@fringetools/cli 0.2.1 → 0.3.0

package/README.md

@@ -22,6 +22,7 @@ Prefer a permanent command? `npm install -D @fringetools/cli`, then `npx fringe
 | Command | What it does |
 |---|---|
 | `fringe check [dir\|file]` | Scan a directory (default `.`) or judge one file (the project root is found by climbing to the nearest `package.json`). Prints findings and the health score. Exit `1` on any `error`. |
+| `fringe scan <url> [--json]` | **Runtime check of a live page** (needs `npm i -D playwright-core axe-core`; uses your installed Chrome). Runs axe-core for real contrast, computed names and ARIA relations (`FR-400`; critical/serious = `error`, the rest `review`), then walks the page with Tab and reports keyboard traps (`FR-401`, error) and controls Tab never reaches (review). Accepts `http(s)://` and `file://` URLs. Exit `1` on errors. |
 | `fringe plan [dir\|file] [--json] [--limit n]` | **Fix order for a repo with many findings**: P0 (errors in shared components or critical paths) → P1 (other errors, mechanical first) → P2 review → P3 polish, each cluster with its fix recipe. Never gates (exit 0). `--json` = `fringe/plan.v1`. |
 | `fringe explain [FR-203]` | Why a rule matters, the preferred fix and the tempting fix to avoid. No id lists all 36 rules. |
 | `fringe explain pattern [form]` | Build-time best-practice checklist for a component type (`form`, `modal`, `navigation`, `data-view`); each item is marked *verified* (a rule checks it) or *judged*. |
@@ -60,6 +61,19 @@ When a baseline or inline suppressions are in play, the last line adds `· N bas
 
 Each finding costs its weight (default error 10, review 3, signal 1). The total is scaled to a 10-file baseline (`× 10 / max(files, 10)`), so repo size doesn't flatten the score. Score = `100 − penalty` up to a penalty of 75; beyond that it decays smoothly (`25·75/penalty`) and never pins at 0. Repos under 10 files score exactly `100 − total`. Weights live in `fringe.config.json`.
 
+## Runtime scan (`fringe scan`)
+
+Static checks read source; `scan` looks at the page as a browser renders it, so it can see real colors (a CSS variable, a theme, text over an image), the names a browser actually computes, and how the keyboard behaves.
+
+```sh
+npm i -D playwright-core axe-core      # once, in the project being scanned (not installed by default)
+npx @fringetools/cli scan http://localhost:3000
+```
+
+What it reports: every axe-core WCAG 2.0 to 2.2 A/AA violation, one finding per element (`FR-400`, WCAG criterion attached), and a Tab walk (`FR-401`): focus that keeps landing on one element is a *keyboard trap*; interactive elements Tab never reaches are listed. Radio buttons (reached by arrow keys) and hidden controls are excluded.
+
+Example: on a real project page the static check reported no findings and `scan` reported 17 color-contrast errors. Limits, plainly: it scans one URL in its initial state (no login, no opening of menus or modals yet); it needs the page running; findings have no source line (they carry a CSS selector); automated checks only find part of the real problems. It does not feed `plan`, baseline or suppression yet, and is not part of the edit hook (it needs a running app and takes seconds).
+
 ## Priority, clusters and fix plans
 
 Every finding in `--json` carries `priority`, `cluster` and `fixability`, and the result has a `clusters` list. A cluster is one rule in one file: usually one root cause and one fix.
@@ -119,6 +133,8 @@ After each edit the hook runs; with errors it returns, for example:
 {"decision":"block","reason":"Fringe found 2 accessibility error(s). Fix them before finishing:\n- FR-203 src/Signup.tsx:9 — input not associated with a label (add id + <label htmlFor>, or aria-label)\n…"}
 ```
 
+The hook also keeps `.fringe/last.json` (the previous run's errors) and tells the agent what its **last edit broke**: "Your last edit introduced 1 new error(s) and fixed 2; 3 failing in total", with the new ones listed first and marked `NEW`. If that file is missing or unreadable it simply skips the comparison. It still blocks on every remaining error; on a legacy repo use the baseline so old debt is not nagged about.
+
 This was verified end to end with real agent runs: the agent receives the findings and fixes them (see [docs/architecture.md](../../docs/architecture.md)). Why `--claude-hook` and not `--hook`: Claude Code only passes a hook's output to the agent as `decision`/`reason` JSON on exit 0 (or stderr on exit 2); the CI contract `--hook` exits 1 and is ignored.
 
 **Skills** — `fringe init` installs five into `.claude/skills/` (sources in [skill/](skill/), one folder each); the Claude Code plugin ships the same folders, namespaced `/fringe:…`: `fringe` (below), `fringe-review` ("review this page": ranked, plain-English findings with fixes), `fringe-audit` (whole-repo plan: top rules and files, a fix order, offers `--update-baseline`), `fringe-debt` (lists `fringe-ignore` suppressions and the baseline) and `fringe-help` (quick reference). Invoke as `/fringe-review` etc. Reviews run `fringe check`, so Claude Code will ask you to approve that command once (or allow `Bash(fringe:*)` / `Bash(npx:*)`).

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-Z4UN7OMW.js";
+} from "./chunk-5RPXF7S7.js";
 
 // src/bin.ts
 process.exitCode = await runCli(process.argv.slice(2));

package/dist/{chunk-Z4UN7OMW.js → chunk-5RPXF7S7.js}

@@ -1,10 +1,10 @@
 // src/index.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync8, statSync } from "fs";
-import { dirname as dirname2, join as join8, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync9, statSync } from "fs";
+import { dirname as dirname2, join as join10, resolve } from "path";
 
 // src/version.ts
-var VERSION = "0.2.1";
+var VERSION = "0.3.0";
 
 // src/check.ts
 import { readFileSync as readFileSync5 } from "fs";
@@ -144,7 +144,7 @@ function collectText(node) {
   }
   return t.trim();
 }
-function parseJsx(file, source) {
+function parseJsx(file2, source) {
   let ast;
   try {
     ast = parse(source, { sourceType: "unambiguous", plugins: ["jsx", "typescript"], errorRecovery: false });
@@ -162,7 +162,7 @@ function parseJsx(file, source) {
       for (const a of node.openingElement.attributes) {
         if (a.type === "JSXAttribute") attrs[a.name.name] = attrValue(a.value);
       }
-      const el = { tag: tag2, attrs, text: collectText(node), loc: { file, line: node.loc?.start.line ?? 0, col: node.loc?.start.column ?? 0 } };
+      const el = { tag: tag2, attrs, text: collectText(node), loc: { file: file2, line: node.loc?.start.line ?? 0, col: node.loc?.start.column ?? 0 } };
       if (parent) el.parentTag = parent.tag;
       if (parent?.inLabel) el.inLabel = true;
       if (parent?.attrs?.className !== void 0) el.parentClass = parent.attrs.className;
@@ -181,7 +181,7 @@ function parseJsx(file, source) {
 // src/parse/html.ts
 import { parse as parse2 } from "parse5";
 var textOf = (n) => n.nodeName === "#text" ? n.value : (n.childNodes ?? []).map(textOf).join("");
-function parseHtml(file, source) {
+function parseHtml(file2, source) {
   const doc = parse2(source, { sourceCodeLocationInfo: true });
   const elems = [];
   (function walkNode(node, parent) {
@@ -189,7 +189,7 @@ function parseHtml(file, source) {
       const attrs = {};
       for (const a of node.attrs ?? []) attrs[a.name] = a.value;
       const text = textOf(node).trim();
-      const el = { tag: node.tagName, attrs, text, loc: { file, line: node.sourceCodeLocation?.startLine ?? 0, col: node.sourceCodeLocation?.startCol ?? 0 } };
+      const el = { tag: node.tagName, attrs, text, loc: { file: file2, line: node.sourceCodeLocation?.startLine ?? 0, col: node.sourceCodeLocation?.startCol ?? 0 } };
       if (parent) el.parentTag = parent.tag;
       if (parent?.inLabel) el.inLabel = true;
       if (parent?.attrs?.class !== void 0) el.parentClass = parent.attrs.class;
@@ -204,12 +204,12 @@ function parseHtml(file, source) {
 
 // src/parse/css.ts
 import postcss from "postcss";
-function parseCss(file, source) {
+function parseCss(file2, source) {
   const decls = [];
   const rec = (node, selector) => {
     for (const child of node.nodes ?? []) {
       if (child.type === "decl") {
-        decls.push({ prop: child.prop, value: String(child.value), selector, loc: { file, line: child.source?.start?.line ?? 0, col: child.source?.start?.column ?? 0 } });
+        decls.push({ prop: child.prop, value: String(child.value), selector, loc: { file: file2, line: child.source?.start?.line ?? 0, col: child.source?.start?.column ?? 0 } });
       } else if (child.type === "rule" || child.type === "atrule") {
         rec(child, child.type === "rule" ? child.selector : selector);
       }
@@ -1056,10 +1056,10 @@ function gatherTokenColors(root, cfg, cssSources) {
   const kind = cfg.tokenSource?.kind;
   if (kind === "design-tokens-json") {
     const rel = cfg.tokenSource?.path ?? "";
-    const file = isAbsolute(rel) ? rel : join4(root, rel);
+    const file2 = isAbsolute(rel) ? rel : join4(root, rel);
     let json;
     try {
-      json = JSON.parse(readFileSync3(file, "utf8"));
+      json = JSON.parse(readFileSync3(file2, "utf8"));
     } catch {
       return out;
     }
@@ -1386,25 +1386,25 @@ async function runCheck(root, cfg = loadConfig(root), useBaseline = true, only)
   const skipped = [];
   const cssSources = [];
   const contexts = [];
-  for (const file of files) {
+  for (const file2 of files) {
     let source = "";
     try {
-      source = readFileSync5(file, "utf8");
+      source = readFileSync5(file2, "utf8");
     } catch {
-      skipped.push(file);
+      skipped.push(file2);
       continue;
     }
-    const ctx = { file, source, elems: [], css: [], tokenColors: [] };
+    const ctx = { file: file2, source, elems: [], css: [], tokenColors: [] };
     try {
-      if (/\.(jsx|tsx|js|ts)$/.test(file)) ctx.elems = parseJsx(file, source);
-      else if (/\.html$/.test(file)) ctx.elems = parseHtml(file, source);
-      else if (/\.(css|scss)$/.test(file)) {
-        ctx.css = parseCss(file, source);
-        cssSources.push({ file, source });
+      if (/\.(jsx|tsx|js|ts)$/.test(file2)) ctx.elems = parseJsx(file2, source);
+      else if (/\.html$/.test(file2)) ctx.elems = parseHtml(file2, source);
+      else if (/\.(css|scss)$/.test(file2)) {
+        ctx.css = parseCss(file2, source);
+        cssSources.push({ file: file2, source });
       }
     } catch (e) {
       if (e.message.startsWith("parse-skip")) {
-        skipped.push(file);
+        skipped.push(file2);
         continue;
       }
       throw e;
@@ -1454,10 +1454,14 @@ function toHook(r) {
     reason
   });
 }
-function toClaudeHook(r, root) {
-  const errs = r.findings.filter((f) => f.severity === "error");
-  if (errs.length === 0) return "";
-  const shown = errs.slice(0, 8).map((f) => `- ${f.rule} ${relative4(root, f.loc.file)}:${f.loc.line} \u2014 ${f.message} (${f.hint})`);
+function toClaudeHook(r, root, history) {
+  const all = r.findings.filter((f) => f.severity === "error");
+  if (all.length === 0) return "";
+  const fresh = new Set(history?.introduced);
+  const errs = [...all.filter((f) => fresh.has(f)), ...all.filter((f) => !fresh.has(f))];
+  const note = history && (history.introduced.length > 0 || history.fixed > 0) ? `Your last edit introduced ${history.introduced.length} new error(s)${history.fixed ? ` and fixed ${history.fixed}` : ""}; ${errs.length} failing in total. New ones are marked NEW.
+` : "";
+  const shown = errs.slice(0, 8).map((f) => `- ${fresh.has(f) ? "NEW " : ""}${f.rule} ${relative4(root, f.loc.file)}:${f.loc.line} \u2014 ${f.message} (${f.hint})`);
   const shownRules = [...new Set(errs.slice(0, 8).map((f) => f.rule))];
   const recipes = shownRules.map((id) => {
     const g = GUIDANCE[id];
@@ -1467,7 +1471,7 @@ function toClaudeHook(r, root) {
 \u2026and ${errs.length - shown.length} more (run \`fringe check\`).` : "";
   return JSON.stringify({
     decision: "block",
-    reason: `Fringe found ${errs.length} accessibility error(s). Fix them before finishing:
+    reason: `${note}Fringe found ${errs.length} accessibility error(s). Fix them before finishing:
 ${shown.join("\n")}${more}
 How to fix them well:
 ${recipes.join("\n")}
@@ -1562,19 +1566,130 @@ function startBoard(root, port) {
   });
 }
 
+// src/receipts.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
+import { join as join7 } from "path";
+var file = (root) => join7(root, ".fringe", "last.json");
+function receipts(root, findings) {
+  const errs = findings.filter((f) => f.severity === "error");
+  const keys = errs.map((f) => keyOf(root, f));
+  let prev;
+  try {
+    const p = JSON.parse(readFileSync7(file(root), "utf8"));
+    if (Array.isArray(p)) prev = p;
+  } catch {
+  }
+  try {
+    mkdirSync2(join7(root, ".fringe"), { recursive: true });
+    writeFileSync2(file(root), JSON.stringify(keys));
+  } catch {
+  }
+  if (!prev) return void 0;
+  const left = /* @__PURE__ */ new Map();
+  for (const k of prev) left.set(k, (left.get(k) ?? 0) + 1);
+  const introduced = errs.filter((f, i) => {
+    const n = left.get(keys[i]) ?? 0;
+    if (n > 0) {
+      left.set(keys[i], n - 1);
+      return false;
+    }
+    return true;
+  });
+  return { introduced, fixed: [...left.values()].reduce((a, b) => a + b, 0) };
+}
+
+// src/scan.ts
+import { createRequire } from "module";
+import { join as join8 } from "path";
+var SCAN_HELP = "fringe scan needs two optional packages in your project: npm i -D playwright-core axe-core (it uses your installed Google Chrome; otherwise run npx playwright-core install chromium)";
+var WCAG_TAG = /^wcag(\d)(\d)(\d+)$/;
+var FOCUSABLE = 'a[href], button, input:not([type=hidden]):not([type=radio]), select, textarea, summary, [tabindex]:not([tabindex="-1"])';
+var at = (url) => ({ file: url, line: 1, col: 0 });
+function axeToFindings(url, violations) {
+  return violations.flatMap((v) => {
+    const tag2 = v.tags.map((t) => WCAG_TAG.exec(t)).find(Boolean);
+    const wcag = tag2 ? `${tag2[1]}.${tag2[2]}.${tag2[3]}` : void 0;
+    const severity = v.impact === "critical" || v.impact === "serious" ? "error" : "review";
+    return v.nodes.map((n) => ({
+      rule: "FR-400",
+      severity,
+      message: `${v.id} at ${n.target.join(" ")}: ${v.help}`,
+      hint: `${(n.failureSummary ?? "").split("\n").slice(1, 2).join("").trim() || v.help} (${v.helpUrl})`,
+      loc: at(url),
+      ...wcag ? { wcag } : {}
+    }));
+  });
+}
+function tabWalkFindings(url, focusables, visits) {
+  const out = [];
+  let run = 1;
+  for (let i = 1; i < visits.length; i++) {
+    run = visits[i] !== null && visits[i] === visits[i - 1] ? run + 1 : 1;
+    if (run === 4) out.push({ rule: "FR-401", severity: "error", message: `keyboard trap: Tab keeps landing on ${visits[i]}`, hint: "let focus move on (Tab or Escape must leave), and trap it only inside an open modal dialog", loc: at(url), wcag: "2.1.2" });
+  }
+  const reached = new Set(visits.filter(Boolean));
+  const missed = focusables.filter((f) => !reached.has(f));
+  if (missed.length > 0)
+    out.push({ rule: "FR-401", severity: "review", message: `${missed.length} interactive element(s) were not reached with Tab: ${missed.slice(0, 5).join(", ")}${missed.length > 5 ? ", \u2026" : ""}`, hint: "make sure each control is a real button/link/input or has tabIndex={0}; hidden-until-hover controls also land here", loc: at(url), wcag: "2.1.1" });
+  return out;
+}
+async function scan(url, cwd = process.cwd()) {
+  if (!/^(https?|file):\/\//i.test(url)) throw new Error(`fringe scan takes an http(s):// or file:// URL, got '${url}'`);
+  const req = createRequire(join8(cwd, "noop.js"));
+  let playwright, axePath;
+  try {
+    playwright = req("playwright-core");
+    axePath = req.resolve("axe-core/axe.min.js");
+  } catch {
+    throw new Error(SCAN_HELP);
+  }
+  let browser;
+  try {
+    browser = await playwright.chromium.launch({ channel: "chrome" });
+  } catch {
+    try {
+      browser = await playwright.chromium.launch();
+    } catch {
+      throw new Error(SCAN_HELP);
+    }
+  }
+  try {
+    const page = await browser.newPage();
+    await page.goto(url, { waitUntil: "load", timeout: 3e4 });
+    await page.addScriptTag({ path: axePath });
+    const axeRes = await page.evaluate(() => globalThis.axe.run(document, { runOnly: { type: "tag", values: ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"] } }));
+    const describe = `(el) => { const i = [...document.querySelectorAll(${JSON.stringify(FOCUSABLE)})].indexOf(el); return i < 0 ? null : el.tagName.toLowerCase() + (el.id ? '#' + el.id : '') + '[' + i + ']'; }`;
+    const focusables = await page.evaluate(`[...document.querySelectorAll(${JSON.stringify(FOCUSABLE)})].filter((el) => { const r = el.getBoundingClientRect(); const s = getComputedStyle(el); return r.width > 0 && r.height > 0 && s.visibility !== 'hidden' && !el.disabled; }).map((el, _i, all) => (${describe})(el))`);
+    const visits = [];
+    for (let i = 0; i < focusables.length + 6; i++) {
+      await page.keyboard.press("Tab");
+      await page.waitForTimeout(40);
+      const now = await page.evaluate(`(${describe})(document.activeElement)`);
+      if (now === null && visits.length > 0) break;
+      visits.push(now);
+    }
+    const findings = [...axeToFindings(url, axeRes.violations), ...tabWalkFindings(url, focusables, visits)];
+    const counts = { error: 0, review: 0, signal: 0 };
+    for (const f of findings) counts[f.severity]++;
+    return { stack: { jsx: false, tailwind: false, vue: false, svelte: false, html: true }, files: 1, skipped: [], findings, counts, score: score(counts, { error: 10, review: 3, signal: 1 }, 1) };
+  } finally {
+    await browser.close();
+  }
+}
+
 // src/init.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync7, readdirSync as readdirSync3, writeFileSync as writeFileSync2, copyFileSync } from "fs";
-import { dirname, join as join7 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync as readdirSync3, writeFileSync as writeFileSync3, copyFileSync } from "fs";
+import { dirname, join as join9 } from "path";
 import { fileURLToPath } from "url";
 var HOOK = "npx -y @fringetools/cli check --claude-hook";
 var SKILL_DIR = fileURLToPath(new URL("../skill/", import.meta.url));
 function initProject(root) {
   const done = [];
-  const settingsPath = join7(root, ".claude", "settings.json");
+  const settingsPath = join9(root, ".claude", "settings.json");
   let settings = {};
   if (existsSync2(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync7(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync8(settingsPath, "utf8"));
     } catch {
       throw new Error(`${settingsPath} is not valid JSON \u2014 fix it and rerun`);
     }
@@ -1583,16 +1698,16 @@ function initProject(root) {
   if (/(fringe|@fringetools\/cli) check/.test(JSON.stringify(post))) done.push("hook already present");
   else {
     post.push({ matcher: "Edit|Write", hooks: [{ type: "command", command: HOOK }] });
-    mkdirSync2(dirname(settingsPath), { recursive: true });
-    writeFileSync2(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    mkdirSync3(dirname(settingsPath), { recursive: true });
+    writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     done.push(`hook added to ${settingsPath}`);
   }
   for (const name of readdirSync3(SKILL_DIR)) {
-    const skillPath = join7(root, ".claude", "skills", name, "SKILL.md");
+    const skillPath = join9(root, ".claude", "skills", name, "SKILL.md");
     if (existsSync2(skillPath)) done.push(`skill ${name} already present`);
     else {
-      mkdirSync2(dirname(skillPath), { recursive: true });
-      copyFileSync(join7(SKILL_DIR, name, "SKILL.md"), skillPath);
+      mkdirSync3(dirname(skillPath), { recursive: true });
+      copyFileSync(join9(SKILL_DIR, name, "SKILL.md"), skillPath);
       done.push(`skill ${name} installed`);
     }
   }
@@ -1722,7 +1837,7 @@ var err = (o) => o.err ?? ((s) => process.stderr.write(s));
 function readManifest(path2, warn) {
   let raw;
   try {
-    raw = readFileSync8(path2, "utf8");
+    raw = readFileSync9(path2, "utf8");
   } catch {
     warn(`fringe: warning: manifest not found at ${path2} \u2014 continuing without
 `);
@@ -1749,7 +1864,7 @@ function resolveTarget(arg) {
   if (!statSync(arg).isFile()) return { root: arg };
   let dir = dirname2(arg);
   for (let d = dir, i = 0; i < 12; i++, d = dirname2(d)) {
-    if (existsSync3(join8(d, "package.json")) || existsSync3(join8(d, "fringe.config.json"))) {
+    if (existsSync3(join10(d, "package.json")) || existsSync3(join10(d, "fringe.config.json"))) {
       dir = d;
       break;
     }
@@ -1761,6 +1876,7 @@ var weakEvidence = (e) => typeof e !== "string" || e.trim().length < 12 || /^(n\
 var HELP = `fringe check [--json] [--hook] [--record] [--manifest <path>] [path]
 fringe check --claude-hook [path]       for Claude Code hooks (feeds errors back to the agent)
 fringe check --update-baseline [path]   accept today's findings; only new ones gate
+fringe scan <url> [--json]               runtime check in a real browser (axe-core + keyboard walk); needs playwright-core and axe-core
 fringe plan [dir|file] [--json] [--limit n]   ordered fix batches with recipes
 fringe explain pattern [form]           best-practice checklist for a component type
 fringe explain [FR-203]                 why a rule matters and how to fix it well
@@ -1805,7 +1921,7 @@ async function runCli(argv, opts = {}) {
       }
       const result = await runCheck(root, cfg, true, only);
       if (rest.includes("--claude-hook")) {
-        const out = toClaudeHook(result, root);
+        const out = toClaudeHook(result, root, receipts(root, result.findings));
         if (out) log(opts)(out);
         return 0;
       }
@@ -1831,6 +1947,22 @@ async function runCli(argv, opts = {}) {
       return result.counts.error > 0 ? 1 : 0;
     } catch (e) {
       err(opts)(`fringe: internal error: ${e.message}
+`);
+      return 2;
+    }
+  }
+  if (cmd === "scan") {
+    try {
+      const url = rest.find((a) => !a.startsWith("--"));
+      if (!url) {
+        err(opts)("fringe: scan needs a URL, e.g. fringe scan http://localhost:3000\n");
+        return 2;
+      }
+      const result = await scan(url, opts.cwd ?? process.cwd());
+      log(opts)(rest.includes("--json") ? toJson(result) : toPretty(result));
+      return result.counts.error > 0 ? 1 : 0;
+    } catch (e) {
+      err(opts)(`fringe: ${e.message}
 `);
       return 2;
     }

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   runCli
-} from "./chunk-Z4UN7OMW.js";
+} from "./chunk-5RPXF7S7.js";
 export {
   runCli
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fringetools/cli",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -20,6 +20,8 @@
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "axe-core": "^4.14.0",
+    "playwright-core": "^1.64.1",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0",
     "vitest": "^2.0.0"
@@ -49,5 +51,17 @@
   "homepage": "https://github.com/skc-learn/fringe#readme",
   "bugs": {
     "url": "https://github.com/skc-learn/fringe/issues"
+  },
+  "peerDependencies": {
+    "playwright-core": ">=1.40",
+    "axe-core": ">=4.8"
+  },
+  "peerDependenciesMeta": {
+    "playwright-core": {
+      "optional": true
+    },
+    "axe-core": {
+      "optional": true
+    }
   }
 }

package/skill/fringe-help/SKILL.md

@@ -24,6 +24,7 @@ Fringe checks agent-written frontends for accessibility, state, dark-pattern and
 | `check [dir]` | Scan and print findings and the health score; exit 1 on any error |
 | `check --json` / `--hook` / `--claude-hook` | Machine output; CI gate; agent feedback form |
 | `check --update-baseline` | Accept today's findings; only new ones gate |
+| `scan <url>` | Runtime check of a live page: real contrast, keyboard walk (needs `playwright-core` + `axe-core`) |
 | `plan [dir\|file]` | Ordered fix batches (shared components first) with recipes |
 | `explain [FR-203]` | Why a rule matters and how to fix it well |
 | `check --record [--manifest f]` | Append the run to `.fringe/ledger.jsonl` |