@fringetools/cli 0.3.1 → 0.4.1

package/README.md

@@ -22,7 +22,7 @@ Prefer a permanent command? `npm install -D @fringetools/cli`, then `npx fringe
 | Command | What it does |
 |---|---|
 | `fringe check [dir\|file]` | Scan a directory (default `.`) or judge one file (the project root is found by climbing to the nearest `package.json`). Prints findings and the health score. Exit `1` on any `error`. |
-| `fringe scan <url> [--json]` | **Runtime check of a live page** (needs `npm i -D playwright-core axe-core`; uses your installed Chrome). Runs axe-core for real contrast, computed names and ARIA relations (`FR-400`; critical/serious = `error`, the rest `review`), then walks the page with Tab and reports keyboard traps (`FR-401`, error) and controls Tab never reaches (review). Accepts `http(s)://` and `file://` URLs. Exit `1` on errors. |
+| `fringe scan <url> [--states file] [--json]` | **Runtime check of a live page** (needs `npm i -D playwright-core axe-core`; uses your installed Chrome). Runs axe-core for real contrast, computed names and ARIA relations (`FR-400`; critical/serious = `error`, the rest `review`), then walks the page with Tab and reports keyboard traps (`FR-401`, error) and controls Tab never reaches (review). Accepts `http(s)://` and `file://` URLs. Exit `1` on errors. |
 | `fringe plan [dir\|file] [--scan url] [--json] [--limit n]` | **Fix order for a repo with many findings**: P0 (errors in shared components or critical paths) → P1 (other errors, mechanical first) → P2 review → P3 polish, each cluster with its fix recipe. Never gates (exit 0). `--scan <url>` adds the live page's runtime findings to the same plan (one cluster per axe rule, with element selectors). `--json` = `fringe/plan.v1`. |
 | `fringe explain [FR-203]` | Why a rule matters, the preferred fix and the tempting fix to avoid. No id lists all 36 rules. |
 | `fringe explain pattern [form]` | Build-time best-practice checklist for a component type (`form`, `modal`, `navigation`, `data-view`); each item is marked *verified* (a rule checks it) or *judged*. |
@@ -31,7 +31,8 @@ Prefer a permanent command? `npm install -D @fringetools/cli`, then `npx fringe
 | `fringe check --hook` | One-line `fringe/hook.v1` JSON for CI / pre-commit. Exits `1` on errors. Claude Code does **not** feed this back — use `--claude-hook` for agents. Wins over `--json`. |
 | `fringe check --update-baseline` | Accept today's findings into `fringe.baseline.json` (commit it). Exit `0`. |
 | `fringe check --record [--manifest <path>]` | Also append this run to `.fringe/ledger.jsonl`, optionally merging an agent flow manifest. |
-| `fringe init [path]` | Add the Claude Code hook and install the five skills. Safe to re-run; refuses to touch an invalid `settings.json`. |
+| `fringe` (no arguments) | Checks the current folder, and if the post-edit check is not set up yet, says how to set it up. |
+| `fringe init [path] [--global]` | Add the Claude Code hook and install the six skills. `--global` writes to `~/.claude` so every project is covered. Uses the project's own installed copy of Fringe when there is one (faster), otherwise `npx`. Safe to re-run; refuses to touch an invalid `settings.json`. |
 | `fringe open [path] [--port <n>]` | Serve the ledger as a plain HTML page on `127.0.0.1:4173` (loopback only). Ctrl+C to stop. |
 | `fringe --help` · `--version` | Usage / version. |
 
@@ -72,7 +73,37 @@ npx @fringetools/cli scan http://localhost:3000
 
 What it reports: every axe-core WCAG 2.0 to 2.2 A/AA violation, one finding per element (`FR-400`, WCAG criterion attached), and a Tab walk (`FR-401`): focus that keeps landing on one element is a *keyboard trap*; interactive elements Tab never reaches are listed. Radio buttons (reached by arrow keys) and hidden controls are excluded.
 
-Example: on a real project page the static check reported no findings and `scan` reported 17 color-contrast errors. Limits, plainly: it scans one URL in its initial state (no login, no opening of menus or modals yet); it needs the page running; findings have no source line (they carry a CSS selector); automated checks only find part of the real problems. `fringe plan --scan <url>` merges it with the static findings into one fix order. It does not feed the baseline or `fringe-ignore` yet, and is not part of the edit hook (it needs a running app and takes seconds).
+Example: on a real project page the static check reported no findings and `scan` reported 17 color-contrast errors. ### States: audit what only exists after a click
+
+Most real problems live in states the first load never shows: an open menu, a modal, a form after a failed submit. Describe them in `fringe.scan.json` (found in the current directory, or pass `--states <file>`):
+
+```json
+{
+  "states": [
+    { "name": "filters open", "steps": [ { "click": "#open-filters" } ] },
+    { "name": "bad login",    "steps": [ { "fill": "#email", "value": "nobody@example.com" }, { "fill": "#password", "value": "wrong" }, { "click": "text=Sign in" }, { "waitFor": "[role=alert]" } ] }
+  ]
+}
+```
+
+For each state Fringe reloads the page, runs the steps, then audits the result (axe-core and the Tab walk). Steps are exactly one of `click`, `fill` (with `value`), `press`, `hover`, `waitFor`, `goto`; selectors are [Playwright selectors](https://playwright.dev/docs/other-locators) (CSS, `text=...`, `role=...`). Findings are labelled `[filters open]` and cluster separately from the same rule on the initial page. A step that fails (selector not found) is reported as `FR-402` ("state could not be reached") and nothing in that state is audited. Use throw-away test data in `fill` values and do not commit real credentials. `plan --scan` uses the same file.
+
+### Stress modes: how the page behaves under real-world conditions
+
+```sh
+npx @fringetools/cli scan http://localhost:3000 --stress                 # all three
+npx @fringetools/cli scan http://localhost:3000 --modes dark,reflow      # a subset
+```
+
+| Mode | What it does | Reports |
+|---|---|---|
+| `dark` | Re-audits with the browser asking for a dark color scheme | contrast and other axe findings that appear only in dark mode |
+| `reduced` | Asks for reduced motion, then looks for animations still looping | `FR-403` (review) |
+| `reflow` | Shrinks to 320px (a 400% zoom of a 1280px window) | `FR-404` (review, WCAG 1.4.10) if the page needs horizontal scrolling, plus new axe findings |
+
+Each mode runs on a fresh page so one mode's emulation never leaks into the next, and only findings the plain page did not already have are kept. Findings are labelled `[dark mode]`, `[reduced motion]`, `[reflow]`. Modes apply to the initial page, not to named states.
+
+Limits, plainly: states are independent (each starts from a fresh load of the URL, so there are no multi-page flows that depend on earlier state beyond `goto`); it needs the page running; findings have no source line (they carry a CSS selector); automated checks only find part of the real problems. `fringe plan --scan <url>` merges it with the static findings into one fix order. It does not feed the baseline or `fringe-ignore` yet, and is not part of the edit hook (it needs a running app and takes seconds).
 
 ## Priority, clusters and fix plans
 
@@ -137,7 +168,7 @@ The hook also keeps `.fringe/last.json` (the previous run's errors) and tells th
 
 This was verified end to end with real agent runs: the agent receives the findings and fixes them (see [docs/architecture.md](../../docs/architecture.md)). Why `--claude-hook` and not `--hook`: Claude Code only passes a hook's output to the agent as `decision`/`reason` JSON on exit 0 (or stderr on exit 2); the CI contract `--hook` exits 1 and is ignored.
 
-**Skills** — `fringe init` installs five into `.claude/skills/` (sources in [skill/](skill/), one folder each); the Claude Code plugin ships the same folders, namespaced `/fringe:…`: `fringe` (below), `fringe-review` ("review this page": ranked, plain-English findings with fixes), `fringe-audit` (whole-repo plan: top rules and files, a fix order, offers `--update-baseline`), `fringe-debt` (lists `fringe-ignore` suppressions and the baseline) and `fringe-help` (quick reference). Invoke as `/fringe-review` etc. Reviews run `fringe check`, so Claude Code will ask you to approve that command once (or allow `Bash(fringe:*)` / `Bash(npx:*)`).
+**Skills** — `fringe init` installs six into `.claude/skills/` (sources in [skill/](skill/), one folder each); the Claude Code plugin ships the same folders, namespaced `/fringetool:…`: `fringe` (below), `fringe-review` ("review this page": ranked, plain-English findings with fixes), `fringe-audit` (whole-repo plan: top rules and files, a fix order, offers `--update-baseline`), `fringe-debt` (lists `fringe-ignore` suppressions and the baseline), `fringe-setup` (guided onboarding: environment check, hook, baseline offer, critical paths) and `fringe-help` (quick reference). Invoke as `/fringe-review` etc. Reviews run `fringe check`, so Claude Code will ask you to approve that command once (or allow `Bash(fringe:*)` / `Bash(npx:*)`).
 
 **The main skill** (`.claude/skills/fringe/SKILL.md`) teaches the agent the ladder: *Flow* (cut what users don't need, with evidence in `.fringe/manifest.json`) → *Edges* (fix every hook finding, never silence a rule to get green) → *Polish* (tokens, scales, no AI look), then record the run. It is plain Markdown, so any agent platform that reads `AGENTS.md`/skill files can use it as-is.
 

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-P5N5ETBT.js";
+} from "./chunk-7ZFEVMML.js";
 
 // src/bin.ts
 process.exitCode = await runCli(process.argv.slice(2));

package/dist/{chunk-P5N5ETBT.js → chunk-7ZFEVMML.js}

@@ -4,7 +4,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync9, statSync } fr
 import { dirname as dirname2, join as join10, resolve } from "path";
 
 // src/version.ts
-var VERSION = "0.3.1";
+var VERSION = "0.4.1";
 
 // src/check.ts
 import { readFileSync as readFileSync5 } from "fs";
@@ -1639,7 +1639,91 @@ function tabWalkFindings(url, focusables, visits) {
     out.push({ rule: "FR-401", severity: "review", message: `${missed.length} interactive element(s) were not reached with Tab: ${missed.slice(0, 5).join(", ")}${missed.length > 5 ? ", \u2026" : ""}`, hint: "make sure each control is a real button/link/input or has tabIndex={0}; hidden-until-hover controls also land here", loc: at(url), wcag: "2.1.1" });
   return out;
 }
-async function scan(url, cwd = process.cwd()) {
+var STEP_KEYS = ["click", "fill", "press", "hover", "waitFor", "goto"];
+function parseStates(json) {
+  const bad = (m) => {
+    throw new Error(`fringe.scan.json: ${m}`);
+  };
+  const states = json?.states;
+  if (!Array.isArray(states)) return bad('expected { "states": [ ... ] }');
+  return states.map((s, i) => {
+    if (typeof s?.name !== "string" || !s.name.trim()) bad(`states[${i}] needs a "name"`);
+    if (!Array.isArray(s.steps) || s.steps.length === 0) bad(`state "${s.name}" needs a non-empty "steps" list`);
+    for (const [k, step] of s.steps.entries()) {
+      const keys = STEP_KEYS.filter((x) => step && typeof step === "object" && x in step);
+      if (keys.length !== 1 || typeof step[keys[0]] !== "string") bad(`state "${s.name}" step ${k + 1} must be exactly one of ${STEP_KEYS.join(", ")} with a string value`);
+      if (keys[0] === "fill" && typeof step.value !== "string") bad(`state "${s.name}" step ${k + 1}: fill needs a "value"`);
+    }
+    return { name: s.name.trim(), steps: s.steps };
+  });
+}
+async function runStep(page, step, base) {
+  const t = { timeout: 1e4 };
+  if ("click" in step) await page.click(step.click, t);
+  else if ("fill" in step) await page.fill(step.fill, step.value, t);
+  else if ("press" in step) await page.keyboard.press(step.press);
+  else if ("hover" in step) await page.hover(step.hover, t);
+  else if ("waitFor" in step) await page.waitForSelector(step.waitFor, t);
+  else await page.goto(new URL(step.goto, base).href, { waitUntil: "load", timeout: 3e4 });
+  await page.waitForTimeout(150);
+}
+async function audit(page, axePath, url) {
+  if (!await page.evaluate(() => !!globalThis.axe)) await page.addScriptTag({ path: axePath });
+  const axeRes = await page.evaluate(() => globalThis.axe.run(document, { runOnly: { type: "tag", values: ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"] } }));
+  const describe = `(el) => { const i = [...document.querySelectorAll(${JSON.stringify(FOCUSABLE)})].indexOf(el); return i < 0 ? null : el.tagName.toLowerCase() + (el.id ? '#' + el.id : '') + '[' + i + ']'; }`;
+  const focusables = await page.evaluate(`[...document.querySelectorAll(${JSON.stringify(FOCUSABLE)})].filter((el) => { const r = el.getBoundingClientRect(); const s = getComputedStyle(el); return r.width > 0 && r.height > 0 && s.visibility !== 'hidden' && !el.disabled; }).map((el, _i, all) => (${describe})(el))`);
+  const visits = [];
+  for (let i = 0; i < focusables.length + 6; i++) {
+    await page.keyboard.press("Tab");
+    await page.waitForTimeout(40);
+    const now = await page.evaluate(`(${describe})(document.activeElement)`);
+    if (now === null && visits.length > 0) break;
+    visits.push(now);
+  }
+  return [...axeToFindings(url, axeRes.violations), ...tabWalkFindings(url, focusables, visits)];
+}
+var inState = (name, url, f) => ({ ...f, message: `[${name}] ${f.message}`, loc: { ...f.loc, file: `${url} [${name}]` }, ...f.cluster ? { cluster: `${f.cluster} [${name}]` } : {} });
+var MODES = ["dark", "reduced", "reflow"];
+function parseModes(list) {
+  const out = list.split(",").map((m) => m.trim()).filter(Boolean);
+  const bad = out.find((m) => !MODES.includes(m));
+  if (bad || out.length === 0) throw new Error(`unknown scan mode '${bad ?? ""}': use ${MODES.join(", ")}`);
+  return out;
+}
+function onlyNew(base, extra) {
+  const seen = new Set(base.map((f) => `${f.rule}|${f.message}`));
+  return extra.filter((f) => !seen.has(`${f.rule}|${f.message}`));
+}
+var countRunningLoops = `[...document.getAnimations()].filter((a) => a.playState === 'running' && a.effect && a.effect.getComputedTiming().iterations === Infinity).map((a) => { const t = a.effect.target; return t ? t.tagName.toLowerCase() + (t.id ? '#' + t.id : '') + (typeof t.className === 'string' && t.className ? '.' + t.className.trim().split(/\\s+/)[0] : '') : 'unknown'; })`;
+async function stress(browser, axePath, url, mode, base) {
+  const page = await browser.newPage();
+  try {
+    return await stressOn(page, axePath, url, mode, base);
+  } finally {
+    await page.close();
+  }
+}
+async function stressOn(page, axePath, url, mode, base) {
+  const at0 = { file: `${url} [${mode}]`, line: 1, col: 0 };
+  await page.goto(url, { waitUntil: "load", timeout: 3e4 });
+  if (mode === "dark") {
+    await page.emulateMedia({ colorScheme: "dark" });
+    await page.waitForTimeout(150);
+    return onlyNew(base, await audit(page, axePath, url)).map((f) => inState("dark mode", url, f));
+  }
+  if (mode === "reduced") {
+    await page.emulateMedia({ reducedMotion: "reduce" });
+    await page.waitForTimeout(300);
+    const loops = await page.evaluate(countRunningLoops);
+    return loops.length === 0 ? [] : [{ rule: "FR-403", severity: "review", message: `[reduced motion] ${loops.length} animation(s) keep looping when the user asks for reduced motion: ${loops.slice(0, 3).join(", ")}`, hint: "honour prefers-reduced-motion: stop or replace infinite animations under @media (prefers-reduced-motion: reduce)", loc: at0 }];
+  }
+  await page.setViewportSize({ width: 320, height: 256 });
+  await page.waitForTimeout(250);
+  const wide = await page.evaluate(() => document.documentElement.scrollWidth - document.documentElement.clientWidth);
+  const out = wide > 1 ? [{ rule: "FR-404", severity: "review", message: `[reflow] content is ${wide}px wider than a 320px screen, so it needs horizontal scrolling`, hint: "let content reflow to one column at 320px (WCAG 1.4.10); wide tables and code blocks may scroll inside their own container", loc: at0, wcag: "1.4.10" }] : [];
+  return [...out, ...onlyNew(base, await audit(page, axePath, url)).map((f) => inState("reflow", url, f))];
+}
+async function scan(url, cwd = process.cwd(), states = [], modes = []) {
   if (!/^(https?|file):\/\//i.test(url)) throw new Error(`fringe scan takes an http(s):// or file:// URL, got '${url}'`);
   const req = createRequire(join8(cwd, "noop.js"));
   let playwright, axePath;
@@ -1662,22 +1746,24 @@ async function scan(url, cwd = process.cwd()) {
   try {
     const page = await browser.newPage();
     await page.goto(url, { waitUntil: "load", timeout: 3e4 });
-    await page.addScriptTag({ path: axePath });
-    const axeRes = await page.evaluate(() => globalThis.axe.run(document, { runOnly: { type: "tag", values: ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa", "wcag22aa"] } }));
-    const describe = `(el) => { const i = [...document.querySelectorAll(${JSON.stringify(FOCUSABLE)})].indexOf(el); return i < 0 ? null : el.tagName.toLowerCase() + (el.id ? '#' + el.id : '') + '[' + i + ']'; }`;
-    const focusables = await page.evaluate(`[...document.querySelectorAll(${JSON.stringify(FOCUSABLE)})].filter((el) => { const r = el.getBoundingClientRect(); const s = getComputedStyle(el); return r.width > 0 && r.height > 0 && s.visibility !== 'hidden' && !el.disabled; }).map((el, _i, all) => (${describe})(el))`);
-    const visits = [];
-    for (let i = 0; i < focusables.length + 6; i++) {
-      await page.keyboard.press("Tab");
-      await page.waitForTimeout(40);
-      const now = await page.evaluate(`(${describe})(document.activeElement)`);
-      if (now === null && visits.length > 0) break;
-      visits.push(now);
+    const all = await audit(page, axePath, url);
+    const plain = [...all];
+    for (const st of states) {
+      await page.goto(url, { waitUntil: "load", timeout: 3e4 });
+      let step = 0;
+      try {
+        for (; step < st.steps.length; step++) await runStep(page, st.steps[step], url);
+      } catch (e) {
+        all.push({ rule: "FR-402", severity: "review", message: `[${st.name}] state could not be reached: step ${step + 1} ${JSON.stringify(st.steps[step])} failed (${String(e.message).split("\n")[0].slice(0, 120)})`, hint: "fix the step in fringe.scan.json or the page; nothing in this state was audited", loc: { file: `${url} [${st.name}]`, line: 1, col: 0 } });
+        continue;
+      }
+      all.push(...(await audit(page, axePath, url)).map((f) => inState(st.name, url, f)));
     }
-    const { findings, clusters } = rankScan(url, [...axeToFindings(url, axeRes.violations), ...tabWalkFindings(url, focusables, visits)]);
+    for (const m of modes) all.push(...await stress(browser, axePath, url, m, plain));
+    const { findings, clusters } = rankScan(url, all);
     const counts = { error: 0, review: 0, signal: 0 };
     for (const f of findings) counts[f.severity]++;
-    return { stack: { jsx: false, tailwind: false, vue: false, svelte: false, html: true }, files: 1, skipped: [], findings, clusters, counts, score: score(counts, { error: 10, review: 3, signal: 1 }, 1) };
+    return { stack: { jsx: false, tailwind: false, vue: false, svelte: false, html: true }, files: 1 + states.length + modes.length, skipped: [], findings, clusters, counts, score: score(counts, { error: 10, review: 3, signal: 1 }, 1) };
   } finally {
     await browser.close();
   }
@@ -1687,7 +1773,7 @@ function rankScan(url, findings) {
   const ranked = findings.map((f) => {
     const priority = Math.round(TIER[f.severity] + wcagBonus(f.wcag));
     const id = f.cluster ?? `${f.rule}@${url}`;
-    const c = clusters.get(id) ?? { id, rule: f.rule, file: url, count: 0, priority: 0, fixability: "judgment", rootCause: "local", importedBy: 0, critical: false };
+    const c = clusters.get(id) ?? { id, rule: f.rule, file: f.loc.file, count: 0, priority: 0, fixability: "judgment", rootCause: "local", importedBy: 0, critical: false };
     c.count++;
     c.priority = Math.max(c.priority, priority);
     clusters.set(id, c);
@@ -1707,6 +1793,18 @@ import { dirname, join as join9 } from "path";
 import { fileURLToPath } from "url";
 var HOOK = "npx -y @fringetools/cli check --claude-hook";
 var SKILL_DIR = fileURLToPath(new URL("../skill/", import.meta.url));
+function hookCommand(root) {
+  return existsSync2(join9(root, "node_modules", "@fringetools", "cli", "package.json")) ? "npx --no-install fringe check --claude-hook" : HOOK;
+}
+function isWired(root, home) {
+  for (const dir of [root, home]) {
+    try {
+      if (/claude-hook|fringe(tool)?@/.test(readFileSync8(join9(dir, ".claude", "settings.json"), "utf8"))) return true;
+    } catch {
+    }
+  }
+  return false;
+}
 function initProject(root) {
   const done = [];
   const settingsPath = join9(root, ".claude", "settings.json");
@@ -1721,7 +1819,7 @@ function initProject(root) {
   const post = (settings.hooks ??= {}).PostToolUse ??= [];
   if (/(fringe|@fringetools\/cli) check/.test(JSON.stringify(post))) done.push("hook already present");
   else {
-    post.push({ matcher: "Edit|Write", hooks: [{ type: "command", command: HOOK }] });
+    post.push({ matcher: "Edit|Write", hooks: [{ type: "command", command: hookCommand(root) }] });
     mkdirSync3(dirname(settingsPath), { recursive: true });
     writeFileSync3(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     done.push(`hook added to ${settingsPath}`);
@@ -1738,6 +1836,9 @@ function initProject(root) {
   return done;
 }
 
+// src/index.ts
+import { homedir } from "os";
+
 // src/patterns.ts
 var PATTERNS = {
   form: {
@@ -1902,15 +2003,31 @@ function resolveTarget(arg) {
   }
   return { root: dir, only: /* @__PURE__ */ new Set([arg]) };
 }
+function loadStates(cwd, rest) {
+  const i = rest.indexOf("--states");
+  const file2 = i !== -1 ? resolve(cwd, rest[i + 1] ?? "") : join10(cwd, "fringe.scan.json");
+  if (i === -1 && !existsSync3(file2)) return [];
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync9(file2, "utf8"));
+  } catch (e) {
+    throw new Error(`${file2}: ${e.message}`);
+  }
+  return parseStates(raw);
+}
+function loadModes(rest) {
+  const i = rest.indexOf("--modes");
+  return i !== -1 ? parseModes(rest[i + 1] ?? "") : rest.includes("--stress") ? [...MODES] : [];
+}
 var weakEvidence = (e) => typeof e !== "string" || e.trim().length < 12 || /^(n\/?a|none|tbd|obvious|unnecessary|clutter|unused)\.?$/i.test(e.trim());
 var HELP = `fringe check [--json] [--hook] [--record] [--manifest <path>] [path]
 fringe check --claude-hook [path]       for Claude Code hooks (feeds errors back to the agent)
 fringe check --update-baseline [path]   accept today's findings; only new ones gate
-fringe scan <url> [--json]               runtime check in a real browser (axe-core + keyboard walk); needs playwright-core and axe-core
+fringe scan <url> [--states f] [--stress | --modes dark,reduced,reflow] [--json]               runtime check in a real browser (axe-core + keyboard walk); needs playwright-core and axe-core
 fringe plan [dir|file] [--scan url] [--json] [--limit n]   ordered fix batches with recipes; --scan adds the live page
 fringe explain pattern [form]           best-practice checklist for a component type
 fringe explain [FR-203]                 why a rule matters and how to fix it well
-fringe init [path]                       add the Claude Code hook + skill
+fringe init [path] [--global]          add the Claude Code hook + skills (--global: every project)
 fringe open [path] [--port <n>]   serve the .fringe ledger on 127.0.0.1
 fringe --help | --version`;
 var KNOWN_FLAGS = /* @__PURE__ */ new Set(["--json", "--hook", "--claude-hook", "--record", "--manifest", "--update-baseline"]);
@@ -1933,6 +2050,11 @@ function parseArgs(rest, warn) {
 }
 async function runCli(argv, opts = {}) {
   const [cmd, ...rest] = argv;
+  if (cmd === void 0) {
+    const code = await runCli(["check"], opts);
+    if (!isWired(opts.cwd ?? process.cwd(), opts.home ?? homedir())) log(opts)("\nfringe: not checking after your agent's edits yet. Run `npx @fringetools/cli init` (this project) or `init --global` (every project).");
+    return code;
+  }
   if (cmd === "--version" || cmd === "-v") {
     log(opts)(VERSION);
     return 0;
@@ -1983,12 +2105,13 @@ async function runCli(argv, opts = {}) {
   }
   if (cmd === "scan") {
     try {
-      const url = rest.find((a) => !a.startsWith("--"));
+      const url = rest.find((a, i) => !a.startsWith("--") && rest[i - 1] !== "--states" && rest[i - 1] !== "--modes");
       if (!url) {
         err(opts)("fringe: scan needs a URL, e.g. fringe scan http://localhost:3000\n");
         return 2;
       }
-      const result = await scan(url, opts.cwd ?? process.cwd());
+      const cwd = opts.cwd ?? process.cwd();
+      const result = await scan(url, cwd, loadStates(cwd, rest), loadModes(rest));
       log(opts)(rest.includes("--json") ? toJson(result) : toPretty(result));
       return result.counts.error > 0 ? 1 : 0;
     } catch (e) {
@@ -2007,12 +2130,15 @@ async function runCli(argv, opts = {}) {
       }
       const li = rest.indexOf("--limit");
       const limit = li !== -1 ? Number(rest[li + 1]) || void 0 : void 0;
-      const paths = parseArgs(rest.filter((a, i) => a !== "--limit" && rest[i - 1] !== "--limit" && a !== "--json" && a !== "--scan" && rest[i - 1] !== "--scan"), err(opts));
+      const paths = parseArgs(rest.filter((a, i) => a !== "--limit" && rest[i - 1] !== "--limit" && a !== "--json" && a !== "--scan" && rest[i - 1] !== "--scan" && a !== "--states" && rest[i - 1] !== "--states" && a !== "--stress" && a !== "--modes" && rest[i - 1] !== "--modes"), err(opts));
       const arg = resolve(opts.cwd ?? process.cwd(), paths[0] ?? ".");
       const { root, only } = resolveTarget(arg);
       const cfg = loadConfig(root);
       let result = await runCheck(root, cfg, true, only);
-      if (scanUrl) result = mergeScan(result, await scan(scanUrl, opts.cwd ?? process.cwd()), cfg.weights);
+      if (scanUrl) {
+        const cwd = opts.cwd ?? process.cwd();
+        result = mergeScan(result, await scan(scanUrl, cwd, loadStates(cwd, rest), loadModes(rest)), cfg.weights);
+      }
       log(opts)(rest.includes("--json") ? toPlanJson(result, limit) : toPlanMarkdown(result, paths[0] ?? ".", limit));
       return 0;
     } catch (e) {
@@ -2043,7 +2169,10 @@ async function runCli(argv, opts = {}) {
   }
   if (cmd === "init") {
     try {
-      for (const line of initProject(resolve(opts.cwd ?? process.cwd(), rest[0] ?? "."))) log(opts)(`fringe: ${line}`);
+      const global = rest.includes("--global") || rest.includes("-g");
+      const target = global ? opts.home ?? homedir() : resolve(opts.cwd ?? process.cwd(), rest.find((a) => !a.startsWith("-")) ?? ".");
+      for (const line of initProject(target)) log(opts)(`fringe: ${line}`);
+      if (global) log(opts)("fringe: set up for your user, so every project is covered (run without --global to set up one project only)");
       return 0;
     } catch (e) {
       err(opts)(`fringe: ${e.message}

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 interface CliOpts {
     log?: (s: string) => void;
     cwd?: string;
-    err?: (s: string) => void;
+    err?: (s: string) => void; /** Home directory for `init --global` (tests override it). */
+    home?: string;
 }
 declare function runCli(argv: string[], opts?: CliOpts): Promise<number>;
 

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   runCli
-} from "./chunk-P5N5ETBT.js";
+} from "./chunk-7ZFEVMML.js";
 export {
   runCli
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fringetools/cli",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "license": "MIT",
   "type": "module",
   "bin": {

package/skill/fringe/SKILL.md

@@ -5,7 +5,7 @@ description: Use when writing or changing frontend code (JSX/TSX, HTML, CSS, Vue
 
 # Fringe
 
-Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli` in its place (e.g. `npx -y @fringetools/cli check --json .`).
+Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli@0.4.0` in its place (e.g. `npx -y @fringetools/cli@0.4.0 check --json .`).
 
 Ponytail trims your code. Fringe handles your edges. Work the ladder in order.
 

package/skill/fringe-audit/SKILL.md

@@ -5,7 +5,7 @@ description: Use when the user wants a whole-repo UX/accessibility audit, a plan
 
 # Fringe audit
 
-Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli` in its place (e.g. `npx -y @fringetools/cli check --json .`).
+Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli@0.4.0` in its place (e.g. `npx -y @fringetools/cli@0.4.0 check --json .`).
 
 1. Run `fringe plan --json --limit 5` (or `fringe plan` for Markdown). It already orders the work: P0 errors in shared components or critical paths, P1 other errors with mechanical fixes first, P2 review, P3 polish, each cluster with its recipe. Use that order; do not re-derive it. Add `"critical": ["src/checkout/**"]` to `fringe.config.json` if the user names the pages that matter most. Do not print every finding.
 2. Summarize as a plan:

package/skill/fringe-debt/SKILL.md

@@ -7,7 +7,7 @@ description: Use when the user asks what Fringe findings have been silenced or d
 
 Fringe has two ways to defer a finding: an inline `fringe-ignore` comment and the `fringe.baseline.json` file. This lists both so a deferral can't quietly become permanent.
 
-Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli` in its place.
+Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli@0.4.0` in its place.
 
 1. **Inline suppressions.** `git grep --no-index --exclude-standard -nE 'fringe-ignore +FR-[0-9]+'`. One row per hit: `<file>:<line>, <rule> — <why, if the comment or nearby code says>`. Skip hits that are only prose mentioning the convention.
 2. **Baseline.** If `fringe.baseline.json` exists, count entries per rule (each entry is `rule|file|message`) and list the files with the most. If it is missing, say there is no baseline.

package/skill/fringe-help/SKILL.md

@@ -15,16 +15,17 @@ Fringe checks agent-written frontends for accessibility, state, dark-pattern and
 | `/fringe-review` | Review a page or component: ranked findings with plain-English fixes |
 | `/fringe-audit` | Audit the whole repo: top rules and files, a fix order, offer a baseline |
 | `/fringe-debt` | List silenced findings (`fringe-ignore`, baseline) |
+| `/fringe-setup` | Guided onboarding: wire the hook, offer a baseline, set critical paths |
 | `/fringe-help` | This reference |
 
-**Commands** (`fringe`, or `npx -y @fringetools/cli`)
+**Commands** (`fringe`, or `npx -y @fringetools/cli@0.4.0`)
 
 | Command | What it does |
 |---|---|
 | `check [dir]` | Scan and print findings and the health score; exit 1 on any error |
 | `check --json` / `--hook` / `--claude-hook` | Machine output; CI gate; agent feedback form |
 | `check --update-baseline` | Accept today's findings; only new ones gate |
-| `scan <url>` | Runtime check of a live page: real contrast, keyboard walk (needs `playwright-core` + `axe-core`) |
+| `scan <url>` | Runtime check of a live page: real contrast, keyboard walk, and named states from `fringe.scan.json` (needs `playwright-core` + `axe-core`) |
 | `plan [dir\|file] [--scan url]` | Ordered fix batches (shared components first) with recipes; `--scan` adds the live page |
 | `explain [FR-203]` | Why a rule matters and how to fix it well |
 | `check --record [--manifest f]` | Append the run to `.fringe/ledger.jsonl` |

package/skill/fringe-review/SKILL.md

@@ -5,7 +5,7 @@ description: Use when the user asks to review, check or critique a UI, page or c
 
 # Fringe review
 
-Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli` in its place (e.g. `npx -y @fringetools/cli check --json .`).
+Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli@0.4.0` in its place (e.g. `npx -y @fringetools/cli@0.4.0 check --json .`).
 
 1. Run `fringe check --json <file or folder>` from the project root: the file or page the user named, else `.`. Each finding already carries `priority` and `fixability`; report highest priority first. For the fix text use `fringe explain <rule>` (why, recipe, what to avoid) rather than improvising.
 2. Report in plain English, no jargon left unexplained:

package/skill/fringe-setup/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: fringe-setup
+description: Use when the user wants to set up or get started with Fringe, or asks why it is not checking their edits ("set up fringe", "get started", "install fringe", /fringe-setup). Guided onboarding: checks the environment, wires the hook, offers a baseline, and records the critical pages.
+---
+
+# Fringe setup
+
+Command: use `fringe` if it is on the PATH, otherwise `npx -y @fringetools/cli` in its place. Ask before each step that changes a file, and say what it will change.
+
+1. **Environment.** Run `node -v` (needs 18 or newer). If it is missing or older, stop and tell the user to install Node first.
+2. **Where things stand.** Run `fringe check .` and report the counts. If it says it is not checking after edits, the hook is not wired.
+3. **Wire the hook (skip if the Fringe plugin is already installed, or the check above reported it is set up).** Ask: this project only, or every project? Then run `fringe init` or `fringe init --global`. Both add the post-edit hook and the skills without touching other settings.
+4. **Existing problems.** If there are more than a handful of errors, explain that `fringe check --update-baseline` records today's findings so only new ones block, and offer it. Do not run it without a yes. Remind the user to commit `fringe.baseline.json`.
+5. **What matters most.** Ask which folders are most important to users (checkout, sign-up, login). Add them to `fringe.config.json` as `"critical": ["src/checkout/**", ...]`, merging into the file if it exists, never overwriting other keys.
+6. **Optional.** Mention `fringe scan <url>` (needs `npm i -D playwright-core axe-core` and Chrome) for real contrast and keyboard checks; install nothing unless asked.
+7. **Finish** with one short summary of what was changed and the commands to remember: `/fringe-review`, `/fringe-audit`, `fringe plan`, `fringe explain FR-203`.
+
+If anything fails, report the exact message; do not retry blindly or edit `.claude/settings.json` by hand.