@junixlabs/uxcli 0.2.0 → 0.2.1

package/README.md

@@ -2,7 +2,7 @@
 
 `uxcli` measures a running UI against its design commitments. Built for AI coding agents that need to verify the frontend they just wrote.
 
-**Status:** early. Three flow probes (WCAG 3.3.4, 3.3.7, 3.2.3), three single-screen probes (2.4.7, 1.4.12, 1.4.3), a gate that proves each probe can fail and can pass, a verdict card, and a second reader. On npm as `@junixlabs/uxcli`; the command is `uxcli`.
+**Status:** early. Three flow probes (WCAG 3.3.4, 3.3.7, 3.2.3), three single-screen probes (2.4.7, 1.4.12, 1.4.3), a gate that proves each probe can fail on a seeded fixture and stays silent or passes on its clean twin, a verdict card, and a second reader. On npm as `@junixlabs/uxcli`; the command is `uxcli`.
 
 **Core rule: no commitment, no verdict.** Every finding cites the commitment it enforces: W3C's, yours, or none. Where no one has committed, `uxcli` says nothing.
 
@@ -42,7 +42,7 @@ The one input the machine cannot derive, the journey, is written by a human. Eve
 | `gate` run every probe's falsification pair | |
 | `why <rule>` the probe's definition | |
 
-Every probe ships with a pair of fixtures: one where it must fail, one where it must pass. A probe without that pair cannot say `fail`. `gate` enforces it. Exit codes: 0 no fail, 2 at least one fail, 1 the run could not be carried out.
+Every probe ships with a pair of fixtures: one where it must fail and a clean twin. The twin of a single-screen probe must reach `pass`; the twins of the flow probes may still be silent (`not-applicable`) until each has a twin on its satisfied branch, tracked in [ROADMAP.md](ROADMAP.md). A probe without that pair cannot say `fail`. `gate` enforces it. Exit codes: 0 no fail, 2 at least one fail, 1 the run could not be carried out.
 
 What comes next, and in what order, is in [ROADMAP.md](ROADMAP.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@junixlabs/uxcli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "UI/UX review for coding agents. No commitment, no verdict.",
   "license": "MIT",
   "repository": {

package/src/page.js

@@ -9,7 +9,8 @@ export const PAGE_PROBES = [focusVisible, textSpacing, contrast];
 
 export async function runPage(url, { browser, state, only } = {}) {
   const own = !browser; if (own) browser = await launch();
-  const bctx = await browser.newContext({ viewport: { width: 1280, height: 800 }, storageState: state || undefined });
+  // bypassCSP: the contrast probe injects axe-core; a page's Content-Security-Policy would otherwise block it (instrument setting, recorded in contrast/spec.md).
+  const bctx = await browser.newContext({ viewport: { width: 1280, height: 800 }, storageState: state || undefined, bypassCSP: true });
   const page = await bctx.newPage();
   const result = { url, ranAt: new Date().toISOString(), title: null, probes: [] };
   const probes = only ? PAGE_PROBES.filter(p => only.includes(p.id) || only.includes(p.sc)) : PAGE_PROBES;

package/src/probes/contrast/spec.md

@@ -9,4 +9,5 @@
 
 ## Revisions
 
+- 2026-09-06 **page context bypasses Content-Security-Policy.** GOV.UK's `script-src` blocked the axe-core injection and the probe returned `unmeasurable · probe error`; the context is now created with `bypassCSP: true`, an instrument setting that does not change what is measured.
 - 2026-09-06 first version. Bench: ACT afw4f7 cases (34) with axe-core 4.13.0, recorded in the working notes.