@chemx/starter-kit 26.9.16-41 → 26.9.17-1100

package/cli/audit/extended-visitors.js

@@ -33,6 +33,59 @@ const FAKE_GREEN_PATTERNS = [
 const IMG_WITHOUT_ALT_PATTERN = new RegExp(['<', 'img\\b', '(?![^>]*\\balt\\s*=)', '[^>]*>'].join(''), 'i');
 const CLICKABLE_CONTAINER_PATTERN = new RegExp(['<', '(div|span)\\b', '(?![^>]*\\brole\\s*=\\s*[\'"](?:button|link|tab)[\'"])', '[^>]*\\b(?:@click|v-on:click)\\s*='].join(''), 'i');
 
+const SENSITIVE_KEYWORDS = new Set([
+  'password', 'passwd', 'secret', 'token', 'apikey', 'api_key',
+  'authtoken', 'auth_token', 'accesstoken', 'access_token',
+  'refreshtoken', 'refresh_token', 'privatekey', 'private_key',
+  'creditcard', 'credit_card', 'ssn'
+]);
+
+const isSensitiveName = (name = '') => {
+  const normalized = String(name).toLowerCase();
+  if (SENSITIVE_KEYWORDS.has(normalized)) return true;
+  return /^(pass(word)?|token|secret|api[_-]?key)$/i.test(normalized);
+};
+
+const JAVASCRIPT_URL_REGEX = /^\s*javascript:/i;
+const TABNABBING_TEMPLATE_PATTERN = /<a\b[^>]*\btarget\s*=\s*["']_blank["'][^>]*>/i;
+const JAVASCRIPT_URL_TEMPLATE_PATTERN = /\b(?:href|src|action|formaction)\s*=\s*["']\s*javascript:/i;
+
+const resolvePropertyKeyName = (key) => {
+  const isIdentifier = t.isIdentifier(key);
+  if (isIdentifier) return key.name;
+  const isStringLiteral = t.isStringLiteral(key);
+  if (isStringLiteral) return key.value;
+  return '';
+};
+
+const isSensitiveExpression = (node) => {
+  if (!node) return false;
+  if (t.isIdentifier(node)) {
+    return isSensitiveName(node.name);
+  }
+  if (t.isMemberExpression(node)) {
+    if (t.isIdentifier(node.property)) {
+      return isSensitiveName(node.property.name);
+    }
+    if (t.isStringLiteral(node.property)) {
+      return isSensitiveName(node.property.value);
+    }
+  }
+  if (t.isObjectExpression(node)) {
+    return node.properties.some((prop) => {
+      if (t.isObjectProperty(prop)) {
+        const keyName = resolvePropertyKeyName(prop.key);
+        return isSensitiveName(keyName);
+      }
+      return false;
+    });
+  }
+  if (t.isTemplateLiteral(node)) {
+    return node.expressions.some(isSensitiveExpression);
+  }
+  return false;
+};
+
 /**
  * Pillar 10: Check for co-located test files for molecule capsules.
  */
@@ -136,6 +189,41 @@ export const checkExtendedTextPatterns = (content, lines, relativePath, filePath
       }
     }
 
+    // Pillar 9: Reverse Tabnabbing in HTML / Vue templates
+    const hasTargetBlank = isTemplateFile && TABNABBING_TEMPLATE_PATTERN.test(lineText);
+    if (hasTargetBlank) {
+      const hasRelProtection = /\brel\s*=\s*["'][^"']*(?:noopener|noreferrer)[^"']*["']/i.test(lineText);
+      if (!hasRelProtection) {
+        const meta = RULE_REGISTRY.SECURITY_REVERSE_TABNABBING;
+        violations.push({
+          filePath: relativePath,
+          line: lineNum,
+          column: 1,
+          hazard: 'External link with target="_blank" missing rel="noopener noreferrer"',
+          rule: 'SECURITY_REVERSE_TABNABBING',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
+    }
+
+    // Pillar 9: javascript: pseudo-protocol in HTML / Vue templates
+    const hasJsUrl = isTemplateFile && JAVASCRIPT_URL_TEMPLATE_PATTERN.test(lineText);
+    if (hasJsUrl) {
+      const meta = RULE_REGISTRY.SECURITY_JAVASCRIPT_URL;
+      violations.push({
+        filePath: relativePath,
+        line: lineNum,
+        column: 1,
+        hazard: 'javascript: pseudo-protocol detected in template attribute',
+        rule: 'SECURITY_JAVASCRIPT_URL',
+        severity: meta.severity,
+        pillar: meta.pillar,
+        directive: meta.directive
+      });
+    }
+
     // Pillar 8: Non-semantic clickable containers in templates (@click on div/span)
     const hasClickableContainer = isTemplateFile && CLICKABLE_CONTAINER_PATTERN.test(lineText);
     if (hasClickableContainer) {
@@ -244,6 +332,49 @@ export const createExtendedVisitors = ({ relativePath, violations }) => {
           });
         }
       }
+
+      // Pillar 9: External link target="_blank" without rel="noopener noreferrer"
+      const isAnchorElement = tagName === 'a';
+      if (isAnchorElement) {
+        const targetAttr = astPath.node.attributes.find((attr) => t.isJSXAttribute(attr) && attr.name?.name === 'target');
+        let isTargetBlank = false;
+        if (targetAttr) {
+          if (t.isStringLiteral(targetAttr.value)) {
+            isTargetBlank = targetAttr.value.value.trim().toLowerCase() === '_blank';
+          } else if (t.isJSXExpressionContainer(targetAttr.value) && t.isStringLiteral(targetAttr.value.expression)) {
+            isTargetBlank = targetAttr.value.expression.value.trim().toLowerCase() === '_blank';
+          }
+        }
+
+        if (isTargetBlank) {
+          const relAttr = astPath.node.attributes.find((attr) => t.isJSXAttribute(attr) && attr.name?.name === 'rel');
+          let hasRelProtection = false;
+          if (relAttr) {
+            if (t.isStringLiteral(relAttr.value)) {
+              const val = relAttr.value.value.toLowerCase();
+              hasRelProtection = val.includes('noopener') || val.includes('noreferrer');
+            } else if (t.isJSXExpressionContainer(relAttr.value) && t.isStringLiteral(relAttr.value.expression)) {
+              const val = relAttr.value.expression.value.toLowerCase();
+              hasRelProtection = val.includes('noopener') || val.includes('noreferrer');
+            }
+          }
+
+          if (!hasRelProtection) {
+            const line = astPath.node.loc?.start.line || 1;
+            const meta = RULE_REGISTRY.SECURITY_REVERSE_TABNABBING;
+            violations.push({
+              filePath: relativePath,
+              line,
+              column: astPath.node.loc?.start.column || 1,
+              hazard: 'External link with target="_blank" missing rel="noopener noreferrer"',
+              rule: 'SECURITY_REVERSE_TABNABBING',
+              severity: meta.severity,
+              pillar: meta.pillar,
+              directive: meta.directive
+            });
+          }
+        }
+      }
     },
 
     JSXAttribute(astPath) {
@@ -314,6 +445,118 @@ export const createExtendedVisitors = ({ relativePath, violations }) => {
           }
         }
       }
+
+      // Pillar 9: javascript: pseudo-protocol URL in JSX
+      const isUrlAttribute = ['href', 'src', 'action', 'formAction'].includes(attrName);
+      if (isUrlAttribute) {
+        let isJsUrl = false;
+        const val = astPath.node.value;
+        if (t.isStringLiteral(val)) {
+          isJsUrl = JAVASCRIPT_URL_REGEX.test(val.value);
+        } else if (t.isJSXExpressionContainer(val)) {
+          const expr = val.expression;
+          if (t.isStringLiteral(expr)) {
+            isJsUrl = JAVASCRIPT_URL_REGEX.test(expr.value);
+          } else if (t.isTemplateLiteral(expr) && expr.quasis.length > 0) {
+            isJsUrl = JAVASCRIPT_URL_REGEX.test(expr.quasis[0].value.raw);
+          }
+        }
+
+        if (isJsUrl) {
+          const line = astPath.node.loc?.start.line || 1;
+          const meta = RULE_REGISTRY.SECURITY_JAVASCRIPT_URL;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: astPath.node.loc?.start.column || 1,
+            hazard: `javascript: pseudo-protocol detected in ${attrName} attribute`,
+            rule: 'SECURITY_JAVASCRIPT_URL',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+    },
+
+    CallExpression(astPath) {
+      const callee = astPath.node.callee;
+
+      // Pillar 9: Dynamic code execution via eval()
+      if (t.isIdentifier(callee) && callee.name === 'eval') {
+        const line = astPath.node.loc?.start.line || 1;
+        const meta = RULE_REGISTRY.SECURITY_DYNAMIC_CODE_EXECUTION;
+        violations.push({
+          filePath: relativePath,
+          line,
+          column: astPath.node.loc?.start.column || 1,
+          hazard: 'Dynamic code execution via eval() detected',
+          rule: 'SECURITY_DYNAMIC_CODE_EXECUTION',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
+
+      // Pillar 9: String-based code execution in setTimeout/setInterval
+      if (t.isIdentifier(callee) && (callee.name === 'setTimeout' || callee.name === 'setInterval')) {
+        const firstArg = astPath.node.arguments[0];
+        const isStringExecution = t.isStringLiteral(firstArg) || t.isTemplateLiteral(firstArg);
+        if (isStringExecution) {
+          const line = astPath.node.loc?.start.line || 1;
+          const meta = RULE_REGISTRY.SECURITY_DYNAMIC_CODE_EXECUTION;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: astPath.node.loc?.start.column || 1,
+            hazard: `String-based dynamic code execution in ${callee.name} detected`,
+            rule: 'SECURITY_DYNAMIC_CODE_EXECUTION',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+
+      // Pillar 9: Sensitive credential/token logging in console
+      const isConsoleCall = t.isMemberExpression(callee) && t.isIdentifier(callee.object) && callee.object.name === 'console';
+      if (isConsoleCall) {
+        const args = astPath.node.arguments || [];
+        const hasSensitiveArg = args.some(isSensitiveExpression);
+        if (hasSensitiveArg) {
+          const line = astPath.node.loc?.start.line || 1;
+          const meta = RULE_REGISTRY.SECURITY_SENSITIVE_LOGGING;
+          violations.push({
+            filePath: relativePath,
+            line,
+            column: astPath.node.loc?.start.column || 1,
+            hazard: 'Sensitive variable (credential, token, or password) logged to console',
+            rule: 'SECURITY_SENSITIVE_LOGGING',
+            severity: meta.severity,
+            pillar: meta.pillar,
+            directive: meta.directive
+          });
+        }
+      }
+    },
+
+    NewExpression(astPath) {
+      // Pillar 9: Dynamic code execution via new Function()
+      const callee = astPath.node.callee;
+      if (t.isIdentifier(callee) && callee.name === 'Function') {
+        const line = astPath.node.loc?.start.line || 1;
+        const meta = RULE_REGISTRY.SECURITY_DYNAMIC_CODE_EXECUTION;
+        violations.push({
+          filePath: relativePath,
+          line,
+          column: astPath.node.loc?.start.column || 1,
+          hazard: 'Dynamic code execution via new Function() constructor detected',
+          rule: 'SECURITY_DYNAMIC_CODE_EXECUTION',
+          severity: meta.severity,
+          pillar: meta.pillar,
+          directive: meta.directive
+        });
+      }
     },
 
     VariableDeclarator(astPath) {

package/cli/audit/pattern-detector.js

@@ -49,9 +49,10 @@ export const createPatternRegistry = () => {
         suggestedCapsule = 'types/state.d.ts';
         recommendation = 'Extract shared discriminated union into domain types to eliminate duplicate definitions';
       } else if (bucket.type === 'UI_STRUCTURE') {
-        label = `Shared UI Layout Structure (${bucket.detail})`;
-        suggestedCapsule = 'm-feature-card';
-        recommendation = 'Extract canonical molecule capsule before slicing consumer monoliths';
+        const categorization = categorizeUiStructure(bucket.detail);
+        label = categorization.label;
+        suggestedCapsule = categorization.suggestedCapsule;
+        recommendation = categorization.recommendation;
       } else if (bucket.type === 'PREDICATE_LOGIC') {
         label = `Duplicated Boolean Predicate Topology (${bucket.detail})`;
         suggestedCapsule = 'usePredicateFilter.ts';
@@ -84,6 +85,92 @@ export const createPatternRegistry = () => {
   return { record, resolveHarmonizationCandidates };
 };
 
+export const categorizeUiStructure = (signature = '') => {
+  const normalized = signature.toLowerCase();
+
+  const isSvg =
+    normalized.startsWith('svg>') ||
+    normalized.includes('path+path') ||
+    normalized.includes('polygon') ||
+    normalized.includes('circle');
+  if (isSvg) {
+    const isMultiLayer = (normalized.match(/path|circle|rect|polygon|g/g) || []).length > 3;
+    return {
+      label: `Shared Vector Glyph (${signature})`,
+      suggestedCapsule: isMultiLayer ? 'm-vector-glyph' : 'a-icon',
+      recommendation: 'Extract foundational icon atom or vector glyph capsule'
+    };
+  }
+
+  const hasButton =
+    normalized.includes('btn') ||
+    normalized.includes('button');
+  if (hasButton) {
+    const hasTextOrTitle =
+      normalized.includes('span') ||
+      normalized.includes('title') ||
+      normalized.includes('h1') ||
+      normalized.includes('h2') ||
+      normalized.includes('h3') ||
+      normalized.includes('h4') ||
+      normalized.includes('p');
+
+    if (hasTextOrTitle) {
+      return {
+        label: `Shared Action Header (${signature})`,
+        suggestedCapsule: 'm-action-header',
+        recommendation: 'Extract action header molecule capsule to standardize button actions'
+      };
+    }
+
+    return {
+      label: `Shared Button Row (${signature})`,
+      suggestedCapsule: 'm-button-row',
+      recommendation: 'Extract button row molecule capsule to consolidate action bar'
+    };
+  }
+
+  const hasChipOrBadge =
+    normalized.includes('chip') ||
+    normalized.includes('badge') ||
+    normalized.includes('pill') ||
+    normalized.includes('tag');
+  if (hasChipOrBadge) {
+    const chipCount = (normalized.match(/chip|badge|pill|tag/g) || []).length;
+    if (chipCount > 1) {
+      return {
+        label: `Shared Pill Row (${signature})`,
+        suggestedCapsule: 'm-pill-row',
+        recommendation: 'Extract pill row molecule capsule to group status indicators'
+      };
+    }
+
+    return {
+      label: `Shared Status Badge (${signature})`,
+      suggestedCapsule: 'm-status-badge',
+      recommendation: 'Extract status badge atom or capsule to unify state tags'
+    };
+  }
+
+  const hasFormInput =
+    normalized.includes('input') ||
+    normalized.includes('textarea') ||
+    normalized.includes('select');
+  if (hasFormInput) {
+    return {
+      label: `Shared Form Field (${signature})`,
+      suggestedCapsule: 'm-form-field',
+      recommendation: 'Extract form field molecule encapsulating label and input atom'
+    };
+  }
+
+  return {
+    label: `Shared UI Layout Structure (${signature})`,
+    suggestedCapsule: 'm-feature-card',
+    recommendation: 'Extract canonical molecule capsule before slicing consumer monoliths'
+  };
+};
+
 const VOID_ELEMENTS = new Set([
   'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta', 'param', 'source', 'track', 'wbr'
 ]);

package/cli/audit/pattern-detector.spec.js

@@ -4,7 +4,8 @@ import {
   createPatternRegistry,
   extractTemplateTokens,
   buildTagTree,
-  recordTemplatePatterns
+  recordTemplatePatterns,
+  categorizeUiStructure
 } from './pattern-detector.js';
 
 test('extractTemplateTokens: extracts tags, ignoring comments and handling quotes', () => {
@@ -56,6 +57,40 @@ test('buildTagTree and recordTemplatePatterns: captures UI_STRUCTURE from Vue te
 
   assert.ok(uiCandidate, 'Expected UI_STRUCTURE candidate to be found');
   assert.equal(uiCandidate.detail, 'v-sheet>(x-btn+x-btn)');
+  assert.equal(uiCandidate.suggestedCapsule, 'm-button-row');
   assert.equal(uiCandidate.fileCount, 2);
   assert.deepEqual(uiCandidate.uniqueFiles.sort(), ['src/components/A.vue', 'src/components/B.vue']);
 });
+
+test('categorizeUiStructure: maps semantic AST topologies to specialized capsules', () => {
+  // SVG dual path -> a-icon
+  const svgRes = categorizeUiStructure('svg>(path+path)');
+  assert.equal(svgRes.suggestedCapsule, 'a-icon');
+  assert.ok(svgRes.label.includes('Vector Glyph'));
+
+  // Action header -> m-action-header
+  const actionRes = categorizeUiStructure('div>(span+v-btn)');
+  assert.equal(actionRes.suggestedCapsule, 'm-action-header');
+  assert.ok(actionRes.label.includes('Action Header'));
+
+  // Button row -> m-button-row
+  const btnRowRes = categorizeUiStructure('div>(v-btn+v-btn)');
+  assert.equal(btnRowRes.suggestedCapsule, 'm-button-row');
+
+  // Status badge -> m-status-badge
+  const badgeRes = categorizeUiStructure('div>(span+v-chip)');
+  assert.equal(badgeRes.suggestedCapsule, 'm-status-badge');
+
+  // Pill row -> m-pill-row
+  const pillRowRes = categorizeUiStructure('div>(v-chip+v-chip)');
+  assert.equal(pillRowRes.suggestedCapsule, 'm-pill-row');
+
+  // Form field -> m-form-field
+  const formRes = categorizeUiStructure('div>(label+input)');
+  assert.equal(formRes.suggestedCapsule, 'm-form-field');
+
+  // Fallback -> m-feature-card
+  const fallbackRes = categorizeUiStructure('div>(div+div)');
+  assert.equal(fallbackRes.suggestedCapsule, 'm-feature-card');
+});
+

package/cli/audit/prompts.js

@@ -293,13 +293,12 @@ export const buildHotspotsPrompt = (report, options = {}) => {
   }
 
   lines.push('### STRICT EXECUTION RULES:');
-  lines.push('1. Branch First: Change to a new branch prefixed with `chem-x/NAMEOFIMPROVEMENT` before making changes, then commit the branch and create a PR to main.');
-  lines.push('2. Pre-Split Pattern Discovery: Audit recurring UI layouts, state machines, and predicates across monoliths first; extract canonical shared capsules before slicing to prevent bespoke pattern duplication.');
-  lines.push('3. Molecular Limits: Molecule capsules must strictly remain under 100 lines per file.');
-  lines.push('4. Table-of-Contents Views: Top-level page views must be 10 to 20 line declarative Table of Contents assembling molecules via named slots.');
-  lines.push('5. Composable Return Contracts: Custom hooks/composables must strictly limit returns to 3 to 5 properties (State + Status + Actions).');
-  lines.push('6. Type Co-location: Co-locate granular types/*.d.ts files inside each feature capsule (< 100 lines per type file) instead of creating type monoliths.');
-  lines.push('7. Zero breaking changes to external component APIs, route exports, or existing props.');
+  lines.push('1. Pre-Split Pattern Discovery: Audit recurring UI layouts, state machines, and predicates across monoliths first; extract canonical shared capsules before slicing to prevent bespoke pattern duplication.');
+  lines.push('2. Molecular Limits: Molecule capsules must strictly remain under 100 lines per file.');
+  lines.push('3. Table-of-Contents Views: Top-level page views must be 10 to 20 line declarative Table of Contents assembling molecules via named slots.');
+  lines.push('4. Composable Return Contracts: Custom hooks/composables must strictly limit returns to 3 to 5 properties (State + Status + Actions).');
+  lines.push('5. Type Co-location: Co-locate granular types/*.d.ts files inside each feature capsule (< 100 lines per type file) instead of creating type monoliths.');
+  lines.push('6. Zero breaking changes to external component APIs, route exports, or existing props.');
   if (!isSubSection) {
     lines.push('');
     lines.push(buildAgentCommandsSection());
@@ -340,11 +339,10 @@ export const buildPillarPrompt = (report, pillarName, options = {}) => {
   }
 
   lines.push('### STRICT EXECUTION RULES:');
-  lines.push('1. Branch First: Change to a new branch prefixed with `chem-x/NAMEOFIMPROVEMENT` before making changes.');
-  lines.push('2. Pre-Split Pattern Discovery: Survey cross-file patterns before slicing; extract canonical shared capsules first.');
-  lines.push('3. Molecular Capsule Limit: Maximum 100 lines per molecule capsule file.');
-  lines.push('4. Table-of-Contents Views: Top-level page views must be 10 to 20 line declarative templates assembling components via named slots.');
-  lines.push('5. Zero breaking changes to external component APIs, route exports, or existing props.');
+  lines.push('1. Pre-Split Pattern Discovery: Survey cross-file patterns before slicing; extract canonical shared capsules first.');
+  lines.push('2. Molecular Capsule Limit: Maximum 100 lines per molecule capsule file.');
+  lines.push('3. Table-of-Contents Views: Top-level page views must be 10 to 20 line declarative templates assembling components via named slots.');
+  lines.push('4. Zero breaking changes to external component APIs, route exports, or existing props.');
   if (!isSubSection) {
     lines.push('');
     lines.push(buildAgentCommandsSection());

package/cli/audit/reporter-utils.js

@@ -36,31 +36,22 @@ export const groupViolationsBySeverity = (violations) => {
 };
 
 export const getSeverityBadge = (severity) => {
-  switch (severity) {
-    case 'CRITICAL':
-      return `${RED}[CRITICAL]${RESET}`;
-    case 'HIGH':
-      return `${ORANGE}[HIGH]${RESET}`;
-    case 'MEDIUM':
-      return `${ORANGE}[MEDIUM]${RESET}`;
-    case 'LOW':
-      return `${YELLOW}[LOW]${RESET}`;
-    default:
-      return `[${severity}]`;
-  }
+  const SEVERITY_BADGES = {
+    CRITICAL: `${RED}[CRITICAL]${RESET}`,
+    HIGH: `${ORANGE}[HIGH]${RESET}`,
+    MEDIUM: `${ORANGE}[MEDIUM]${RESET}`,
+    LOW: `${YELLOW}[LOW]${RESET}`
+  };
+  return SEVERITY_BADGES[severity] || `[${severity}]`;
 };
 
 export const getStatusBadge = (status) => {
-  switch (status) {
-    case 'PASSED':
-      return `${GREEN}✔ PASS${RESET}`;
-    case 'WARN':
-      return `${YELLOW}⚠ WARN${RESET}`;
-    case 'FAILED':
-      return `${RED}✕ FAIL${RESET}`;
-    default:
-      return status;
-  }
+  const STATUS_BADGES = {
+    PASSED: `${GREEN}✔ PASS${RESET}`,
+    WARN: `${YELLOW}⚠ WARN${RESET}`,
+    FAILED: `${RED}✕ FAIL${RESET}`
+  };
+  return STATUS_BADGES[status] || status;
 };
 
 export const resolveIndividualPillarGrade = (pillarData) => {

package/cli/audit/roadmap.js

@@ -128,12 +128,6 @@ export const buildRemediationRoadmap = (report) => {
         target: '.git/hooks/pre-commit & .github/workflows/',
         action: 'Run npx chemx install to lock in line budgets and prevent future monolith regressions.',
         locations: []
-      },
-      {
-        title: 'Branch, Commit & Pull Request Workflow',
-        target: 'git checkout -b chem-x/NAMEOFIMPROVEMENT',
-        action: 'Change to a branch prefixed with chem-x/NAMEOFIMPROVEMENT to make changes, commit the branch, and create a PR to main.',
-        locations: []
       }
     ]
   });
@@ -202,13 +196,6 @@ export const buildSelfHealingRoadmapPrompt = (report) => {
 
   lines.push('Act as a Principal Systems Architect. Execute a self-healing architectural remediation of our codebase by following this strict multi-phase sequence in order:\n');
 
-  lines.push('### MANDATORY GIT BRANCHING & PR WORKFLOW:');
-  lines.push('1. Before modifying any files, change to a dedicated feature branch prefixed with `chem-x/NAMEOFIMPROVEMENT`:');
-  lines.push('   `git checkout -b chem-x/NAMEOFIMPROVEMENT`');
-  lines.push('2. Execute each remediation phase sequentially on this branch.');
-  lines.push('3. Commit the branch with atomic, intention-revealing commit messages.');
-  lines.push('4. Create a Pull Request (PR) to `main` upon completing the remediation phases.\n');
-
   lines.push('### AI AGENT DISCOVERY & REFACTORING COMMANDS:');
   lines.push('- Discovery & Inspect: Run `pnpm q "<target>" --inspect` (or `npx chemx search "<target>" --inspect`) to inspect component props and hooks before editing.');
   lines.push('- Tier Filter: Run `pnpm q "<query>" --tier=molecule` (or `atom`, `organism`, `hook`) to find related capsules.');
@@ -234,13 +221,11 @@ export const buildSelfHealingRoadmapPrompt = (report) => {
   });
 
   lines.push('### EXECUTION DISCIPLINE:');
-  lines.push('1. Branch First: Change to a new branch prefixed with `chem-x/NAMEOFIMPROVEMENT` (e.g. `git checkout -b chem-x/<name-of-improvement>`) before making any changes.');
-  lines.push('2. Complete Step 1 (Pattern Harvesting) completely before touching any monolithic file in Step 3.');
-  lines.push('3. Spliced views in Step 3 must directly import and bind to the canonical capsules created in Step 1.');
-  lines.push('4. Every new molecule component must stay under 100 lines.');
-  lines.push('5. Top-level page views must be 10-20 line declarative Table-of-Contents templates assembling molecules via named slots.');
-  lines.push('6. Zero synthetic or mock data; zero em dashes (use hyphens or colons).');
-  lines.push('7. PR to Main: Commit the branch and create a Pull Request to main.');
+  lines.push('1. Complete Step 1 (Pattern Harvesting) completely before touching any monolithic file in Step 3.');
+  lines.push('2. Spliced views in Step 3 must directly import and bind to the canonical capsules created in Step 1.');
+  lines.push('3. Every new molecule component must stay under 100 lines.');
+  lines.push('4. Top-level page views must be 10-20 line declarative Table-of-Contents templates assembling molecules via named slots.');
+  lines.push('5. Zero synthetic or mock data; zero em dashes (use hyphens or colons).');
 
   return lines.join('\n');
 };

package/cli/audit/rules-predicates.js

@@ -8,7 +8,7 @@ const COMPONENT_EXTENSIONS = new Set(['.vue', '.tsx', '.jsx']);
 const TEMPLATE_EXTENSIONS = new Set(['.vue', '.html', '.svelte']);
 const COMMENT_PREFIXES = ['//', '*', '/*'];
 const CONSOLE_LOG_METHODS = ['log', 'info', 'warn'];
-const NON_INTERACTIVE_FLAGS = ['--non-interactive', '--no-interactive', '--ci'];
+const NON_INTERACTIVE_FLAGS = ['--non-interactive', '--no-interactive', '--ci', '--headless', '--yes', '-y'];
 const FORMAT_FLAGS = ['--markdown', '--md', '--json'];
 const GRADE_RANKS = { 'A+': 5, 'A': 4, 'B': 3, 'C': 2, 'D': 1, 'F': 0 };
 
@@ -135,5 +135,6 @@ export const isNonInteractiveSession = (rawArgs, env = process.env) => {
   const hasOutputFlag = rawArgs.some((arg) => arg.startsWith('--output=') || arg.startsWith('-o='));
   const hasFormatFlag = FORMAT_FLAGS.some((flag) => rawArgs.includes(flag));
   const hasCiEnv = Boolean(env.CI || env.GIT_DIR);
-  return [hasCliFlag, hasOutputFlag, hasFormatFlag, hasCiEnv].some(Boolean);
+  const isNotTTY = Boolean(process.stdout && process.stdout.isTTY === false);
+  return [hasCliFlag, hasOutputFlag, hasFormatFlag, hasCiEnv, isNotTTY].some(Boolean);
 };

package/cli/audit/rules-registry.js

@@ -36,6 +36,26 @@ export const RULE_REGISTRY = {
     severity: 'CRITICAL',
     directive: 'Extract hardcoded API keys and secrets into environment variables or secrets manager'
   },
+  SECURITY_REVERSE_TABNABBING: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'MEDIUM',
+    directive: 'Add rel="noopener noreferrer" to external links with target="_blank" to prevent tab hijacking'
+  },
+  SECURITY_JAVASCRIPT_URL: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'CRITICAL',
+    directive: 'Do not use javascript: pseudo-protocol in links or action attributes; use event handlers'
+  },
+  SECURITY_DYNAMIC_CODE_EXECUTION: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'CRITICAL',
+    directive: 'Avoid eval(), new Function(), and string-based setTimeout/setInterval code execution'
+  },
+  SECURITY_SENSITIVE_LOGGING: {
+    pillar: PILLARS.PILLAR_9,
+    severity: 'HIGH',
+    directive: 'Never log sensitive credentials, tokens, or passwords to console diagnostics'
+  },
 
   // Pillar 10: Testing Discipline
   TEST_FAKE_GREEN: {
@@ -86,6 +106,11 @@ export const RULE_REGISTRY = {
     severity: 'CRITICAL',
     directive: 'Extract display states into computed descriptor objects or early returns'
   },
+  CONTROL_FLOW_DISPATCH_SWITCH: {
+    pillar: PILLARS.PILLAR_2,
+    severity: 'MEDIUM',
+    directive: 'Replace repetitive dispatch switch with an O(1) keyed dictionary or method map (Directive 3.E)'
+  },
   HOOK_SATURATION: {
     pillar: PILLARS.PILLAR_3,
     severity: 'HIGH',

package/cli/audit/rules.js

@@ -102,6 +102,10 @@ export const auditCode = (content, filePath, relativePath, options = {}) => {
   // Pillars 8-11: Extended Fast Checks (A11y, Security secrets, Fake tests, Co-located specs)
   checkExtendedTextPatterns(content, lines, relativePath, filePath, violations);
 
+  if (options.fast) {
+    return violations;
+  }
+
   // Vue template structural pattern discovery
   if (ext === '.vue' && options.patternRegistry) {
     const templateMatch = content.match(/<template\b[^>]*>([\s\S]*?)<\/template>/i);