@uxlint-net/uxlint 0.1.26

package/README.md

@@ -0,0 +1,53 @@
+# @uxlint-net/uxlint
+
+Audit any website's UX the way a design-literate reviewer would — contrast, tap targets, type scale,
+colour discipline, copy clarity, scan patterns, resilience — and get a concrete fix for every finding.
+
+Built to sit in a coding agent's loop: an agent writes UI it cannot see, and this is how it looks.
+
+```sh
+npx @uxlint-net/uxlint audit --base http://localhost:5173     # audit a running site
+npx @uxlint-net/uxlint mcp                                    # run the MCP server (stdio)
+```
+
+## Use it from an agent
+
+Add it as an MCP server. In Claude Code:
+
+```sh
+claude mcp add uxlint -- npx -y @uxlint-net/uxlint mcp
+```
+
+Or in any client that reads a JSON config:
+
+```json
+{
+  "mcpServers": {
+    "uxlint": { "command": "npx", "args": ["-y", "@uxlint-net/uxlint", "mcp"] }
+  }
+}
+```
+
+The agent gets `audit_url` (audit and get findings with fixes), `verify_fix` (re-check one rule on one
+page in ~2s), `ux_guidance` (the idiomatic pattern for an area, before you change UI) and `get_shot`
+(the annotated screenshot of a finding).
+
+## What this package is
+
+A launcher, not the tool. uxlint is a single compiled Rust binary; this package downloads the build for
+your platform from the matching GitHub release, verifies the checksum published beside it, caches it
+under `~/.cache/uxlint`, and hands over. The version you install is the version you get —
+`npx @uxlint-net/uxlint@0.1.26` runs exactly that binary.
+
+It drives a Chrome or Chromium you already have (no browser download, no Node runtime for the audit
+itself). macOS and Linux, x64 and arm64. `CHROME=/path/to/chrome` if yours lives somewhere unusual.
+
+## Privacy
+
+The capture script is compiled into the binary and the source is public, so what runs in your pages is
+fixed by the version you installed and can't be changed at run time. `uxlint audit --dry-run <dir>`
+writes the exact payload to a folder so you can read it before anything is uploaded. See
+[Privacy & trust](https://github.com/uxlint-net/uxlint-cli#privacy--trust).
+
+- Docs: <https://uxlint.net/docs>
+- Source: <https://github.com/uxlint-net/uxlint-cli>

package/bin/uxlint.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// `npx uxlint …` — the npm face of the uxlint CLI.
+//
+// uxlint is a compiled Rust binary, but nearly every MCP client, editor and directory assumes a
+// one-line `npx` command with no prior install. This package is that line. It ships no binary of its
+// own: it fetches the one published for this platform from the GitHub release matching its own
+// version, verifies the checksum we publish beside it, caches it, and hands over.
+//
+// Two rules govern everything here:
+//
+//   1. NOTHING may be written to stdout. Under `uxlint mcp` stdout is the JSON-RPC channel, and one
+//      stray line of progress makes the server look broken to its client. Every message goes to
+//      stderr, which clients show as logs.
+//   2. The version is pinned to this package's own version, so `npx uxlint@0.1.26` runs exactly the
+//      0.1.26 binary. An npm install that silently drifted to a newer CLI would make the two version
+//      numbers a lie, and /v1/me tells clients which CLI to run.
+//
+// No dependencies, on purpose: a launcher that fetches a signed artifact should not itself pull a
+// tree of packages. `tar` is invoked from PATH (present on macOS and Linux, the platforms we build).
+'use strict';
+
+const { spawn, spawnSync } = require('node:child_process');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const { version } = require('../package.json');
+const REPO = 'uxlint-net/uxlint-cli';
+
+const log = (msg) => process.stderr.write(`uxlint: ${msg}\n`);
+
+/** The release asset for this machine, or null if we don't publish one for it. */
+function assetName() {
+  const arch = { x64: 'x64', arm64: 'arm64' }[process.arch];
+  const plat = { linux: 'linux', darwin: 'macos' }[process.platform];
+  return arch && plat ? `uxlint-${plat}-${arch}.tar.gz` : null;
+}
+
+/** Follows redirects — GitHub release downloads always redirect to object storage. */
+async function fetchBuffer(url, redirects = 5) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) throw new Error(`${res.status} ${res.statusText} for ${url}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+async function install(dir, asset) {
+  const base = `https://github.com/${REPO}/releases/download/v${version}/${asset}`;
+  log(`downloading ${asset} v${version} (once)`);
+  const [tarball, shaFile] = await Promise.all([
+    fetchBuffer(base),
+    fetchBuffer(`${base}.sha256`).catch(() => null) // absent → we say so rather than pretend
+  ]);
+
+  // Verify against the checksum published beside the artifact. This is the same file the shell
+  // installer checks; skipping it silently would make `npx` the weakest way to install uxlint.
+  if (shaFile) {
+    const want = shaFile.toString('utf8').trim().split(/\s+/)[0];
+    const got = crypto.createHash('sha256').update(tarball).digest('hex');
+    if (want !== got) {
+      throw new Error(`checksum mismatch for ${asset}\n  published ${want}\n  downloaded ${got}`);
+    }
+  } else {
+    log(`warning: no published checksum for ${asset} — proceeding unverified`);
+  }
+
+  fs.mkdirSync(dir, { recursive: true });
+  const tmp = path.join(dir, asset);
+  fs.writeFileSync(tmp, tarball);
+  const untar = spawnSync('tar', ['xzf', tmp, '-C', dir], { stdio: ['ignore', 'ignore', 'inherit'] });
+  fs.unlinkSync(tmp);
+  if (untar.status !== 0) throw new Error('could not extract the release archive (is `tar` on PATH?)');
+}
+
+async function main() {
+  const asset = assetName();
+  if (!asset) {
+    log(`no published build for ${process.platform}/${process.arch}.`);
+    log('supported: macOS and Linux on x64 or arm64. See https://uxlint.net/docs/cli');
+    process.exit(1);
+  }
+
+  // Versioned cache: a new package version fetches a new binary, and old ones stay put rather than
+  // being overwritten under a running process.
+  const cache = process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache');
+  const dir = path.join(cache, 'uxlint', 'bin', version);
+  const bin = path.join(dir, 'uxlint');
+
+  if (!fs.existsSync(bin)) {
+    try {
+      await install(dir, asset);
+      fs.chmodSync(bin, 0o755);
+    } catch (err) {
+      log(`install failed: ${err.message}`);
+      log('you can install it directly instead: curl -fsSL https://uxlint.net/install.sh | sh');
+      process.exit(1);
+    }
+  }
+
+  // Hand over completely: same argv, same streams, same exit code. `npx uxlint mcp` is then
+  // indistinguishable from running the binary, which is what an MCP client needs.
+  const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' });
+  child.on('error', (err) => {
+    log(`could not run ${bin}: ${err.message}`);
+    process.exit(1);
+  });
+  child.on('exit', (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+}
+
+main().catch((err) => {
+  log(String((err && err.message) || err));
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,50 @@
+{
+	"name": "@uxlint-net/uxlint",
+	"mcpName": "io.github.uxlint-net/uxlint",
+	"version": "0.1.26",
+	"description": "Audit any website's UX the way a design-literate reviewer would — contrast, tap targets, type scale, copy, scan patterns, resilience — with a concrete fix for every finding. Runs in the Chrome you already have; built for coding agents (MCP).",
+	"keywords": [
+		"ux",
+		"design",
+		"accessibility",
+		"a11y",
+		"audit",
+		"mcp",
+		"mcp-server",
+		"modelcontextprotocol",
+		"lighthouse",
+		"code-review"
+	],
+	"homepage": "https://uxlint.net",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/uxlint-net/uxlint-cli.git"
+	},
+	"bugs": {
+		"url": "https://github.com/uxlint-net/uxlint-cli/issues"
+	},
+	"license": "BUSL-1.1",
+	"author": {
+		"name": "uxlint",
+		"url": "https://uxlint.net"
+	},
+	"type": "commonjs",
+	"bin": {
+		"uxlint": "bin/uxlint.js"
+	},
+	"files": [
+		"bin/uxlint.js",
+		"README.md"
+	],
+	"engines": {
+		"node": ">=18"
+	},
+	"os": [
+		"darwin",
+		"linux"
+	],
+	"cpu": [
+		"x64",
+		"arm64"
+	]
+}