@hajimism/dek 0.4.0 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,98 @@
 
 Release notes for `@hajimism/dek`. From 0.1.0 on, release-please writes this file from the Conventional Commits on `main`.
 
+## [0.5.1](https://github.com/hajimism/dek/compare/v0.5.0...v0.5.1) (2026-10-30)
+
+
+### Bug Fixes
+
+* **cli:** stop a dev server whose parent died before the server was up ([80b533f](https://github.com/hajimism/dek/commit/80b533fc691cfc104b6c83f7d99be4d73fc75c8d))
+* **dev:** say when the running server serves another deck only ([333ae06](https://github.com/hajimism/dek/commit/333ae06818fa8ad09f5ed492ae33148cce9254fd))
+* judge a command that skips its stdin by how it exits, not as one that cannot start ([103152c](https://github.com/hajimism/dek/commit/103152cd2132ba9c430ede4d7020844f7a8dcf9a))
+* **lint:** free no DEK013 class a skeleton or a slide script may use ([e32638b](https://github.com/hajimism/dek/commit/e32638b12220055d8a5a329b9e93f9eda47371e8))
+* **lint:** name the files a hint sends you to as paths from where the command ran ([5943dbe](https://github.com/hajimism/dek/commit/5943dbe1b11ac4529faae9cc1b98f22b4c63d214))
+* **lint:** name the files a hint sends you to as paths from where the command ran ([c5fcce3](https://github.com/hajimism/dek/commit/c5fcce3101061a6eaad55b27d94019f5b028e762))
+* **lint:** say how to stay within max_classes in DEK013 and DEK026 ([9c3078b](https://github.com/hajimism/dek/commit/9c3078bad4d93e5f381c99f5b6e0dd2c059f32dc))
+
+
+### Documentation
+
+* say that DEK035 leaves a deck that breaks by phrase to Chromium ([c21b428](https://github.com/hajimism/dek/commit/c21b4284db4a46a231778a4fa8d42aac38c46b0d))
+* say that DEK035 leaves a deck that breaks by phrase to Chromium ([dfef085](https://github.com/hajimism/dek/commit/dfef085bedf2d120c62a0f7418fd3d69f0a77001))
+
+## [0.5.0](https://github.com/hajimism/dek/compare/v0.4.0...v0.5.0) (2026-10-27)
+
+
+### ⚠ BREAKING CHANGES
+
+* **ref:** a dek.toml that pins a ref whose name holds a control character or a character a person cannot see no longer loads until that line is removed; `dekc pack` refuses a deck so named until its folder is renamed; and `dekc new` and `dekc init --deck` refuse such a name, which they took before. Every other name works as before.
+* where Chromium's sandbox does not start, `dekc shot <ref>` fails until DEK_ALLOW_UNSANDBOXED=1 is set.
+
+### Features
+
+* **ref:** report the characters in a ref that a person cannot see ([5ca233e](https://github.com/hajimism/dek/commit/5ca233e186125e821f1341cc790636f26654274a))
+
+
+### Bug Fixes
+
+* **build:** keep a minified stylesheet reading as its source where an escape meets a newline or a comment ([41fd1ba](https://github.com/hajimism/dek/commit/41fd1ba08abc63c8af1d9deb8e2b9d70bb5ceab5))
+* **build:** minify a stylesheet into one that reads as its source does ([bdcffb9](https://github.com/hajimism/dek/commit/bdcffb9edaf7238b33bdf740dc4072c6f8cdaaa1))
+* **cli:** at the project root, hint a command only for the decks that have what it names ([fe3f8fb](https://github.com/hajimism/dek/commit/fe3f8fb12c178a7d8bfcb40b4ed16b52d03a08ae))
+* **cli:** hint `dekc ls` for a deck that is not there, not `dekc ls <it>` ([1ee4554](https://github.com/hajimism/dek/commit/1ee455439734f57eaf03c6c91fd78a9423f4812f))
+* **cli:** name a ref by the ref in the hints about it ([e9d1a47](https://github.com/hajimism/dek/commit/e9d1a47fe282b766bed189212891f1aafcc38a94))
+* **dev:** print a failure of the dev server's lint or voice run instead of dropping it ([14a8e8c](https://github.com/hajimism/dek/commit/14a8e8ceb75247d850407aeeef3bba56f5525a88))
+* give up on a voice engine, a dev server, or a rumdl that never answers ([19023f2](https://github.com/hajimism/dek/commit/19023f2c3987c4e60f2fe7440d4e1d5369ec2f10))
+* keep a file's mode when dek writes it anew ([085d7e8](https://github.com/hajimism/dek/commit/085d7e8e4be2895c975cd76668d4c7af91937d96))
+* **lint:** list rumdl as skipped when what it printed is not SARIF ([74582e0](https://github.com/hajimism/dek/commit/74582e07153aeb77211083e87309cbe6214e8ba3))
+* **lint:** name the path beside a stray space in DEK021's hint only when it is a plain word ([b030691](https://github.com/hajimism/dek/commit/b03069178ab6b318749c0296aca5fc916ebc2cec))
+* **lint:** read a URL in DEK011 as the browser's URL parser reads it ([c0950a5](https://github.com/hajimism/dek/commit/c0950a59b6c25f1c561c101a07750b89c0a87283))
+* **lint:** say to run lint --visual again after lint --visual fails ([a00da44](https://github.com/hajimism/dek/commit/a00da4437aadf6373a4e888213f26d6efdd7462a))
+* **ls:** keep a ref's title, event, and date to one line, as AGENTS.md does ([af85b6e](https://github.com/hajimism/dek/commit/af85b6e8ef63175cfb3166465e533e6b361f166e))
+* **mv:** write script.md, slides, and voice.toml whole, never over the old file ([a7a22b3](https://github.com/hajimism/dek/commit/a7a22b34a1fb073181966bec4a7c7e88b88757ce))
+* print no color code a deck or a ref wrote, only dek's own ([27b6751](https://github.com/hajimism/dek/commit/27b6751eb48d84e2538983c618889f74389d5caa))
+* read a pack's or a GitHub tarball's tar with dek's own reader, so it unpacks no more than was counted ([bdda596](https://github.com/hajimism/dek/commit/bdda596bf5974e6c30f5d273090327d0ed114a6b))
+* read each attribute value as the browser does, its character references decoded ([65a58d1](https://github.com/hajimism/dek/commit/65a58d11497648690c539c8caa4bbe49c246a4c8))
+* read the keys after an array or inline table written over several lines ([fa8f268](https://github.com/hajimism/dek/commit/fa8f2680bec36c3b092f5b7eef5749cd4146d64a))
+* read url() and a string cut short by CR or FF where the browser does ([55296f2](https://github.com/hajimism/dek/commit/55296f2a8f04ffdea958b835132bc2ad4c8054d5))
+* **ref:** keep a ref's names out of hints, and to one short line in messages ([67f7d19](https://github.com/hajimism/dek/commit/67f7d19268cb1032978d62a1a0fe1ec2a209197c))
+* **ref:** refuse a pack whose deck's name holds a control character or one a person cannot see ([373f14f](https://github.com/hajimism/dek/commit/373f14f368057677c33d9c8bbaccc427e048d790))
+* **sample:** set the note on why-dek's read-only card in ink ([586d09d](https://github.com/hajimism/dek/commit/586d09d7e706ae56b731ee9c5a4b6f1b03406d2e))
+* say whenever Chromium draws without its sandbox, and draw a ref there only when asked ([293b3ff](https://github.com/hajimism/dek/commit/293b3ffd0fd12ff042831fc4816e96025d7336af))
+* **server:** keep what the dev server serves out of other sites' pages and frames ([260b0f0](https://github.com/hajimism/dek/commit/260b0f081de5d9821312456abbec2849dfac7fd7))
+* **shot:** send a ref's broken slide script to its author, not to lint ([c1045fa](https://github.com/hajimism/dek/commit/c1045faf8583ca61281b825811a172a72ec0bb6c))
+* **show:** keep the name of keyframes written as a string in the theme excerpt ([072b078](https://github.com/hajimism/dek/commit/072b07848a2799f7d2e98f42962330c2e407bbee))
+* **show:** say a slide is a ref's, and start a part on a line no file can write ([b6b2389](https://github.com/hajimism/dek/commit/b6b2389fe5cf8dfc9dac4fefa1eab88737d7075a))
+* sort dict.toml, decks, and slide files the same way on every machine ([29a3f3c](https://github.com/hajimism/dek/commit/29a3f3c4c6073fbdc5808c9921d296fa8e4125cf))
+* start every program dek runs with the environment as it is now ([ee6b319](https://github.com/hajimism/dek/commit/ee6b319d2772ff39ea82cf3dd8fd763d4fb130c8))
+* stop a command at its timeout, even one that ignores SIGTERM or leaves a process behind ([3b05db7](https://github.com/hajimism/dek/commit/3b05db7ee9c17e68e5d580d744dc457856c29678))
+* **tar:** leave AppleDouble names out, and number that record 27 ([c4fb0ef](https://github.com/hajimism/dek/commit/c4fb0efbb9cd0a73f5335f078fb9b08bca1d35ef))
+* **video:** give up on an ffmpeg that never answers -version ([c0d3c6a](https://github.com/hajimism/dek/commit/c0d3c6a22d0dd8328782661ebc22384313d33487))
+* **visual:** stop sending a DEK031 to theme.css when the theme alone was never measured ([b3321b3](https://github.com/hajimism/dek/commit/b3321b3302389743dd5f0606e2a6367e2635f14d))
+* **voice:** stop waiting on a player that never ends after a say clip ([fc1082b](https://github.com/hajimism/dek/commit/fc1082bf3e8eb012bda822256fe51a067eb086b8))
+
+
+### Refactoring
+
+* write the link preview image and remove the dev server's lock through safe-fs ([3ae94c8](https://github.com/hajimism/dek/commit/3ae94c8db6ae9bef4243bec3cc334e1a4a2b9e11))
+
+
+### Documentation
+
+* **adr:** keep a ref's words out of dek's hints, and mark what a ref wrote wherever dek prints it ([e4f0787](https://github.com/hajimism/dek/commit/e4f07878aee0f0f887484b800778324a55e0f97d))
+* **adr:** number the --json contract record 31 ([8108f37](https://github.com/hajimism/dek/commit/8108f3770b3c2b24efb57b2ed1064949a998e95b))
+* **adr:** number the fast-check record 26, where this stack adds it ([389948e](https://github.com/hajimism/dek/commit/389948e6e8ef79842d8b429fac5e2d8e5d2ddeb2))
+* **adr:** number the ref-words record 30, and point it at the trust record ([6925755](https://github.com/hajimism/dek/commit/692575572ab5a235ac1256c7b7b11e31a4ddc01f))
+* **adr:** number the sandbox record 29, and point it at the trust record ([e082487](https://github.com/hajimism/dek/commit/e08248711777c3acabd8ac46c1c8a080302de961))
+* **adr:** number the trust record 28, after the records already on this branch ([7a7fbd8](https://github.com/hajimism/dek/commit/7a7fbd8b9cb6f18af2d27f26a1fb962c3e85f30a))
+* **adr:** read a pack's or a repository's tar with dek's own reader ([ba896c8](https://github.com/hajimism/dek/commit/ba896c84daec4a39fdc5d7fdd34c1cf5ccb52394))
+* **adr:** read every attribute value as the browser does ([6a1c698](https://github.com/hajimism/dek/commit/6a1c698fbc74da129c034f175063d8c99a83f9bc))
+* **adr:** say what dek does where Chromium's sandbox cannot start ([f2f940a](https://github.com/hajimism/dek/commit/f2f940ad4c0a216f9f0ec0085da72cfd15414282))
+* **adr:** say whom dek trusts, and what each of them may make it do ([8f26099](https://github.com/hajimism/dek/commit/8f260990674b3c3105b40b276f9e90c6e013e1db))
+* pass the suite timeout on every bun test line in CONTRIBUTING ([6c7182c](https://github.com/hajimism/dek/commit/6c7182cab0564f91088be06b5209c32b6f191efa))
+* say how dek keeps a ref's words apart from its own ([756ba7c](https://github.com/hajimism/dek/commit/756ba7ca74ff05cbd109ef0eab270dea92c52b78))
+* say how long dek waits on rumdl, a voice engine, and the dev server, and how large a ref may be ([e196cd8](https://github.com/hajimism/dek/commit/e196cd81ad83cd90286a91977258bb7c0882eaee))
+* say lint reads an attribute's value and URL as the browser does ([4c67184](https://github.com/hajimism/dek/commit/4c671849309e7ff8015341862b9fc8ec860d0cb7))
+
 ## [0.4.0](https://github.com/hajimism/dek/compare/v0.3.4...v0.4.0) (2026-10-27)
 
 

package/README.ja.md

@@ -64,7 +64,7 @@ bun run dev            # または bun run lint:visual / bun run build
 ```bash
 bun install
 bunx playwright install chromium   # 最初に一度。実ブラウザを動かすテストに使う
-bun test --watch
+bun test --watch --timeout=20000
 bun run typecheck
 bun run check             # Biome の format + lint
 bun run docs:dev          # VitePress

package/README.md

@@ -64,7 +64,7 @@ bun run dev            # or bun run lint:visual / bun run build
 ```bash
 bun install
 bunx playwright install chromium   # once, for the tests that drive a real browser
-bun test --watch
+bun test --watch --timeout=20000
 bun run typecheck
 bun run check             # Biome format + lint
 bun run docs:dev          # VitePress

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hajimism/dek",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "A build system for talks.",
   "license": "MIT",
   "author": "Hajime Nakagawa (https://github.com/hajimism)",
@@ -43,8 +43,8 @@
     "ai-agents"
   ],
   "scripts": {
-    "test": "bun test --parallel=4",
-    "test:watch": "bun test --watch",
+    "test": "bun test --parallel=4 --timeout=20000",
+    "test:watch": "bun test --watch --timeout=20000",
     "typecheck": "tsc --noEmit",
     "knip": "knip",
     "schema": "bun scripts/cli-schema.ts",
@@ -61,11 +61,12 @@
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.15",
-    "@happy-dom/global-registrator": "21.0.1",
+    "@biomejs/biome": "2.6.2",
+    "@happy-dom/global-registrator": "21.0.4",
     "@types/bun": "^1.4.2",
-    "happy-dom": "21.0.1",
-    "knip": "6.41.0",
+    "fast-check": "4.10.2",
+    "happy-dom": "21.0.4",
+    "knip": "6.42.1",
     "playwright": "^1.63.0",
     "publint": "0.3.25",
     "typescript": "^7.0.2",

package/src/cli/address.ts

@@ -1,29 +1,49 @@
-import { existsSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
-import { shellName } from "../core/escape.ts";
+import { existsSync, statSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
+import { isPlainWord, shellName } from "../core/escape.ts";
 import { isInside } from "../core/path.ts";
+import { snapshotName } from "../core/ref.ts";
+import { isRefName } from "../core/ref-name.ts";
 import { type AnySpec, COMMANDS, subcommandsOf } from "./commands.ts";
 
 /** A deck a hint is about: the name a command takes, and the directory that makes it implicit. */
 export type HintDeck = { name: string; dir: string };
 
 /**
- * A hint's commands as they run from `cwd`. Hints are written as if run inside the deck they are
- * about, where a command finds its deck by itself. Run anywhere else, a command that takes a deck
- * needs its name: as the first word outside every deck, and as `--deck` inside another deck,
- * where a first word names something in that deck instead, or where the name would read as a
- * subcommand or a flag. The name is one shell word, however it is spelled, or `<deck>` when no
- * word holds it alike in every shell, with where to find it unless `note` is false, for a hint
- * that joins several and says it once. A command that already names a deck, or takes none, is
- * left as written.
+ * A hint as it reads from `cwd`. Hints are written as if read inside the deck they are about:
+ * its commands are addressed as `addressCommands` says, and the deck files it names become paths
+ * from `cwd`, as the path of the diagnostic beside it is, except in a ref.
  */
 export function addressHint(
   hint: string,
   deck: HintDeck | undefined,
   cwd: string,
+  options: { note?: boolean } = {},
+): string {
+  if (deck === undefined) {
+    return hint;
+  }
+  const addressed = addressCommands(hint, deck, cwd, options);
+  // A ref's files are its author's to fix, so a hint about one names them as the ref does.
+  return isRefName(deck.name) ? addressed : addressFiles(addressed, deck.dir, cwd);
+}
+
+/**
+ * A hint's commands as they run from `cwd`. Inside the deck they are about, a command finds its
+ * deck by itself. Run anywhere else, a command that takes a deck needs its name: as the first
+ * word outside every deck, and as `--deck` inside another deck, where a first word names
+ * something in that deck instead, or where the name would read as a subcommand or a flag. The
+ * name is one shell word, however it is spelled, or `<deck>` when no word holds it alike in every
+ * shell, with where to find it unless `note` is false, for a hint that joins several and says it
+ * once. A command that already names a deck, or takes none, is left as written.
+ */
+export function addressCommands(
+  hint: string,
+  deck: HintDeck,
+  cwd: string,
   { note: noted = true }: { note?: boolean } = {},
 ): string {
-  if (deck === undefined || isInside(cwd, deck.dir)) {
+  if (isInside(cwd, deck.dir)) {
     return hint;
   }
   const word = shellName(deck.name) ?? DECK_PLACEHOLDER;
@@ -79,6 +99,24 @@ export function deckFlag(name: string): string {
   return name.startsWith("-") ? `--deck=${word}` : `--deck ${word}`;
 }
 
+/**
+ * A deck file as a hint names it from the deck: a slide's own file, a voice file, theme.css, or
+ * script.md, or a project file reached with `../../`. Not part of a longer path or word. A path
+ * from `cwd` that is no plain word, through a folder a hint may not name, is left as written.
+ */
+const DECK_FILE_RE =
+  /(?<![\w./-])(\.\.\/\.\.\/[\w./-]*[\w-]|(?:slides|voice)\/[\w.-]*[\w-]|theme\.css|script\.md)(?![\w/-])/g;
+
+function addressFiles(hint: string, dir: string, cwd: string): string {
+  if (cwd === dir) {
+    return hint;
+  }
+  return hint.replace(DECK_FILE_RE, (file) => {
+    const path = relative(cwd, join(dir, file)) || ".";
+    return isPlainWord(path) ? path : file;
+  });
+}
+
 /** A backquoted command: `dekc`, a command word, and what follows it up to the closing quote. */
 const COMMAND_RE = /`dekc ([a-z]+)((?: [^`]*)?)`/g;
 
@@ -110,13 +148,19 @@ function namesDeck(rest: string, word: string | undefined): boolean {
 
 /**
  * The deck `path` lies in: the directory under a project's `decks/`, found from the path alone.
- * A source path dek reports is absolute, so no project needs to be resolved to address it.
+ * A source path dek reports is absolute, so no project needs to be resolved to address it. A
+ * deck that is not there, such as the one a `deck "nope" not found` points at, is none, and a
+ * ref's deck, in a snapshot as dek writes one, is named by the ref, as every command that reads
+ * one takes it.
  */
 export function deckAround(path: string): HintDeck | undefined {
   for (let dir = path; dirname(dir) !== dir; dir = dirname(dir)) {
     const parent = dirname(dir);
-    if (basename(parent) === "decks" && existsSync(join(dirname(parent), "dek.toml"))) {
-      return { name: basename(dir), dir };
+    const root = dirname(parent);
+    if (basename(parent) === "decks" && existsSync(join(root, "dek.toml"))) {
+      return statSync(dir, { throwIfNoEntry: false })?.isDirectory()
+        ? { name: snapshotName(root) ?? basename(dir), dir }
+        : undefined;
     }
   }
   return undefined;

package/src/cli/commands.ts

@@ -1,5 +1,6 @@
 import { hasErrors } from "../core/diagnostic.ts";
 import { shellQuote } from "../core/escape.ts";
+import type { HiddenText } from "../core/foreign-text.ts";
 import { isRefName } from "../core/ref-name.ts";
 import { mergeSarif, toSarif } from "../core/sarif.ts";
 import type { CheckCliResult } from "./check.ts";
@@ -15,6 +16,7 @@ import {
   formatBuild,
   formatCheck,
   formatCues,
+  formatHidden,
   formatInit,
   formatKept,
   formatKeptTheme,
@@ -65,14 +67,17 @@ type AnyCtx = Omit<Ctx<[], DeckScope | undefined>, "args"> & {
 /** How a command's result is printed. Only `text` is required. */
 export type Output<D> = {
   text(data: D, color: boolean): string;
-  /** What did not happen, for stderr next to the text: the result on stdout stays the result. */
+  /**
+   * What did not happen, or what is worth a look, such as what a ref hides, for stderr next to the
+   * text: the result on stdout stays the result.
+   */
   notes?(data: D, color: boolean): string | undefined;
   /** The `--json` fields next to `ok`; the data as-is when absent. */
   json?(data: D): object;
   /** The data with every path into the source tree as `display` shows it. */
   paths?(data: D, display: (path: string) => string): D;
-  /** The error of a run that did its job and found one. */
-  failure?(data: D): FormattedError | undefined;
+  /** The error of a run that did its job and found one; `flags` are the run's, for its rerun. */
+  failure?(data: D, flags: FlagValues): FormattedError | undefined;
   /** `--format sarif`. */
   sarif?(data: D): object;
 };
@@ -194,6 +199,20 @@ function withDisplayDiagnostics<D extends { diagnostics: CheckCliResult["diagnos
   return { ...data, diagnostics: displayDiagnostics(data.diagnostics, display) };
 }
 
+/** What to do about the characters a person cannot see that a ref's theme brought into a new deck. */
+const COPIED_HIDDEN_HELP =
+  "they came in with the ref's theme, and a person reading the deck sees none of them; remove them from theme.css unless you mean them";
+
+/** The data with each hidden-character report's path as `display` shows it. */
+function withDisplayHidden<D extends { hidden?: HiddenText[] }>(
+  data: D,
+  display: (path: string) => string,
+): D {
+  return data.hidden === undefined
+    ? data
+    : { ...data, hidden: data.hidden.map((entry) => ({ ...entry, path: display(entry.path) })) };
+}
+
 /**
  * Every command, in the order `dekc help` lists them: the words and flags it takes, its help,
  * what it works on, how it runs, and how its result prints. Each module loads only when its
@@ -289,11 +308,12 @@ export const COMMANDS = {
     },
     output: {
       text: formatNew,
-      paths: (data, display) => ({
-        ...data,
-        created: data.created.map(display),
-        updated: data.updated.map(display),
-      }),
+      notes: (data, color) => formatHidden(data.hidden, color, COPIED_HIDDEN_HELP) || undefined,
+      paths: (data, display) =>
+        withDisplayHidden(
+          { ...data, created: data.created.map(display), updated: data.updated.map(display) },
+          display,
+        ),
     },
   }),
   ls: result({
@@ -312,10 +332,12 @@ export const COMMANDS = {
     },
     output: {
       text: formatLs,
+      notes: (data, color) =>
+        (data.kind === "deck" && formatHidden(data.hidden, color)) || undefined,
       json: ({ kind: _kind, ...data }) => data,
       paths: (data, display) =>
         data.kind === "deck"
-          ? withDisplayDiagnostics(data, display)
+          ? withDisplayHidden(withDisplayDiagnostics(data, display), display)
           : {
               ...withDisplayDiagnostics(data, display),
               decks: data.decks.map((deck) => withDisplayDiagnostics(deck, display)),
@@ -399,7 +421,11 @@ export const COMMANDS = {
       const { showCommand } = await import("./show.ts");
       return showCommand(target, args.slug);
     },
-    output: { text: formatShow },
+    output: {
+      text: formatShow,
+      notes: (data, color) => formatHidden(data.hidden, color) || undefined,
+      paths: withDisplayHidden,
+    },
   }),
   theme: result({
     scope: "deck",
@@ -424,7 +450,8 @@ export const COMMANDS = {
     },
     output: {
       text: formatTheme,
-      paths: (data, display) => ({ ...data, path: display(data.path) }),
+      notes: (data, color) => formatHidden(data.hidden, color) || undefined,
+      paths: (data, display) => withDisplayHidden({ ...data, path: display(data.path) }, display),
     },
   }),
   check: result({
@@ -486,7 +513,11 @@ export const COMMANDS = {
         motion: flags.motion,
       });
     },
-    output: { text: formatShot },
+    output: {
+      text: formatShot,
+      notes: (data, color) => formatHidden(data.hidden, color) || undefined,
+      paths: withDisplayHidden,
+    },
   }),
   mv: result({
     scope: "deck",
@@ -674,7 +705,9 @@ export const COMMANDS = {
       notes: (data, color) => formatSkipped(data.skipped, color) || undefined,
       json: ({ rumdlSarif: _rumdlSarif, ...data }) => data,
       paths: withDisplayDiagnostics,
-      failure: (data) => diagnosticFailure("lint", data, "dekc lint"),
+      // The rerun measures what this run did: without --visual, the errors it found may not show.
+      failure: (data, flags) =>
+        diagnosticFailure("lint", data, flags.visual ? "dekc lint --visual" : "dekc lint"),
       sarif: (data) => {
         const dek = data.diagnostics.filter((diagnostic) => diagnostic.id.startsWith("DEK"));
         return mergeSarif(toSarif(dek, { skipped: data.skipped ?? [] }), data.rumdlSarif);
@@ -844,7 +877,7 @@ export const COMMANDS = {
       const { pptxCommand } = await import("./pptx.ts");
       return pptxCommand(target, { rootDist: flags["root-dist"], public: flags.public });
     },
-    output: { text: formatPptx, json: ({ outs }) => ({ outs }) },
+    output: { text: formatPptx, json: ({ lifted: _lifted, ...data }) => data },
   }),
   help: {
     kind: "help",

package/src/cli/contract.ts

@@ -50,6 +50,19 @@ const SkippedCheck = z
     description: "A check that did not run, so an empty list of findings is no pass for it.",
   });
 
+const Unsandboxed = z
+  .strictObject({
+    reason: z.string().describe("What Chromium said when it did not start with its sandbox."),
+    hint: z
+      .string()
+      .describe("What lets the sandbox start, and, unless already set, DEK_ALLOW_UNSANDBOXED=1."),
+  })
+  .meta({
+    id: "Unsandboxed",
+    description:
+      "Chromium drew without its sandbox, which did not start here, as in a container running as root. A ref is never drawn so unless DEK_ALLOW_UNSANDBOXED=1.",
+  });
+
 const Failure = z
   .strictObject({
     message: z.string(),
@@ -68,6 +81,27 @@ const RefInfo = z
   })
   .meta({ id: "RefInfo", description: "Set when the deck read is a ref." });
 
+const HiddenText = z
+  .strictObject({
+    path: z.string(),
+    line: z.number().int(),
+    column: z
+      .number()
+      .int()
+      .describe("1-based, in UTF-16 units as editors count: where the first of them is."),
+    codePoints: z.array(z.string()).describe("Each of them on the line, in order, as U+XXXX."),
+  })
+  .meta({
+    id: "HiddenText",
+    description:
+      "A line of a ref's file that holds characters a person cannot see: those Unicode marks default-ignorable, such as tag characters, zero-width characters, the byte order mark, bidi controls, and Hangul fillers, but not variation selectors; the line and paragraph separators; and the interlinear annotation marks. Text output shows each as ⟨U+XXXX⟩.",
+  });
+
+const hidden = z
+  .array(HiddenText)
+  .optional()
+  .describe("A ref's lines that hold characters a person cannot see; absent when none does.");
+
 const Position = z
   .strictObject({ slideIndex: z.number().int(), beatIndex: z.number().int() })
   .meta({ id: "Position" });
@@ -75,6 +109,9 @@ const Position = z
 const paths = z.array(z.string());
 const diagnostics = z.array(Diagnostic);
 const skipped = z.array(SkippedCheck).optional().describe("Absent when every check ran.");
+const unsandboxed = Unsandboxed.optional().describe(
+  "Absent when every page drawn was drawn in Chromium's sandbox, or none was.",
+);
 
 const nav = z.strictObject({
   slug: z.string(),
@@ -112,6 +149,7 @@ export const RESULT_FIELDS = {
     updated: paths,
     next: z.array(z.string()),
     warnings: z.array(z.string()).describe("Set when the theme came from a ref with no license."),
+    hidden,
   }),
   ls: z.union([
     z.strictObject({
@@ -149,6 +187,7 @@ export const RESULT_FIELDS = {
       diagnostics,
       skipped,
       ref: RefInfo.optional(),
+      hidden,
     }),
   ]),
   ref: z.union([
@@ -202,6 +241,7 @@ export const RESULT_FIELDS = {
       ),
     assets: paths,
     ref: RefInfo.optional(),
+    hidden,
   }),
   theme: z.strictObject({
     path: z.string(),
@@ -225,11 +265,13 @@ export const RESULT_FIELDS = {
       ),
     layout: z.strictObject({ name: z.string(), example: z.string() }).optional(),
     ref: RefInfo.optional(),
+    hidden,
   }),
   check: z.strictObject({
     slug: z.string(),
     diagnostics,
     skipped,
+    unsandboxed,
     shot: z.string().optional(),
     fill: z
       .strictObject({
@@ -289,6 +331,8 @@ export const RESULT_FIELDS = {
       )
       .optional()
       .describe("With --motion, each beat in order with its frames, the settled end last."),
+    unsandboxed,
+    hidden,
   }),
   mv: z.strictObject({
     from: z.string(),
@@ -378,7 +422,7 @@ export const RESULT_FIELDS = {
     z.strictObject({ action: z.literal("clear"), cleared: z.number().int() }),
   ]),
   sync: z.strictObject({ created: paths, updated: paths, removed: paths, kept: paths }),
-  lint: z.strictObject({ diagnostics, skipped }),
+  lint: z.strictObject({ diagnostics, skipped, unsandboxed }),
   cues: z.strictObject({
     name: z.string(),
     cues: z.array(
@@ -417,15 +461,17 @@ export const RESULT_FIELDS = {
     images: paths.describe("dist/<deck>.png for each deck that got a link preview image."),
     diagnostics,
     skipped,
+    unsandboxed,
   }),
   video: z.strictObject({
     out: z.string(),
     vtt: z.string().optional(),
     chapters: z.string().optional(),
     credits: z.string().optional(),
+    unsandboxed,
   }),
-  pdf: z.strictObject({ outs: paths }),
-  pptx: z.strictObject({ outs: paths }),
+  pdf: z.strictObject({ outs: paths, unsandboxed }),
+  pptx: z.strictObject({ outs: paths, unsandboxed }),
   pack: z.strictObject({
     outs: paths,
     warnings: z.array(z.string()).describe("Once per project: the packs carry no license."),

package/src/cli/files.ts

@@ -1,3 +1,4 @@
+// biome-ignore lint/style/noRestrictedImports: mkdirSync and writeFileSync, for init and new, which create a file only where none is (wx); safe-fs replaces one.
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { bundledTheme } from "../core/bundled-theme.ts";

package/src/cli/format.ts

@@ -2,7 +2,7 @@ import { isAbsolute, relative } from "node:path";
 import type { Diagnostic } from "../core/diagnostic.ts";
 import { type ErrorFields, errorFields } from "../core/error.ts";
 import type { LiveEvent } from "../core/live-protocol.ts";
-import { ansi, displayWidth, padEndWidth, padStartWidth } from "./tty.ts";
+import { ansi, displayWidth, padEndWidth, padStartWidth, plainText } from "./tty.ts";
 
 function formatLocation(location: { path?: string; line?: number; column?: number }): string {
   if (location.path !== undefined && location.line !== undefined) {
@@ -56,17 +56,18 @@ export function formatError(error: unknown, opts?: { cwd?: string }): FormattedE
     : { ...fields, path: displayPath(fields.path, opts?.cwd) };
 }
 
+/** An error as the terminal shows it: its own text plain, and dek's colors around it. */
 export function formatErrorText(error: unknown, opts?: { color?: boolean; cwd?: string }): string {
   const formatted = formatError(error, opts);
   const c = ansi(opts?.color === true);
-  const parts = [`${c.bold(c.red("error:"))} ${formatted.message}`];
+  const parts = [`${c.bold(c.red("error:"))} ${plainText(formatted.message)}`];
   if (formatted.path) {
     const loc =
       formatted.line !== undefined ? `${formatted.path}:${formatted.line}` : formatted.path;
-    parts.push(` ${c.cyan("-->")} ${loc}`);
+    parts.push(` ${c.cyan("-->")} ${plainText(loc)}`);
   }
   if (formatted.hint) {
-    parts.push(`  ${c.yellow("help:")} ${formatted.hint}`);
+    parts.push(`  ${c.yellow("help:")} ${plainText(formatted.hint)}`);
   }
   return parts.join("\n");
 }