chore(skills): configuration des compétences Impeccable pour les agents

.github/skills/impeccable/scripts/detector/cli/main.mjs

@@ -0,0 +1,432 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { loadDesignSystemForTarget } from '../design-system.mjs';
+import { RULE_SCOPES, filterByScopes } from '../registry/antipatterns.mjs';
+import { createBrowserDetector, detectUrl } from '../engines/browser/detect-url.mjs';
+import { detectHtml } from '../engines/static-html/detect-html.mjs';
+import { detectText } from '../engines/regex/detect-text.mjs';
+import {
+  filterDetectionFindings,
+  readDetectionConfig,
+  shouldIgnoreDetectionFile,
+} from '../../lib/impeccable-config.mjs';
+import {
+  HTML_EXTENSIONS,
+  buildImportGraph,
+  detectFrameworkConfig,
+  isPortListening,
+  walkDir,
+} from '../node/file-system.mjs';
+
+// ---------------------------------------------------------------------------
+// Output formatting
+// ---------------------------------------------------------------------------
+
+function formatFindingSummary(count) {
+  return `${count} anti-pattern${count === 1 ? '' : 's'} found.`;
+}
+
+// Local filesystem path behind a file:// URL, or null when it can't be mapped.
+function fileUrlToLocalPath(url) {
+  try {
+    return fileURLToPath(url);
+  } catch {
+    return null;
+  }
+}
+
+// Advisory findings are detected but never treated as failures: they list in a
+// separate, visually dimmed section, are excluded from the failure count that
+// drives the exit code, and carry `"advisory": true` in JSON so consumers can
+// filter. Every advisory finding carries the flag (stamped by the registry via
+// findings.mjs).
+function isAdvisory(finding) {
+  return finding && finding.advisory === true;
+}
+
+function partitionAdvisory(findings) {
+  const primary = [];
+  const advisory = [];
+  for (const f of findings) (isAdvisory(f) ? advisory : primary).push(f);
+  return { primary, advisory };
+}
+
+// ANSI dim, when stderr is a TTY. Advisory output is chrome, so keep it quiet.
+function dim(text) {
+  return process.stderr.isTTY ? `\x1b[2m${text}\x1b[0m` : text;
+}
+
+function formatFindingsBody(findings) {
+  const grouped = {};
+  for (const f of findings) {
+    if (!grouped[f.file]) grouped[f.file] = [];
+    grouped[f.file].push(f);
+  }
+  const out = [];
+  for (const [file, items] of Object.entries(grouped)) {
+    const importNote = items[0]?.importedBy?.length ? ` (imported by ${items[0].importedBy.join(', ')})` : '';
+    out.push(`\n${file}${importNote}`);
+    for (const item of items) {
+      out.push(`  ${item.line ? `line ${item.line}: ` : ''}[${item.antipattern}] ${item.snippet}`);
+      out.push(`    → ${item.description}`);
+    }
+  }
+  return out;
+}
+
+function formatAdvisorySection(advisory) {
+  if (!advisory || advisory.length === 0) return '';
+  const lines = [`\n${dim('── Advisory (not counted as failures) ──')}`];
+  for (const line of formatFindingsBody(advisory)) lines.push(dim(line));
+  lines.push(dim(`\n${advisory.length} advisory note${advisory.length === 1 ? '' : 's'}. Suppress with --no-advisory.`));
+  return lines.join('\n');
+}
+
+// Text/JSON formatter. `findings` is the full set; advisory items are separated
+// out into their own section and excluded from the failure summary count. JSON
+// output keeps every finding (each advisory one flagged) in a single array.
+function formatFindings(findings, jsonMode) {
+  if (jsonMode) return JSON.stringify(findings, null, 2);
+
+  const { primary, advisory } = partitionAdvisory(findings);
+  const out = [...formatFindingsBody(primary)];
+  out.push(`\n${formatFindingSummary(primary.length)}`);
+  const advisorySection = formatAdvisorySection(advisory);
+  if (advisorySection) out.push(advisorySection);
+  return out.join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// Stdin handling
+// ---------------------------------------------------------------------------
+
+// `optionsFor` maps a local path to scan options carrying that path's own
+// project design system (or base options when null). Falls back to a plain
+// object so direct/legacy callers still work.
+async function detectLocalFile(filePath, options) {
+  if (HTML_EXTENSIONS.has(path.extname(filePath).toLowerCase())) {
+    return detectHtml(filePath, options);
+  }
+  return detectText(fs.readFileSync(filePath, 'utf-8'), filePath, options);
+}
+
+async function handleStdin(optionsFor = () => ({})) {
+  const resolve = typeof optionsFor === 'function' ? optionsFor : () => optionsFor;
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const input = Buffer.concat(chunks).toString('utf-8');
+  try {
+    const parsed = JSON.parse(input);
+    const fp = parsed?.tool_input?.file_path;
+    if (fp && fs.existsSync(fp)) {
+      return detectLocalFile(fp, resolve(fp));
+    }
+  } catch { /* not JSON */ }
+  return detectText(input, '<stdin>', resolve(null));
+}
+
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+async function confirm(question) {
+  const rl = (await import('node:readline')).default.createInterface({
+    input: process.stdin, output: process.stderr,
+  });
+  return new Promise((resolve) => {
+    rl.question(`${question} [Y/n] `, (answer) => {
+      rl.close();
+      resolve(!answer || /^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
+function printUsage() {
+  console.log(`Usage: impeccable detect [options] [file-or-dir-or-url...]
+
+Scan files or URLs for UI anti-patterns and design quality issues.
+
+Options:
+  --json              Output results as JSON
+  --quiet             In text mode, only print the final findings count
+  --scope <name>      Only report rules in the given design domain
+                      (type, layout). Comma-separated.
+  --viewport <WxH>    Browser viewport for URL scans (default 1280x800),
+                      e.g. --viewport 390x844 for a mobile-width pass
+  --no-config         Do not apply project config, detector ignores, inline
+                      ignore comments, or DESIGN.md
+  --no-inline-ignores Do not honor in-file impeccable-disable* ignore comments
+  --no-design-system  Do not load local DESIGN.md / .impeccable/design.json context
+  --no-advisory       Suppress advisory findings entirely (e.g. em-dash overuse)
+  --help              Show this help message
+
+Advisory findings:
+  Some rules are advisory: detected and listed in a separate section, but never
+  counted as failures and never changing the exit code. They stay out of the
+  failure count so they never block automation. --no-advisory hides them.
+
+Project config:
+  Respects .impeccable/config.json and .impeccable/config.local.json detector
+  settings: detector.ignoreRules, detector.ignoreFiles, detector.ignoreValues,
+  and detector.designSystem.enabled.
+
+Inline ignores:
+  In-file comments waive a finding where it lives and travel with the file:
+    <!-- impeccable-disable overused-font -- exported brand doc -->
+    .brand { font-family: Inter } /* impeccable-disable-line overused-font */
+    // impeccable-disable-next-line bounce-easing: intentional bounce
+  impeccable-disable applies to the whole file; -line / -next-line are scoped.
+  List one or more rule ids (comma-separated), or omit them / use * for all.
+
+Detection modes:
+  HTML files     Static HTML/CSS analysis (default, catches linked CSS)
+  Non-HTML files Regex pattern matching (CSS, JSX, TSX, etc.)
+  URLs           Puppeteer full browser rendering (auto-detected;
+                 http(s):// and file:// URLs)
+
+Examples:
+  impeccable detect src/
+  impeccable detect index.html
+  impeccable detect https://example.com
+  impeccable detect --json .
+  impeccable detect --no-config src/`);
+}
+
+async function detectCli() {
+  let args = process.argv.slice(2).map(arg => {
+    if (arg === '-json') return '--json';
+    if (arg === '-fast') return '--fast';
+    return arg;
+  });
+  if (args[0] === 'detect') args = args.slice(1);
+  const jsonMode = args.includes('--json');
+  const quietMode = args.includes('--quiet');
+  const helpMode = args.includes('--help');
+  const noAdvisory = args.includes('--no-advisory');
+  // --fast (regex-only) is deprecated: since the jsdom removal, the static
+  // HTML/CSS analysis is fast and covers every rule, so the regex-only path
+  // only loses coverage for no real speed win. Accept the flag for back-compat
+  // but ignore it and run the full scan.
+  if (args.includes('--fast')) {
+    process.stderr.write(
+      'Note: --fast is deprecated and ignored. The full scan is fast now and runs every rule.\n',
+    );
+  }
+  if (args.includes('--gpt') || args.includes('--gemini')) {
+    process.stderr.write(
+      'Note: --gpt and --gemini are deprecated and ignored. Generated-UI tells now run by default.\n',
+    );
+  }
+  const configEnabled = !args.includes('--no-config');
+  const detectionConfig = configEnabled
+    ? readDetectionConfig(process.cwd())
+    : { ignoreRules: [], ignoreFiles: [], ignoreValues: [] };
+  const scopes = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] !== '--scope' && !args[i].startsWith('--scope=')) continue;
+    const inline = args[i].startsWith('--scope=');
+    const value = inline ? args[i].slice('--scope='.length) : args[i + 1];
+    const parsed = (value && !value.startsWith('--'))
+      ? value.split(',').map(s => s.trim()).filter(Boolean)
+      : [];
+    // A bare `--scope` would otherwise fall out of `targets` and scan unscoped;
+    // fail loudly so a mistyped pre-scan never runs the wrong rule set.
+    if (parsed.length === 0) {
+      process.stderr.write(
+        `Error: --scope requires a value. Valid scopes: ${[...RULE_SCOPES].join(', ')}\n`,
+      );
+      process.exit(1);
+    }
+    scopes.push(...parsed);
+    args.splice(i, inline ? 1 : 2);
+    i -= 1;
+  }
+  let viewport = null;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] !== '--viewport' && !args[i].startsWith('--viewport=')) continue;
+    const inline = args[i].startsWith('--viewport=');
+    const value = inline ? args[i].slice('--viewport='.length) : args[i + 1];
+    const match = /^(\d{2,5})x(\d{2,5})$/i.exec(value || '');
+    if (!match) {
+      process.stderr.write('Error: --viewport requires a WxH value, e.g. --viewport 390x844\n');
+      process.exit(1);
+    }
+    viewport = { width: Number(match[1]), height: Number(match[2]) };
+    args.splice(i, inline ? 1 : 2);
+    i -= 1;
+  }
+  const unknownScopes = scopes.filter(s => !RULE_SCOPES.has(s));
+  if (unknownScopes.length > 0) {
+    process.stderr.write(
+      `Error: unknown --scope value(s): ${unknownScopes.join(', ')}. Valid scopes: ${[...RULE_SCOPES].join(', ')}\n`,
+    );
+    process.exit(1);
+  }
+  const designSystemEnabled = configEnabled && !args.includes('--no-design-system') && detectionConfig.designSystem?.enabled !== false;
+  // Inline `impeccable-disable*` waivers are part of the scanned file, so they
+  // apply by default. `--no-config` (raw scan) and the dedicated
+  // `--no-inline-ignores` both turn them off.
+  const inlineIgnoresEnabled = configEnabled && !args.includes('--no-inline-ignores');
+  const baseScanOptions = { inlineIgnores: inlineIgnoresEnabled };
+  if (viewport) baseScanOptions.viewport = viewport;
+  // DESIGN.md must resolve from EACH scan target's own project root, not from
+  // process.cwd(): scanning project B's files from inside project A applied A's
+  // design rules (cross-project contamination). Resolve per target, memoized by
+  // resolved project root so a multi-file scan pays the read once per project.
+  // A target with no project marker above it gets no design system (never cwd's).
+  const designSystemCache = new Map();
+  const scanOptionsFor = (localPath) => {
+    if (!designSystemEnabled || !localPath) return baseScanOptions;
+    const designSystem = loadDesignSystemForTarget(localPath, { cache: designSystemCache });
+    return designSystem ? { ...baseScanOptions, designSystem } : baseScanOptions;
+  };
+  const targets = args.filter(a => !a.startsWith('--'));
+
+  if (helpMode) { printUsage(); process.exit(0); }
+
+  let allFindings = [];
+
+  if (!process.stdin.isTTY && targets.length === 0) {
+    allFindings = await handleStdin(scanOptionsFor);
+  } else {
+    const paths = targets.length > 0 ? targets : [process.cwd()];
+    // file:// URLs get the same Puppeteer-rendered pass as http(s) — the
+    // real cascade, real computed styles, real layout. Callers that want a
+    // browser-grade scan of a local artifact can pass file:///abs/path.html
+    // instead of the bare path (which stays on the static engine).
+    const urlRe = /^(?:https?|file):\/\//i;
+    const urlTargetCount = paths.filter(target => urlRe.test(target)).length;
+    const browserDetector = urlTargetCount > 1 ? await createBrowserDetector() : null;
+
+    try {
+      for (const target of paths) {
+        if (urlRe.test(target)) {
+          // A file:// URL points at a local artifact, so its design system
+          // resolves from that file's project. A remote http(s) URL has no
+          // local project — it gets base options (no design system), never
+          // process.cwd()'s.
+          const urlOptions = /^file:/i.test(target)
+            ? scanOptionsFor(fileUrlToLocalPath(target))
+            : baseScanOptions;
+          try {
+            const scanner = browserDetector
+              ? (url) => browserDetector.detectUrl(url, urlOptions)
+              : (url) => detectUrl(url, urlOptions);
+            allFindings.push(...await scanner(target));
+          } catch (e) { process.stderr.write(`Error: ${e.message}\n`); }
+          continue;
+        }
+
+        const resolved = path.resolve(target);
+        let stat;
+        try { stat = fs.statSync(resolved); }
+        catch { process.stderr.write(`Warning: cannot access ${target}\n`); continue; }
+
+        if (stat.isDirectory()) {
+          // Check for framework dev server config (skip in JSON/quiet modes to avoid polluting output)
+          if (!jsonMode && !quietMode) {
+            const fwConfig = detectFrameworkConfig(resolved);
+            if (fwConfig) {
+              const probe = await isPortListening(fwConfig.port, fwConfig.fingerprint);
+              if (probe.listening && probe.matched) {
+                process.stderr.write(
+                  `\n${fwConfig.name} dev server detected on localhost:${fwConfig.port}.\n` +
+                  `For more accurate results, scan the running site:\n` +
+                  `  npx impeccable detect http://localhost:${fwConfig.port}\n\n`
+                );
+              } else if (probe.listening && !probe.matched) {
+                process.stderr.write(
+                  `\n${fwConfig.name} project detected (${path.basename(fwConfig.configPath)}).\n` +
+                  `Port ${fwConfig.port} is in use by another service. Start the ${fwConfig.name} dev server and scan via URL for best results.\n\n`
+                );
+              } else {
+                process.stderr.write(
+                  `\n${fwConfig.name} project detected (${path.basename(fwConfig.configPath)}).\n` +
+                  `Start the dev server and scan via URL for best results:\n` +
+                  `  npx impeccable detect http://localhost:${fwConfig.port}\n\n`
+                );
+              }
+            }
+          }
+
+          const files = walkDir(resolved)
+            .filter(file => !shouldIgnoreDetectionFile(file, process.cwd(), detectionConfig));
+          const htmlCount = files.filter(f => HTML_EXTENSIONS.has(path.extname(f).toLowerCase())).length;
+
+          // Warn and confirm if scanning many files (static HTML/CSS processes each HTML file)
+          if (files.length > 50 && process.stdin.isTTY && !jsonMode && !quietMode) {
+            process.stderr.write(
+              `\nFound ${files.length} files (${htmlCount} HTML) in ${target}.\n` +
+              `Scanning may take a while${htmlCount > 10 ? ' (static HTML/CSS processes each HTML file individually)' : ''}.\n` +
+              `Target a specific subdirectory to narrow scope.\n`
+            );
+            const ok = await confirm('Continue?');
+            if (!ok) { process.stderr.write('Aborted.\n'); process.exit(0); }
+          }
+
+          // Build import graph for multi-file awareness
+          const graph = buildImportGraph(files);
+          // Build reverse map: file -> set of files that import it
+          const importedByMap = new Map();
+          for (const [importer, imports] of graph) {
+            for (const imported of imports) {
+              if (!importedByMap.has(imported)) importedByMap.set(imported, new Set());
+              importedByMap.get(imported).add(importer);
+            }
+          }
+
+          for (const file of files) {
+            // Each file resolves its own project design system (cached by root),
+            // so a scan spanning sibling projects applies the right rules per file.
+            const fileOptions = scanOptionsFor(file);
+            const fileFindings = await detectLocalFile(file, fileOptions);
+            // Annotate findings with import context
+            const importers = importedByMap.get(file);
+            if (importers && importers.size > 0) {
+              const importerNames = [...importers].map(f => path.basename(f));
+              for (const f of fileFindings) {
+                f.importedBy = importerNames;
+              }
+            }
+            allFindings.push(...fileFindings);
+          }
+        } else if (stat.isFile()) {
+          if (shouldIgnoreDetectionFile(resolved, process.cwd(), detectionConfig)) continue;
+          const fileOptions = scanOptionsFor(resolved);
+          allFindings.push(...await detectLocalFile(resolved, fileOptions));
+        }
+      }
+    } finally {
+      if (browserDetector) await browserDetector.close();
+    }
+  }
+
+  allFindings = filterDetectionFindings(allFindings, detectionConfig);
+  allFindings = filterByScopes(allFindings, scopes);
+  // --no-advisory drops advisory findings before any output or exit-code math.
+  if (noAdvisory) allFindings = allFindings.filter((f) => !isAdvisory(f));
+
+  // The exit code and failure count reflect non-advisory findings only. An
+  // advisory-only scan still prints its notes but exits 0 (a clean pass), so
+  // advisory rules never break CI or block automation.
+  const { primary, advisory } = partitionAdvisory(allFindings);
+
+  if (allFindings.length > 0) {
+    if (jsonMode) process.stdout.write(formatFindings(allFindings, true) + '\n');
+    else if (quietMode) {
+      process.stderr.write(formatFindingSummary(primary.length) + '\n');
+      if (advisory.length > 0) {
+        process.stderr.write(dim(`${advisory.length} advisory note${advisory.length === 1 ? '' : 's'} (not counted).`) + '\n');
+      }
+    }
+    else process.stderr.write(formatFindings(allFindings, false) + '\n');
+    process.exit(primary.length > 0 ? 2 : 0);
+  }
+  if (jsonMode) process.stdout.write('[]\n');
+  process.exit(0);
+}
+
+export { formatFindings, handleStdin, confirm, printUsage, detectCli };

.github/skills/impeccable/scripts/detector/detect-antipatterns.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+/**
+ * Anti-Pattern Detector for Impeccable
+ * Copyright (c) 2026 Paul Bakaus
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Public API facade. Runtime engines live under cli/engine/engines/.
+ */
+
+import { detectCli } from './cli/main.mjs';
+
+export { ANTIPATTERNS, RULE_ENGINE_SUPPORT, getAntipattern, getRulesForCategory, getRuleEngineSupport } from './registry/antipatterns.mjs';
+export { SAFE_TAGS, BORDER_SAFE_TAGS, OVERUSED_FONTS, GENERIC_FONTS, KNOWN_SERIF_FONTS } from './shared/constants.mjs';
+export { isNeutralColor, parseRgb, relativeLuminance, contrastRatio, parseGradientColors, hasChroma, getHue, colorToHex } from './shared/color.mjs';
+export { isFullPage } from './shared/page.mjs';
+export {
+  checkElementBorders,
+  checkElementMotion,
+  checkElementGlow,
+  checkPageTypography,
+  checkPageLayout,
+  checkHtmlPatterns,
+} from './rules/checks.mjs';
+export { createDetectorProfile, summarizeDetectorProfile } from './profile/profiler.mjs';
+export {
+  parseFrontmatter as parseDesignFrontmatter,
+  normalizeDesignSystem,
+  loadDesignSystemForCwd,
+  checkSourceDesignSystem,
+  collectStaticDesignSystemFindings,
+} from './design-system.mjs';
+export { detectHtml } from './engines/static-html/detect-html.mjs';
+export { detectUrl, createBrowserDetector } from './engines/browser/detect-url.mjs';
+export { detectText, extractStyleBlocks, extractCSSinJS } from './engines/regex/detect-text.mjs';
+export {
+  walkDir,
+  hasScannableExtension,
+  SCANNABLE_EXTENSIONS,
+  SKIP_DIRS,
+  buildImportGraph,
+  resolveImport,
+  detectFrameworkConfig,
+  isPortListening,
+  FRAMEWORK_CONFIGS,
+} from './node/file-system.mjs';
+export { formatFindings, detectCli } from './cli/main.mjs';
+
+const isMainModule = process.argv[1]?.endsWith('detect-antipatterns.mjs') ||
+  process.argv[1]?.endsWith('detect-antipatterns.mjs/');
+if (isMainModule) detectCli();

.github/skills/impeccable/scripts/detector/engines/browser/detect-url.mjs

@@ -0,0 +1,372 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { finding } from '../../findings.mjs';
+import { profileFindingsAsync, profileStep, profileStepAsync } from '../../profile/profiler.mjs';
+import { captureVisualContrastCandidate } from '../visual/screenshot-contrast.mjs';
+import { checkContentHiddenAtRest } from '../../rules/checks.mjs';
+
+// On Windows, puppeteer's bundled Chrome lives in a user-writable cache
+// directory. Its GPU process can be denied (STATUS_ACCESS_DENIED) by security
+// software or the GPU sandbox because it launches from an untrusted path.
+// Chrome then crash-loops the GPU process, and each relaunch briefly flashes a
+// compositor surface, the black window users report during `detect <url>`
+// (issue #372). The system-installed Chrome runs from a trusted location with a
+// healthy GPU, so channel:'chrome' avoids the crash entirely; both use hardware
+// GPU, so contrast measurement is unaffected. Scope this to Windows only: other
+// platforms do not have the bug, so they keep the pinned bundled build for
+// consistent measurement across machines. Fall back to bundled when the switch
+// fails (Chrome not installed, or channel resolution fails). If the bundled
+// launch then also fails, surface the original system-Chrome error as the
+// cause so the real failure is not lost.
+async function launchBrowser(puppeteer, { headless = true, args = [] } = {}) {
+  let channelError;
+  if (process.platform === 'win32') {
+    try {
+      return await puppeteer.default.launch({ channel: 'chrome', headless, args });
+    } catch (err) {
+      // System Chrome unavailable or unlaunchable; fall through to the bundled
+      // browser, but keep the error in case the fallback fails too.
+      channelError = err;
+    }
+  }
+  try {
+    return await puppeteer.default.launch({ headless, args });
+  } catch (err) {
+    if (channelError && err && err.cause === undefined) err.cause = channelError;
+    throw err;
+  }
+}
+
+// Reveal sweep + invisible-text measurement for the content-hidden-at-rest
+// rule. Scrolls through the document with instant jumps (bypasses CSS
+// scroll-behavior: smooth) so IntersectionObserver / scroll reveal handlers
+// get every chance to fire, returns to the top, lets transitions settle,
+// then measures how much text still renders invisible. A healthy
+// reveal-on-scroll page drops to ~0 after the sweep; a page whose reveal
+// script died keeps most of its text at opacity 0.
+async function measureContentHiddenAfterReveal(page) {
+  await page.evaluate(async () => {
+    const step = Math.max(200, Math.floor(window.innerHeight * 0.7));
+    const max = Math.max(
+      document.documentElement.scrollHeight || 0,
+      document.body?.scrollHeight || 0,
+    );
+    for (let y = 0; y <= max; y += step) {
+      window.scrollTo({ top: y, left: 0, behavior: 'instant' });
+      await new Promise(resolve => requestAnimationFrame(() => setTimeout(resolve, 40)));
+    }
+    window.scrollTo({ top: 0, left: 0, behavior: 'instant' });
+    await new Promise(resolve => setTimeout(resolve, 700));
+  });
+  return page.evaluate(() => {
+    if (typeof window.impeccableMeasureHiddenText !== 'function') return null;
+    return window.impeccableMeasureHiddenText();
+  });
+}
+
+function serializeDesignSystemForBrowser(designSystem) {
+  if (!designSystem?.present) return null;
+  return {
+    present: true,
+    hasFonts: designSystem.hasFonts === true,
+    allowedFonts: Array.from(designSystem.allowedFonts || []),
+    hasColors: designSystem.hasColors === true,
+    allowedColors: Array.from(designSystem.allowedColorKeys?.values?.() || [])
+      .map(entry => entry?.color)
+      .filter(color => color && Number.isFinite(color.r) && Number.isFinite(color.g) && Number.isFinite(color.b))
+      .map(color => ({ r: color.r, g: color.g, b: color.b })),
+    hasRadii: designSystem.hasRadii === true,
+    allowedRadii: (designSystem.allowedRadii || [])
+      .map(entry => Number(entry?.px))
+      .filter(px => Number.isFinite(px)),
+    hasPillRadius: designSystem.hasPillRadius === true,
+  };
+}
+
+async function runVisualContrastFallback(page, serializedGroups, options, profile, target) {
+  if (options?.visualContrast === false) return [];
+  const maxCandidates = Number.isFinite(options?.visualContrastMaxCandidates)
+    ? options.visualContrastMaxCandidates
+    : 12;
+  const scrollOffscreen = options?.visualContrastScrollOffscreen !== false;
+  const existingLowContrastSelectors = new Set(
+    serializedGroups
+      .filter(group => group.findings?.some(f => f.type === 'low-contrast'))
+      .map(group => group.selector)
+      .filter(Boolean)
+  );
+
+  let browserAnalyses = [];
+  const findings = [];
+  if (options?.visualContrastBrowser !== false) {
+    const browserFindings = await profileFindingsAsync(profile, {
+      engine: 'browser',
+      phase: 'visual-contrast',
+      ruleId: 'browser-fallback',
+      target,
+    }, async () => {
+      browserAnalyses = await page.evaluate(async ({ maxCandidates, scrollOffscreen }) => {
+        if (typeof window.impeccableAnalyzeVisualContrast !== 'function') return [];
+        return window.impeccableAnalyzeVisualContrast({ maxCandidates, scrollOffscreen });
+      }, { maxCandidates, scrollOffscreen });
+      return browserAnalyses
+        .filter(result => result.finding && !existingLowContrastSelectors.has(result.selector))
+        .map(result => result.finding);
+    });
+    findings.push(...browserFindings);
+  }
+
+  let candidates = browserAnalyses.length > 0 ? browserAnalyses : [];
+  if (candidates.length === 0) {
+    candidates = await profileStepAsync(profile, {
+      engine: 'browser',
+      phase: 'visual-contrast',
+      ruleId: 'collect-candidates',
+      target,
+    }, () => page.evaluate(({ maxCandidates }) => {
+      if (typeof window.impeccableCollectVisualContrastCandidates !== 'function') return [];
+      return window.impeccableCollectVisualContrastCandidates({ maxCandidates });
+    }, { maxCandidates }));
+  }
+
+  const viewport = options?.viewport || { width: 1280, height: 800 };
+  const browserResolvedSelectors = new Set(
+    browserAnalyses
+      .filter(result => result.status === 'fail' || result.status === 'pass')
+      .map(result => result.selector)
+      .filter(Boolean)
+  );
+  const filtered = candidates.filter(candidate =>
+    !existingLowContrastSelectors.has(candidate.selector) &&
+    !browserResolvedSelectors.has(candidate.selector)
+  );
+  if (options?.visualContrastPixel === false) return findings;
+  for (const candidate of filtered) {
+    const result = await profileFindingsAsync(profile, {
+      engine: 'browser',
+      phase: 'visual-contrast',
+      ruleId: 'pixel-diff',
+      target,
+    }, async () => {
+      const finding = await captureVisualContrastCandidate(page, candidate, viewport);
+      return finding ? [finding] : [];
+    });
+    findings.push(...result);
+  }
+  return findings;
+}
+
+// ---------------------------------------------------------------------------
+// Puppeteer detection (for URLs)
+// ---------------------------------------------------------------------------
+
+async function detectUrl(url, options = {}) {
+  const profile = options?.profile;
+  const waitUntil = options?.waitUntil || 'networkidle0';
+  const settleMs = Number.isFinite(options?.settleMs) ? options.settleMs : 0;
+  const viewport = options?.viewport || { width: 1280, height: 800 };
+  const externalBrowser = options?.browser || null;
+  let puppeteer;
+  if (!externalBrowser) {
+    try {
+      puppeteer = await profileStepAsync(profile, {
+        engine: 'browser',
+        phase: 'setup',
+        ruleId: 'import-puppeteer',
+        target: url,
+      }, () => import('puppeteer'));
+    } catch {
+      throw new Error('puppeteer is required for URL scanning. Install: npm install puppeteer');
+    }
+  }
+
+  // Read the browser detection script — reuse it instead of reimplementing
+  const browserScriptPath = path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    '..',
+    '..',
+    'detect-antipatterns-browser.js'
+  );
+  let browserScript;
+  try {
+    browserScript = profileStep(profile, {
+      engine: 'browser',
+      phase: 'setup',
+      ruleId: 'read-browser-script',
+      target: url,
+    }, () => fs.readFileSync(browserScriptPath, 'utf-8'));
+  } catch {
+    throw new Error(`Browser script not found at ${browserScriptPath}`);
+  }
+
+  // CI runners (GitHub Actions Ubuntu) block unprivileged user namespaces, so
+  // Chrome can't initialize its sandbox there. Disable the sandbox only when
+  // running in CI; local users keep the default hardened launch.
+  const launchArgs = process.env.CI ? ['--no-sandbox', '--disable-setuid-sandbox'] : [];
+  const browser = externalBrowser || await profileStepAsync(profile, {
+    engine: 'browser',
+    phase: 'load',
+    ruleId: 'launch-browser',
+    target: url,
+  }, () => launchBrowser(puppeteer, { headless: options?.headless ?? true, args: launchArgs }));
+  const page = await profileStepAsync(profile, {
+    engine: 'browser',
+    phase: 'load',
+    ruleId: 'new-page',
+    target: url,
+  }, () => browser.newPage());
+
+  // Uncaught exceptions and parse errors surface as pageerror events. The
+  // listener must attach before goto: a syntax error fires during the
+  // initial parse, long before the load event. Dedupe by message; a single
+  // broken loop can otherwise throw hundreds of identical errors.
+  const pageErrors = [];
+  if (options?.scriptErrors !== false) {
+    page.on('pageerror', (err) => {
+      const message = String(err?.message || err).split('\n')[0].trim().slice(0, 160);
+      if (message && !pageErrors.includes(message)) pageErrors.push(message);
+    });
+  }
+
+  let results = [];
+  try {
+    await profileStepAsync(profile, {
+      engine: 'browser',
+      phase: 'load',
+      ruleId: 'set-viewport',
+      target: url,
+    }, () => page.setViewport(viewport));
+    await profileStepAsync(profile, {
+      engine: 'browser',
+      phase: 'load',
+      ruleId: `goto:${waitUntil}`,
+      target: url,
+    }, () => page.goto(url, { waitUntil, timeout: 30000 }));
+    if (settleMs > 0) {
+      await profileStepAsync(profile, {
+        engine: 'browser',
+        phase: 'load',
+        ruleId: 'settle',
+        target: url,
+      }, () => new Promise(resolve => setTimeout(resolve, settleMs)));
+    }
+
+    // Inject the browser detection script and collect results
+    const browserDesignSystem = serializeDesignSystemForBrowser(options?.designSystem);
+    await profileStepAsync(profile, {
+      engine: 'browser',
+      phase: 'scan',
+      ruleId: 'configure-pure-detect',
+      target: url,
+    }, () => page.evaluate((designSystem) => {
+      window.__IMPECCABLE_CONFIG__ = {
+        ...(window.__IMPECCABLE_CONFIG__ || {}),
+        autoScan: false,
+        ...(designSystem ? { designSystem } : {}),
+      };
+    }, browserDesignSystem));
+    await profileStepAsync(profile, {
+      engine: 'browser',
+      phase: 'scan',
+      ruleId: 'inject-browser-script',
+      target: url,
+    }, () => page.evaluate(browserScript));
+    let serializedGroups = [];
+    results = await profileFindingsAsync(profile, {
+      engine: 'browser',
+      phase: 'scan',
+      ruleId: 'browser-scan',
+      target: url,
+    }, async () => {
+      serializedGroups = await page.evaluate(() => {
+        if (!window.impeccableDetect) return [];
+        return window.impeccableDetect({ decorate: false, serialize: true });
+      });
+      return serializedGroups.flatMap(({ findings }) =>
+        findings.map(f => ({ id: f.type, snippet: f.detail, ignoreValue: f.ignoreValue || '', severity: f.severity || '' }))
+      );
+    });
+    // Content invisible at rest: reveal sweep, then re-measure. Runs after
+    // the main scan (which must see the true at-rest state) and before the
+    // visual contrast fallback (the sweep restores scroll to the top).
+    if (options?.contentHidden !== false) {
+      const hiddenFindings = await profileFindingsAsync(profile, {
+        engine: 'browser',
+        phase: 'scan',
+        ruleId: 'content-hidden-at-rest',
+        target: url,
+      }, async () => {
+        const measured = await measureContentHiddenAfterReveal(page);
+        return measured ? checkContentHiddenAtRest(measured) : [];
+      });
+      results.push(...hiddenFindings);
+    }
+
+    for (const message of pageErrors.slice(0, 3)) {
+      results.push({ id: 'script-error', snippet: message });
+    }
+
+    const visualFindings = await runVisualContrastFallback(page, serializedGroups, options, profile, url);
+    results.push(...visualFindings);
+  } finally {
+    await profileStepAsync(profile, {
+      engine: 'browser',
+      phase: 'load',
+      ruleId: 'close-page',
+      target: url,
+    }, () => page.close().catch(() => {}));
+    if (!externalBrowser) {
+      await profileStepAsync(profile, {
+        engine: 'browser',
+        phase: 'load',
+        ruleId: 'close-browser',
+        target: url,
+      }, () => browser.close());
+    }
+  }
+  return results.map(f => {
+    const item = finding(f.id, url, f.snippet);
+    if (f.ignoreValue) item.ignoreValue = f.ignoreValue;
+    // Per-finding severity promotion (e.g. hero-region pulsing dot)
+    // overrides the registry default carried by finding().
+    if (f.severity && f.severity !== item.severity) item.severity = f.severity;
+    return item;
+  });
+}
+
+async function createBrowserDetector(options = {}) {
+  let puppeteer;
+  try {
+    puppeteer = await import('puppeteer');
+  } catch {
+    throw new Error('puppeteer is required for URL scanning. Install: npm install puppeteer');
+  }
+  const launchArgs = options.launchArgs || (process.env.CI ? ['--no-sandbox', '--disable-setuid-sandbox'] : []);
+  const browser = options.browser || await launchBrowser(puppeteer, {
+    headless: options.headless ?? true,
+    args: launchArgs,
+  });
+  const ownsBrowser = !options.browser;
+  const defaults = {
+    waitUntil: options.waitUntil || 'load',
+    settleMs: Number.isFinite(options.settleMs) ? options.settleMs : 100,
+    viewport: options.viewport || { width: 1280, height: 800 },
+  };
+  return {
+    browser,
+    async detectUrl(url, scanOptions = {}) {
+      return detectUrl(url, {
+        ...defaults,
+        ...scanOptions,
+        browser,
+      });
+    },
+    async close() {
+      if (ownsBrowser) await browser.close().catch(() => {});
+    },
+  };
+}
+
+export { runVisualContrastFallback, detectUrl, createBrowserDetector, launchBrowser };

.github/skills/impeccable/scripts/detector/engines/static-html/detect-html.mjs

@@ -0,0 +1,290 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { GENERIC_FONTS, OVERUSED_FONTS } from '../../shared/constants.mjs';
+import {
+  checkSourceDesignSystem,
+  collectStaticDesignSystemFindings,
+  mergeDesignSystemFindings,
+} from '../../design-system.mjs';
+import { isFullPage } from '../../shared/page.mjs';
+import { applyInlineIgnores } from '../../shared/inline-ignores.mjs';
+import { finding } from '../../findings.mjs';
+import { profileFindings, profileStep, profileStepAsync } from '../../profile/profiler.mjs';
+import {
+  checkElementBorders,
+  checkElementClippedOverflow,
+  checkElementColors,
+  checkElementGlow,
+  checkElementGptBorderShadow,
+  checkElementHeroEyebrow,
+  checkElementHoverContrast,
+  checkElementIconTile,
+  checkElementItalicSerif,
+  checkElementMotion,
+  checkElementOversizedH1,
+  checkElementQuality,
+  checkElementRadialSpotlight,
+  checkCreamPalette,
+  checkHtmlPatterns,
+  checkKickerAboveHeadingFromDoc,
+  scopedIgnoreActive,
+  checkNumberedSectionLabelsFromDoc,
+  checkPageLayout,
+  checkPageQualityFromDoc,
+  checkRepeatedContainerTextFromDoc,
+  resolveBackground,
+  resolveBorderRadiusPx,
+} from '../../rules/checks.mjs';
+import { detectText, runTextContentAnalyzers } from '../regex/detect-text.mjs';
+import {
+  StaticDocument,
+  buildStaticStyleMap,
+  buildStaticWindow,
+  collectStaticCssText,
+} from './css-cascade.mjs';
+
+function checkStaticPageTypography(document, window) {
+  const findings = [];
+  const fonts = new Set();
+  const overusedFound = new Set();
+  for (const el of document.querySelectorAll('p, h1, h2, h3, h4, h5, h6, li, td, th, dd, blockquote, figcaption, a, button, label, span, div')) {
+    const hasText = el.childNodes.some(n => n.nodeType === 3 && n.textContent.trim().length > 0);
+    if (!hasText) continue;
+    const ff = window.getComputedStyle(el).fontFamily || '';
+    const stack = ff.split(',').map(f => f.trim().replace(/^['"]|['"]$/g, '').toLowerCase());
+    const primary = stack.find(f => f && !GENERIC_FONTS.has(f));
+    if (!primary) continue;
+    fonts.add(primary);
+    if (OVERUSED_FONTS.has(primary)) overusedFound.add(primary);
+  }
+  for (const font of overusedFound) {
+    findings.push({ id: 'overused-font', snippet: `Primary font: ${font}` });
+  }
+  const sizes = new Set();
+  for (const el of document.querySelectorAll('h1, h2, h3, h4, h5, h6, p, span, a, li, td, th, label, button, div')) {
+    const fontSize = parseFloat(window.getComputedStyle(el).fontSize);
+    if (fontSize >= 8 && fontSize < 200) sizes.add(Math.round(fontSize * 10) / 10);
+  }
+  if (sizes.size >= 3) {
+    const sorted = [...sizes].sort((a, b) => a - b);
+    const ratio = sorted[sorted.length - 1] / sorted[0];
+    if (ratio < 2.0) {
+      findings.push({ id: 'flat-type-hierarchy', snippet: `Sizes: ${sorted.map(s => s + 'px').join(', ')} (ratio ${ratio.toFixed(1)}:1)` });
+    }
+  }
+  return findings;
+}
+
+function checkElementBrokenImage(el) {
+  const src = (el.getAttribute && el.getAttribute('src')) ?? el.attribs?.src;
+  // Missing src attribute entirely
+  if (src === undefined || src === null) {
+    return [{ id: 'broken-image', snippet: '<img> with no src attribute' }];
+  }
+  const trimmed = String(src).trim();
+  // Empty or placeholder-only src values
+  if (trimmed === '' || trimmed === '#') {
+    return [{ id: 'broken-image', snippet: `<img src="${src}">` }];
+  }
+  return [];
+}
+
+const STATIC_ELEMENT_RULES = [
+  { id: 'border-rules', selector: '*', run: (el, tag, style, window, customPropMap) => checkElementBorders(tag, style, null, resolveBorderRadiusPx(el, style, parseFloat(style.width) || 0, window), el) },
+  { id: 'color-rules', selector: '*', run: (el, tag, style, window, customPropMap) => checkElementColors(el, style, tag, window, customPropMap, false) },
+  { id: 'hover-color-rules', selector: '*', run: (el, tag, style, window) => checkElementHoverContrast(el, style, tag, window) },
+  { id: 'dark-glow', selector: '*', run: (el, tag, style, window, customPropMap) => checkElementGlow(tag, style, resolveBackground(el.parentElement || el, window, customPropMap)) },
+  { id: 'motion-rules', selector: '*', run: (el, tag, style) => checkElementMotion(tag, style) },
+  { id: 'icon-tile-stack', selector: 'h1,h2,h3,h4,h5,h6', run: (el, tag, _style, window) => checkElementIconTile(el, tag, window) },
+  { id: 'italic-serif-display', selector: 'h1,h2', run: (el, tag, style) => checkElementItalicSerif(el, style, tag) },
+  { id: 'hero-eyebrow-chip', selector: 'h1', run: (el, tag, style, window, customPropMap) => checkElementHeroEyebrow(el, style, tag, window, customPropMap) },
+  { id: 'broken-image', selector: 'img', run: (el) => checkElementBrokenImage(el) },
+  { id: 'quality-rules', selector: '*', run: (el, tag, style, window) => checkElementQuality(el, style, tag, window) },
+  { id: 'oversized-h1', selector: 'h1', run: (el, tag, style, window) => checkElementOversizedH1(el, style, tag, window) },
+  { id: 'clipped-overflow-container', selector: '*', run: (el, tag, style, window) => checkElementClippedOverflow(el, style, tag, window) },
+  { id: 'gpt-thin-border-wide-shadow', selector: '*', run: (el, tag, style) => checkElementGptBorderShadow(el, style) },
+  { id: 'radial-spotlight-glow', selector: '*', run: (el, tag, style, window) => checkElementRadialSpotlight(el, style, tag, window) },
+];
+
+async function detectHtml(filePath, options = {}) {
+  const profile = options?.profile;
+  const html = profileStep(profile, {
+    engine: 'static-html',
+    phase: 'setup',
+    ruleId: 'read-html',
+    target: filePath,
+  }, () => fs.readFileSync(filePath, 'utf-8'));
+
+  let modules;
+  try {
+    modules = await profileStepAsync(profile, {
+      engine: 'static-html',
+      phase: 'setup',
+      ruleId: 'import-static-parser',
+      target: filePath,
+    }, async () => {
+      const [htmlparser2, cssSelect, csstree, domutils] = await Promise.all([
+        import('htmlparser2'),
+        import('css-select'),
+        import('css-tree'),
+        import('domutils'),
+      ]);
+      return {
+        parseDocument: htmlparser2.parseDocument,
+        selectAll: cssSelect.selectAll,
+        selectOne: cssSelect.selectOne,
+        compile: cssSelect.compile,
+        csstree,
+        domutils,
+      };
+    });
+  } catch (err) {
+  if (!globalThis.__impeccableStaticHtmlWarned) {
+    globalThis.__impeccableStaticHtmlWarned = true;
+
+    process.stderr.write(
+  'impeccable detect: DEGRADED - HTML parser modules unavailable ' +
+  '(htmlparser2, css-select, css-tree, domutils).\n' +
+  'Falling back to regex matching. Custom properties, selector matching and computed ' +
+  'contrast are NOT evaluated; findings are an undercount, not a clean bill of health.\n'
+);
+  }
+
+  return detectText(html, filePath, options);
+}
+
+  const resolvedPath = path.resolve(filePath);
+  const fileDir = path.dirname(resolvedPath);
+  const root = profileStep(profile, {
+    engine: 'static-html',
+    phase: 'parse-html',
+    ruleId: 'parse-document',
+    target: filePath,
+  }, () => modules.parseDocument(html, { lowerCaseAttributeNames: false, lowerCaseTags: true }));
+
+  const cssText = collectStaticCssText(root, fileDir, profile, filePath, modules);
+  const document = new StaticDocument(root, modules);
+  buildStaticStyleMap(root, document, cssText, modules, profile, filePath);
+  const window = buildStaticWindow(document);
+
+  const customPropMap = null;
+
+  const findings = [];
+  const runElementCheck = (ruleId, callback) => profile
+    ? profileFindings(profile, { engine: 'static-html', phase: 'element', ruleId, target: filePath }, callback)
+    : callback();
+
+  const visitedByRule = new Map();
+  for (const rule of STATIC_ELEMENT_RULES) {
+    const elements = document.querySelectorAll(rule.selector);
+    visitedByRule.set(rule.id, elements.length);
+    for (const el of elements) {
+      const tag = el.tagName.toLowerCase();
+      const style = window.getComputedStyle(el);
+      for (const f of runElementCheck(rule.id, () => rule.run(el, tag, style, window, customPropMap))) {
+        // Element-scoped waivers: a data-impeccable-ignore ancestor suppresses
+        // matching findings for its subtree, same as the browser walk.
+        if (scopedIgnoreActive(el, f.id)) continue;
+        findings.push(finding(f.id, filePath, f.snippet));
+      }
+    }
+  }
+
+  if (options?.designSystem) {
+    const sourceDesignFindings = profileFindings(profile, {
+      engine: 'static-html',
+      phase: 'source',
+      ruleId: 'design-system',
+      target: filePath,
+    }, () => checkSourceDesignSystem(html, filePath, { designSystem: options.designSystem }));
+    const staticDesignFindings = profileFindings(profile, {
+      engine: 'static-html',
+      phase: 'page',
+      ruleId: 'design-system',
+      target: filePath,
+    }, () => collectStaticDesignSystemFindings(document, window, filePath, options.designSystem));
+    findings.push(...mergeDesignSystemFindings(staticDesignFindings, sourceDesignFindings));
+  }
+
+  if (isFullPage(html)) {
+    const runPageCheck = (ruleId, callback) => profile
+      ? profileFindings(profile, { engine: 'static-html', phase: 'page', ruleId, target: filePath }, callback)
+      : callback();
+    for (const f of runPageCheck('typography-rules', () => checkStaticPageTypography(document, window))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    for (const f of runPageCheck('kicker-above-heading', () => checkKickerAboveHeadingFromDoc(document, window))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    for (const f of runPageCheck('numbered-section-labels', () => checkNumberedSectionLabelsFromDoc(document, window))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    for (const f of runPageCheck('repeated-container-text', () => checkRepeatedContainerTextFromDoc(document, window))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    for (const f of runPageCheck('layout-rules', () => checkPageLayout(document, window))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    for (const f of runPageCheck('cream-palette', () => checkCreamPalette(document, window))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    for (const f of runPageCheck('skipped-heading', () => checkPageQualityFromDoc(document))) {
+      findings.push(finding(f.id, filePath, f.snippet));
+    }
+    // Scoped corpora for the pattern checks (see buildHtmlPatternCorpora in
+    // rules/checks.mjs): CSS-property regexes must not fire on prose ABOUT
+    // css — `<code>background-clip: text</code>` in a changelog is
+    // documentation, not styling. cssText already carries the <style>
+    // blocks and any linked local stylesheets; style/class attributes come
+    // from the parsed document, so escaped code samples never contribute.
+    const styleAttrParts = [];
+    const classAttrParts = [];
+    for (const el of document.querySelectorAll('*')) {
+      const styleAttr = el.getAttribute('style');
+      if (styleAttr) styleAttrParts.push(`style="${styleAttr}"`);
+      const classAttr = el.getAttribute('class');
+      if (classAttr) classAttrParts.push(classAttr);
+    }
+    const patternCorpora = {
+      styleText: [cssText, ...styleAttrParts].join('\n'),
+      classText: classAttrParts.join('\n'),
+    };
+    for (const f of runPageCheck('html-patterns', () => checkHtmlPatterns(html, patternCorpora).filter(item =>
+      item.id !== 'bounce-easing' && item.id !== 'layout-transition'
+    ))) {
+      // Selector-backed page findings honor scoped waivers here too, matching
+      // the browser pass: resolve the selector and drop the finding when an
+      // ignoring ancestor covers a match. Unlike the browser, an unmatched
+      // selector keeps the finding — static scans see partial documents.
+      if (f.selector) {
+        let matches = null;
+        try {
+          matches = document.querySelectorAll(String(f.selector).replace(/::?[a-zA-Z-]+(\([^)]*\))?/g, '').trim());
+        } catch { matches = null; }
+        if (matches && matches.length > 0 && [...matches].every(el => scopedIgnoreActive(el, f.id))) continue;
+      }
+      const item = finding(f.id, filePath, f.snippet);
+      // Position-aware severity promotion: checks may attach a per-finding
+      // severity (e.g. a pulsing dot inside a header/nav landmark) that
+      // overrides the registry default.
+      if (f.severity) item.severity = f.severity;
+      findings.push(item);
+    }
+    // Text-content analyzers (em-dash overuse, marketing buzzwords,
+    // numbered section markers, aphoristic cadence) live in the regex
+    // engine. Call them from here so .html files get the same coverage
+    // as .css/.tsx files. These are scoped to text content only and
+    // don't overlap with static-html's element/page rules.
+    for (const f of runPageCheck('text-content', () => runTextContentAnalyzers(html, filePath, options))) {
+      findings.push(finding(f.antipattern, filePath, f.snippet));
+    }
+  }
+
+  // Static-HTML findings carry no line number, so only whole-file
+  // `impeccable-disable` directives apply here — exactly the standalone-document
+  // waiver this primitive targets. Bypassed by `--no-config` / `--no-inline-ignores`.
+  return options?.inlineIgnores === false ? findings : applyInlineIgnores(findings, html);
+}
+
+export { checkStaticPageTypography, STATIC_ELEMENT_RULES, detectHtml };

.github/skills/impeccable/scripts/detector/engines/visual/screenshot-contrast.mjs

@@ -0,0 +1,189 @@
+function sanitizeScreenshotClip(clip, viewport) {
+  if (!clip) return null;
+  const x = Math.max(0, Math.floor(clip.x || 0));
+  const y = Math.max(0, Math.floor(clip.y || 0));
+  const width = Math.min(
+    Math.max(1, Math.ceil(clip.width || 0)),
+    Math.max(1, viewport?.width || 1600),
+  );
+  const height = Math.min(
+    Math.max(1, Math.ceil(clip.height || 0)),
+    320,
+  );
+  if (width < 1 || height < 1) return null;
+  return { x, y, width, height };
+}
+
+async function compareScreenshotContrast(page, beforeBase64, afterBase64, candidate) {
+  return page.evaluate(async ({ beforeBase64, afterBase64, candidate }) => {
+    const loadImage = (base64) => new Promise((resolve, reject) => {
+      const img = new Image();
+      img.onload = () => resolve(img);
+      img.onerror = () => reject(new Error('Could not decode contrast screenshot'));
+      img.src = `data:image/png;base64,${base64}`;
+    });
+    const [before, after] = await Promise.all([loadImage(beforeBase64), loadImage(afterBase64)]);
+    const width = Math.min(before.width, after.width);
+    const height = Math.min(before.height, after.height);
+    if (width < 1 || height < 1) return null;
+
+    const canvas = document.createElement('canvas');
+    canvas.width = width;
+    canvas.height = height;
+    const ctx = canvas.getContext('2d', { willReadFrequently: true });
+    if (!ctx) return null;
+
+    ctx.drawImage(before, 0, 0, width, height);
+    const beforePixels = ctx.getImageData(0, 0, width, height).data;
+    ctx.clearRect(0, 0, width, height);
+    ctx.drawImage(after, 0, 0, width, height);
+    const afterPixels = ctx.getImageData(0, 0, width, height).data;
+
+    const luminance = ({ r, g, b }) => {
+      const convert = c => {
+        const v = c / 255;
+        return v <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4;
+      };
+      return 0.2126 * convert(r) + 0.7152 * convert(g) + 0.0722 * convert(b);
+    };
+    const ratio = (a, b) => {
+      const l1 = luminance(a);
+      const l2 = luminance(b);
+      return (Math.max(l1, l2) + 0.05) / (Math.min(l1, l2) + 0.05);
+    };
+
+    const cssTextColor = candidate.textColor && !candidate.preferRenderedForeground
+      ? {
+          r: candidate.textColor.r,
+          g: candidate.textColor.g,
+          b: candidate.textColor.b,
+        }
+      : null;
+    const ratios = [];
+    let glyphPixels = 0;
+    let strongestDelta = 0;
+    for (let i = 0; i < beforePixels.length; i += 4) {
+      const delta = Math.abs(beforePixels[i] - afterPixels[i])
+        + Math.abs(beforePixels[i + 1] - afterPixels[i + 1])
+        + Math.abs(beforePixels[i + 2] - afterPixels[i + 2])
+        + Math.abs(beforePixels[i + 3] - afterPixels[i + 3]);
+      strongestDelta = Math.max(strongestDelta, delta);
+      if (delta < 10) continue;
+      glyphPixels++;
+      const fg = cssTextColor || {
+        r: beforePixels[i],
+        g: beforePixels[i + 1],
+        b: beforePixels[i + 2],
+      };
+      const bg = {
+        r: afterPixels[i],
+        g: afterPixels[i + 1],
+        b: afterPixels[i + 2],
+      };
+      ratios.push(ratio(fg, bg));
+    }
+
+    if (ratios.length < 8) {
+      return {
+        glyphPixels,
+        strongestDelta,
+        worstRatio: null,
+        p10Ratio: null,
+        medianRatio: null,
+      };
+    }
+
+    ratios.sort((a, b) => a - b);
+    const pick = pct => ratios[Math.min(ratios.length - 1, Math.max(0, Math.floor((pct / 100) * ratios.length)))];
+    return {
+      glyphPixels,
+      strongestDelta,
+      worstRatio: ratios[0],
+      p10Ratio: pick(10),
+      medianRatio: pick(50),
+    };
+  }, { beforeBase64, afterBase64, candidate });
+}
+
+async function captureVisualContrastCandidate(page, candidate, viewport) {
+  const clip = sanitizeScreenshotClip(candidate.clip, viewport);
+  if (!clip) return null;
+
+  const beforeBase64 = await page.screenshot({
+    encoding: 'base64',
+    clip,
+    captureBeyondViewport: true,
+  });
+  const token = `impeccable-contrast-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const applied = await page.evaluate(({ selector, token, backgroundClipText }) => {
+    let el;
+    try {
+      el = document.querySelector(selector);
+    } catch {
+      return false;
+    }
+    if (!el) return false;
+    let style = document.getElementById('impeccable-visual-contrast-hide-style');
+    if (!style) {
+      style = document.createElement('style');
+      style.id = 'impeccable-visual-contrast-hide-style';
+      style.textContent = [
+        '[data-impeccable-visual-contrast-target] {',
+        '  color: transparent !important;',
+        '  -webkit-text-fill-color: transparent !important;',
+        '  text-shadow: none !important;',
+        '}',
+        '[data-impeccable-visual-contrast-target][data-impeccable-bgclip-text="true"] {',
+        '  background-image: none !important;',
+        '}',
+      ].join('\n');
+      document.head.appendChild(style);
+    }
+    el.setAttribute('data-impeccable-visual-contrast-target', token);
+    if (backgroundClipText) el.setAttribute('data-impeccable-bgclip-text', 'true');
+    return true;
+  }, {
+    selector: candidate.selector,
+    token,
+    backgroundClipText: candidate.backgroundClipText,
+  });
+  if (!applied) return null;
+
+  let afterBase64;
+  try {
+    afterBase64 = await page.screenshot({
+      encoding: 'base64',
+      clip,
+      captureBeyondViewport: true,
+    });
+  } finally {
+    await page.evaluate(({ selector }) => {
+      try {
+        const el = document.querySelector(selector);
+        if (el) {
+          el.removeAttribute('data-impeccable-visual-contrast-target');
+          el.removeAttribute('data-impeccable-bgclip-text');
+        }
+      } catch {
+        // Ignore invalid or stale selectors during cleanup.
+      }
+    }, { selector: candidate.selector }).catch(() => {});
+  }
+
+  const metrics = await compareScreenshotContrast(page, beforeBase64, afterBase64, candidate);
+  if (!metrics || !Number.isFinite(metrics.p10Ratio) || metrics.glyphPixels < 8) return null;
+  const measuredRatio = metrics.p10Ratio;
+  if (measuredRatio >= candidate.threshold) return null;
+  const textLabel = candidate.text ? ` "${candidate.text}"` : '';
+  const reasonLabel = (candidate.reasons || []).slice(0, 3).join(', ') || 'visual background';
+  return {
+    id: 'low-contrast',
+    snippet: `pixel contrast ${measuredRatio.toFixed(1)}:1 median ${metrics.medianRatio.toFixed(1)}:1 (need ${candidate.threshold}:1) on ${reasonLabel}${textLabel}`,
+  };
+}
+
+export {
+  sanitizeScreenshotClip,
+  compareScreenshotContrast,
+  captureVisualContrastCandidate,
+};

.github/skills/impeccable/scripts/detector/findings.mjs

@@ -0,0 +1,18 @@
+import { getAntipattern } from './registry/antipatterns.mjs';
+
+function getAP(id) {
+  return getAntipattern(id);
+}
+
+function finding(id, filePath, snippet, line = 0) {
+  const ap = getAP(id);
+  const base = { antipattern: id, name: ap.name, description: ap.description, severity: ap.severity || 'warning', category: ap.category || null, file: filePath, line, snippet };
+  // Advisory findings are detected but reported separately and never counted as
+  // failures. Carry the flag on the finding so every consumer (CLI, JSON, hook)
+  // can partition without a registry lookup. Only stamped when true to keep the
+  // finding shape stable for the vast majority of rules.
+  if (ap.advisory === true) base.advisory = true;
+  return base;
+}
+
+export { getAP, finding };

.github/skills/impeccable/scripts/detector/node/file-system.mjs

@@ -0,0 +1,213 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+// ---------------------------------------------------------------------------
+// File walker
+// ---------------------------------------------------------------------------
+
+// Hidden directories are skipped wholesale during recursion (below), which
+// covers .git / .next / .nuxt / .svelte-kit / .turbo / .vercel and — the
+// issue #303 class — every vendored AI-harness install (.claude, .cursor,
+// .codex, .agents, .impeccable, ...) whose bundled detector source would
+// otherwise be reported as findings on a root scan. Only the non-hidden
+// build/dependency dirs need naming. An explicitly passed hidden target
+// still scans: walkDir name-checks children, never the root it's given.
+const SKIP_DIRS = new Set([
+  'node_modules', 'dist', 'build', '__pycache__',
+]);
+
+// The exceptions to the hidden-dir rule: hidden directories that
+// conventionally hold real UI source rather than tooling or vendored code.
+// VitePress and VuePress keep custom theme components in
+// .vitepress/theme/*.vue / .vuepress/theme/, and Storybook keeps preview
+// decorators/styles in .storybook/.
+const HIDDEN_SOURCE_DIRS = new Set(['.vitepress', '.vuepress', '.storybook']);
+
+const SCANNABLE_EXTENSIONS = new Set([
+  '.html', '.htm', '.css', '.scss', '.sass', '.less',
+  '.jsx', '.tsx', '.js', '.ts',
+  '.vue', '.svelte', '.astro', '.blade.php',
+]);
+
+const HTML_EXTENSIONS = new Set(['.html', '.htm']);
+
+function hasScannableExtension(filename) {
+  const lower = filename.toLowerCase();
+  if (SCANNABLE_EXTENSIONS.has(path.extname(lower))) return true;
+  for (const ext of SCANNABLE_EXTENSIONS) {
+    if (ext.indexOf('.', 1) !== -1 && lower.endsWith(ext)) return true;
+  }
+  return false;
+}
+
+const IMPORT_SPECIFIER_PATTERNS = [
+  /import\s+(?:[\s\S]*?from\s+)?['"]([^'"]+)['"]/g,
+  /@import\s+(?:url\(\s*)?['"]?([^'");\s]+)['"]?\s*\)?/g,
+  /@(?:use|forward)\s+['"]([^'"]+)['"]/g,
+];
+
+function walkDir(dir) {
+  const files = [];
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return files; }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry.name)) continue;
+    if (entry.isDirectory() && entry.name.startsWith('.') && !HIDDEN_SOURCE_DIRS.has(entry.name)) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) files.push(...walkDir(full));
+    else if (hasScannableExtension(entry.name)) files.push(full);
+  }
+  return files;
+}
+
+
+// ---------------------------------------------------------------------------
+// Import graph (multi-file awareness)
+// ---------------------------------------------------------------------------
+
+function resolveImport(specifier, fromDir, fileSet) {
+  if (!/^[./]/.test(specifier)) return null; // skip bare specifiers
+  const base = path.resolve(fromDir, specifier);
+  if (fileSet.has(base)) return base;
+  for (const ext of SCANNABLE_EXTENSIONS) {
+    const withExt = base + ext;
+    if (fileSet.has(withExt)) return withExt;
+  }
+  // index file convention
+  for (const ext of SCANNABLE_EXTENSIONS) {
+    const indexFile = path.join(base, 'index' + ext);
+    if (fileSet.has(indexFile)) return indexFile;
+  }
+  return null;
+}
+
+function buildImportGraph(files) {
+  const fileSet = new Set(files);
+  const graph = new Map();
+
+  for (const file of files) {
+    const content = fs.readFileSync(file, 'utf-8');
+    const dir = path.dirname(file);
+    const imports = new Set();
+
+    for (const pattern of IMPORT_SPECIFIER_PATTERNS) {
+      for (const match of content.matchAll(pattern)) {
+        const resolved = resolveImport(match[1], dir, fileSet);
+        if (resolved) imports.add(resolved);
+      }
+    }
+
+    graph.set(file, imports);
+  }
+  return graph;
+}
+
+// ---------------------------------------------------------------------------
+// Framework dev server detection
+// ---------------------------------------------------------------------------
+
+const FRAMEWORK_CONFIGS = [
+  { name: 'Next.js', files: ['next.config.js', 'next.config.mjs', 'next.config.ts'], defaultPort: 3000,
+    portRe: /port\s*[:=]\s*(\d+)/,
+    fingerprint: { header: 'x-powered-by', value: /next/i } },
+  { name: 'SvelteKit', files: ['svelte.config.js', 'svelte.config.ts'], defaultPort: 5173,
+    portRe: /port\s*[:=]\s*(\d+)/,
+    fingerprint: { header: 'x-sveltekit-page', value: null } },
+  { name: 'Nuxt', files: ['nuxt.config.js', 'nuxt.config.ts'], defaultPort: 3000,
+    portRe: /port\s*[:=]\s*(\d+)/,
+    fingerprint: { header: 'x-powered-by', value: /nuxt/i } },
+  { name: 'Vite', files: ['vite.config.js', 'vite.config.ts', 'vite.config.mjs'], defaultPort: 5173,
+    portRe: /port\s*[:=]\s*(\d+)/,
+    fingerprint: { body: /@vite\/client/ } },
+  { name: 'Astro', files: ['astro.config.js', 'astro.config.ts', 'astro.config.mjs'], defaultPort: 4321,
+    portRe: /port\s*[:=]\s*(\d+)/,
+    fingerprint: { body: /astro/i } },
+  { name: 'Angular', files: ['angular.json'], defaultPort: 4200,
+    portRe: /"port"\s*:\s*(\d+)/,
+    fingerprint: { body: /ng-version/i } },
+  { name: 'Remix', files: ['remix.config.js', 'remix.config.ts'], defaultPort: 3000,
+    portRe: /port\s*[:=]\s*(\d+)/,
+    fingerprint: { header: 'x-powered-by', value: /remix/i } },
+];
+
+function detectFrameworkConfig(dir) {
+  let entries;
+  try { entries = fs.readdirSync(dir); } catch { return null; }
+  const entrySet = new Set(entries);
+
+  for (const cfg of FRAMEWORK_CONFIGS) {
+    const match = cfg.files.find(f => entrySet.has(f));
+    if (!match) continue;
+
+    const configPath = path.join(dir, match);
+    let port = cfg.defaultPort;
+    try {
+      const content = fs.readFileSync(configPath, 'utf-8');
+      const portMatch = content.match(cfg.portRe);
+      if (portMatch) port = parseInt(portMatch[1], 10);
+    } catch { /* use default */ }
+
+    return { name: cfg.name, port, configPath, fingerprint: cfg.fingerprint };
+  }
+  return null;
+}
+
+/**
+ * Check if a port is listening and optionally verify it matches the expected framework.
+ * Returns { listening: true, matched: true/false } or { listening: false }.
+ */
+async function isPortListening(port, fingerprint = null) {
+  if (!fingerprint) {
+    // Simple TCP probe fallback
+    const net = await import('node:net');
+    return new Promise((resolve) => {
+      const sock = net.default.createConnection({ port, host: '127.0.0.1' });
+      sock.setTimeout(500);
+      sock.on('connect', () => { sock.destroy(); resolve({ listening: true, matched: true }); });
+      sock.on('error', () => resolve({ listening: false }));
+      sock.on('timeout', () => { sock.destroy(); resolve({ listening: false }); });
+    });
+  }
+
+  // HTTP probe with fingerprint matching
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2000);
+    const res = await fetch(`http://localhost:${port}/`, { signal: controller.signal, redirect: 'follow' });
+    clearTimeout(timeout);
+
+    // Check header fingerprint
+    if (fingerprint.header) {
+      const val = res.headers.get(fingerprint.header);
+      if (val && (!fingerprint.value || fingerprint.value.test(val))) {
+        return { listening: true, matched: true };
+      }
+    }
+
+    // Check body fingerprint
+    if (fingerprint.body) {
+      const body = await res.text();
+      if (fingerprint.body.test(body)) {
+        return { listening: true, matched: true };
+      }
+    }
+
+    // Port is listening but doesn't match the expected framework
+    return { listening: true, matched: false };
+  } catch {
+    return { listening: false };
+  }
+}
+
+export {
+  SKIP_DIRS,
+  SCANNABLE_EXTENSIONS,
+  HTML_EXTENSIONS,
+  hasScannableExtension,
+  walkDir,
+  resolveImport,
+  buildImportGraph,
+  FRAMEWORK_CONFIGS,
+  detectFrameworkConfig,
+  isPortListening,
+};

.github/skills/impeccable/scripts/detector/profile/profiler.mjs

@@ -0,0 +1,166 @@
+function profileNow() {
+  return typeof performance !== 'undefined' && performance.now
+    ? performance.now()
+    : Date.now();
+}
+
+function createDetectorProfile() {
+  return { events: [] };
+}
+
+function recordProfileEvent(profile, event) {
+  if (!profile) return;
+  const normalized = {
+    engine: event.engine || 'unknown',
+    phase: event.phase || 'unknown',
+    ruleId: event.ruleId || 'unknown',
+    target: event.target || '',
+    ms: Number.isFinite(event.ms) ? event.ms : 0,
+    findings: Number.isFinite(event.findings) ? event.findings : 0,
+  };
+  if (event.detail) normalized.detail = event.detail;
+  if (Array.isArray(event.findingIds) && event.findingIds.length) {
+    normalized.findingIds = event.findingIds;
+  }
+  if (typeof profile === 'function') {
+    profile(normalized);
+  } else if (typeof profile.record === 'function') {
+    profile.record(normalized);
+  } else if (Array.isArray(profile.events)) {
+    profile.events.push(normalized);
+  } else if (Array.isArray(profile)) {
+    profile.push(normalized);
+  }
+}
+
+function extractFindingIds(findings) {
+  if (!Array.isArray(findings) || findings.length === 0) return [];
+  return [...new Set(findings.map(f => f?.id || f?.type || f?.antipattern).filter(Boolean))];
+}
+
+function profileFindings(profile, meta, callback) {
+  if (!profile) return callback();
+  const started = profileNow();
+  const findings = callback();
+  recordProfileEvent(profile, {
+    ...meta,
+    ms: profileNow() - started,
+    findings: Array.isArray(findings) ? findings.length : 0,
+    findingIds: extractFindingIds(findings),
+  });
+  return findings;
+}
+
+function profileStep(profile, meta, callback) {
+  if (!profile) return callback();
+  const started = profileNow();
+  try {
+    return callback();
+  } finally {
+    recordProfileEvent(profile, {
+      ...meta,
+      ms: profileNow() - started,
+      findings: 0,
+    });
+  }
+}
+
+async function profileFindingsAsync(profile, meta, callback) {
+  if (!profile) return callback();
+  const started = profileNow();
+  const findings = await callback();
+  recordProfileEvent(profile, {
+    ...meta,
+    ms: profileNow() - started,
+    findings: Array.isArray(findings) ? findings.length : 0,
+    findingIds: extractFindingIds(findings),
+  });
+  return findings;
+}
+
+async function profileStepAsync(profile, meta, callback) {
+  if (!profile) return callback();
+  const started = profileNow();
+  try {
+    return await callback();
+  } finally {
+    recordProfileEvent(profile, {
+      ...meta,
+      ms: profileNow() - started,
+      findings: 0,
+    });
+  }
+}
+
+function percentile(sortedValues, pct) {
+  if (!sortedValues.length) return 0;
+  const idx = Math.min(
+    sortedValues.length - 1,
+    Math.max(0, Math.ceil((pct / 100) * sortedValues.length) - 1),
+  );
+  return sortedValues[idx];
+}
+
+function summarizeDetectorProfile(profile) {
+  const events = Array.isArray(profile)
+    ? profile
+    : (Array.isArray(profile?.events) ? profile.events : []);
+  const groups = new Map();
+  for (const event of events) {
+    const key = [
+      event.engine || 'unknown',
+      event.phase || 'unknown',
+      event.ruleId || 'unknown',
+      event.target || '',
+    ].join('\u0000');
+    let group = groups.get(key);
+    if (!group) {
+      group = {
+        engine: event.engine || 'unknown',
+        phase: event.phase || 'unknown',
+        ruleId: event.ruleId || 'unknown',
+        target: event.target || '',
+        calls: 0,
+        totalMs: 0,
+        findings: 0,
+        samples: [],
+      };
+      groups.set(key, group);
+    }
+    const ms = Number.isFinite(event.ms) ? event.ms : 0;
+    group.calls += 1;
+    group.totalMs += ms;
+    group.findings += Number.isFinite(event.findings) ? event.findings : 0;
+    group.samples.push(ms);
+  }
+  return [...groups.values()]
+    .map(group => {
+      const samples = group.samples.sort((a, b) => a - b);
+      return {
+        engine: group.engine,
+        phase: group.phase,
+        ruleId: group.ruleId,
+        target: group.target,
+        calls: group.calls,
+        totalMs: Number(group.totalMs.toFixed(3)),
+        avgMs: Number((group.totalMs / group.calls).toFixed(3)),
+        p50: Number(percentile(samples, 50).toFixed(3)),
+        p95: Number(percentile(samples, 95).toFixed(3)),
+        findings: group.findings,
+      };
+    })
+    .sort((a, b) => b.totalMs - a.totalMs);
+}
+
+export {
+  profileNow,
+  createDetectorProfile,
+  recordProfileEvent,
+  extractFindingIds,
+  profileFindings,
+  profileStep,
+  profileFindingsAsync,
+  profileStepAsync,
+  percentile,
+  summarizeDetectorProfile,
+};

.github/skills/impeccable/scripts/detector/registry/antipatterns.mjs

@@ -0,0 +1,617 @@
+const ANTIPATTERNS = [
+  // ── AI slop: tells that something was AI-generated ──
+  {
+    id: 'side-tab',
+    category: 'slop',
+    name: 'Side-tab accent border',
+    description:
+      'Thick colored border on one side of a card — the most recognizable tell of AI-generated UIs. Use a subtler accent or remove it entirely.',
+    skillSection: 'Visual Details',
+    skillGuideline: 'colored accent stripe',
+  },
+  {
+    id: 'border-accent-on-rounded',
+    category: 'slop',
+    name: 'Border accent on rounded element',
+    description:
+      'Thick accent border on a rounded card — the border clashes with the rounded corners. Remove the border or the border-radius.',
+    skillSection: 'Visual Details',
+    skillGuideline: 'colored accent stripe',
+  },
+  {
+    id: 'overused-font',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Overused font',
+    description:
+      'Inter, Roboto, Fraunces, Geist, Plus Jakarta Sans, and Space Grotesk are used on so many sites they no longer feel distinctive. Each new wave of AI-generated UIs converges on the same handful of faces. Choose a face that gives your interface personality.',
+    skillSection: 'Typography',
+    skillGuideline: 'overused fonts like Inter',
+  },
+  {
+    id: 'flat-type-hierarchy',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Flat type hierarchy',
+    description:
+      'Font sizes are too close together — no clear visual hierarchy. Use fewer sizes with more contrast (aim for at least a 1.25 ratio between steps).',
+    skillSection: 'Typography',
+    skillGuideline: 'flat type hierarchy',
+  },
+  {
+    id: 'gradient-text',
+    category: 'slop',
+    name: 'Gradient text',
+    description:
+      'Gradient text is decorative rather than meaningful — a common AI tell, especially on headings and metrics. Use solid colors for text.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'gradient text for',
+  },
+  {
+    id: 'ai-color-palette',
+    category: 'slop',
+    name: 'AI color palette',
+    description:
+      'Purple/violet gradients and cyan-on-dark are the most recognizable tells of AI-generated UIs. Choose a distinctive, intentional palette.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'AI color palette',
+  },
+  {
+    id: 'cream-palette',
+    category: 'slop',
+    name: 'Cream / beige palette',
+    description:
+      'A warm cream or beige page background has become the default "tasteful" AI surface, reached for by reflex. Choose a background that comes from a deliberate palette, not the safe warm off-white.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'cream and beige as the default surface',
+  },
+  {
+    id: 'nested-cards',
+    category: 'slop',
+    scopes: ['layout'],
+    name: 'Nested cards',
+    description:
+      'Cards inside cards create visual noise and excessive depth. Flatten the hierarchy — use spacing, typography, and dividers instead of nesting containers.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'Nest cards inside cards',
+  },
+  {
+    id: 'monotonous-spacing',
+    category: 'slop',
+    scopes: ['layout'],
+    name: 'Monotonous spacing',
+    description:
+      'The same spacing value used everywhere — no rhythm, no variation. Use tight groupings for related items and generous separations between sections.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'same spacing everywhere',
+  },
+  {
+    id: 'bounce-easing',
+    category: 'slop',
+    name: 'Bounce or elastic easing',
+    description:
+      'Bounce and elastic easing feel dated and tacky. Real objects decelerate smoothly — use exponential easing (ease-out-quart/quint/expo) instead.',
+    skillSection: 'Motion',
+    skillGuideline: 'bounce or elastic easing',
+  },
+  {
+    id: 'pulsing-dot',
+    category: 'slop',
+    name: 'Pulsing status dot',
+    description:
+      'Small pulsing status dots simulate liveness decoratively. Reserve pulse animation for indicators tied to genuinely live, changing data; a static indicator with clear labeling is honest and calmer.',
+    skillSection: 'Motion',
+    skillGuideline: 'decorative pulsing status dot',
+  },
+  {
+    id: 'blinking-cursor',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Decorative blinking cursor',
+    description:
+      'A blinking text cursor animated into a hero or landing section simulates typing where no input exists. It borrows the dev-tool aesthetic as decoration. Real editable fields draw their own caret; anywhere else, let the composition hold attention without a fake prompt.',
+    skillSection: 'Motion',
+  },
+  {
+    id: 'shape-assembled-illustration',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Shape-assembled illustration',
+    description:
+      'A large inline SVG that builds a pictorial scene from a pile of primitive shapes reads as placeholder clip art, not illustration. Icons, logos, and data graphics are fine at their scale; a hero-sized visual deserves real artwork, a photograph, or a deliberately drawn graphic.',
+    skillSection: 'Imagery',
+  },
+  {
+    id: 'dark-glow',
+    category: 'slop',
+    name: 'Glowing shadow accents',
+    description:
+      'Colored glow shadows — a zero-offset chromatic halo (box- or text-shadow) on any background, or any colored blurred shadow on a dark background — are the default "cool" look of AI-generated UIs. Use neutral elevation shadows and subtle, purposeful lighting instead.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'dark mode with glowing accents',
+  },
+  {
+    id: 'radial-halo',
+    category: 'slop',
+    name: 'Radial-gradient background halo',
+    description:
+      'A chromatic radial-gradient wash — saturated at the center, fading to transparent — used as a decorative background glow on a dark page. Same tell as glowing shadows, drawn with a gradient instead of a shadow. Ground the surface with a solid or subtly shifted background instead.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'dark mode with glowing accents',
+  },
+  {
+    id: 'radial-spotlight-glow',
+    category: 'slop',
+    name: 'Decorative radial spotlight glow',
+    description:
+      'A soft, low-opacity accent-colored radial gradient fading to transparent, dropped behind a hero or section as a "spotlight." It is a reflex AI decoration — the translucent cousin of the saturated radial halo. Let the surface stand on its own, or light the composition with a deliberate material accent rather than a floating colored haze.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'dark mode with glowing accents',
+  },
+  {
+    id: 'marquee',
+    category: 'slop',
+    name: 'Auto-scrolling marquee',
+    description:
+      'Continuously auto-scrolling content demands attention it has not earned and hides half its content at any moment. Reserve motion for content that changes; let readers move at their own pace.',
+    skillSection: 'Motion',
+    skillGuideline: 'auto-scrolling marquee',
+  },
+  {
+    id: 'icon-tile-stack',
+    category: 'slop',
+    scopes: ['layout'],
+    name: 'Icon tile stacked above heading',
+    description:
+      'A small rounded-square icon container above a heading is the universal AI feature-card template — every generator outputs this exact shape. Try a side-by-side icon and heading, or let the icon sit in flow without its own container.',
+    skillSection: 'Typography',
+    skillGuideline: 'large icons with rounded corners above every heading',
+  },
+  {
+    id: 'italic-serif-display',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Italic serif display headline',
+    description:
+      'Oversized italic serif (Fraunces, Recoleta, Playfair, Newsreader-italic) as the primary hero headline reads as taste in isolation but has become the universal AI-startup landing page hero. Set roman, or move to a non-serif display face. Editorial / magazine register may legitimately want this — judge by context.',
+    skillSection: 'Typography',
+    skillGuideline: 'oversized italic serif as the hero headline',
+  },
+  {
+    id: 'hero-eyebrow-chip',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Hero eyebrow / pill chip',
+    description:
+      'A tiny uppercase letter-spaced label sitting immediately above an oversized hero headline — or the same shape rendered as a pill chip — is now the default AI SaaS hero. Drop the eyebrow, integrate the kicker into the headline, or run it as a navigation breadcrumb instead.',
+    skillSection: 'Typography',
+    skillGuideline: 'tiny uppercase tracked label above the hero headline',
+  },
+  {
+    id: 'kicker-above-heading',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Kicker / eyebrow label above heading',
+    description:
+      'A tiny tracked uppercase or small-caps label sitting as its own block directly above a heading is banned outright, repeated or not. Generated kickers never earn their place: the heading carries its own weight. Delete the label and let the heading speak; if the words matter, work them into the heading or the body.',
+    skillSection: 'Typography',
+    skillGuideline: 'kicker or eyebrow labels above headings',
+  },
+  {
+    id: 'numbered-section-labels',
+    category: 'slop',
+    scopes: ['type'],
+    severity: 'advisory',
+    name: 'Tiny numbered section labels',
+    description:
+      'Small numeric index labels riding next to section headings, repeated section after section, are AI editorial scaffolding — a page numbering its own chapters instead of earning structure. Let hierarchy, content, and rhythm carry the sequence.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'numbered section markers',
+  },
+  {
+    id: 'em-dash-overuse',
+    category: 'slop',
+    // Advisory: humans use em-dashes legitimately, so this rule is opt-in noise
+    // rather than a failure. It fires only on the AI saturation pattern, not on
+    // ordinary prose. Advisory findings are surfaced separately, never counted
+    // as failures, and skipped by the design hook unless a project opts in.
+    advisory: true,
+    name: 'Em-dash overuse',
+    description:
+      'Em-dash saturation in body copy is an AI cadence tell. Advisory only: humans use em-dashes legitimately, so this fires only on saturation — at least 8 em-dashes (— or --) at a density near one per 500 characters of body text — never on a long article that uses a few. Prefer commas, colons, periods, or parentheses.',
+    skillSection: 'Copy',
+    skillGuideline: 'no em dashes',
+  },
+  {
+    id: 'marketing-buzzword',
+    category: 'slop',
+    name: 'Marketing buzzword',
+    description:
+      'Generic SaaS phrases (streamline / empower / supercharge / world-class / enterprise-grade / next-generation / cutting-edge / etc) are instant AI tells. Pick a specific verb and noun that says what the product literally does.',
+    skillSection: 'Copy',
+    skillGuideline: 'marketing buzzwords',
+  },
+  {
+    id: 'aphoristic-cadence',
+    category: 'slop',
+    name: 'Aphoristic-cadence copy',
+    description:
+      'Three or more sections landing on a short rebuttal sentence ("X. No Y." / "X. Just Y.") or a manufactured-contrast aphorism ("Not a feature. A platform.") reads as AI cadence, not voice. Once is fine; the pattern is the tell.',
+    skillSection: 'Copy',
+    skillGuideline: 'aphoristic cadence',
+  },
+  {
+    id: 'oversized-h1',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Oversized hero headline',
+    description:
+      'A full-sentence headline set at display size ends up dominating the viewport, leaving no room for anything else above the fold. A punchy one- or two-word headline at that size is fine — the problem is a long headline blown up too large. Set long headlines smaller, or tighten the copy.',
+    skillSection: 'Typography',
+    skillGuideline: 'long headline set at display size',
+  },
+  {
+    id: 'extreme-negative-tracking',
+    category: 'slop',
+    scopes: ['type'],
+    name: 'Crushed letter spacing',
+    description:
+      'Letter-spacing pulled tighter than the point where characters keep their own shapes costs legibility. Tighten display type optically, not destructively.',
+    skillSection: 'Typography',
+    skillGuideline: 'letter spacing crushed past legibility',
+  },
+  {
+    id: 'broken-image',
+    category: 'quality',
+    name: 'Broken or placeholder image',
+    description:
+      '<img> tags with empty src, missing src, or placeholder values ship as broken-image boxes. Use real images, generated assets, or remove the tag.',
+    skillSection: 'Imagery',
+    skillGuideline: 'broken image references',
+  },
+
+  // ── Quality: general design and accessibility issues ──
+  {
+    id: 'script-error',
+    category: 'quality',
+    severity: 'error',
+    name: 'Uncaught script error on load',
+    description:
+      'A script threw an uncaught exception or failed to parse while the page loaded. Broken JavaScript silently kills reveals, interactions, and dynamic content, and can leave most of a page invisible. Fix the error before judging anything else.',
+  },
+  {
+    id: 'content-hidden-at-rest',
+    category: 'quality',
+    severity: 'error',
+    scopes: ['layout'],
+    name: 'Content invisible at rest',
+    description:
+      'A large share of the page text sits at opacity 0 or visibility hidden even after every reveal handler had a chance to run. This is the failed-reveal signature: the content shipped but never becomes visible. Make content visible by default and let JavaScript enhance its entrance instead of gating its existence.',
+  },
+  {
+    id: 'edge-flush-cards',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'Cards flush against the scroller edge',
+    description:
+      'Cards inside a horizontal scroller or tab panel sit flush against the container edge at rest while keeping a gutter on the other side, so their edges and rounded corners get cut off. Usually the panel is sized wider than its clip box. Keep a consistent inset on both sides.',
+  },
+  {
+    id: 'text-occlusion',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'Text occluded by an overlapping element',
+    description:
+      'Text is painted under an opaque element or a second text run, so part of it cannot be read. A decorative box, a stacked layer, or an inline element with leaked padding lands on the words instead of beside them. Give overlapping layers room, or move the text out from under the layer above it.',
+    skillSection: 'Layout & Space',
+  },
+  {
+    id: 'first-viewport-column-overflow',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'One column stretches the first viewport',
+    description:
+      'A multi-column opening section lets one column run far past the fold while its sibling fits in a single viewport, so the short column floats in dead space and the fold falls deep inside one section. Balance the columns, cap the tall one, or let the long content flow below the opening row.',
+    skillSection: 'Layout & Space',
+  },
+  {
+    id: 'gray-on-color',
+    category: 'quality',
+    name: 'Gray text on colored background',
+    description:
+      'Gray text looks washed out on colored backgrounds. Use a darker shade of the background color instead, or white/near-white for contrast.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'gray text on colored backgrounds',
+  },
+  {
+    id: 'low-contrast',
+    category: 'quality',
+    name: 'Low contrast text',
+    description:
+      'Text does not meet WCAG AA contrast requirements (4.5:1 for body, 3:1 for large text). Increase the contrast between text and background.',
+  },
+  {
+    id: 'layout-transition',
+    category: 'quality',
+    name: 'Layout property animation',
+    description:
+      'Animating width, height, padding, or margin causes layout thrash and janky performance. Use transform and opacity instead, or grid-template-rows for height animations.',
+    skillSection: 'Motion',
+    skillGuideline: 'Animate layout properties',
+  },
+  {
+    id: 'line-length',
+    category: 'quality',
+    scopes: ['type', 'layout'],
+    name: 'Line length too long',
+    description:
+      'Text lines wider than ~80 characters are hard to read. The eye loses its place tracking back to the start of the next line. Add a max-width (65ch to 75ch) to text containers.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'wrap beyond ~80 characters',
+  },
+  {
+    id: 'cramped-padding',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'Cramped padding',
+    description:
+      'Text is too close to the edge of its container. Two shapes: (1) an element with its own text where the padding is too low for the font size, and (2) a wrapper with text-bearing children and near-zero padding against a visible boundary (border, outline, or non-transparent background) — children land flush against the boundary line. Add at least 8px (ideally 12–16px) of padding inside bordered, outlined, or colored containers.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'inside bordered or colored containers',
+  },
+  {
+    id: 'body-text-viewport-edge',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'Body text touching viewport edge',
+    description:
+      'Body paragraphs render flush against the left or right viewport edge with no container providing horizontal padding. Wrap content in a container with at least 16px (ideally 24-32px) of horizontal padding, or apply max-width with mx-auto.',
+  },
+  {
+    id: 'tight-leading',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Tight line height',
+    description:
+      'Line height below 1.3x the font size makes multi-line text hard to read. Use 1.5 to 1.7 for body text so lines have room to breathe.',
+  },
+  {
+    id: 'skipped-heading',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Skipped heading level',
+    description:
+      'Heading levels should not skip (e.g. h1 then h3 with no h2). Screen readers use heading hierarchy for navigation. Skipping levels breaks the document outline.',
+  },
+  {
+    id: 'heading-rhythm',
+    category: 'quality',
+    scopes: ['layout', 'type'],
+    name: 'Heading crowded against the previous block',
+    description:
+      'A heading binds to the content it introduces, so the rendered space above it should exceed the space below it. When headings across a page sit as close or closer to the block above than to their own content, every section reads as if it captions the previous one. Open up the space above each heading.',
+    skillSection: 'Layout & Space',
+  },
+  {
+    id: 'justified-text',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Justified text',
+    description:
+      'Justified text without hyphenation creates uneven word spacing ("rivers of white"). Use text-align: left for body text, or enable hyphens: auto if you must justify.',
+  },
+  {
+    id: 'tiny-text',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Tiny body text',
+    description:
+      'Body text below 12px is hard to read, especially on high-DPI screens. Use at least 14px for body content, 16px is ideal.',
+  },
+  {
+    id: 'undersized-ui-text',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Undersized functional text',
+    description:
+      'Interactive and content-bearing UI text (links, buttons, nav items, labels, table cells, meta rows, timecodes) below 11px is a legibility failure, not a style choice. WCAG sets no absolute pixel floor, but functional text under 11px is a defensible quality bar: it fails on high-DPI and small viewports and it degrades tap and read targets. The 11px floor holds even inside a footer; only non-interactive legal smallprint gets the softer 10px floor. Being ON the DESIGN.md size ramp does not exempt a value here: adding 8px to the ramp launders the token but not the legibility problem, and that is exactly the escape hatch this rule closes. Exempts sup/sub, visually-hidden (sr-only) text, and code/terminal contexts. Decorative letterspaced micro-labels are still functional and stay in scope.',
+  },
+  {
+    id: 'all-caps-body',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'All-caps body text',
+    description:
+      'Long passages in uppercase are hard to read. We recognize words by shape (ascenders and descenders), which all-caps removes. Reserve uppercase for short labels and headings.',
+    skillSection: 'Typography',
+    skillGuideline: 'long body passages in uppercase',
+  },
+  {
+    id: 'wide-tracking',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Wide letter spacing on body text',
+    description:
+      'Letter spacing above 0.05em on body text disrupts natural character groupings and slows reading. Reserve wide tracking for short uppercase labels only.',
+  },
+  {
+    id: 'text-overflow',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'Content overflowing its container',
+    description:
+      'Content renders wider than its container, spilling out or forcing a horizontal scrollbar. Let text wrap, constrain widths, or give the region a deliberate scroll affordance.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'content wider than its container',
+  },
+  {
+    id: 'repeated-container-text',
+    category: 'quality',
+    name: 'Same text repeated inside one container',
+    description:
+      'The same literal text rendered three or more times in structurally different spots inside a single card or panel is redundant messaging — usually a status or label wired into every slot of a template. Say it once, in the slot where it matters most.',
+  },
+  {
+    id: 'clipped-overflow-container',
+    category: 'quality',
+    scopes: ['layout'],
+    name: 'Positioned child clipped by overflow container',
+    description:
+      'A clipping container (overflow hidden or clip) wrapping an absolutely-positioned child cuts off tooltips, menus, and popovers that need to escape. Let the overflow be visible, or move the positioned layer out of the clip.',
+    skillSection: 'Layout & Space',
+    skillGuideline: 'overflow container clipping positioned children',
+  },
+  {
+    id: 'design-system-font',
+    category: 'quality',
+    scopes: ['type'],
+    name: 'Font outside DESIGN.md',
+    description:
+      'A font is used that is not declared in DESIGN.md typography. Use the documented type system or update DESIGN.md if this is an intentional brand addition.',
+    skillSection: 'Typography',
+    skillGuideline: 'font family outside the project design system',
+  },
+  {
+    id: 'design-system-color',
+    category: 'quality',
+    severity: 'advisory',
+    name: 'Color outside DESIGN.md',
+    description:
+      'A literal color is outside the DESIGN.md palette and sidecar tonal ramps. This may be legitimate, but it should be an intentional design-system addition rather than drift.',
+    skillSection: 'Color & Contrast',
+    skillGuideline: 'literal color outside the project design system',
+  },
+  {
+    id: 'design-system-radius',
+    category: 'quality',
+    severity: 'advisory',
+    name: 'Radius outside DESIGN.md',
+    description:
+      'A border-radius value is outside the DESIGN.md rounded scale. Use a documented radius token or update the design system if the new shape is intentional.',
+    skillSection: 'Visual Details',
+    skillGuideline: 'border radius outside the project design system',
+  },
+  {
+    id: 'design-system-font-size',
+    category: 'quality',
+    severity: 'advisory',
+    scopes: ['type'],
+    name: 'Font size outside DESIGN.md',
+    description:
+      'A literal font-size is off the type ramp documented in DESIGN.md typography. Use a documented size step or update the design system if the new step is intentional.',
+    skillSection: 'Typography',
+    skillGuideline: 'font size outside the project design system',
+  },
+
+  // ── Common generated-UI tells ───────────────────────────────────────────
+  {
+    id: 'gpt-thin-border-wide-shadow',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Hairline border with wide shadow',
+    description:
+      'A hairline border paired with a wide, diffuse shadow is a recurring generated-UI signature. Commit to one — a defined edge or a soft elevation — rather than both at once.',
+    skillSection: 'Visual Details',
+    skillGuideline: 'hairline border plus wide diffuse shadow',
+  },
+  {
+    id: 'repeating-stripes-gradient',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Repeating-gradient stripes',
+    description:
+      'Repeating-gradient stripes used as surface decoration are a recurring generated-UI signature. Reach for a deliberate texture or leave the surface plain.',
+    skillSection: 'Visual Details',
+    skillGuideline: 'repeating-gradient decorative stripes',
+  },
+  {
+    id: 'codex-grid-background',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Decorative grid-line background',
+    description:
+      'A decorative grid or line-field background drawn with hairline linear-gradient layers tiled by a fixed pixel cell is a recurring generated-UI signature. Reserve grid overlays for actual canvas, map, blueprint, or measurement surfaces; elsewhere use product structure or a plain surface.',
+    skillSection: 'Visual Details',
+    skillGuideline: 'two-axis grid-line gradient background',
+  },
+  {
+    id: 'theater-slop-phrase',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Theater framing copy',
+    description:
+      'Dismissing something as "theater" is a recurring generated-copy tic. Say plainly what the thing does or does not do.',
+    skillSection: 'Copy',
+    skillGuideline: 'theater framing copy',
+  },
+  {
+    id: 'image-hover-transform',
+    category: 'slop',
+    severity: 'advisory',
+    name: 'Image hover transform',
+    description:
+      'Scaling or rotating an image on hover is a recurring generated-UI signature. Let imagery sit still, or use a subtler, purposeful interaction.',
+    skillSection: 'Motion',
+    skillGuideline: 'image scale or rotate on hover',
+  },
+];
+
+const RULE_ENGINE_SUPPORT = {
+  regex: new Set(['source', 'page-analyzer']),
+  'static-html': new Set(['element', 'page']),
+  browser: new Set(['element', 'page', 'layout']),
+  visual: new Set(['visual-contrast']),
+};
+
+function getAntipattern(id) {
+  return ANTIPATTERNS.find(rule => rule.id === id);
+}
+
+// Advisory rules are detected and reported, but never treated as failures:
+// the CLI lists them under a separate "Advisory" section, they do not affect
+// exit codes or the failure count, and the design hook skips them by default.
+// The set is derived from the registry so a rule only needs `advisory: true`.
+const ADVISORY_RULE_IDS = new Set(
+  ANTIPATTERNS.filter(rule => rule.advisory === true).map(rule => rule.id),
+);
+
+function isAdvisoryRule(id) {
+  return ADVISORY_RULE_IDS.has(id);
+}
+
+function getRulesForCategory(category) {
+  return ANTIPATTERNS.filter(rule => rule.category === category);
+}
+
+function getRuleEngineSupport(engine) {
+  return RULE_ENGINE_SUPPORT[engine] || new Set();
+}
+
+// Set of scope tags rules can declare (e.g. 'type', 'layout'). Used by the
+// CLI --scope flag to narrow output to one design domain.
+const RULE_SCOPES = new Set(
+  ANTIPATTERNS.flatMap(rule => rule.scopes || []),
+);
+
+// Keep only findings whose rule declares at least one of the requested
+// scopes. An empty scope list means no filtering (default CLI behavior).
+function filterByScopes(findings, scopes = []) {
+  if (!scopes || scopes.length === 0) return findings;
+  const enabled = new Set(scopes);
+  return findings.filter(f => {
+    const rule = getAntipattern(f.antipattern);
+    return (rule?.scopes || []).some(scope => enabled.has(scope));
+  });
+}
+
+export {
+  ANTIPATTERNS,
+  RULE_SCOPES,
+  RULE_ENGINE_SUPPORT,
+  ADVISORY_RULE_IDS,
+  getAntipattern,
+  getRulesForCategory,
+  getRuleEngineSupport,
+  isAdvisoryRule,
+  filterByScopes,
+};

.github/skills/impeccable/scripts/detector/shared/color.mjs

@@ -0,0 +1,596 @@
+// ─── Section 2: Color Utilities ─────────────────────────────────────────────
+
+function isNeutralColor(color) {
+  if (!color || color === 'transparent') return true;
+
+  // rgb/rgba — use channel spread. Threshold 30 ≈ 11.7% of the 0–255 range.
+  const rgb = color.match(/rgba?\((\d+),\s*(\d+),\s*(\d+)/);
+  if (rgb) {
+    return (Math.max(+rgb[1], +rgb[2], +rgb[3]) - Math.min(+rgb[1], +rgb[2], +rgb[3])) < 30;
+  }
+
+  // oklch()/lch() — chroma is the second numeric component.
+  // oklch chroma is ~0–0.4 in sRGB gamut; >= 0.02 reads as tinted, not gray.
+  // lch chroma is ~0–150; >= 3 reads as tinted. jsdom emits both formats
+  // literally (it does NOT convert them to rgb).
+  const oklch = color.match(/oklch\(\s*[\d.]+%?\s*([\d.-]+)/i);
+  if (oklch) return parseFloat(oklch[1]) < 0.02;
+  const lch = color.match(/lch\(\s*[\d.]+%?\s*([\d.-]+)/i);
+  if (lch) return parseFloat(lch[1]) < 3;
+
+  // oklab()/lab() — a and b are signed axes; chroma = sqrt(a² + b²).
+  // oklab a/b are ~-0.4..0.4, threshold 0.02. lab a/b are ~-128..127, threshold 3.
+  const oklab = color.match(/oklab\(\s*[\d.]+%?\s*([\d.-]+)\s+([\d.-]+)/i);
+  if (oklab) {
+    const a = parseFloat(oklab[1]), b = parseFloat(oklab[2]);
+    return Math.hypot(a, b) < 0.02;
+  }
+  const lab = color.match(/lab\(\s*[\d.]+%?\s*([\d.-]+)\s+([\d.-]+)/i);
+  if (lab) {
+    const a = parseFloat(lab[1]), b = parseFloat(lab[2]);
+    return Math.hypot(a, b) < 3;
+  }
+
+  // hsl/hsla — saturation is the second numeric component (percent).
+  // Modern jsdom usually converts hsl() to rgb, but handle it directly for
+  // safety across versions and for any engine that preserves the format.
+  const hsl = color.match(/hsla?\(\s*[\d.-]+\s*,?\s*([\d.]+)%/i);
+  if (hsl) return parseFloat(hsl[1]) < 10;
+
+  // hwb(hue whiteness% blackness%) — a pixel is fully gray when
+  // whiteness + blackness >= 100; chroma-like saturation = 1 - (w+b)/100.
+  const hwb = color.match(/hwb\(\s*[\d.-]+\s+([\d.]+)%\s+([\d.]+)%/i);
+  if (hwb) {
+    const w = parseFloat(hwb[1]), b = parseFloat(hwb[2]);
+    return (1 - Math.min(100, w + b) / 100) < 0.1;
+  }
+
+  // Unknown / unrecognized format — err on the side of DETECTING rather
+  // than silently skipping. This is the opposite of the previous default,
+  // which was the root cause of the oklch bug.
+  return false;
+}
+
+function parseRgb(color) {
+  if (!color || color === 'transparent') return null;
+  const m = color.match(/rgba?\((\d+),\s*(\d+),\s*(\d+)(?:,\s*([\d.]+))?\)/);
+  if (!m) return null;
+  return { r: +m[1], g: +m[2], b: +m[3], a: m[4] !== undefined ? +m[4] : 1 };
+}
+
+function relativeLuminance({ r, g, b }) {
+  const [rs, gs, bs] = [r / 255, g / 255, b / 255].map(c =>
+    c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4
+  );
+  return 0.2126 * rs + 0.7152 * gs + 0.0722 * bs;
+}
+
+function contrastRatio(c1, c2) {
+  const l1 = relativeLuminance(c1);
+  const l2 = relativeLuminance(c2);
+  return (Math.max(l1, l2) + 0.05) / (Math.min(l1, l2) + 0.05);
+}
+
+// The CSS color functions worth pulling out of a longer declaration. The set
+// is deliberately closed: `linear-gradient(` and `url(` also look like
+// `name(` and must not be read as colors.
+const COLOR_FUNCTION_NAMES = new Set([
+  'rgb', 'rgba', 'hsl', 'hsla', 'hwb', 'oklch', 'oklab', 'lch', 'lab', 'color', 'color-mix',
+]);
+
+// Pull every color-function token out of a value, with balanced-paren capture
+// so nested forms (`color-mix(in oklab, oklch(...) 20%, transparent)`) survive
+// whole. Returns the raw substrings in source order.
+function extractColorFunctionTokens(value) {
+  const str = String(value || '');
+  const tokens = [];
+  const re = /([a-z][a-z-]*)\(/gi;
+  let m;
+  while ((m = re.exec(str)) !== null) {
+    if (!COLOR_FUNCTION_NAMES.has(m[1].toLowerCase())) continue;
+    let depth = 0, end = -1;
+    for (let i = m.index + m[0].length - 1; i < str.length; i++) {
+      if (str[i] === '(') depth++;
+      else if (str[i] === ')') { depth--; if (depth === 0) { end = i; break; } }
+    }
+    if (end < 0) break;
+    tokens.push(str.slice(m.index, end + 1));
+    re.lastIndex = end + 1;
+  }
+  return tokens;
+}
+
+function parseGradientColors(bgImage) {
+  if (!bgImage || !bgImage.includes('gradient')) return [];
+  const colors = [];
+  const tokenSpans = [];
+  let from = 0;
+  // Stops arrive in whatever syntax the author wrote and the browser kept.
+  // A dark ground painted as `linear-gradient(oklch(...), oklch(...))` used
+  // to read as a gradient with no stops at all.
+  for (const token of extractColorFunctionTokens(bgImage)) {
+    const start = bgImage.indexOf(token, from);
+    if (start < 0) break;
+    tokenSpans.push({ start, end: start + token.length });
+    from = start + token.length;
+    const c = parseAnyColor(token);
+    if (c) colors.push(c);
+  }
+  for (const m of bgImage.matchAll(/#([0-9a-f]{6}|[0-9a-f]{3})\b/gi)) {
+    // Nested hex inside color-mix is an ingredient, not a stop (issue #578).
+    if (tokenSpans.some(s => m.index >= s.start && m.index < s.end)) continue;
+    const h = m[1];
+    if (h.length === 6) {
+      colors.push({ r: parseInt(h.slice(0,2),16), g: parseInt(h.slice(2,4),16), b: parseInt(h.slice(4,6),16), a: 1 });
+    } else {
+      colors.push({ r: parseInt(h[0]+h[0],16), g: parseInt(h[1]+h[1],16), b: parseInt(h[2]+h[2],16), a: 1 });
+    }
+  }
+  return colors;
+}
+
+function hasChroma(c, threshold = 30) {
+  if (!c) return false;
+  return (Math.max(c.r, c.g, c.b) - Math.min(c.r, c.g, c.b)) >= threshold;
+}
+
+function getHue(c) {
+  if (!c) return 0;
+  const r = c.r / 255, g = c.g / 255, b = c.b / 255;
+  const max = Math.max(r, g, b), min = Math.min(r, g, b);
+  if (max === min) return 0;
+  const d = max - min;
+  let h;
+  if (max === r) h = ((g - b) / d + (g < b ? 6 : 0)) / 6;
+  else if (max === g) h = ((b - r) / d + 2) / 6;
+  else h = ((r - g) / d + 4) / 6;
+  return Math.round(h * 360);
+}
+
+function colorToHex(c) {
+  if (!c) return '?';
+  return '#' + [c.r, c.g, c.b].map(v => v.toString(16).padStart(2, '0')).join('');
+}
+
+// ─── Color-space conversions ────────────────────────────────────────────────
+//
+// Every function here lands on 8-bit sRGB, clamped to gamut. Chrome, Safari,
+// and Firefox all keep the authored color space in getComputedStyle output
+// (`oklch(0.84 0.19 80.46)`, `lch(20 5 60)`, `color(srgb 1.04 0.72 -0.21)`),
+// so a detector that only reads rgb() is blind on any modern palette. The
+// expected outputs are pinned in tests/detect-antipatterns.test.js against
+// what Chrome itself paints for the same strings.
+
+function clamp01(x) {
+  return Number.isFinite(x) ? Math.max(0, Math.min(1, x)) : 0;
+}
+
+// Linear-light sRGB channel to the encoded 0-255 value.
+function encodeSrgbChannel(x) {
+  const c = clamp01(x);
+  return Math.round((c <= 0.0031308 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055) * 255);
+}
+
+function decodeSrgbChannel(x) {
+  const c = Number.isFinite(x) ? x : 0;
+  const sign = c < 0 ? -1 : 1;
+  const abs = Math.abs(c);
+  return sign * (abs <= 0.04045 ? abs / 12.92 : Math.pow((abs + 0.055) / 1.055, 2.4));
+}
+
+function linearSrgbToColor(r, g, b, a = 1) {
+  return { r: encodeSrgbChannel(r), g: encodeSrgbChannel(g), b: encodeSrgbChannel(b), a };
+}
+
+// OKLab to sRGB (Björn Ottosson's matrices). L in 0..1, a/b are signed axes.
+function oklabToRgb(L, a, b) {
+  const l_ = L + 0.3963377774 * a + 0.2158037573 * b;
+  const m_ = L - 0.1055613458 * a - 0.0638541728 * b;
+  const s_ = L - 0.0894841775 * a - 1.2914855480 * b;
+  const lc = l_ * l_ * l_, mc = m_ * m_ * m_, sc = s_ * s_ * s_;
+  return linearSrgbToColor(
+     4.0767416621 * lc - 3.3077115913 * mc + 0.2309699292 * sc,
+    -1.2684380046 * lc + 2.6097574011 * mc - 0.3413193965 * sc,
+    -0.0041960863 * lc - 0.7034186147 * mc + 1.7076147010 * sc,
+  );
+}
+
+// OKLCH to sRGB. L in 0..1, C in 0..~0.4 typical, H in degrees. Chroma past
+// the sRGB gamut clamps per channel rather than producing NaN.
+function oklchToRgb(L, C, H) {
+  const hRad = (H * Math.PI) / 180;
+  return oklabToRgb(L, C * Math.cos(hRad), C * Math.sin(hRad));
+}
+
+// CIE Lab to sRGB. CSS lab()/lch() use the D50 white point; the matrix below
+// is the Bradford-adapted XYZ-D50 to linear-sRGB transform from CSS Color 4.
+function labToRgb(L, a, b) {
+  const kappa = 24389 / 27, epsilon = 216 / 24389;
+  const fy = (L + 16) / 116, fx = fy + a / 500, fz = fy - b / 200;
+  const invert = (t) => (t * t * t > epsilon ? t * t * t : (116 * t - 16) / kappa);
+  const yr = L > kappa * epsilon ? Math.pow((L + 16) / 116, 3) : L / kappa;
+  const Xn = 0.3457 / 0.3585, Zn = (1 - 0.3457 - 0.3585) / 0.3585;
+  const x = invert(fx) * Xn, y = yr, z = invert(fz) * Zn;
+  return linearSrgbToColor(
+     3.1341359569958707 * x - 1.6173863321612538 * y - 0.4906619460083532 * z,
+    -0.9787955029120890 * x + 1.9162545672595240 * y + 0.0334427311613195 * z,
+     0.0719553798841168 * x - 0.2289768264158322 * y + 1.4053860583241250 * z,
+  );
+}
+
+function lchToRgb(L, C, H) {
+  const hRad = (H * Math.PI) / 180;
+  return labToRgb(L, C * Math.cos(hRad), C * Math.sin(hRad));
+}
+
+// color(<space> c1 c2 c3) for the spaces that turn up in real stylesheets.
+// `srgb` is what Chrome serializes most color-mix() results into, routinely
+// with channels outside 0..1. Spaces we do not model return null so callers
+// abstain instead of measuring against a color we invented.
+function colorFunctionToRgb(space, c1, c2, c3) {
+  switch (space) {
+    case 'srgb':
+      return { r: Math.round(clamp01(c1) * 255), g: Math.round(clamp01(c2) * 255), b: Math.round(clamp01(c3) * 255), a: 1 };
+    case 'srgb-linear':
+      return linearSrgbToColor(c1, c2, c3);
+    case 'display-p3': {
+      const [R, G, B] = [decodeSrgbChannel(c1), decodeSrgbChannel(c2), decodeSrgbChannel(c3)];
+      return linearSrgbToColor(
+         1.2249401762805587 * R - 0.2249404646817506 * G + 0.0000002884022551 * B,
+        -0.0420569547096138 * R + 1.0420571661298634 * G - 0.0000002113202247 * B,
+        -0.0196375587040044 * R - 0.0786360772174755 * G + 1.0982736359214800 * B,
+      );
+    }
+    default:
+      return null;
+  }
+}
+
+function hslToRgb(h, s, l) {
+  h = ((h % 360) + 360) % 360;
+  const c = (1 - Math.abs(2 * l - 1)) * s;
+  const x = c * (1 - Math.abs(((h / 60) % 2) - 1));
+  const m0 = l - c / 2;
+  const [r, g, b] =
+    h < 60 ? [c, x, 0] :
+    h < 120 ? [x, c, 0] :
+    h < 180 ? [0, c, x] :
+    h < 240 ? [0, x, c] :
+    h < 300 ? [x, 0, c] : [c, 0, x];
+  return {
+    r: Math.round((r + m0) * 255),
+    g: Math.round((g + m0) * 255),
+    b: Math.round((b + m0) * 255),
+    a: 1,
+  };
+}
+
+function hwbToRgb(h, w, bl) {
+  if (w + bl >= 1) {
+    const g = Math.round((w / (w + bl)) * 255);
+    return { r: g, g, b: g, a: 1 };
+  }
+  const base = hslToRgb(h, 1, 0.5);
+  const mix = (c) => Math.round(((c / 255) * (1 - w - bl) + w) * 255);
+  return { r: mix(base.r), g: mix(base.g), b: mix(base.b), a: 1 };
+}
+
+// Common CSS named colors — the handful that actually show up in generated
+// UIs, not the full 148-name spec list. Includes the achromatic names so a
+// named gray parses (and correctly reads as no-chroma) instead of being
+// treated as an unknown color.
+const CSS_NAMED_COLORS = {
+  black: { r: 0, g: 0, b: 0 },
+  white: { r: 255, g: 255, b: 255 },
+  gray: { r: 128, g: 128, b: 128 },
+  grey: { r: 128, g: 128, b: 128 },
+  silver: { r: 192, g: 192, b: 192 },
+  dimgray: { r: 105, g: 105, b: 105 },
+  darkgray: { r: 169, g: 169, b: 169 },
+  lightgray: { r: 211, g: 211, b: 211 },
+  gainsboro: { r: 220, g: 220, b: 220 },
+  whitesmoke: { r: 245, g: 245, b: 245 },
+  red: { r: 255, g: 0, b: 0 },
+  crimson: { r: 220, g: 20, b: 60 },
+  tomato: { r: 255, g: 99, b: 71 },
+  coral: { r: 255, g: 127, b: 80 },
+  salmon: { r: 250, g: 128, b: 114 },
+  orange: { r: 255, g: 165, b: 0 },
+  gold: { r: 255, g: 215, b: 0 },
+  yellow: { r: 255, g: 255, b: 0 },
+  olive: { r: 128, g: 128, b: 0 },
+  lime: { r: 0, g: 255, b: 0 },
+  green: { r: 0, g: 128, b: 0 },
+  teal: { r: 0, g: 128, b: 128 },
+  turquoise: { r: 64, g: 224, b: 208 },
+  cyan: { r: 0, g: 255, b: 255 },
+  aqua: { r: 0, g: 255, b: 255 },
+  skyblue: { r: 135, g: 206, b: 235 },
+  dodgerblue: { r: 30, g: 144, b: 255 },
+  blue: { r: 0, g: 0, b: 255 },
+  navy: { r: 0, g: 0, b: 128 },
+  indigo: { r: 75, g: 0, b: 130 },
+  rebeccapurple: { r: 102, g: 51, b: 153 },
+  purple: { r: 128, g: 0, b: 128 },
+  violet: { r: 238, g: 130, b: 238 },
+  orchid: { r: 218, g: 112, b: 214 },
+  magenta: { r: 255, g: 0, b: 255 },
+  fuchsia: { r: 255, g: 0, b: 255 },
+  hotpink: { r: 255, g: 105, b: 180 },
+  pink: { r: 255, g: 192, b: 203 },
+  maroon: { r: 128, g: 0, b: 0 },
+};
+
+// Split a string on top-level commas (ignoring commas nested in parens).
+function splitTopLevelCommas(str) {
+  const parts = [];
+  let depth = 0, start = 0;
+  for (let i = 0; i < str.length; i++) {
+    const ch = str[i];
+    if (ch === '(') depth++;
+    else if (ch === ')') depth = Math.max(0, depth - 1);
+    else if (ch === ',' && depth === 0) {
+      parts.push(str.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  const tail = str.slice(start).trim();
+  if (tail) parts.push(tail);
+  return parts;
+}
+
+// Evaluate a CSS color-mix() expression to {r,g,b,a}. Returns null when
+// the expression can't be resolved (unresolved var(), unknown colors).
+//
+// Mixing is done with premultiplied alpha in sRGB regardless of the
+// declared interpolation space. That is exact for the dominant generated-UI
+// pattern — `color-mix(in oklab, <color> N%, transparent)` — where the
+// result is simply <color> at alpha N% in ANY rectangular space, and a
+// close-enough approximation for opaque-opaque mixes (the detector only
+// consumes these values for contrast/chroma thresholds, not for display).
+function parseColorMix(str) {
+  const m = String(str).trim().match(/^color-mix\(/i);
+  if (!m) return null;
+  // Balanced-paren capture of the arguments.
+  let depth = 0, end = -1;
+  const open = str.indexOf('(');
+  for (let i = open; i < str.length; i++) {
+    if (str[i] === '(') depth++;
+    else if (str[i] === ')') { depth--; if (depth === 0) { end = i; break; } }
+  }
+  if (end < 0) return null;
+  const args = splitTopLevelCommas(str.slice(open + 1, end));
+  if (args.length !== 3 || !/^in\s/i.test(args[0])) return null;
+
+  const parseComponent = (component) => {
+    // Percentage may lead or trail the color per spec.
+    let pct = null;
+    let colorStr = component;
+    const trail = component.match(/\s+([\d.]+)%$/);
+    const lead = component.match(/^([\d.]+)%\s+/);
+    if (trail) { pct = parseFloat(trail[1]); colorStr = component.slice(0, trail.index).trim(); }
+    else if (lead) { pct = parseFloat(lead[1]); colorStr = component.slice(lead[0].length).trim(); }
+    let color;
+    if (/^transparent$/i.test(colorStr)) color = { r: 0, g: 0, b: 0, a: 0 };
+    else color = parseAnyColor(colorStr);
+    if (!color) return null;
+    return { color, pct };
+  };
+
+  const c1 = parseComponent(args[1]);
+  const c2 = parseComponent(args[2]);
+  if (!c1 || !c2) return null;
+  let p1 = c1.pct, p2 = c2.pct;
+  if (p1 == null && p2 == null) { p1 = 50; p2 = 50; }
+  else if (p1 == null) p1 = 100 - p2;
+  else if (p2 == null) p2 = 100 - p1;
+  const sum = p1 + p2;
+  if (sum <= 0) return null;
+  // Per spec: weights normalize to sum; when sum < 100 the result alpha is
+  // additionally scaled by sum/100.
+  const w1 = p1 / sum, w2 = p2 / sum;
+  const alphaScale = sum < 100 ? sum / 100 : 1;
+  const a1 = c1.color.a ?? 1, a2 = c2.color.a ?? 1;
+  const a = (a1 * w1 + a2 * w2) * alphaScale;
+  if (a <= 0) return { r: 0, g: 0, b: 0, a: 0 };
+  const mix = (ch) => Math.round((c1.color[ch] * a1 * w1 + c2.color[ch] * a2 * w2) / (a1 * w1 + a2 * w2));
+  return { r: mix('r'), g: mix('g'), b: mix('b'), a: Math.min(1, a) };
+}
+
+// Composite a translucent color over an opaque(ish) base (simple
+// source-over in sRGB). Returns an opaque {r,g,b,a:1}.
+function compositeColorOver(top, base) {
+  const a = top.a ?? 1;
+  return {
+    r: Math.round(top.r * a + base.r * (1 - a)),
+    g: Math.round(top.g * a + base.g * (1 - a)),
+    b: Math.round(top.b * a + base.b * (1 - a)),
+    a: 1,
+  };
+}
+
+// A color() / lab() / lch() component: a bare number, a percentage against
+// `scale`, or the `none` keyword (which resolves to zero for our purposes).
+function parseColorComponent(token, scale = 1) {
+  if (token == null) return null;
+  const t = String(token).trim();
+  if (/^none$/i.test(t)) return 0;
+  const num = parseFloat(t);
+  if (!Number.isFinite(num)) return null;
+  return t.endsWith('%') ? (num / 100) * scale : num;
+}
+
+function parseAlphaToken(token) {
+  if (token == null) return 1;
+  const t = String(token).trim();
+  if (/^none$/i.test(t)) return 1;
+  const num = parseFloat(t);
+  if (!Number.isFinite(num)) return 1;
+  return t.endsWith('%') ? num / 100 : num;
+}
+
+// Extended color parser: rgb/rgba/hex/oklch/oklab/lch/lab/hsl/hwb/color()/
+// color-mix/common named colors. Returns null on no match. Use this when the
+// input might be any CSS color form; use plain parseRgb when you only expect
+// computed rgb() values from real browsers.
+function parseAnyColor(s) {
+  if (!s || typeof s !== 'string') return null;
+  const str = s.trim();
+  if (str === 'transparent' || str === 'currentcolor' || str === 'inherit') return null;
+  if (/^color-mix\(/i.test(str)) return parseColorMix(str);
+  let m;
+  m = str.match(/rgba?\(\s*(\d+(?:\.\d+)?)\s*,?\s*(\d+(?:\.\d+)?)\s*,?\s*(\d+(?:\.\d+)?)(?:\s*[,/]\s*([\d.]+)(%)?)?\s*\)/);
+  if (m) {
+    const c = { r: Math.round(+m[1]), g: Math.round(+m[2]), b: Math.round(+m[3]), a: 1 };
+    if (m[4] !== undefined) c.a = m[5] === '%' ? parseFloat(m[4]) / 100 : +m[4];
+    return c;
+  }
+  m = str.match(/^#([0-9a-f]{3,8})$/i);
+  if (m) {
+    const h = m[1];
+    if (h.length === 3 || h.length === 4) {
+      return {
+        r: parseInt(h[0] + h[0], 16),
+        g: parseInt(h[1] + h[1], 16),
+        b: parseInt(h[2] + h[2], 16),
+        a: h.length === 4 ? parseInt(h[3] + h[3], 16) / 255 : 1,
+      };
+    }
+    if (h.length === 6 || h.length === 8) {
+      return {
+        r: parseInt(h.slice(0, 2), 16),
+        g: parseInt(h.slice(2, 4), 16),
+        b: parseInt(h.slice(4, 6), 16),
+        a: h.length === 8 ? parseInt(h.slice(6, 8), 16) / 255 : 1,
+      };
+    }
+  }
+  // OKLCH parser. Tailwind v4's CSS minifier squishes the space after
+  // `%` ("21.5%.02 50"), so the separator between L and C may be absent.
+  // Match L (with optional %), then C and H separated permissively.
+  m = str.match(/oklch\(\s*([\d.]+)(%?)\s*[\s,]*\s*([\d.]+)\s*[\s,]+\s*([-\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+)(%)?)?\s*\)/i);
+  if (m) {
+    const Lnum = parseFloat(m[1]);
+    const L = m[2] === '%' ? Lnum / 100 : Lnum;
+    const rgb = oklchToRgb(L, parseFloat(m[3]), parseFloat(m[4]));
+    if (m[5] !== undefined) {
+      const alpha = parseFloat(m[5]);
+      rgb.a = m[6] === '%' ? alpha / 100 : alpha;
+    }
+    return rgb;
+  }
+  // OKLAB — a/b are signed axes; percentages map 100% → 0.4.
+  m = str.match(/oklab\(\s*([\d.]+)(%?)\s+(-?[\d.]+)(%?)\s+(-?[\d.]+)(%?)(?:\s*\/\s*([\d.]+)(%)?)?\s*\)/i);
+  if (m) {
+    const L = m[2] === '%' ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+    const a = m[4] === '%' ? parseFloat(m[3]) * 0.004 : parseFloat(m[3]);
+    const b = m[6] === '%' ? parseFloat(m[5]) * 0.004 : parseFloat(m[5]);
+    const rgb = oklabToRgb(L, a, b);
+    if (m[7] !== undefined) {
+      const alpha = parseFloat(m[7]);
+      rgb.a = m[8] === '%' ? alpha / 100 : alpha;
+    }
+    return rgb;
+  }
+  // LCH / LAB — CIE, D50 white point. Chrome serializes lch(20% 5 60) as
+  // `lch(20 5 60)`, so L arrives with or without its percent sign. In both
+  // spaces L runs 0..100 and 100% means 100.
+  m = str.match(/^lch\(\s*([\d.]+%?|none)\s+([\d.]+%?|none)\s+(-?[\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?|none))?\s*\)$/i);
+  if (m) {
+    const L = parseColorComponent(m[1], 100);
+    const C = parseColorComponent(m[2], 150);
+    const H = parseFloat(m[3]);
+    if (L == null || C == null || !Number.isFinite(H)) return null;
+    const rgb = lchToRgb(L, C, H);
+    rgb.a = parseAlphaToken(m[4]);
+    return rgb;
+  }
+  m = str.match(/^lab\(\s*([\d.]+%?|none)\s+(-?[\d.]+%?|none)\s+(-?[\d.]+%?|none)(?:\s*\/\s*([\d.]+%?|none))?\s*\)$/i);
+  if (m) {
+    const L = parseColorComponent(m[1], 100);
+    const a = parseColorComponent(m[2], 125);
+    const b = parseColorComponent(m[3], 125);
+    if (L == null || a == null || b == null) return null;
+    const rgb = labToRgb(L, a, b);
+    rgb.a = parseAlphaToken(m[4]);
+    return rgb;
+  }
+  // color(<space> c1 c2 c3 [/ alpha]) — what Chrome hands back for most
+  // color-mix() results and for any wide-gamut color an author wrote.
+  m = str.match(/^color\(\s*([a-z0-9-]+)\s+(-?[\d.eE+-]+%?|none)\s+(-?[\d.eE+-]+%?|none)\s+(-?[\d.eE+-]+%?|none)(?:\s*\/\s*([\d.]+%?|none))?\s*\)$/i);
+  if (m) {
+    const c1 = parseColorComponent(m[2]);
+    const c2 = parseColorComponent(m[3]);
+    const c3 = parseColorComponent(m[4]);
+    if (c1 == null || c2 == null || c3 == null) return null;
+    const rgb = colorFunctionToRgb(m[1].toLowerCase(), c1, c2, c3);
+    if (!rgb) return null;
+    rgb.a = parseAlphaToken(m[5]);
+    return rgb;
+  }
+  // HSL/HSLA — comma or space syntax, optional deg on hue.
+  m = str.match(/hsla?\(\s*(-?[\d.]+)(?:deg)?\s*[,\s]\s*([\d.]+)%\s*[,\s]\s*([\d.]+)%(?:\s*[,/]\s*([\d.]+)(%)?)?\s*\)/i);
+  if (m) {
+    const rgb = hslToRgb(parseFloat(m[1]), parseFloat(m[2]) / 100, parseFloat(m[3]) / 100);
+    if (m[4] !== undefined) {
+      const alpha = parseFloat(m[4]);
+      rgb.a = m[5] === '%' ? alpha / 100 : alpha;
+    }
+    return rgb;
+  }
+  // HWB — hue whiteness% blackness%.
+  m = str.match(/hwb\(\s*(-?[\d.]+)(?:deg)?\s+([\d.]+)%\s+([\d.]+)%(?:\s*\/\s*([\d.]+)(%)?)?\s*\)/i);
+  if (m) {
+    const rgb = hwbToRgb(parseFloat(m[1]), parseFloat(m[2]) / 100, parseFloat(m[3]) / 100);
+    if (m[4] !== undefined) {
+      const alpha = parseFloat(m[4]);
+      rgb.a = m[5] === '%' ? alpha / 100 : alpha;
+    }
+    return rgb;
+  }
+  const named = CSS_NAMED_COLORS[str.toLowerCase()];
+  if (named) return { ...named, a: 1 };
+  return null;
+}
+
+// True when a computed background-color string names no paint at all. Used to
+// tell "this layer is see-through" (walk on to the ancestor) apart from "this
+// layer has a color we could not read" (stop and abstain).
+//
+// `inherit` belongs here even though it is not literally see-through: it means
+// "paint with the parent's background-color", and walking on to the parent IS
+// that resolution. Real browsers resolve the keyword before getComputedStyle
+// output; only jsdom's partial cascade hands it through verbatim, and treating
+// it as unreadable would make the walk abstain on a surface it can know.
+// (`currentcolor` is NOT here — it is real paint in the element's own text
+// color; resolveBackgroundInfo substitutes the computed color for it.)
+function isNoPaintColorValue(value) {
+  const v = String(value || '').trim().toLowerCase();
+  if (!v) return true;
+  return v === 'transparent' || v === 'none' || v === 'initial' || v === 'inherit' || v === 'unset' || v === 'revert' || v === 'revert-layer';
+}
+
+export {
+  isNeutralColor,
+  parseRgb,
+  relativeLuminance,
+  contrastRatio,
+  parseGradientColors,
+  extractColorFunctionTokens,
+  hasChroma,
+  getHue,
+  colorToHex,
+  oklabToRgb,
+  oklchToRgb,
+  labToRgb,
+  lchToRgb,
+  colorFunctionToRgb,
+  hslToRgb,
+  hwbToRgb,
+  CSS_NAMED_COLORS,
+  splitTopLevelCommas,
+  parseColorMix,
+  parseAnyColor,
+  compositeColorOver,
+  isNoPaintColorValue,
+};

.github/skills/impeccable/scripts/detector/shared/constants.mjs

@@ -0,0 +1,112 @@
+// ─── Section 1: Constants ───────────────────────────────────────────────────
+
+const SAFE_TAGS = new Set([
+  'blockquote', 'nav', 'a', 'input', 'textarea', 'select',
+  'pre', 'code', 'span', 'th', 'td', 'tr', 'li', 'label',
+  'button', 'hr', 'html', 'head', 'body', 'script', 'style',
+  'link', 'meta', 'title', 'br', 'img', 'svg', 'path', 'circle',
+  'rect', 'line', 'polyline', 'polygon', 'g', 'defs', 'use',
+]);
+
+// Per-check safe-tags override for the border (side-tab / border-accent)
+// rule. We intentionally re-allow <label> here because card-shaped clickable
+// labels (e.g. .checklist-item wrapping a checkbox + content) are one of the
+// canonical side-tab anti-pattern shapes and must be detected. The rule's
+// other preconditions (non-neutral color, width >= 2px on a single side,
+// radius > 0 or width >= 3, element size >= 20x20 in the browser path)
+// already filter out plain inline form labels so this does not introduce
+// false positives. See modern-color-borders.html for the test matrix.
+const BORDER_SAFE_TAGS = new Set(
+  [...SAFE_TAGS].filter(t => t !== 'label')
+);
+
+const OVERUSED_FONTS = new Set([
+  // Older monoculture (still ubiquitous):
+  'inter', 'roboto', 'open sans', 'lato', 'montserrat', 'arial', 'helvetica',
+  // Newer monoculture (the Anthropic-skill / Vercel / GitHub default wave):
+  'fraunces', 'instrument sans', 'instrument serif',
+  'geist', 'geist sans', 'geist mono',
+  'mona sans',
+  'plus jakarta sans', 'space grotesk', 'recoleta',
+]);
+
+// Brand-associated fonts: don't flag these as "overused" on the brand's own domains.
+// Keys are font names, values are arrays of hostname suffixes where the font is allowed.
+const GOOGLE_DOMAINS = [
+  'google.com', 'youtube.com', 'android.com', 'chromium.org',
+  'chrome.com', 'web.dev', 'gstatic.com', 'firebase.google.com',
+];
+const VERCEL_DOMAINS = ['vercel.com', 'nextjs.org', 'v0.app'];
+const GITHUB_DOMAINS = ['github.com', 'githubnext.com'];
+const BRAND_FONT_DOMAINS = {
+  'roboto': GOOGLE_DOMAINS,
+  'google sans': GOOGLE_DOMAINS,
+  'product sans': GOOGLE_DOMAINS,
+  'geist': VERCEL_DOMAINS,
+  'geist sans': VERCEL_DOMAINS,
+  'geist mono': VERCEL_DOMAINS,
+  'mona sans': GITHUB_DOMAINS,
+};
+
+function isBrandFontOnOwnDomain(font) {
+  if (typeof location === 'undefined') return false;
+  const allowed = BRAND_FONT_DOMAINS[font];
+  if (!allowed) return false;
+  const host = location.hostname.toLowerCase();
+  return allowed.some(suffix => host === suffix || host.endsWith('.' + suffix));
+}
+
+const GENERIC_FONTS = new Set([
+  'serif', 'sans-serif', 'monospace', 'cursive', 'fantasy',
+  'system-ui', 'ui-serif', 'ui-sans-serif', 'ui-monospace', 'ui-rounded',
+  '-apple-system', 'blinkmacsystemfont', 'segoe ui',
+  'inherit', 'initial', 'unset', 'revert',
+]);
+
+// WCAG large text thresholds are defined in points: 18pt normal text and
+// 14pt bold text. Browsers expose font-size in CSS pixels at 96px per inch.
+const WCAG_LARGE_TEXT_PX = 18 * (96 / 72);
+const WCAG_LARGE_BOLD_TEXT_PX = 14 * (96 / 72);
+
+// Em-dash overuse (advisory) thresholds, shared by the regex/static-HTML
+// analyzer and the browser DOM check so both fire on the same saturation
+// pattern. Two gates must hold: an absolute floor of EM_DASH_FLOOR dashes, and
+// a density of at least one dash per EM_DASH_CHARS_PER_DASH characters of body
+// text. A long article that uses a few em-dashes is left alone; a short,
+// dash-per-clause page is not.
+const EM_DASH_FLOOR = 8;
+const EM_DASH_CHARS_PER_DASH = 500;
+
+// Serif faces that show up in italic-display heroes. The rule also fires when
+// the primary face is unknown but the stack ends in the generic `serif` token,
+// which catches custom/private faces with a serif fallback.
+const KNOWN_SERIF_FONTS = new Set([
+  'fraunces', 'recoleta', 'newsreader', 'playfair display', 'playfair',
+  'cormorant', 'cormorant garamond', 'garamond', 'eb garamond',
+  'tiempos', 'tiempos headline', 'tiempos text',
+  'lora', 'vollkorn', 'spectral',
+  'source serif pro', 'source serif 4', 'source serif',
+  'ibm plex serif', 'merriweather',
+  'libre caslon', 'libre baskerville', 'baskerville',
+  'georgia', 'times new roman', 'times',
+  'dm serif display', 'dm serif text',
+  'instrument serif', 'gt sectra', 'ogg', 'canela',
+  'freight display', 'freight text',
+]);
+
+export {
+  SAFE_TAGS,
+  BORDER_SAFE_TAGS,
+  OVERUSED_FONTS,
+  GOOGLE_DOMAINS,
+  VERCEL_DOMAINS,
+  GITHUB_DOMAINS,
+  BRAND_FONT_DOMAINS,
+  isBrandFontOnOwnDomain,
+  GENERIC_FONTS,
+  WCAG_LARGE_TEXT_PX,
+  WCAG_LARGE_BOLD_TEXT_PX,
+  EM_DASH_FLOOR,
+  EM_DASH_CHARS_PER_DASH,
+  KNOWN_SERIF_FONTS,
+};

.github/skills/impeccable/scripts/detector/shared/fonts.mjs

@@ -0,0 +1,30 @@
+const GOOGLE_FONTS_URL_RE = /fonts\.googleapis\.com\/css2?\?[^"'\s)<>]*/gi;
+
+function normalizeGoogleFontFamilyParam(value) {
+  return String(value || '')
+    .split('|')
+    .map(part => part.split(':')[0].trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function extractGoogleFontFamilies(text) {
+  const families = [];
+  if (!text) return families;
+
+  GOOGLE_FONTS_URL_RE.lastIndex = 0;
+  let urlMatch;
+  while ((urlMatch = GOOGLE_FONTS_URL_RE.exec(text)) !== null) {
+    const url = urlMatch[0];
+    const queryStart = url.indexOf('?');
+    if (queryStart === -1) continue;
+
+    const params = new URLSearchParams(url.slice(queryStart + 1).replace(/&amp;/g, '&'));
+    for (const value of params.getAll('family')) {
+      families.push(...normalizeGoogleFontFamilyParam(value));
+    }
+  }
+
+  return families;
+}
+
+export { extractGoogleFontFamilies };

.github/skills/impeccable/scripts/detector/shared/inline-ignores.mjs

@@ -0,0 +1,148 @@
+/**
+ * Inline, in-file ignore directives — eslint-disable-style waivers that live at
+ * the point they apply and travel with the artifact instead of (or alongside)
+ * an ignore in `.impeccable/config.json`.
+ *
+ * A config ignore is the right default for repo-wide policy. This complements it
+ * for the one case config can't cover: a waiver that belongs to a single file and
+ * needs to follow that file when it leaves the repo — a generated/exported
+ * standalone document, an emailed HTML file, a snippet scanned out of context.
+ *
+ * Comment-syntax-agnostic: the directive is a raw token matched anywhere on a
+ * line, so the same marker works across every comment style impeccable scans —
+ * `//`, `/* *\/`, `<!-- -->`, `#`, `{/* *\/}`, `{# #}`. Trailing comment closers
+ * are stripped before the rule list is parsed.
+ *
+ * Syntax (reason optional; eslint `--` or biome `:` separator):
+ *
+ *   impeccable-disable <rule>[, <rule>...] [-- reason]   whole file
+ *   impeccable-disable-line <rule>...      [-- reason]   the same line
+ *   impeccable-disable-next-line <rule>... [-- reason]   the following line
+ *   impeccable-disable                                   bare / `*` = every rule
+ *
+ * Examples:
+ *
+ *   <!-- impeccable-disable overused-font -- exported brand doc, font is first-party -->
+ *   .brand { font-family: Inter; } /* impeccable-disable-line overused-font *\/
+ *   // impeccable-disable-next-line bounce-easing: intentional playful affordance
+ *
+ * Behavior is suppression, for parity with config ignores: a matched directive
+ * drops the finding. The inline reason is self-documenting in the diff; it is not
+ * required and is discarded at scan time (only used here to keep reason words out
+ * of the parsed rule list).
+ */
+
+const DIRECTIVE_RE = /impeccable-(disable-next-line|disable-line|disable)\b[ \t]*([^\n\r]*)/gi;
+
+// Trailing comment closers, so `*/`, `*/}`, `-->`, `*}`, `#}`, `%>`, `}}` don't
+// leak into the rule list. Anchored to end-of-line; the leading `\s*` mops up the
+// space before the closer. `--+>` covers `-->` and any longer dash run.
+const TRAILING_CLOSER_RE = /\s*(?:\*\/\}?|--+>|\*\}|#\}|%>|\}\})\s*$/;
+
+function normalizeRule(token) {
+  return String(token || '').trim().toLowerCase();
+}
+
+// Split the directive remainder into rule tokens, dropping any human reason that
+// follows an eslint-style `--` or biome-style `:` separator. Rule ids only ever
+// contain single hyphens (`overused-font`, `bounce-easing`), so `--` and `:`
+// are unambiguous separators.
+function parseRuleList(remainder) {
+  let text = String(remainder || '').replace(TRAILING_CLOSER_RE, '').trim();
+  // Cut off a human reason at the first `--` (eslint) or `:` (biome) separator.
+  const reasonSep = text.match(/\s*(?:--+|:)\s*/);
+  if (reasonSep) text = text.slice(0, reasonSep.index);
+  const tokens = text.split(/[\s,]+/).map(normalizeRule).filter(Boolean);
+  if (tokens.length === 0 || tokens.includes('*')) return ['*'];
+  return tokens;
+}
+
+function addRules(set, rules) {
+  for (const rule of rules) set.add(rule);
+}
+
+function getSet(map, key) {
+  let set = map.get(key);
+  if (!set) {
+    set = new Set();
+    map.set(key, set);
+  }
+  return set;
+}
+
+/**
+ * Parse every inline ignore directive in a file's raw text.
+ *
+ * Returns sets keyed by the 1-based line the directive *targets* so matching is a
+ * direct lookup:
+ *   - file:     rules disabled for the whole file
+ *   - line:     line -> rules disabled on that exact line (disable-line)
+ *   - nextLine: line -> rules disabled on that line (disable-next-line on line-1)
+ *
+ * `*` in any set means "every rule".
+ */
+function parseInlineIgnores(content) {
+  const result = { file: new Set(), line: new Map(), nextLine: new Map() };
+  const text = typeof content === 'string' ? content : '';
+  // Cheap bail-out: the substring must be present for any directive to exist.
+  // Case-insensitive to match DIRECTIVE_RE's `i` flag (e.g. `Impeccable-Disable`).
+  if (!/impeccable-disable/i.test(text)) return result;
+
+  // Split on `\n` only, exactly as detectText numbers lines, so directive line
+  // keys line up with finding `line` values (incl. on `\r`-only line endings).
+  // The directive regex excludes `\r`, so a trailing `\r` on `\r\n` files is
+  // never captured into the rule list.
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    DIRECTIVE_RE.lastIndex = 0;
+    let m;
+    while ((m = DIRECTIVE_RE.exec(lines[i])) !== null) {
+      const variant = m[1].toLowerCase();
+      const rules = parseRuleList(m[2]);
+      if (variant === 'disable') {
+        addRules(result.file, rules);
+      } else if (variant === 'disable-line') {
+        addRules(getSet(result.line, i + 1), rules);
+      } else {
+        // disable-next-line on line i+1 targets line i+2.
+        addRules(getSet(result.nextLine, i + 2), rules);
+      }
+    }
+  }
+  return result;
+}
+
+function setMatches(set, rule) {
+  return Boolean(set) && (set.has('*') || set.has(rule));
+}
+
+function isInlineIgnored(finding, directives) {
+  const rule = normalizeRule(finding && finding.antipattern);
+  if (!rule) return false;
+  if (setMatches(directives.file, rule)) return true;
+  const line = Number(finding && finding.line) || 0;
+  if (line > 0) {
+    if (setMatches(directives.line.get(line), rule)) return true;
+    if (setMatches(directives.nextLine.get(line), rule)) return true;
+  }
+  return false;
+}
+
+function hasDirectives(directives) {
+  return directives.file.size > 0 || directives.line.size > 0 || directives.nextLine.size > 0;
+}
+
+/**
+ * Drop findings waived by an inline directive in the same file's source text.
+ * Findings without a usable line number (e.g. static-HTML page-level findings)
+ * are only matched by whole-file directives — which is the standalone-document
+ * case this primitive exists for.
+ */
+function applyInlineIgnores(findings, content) {
+  if (!Array.isArray(findings) || findings.length === 0) return findings;
+  const directives = parseInlineIgnores(content);
+  if (!hasDirectives(directives)) return findings;
+  return findings.filter((finding) => !isInlineIgnored(finding, directives));
+}
+
+export { parseInlineIgnores, applyInlineIgnores, isInlineIgnored };

.github/skills/impeccable/scripts/detector/shared/page.mjs

@@ -0,0 +1,7 @@
+/** Check if content looks like a full page (not a component/partial) */
+function isFullPage(content) {
+  const stripped = content.replace(/<!--[\s\S]*?-->/g, '');
+  return /<!doctype\s|<html[\s>]|<head[\s>]/i.test(stripped);
+}
+
+export { isFullPage };