@alexcodeplace/slopgate 0.1.1 → 0.3.0

package/README.md

@@ -23,7 +23,7 @@ A global code-quality / anti-slop gate for Claude Code and git. Engine is shared
   - **diff-shape** — wide commits spanning too many directories (encourages focused changes)
 
 - **Shared regex + AST rule packs** — fast-tier and commit-tier both run these
-  - Convention: `no-stubs`, `ts-suppress`, `as-any`, `raw-hex` (design tokens), `sql-safety`
+  - Convention: `no-stubs`, `ts-suppress`, `as-any`, `no-narration-comments`, `raw-hex` (design tokens), `sql-safety`
   - Security: `live-secrets`, `eval-ban`, `pii-logs`, `weak-hash`
   - Cloudflare boundary: `kv-ban` (plus the opt-in `stack = ["cloudflare"]` pack)
   - Built-in AST rules: empty-catch, unsafe `innerHTML`/`dangerouslySetInnerHTML`, `target="_blank"` without `rel`, `window` access during render
@@ -388,6 +388,7 @@ All are opt-in via the `baseline` array in config. Severity drives the gate thre
 | `no-stubs` | critical | convention | Stub / placeholder / "not implemented" / deferred-work markers |
 | `ts-suppress` | high | convention | `@ts-ignore` / `@ts-expect-error` — suppressing tsc instead of fixing the cause |
 | `as-any` | high | convention | `as any` casts that disable type safety |
+| `no-narration-comments` | high | convention | Comments that narrate a diff/history/removal (`changed from`, `used to`, `no longer needed`, `track later`) instead of explaining a non-obvious constraint |
 | `raw-hex` | high | convention | Hardcoded hex / `rgb()` colors + raw multi-digit `px` — use design tokens |
 | `sql-safety` | critical | convention | `SELECT … FOR UPDATE` with an aggregate (Postgres rejects this at runtime) |
 | `kv-ban` | critical | boundary | Cloudflare KV in read-after-write paths (eventually-consistent) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexcodeplace/slopgate",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "type": "module",
   "description": "Global code-quality / anti-slop gate — engine shared, rules per-project.",
   "license": "MIT",

package/rules/baseline/ast/empty-catch-block-ts.yml

@@ -5,3 +5,6 @@ message: Empty catch block swallows error silently
 note: '{"severity":"high","category":"convention","resolution":"Handle or rethrow. Minimum: log with context (console.error). Comment-only bodies count as empty."}'
 rule:
   pattern: 'try { $A } catch ($E) {}'
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/empty-catch-block-tsx.yml

@@ -5,3 +5,6 @@ message: Empty catch block swallows error silently
 note: '{"severity":"high","category":"convention","resolution":"Handle or rethrow. Minimum: log with context (console.error). Comment-only bodies count as empty."}'
 rule:
   pattern: 'try { $A } catch ($E) {}'
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/inner-html.yml

@@ -6,4 +6,7 @@ note: '{"severity":"high","category":"security","resolution":"Build DOM via safe
 rule:
   any:
     - pattern: $X.innerHTML = $$$
-    - pattern: $X.insertAdjacentHTML($$$)
+    - pattern: $X.insertAdjacentHTML($$$)
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/target-blank-norel.yml

@@ -23,3 +23,6 @@ rule:
             has:
               kind: jsx_attribute
               regex: '^rel='
+ignores:
+  - '**/*.test.ts'
+  - '**/*.test.tsx'

package/rules/baseline/ast/window-in-render.yml

@@ -9,6 +9,8 @@ files:
   - '**/fixtures/src/components/**'
 ignores:
   - '**/features/design-system/**'
+  - '**/*.test.ts'
+  - '**/*.test.tsx'
 rule:
   any:
     - pattern: window.$PROP

package/rules/baseline/selftest.config.toml

@@ -6,7 +6,8 @@
 roots = ["rules/baseline/fixtures/src"]
 exts = [".ts", ".tsx"]
 skipDirs = ["node_modules"]
-baseline = ["no-stubs", "ts-suppress", "as-any", "raw-hex", "kv-ban", "live-secrets", "eval-ban", "pii-logs", "weak-hash", "sql-safety"]
+baseline = ["no-stubs", "ts-suppress", "as-any", "no-narration-comments", "markers", "raw-hex", "kv-ban", "live-secrets", "eval-ban", "pii-logs", "weak-hash", "sql-safety"]
+stack = ["debug"]
 rules = []
 suppressions = "./fixtures/suppressions.json"
 fixtures = "./fixtures"

package/skills/slopgate-improve/SKILL.md

@@ -9,6 +9,20 @@ description: Mine a project's institutional memory (skills, agents, commands, CL
 
 Scope / focus area (optional): $ARGUMENTS — blank = all sources.
 
+## Step 0 — Ensure gate initialized (run FIRST)
+
+A `/slopgate-*` skill MUST NOT operate on an un-gated repo. Verify the gate; init if absent. Idempotent — `slopgate init` preserves an existing config and only fills what is missing (it also installs the fail-closed pre-commit hook). Single source of truth = the CLI's own idempotency; this step just calls it.
+
+```bash
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || { echo "slopgate: not a git repo — cannot init gate"; exit 1; }
+if [ ! -f "$ROOT/.slopgate/config.toml" ]; then
+  echo "slopgate: gate not initialized — running 'slopgate init' first"
+  ( cd "$ROOT" && slopgate init ) || { echo "slopgate: init failed"; exit 1; }
+fi
+```
+
+`config.toml` present → proceed. For richer project-specific rule mining on a fresh repo, run `/slopgate-init` separately.
+
 ## Rule tier model
 
 | Tier | Pack location | Who opts in |

package/skills/slopgate-ux/SKILL.md

@@ -14,6 +14,20 @@ answer is NO, revise before emitting.
 > Mission: generate human-centric, intuitive, **complete** interfaces. Avoid "UX slop": lazy, incomplete,
 > or cognitively overwhelming designs optimized only for the happy path.
 
+## Step 0 — Ensure gate initialized (run FIRST)
+
+A `/slopgate-*` skill MUST NOT operate on an un-gated repo. Verify the gate; init if absent, so the `ux:{}` static module backs these prompt-time directives. Idempotent — `slopgate init` preserves an existing config and only fills what is missing (it also installs the fail-closed pre-commit hook). Single source of truth = the CLI's own idempotency; this step just calls it.
+
+```bash
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || { echo "slopgate: not a git repo — cannot init gate"; exit 1; }
+if [ ! -f "$ROOT/.slopgate/config.toml" ]; then
+  echo "slopgate: gate not initialized — running 'slopgate init' first"
+  ( cd "$ROOT" && slopgate init ) || { echo "slopgate: init failed"; exit 1; }
+fi
+```
+
+`config.toml` present → proceed with the checklist below.
+
 ## 0. Generic-AI-slop alarm bells — reject on sight
 Centered hero + two stacked CTAs over a gradient · "Trusted by" logo strip under the hero · bento-box
 grids (3–4 icon/heading/paragraph cards) · emoji as bullets/section markers/icons · decorative