mirror of
https://github.com/pbakaus/impeccable.git
synced 2026-09-12 14:16:28 +03:00
Paul BakausandClaude Opus 4.7
05b0ac3e1f
Shape names renamed to describe the patch mechanism (what the agent does) rather than the origin (where the CSP lives). One template now covers multiple frameworks. ## Shape rename - shared-helper → append-arrays - inline-headers → append-string append-arrays applies wherever CSP is a structured directive array. append-string applies wherever CSP is a literal value string. ## New detection coverage - SvelteKit kit.csp.directives in svelte.config.js → append-arrays - Nuxt routeRules / nitro.routeRules CSP header → append-string - Nuxt-security module's contentSecurityPolicy → append-arrays ## New fixtures - sveltekit-csp/: SvelteKit config with kit.csp.directives. Includes expected-after-patch.js showing the array spread. - nuxt-csp/: Nuxt 3 config with routeRules CSP. Includes expected-after-patch.ts showing the string splice. ## Skill docs Single append-arrays template covers Next monorepo, SvelteKit, and Nuxt-security. Single append-string template covers inline Next headers() and Nuxt routeRules. Per-framework specifics listed as sub-bullets under each shape. 54 tests across 9 fixtures, all passing. Clean fixtures (plain vite, nextjs-app, astro, sveltekit, multipage-with-generator) still classify as shape: null. Astro and Vue (non-Nuxt) left unhandled by design: Astro has no first-party CSP mechanism; Vue without Nuxt is covered by the existing Vite fixture. Plain Svelte has no framework CSP primitive and inherits from its bundler (Vite/Rollup). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Framework fixtures
Representative project shapes for exercising live mode against different framework conventions. Each fixture is a small directory tree that the test harness copies into a temp git repo, then drives live-inject.mjs, live-wrap.mjs, live-accept.mjs, and is-generated.mjs against.
Layout
<fixture>/
files/ project tree the test copies into tmp
gitignore.txt becomes .gitignore in tmp (so we can commit the real files here)
fixture.json config + expected results the test consumes
fixture.json schema:
{
"name": "human-readable label",
"config": { ...contents for live-inject.mjs config.json ... },
"sourceFiles": ["paths that is-generated should classify as source (false)"],
"generatedFiles": ["paths that is-generated should classify as generated (true)"],
"wrapCases": [
{
"name": "description",
"args": { "classes": "...", "tag": "...", "elementId": "..." },
"expectedFile": "where wrap should land (relative to fixture root)",
"expectsError": "optional error code, e.g. element_not_in_source"
}
],
"csp": {
"shape": "shared-helper | inline-headers | middleware | meta-tag | null",
"signals": ["diagnostic hints — paths where CSP was detected"],
"patchTarget": "which file the agent should modify",
"expectedAfter": "filename of the reference post-patch output inside this fixture"
}
}
The expectedAfter file lives alongside fixture.json (not inside files/) and is a human/agent-review reference — tests don't auto-apply the patch.
Current fixtures
| Fixture | Shape |
|---|---|
vite-react/ |
Tracked index.html shell + src/App.jsx. Inject into the shell. |
nextjs-app/ |
app/layout.tsx as JSX inject target (commentSyntax jsx). |
astro/ |
src/layouts/Layout.astro as inject target. HTML comments. |
sveltekit/ |
src/app.html shell + src/routes/+page.svelte. |
multipage-with-generator/ |
src/ tracked, dist/ gitignored. Exercises the is-generated guard and element_not_in_source fallback. |
nextjs-turborepo/ |
Monorepo with shared CSP helper (createBaseNextConfig). CSP shape append-arrays. |
nextjs-inline-csp/ |
App-level next.config.js with a literal CSP string. CSP shape append-string. |
sveltekit-csp/ |
SvelteKit kit.csp.directives in svelte.config.js. CSP shape append-arrays. |
nuxt-csp/ |
Nuxt routeRules with literal CSP header in nuxt.config.ts. CSP shape append-string. |
Add new fixtures by cloning a directory, swapping files, and updating fixture.json.