@invisibleloop/pulse 0.20.1 → 0.20.2

package/src/agent/coverage-check.js

@@ -4,92 +4,59 @@
  *
  * Called by the Stop hook in .claude/settings.json to enforce test coverage.
  * Runs `npm run test:coverage` and blocks the agent if any src/pages/ file
- * has uncovered lines — except async action run() and server fetcher functions
- * which cannot be tested without mocking real APIs.
+ * has uncovered lines — except code that cannot be unit-tested without mocking
+ * real APIs:
+ *
+ *   - server fetchers (`server:` blocks) and store fetchers
+ *   - action `run:` functions
+ *   - `guard:`, `submit:`, and `sitemap:` handlers
+ *   - `meta:` blocks (async meta functions hit real data sources)
+ *
+ * Also honours c8-style ignore comments, which Node's built-in coverage
+ * (--experimental-test-coverage) does NOT support natively. In a block or line
+ * comment, write:
+ *
+ *   "c8 ignore next"      — exempts the following line
+ *   "c8 ignore next 3"    — exempts the following 3 lines
+ *   "c8 ignore start" ... "c8 ignore stop"  — exempts the range
+ *   ("coverage-ignore" works as a synonym for "c8 ignore")
  *
  * Outputs a Claude Code hook JSON decision to stdout.
  */
 
 import { execSync } from 'child_process'
 import fs from 'fs'
-
-// Agent is ending its turn to wait for the user's answer (design-approval gate) —
-// let the turn end. The marker is consumed on the user's next prompt, so the
-// gates return in full force afterwards.
-if (fs.existsSync('.pulse-awaiting-approval')) process.exit(0)
-
-// No test files → nothing to check
-const hasTests = fs.existsSync('src/pages') && (function scan(d) {
-  for (const f of fs.readdirSync(d)) {
-    const p = `${d}/${f}`
-    if (fs.statSync(p).isDirectory()) { if (scan(p)) return true }
-    else if (f.endsWith('.test.js')) return true
-  }
-  return false
-})('src/pages')
-
-if (!hasTests) process.exit(0)
-
-let out = ''
-try {
-  out = execSync('npm run test:coverage 2>&1', { encoding: 'utf8', timeout: 60000 })
-} catch (e) {
-  out = e.stdout || e.message
-}
-
-// Parse the coverage report — look for lines with uncovered line numbers
-const lines = out.split('\n')
-let inReport = false
-const rawGaps = []
-
-for (const line of lines) {
-  if (line.includes('start of coverage report')) { inReport = true; continue }
-  if (!inReport) continue
-
-  // Match: #  filename.js | line% | branch% | func% | 30-36 50
-  const m = line.match(/^[#ℹ]\s+([\w./[\]-]+\.js)\s*\|\s*[\d.]+\s*\|\s*[\d.]+\s*\|\s*[\d.]+\s*\|\s*([^|\n]+)$/)
-  if (m) {
-    const uncov = m[2].trim()
-    if (uncov && uncov !== 'uncovered lines') {
-      rawGaps.push({ file: m[1].trim(), uncovered: uncov })
-    }
-  }
-}
+import { pathToFileURL } from 'url'
+
+// Property blocks that are exempt — all server-side-only code paths that call
+// real external APIs and cannot run in unit tests.
+const EXEMPT_BLOCK_STARTS = [
+  /^server\s*:/,
+  /^run\s*:/, /^run\s*\(/,
+  /^guard\s*:/,
+  /^submit\s*:/,
+  /^sitemap\s*:/,
+  /^meta\s*:/,
+]
 
 /**
- * Returns true if all uncovered line numbers in the given file fall inside
- * a `server:` property block or an action `run:` function — both of which
- * call real external APIs and are explicitly exempt from coverage requirements.
+ * Build the set of exempt (1-based) line numbers for a source string:
+ * lines inside exempt property blocks, plus c8-ignore-annotated lines.
+ *
+ * @param {string} src
+ * @returns {Set<number>}
  */
-function allLinesExempt(filePath, uncoveredSpec) {
-  let src
-  try { src = fs.readFileSync(filePath, 'utf8') } catch { return false }
+export function computeExemptLines(src) {
   const srcLines = src.split('\n')
-
-  // Expand "30-36 50" → [30, 31, 32, 33, 34, 35, 36, 50]
-  const lineNums = []
-  for (const part of uncoveredSpec.split(/\s+/)) {
-    const range = part.match(/^(\d+)-(\d+)$/)
-    if (range) {
-      for (let i = parseInt(range[1]); i <= parseInt(range[2]); i++) lineNums.push(i)
-    } else if (/^\d+$/.test(part)) {
-      lineNums.push(parseInt(part))
-    }
-  }
-
-  // Build a set of exempt line numbers: lines inside `server:` blocks or action `run:` functions.
-  // Strategy: scan the source tracking brace depth relative to the start of each exempt block.
   const exemptLines = new Set()
+
+  // 1. Exempt property blocks — scan tracking brace/paren depth from block start
   let i = 0
   while (i < srcLines.length) {
     const trimmed = srcLines[i].trimStart()
-    // Detect start of `server:` property or action `run:` function
-    const isExemptStart = /^server\s*:/.test(trimmed) || /^run\s*:/.test(trimmed) || /^run\s*\(/.test(trimmed)
-    if (isExemptStart) {
-      // Mark lines from here until the block closes (depth reaches 0 after opening)
+    if (EXEMPT_BLOCK_STARTS.some(re => re.test(trimmed))) {
       let depth = 0
       let started = false
-      const startLine = i
       while (i < srcLines.length) {
         exemptLines.add(i + 1) // 1-based
         for (const ch of srcLines[i]) {
@@ -103,30 +70,127 @@ function allLinesExempt(filePath, uncoveredSpec) {
     i++
   }
 
-  return lineNums.every(n => exemptLines.has(n))
+  // 2. c8-style ignore comments (Node's built-in coverage ignores these, so we
+  //    honour them here — the marker line itself is always exempt too)
+  const IGNORE = /(?:c8 ignore|coverage-ignore)(?:\s+(next|start|stop))?(?:\s+(\d+))?/
+  let rangeOpen = false
+  for (let n = 0; n < srcLines.length; n++) {
+    if (rangeOpen) exemptLines.add(n + 1)
+    const m = srcLines[n].match(IGNORE)
+    if (!m) continue
+    exemptLines.add(n + 1)
+    const keyword = m[1]
+    if (keyword === 'start') { rangeOpen = true; continue }
+    if (keyword === 'stop')  { rangeOpen = false; continue }
+    // 'next' (or bare marker) — exempt the following N lines (default 1)
+    const count = m[2] ? parseInt(m[2], 10) : 1
+    for (let k = 1; k <= count; k++) exemptLines.add(n + 1 + k)
+  }
+
+  return exemptLines
 }
 
-const gaps = []
-for (const { file, uncovered } of rawGaps) {
-  // Try to resolve relative to cwd (coverage reports use relative paths)
-  const candidates = [file, `src/pages/${file}`, file.replace(/^.*src\/pages\//, 'src/pages/')]
-  const resolved   = candidates.find(p => fs.existsSync(p))
+/**
+ * Returns true if all uncovered line numbers fall on exempt lines.
+ *
+ * @param {string} filePath
+ * @param {string} uncoveredSpec - e.g. "30-36 50"
+ * @returns {boolean}
+ */
+export function allLinesExempt(filePath, uncoveredSpec) {
+  let src
+  try { src = fs.readFileSync(filePath, 'utf8') } catch { return false }
+
+  // Expand "30-36 50" → [30, 31, 32, 33, 34, 35, 36, 50]
+  const lineNums = []
+  for (const part of uncoveredSpec.split(/\s+/)) {
+    const range = part.match(/^(\d+)-(\d+)$/)
+    if (range) {
+      for (let i = parseInt(range[1]); i <= parseInt(range[2]); i++) lineNums.push(i)
+    } else if (/^\d+$/.test(part)) {
+      lineNums.push(parseInt(part))
+    }
+  }
+
+  const exemptLines = computeExemptLines(src)
+  return lineNums.every(n => exemptLines.has(n))
+}
 
-  if (resolved && allLinesExempt(resolved, uncovered)) continue  // auto-exempt
+// ---------------------------------------------------------------------------
+// Main — only when executed directly (the exports above are unit-tested)
+// ---------------------------------------------------------------------------
 
-  gaps.push(`  ${file} — uncovered lines: ${uncovered}`)
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main()
 }
 
-if (gaps.length) {
-  process.stdout.write(JSON.stringify({
-    decision: 'block',
-    reason: [
-      'COVERAGE GAPS detected. Add tests for these uncovered lines before finishing:',
-      ...gaps,
-      '',
-      'Run `npm run test:coverage` to see the full report.',
-      'Exempt from this rule: async action run() functions and server fetchers that call real APIs.',
-      'Everything else — view branches, mutations, onViewError, pure helper functions — must be covered.',
-    ].join('\n'),
-  }))
+function main() {
+  // Agent is ending its turn to wait for the user's answer (approval gate or a
+  // mid-flow pause) — let the turn end. The marker is consumed on the user's
+  // next prompt, so the gates return in full force afterwards.
+  if (fs.existsSync('.pulse-awaiting-approval')) process.exit(0)
+
+  // No test files → nothing to check
+  const hasTests = fs.existsSync('src/pages') && (function scan(d) {
+    for (const f of fs.readdirSync(d)) {
+      const p = `${d}/${f}`
+      if (fs.statSync(p).isDirectory()) { if (scan(p)) return true }
+      else if (f.endsWith('.test.js')) return true
+    }
+    return false
+  })('src/pages')
+
+  if (!hasTests) process.exit(0)
+
+  let out = ''
+  try {
+    out = execSync('npm run test:coverage 2>&1', { encoding: 'utf8', timeout: 60000 })
+  } catch (e) {
+    out = e.stdout || e.message
+  }
+
+  // Parse the coverage report — look for lines with uncovered line numbers
+  const lines = out.split('\n')
+  let inReport = false
+  const rawGaps = []
+
+  for (const line of lines) {
+    if (line.includes('start of coverage report')) { inReport = true; continue }
+    if (!inReport) continue
+
+    // Match: #  filename.js | line% | branch% | func% | 30-36 50
+    const m = line.match(/^[#ℹ]\s+([\w./[\]-]+\.js)\s*\|\s*[\d.]+\s*\|\s*[\d.]+\s*\|\s*[\d.]+\s*\|\s*([^|\n]+)$/)
+    if (m) {
+      const uncov = m[2].trim()
+      if (uncov && uncov !== 'uncovered lines') {
+        rawGaps.push({ file: m[1].trim(), uncovered: uncov })
+      }
+    }
+  }
+
+  const gaps = []
+  for (const { file, uncovered } of rawGaps) {
+    // Try to resolve relative to cwd (coverage reports use relative paths)
+    const candidates = [file, `src/pages/${file}`, file.replace(/^.*src\/pages\//, 'src/pages/')]
+    const resolved   = candidates.find(p => fs.existsSync(p))
+
+    if (resolved && allLinesExempt(resolved, uncovered)) continue  // auto-exempt
+
+    gaps.push(`  ${file} — uncovered lines: ${uncovered}`)
+  }
+
+  if (gaps.length) {
+    process.stdout.write(JSON.stringify({
+      decision: 'block',
+      reason: [
+        'COVERAGE GAPS detected. Add tests for these uncovered lines before finishing:',
+        ...gaps,
+        '',
+        'Run `npm run test:coverage` to see the full report.',
+        'Auto-exempt: server fetchers, action run(), guard, submit, sitemap, and meta blocks — these call real APIs and need no tests.',
+        'For anything else that genuinely cannot be tested, annotate it: /* c8 ignore next */ (or next N, or start/stop for a range) — this hook honours those comments even though Node\'s built-in coverage does not.',
+        'Everything else — view branches, mutations, onViewError, pure helper functions — must be covered.',
+      ].join('\n'),
+    }))
+  }
 }

package/src/agent/workflow.md

@@ -165,6 +165,20 @@ If you're about to type `class="hero"` or `class="product-card"` in Mode A, stop
 **Mode B — Creative override (raw HTML throughout)**
 When the design intent calls for a more expressive, unconventional, or typographically-driven layout that components would constrain, you may build with raw HTML throughout. This is a deliberate design decision, not a shortcut.
 
+**When to choose Mode B — use the component, unless:**
+- The layout requires **full-viewport height or edge-to-edge bleed** that the component doesn't support (e.g. `hero()` doesn't fill the viewport)
+- The design uses **custom gradient glows, parallax, or large-scale image fills** that the component would wrap in unwanted structure
+- The vibe is **brutalist, retro, neon, paper, or typographic-editorial** and the structural feel would be actively fought by the component's default padding/spacing/radius
+- The typography is **clamp-scaled display type** (e.g. `clamp(4rem, 10vw, 12rem)`) that breaks inside a component's internal box model
+- The layout is **asymmetric or zone-based** (e.g. 70/30 split, overlapping elements, staggered grid) that no single component supports
+- A **Figma/reference design was provided** that clearly departs from the component's output
+
+**When to use the component (not a valid reason for override):**
+- "The component doesn't have a perfect prop for this" — add a utility class or wrapper div instead
+- "I want a slightly different colour or size" — override with CSS tokens
+- "I'm not sure what the component looks like" — check the guide first
+- "It's easier to write raw HTML" — this is never a valid reason
+
 Rules for Mode B:
 - **Declare it in a comment at the top of the spec file:** `// component-free — creative override: <reason>`. The review tool detects creative override by reading this comment from the source — without it, `pulse_review` will flag every component pattern as a violation even though you chose Mode B deliberately. Announcing the mode in chat is not enough; the comment must be in the file.
 - Load `/pulse-ui.css` in `meta.styles` — the token system is still required
@@ -206,9 +220,9 @@ After the Write tool completes, call `pulse_create_page(name)` to register the p
 ✓ src/pages/my-page.js written and registered.
 ```
 
-### 3d — Suggest (optional but recommended)
+### 3d — Suggest (recommended mid-build checkpoint)
 
-After writing the first draft, call `pulse_suggest(content)` before running the hard validator. It catches obvious omissions collaboratively — a second opinion, not a gate.
+After writing the first draft, call `pulse_suggest(content)` before running the hard validator. It catches obvious omissions collaboratively — a second opinion, not a gate. Then call `pulse_review(file, { quick: true })` for a lightweight structural pass (main landmark, data-event on inputs, missing onError, hex in view). Neither is a substitute for the full review, but catching issues here is faster than discovering them at Lighthouse.
 
 **Rule: never output `✓` before the tool call that confirms the result.**
 

package/src/cli/cli.test.js

@@ -158,6 +158,78 @@ console.log('\nStore auto-discovery\n')
   }
 }
 
+// ---------------------------------------------------------------------------
+// Coverage-check exemptions
+// ---------------------------------------------------------------------------
+// Regression: the stop hook blocked every session on uncovered guard/submit/
+// sitemap/meta lines (server-only, untestable), and c8 ignore comments were
+// not honoured because Node's built-in coverage ignores them.
+
+console.log('\nCoverage-check exemptions\n')
+
+{
+  const { computeExemptLines } = await import('../agent/coverage-check.js')
+
+  const src = [
+    /*  1 */ `export default {`,
+    /*  2 */ `  route: '/x',`,
+    /*  3 */ `  guard: async (ctx) => {`,
+    /*  4 */ `    if (!ctx.cookies.session) return { redirect: '/login' }`,
+    /*  5 */ `  },`,
+    /*  6 */ `  submit: async (ctx) => {`,
+    /*  7 */ `    return { redirect: '/done' }`,
+    /*  8 */ `  },`,
+    /*  9 */ `  sitemap: async () => ['/a'],`,
+    /* 10 */ `  meta: {`,
+    /* 11 */ `    title: async (ctx) => fetchTitle(ctx),`,
+    /* 12 */ `  },`,
+    /* 13 */ `  view: (state) => state.n,`,
+    /* 14 */ `  helpers: () => {`,
+    /* 15 */ `    /* c8 ignore next 2 */`,
+    /* 16 */ `    impossibleBranch()`,
+    /* 17 */ `    alsoImpossible()`,
+    /* 18 */ `    normalCode()`,
+    /* 19 */ `  },`,
+    /* 20 */ `}`,
+  ].join('\n')
+
+  const exempt = computeExemptLines(src)
+
+  test('guard, submit, sitemap, and meta blocks are exempt', () => {
+    for (const n of [3, 4, 5, 6, 7, 8, 9, 10, 11, 12]) {
+      if (!exempt.has(n)) throw new Error(`Expected line ${n} to be exempt`)
+    }
+  })
+
+  test('view and ordinary helper code are NOT exempt', () => {
+    for (const n of [13, 18]) {
+      if (exempt.has(n)) throw new Error(`Line ${n} must not be exempt`)
+    }
+  })
+
+  test('c8 ignore next N exempts exactly the following N lines', () => {
+    for (const n of [15, 16, 17]) {
+      if (!exempt.has(n)) throw new Error(`Expected line ${n} to be exempt via c8 ignore`)
+    }
+    if (exempt.has(18)) throw new Error('Line 18 is beyond the ignore count and must not be exempt')
+  })
+
+  test('c8 ignore start/stop exempts the whole range', () => {
+    const ranged = computeExemptLines([
+      `const a = 1`,            // 1
+      `/* c8 ignore start */`,  // 2
+      `untestable1()`,          // 3
+      `untestable2()`,          // 4
+      `/* c8 ignore stop */`,   // 5
+      `const b = 2`,            // 6
+    ].join('\n'))
+    for (const n of [2, 3, 4, 5]) {
+      if (!ranged.has(n)) throw new Error(`Expected line ${n} exempt in range`)
+    }
+    if (ranged.has(6)) throw new Error('Line after stop must not be exempt')
+  })
+}
+
 // ---------------------------------------------------------------------------
 
 console.log(`\n${passed + failed} tests: ${passed} passed, ${failed} failed\n`)

package/src/cli/dev.js

@@ -275,11 +275,14 @@ const { updateSpecs, updateStore } = await createServer(specs, {
       // Strip server-only imports that can't resolve in the browser:
       //   - node:* built-ins (fs, path, etc.)
       //   - JSON files imported with `with { type: 'json' }` (e.g. package.json for version)
-      // These are only used inside spec.server functions or module-level server init;
-      // the client runtime never calls those code paths.
+      //   - the package ROOT (@invisibleloop/pulse) — that export is the server
+      //     itself (createServer, pushStore); the closing quote anchors the match
+      //     so subpaths like @invisibleloop/pulse/ui are untouched
+      // These are only used inside spec.server/submit functions or module-level
+      // server init; the client runtime never calls those code paths.
       let content = fs.readFileSync(filePath, 'utf-8')
       content = content.replace(
-        /^[ \t]*import\s+(?:\{[^}]*\}|[\w*]+(?:\s+as\s+\w+)?)\s+from\s+['"](?:node:[^'"]+|[^'"]*\.json)['"]\s*(?:with\s*\{[^}]*\})?\s*;?[ \t]*\n?/gm,
+        /^[ \t]*import\s+(?:\{[^}]*\}|[\w*]+(?:\s+as\s+\w+)?)\s+from\s+['"](?:node:[^'"]+|[^'"]*\.json|@invisibleloop\/pulse)['"]\s*(?:with\s*\{[^}]*\})?\s*;?[ \t]*\n?/gm,
         ''
       )
       res.writeHead(200, {

package/src/cli/index.js

@@ -269,8 +269,11 @@ async function runStop(root) {
     } catch { /* use default */ }
   }
   try {
-    execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null; true`, { stdio: 'inherit' })
-    console.log(`\n⚡ Dev server on port ${port} stopped.\n`)
+    // Kill the dev server AND the local production server (dev port + 1) —
+    // pulse_build spawns the prod server detached, so without this it lingers
+    // after the session and blocks the next build's Lighthouse run.
+    execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null; lsof -ti:${port + 1} | xargs kill -9 2>/dev/null; true`, { stdio: 'inherit' })
+    console.log(`\n⚡ Servers on ports ${port} (dev) and ${port + 1} (prod) stopped.\n`)
   } catch { /* nothing was running */ }
 }
 

package/src/cli/scaffold.js

@@ -207,7 +207,7 @@ ${port !== 3000 ? `  port: ${port},\n` : ''}${agent && agent !== 'claude' ? `  a
           hooks: [
             {
               type: 'command',
-              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let changed=new Set();let hasGit=false;try{execSync('git rev-parse --is-inside-work-tree',{stdio:'pipe'});hasGit=true;execSync('git status --porcelain',{encoding:'utf8'}).split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f)changed.add(f);});}catch{}if(!hasGit&&fs.existsSync('src/pages')){for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))changed.add('src/pages/'+f);}}const specs=[...changed].filter(f=>f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'));const missing=specs.filter(f=>{const t=f.replace(/\\.js$/,'.test.js');return!fs.existsSync(t)&&!changed.has(t);});if(missing.length){process.stdout.write(JSON.stringify({decision:'block',reason:'TESTS MISSING: '+missing.join(', ')+' — you must write tests before finishing. Use renderSync/render from @invisibleloop/pulse/testing to test view output, mutations, and any extracted logic functions. Run the tests with node to confirm they pass.\\n\\nEXCEPTION — waiting on the user: if you are ending this turn to wait for the user\\'s answer (e.g. the design-approval gate), call pulse_await_approval first, then ask and end your turn. Do not write tests or run /verify on an unapproved design.'}));}"`,
+              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let changed=new Set();let hasGit=false;try{execSync('git rev-parse --is-inside-work-tree',{stdio:'pipe'});hasGit=true;execSync('git status --porcelain',{encoding:'utf8'}).split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f)changed.add(f);});}catch{}if(!hasGit&&fs.existsSync('src/pages')){for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))changed.add('src/pages/'+f);}}const specs=[...changed].filter(f=>f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'));const missing=specs.filter(f=>{const t=f.replace(/\\.js$/,'.test.js');return!fs.existsSync(t)&&!changed.has(t);});if(missing.length){process.stdout.write(JSON.stringify({decision:'block',reason:'TESTS MISSING: '+missing.join(', ')+' — you must write tests before finishing. Use renderSync/render from @invisibleloop/pulse/testing to test view output, mutations, and any extracted logic functions. Run the tests with node to confirm they pass.\\n\\nEXCEPTION — pausing for the user: if you are ending this turn to wait for the user\\'s answer (design-approval gate) OR to report progress mid-verification (e.g. between Lighthouse runs across multiple pages), call pulse_await_approval first, then end your turn. Do not write tests or run /verify on an unapproved design.'}));}"`,
               statusMessage: 'Checking for missing tests...',
             },
             {
@@ -217,7 +217,7 @@ ${port !== 3000 ? `  port: ${port},\n` : ''}${agent && agent !== 'claude' ? `  a
             },
             {
               type: 'command',
-              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let specs=[];try{const out=execSync('git status --porcelain',{encoding:'utf8'});out.split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f&&f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'))specs.push(f);});}catch{if(fs.existsSync('src/pages'))for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))specs.push('src/pages/'+f);}}if(!specs.length)process.exit(0);const stamp='.pulse-verified';let stampMtime=0;try{stampMtime=fs.statSync(stamp).mtimeMs;}catch{}const stale=specs.filter(f=>{try{return fs.statSync(f).mtimeMs>stampMtime;}catch{return true;}});if(stale.length){process.stdout.write(JSON.stringify({decision:'block',reason:'VERIFY REQUIRED: These pages have not been verified since last edit:\\n'+stale.map(f=>'  '+f).join('\\n')+'\\n\\nIMPORTANT — check first: are you ending this turn to wait for the user\\'s answer (e.g. the design-approval question)? If so, do NOT run /verify — the user has not approved the design yet. Call pulse_await_approval, re-ask your question, and end your turn; this gate will let you stop.\\n\\nOtherwise run /verify for each changed page. /verify runs Lighthouse (desktop + mobile), performance trace, console check, and code review — then writes the stamp that clears this check.'}));}"`,
+              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let specs=[];try{const out=execSync('git status --porcelain',{encoding:'utf8'});out.split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f&&f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'))specs.push(f);});}catch{if(fs.existsSync('src/pages'))for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))specs.push('src/pages/'+f);}}if(!specs.length)process.exit(0);const stamp='.pulse-verified';let stampMtime=0;try{stampMtime=fs.statSync(stamp).mtimeMs;}catch{}const stale=specs.filter(f=>{try{return fs.statSync(f).mtimeMs>stampMtime;}catch{return true;}});if(stale.length){process.stdout.write(JSON.stringify({decision:'block',reason:'VERIFY REQUIRED: These pages have not been verified since last edit:\\n'+stale.map(f=>'  '+f).join('\\n')+'\\n\\nIMPORTANT — check first: are you ending this turn to wait for the user\\'s answer (design-approval question) or to report progress mid-verification (e.g. between Lighthouse runs across multiple pages)? If so, do NOT rush /verify — call pulse_await_approval and end your turn; this gate will let you stop, and the marker is consumed when the user replies.\\n\\nOtherwise run /verify for each changed page. /verify runs Lighthouse (desktop + mobile), performance trace, console check, and code review — then writes the stamp that clears this check.'}));}"`,
               statusMessage: 'Checking verification stamp...',
             }
           ]

package/src/mcp/mcp.test.js

@@ -114,6 +114,8 @@ const SYNC_PAIRS = [
   ['src/agent/checklist.md',        'docs/.claude/pulse-checklist.md'],
   ['src/agent/checklist.md',        'examples/.claude/pulse-checklist.md'],
   ['src/agent/commands/verify.md',  '.claude/commands/verify.md'],
+  ['src/agent/coverage-check.js',   'docs/.claude/coverage-check.js'],
+  ['src/agent/coverage-check.js',   'examples/.claude/coverage-check.js'],
 ]
 
 for (const [a, b] of SYNC_PAIRS) {
@@ -277,6 +279,48 @@ test('approval pause mechanism is wired end to end', () => {
     `Instruct: always call pulse_await_approval before asking, whichever way the question is asked.`)
 })
 
+test('pulse_validate prop-alias check excludes attrs blocks (false-positive fix)', () => {
+  // Regression: input({ attrs: { autocomplete } }) — the RECOMMENDED pattern —
+  // was flagged as a wrong top-level prop because the match crossed into the
+  // attrs object. The exclusion regex must be present in the alias loop.
+  assert(serverSrc.includes('attrs\\s*:\\s*\\{[^}]*$'),
+    'The PROP_ALIASES loop must exclude matches that fall inside an open attrs: { … } block')
+})
+
+test('pulse_validate CSP check matches config by host, not full URL', () => {
+  // Regression: CSP sources are valid without a scheme (images.unsplash.com),
+  // but the config check required https?:// — flagging correctly configured
+  // projects on every validate.
+  assert(serverSrc.includes('configImgSrc.includes(host)'),
+    'External-image CSP check must test the config for the bare host')
+  assert(serverSrc.includes(`host:    'images.unsplash.com'`),
+    'External image host entries must carry a bare host field')
+})
+
+test('validator resolves relative imports from the spec file\'s own directory', () => {
+  // Regression: the temp validation file was always written into src/pages/
+  // root, so subdirectory pages (src/pages/news/index.js) had their relative
+  // imports (../../components/layout.js) resolve from the wrong depth.
+  assert(/async function validateContent\(content, tmpDir = PAGES_DIR\)/.test(serverSrc),
+    'validateContent must accept a tmpDir parameter')
+  assert(serverSrc.includes('validateContent(content, path.dirname(fullPath))'),
+    'pulse_create_page must validate from the file\'s own directory')
+  assert(serverSrc.includes('validateContent(content, path.dirname(file))'),
+    'pulse_validate file mode must validate from the file\'s own directory')
+})
+
+test('package-root import is stripped from client bundles in build and dev', () => {
+  // Regression: import { pushStore } from '@invisibleloop/pulse' (the documented
+  // live-push pattern) pulled the entire server — http, fs, zlib — into the
+  // browser bundle and broke `pulse build`.
+  const buildSrc = fs.readFileSync(path.join(ROOT, 'scripts/build.js'), 'utf8')
+  const devSrc   = fs.readFileSync(path.join(ROOT, 'src/cli/dev.js'), 'utf8')
+  assert(buildSrc.includes(`'@invisibleloop/pulse/md', '@invisibleloop/pulse'`),
+    'build.js SERVER_ONLY_IMPORTS must include the package root')
+  assert(devSrc.includes(`@invisibleloop\\/pulse)['"]`),
+    'dev.js serveFile must strip package-root imports before serving specs to the browser')
+})
+
 test('pulse_check_contrast extracts variables from [data-theme="light"] blocks', () => {
   // Regression: the light-theme block pattern was an ungrouped alternation
   // (a|b) + '\\s*\\{([^}]+)\\}' — the body matcher bound only to the second