}, done/steer_done/complete/agent_done/discarded/error/discard/any reply type: {type: msg.type||'done', id, message, file, sourceFile, previewFile, previewMode, data} (forwarded from POST /poll), redelivered done, manual-edit activity entries {seq, type:'manual_edit_*', ts, …details}.

Manual-edit activity types broadcast: manual_edit_stashed, manual_edit_discarded, manual_edit_commit_started, manual_edit_apply_dispatched, manual_edit_apply_reply_received, manual_edit_apply_reply_invalid, manual_edit_apply_stale_reply_rejected, manual_edit_apply_timeout, manual_edit_repair_needs_decision, manual_edit_repair_rollback_done, manual_edit_commit_done, manual_edit_commit_failed, manual_edit_transaction_rolled_back, manual_edit_poll_reply_unknown.

Browser handling of done: for svelte-component sessions → re-read manifest via /source and (re)mount; else if arrivedVariants>=expected → CYCLING; else if msg.file and state GENERATING → after 750 ms injectVariantsFromSource(file) (fetch /source?path=, parse, extract wrapper between <!-- impeccable-variants-start ID --> … <!-- impeccable-variants-end ID --> and inject); else toast after 2 s.

6.3 Agent poll: GET /poll

Query: token, timeout (ms, default 600000), leaseMs (default 30000; live-poll.mjs sends 600000), types (comma list filter). Records lastPollAt. If an available (unleased or lease-expired, type-allowed) event exists: lease it (see below) and answer 200 with the event JSON. Else park; on timeout answer {"type":"timeout"}; on shutdown {"type":"exit"}. Selection order: priority 0 accept|discard|exit, 1 manual_edit_apply|steer|carbonize_cleanup, 2 generate, 3 others; then by seq. Queue dedupes by (id,type) (mount failures also by variant).

Lease: leaseUntil = now+leaseMs; for generate events not yet scaffoldAttempted: record agent phases picked_up, scaffolding, run preflight (spawns live-wrap.mjs/live-insert.mjs --defer-source-write … with 15 s timeout, see 7), then event gets scaffoldAttempted:true, scaffoldDurationMs, scaffold:{…helper JSON} or scaffoldError:'<last stderr line or message ≤500>' (insufficient_locator when neither id nor classes), phase source_ready/scaffold_fallback {durationMs, previewMode}; re-stamp lease; add generationReadyAt and phase generation_ready; broadcast agent_polling. Events without an id (exit) are removed from the queue when leased.

Delivered event = the stored browser event (minus nothing; token is stripped only in the journal's pendingEvent) plus server additions. live-poll.mjs adds _instructions (see per-script). Types needing an agent reply: generate, steer, manual_edit_apply, carbonize_cleanup, variant_mount_failed.

6.4 Agent reply: POST /poll

Body {token, id, type, message?, file?, data?, sourceEventType?} (built by buildPollReplyPayload, all keys present, undefined ones dropped by JSON). Processing:

1. If id has an in-flight manual-apply deferred: validate data (see 10.4); invalid → 400 {error:'invalid_manual_apply_result', reason, hint:'Use live-poll.mjs --reply <id> done --data \'{"status":"done","appliedEntryIds":["ENTRY_ID"],"failed":[],"files":["src/page.html"],"notes":[]}\'', …}; valid → resolve, ack event, 200 {"ok":true}.
2. If id is a timed-out apply id → roll back files → 409 {error:'stale_manual_edit_apply_reply', rolledBackFiles, rollbackFailures}.
3. sourceEventType = given or inferred: discarded|discard→discard; complete→carbonize_cleanup if pending else accept if pending else generate; steer_done→steer; agent_done|done→variant_mount_failed if that is pending and no generate, else generate; error→ type of the leased entry for id, else generate; other→undefined (matches any).
4. type==='retry' → release lease; 200 {"ok":true,"released":true} or 404 {error:'unknown_poll_retry_id', id} / 400 {error:'missing_poll_retry_id'}.
5. steer_done for a pending steer without file and without non-blank message → 400 {error:'steer_done_requires_file_or_message', hint:'Reply with --file after writing source, or include a message explaining an intentional no-op.'}.
6. Acknowledge (remove) the pending event. If none and no known session for id → 404 {error:'unknown_poll_reply_id', id} / 400 {error:'missing_poll_reply_id'} (and activity manual_edit_poll_reply_unknown).
7. file metadata: if file ends with manifest.json and path contains .impeccable/live/previews/, node_modules/.impeccable-live/, src/lib/impeccable/ or /.impeccable-live/, and inside cwd, and manifest previewMode==='svelte-component' with sourceFile → {file: sourceFile, sourceFile, previewFile: <given>, previewMode}.
8. Svelte publish (previewMode==='svelte-component' and type done or absent): compile-check every v\d+.svelte with the app's svelte/compiler [NODE-DEP] (compile(src,{generate:false})); failure → 422 {error:'variant_compile_failed', id, failures:[{file:'<componentDir>/vN.svelte', line, column, message(≤300)}], _instructions:'The publish was NOT delivered: …then send the same --reply done again.'} and nothing else happens; else bumpSvelteComponentPreviewRevision (see 8).
9. Journal (unless session already completed/discarded): {type: steer_done|discarded|complete|agent_error|agent_done (mapping: steer_done→steer_done, discard/discarded→discarded, complete→complete, error→agent_error, else agent_done), id, file, sourceFile, previewFile, previewMode, message, sourceEventType: <acknowledged event type>, carbonize: data.carbonize===true}.
10. Flush polls; broadcast {type: msg.type||'done', id, message, file, sourceFile, previewFile, previewMode, data}; 200 {"ok":true}.

Reply vocabulary the agent uses: done (generate/mount-failed/manual-apply with --data), steer_done, error "<msg>", complete, discarded, agent_done (poll script for carbonize accepts), retry.

6.5 Session store (journal + snapshot)

Journal line: {"seq":N,"id":"…","type":"…","ts":"ISO","event":{…full event minus nothing… (pendingEvent copies strip token)}}. Snapshot file = snapshot + "__journalBytes", "__nextSeq"; trusted only if __journalBytes equals current journal size and id matches. getSnapshot(id,{includeCompleted}) returns null for completed|discarded unless includeCompleted. listActiveSessions() = all *.jsonl ids in legacy+primary dirs, sorted, non-completed. Session ids must match /^[A-Za-z0-9_-]{1,128}$/ (invalid session id: X thrown).

Base snapshot: {id, phase:'new', pageUrl:null, sourceFile:null, previewFile:null, previewMode:null, expectedVariants:0, arrivedVariants:0, visibleVariant:null, paramValues:{}, pendingEventSeq:null, pendingEvent:null, deliveryLease:null, checkpointRevision:0, browserCheckpointRevision:0, publicationCheckpointRevision:0, activeOwner:null, sourceMarkers:{}, fallbackMode:null, generationPhase:null, generationCompletedAt:null, generationTimings:{}, variantPlan:null, generationCanceled:false, generationCanceledAt:null, cancelReason:null, annotationArtifacts:[], mountedVariants:[], mountFailures:[], renderState:null, diagnostics:[], updatedAt:null} (+ detectorWaivers, message when set).

Reducer per event type (updatedAt = entry.ts):

• generate: phase generate_requested; pageUrl; expectedVariants=count; pendingEventSeq=seq; pendingEvent=event; variantPlan=null; mounted/mountFailures cleared, renderState null; screenshotPath → push {type:'screenshot', path} artifact.
• variant_plan (unless canceled/fenced): variantPlan=plan. detector_waivers: append waivers.
• agent_phase: generationPhase=phase; generationTimings[phase]={at, durationMs}.
• variants_ready|agent_done: if canceled/fenced and not (agent_done carbonize in accept_requested) → diagnostic late_generation_event_ignored; else phase = carbonize_required if carbonize else variants_ready; generationCompletedAt; sourceFile=event.sourceFile??event.file; previewFile/previewMode; arrivedVariants = event.arrivedVariants ?? expected; clear pending; carbonize → diagnostic carbonize_cleanup_required; renderState derived (mounted if any mounted, failed if failures only, pending if completed, else null).
• variant_mounted: add variant (sorted); variant_mount_failed: push {variant,url,error,at} keep last 5; set pendingEvent if none.
• checkpoint: fenced → diagnostic checkpoint_after_terminal_ignored; domain = publication if revisionDomain==='publication' or (reason==='variants_progress' && no owner) else browser; if revision >= current → phase, revision field (browser also mirrors checkpointRevision, activeOwner), arrivedVariants, visibleVariant (browser), sourceFile/previewFile/previewMode, paramValues (browser); else diagnostic stale_checkpoint_ignored.
• accept|accept_intent: phase accept_requested, generationCanceled=true, cancelReason accept, visibleVariant=Number(variantId), paramValues, pending=event.
• manual_edit_apply: phase manual_edit_apply_requested, pending. steer: steer_requested, pending. carbonize_cleanup: carbonize_cleanup_requested, sourceFile=file, pending.
• steer_done: phase steer_done, sourceFile/previewFile/previewMode/message, clear pending.
• discard: discard_requested, canceled, cancelReason discard, pending. discarded: phase discarded, clear pending. complete: completed, sourceFile etc, clear pending.
• agent_error: if canceled and sourceEventType generate → late_generation_event_ignored; else phase agent_error, clear pending, diagnostic {error:'agent_error', message}.
• unknown → diagnostic unknown_event_type.

7. Wrap / scaffold contract (source-preview path)

Wrapper block for HTML-comment files (indent = picked element's leading whitespace; original reindented under indent+' ' preserving relative depth):

<indent><!-- impeccable-variants-start ID -->
<indent><div data-impeccable-variants="ID" data-impeccable-variant-count="N" style="display: contents">
<indent>  <!-- Original -->
<indent>  <div data-impeccable-variant="original">
<indent>    …original lines…
<indent>  </div>
<indent>  <!-- Variants: insert below this line -->
<indent></div>
<indent><!-- impeccable-variants-end ID -->

JSX files (.jsx/.tsx): outer div first, comments inside, style={{ display: "contents" }}, comments {/* … */}:

<div data-impeccable-variants="ID" data-impeccable-variant-count="N" style={{ display: "contents" }}>
  {/* impeccable-variants-start ID */}
  {/* Original */}
  <div data-impeccable-variant="original">
    …
  </div>
  {/* Variants: insert below this line */}
  {/* impeccable-variants-end ID */}
</div>

insertLine (1-indexed) = startLine + 6 + (originalLineCount-1) + 1 = the line after the "Variants: insert below this line" marker.

Insert-mode wrapper (live-insert.mjs), no original: HTML: <!-- start -->, <div data-impeccable-variants="ID" data-impeccable-mode="insert" data-impeccable-variant-count="N" style="display: contents">, <!-- Variants: insert below this line -->, </div>, <!-- end -->; JSX: div, start, marker, end, </div>. insertLine = spliceIndex + 3 + 1 (1-indexed). Splice index = anchor startLine (before) or endLine+1 (after), 0-indexed.

Agent-authored variant block (what the fake agent and live.md prescribe), inserted at the marker:

<style data-impeccable-css="ID">            (JSX: <style …>{` … `}</style>; Astro: <style is:inline data-impeccable-css="ID">)
  @scope ([data-impeccable-variant="1"]) { :scope > h1 { … var(--p-lightness, 0.5) … } }
  @scope ([data-impeccable-variant="2"]) { :scope[data-p-face="serif"] > h1 { … } }
  … (Astro styleMode: `[data-impeccable-variant="N"] > .x { }` prefixes, no @scope)
</style>
<div data-impeccable-variant="1" data-impeccable-params='[{"id":"lightness","kind":"range","min":0.3,"max":0.7,"step":0.05,"default":0.5,"label":"Lightness"}]'>
  <h1 class="hero-title">…</h1>          exactly ONE top-level element, same tag as original
</div>
<div data-impeccable-variant="2" style="display: none" data-impeccable-params='[{"id":"face","kind":"steps","default":"sans","label":"Face","options":[{"value":"sans","label":"Sans"},…]}]'>…</div>
<div data-impeccable-variant="3" style="display: none" data-impeccable-params='[{"id":"italic","kind":"toggle","default":false,"label":"Italic"}]'>…</div>

Param kinds: range {id,kind:'range',min,max,step,default,label} → CSS var --p-<id>; steps {id,kind:'steps',default,label,options:[{value,label}]} → attribute data-p-<id>="<value>"; toggle {id,kind:'toggle',default:boolean,label} → --p-<id>: 1|0 and attribute data-p-<id>="on" present only when on. Browser drives range/toggle vars through an injected stylesheet (#impeccable-live-variant-state), and hides non-visible variants there; values reset to declared defaults on variant switch. Budget/authoring rules (0-4 per variant, hard cap 4) are prose in live.md section 7. Optional readiness sentinel --impeccable-variant-ready (stripped on accept).

cssAuthoring object returned by wrap/insert:

• scoped: {mode:'scoped', styleTag:'<style data-impeccable-css="SESSION_ID">', strategy:'scope-rule', rulePattern:'@scope ([data-impeccable-variant="N"]) { :scope > .variant-class { ... } }', selectorExamples:[…per N], requirements:[3 strings], forbidden:[2 strings]}
• astro-global-prefixed: {mode, styleTag:'<style is:inline data-impeccable-css="SESSION_ID">', strategy:'global-prefixed', rulePattern:'[data-impeccable-variant="N"] > .variant-class { ... }', selectorExamples, requirements:[4], forbidden:[3]}, plus cssSelectorPrefixExamples:['[data-impeccable-variant="1"]',…] (empty for scoped).
• svelte-component: {mode:'svelte-component', styleTag:null, strategy:'component-style-block', rulePattern:'.semantic-class { ... }', selectorExamples:['.expense-row { padding: 22px; }' ×N], requirements:[7], forbidden:[3], paramsFile:'params.json'}.

Source search (live/source-search.mjs): dirs in order src, app, pages, components, public, views, templates, lib, .; skip node_modules, .git, .impeccable (accept also skips dist, build); depth ≤5; realpath cycle guard; files before dirs; extensions = LIVE_TEMPLATE_EXTENSIONS (.html,.jsx,.tsx,.vue,.svelte,.astro,.ex,.heex,.eex) + .impeccable/config.json/config.local.json detector.extensions; suffix match. Wrap additionally rejects generated files (isGeneratedFile: git check-ignore --quiet exit 0 [spawns git] or first 300 bytes match /@generated\b/i, /\bGENERATED\s+FILE\b/, /\bAUTO-?GENERATED\b/i, /\bDO\s+NOT\s+EDIT\b/i).

Search queries built from flags in order: id="<id>"; if multiple classes: class="<joined>", className="<joined>", then each class longest-first; single class: the class; <tag class="<first> and <tag className="<first> when tag+classes; raw --query. Element location: first line containing query (skipping lines starting with <!--,{/*,// or containing data-impeccable-variant), resolve opener (/<([A-Za-z][A-Za-z0-9]*)(?=[\s/>]|$)/ on the line, else walk back ≤10 lines; a differently-named opener aborts), closer by depth counting (<tag, <tag …/>, </tag>), fallback min(start+50, last). With --text (≥8 normalized chars): all candidates, filter by text (spaced or compact normalization of tag/JSX-stripped body).

8. Svelte component preview (live/svelte-component.mjs, live/svelte-ast.mjs)

Used when target ext is .svelte and env IMPECCABLE_LIVE_SVELTE_COMPONENT is not 0|false|no. Requires the app's svelte/compiler ≥5 resolvable via createRequire(<appRoot>/package.json) [NODE-DEP: svelte compiler from user app]; otherwise fallback:'source-preview', reason svelte 5 compiler not resolvable from the app root.

Scaffold: parse selected markup with parse(src,{modern:true}); refuse ({ok:false, reason}) on: script tags (selected block contains a script tag), component tags (component tag <X> requires source-preview mode), RenderTag, AwaitBlock, svelte:head/window/document/body, inline <script> element, bind:/use:/animate/transition directives, spread attributes, dynamic style: directives, mixed loop+outer expressions, unsupported each keys, non-hydratable per-item content. Free expressions become props: kinds text, raw ({@html}), condition ({#if} test, with probe:{tag,classes} or {className} for class: directives), collection ({#each} expr, with item:{rootTag, rootClasses, textSlots:[{key,expr}], attrSlots:[{key,expr,attr,tag,classes}], staticTexts, nestedUnsupported, keyField?}), handler (on* attrs). Prop names derived from the expression tail (reserved words suffixed Value, dupes numbered). Contract entry: {prop, expr, kind, placeholder:'{expr}', item?, probe?}.

Files written under node_modules/.impeccable-live/:

• __runtime.js: export { mount, unmount } from 'svelte';\n
• __probe.js: export const impeccableLivePreviewProbe = true;\n
• <id>/manifest.json:

{ "id", "previewMode": "svelte-component", "contractVersion": 2, "sourceFile": "src/routes/+page.svelte", "sourceStartLine", "sourceEndLine", "count", "propContract": [...], "originalMarkup", "seededSelectors": [...], "componentDir": "node_modules/.impeccable-live/<id>", "componentDirAbs", "runtimeModule": "/node_modules/.impeccable-live/__runtime.js", "runtimeModuleAbs", "probeModule": "/node_modules/.impeccable-live/__probe.js", "probeModuleAbs" }

insert variant: {id, mode:'insert', previewMode, sourceFile, insertLine, position, anchorStartLine, anchorEndLine, originalMarkup, anchorMarkup, count, propContract:[], componentDir, componentDirAbs, runtimeModule…}. After publish: revision, revisionDir:'<componentDir>/r<N>', revisionDirAbs. Agents may set arrivedVariants (fake agent does).

• <id>/v<N>.svelte stub (only if absent): props script <script>\n /** @typedef {{\n <prop>?: <type>;\n }} Props */\n let { <prop> = <default>, … } = $props();\n</script>\n (types text/raw→string, condition→boolean, collection→Array<Record<string, unknown>>, handler→() => void; defaults '', false, [], () => {}; empty contract → /** @typedef {Record<string, never>} Props */\n let {} = $props();), then <!-- Props: name (kind) <- {expr}, … --> comment, prop-substituted markup, then ONE <style> seeded with route rules whose class or tag selectors match the selection (comment text explains "exactly one top-level style element").
• <id>/params.json (agent-authored) {"1":[…params],"2":[…]}.

Revision dirs: on every done reply for a component session the server copies all files (except manifest.json) from <id>/ into <id>/r<N>/ (N = manifest.revision+1), deletes other r* dirs, and stamps revision, revisionDir, revisionDirAbs in the manifest. Browser imports /<revisionDir>/v<N>.svelte?t=<now> (candidates: dev-server base + rel, /+rel, @fs/<abs> under base and root), reads params.json from revisionDir via /source, mounts with the app's mount(Component,{target, props, intro:false}) from __runtime.js. variant_mounted/variant_mount_failed reported per mount.

Sweeps: shutdown/exit removes whole node_modules/.impeccable-live and legacy .impeccable/live/previews; startup removes session dirs (not __*) not in active snapshot list, and the root when nothing kept.

9. Accept pipeline (live-accept.mjs, live/accept-css.mjs, live/accept-verify.mjs)

Order in live-accept.mjs: receipt check → find impeccable-variants-start <id> in a template file (skip node_modules/.git/.impeccable/dist/build) → else find svelte manifest → neither: stdout {"handled":false,"error":"Session markers not found for id: <id>"} exit 0.

Svelte-component accept (under source lock accept:<id> on the route file, wait 1000 ms): read v<N>.svelte ({handled:false, error:'Variant N not found', …}), split script/markup/style; insert manifests → inlineSvelteComponentInsertAccept (empty → Accepted Svelte insert variant is empty; data-impeccable-* attrs → Accepted Svelte insert variant contains preview-only data-impeccable attributes; splice markup at insertLine reindented, bake+merge CSS). Replace: merge original root's attributes onto variant root (class union, missing attrs appended); restore props→expressions via AST (contract v2) or textual swap (v1); replace source lines [sourceStartLine, sourceEndLine] with reindented markup; collect pre-existing unused selectors (compiler warnings css_unused_selector); read params.json[variant]; sanitize any data-impeccable-variant/@scope/:scope selectors (defensive); bakeParamValues (see below); mergeCssIntoSvelteSource (reconcile into last <style> block, or create one); remove seeded selectors not re-declared and not used by markup outside the replaced region (superseded); pruneUnusedSelectors (up to 3 compiler passes); postcondition: any pre-accept selector missing that wasn't pruned/superseded → {handled:false, mode:'error', error:'CSS reconciliation would lose selectors from the existing style block: … . Source not modified; accept the variant manually.'}; write; remove session dir; verifyAcceptedSource. Result {handled:true, css:{replaced, appended, pruned:[], superseded:[]}, verify:{clean, findings}, file, sourceFile, previewMode:'svelte-component', componentDir, carbonize:false}. Discard: remove component dir → {handled:true, file, carbonize:false, previewMode, componentDir}.

HTML/JSX accept: generated file → {handled:false, mode:'fallback', file, hint:'Session is in a generated file. Persist the accepted variant in source; do not rely on this script.'} exit 0. Legacy data-impeccable-preview="source-shadow" → {handled:false, error:'source_shadow_preview_deprecated', hint}. Under lock: locate marker block (Markers not found), for JSX expand replace range to the outer wrapper <div> … matching </div> (multi-line-aware depth tracking, <style> bodies stripped for matching); extract chosen variant inner (Variant N not found), original inner, CSS (<style data-impeccable-css="ID"> body; JSX template-literal {\…`}wrap stripped; self-closing → none).needsCarbonize = !!css || variantText.includes('data-impeccable-variant')`. Replacement (indent = wrapper line's indent):

• no CSS: just deindented variant lines.
• HTML with CSS:

<indent><!-- impeccable-carbonize-start ID -->
<indent><style data-impeccable-css="ID">
<indent>…css lines (trimStart)…
<indent></style>
<indent><!-- impeccable-param-values ID: {"lightness":0.7} -->     (only when paramValues non-empty)
<indent><!-- impeccable-carbonize-end ID -->
<indent><div data-impeccable-variant="N" style="display: contents">
<indent>  …variant lines…
<indent></div>

• JSX: everything above wrapped in <indent><div data-impeccable-carbonize="ID" style={{ display: "contents" }}> … </div> with body indented 2 more, <style …>{\`` / `}</style>, {/* … */}comments,style={{ display: 'contents' }}on the variant div. Result{handled:true, file: rel, carbonize:boolean, todo?:'REQUIRED before next poll: carbonize cleanup in . See reference/live.md "Required after accept".'}. Discard: replace range with deindented original → {handled:true, file, carbonize:false}. After accept with --page-url, buffered manual-edit ops whose original/new text appears as an exact text segment in the replaced original block are dropped from pending-manual-edits.json`.

Receipt: on any handled!==false result write accept-receipts/<id>.json = {id, operation:'accept'|'discard', variantId:'N'|null, result, completedAt} (tmp+rename). Re-run with same op/variant → prior result + {handled:true, alreadyApplied:true}; different → {handled:false, mode:'error', error:'accept_receipt_conflict', priorOperation, priorVariantId}.

Errors: thrown (e.g. source_locked from lock contention) → {handled:false, mode:'error', error:'<msg>', file}; preview-path {handled:false, error} without mode gets mode:'error' added.

CSS helpers (pure, accept-css.mjs): parseStylesheet (rule/at/comment nodes; media, supports, layer, container, scope recurse), serializeNodes (sel {body} one-line if <60 chars single decl, else multi-line 2-space), normalizeSelector (collapse ws, strip ws around >+~,), reconcileCss(existing, incoming) → replace same-selector bodies (first replaces, later same-selector rules extend), new rules inserted before the first at-block, {css, replaced, appended}; substituteParamVar(css,id,value) paren-aware var(--p-id[,fallback]); stripParamSelector(sel,id,kind,chosen): steps keep only [data-p-id="chosen"]/bare form; toggle keeps bare [data-p-id] or ="on" only when on; bakeParamValues(css, params, values): undeclared values bake as range; toggle var value 1|0; drops rules whose every selector died or body empty; strips --impeccable-variant-ready declaration; pruneUnusedSelectors(source, compile, {skipSelectors}), collectUnusedSelectors, collectAllSelectors.

verifyAcceptedSource(text) findings (marker→why): impeccable-variants-start|end (variant wrapper comment left in source), impeccable-carbonize-start|end (carbonize block not rewritten into permanent form), impeccable-param-values (param-values comment not baked and removed), data-impeccable- (live-mode plumbing attribute left on markup), /\bdata-p-[A-Za-z0-9_-]+\s*(?:=|\])/ label data-p-* (preview parameter attribute left on markup), /var\(\s*--p-[A-Za-z0-9_-]+\s*[,)]/ label var(--p-*) (preview parameter variable not baked to a literal), --impeccable-variant-ready (preview readiness sentinel left in CSS). Each finding {marker, line (1-based), excerpt (≤120), why}.

Source lock: file <live>/locks/<sha256(abs)[:24]>.lock created wx with {owner, token, pid, at, file}; stale if unreadable and older than 60 s, or owner pid dead; retry every 5 ms until waitMs (accept: 1000) then throw source_locked (code:'SOURCE_LOCKED'); release only own token.

10. Manual edits (staged copy edits)

10.1 Buffer pending-manual-edits.json: {version:1, entries:[{id, pageUrl, element, ops:[op], stagedAt}]}; op = {ref, tag, elementId, classes[], originalText, newText, deleted?, leaf?, nearbyEditableTexts?, restore?, sourceHint?:{file,loc,line,column}, contextRef?, container?}. stageEntry merges by (pageUrl, ref): existing op keeps its originalText, takes new newText/deleted, entry.element updated; else appended to entry with same (pageUrl,id) or a new entry.

10.2 Routes:

• POST /manual-edit-stash body {token, id, pageUrl, element, ops} → validate as manual_edits; stage; 200 {ok:true, pendingCount:<page>, totalCount, perPage}; 500 {error:'stash_write_failed', message}; activity manual_edit_stashed {id,pageUrl,opCount,pendingCount,totalCount,hintedFileCount}.
• GET /manual-edit-stash?token&pageUrl → {count, totalCount, perPage, entries}.
• POST /manual-edit-commit?token&pageUrl&async=1&repair=1: repair=1 without transaction → 409 {error:'manual_edit_repair_transaction_missing'}; non-repair first rolls back an abandoned transaction; activity manual_edit_commit_started; async → 202 {status:'started', pendingCount, totalCount, perPage} immediately, else final result 200 {…commitResult, totalCount, perPage} or 500 {error:'manual_edit_commit_failed', message}. Provider selection: env IMPECCABLE_LIVE_COPY_AGENT (chat, auto (default), codex, claude, mock, 0|false|off|none); chat when explicit or auto with an agent polling within 60 s (chatAgentLikelyActive); timeout IMPECCABLE_LIVE_COPY_AGENT_TIMEOUT_MS (120000). Chat route pushes manual_edit_apply events (10.3). Subprocess route runs codex exec --cd <cwd> --dangerously-bypass-approvals-and-sandbox --ephemeral --output-last-message <file> -c model_reasoning_effort="<IMPECCABLE_LIVE_COPY_AGENT_EFFORT|low>" [--model X] - or claude --print --permission-mode bypassPermissions --output-format json [--model X] with the prompt on stdin [spawns external CLIs].
• POST /manual-edit-repair-decision {token?, pageUrl?, action:'rollback'} → rollback transaction, 200 {action, pageUrl, rollback, remainingCount, totalCount, perPage}; other action → 400 {error:'unsupported_manual_edit_repair_decision', action}.
• POST /manual-edit-discard?token&pageUrl → rollback txn, remove entries (page or all), cancel pending apply events (with file rollback), 200 {discarded:<opCount>, entries, canceledApplyEvents:[{id,pageUrl,entryCount,rolledBackFiles?,rollbackFailures?}], totalCount, perPage}.

10.3 manual_edit_apply event (server-minted id = 8 hex from uuid): {type:'manual_edit_apply', id, pageUrl, batch:<compacted evidence>, evidencePath:'<abs>/.impeccable/live/manual-edit-evidence/<id>.json', agentAction:{kind:'manual_edit_apply', required:'apply_source_edits_then_reply', replyCommand:"live-poll.mjs --reply <id> done --data '<json>'", warning:'Polling only leases this work item; it does not commit source edits.'}, schemaVersion:1, deadlineMs:120000 (IMPECCABLE_LIVE_APPLY_EVENT_SOFT_DEADLINE_MS), chunk?:{index,total,opCount,totalOpCount}, repair?:{attempt,maxAttempts,transactionId,reason,failures,files,pageUrl}}. Batches over IMPECCABLE_LIVE_MANUAL_EDIT_CHUNK_SIZE (default 3, 1..20) ops are split into chunks. Hard timeout IMPECCABLE_LIVE_APPLY_EVENT_HARD_TIMEOUT_MS (150000): event acked, id tombstoned (late reply → 409 stale + rollback), files snapshot rolled back. Compacted batch: {version, pageUrl, count, entries:[{id,pageUrl,stagedAt,element:{ref,tagName,id,classes,textContent≤240},ops:[{entryId,ref,contextRef,tag,elementId,classes,originalText,newText,deleted?,sourceHint,leaf,nearbyEditableTexts(≤4),container,contextHints(≤8)}]}], ops:[…flat with entryId], candidates?:[≤24 {entryId,ref,sourceHint,textMatches(≤8),objectKeyMatches(≤8),contextTextMatches(≤8),locatorMatches(≤6)} each match {file,line,column,reason,status}], context?:{bufferPath,totalEntries,totalOps,chunkIndex,chunkTotal,totalApplyOps}}.

10.4 Apply result (--data): {status:'done'|'partial'|'error', appliedEntryIds:string[], failed:[{entryId, reason, candidates?}], files:string[], notes:string[], message?}. Rejections (reason): missing_result_data, summary_result_not_allowed (has entries/ops), invalid_status, <key>_must_be_array, appliedEntryIds_must_contain_strings, files_must_contain_strings, notes_must_contain_strings, failed_must_contain_objects, failed_entryId_required, failed_reason_required, applied_entry_id_not_in_event, failed_entry_id_not_in_event, done_result_has_failed_entries, done_result_missing_applied_entry_ids, partial_result_has_no_entries, error_result_has_applied_entries.

10.5 Evidence (live-manual-edit-evidence.mjs buildManualEditEvidence({cwd,pageUrl})): {version:1, pageUrl, count, entries, ops:[flattened+contextHints], context:{cwd, bufferPath, totalEntries, totalOps}, candidates:[{entryId, ref, originalText, sourceHint:{…,status:'ok'|'text_not_found_near_hint'|'file_missing'|'generated'|'outside_cwd', relativeFile, excerpt:[{line,text}]}|null, textMatches, objectKeyMatches, locatorMatches, contextTextMatches}]}; empty buffer → {pageUrl, count:0, entries:[], ops:[], candidates:[]}. Search dirs src, app, pages, components, public, views, templates, site, lib, data + root files, depth ≤7, extensions .html,.jsx,.tsx,.vue,.svelte,.astro,.js,.mjs,.ts,.ex,.heex,.eex, skip node_modules,.git,.impeccable,.astro,.next,.nuxt,.svelte-kit,dist,build,out,coverage and generated files. Match {kind:'text'|'object_key'|'id'|'class'|'tag'|'context', file, line, needle, excerpt≤240}; limits 8 strong/4 weak text, 8 object-key, 4 locator, 8 context (2 per hint).

10.6 Commit (commitManualEdits) result: {applied:[{id,ref,originalText,newText}], failed:[{id, reason, candidates, failures?, checks?, files?}], files, cleared, count, pageUrl, notes?, warnings?, reason?, message?, rolledBackFiles?, rollbackFailures?, unreportedFiles?, repair?:{status:'repaired'|'needs_decision', attempts, maxAttempts, transactionId, failures?, files?}, needsManualDecision?, totalCount, perPage}. Reasons: manual_edit_buffer_invalid, no_pending_edits, conflicting_apply_result, unreported_source_changes, missing_applied_entry_ids, missing_touched_files, not_reported_applied, source_verification_failed, failed_entry_source_changed, rolled_back_due_to_failed_entry_source_changed, manual_edit_repair_needs_decision. Post-apply checks: leftover impeccable markers, JSON parse for .json, @babel/parser syntax for .jsx/.tsx/.ts [NODE-DEP optional; warning syntax_parser_unavailable if missing], node --check for .js/.mjs/.cjs, package.json scripts["impeccable:manual-edit-validate"] via shell. Repair attempts IMPECCABLE_LIVE_MANUAL_EDIT_REPAIR_ATTEMPTS (default 3, 1..10).

---

Per script

Conventions: every script's "run directly" guard is process.argv[1] ending with <name>.mjs (or <name>.mjs/). Unless noted, output is one JSON object on stdout; agent-facing helpers add _instructions only in live-poll.mjs. Exit code 0 unless stated.

live.mjs -> impeccable live (boot)

• Invoked from live.md step 1: "node {{scripts_path}}/live.mjs" or "node {{scripts_path}}/live.mjs --target <path>" (monorepo).
• Args: --target <p> / --target=<p> / -t <p> (strict: missing value → stderr --target requires a path value. exit 1); --help|-h prints usage, exit 0.
• Env: none directly (children inherit IMPECCABLE_LIVE_CONFIG).
• Flow & outputs (all pretty-printed JSON, 2 spaces, exit 0 unless noted):
  1. Workspace monorepo selection (resolveTargetSelection, only when no target, cwd is a workspace/monorepo root with discoverable children): {ok:false, error:'target_selection_required', targetPath:null, projectRoot, repoRoot, targetCandidates:[{name, path, targetExample, …context summary}], hint:'Ask the user which app Impeccable should use, then rerun live from that child app cwd. Use --target <path> only as a fallback or explicit path diagnostic.'}.
  2. resolveRoots selection → {ok:false, error:'target_selection_required', targetCandidates:[{name,path}], hint:'Several apps with a dev-server config exist. Ask the user which one to use, then rerun with --target <path into that app>.'}.
  3. Missing/unreadable/empty PRODUCT.md or DESIGN.md → {ok:false, error:'context_missing', missing:['PRODUCT.md'?,'DESIGN.md'?], nextCommand:'init'|'document', targetPath, projectRoot, repoRoot, productPath:rel|null, designPath:rel|null}.
  4. writeRootsManifest(roots).
  5. node live-inject.mjs --check (cwd appRoot, 15 s): not ok → print that JSON ({ok:false,error:'config_missing'|'config_invalid',path,message?} or {ok:false,error:'check_failed',raw}) + targetPath, projectRoot, repoRoot, exit 0.
  6. Reuse server if server.json pid alive, else node live-server.mjs --background; failure → {ok:false,error:'server_start_failed'} exit 1.
  7. node live-inject.mjs --port P --token T; not ok → {ok:false,error:'inject_failed',detail:<json|raw>,serverPort} exit 1.
  8. Drift scan: .html files under public, src, app, pages (skipping ignored dirs/dot-dirs) not in resolved files and not user-excluded → configDrift = {orphans:[≤20], orphanCount, hint:'N HTML file(s) exist but aren\'t in config.files. Consider adding them, or use a glob pattern like "public/**/*.html".'} else null.
  9. Success: {ok:true, serverPort, serverToken, pageFiles:[…resolved], liveConfigPath, configDrift, targetPath, projectRoot:appRoot, repoRoot, roots:{manifest}, hasProduct:true, product:<text>, productPath:rel, hasDesign:true, design:<text>, designPath:rel, hasSurfaceBrief, surfaceBrief:<text|null>, surfaceBriefPath:rel|null, _instructions:'Open the app URL that serves a pageFiles entry (never serverPort; that is the helper). Then start the poll loop per your harness policy in live.md and re-run node <scripts>/live-poll.mjs immediately after every event or reply. Every event carries _instructions: follow them; they are the authoritative next step with real ids and paths filled in. A poll that is running is a poll you are SERVICING: never announce you are waiting and idle your turn; stay on the exec session until it returns an event, and never end a turn while a poll is outstanding.'}. Surface brief resolved from .impeccable/surfaces under appRoot, contextRoot, repoRoot (first hit).
• Tests: tests/live-target-context.test.mjs, tests/live-roots.test.mjs, tests/live-e2e.test.mjs (session.liveBoot for appDir fixtures), tests/live-recovery-commands.test.mjs.

live-server.mjs -> impeccable live-server

• Invoked from live.md Cleanup (node {{scripts_path}}/live-server.mjs stop), by live.mjs (--background), by tests directly.
• Args: (none) foreground; --background (spawn detached child with same args minus flag, wait ≤10 s for a server.json whose pid ≠ own, print {"pid","port","token"} exit 0; else stderr Timed out waiting for live server to start. exit 1); --port=N; stop [--keep-inject] (fetch /stop?token= → stdout Stopped live server on port P. or No running live server found.; then unless keep-inject run live-inject.mjs --remove, print Removed live script tag from <file>. when a result line has removed:true, else Note: could not remove live script tag (<first line>); exit 0); --help.
• Env: IMPECCABLE_LIVE_DEBUG_EVENTS, IMPECCABLE_LIVE_COPY_AGENT*, IMPECCABLE_LIVE_APPLY_EVENT_{HARD_TIMEOUT,SOFT_DEADLINE}_MS, IMPECCABLE_LIVE_MANUAL_EDIT_CHUNK_SIZE, IMPECCABLE_LIVE_MANUAL_EDIT_REPAIR_ATTEMPTS.
• Behavior: shared model sections 3, 5, 6, 8, 10. Console lines: [live] lease failed for <id>: <msg>, [impeccable] Svelte component session cleanup failed: …, [impeccable] applied legacy deferred Svelte component accepts: {…}.
• Tests: tests/live-server.test.mjs (integration: /health, /status, events, poll, gitignore), tests/live-poll-stream.test.mjs, tests/live-e2e.test.mjs, tests/live-event-validation.test.mjs, tests/live-poll-lanes.test.mjs, tests/live-session-store.test.mjs, tests/live-generation-preflight.test.mjs.

live-poll.mjs -> impeccable poll

• Invoked from live.md poll loop; --reply forms quoted in _instructions (see instructions.mjs strings in 6.3/below).
• Args: --stream, --timeout=MS (one-shot total, default 600000), --types=A,B, --ack-timeout=MS (stream, default 600000), --reply <id> <status> [--file PATH] [--data JSON] [message], --help. --reply success (stdout, exit 0): one compact JSON line {ok:true,id,status,file? (only when --file was passed),_instructions:'Poll again now.'}. --reply errors (stderr, exit 1): Usage: node "<abs>/live-poll.mjs" --reply <id> <status> [--file path] [--data '<json>'] [message] + Missing event id after --reply. / The value after --reply must be the event id, not the status "done". Use --reply EVENT_ID done. / Missing reply status after event id "X".; --data must be valid JSON: <err>.
• Needs server.json; else stderr No running live server found. Start one with: node "<abs>/live.mjs" exit 1.
• One-shot: loops GET /poll?token&timeout=<slice ≤270000>&leaseMs=600000[&types] until an event or total deadline; prints one JSON line (console.log(JSON.stringify(event))) with _instructions added by instructionsForEvent (unless already present). For accept/discard: spawns node live-accept.mjs --id ID (--discard | --variant N) [--page-url U] [--param-values JSON] (30 s), sets event._acceptResult (parse failure/throw → {handled:false, mode:'error', error}), then POSTs completion {id, type: completionType, sourceEventType: event.type, message: _acceptResult.error, file: _acceptResult.file, data: {carbonize:true}?} where completionType = discard: discarded if handled else error; accept: agent_done if handled&carbonize, complete if handled, error if mode error or (svelte-component unhandled), else agent_done; sets event._completionAck = {ok:true, type} (+ final:false, requiresComplete:true, nextCommand:'live-complete.mjs --id <id>', message:'Carbonize cleanup must be verified, then the session must be completed explicitly before polling again.' for carbonize) or {ok:false, error}. Stderr banners: manual_edit_apply → 4-line banner starting Manual Apply action required: edit source, then reply with \live-poll.mjs --reply done --data ''`.; carbonize → ⚠ Carbonize cleanup REQUIRED before next poll. After cleanup, run live-complete.mjs --id . See reference/live.md "Required after accept".`
• Stream: stderr [impeccable-poll] stream mode: one JSON object per line on stdout; use --reply while this process stays running; after each reply-needing event waits (poll /status every 400 ms) until the id leaves pendingEvents (else Timed out waiting for --reply on event <id> exit 1); returns on exit.
• Errors: 401 → Authentication failed. The server token may have changed. + Try restarting: node "…/live-server.mjs" stop && node "…/live.mjs" exit 1; ECONNREFUSED → Live server not running. Start one with: … exit 1; reply non-2xx → Reply failed: <error>\n<reason>\n<hint>\n<failures file:line msg…>\n<_instructions> exit 1; other → Poll failed: <msg> exit 1.
• _instructions templates (instructions.mjs; <S> = abs scripts dir): steer → Do what the message asks (page edits, navigation help, or a short answer). Then reply exactly once: node <S>/live-poll.mjs --reply <id> steer_done ["optional short toast"] (on failure: --reply <id> error "Short reason"). No pickup ack; poll again immediately after.; prefetch, variant_mount_failed (The browser could NOT render variant N (module: URL): ERR… reply node <S>/live-poll.mjs --reply <id> done --file <manifest or source path>; the browser retries on its own. Poll again after the reply.), discard (Original restored and durable completion acknowledged; nothing to do. Poll again. or Completion was not acknowledged: run node <S>/live-complete.mjs --id <id> --discarded, then poll again.), manual_edit_apply (delegate to impeccable_manual_edit_applier; reply --reply <id> done --data '{"status":"done","appliedEntryIds":[...],"failed":[],"files":[...],"notes":[]}'), timeout (No event arrived; poll again immediately.), exit (Session over: kill any background poll, then node <S>/live-server.mjs stop (removes the injected script tag). Sweep leftover impeccable-variants-start / impeccable-carbonize-start markers from source.), generate (numbered steps: screenshot / scaffold branch (svelte-component: edit stubs <dir>/v1.svelte…, params in params.json, reply --file <manifest>; deferred wrapper: splice into scaffold.wrapperBlock and replace lines replaceStartLine-replaceEndLine in ONE edit; written wrapper: splice at insertLine; no scaffold: run live-wrap.mjs --id … --count … --element-id "…" --classes "a,b" --tag "…" --text "<first ~80 chars>") / action reference / When all N variants are delivered: node <S>/live-poll.mjs --reply <id> done --file <project-root-relative path you wrote>. Then poll again. If generation fails … reply --reply <id> error "Short reason" …), accept (carbonize 5-step text; Accept was merged into source mechanically; nothing to clean up. Poll again.; fallback; source_locked retry; accept_receipt_conflict; generic error; manual merge). Prefix when ack failed: Completion was NOT acknowledged: run node <S>/live-status.mjs, finish any cleanup, then node <S>/live-complete.mjs --id <id>.
• Tests: tests/live-poll.test.mjs, tests/live-poll-stream.test.mjs, tests/live-completion.test.mjs, tests/live-recovery-commands.test.mjs.

live-status.mjs -> impeccable status

• Invoked from live.md Recovery: node {{scripts_path}}/live-status.mjs. Args: --target. Works with server down.
• Output (pretty JSON): {liveServer:{status,port,connectedClients,agentPolling,pendingEvents}|null, activeSessions:[server list or local store list], render:[{id, renderState, mountedVariants, mountFailures}], recoveryHint}. Hint: manual apply pending → Manual Apply pending (page …, chunk i/n, N op(s), N entr(y|ies), likely files: …). If you have not already leased it, run live-poll.mjs. Apply the source edits from the manual_edit_apply batch, then reply with live-poll.mjs --reply <id> done --data '<json>'. Polling only leases this work item; it does not commit source edits. Do not run live-commit-manual-edits.mjs for this leased event. Do not poll again before replying.; render failed → The browser failed to mount variant N from URL (ERR); nothing is on screen. Fix the variant files, then reply with live-poll.mjs --reply <id> done --file <manifest or source path> for the queued variant_mount_failed event (or republish) so the browser retries.; server up → Run live-poll.mjs to continue pending work, or live-complete.mjs --id <session> after manual cleanup.; else Start live-server.mjs to requeue pending durable events, then run live-poll.mjs.
• Tests: tests/live-recovery-commands.test.mjs.

live-resume.mjs -> impeccable resume

• Args: --id ID/--id=ID, --help (Usage: node live-resume.mjs [--id SESSION_ID]\n\nPrint the active durable session checkpoint and the next safe agent action.).
• Output: no session → {active:false, nextAction:'No active durable live session found.'}; else {active:true, snapshot, pendingEvent, render:{renderState,mountedVariants,mountFailures}, nextAction} where nextAction priority: manual apply hint; mount failure text; pending → Run live-poll.mjs, handle <type> <id>, then acknowledge with live-poll.mjs --reply <id> done.; phase carbonize_required → Finish carbonize cleanup in <file>, then run live-complete.mjs --id <id>.; accept_requested → Run live-complete.mjs --id <id> after verifying the accepted variant is written.; else Inspect <id>; no pending agent event is currently queued.
• Read-only (never writes snapshot). Tests: tests/live-recovery-commands.test.mjs.

live-complete.mjs -> impeccable complete

• Invoked from live.md carbonize step and _completionAck.nextCommand. Args: --id ID (required; missing → usage, exit 1), --discarded|--discard, --error MSG/--error=MSG, --force, --help (exit 0).
• Gate (status complete, no --force): snapshot.sourceFile inside project and not under node_modules/ → verifyAcceptedFile; dirty → {ok:false, error:'source_dirty', id, file, findings:[…], hint:'The accepted source still carries live-mode leftovers. Finish the carbonize cleanup (bake params, remove markers and data-p-* attributes), then run live-complete again. Use --force only if a finding is a false positive.'} exit 1.
• Then: if server up, POST /poll {token,id,type:'complete'|'discarded'|'error',message}; ok → {ok:true, id, phase, snapshot}; else append {type:'complete'|'discarded'|'agent_error', id, message?} locally → same shape.
• Tests: tests/live-recovery-commands.test.mjs, e2e runLiveComplete.

live-accept.mjs -> impeccable accept

• Invoked by live-poll.mjs automatically; live.md says re-run same command on source_locked.
• Args: --id ID (missing → stderr Missing --id exit 1; bad chars → Invalid --id exit 1), --discard | --variant N (Need --discard or --variant N; N must be 1-3 digits: Invalid --variant), --param-values '<json>' (malformed → ignored), --page-url URL, --defer-source-write (deprecated no-op), --help.
• Output/side effects: section 9. All results exit 0 (even handled:false).
• Tests: tests/live-accept.test.mjs, tests/live-accept-scrub.test.mjs, tests/live-accept-css.test.mjs, tests/live-svelte-component-accept.test.mjs, tests/live-source-lock.test.mjs, e2e params scenario.

live-wrap.mjs -> impeccable wrap

• Invoked from live.md Handle generate step 2 and preflight (--defer-source-write).
• Args: --id ID (req), --count N (default 3), --element-id, --classes "a,b" (comma or space separated), --tag, --query, --file PATH, --text, --page-url URL, --defer-source-write, --target, --help. Both --flag value and --flag=value forms accepted. Missing id → Missing --id exit 1; none of id/classes/query → Need at least one of: --element-id, --classes, --query exit 1.
• stderr JSON errors, exit 1: {error:'element_not_in_source', fallback:'agent-driven', generatedMatch:rel, hint}, {error:'element_not_found', fallback:'agent-driven', hint}, {error:'file_is_generated', fallback:'agent-driven', file, hint}, {error:'Found file but could not locate element in <abs>. Searched for: q1, q2'}, {error:'element_ambiguous', fallback:'agent-driven', reason?:'rendered_text_not_in_source', file, candidates:[{startLine,endLine}], hint}, {error:'missing_page_url_with_pending_edits', pendingEntries:N, hint}, {error:'manual_edit_buffer_apply_failed', pendingOps:[{entryId,ref,originalText,reason:'ambiguous_or_unmatched_pending_edit'}], hint}.
• With --page-url, buffered manual edits for that page whose text sits in the picked range are applied to the wrapper's "original" copy (source untouched).
• stdout success JSON: {file, sourceFile?, previewMode?:'svelte-component', previewFallback?:{from:'svelte-component', reason}, sourceWritten?:false, wrapperBlock?, replaceStartLine?, replaceEndLine?, componentDir?, propContract?, componentStubMarkup?, sourceStartLine?, sourceEndLine?, startLine, endLine, insertLine, commentSyntax:{open,close}, styleMode:'scoped'|'astro-global-prefixed'|'svelte-component', styleTag:string|null, cssSelectorPrefixExamples:[], cssAuthoring:{…}, originalLineCount}. Non-deferred, non-svelte: writes the wrapper into the file. Svelte: file = manifest path, startLine=endLine=insertLine=1.
• Tests: tests/live-wrap.test.mjs, tests/live-wrap-buffer-aware.test.mjs, tests/live-source-search.test.mjs, tests/framework-fixtures.test.mjs (wrapCases), tests/live-svelte-ast.test.mjs.

live-insert.mjs -> impeccable insert

• Args as wrap plus --position before|after (required: Missing --position (before | after), Invalid --position: X); no --page-url. Errors like wrap (element_not_in_source/element_not_found with hint:'See "Handle fallback" in live.md.', file_is_generated, element_ambiguous without hint).
• Output: {mode:'insert', position, file, sourceWritten?:false, wrapperBlock?, replaceStartLine?, replaceEndLine? (= replaceStartLine-1), insertLine, commentSyntax, styleMode, styleTag, cssSelectorPrefixExamples, cssAuthoring}; svelte: {mode:'insert', position, file:<manifest>, sourceFile, previewMode:'svelte-component', componentDir, propContract:[], insertLine:1, sourceInsertLine, anchorStartLine, anchorEndLine, commentSyntax, styleMode:'svelte-component', styleTag:null, cssSelectorPrefixExamples:[], cssAuthoring}.
• Tests: tests/live-insert.test.mjs, tests/live-insert-ui.test.mjs, tests/live-e2e/agent-insert.test.mjs, e2e insert fixtures.

live-inject.mjs -> impeccable inject

• Invoked by live.mjs (--check, --port --token) and live-server.mjs stop (--remove); live-setup.md describes config.
• Args: --check (read-only: {ok:false,error:'config_missing',path} exit 0 / {ok:false,error:'config_invalid',message,path} / {ok:true,config,path}), --remove, --port N (+ optional --token T; without token adopts server.json token only when its port matches), --help. Missing config in insert/remove → stderr {ok:false,error:'config_missing',path} exit 1; --port missing/NaN → stderr {ok:false,error:'missing_port'} exit 1.
• Insert output: tag: {ok:anyInserted, port, gitIgnore:{file,mode,changed,patterns}, results:[{file, inserted:true, cspPatched}|{file,error:'file_not_found'}|{file,error:'insertion_point_not_found',anchor}], healed?} (exit 1 if none inserted); adapter: {ok, port, adapter:'sveltekit'|'nuxt'|'tanstack-start', gitIgnore, results:[adapterResult], healed?} (exitCode 1 on adapter error). Also writes ignore block at repoRoot when nested. Remove output: {ok:true, results:[{file, removed, cspReverted}|{file,removed:false,note:'no tag present'}|{file,error:'file_not_found'}], healed?} or adapter {ok, adapter, results:[…], healed?}.
• Tests: tests/live-inject.test.mjs, tests/live-frameworks.test.mjs, tests/live-tanstack-adapter.test.mjs, tests/framework-fixtures.test.mjs, tests/live-server.test.mjs (gitignore).

live-target.mjs

• Library only (resolveLiveTarget(cwd,args) → {originalCwd, projectRoot, targetPath, absoluteTargetPath, targetOptions}); used by live.mjs. Tests: tests/live-target-context.test.mjs.

live-commit-manual-edits.mjs -> impeccable commit-manual-edits

• Invoked by /manual-edit-commit (server) and manually (node live-commit-manual-edits.mjs [--page-url=<url>] [--provider=auto|codex|claude|mock]). live.md/status hint: never run it for a leased chat Apply event.
• Env: IMPECCABLE_LIVE_COPY_AGENT, IMPECCABLE_LIVE_COPY_AGENT_TIMEOUT_MS, IMPECCABLE_LIVE_COPY_AGENT_MODEL, IMPECCABLE_LIVE_COPY_AGENT_EFFORT, IMPECCABLE_LIVE_COPY_AGENT_MOCK_RESULT, IMPECCABLE_LIVE_COPY_AGENT_MOCK_WRITES, IMPECCABLE_LIVE_COPY_AGENT_MOCK_DELAY_MS, IMPECCABLE_LIVE_MANUAL_EDIT_REPAIR_ATTEMPTS.
• Output: commit result JSON (10.6); on throw stderr {error:'commit_failed', message} exit 1. Does not call enterLiveRoot.
• Tests: tests/live-commit-manual-edits.test.mjs, tests/live-copy-edit-agent.test.mjs.

live-discard-manual-edits.mjs -> impeccable discard-manual-edits

• Args: --page-url=<url> (or --page-url bare = true → matches nothing meaningful), --help (Usage: node live-discard-manual-edits.mjs [--page-url=<url>]). Output {discarded:<opCount>, entries:[…removed], totalCount:<remaining ops>}. No enterLiveRoot. Tests: tests/live-discard-manual-edits.test.mjs.

live-manual-edit-evidence.mjs

• Library (buildManualEditEvidence); no CLI main. Tests: via commit tests.

live-copy-edit-agent.mjs

• Library: buildCopyEditBatchPrompt (long rule list + Final response contract JSON shapes), runCopyEditBatchAgent, runCopyEditPostApplyChecks, chooseCopyEditAgent, parseCopyEditAgentResult (accepts raw JSON, {result:"<json>"} wrappers, or first {…} in text), describeNoProviderError, extractRunnerErrorMessage. [NODE-DEP: spawns codex/claude CLIs, optional @babel/parser]. Tests: tests/live-copy-edit-agent.test.mjs.

Browser parts (live-browser-session.js, live-browser-dom.js, live-browser.js, modern-screenshot.umd.js)

• Served concatenated as /live.js. localStorage keys: impeccable-live-session ({id, appRoot, state, action, count, expected, arrived, visible, sourceFile, previewFile, previewMode, pageUrl, paramValues, parameterState, insertPlaceholder, pickedAnchor, pickedAnchorViewportTop, pageHash, pageSearch, checkpointRevision}), impeccable-live-session-handled (id), impeccable-live-session-scroll, plus prefs keys. Saved sessions with a different appRoot are discarded. States: IDLE, PICKING, CONFIGURING, EDITING, GENERATING, CYCLING, SAVING, CONFIRMED. window.__IMPECCABLE_LIVE_INIT__===true is the e2e handshake oracle. Polls /status periodically for the agent-polling indicator. modern-screenshot.js lazy-loaded for annotated captures.
• Tests: tests/live-browser-session.test.mjs, tests/live-browser-dom.test.mjs, tests/live-browser-regression.test.mjs, tests/live-browser-source.test.mjs, tests/live-browser-script-parts.test.mjs, tests/live-ui-surfaces.test.mjs, tests/live-e2e.test.mjs.

Preflight (live/generation-preflight.mjs, run by the server on lease)

• Command: node live-(wrap|insert).mjs --id <id> --count <count||3> --defer-source-write [--position P] [--element-id X] [--classes "a b"] [--tag T] [--text <≤80>] [--page-url U (replace only)] [--file <cached>]; per-target cache keyed on {mode,position,elementId,classes,tag,pageUrl} → resolved sourceFile; evicted on failure. Result {ok:true, mode, durationMs, scaffold:<last stdout JSON line>} or {ok:false, mode, durationMs, error} / {ok:false, skipped:true, reason:'insufficient_locator'}. Tests: tests/live-generation-preflight.test.mjs.

E2E harness contract (tests/live-e2e.test.mjs, tests/live-e2e/*)

• Fake agent polls GET /poll?token&timeout=5000 (no lease override → 30 s lease), replies via POST /poll with {token,type:'done',sourceEventType:'generate',id,file}, steer_done {message,file}, error, accept/discard completions with data:{carbonize:true,_acceptResult}/{_acceptResult}, manual apply via live-poll.mjs --reply <id> done --data <json>. Variant format: 3 variants (font-weights 300/900/600 for render proof), params lightness (range), face (steps), italic (toggle). Scenarios: core, manual, annotations, exit, missed-done, params, mount-failure, republish, storage-loss (fixtures README). Fixture runtime block schema is authoritative for what a reimplementation must satisfy end-to-end.