chill-agent 1.4.0 → 1.6.0

package/pi-extension/test/helpers.test.js

@@ -0,0 +1,179 @@
+import assert from "node:assert/strict";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+
+import {
+  filterSkillBodyForMode,
+  parsePonytailCommand,
+  readDefaultMode,
+  readQuietStartup,
+  resolveSessionMode,
+  writeDefaultMode,
+} from "../index.js";
+
+test("parsePonytailCommand falls back to full when invoked bare and default is off", () => {
+  assert.deepEqual(parsePonytailCommand("", "off"), { type: "set-mode", mode: "full" });
+  // #639: when ponytail is already on, a bare command reports instead of resetting the level.
+  assert.deepEqual(parsePonytailCommand("", "full", "ultra"), { type: "status" });
+  assert.deepEqual(parsePonytailCommand("", "full", "off"), { type: "set-mode", mode: "full" });
+});
+
+test("parsePonytailCommand parses modes, status, and default subcommand", () => {
+  assert.deepEqual(parsePonytailCommand("ultra", "full"), { type: "set-mode", mode: "ultra" });
+  assert.deepEqual(parsePonytailCommand("status", "full"), { type: "status" });
+  assert.deepEqual(parsePonytailCommand("default lite", "full"), { type: "set-default", mode: "lite" });
+});
+
+test("parsePonytailCommand rejects review as a default (session-only mode, #377)", () => {
+  assert.deepEqual(parsePonytailCommand("default review", "full"), { type: "invalid", reason: "invalid-default-mode" });
+});
+
+test("resolveSessionMode still honors review as a session mode (not a default)", () => {
+  const entries = [{ type: "custom", customType: "ponytail-mode", data: { mode: "review" } }];
+  assert.equal(resolveSessionMode(entries, "full"), "review");
+});
+
+test("resolveSessionMode prefers latest persisted session mode", () => {
+  const entries = [
+    { type: "custom", customType: "ponytail-mode", data: { mode: "lite" } },
+    { type: "custom", customType: "ponytail-mode", data: { mode: "ultra" } },
+  ];
+
+  assert.equal(resolveSessionMode(entries, "full"), "ultra");
+});
+
+test("resolveSessionMode returns fallback when entries is not an array", () => {
+  assert.equal(resolveSessionMode(null, "ultra"), "ultra");
+  assert.equal(resolveSessionMode(undefined, "lite"), "lite");
+  assert.equal(resolveSessionMode({}, "full"), "full");
+  assert.equal(resolveSessionMode("not an array"), "full"); // DEFAULT_MODE fallback
+});
+
+test("readDefaultMode and writeDefaultMode use XDG config path", () => {
+  const tempDir = mkdtempSync(join(tmpdir(), "ponytail-config-"));
+  const previousXdg = process.env.XDG_CONFIG_HOME;
+  const previousDefault = process.env.PONYTAIL_DEFAULT_MODE;
+  const configPath = join(tempDir, "ponytail", "config.json");
+  process.env.XDG_CONFIG_HOME = tempDir;
+  delete process.env.PONYTAIL_DEFAULT_MODE;
+
+  try {
+    assert.equal(readDefaultMode(), "full");
+    assert.equal(writeDefaultMode("ultra"), "ultra");
+    assert.equal(readDefaultMode(), "ultra");
+    assert.ok(existsSync(configPath));
+    assert.deepEqual(JSON.parse(readFileSync(configPath, "utf8")), { defaultMode: "ultra" });
+  } finally {
+    if (previousXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = previousXdg;
+    if (previousDefault === undefined) delete process.env.PONYTAIL_DEFAULT_MODE;
+    else process.env.PONYTAIL_DEFAULT_MODE = previousDefault;
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("readDefaultMode trims and normalizes whitespace in env and config values", () => {
+  const tempDir = mkdtempSync(join(tmpdir(), "ponytail-default-normalize-"));
+  const previousXdg = process.env.XDG_CONFIG_HOME;
+  const previousDefault = process.env.PONYTAIL_DEFAULT_MODE;
+  const configDir = join(tempDir, "ponytail");
+  const configPath = join(configDir, "config.json");
+  mkdirSync(configDir, { recursive: true });
+  process.env.XDG_CONFIG_HOME = tempDir;
+  process.env.PONYTAIL_DEFAULT_MODE = "  FULL  ";
+  writeFileSync(configPath, JSON.stringify({ defaultMode: "\tultra\n" }), "utf8");
+
+  try {
+    assert.equal(readDefaultMode(), "full");
+    process.env.PONYTAIL_DEFAULT_MODE = "\n lite \r\n";
+    assert.equal(readDefaultMode(), "lite");
+    delete process.env.PONYTAIL_DEFAULT_MODE;
+    assert.equal(readDefaultMode(), "ultra");
+  } finally {
+    if (previousXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = previousXdg;
+    if (previousDefault === undefined) delete process.env.PONYTAIL_DEFAULT_MODE;
+    else process.env.PONYTAIL_DEFAULT_MODE = previousDefault;
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("readQuietStartup resolves env var, config file, and default in that order", () => {
+  const tempDir = mkdtempSync(join(tmpdir(), "ponytail-quiet-"));
+  const previousXdg = process.env.XDG_CONFIG_HOME;
+  const previousEnv = process.env.PONYTAIL_QUIET_STARTUP;
+  const configDir = join(tempDir, "ponytail");
+  const configPath = join(configDir, "config.json");
+  process.env.XDG_CONFIG_HOME = tempDir;
+  delete process.env.PONYTAIL_QUIET_STARTUP;
+
+  try {
+    // No env, no config -> default false (toast still shows)
+    assert.equal(readQuietStartup(), false);
+
+    // Config file true -> respected
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(configPath, JSON.stringify({ quietStartup: true }), "utf8");
+    assert.equal(readQuietStartup(), true);
+
+    // Env var overrides config
+    process.env.PONYTAIL_QUIET_STARTUP = "false";
+    assert.equal(readQuietStartup(), false);
+    process.env.PONYTAIL_QUIET_STARTUP = "1";
+    assert.equal(readQuietStartup(), true);
+  } finally {
+    if (previousXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = previousXdg;
+    if (previousEnv === undefined) delete process.env.PONYTAIL_QUIET_STARTUP;
+    else process.env.PONYTAIL_QUIET_STARTUP = previousEnv;
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("filterSkillBodyForMode keeps only requested intensity examples and rows", () => {
+  // Examples are quoted in the real SKILL.md (`- lite: "..."`) — match that
+  // shape here too; see the next test for why the quote is load-bearing.
+  const body = `---\nname: ponytail\n---\n| **lite** | keep lite |\n| **full** | keep full |\n| **ultra** | keep ultra |\n- lite: "Lite example"\n- full: "Full example"\n- ultra: "Ultra example"\nOther line`;
+
+  const filtered = filterSkillBodyForMode(body, "ultra");
+
+  assert.ok(!filtered.includes("keep lite"));
+  assert.ok(!filtered.includes("keep full"));
+  assert.ok(filtered.includes("keep ultra"));
+  assert.ok(!filtered.includes("Lite example"));
+  assert.ok(filtered.includes("Ultra example"));
+  assert.ok(filtered.includes("Other line"));
+});
+
+test("filterSkillBodyForMode does not drop a rule bullet whose label matches a mode name", () => {
+  // A rule bullet like "- Full: ..." has the same "label: text" shape as a
+  // worked example, but isn't one — it must survive in every mode. Only the
+  // quoted, `- lite: "..."`-style bullets are real per-mode examples.
+  const body = `- Full: do not confuse this rule label with the mode name.\n- Lite: same risk, this is a real rule bullet.\n- lite: "real worked example"\n- ultra: "real worked example"`;
+
+  const filtered = filterSkillBodyForMode(body, "ultra");
+
+  assert.ok(filtered.includes("Full: do not confuse"), "an unquoted rule bullet must not be treated as a mode example");
+  assert.ok(filtered.includes("Lite: same risk"), "an unquoted rule bullet must not be treated as a mode example");
+  assert.ok(!filtered.includes("- lite:"), "the real quoted lite example must still be filtered out in ultra mode");
+  assert.ok(filtered.includes('ultra: "real worked example"'));
+});
+
+test("filterSkillBodyForMode keeps rule bullets that contain a colon", () => {
+  // Regression: rule bullets outside the Intensity section (e.g. the
+  // "No unrequested abstractions:" rule or the `shortcut:` comment convention)
+  // contain a colon and must not be mistaken for mode-example lines.
+  const skillPath = new URL("../../skills/ponytail/SKILL.md", import.meta.url);
+  const body = readFileSync(skillPath, "utf8");
+
+  const filtered = filterSkillBodyForMode(body, "full");
+
+  assert.ok(filtered.includes("Bug fix: before you edit, grep every caller"));
+  assert.ok(filtered.includes("Never cut: validation at trust boundaries"));
+  assert.ok(filtered.includes("code comment in this form: `shortcut: <the limit>, <when to upgrade>`"));
+  // The level rows are still filtered down to the active mode.
+  assert.ok(filtered.includes("| **full** |"));
+  assert.ok(!filtered.includes("| **lite** |"));
+});

package/plugin.yaml

@@ -1,12 +1,21 @@
-name: chill-agent
-version: 1.2.0
-description: ChillAgent Anti-Slop 2.0 & Pragmatic Senior Dev Standard
-skills:
-  - ./skills/chill-slop/
-  - ./skills/chill-slop-ui/
-  - ./skills/chill-slop-code/
-  - ./skills/chill-slop-copywriting/
-  - ./skills/chill-slop-human/
-  - ./skills/chill-slop-mobile/
-  - ./skills/chill-audit/
-  - ./skills/chill-review/
+name: ponytail
+version: 1.6.0
+description: Lazy senior dev mode for Hermes Agent, always-on context, bundled skills, and slash commands.
+author: sann
+provides_hooks:
+  - pre_llm_call
+  - pre_gateway_dispatch
+provides_commands:
+  - ponytail
+  - ponytail-review
+  - ponytail-audit
+  - ponytail-debt
+  - ponytail-gain
+  - ponytail-help
+provides_skills:
+  - ponytail
+  - ponytail-review
+  - ponytail-audit
+  - ponytail-debt
+  - ponytail-gain
+  - ponytail-help

package/rules/antislop.mdc

@@ -0,0 +1,18 @@
+---
+description: Always-on antislop pointer for Cursor sessions. Loads the matching skills and saved usage mode.
+globs: **/*
+alwaysApply: true
+---
+
+<EXTREMELY_IMPORTANT>
+You use antislop (Anti Slop: Rules for AI Coding Agents). It is a filter, not a style guide: it stops generic AI slop in generated UI, copy, and code, without prescribing aesthetics.
+
+For UI, copy, people, mobile layout, or code comments work, load the matching antislop skill before starting. Each skill is a folder in this plugin's skills/ directory (read its SKILL.md):
+- Core filter, always on: skills/antislop/SKILL.md
+- UI / visual: skills/antislop-ui/SKILL.md
+- Copy & text: skills/antislop-copywriting/SKILL.md
+- People: skills/antislop-human/SKILL.md
+- Mobile / responsive: skills/antislop-layoutmobile/SKILL.md
+- Code comments: skills/antislop-code/SKILL.md
+Before starting, follow the core's "Two Usage Modes" section: explicit session instruction first, then global preference, then ask. For a resolved mode, announce `antislop active: <mode> (session override).` or `antislop active: <mode> (global preference).` once, using the actual mode and source. Ask only when no mode is resolved.
+</EXTREMELY_IMPORTANT>

package/scripts/build-openclaw-skills.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+// Generate the OpenClaw / ClawHub skill package (.openclaw/skills/) from the
+// canonical skills/. OpenClaw skills are SKILL.md (frontmatter + body), the same
+// format ponytail already uses, with one difference: `description` must be a
+// single line under 160 chars. The canonical descriptions are long (tuned for
+// Claude's skill picker), so each ships a short one here. The body is copied
+// verbatim from skills/<name>/SKILL.md so the ruleset never drifts; only the
+// frontmatter is rewritten.
+//
+// Run:  node scripts/build-openclaw-skills.js
+// tests/openclaw-skills.test.js fails if the committed copies are stale.
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.join(__dirname, '..');
+const HOMEPAGE = 'https://github.com/DietrichGebert/ponytail';
+
+const DESCRIPTIONS = {
+  'ponytail': 'Lazy senior dev mode for any coding task: the smallest change that fully solves it, and a reply a busy human understands in one read.',
+  'ponytail-review': 'Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.',
+  'ponytail-audit': 'Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.',
+  'ponytail-debt': 'Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot report.',
+  'ponytail-gain': 'Show ponytail measured impact as a scoreboard: less code, less cost, more speed, from the agentic benchmark averages. One-shot display.',
+  'ponytail-help': "Quick reference for ponytail's modes, skills, and commands. One-shot display.",
+};
+
+const NAMES = Object.keys(DESCRIPTIONS);
+
+function sourceBody(name) {
+  const src = fs.readFileSync(path.join(ROOT, 'skills', name, 'SKILL.md'), 'utf8').replace(/\r\n/g, '\n');
+  const fm = src.match(/^---\n[\s\S]*?\n---\n?/);
+  if (!fm) throw new Error(`skills/${name}/SKILL.md has no frontmatter`);
+  return src.slice(fm[0].length);
+}
+
+function render(name) {
+  const desc = DESCRIPTIONS[name];
+  if (desc.length > 160 || desc.includes('\n') || desc.includes('"')) {
+    throw new Error(`description for ${name} must be one line, no quotes, under 160 chars`);
+  }
+  const frontmatter =
+    `---\nname: ${name}\ndescription: "${desc}"\nhomepage: ${HOMEPAGE}\nlicense: MIT\n---\n`;
+  return frontmatter + sourceBody(name);
+}
+
+function outPath(name) {
+  return path.join(ROOT, '.openclaw', 'skills', name, 'SKILL.md');
+}
+
+module.exports = { DESCRIPTIONS, NAMES, render, outPath, sourceBody };
+
+if (require.main === module) {
+  for (const name of NAMES) {
+    const p = outPath(name);
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, render(name));
+    console.log('wrote', path.relative(ROOT, p).replace(/\\/g, '/'));
+  }
+}

package/scripts/check-repo.mjs

@@ -0,0 +1,389 @@
+#!/usr/bin/env node
+/**
+ * The rules antislop applies to other people's repos, applied to this one.
+ * Run it before opening a PR:
+ *
+ *   node scripts/check-repo.mjs
+ */
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { buildIndex, START, END } from './skill-index.mjs'
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
+const read = (p) => fs.readFileSync(path.join(root, p), 'utf8')
+// Split on /\r?\n/, not '\n': on a Windows checkout a trailing \r survives and
+// every ^...$ regex below silently stops matching.
+const lines = (p) => read(p).split(/\r?\n/)
+
+const SKILLS = fs
+  .readdirSync(path.join(root, 'skills'), { withFileTypes: true })
+  .filter((e) => e.isDirectory())
+  .map((e) => `skills/${e.name}/SKILL.md`)
+
+const MANIFESTS = [
+  'package.json',
+  '.claude-plugin/plugin.json',
+  '.claude-plugin/marketplace.json',
+  '.codex-plugin/plugin.json',
+  '.cursor-plugin/plugin.json',
+  '.cursor-plugin/marketplace.json',
+  '.kimi-plugin/plugin.json',
+  '.agents/plugins/marketplace.json',
+  '.omp-plugin/marketplace.json',
+  'plugin.json',
+  'cli/package.json',
+]
+
+/** The community files GitHub reads. Held to the rules the documents above already follow. */
+const COMMUNITY = [
+  'CONTRIBUTING.md',
+  'CODE_OF_CONDUCT.md',
+  '.github/PULL_REQUEST_TEMPLATE.md',
+  '.github/ISSUE_TEMPLATE/bug_report.yml',
+  '.github/ISSUE_TEMPLATE/rule_gap.yml',
+  '.github/ISSUE_TEMPLATE/config.yml',
+]
+
+/** R-02's carve-out, encoded so a new em dash in ordinary prose still fails. */
+function emDashes() {
+  const bad = []
+  // The rules/ pointers ship to plugin users, so the ban covers them like any other doc.
+  const files = [
+    'antislop.md',
+    'README.md',
+    'GUIDE.md',
+    'ROADMAP.md',
+    'SECURITY.md',
+    'rules/antislop.md',
+    'rules/antislop.mdc',
+    ...COMMUNITY,
+    ...SKILLS,
+  ]
+
+  for (const file of files) {
+    let section = ''
+    lines(file).forEach((line, i) => {
+      const heading = line.match(/^#{2,4}\s+(.*)$/)
+      if (heading) section = heading[1]
+      if (!/[—–]/.test(line)) return
+
+      const exempt =
+        // "#### R-02 — Copywriting" and "### C-1 — Intentionality"
+        /^#{2,4}\s+(R-\d{2}|C-\d)\s+—\s/.test(line) ||
+        // The rule that defines the ban, and the skill section that teaches it.
+        /^(R-02|Em Dashes)\b/.test(section) ||
+        // The Part 1 table row that shows the pattern.
+        /^\|\s*\*\*Em Dash/.test(line) ||
+        // The Delivery Gate item that quotes the character it checks for.
+        (/^\s*- \[ \]/.test(line) && /\*\(R-02\)\*/.test(line))
+
+      if (!exempt) bad.push(`${file}:${i + 1}: ${line.trim().slice(0, 90)}`)
+    })
+  }
+  return bad
+}
+
+/** Every rule the core defines must have a Delivery Gate item citing it, and vice versa. */
+function gateCoverage() {
+  const core = read('antislop.md')
+  const defined = new Set([...core.matchAll(/^#### (R-\d{2}) —/gm)].map((m) => m[1]))
+  const gate = core.split('## Delivery Gate (Mandatory)')[1] ?? ''
+  const cited = new Set([...gate.matchAll(/\((R-\d{2})\)/g)].map((m) => m[1]))
+
+  const bad = []
+  for (const r of [...defined].sort()) {
+    if (!cited.has(r)) bad.push(`${r} is defined in Part 2 but no Delivery Gate item cites it`)
+  }
+  for (const r of [...cited].sort()) {
+    if (!defined.has(r)) bad.push(`${r} is cited in the Delivery Gate but Part 2 does not define it`)
+  }
+  return bad
+}
+
+/** A skill may reference core rules by number. It may not invent one. */
+function skillReferences() {
+  const defined = new Set([...read('antislop.md').matchAll(/^#### (R-\d{2}) —/gm)].map((m) => m[1]))
+  const bad = []
+  for (const file of SKILLS) {
+    for (const r of new Set([...read(file).matchAll(/\bR-\d{2}\b/g)].map((m) => m[0]))) {
+      if (!defined.has(r)) bad.push(`${file} cites ${r}, which antislop.md does not define`)
+    }
+  }
+  return bad
+}
+
+/** The version is hand-written in every manifest and stamp. They have to agree. */
+function versions() {
+  // A malformed file is already reported by the manifest check; do not crash here.
+  const json = (p) => {
+    try {
+      return JSON.parse(read(p))
+    } catch {
+      return null
+    }
+  }
+  const want = json('cli/package.json')?.version
+  if (!want) return ['cli/package.json has no readable version']
+
+  const found = [
+    // The lock file carries the version twice, and npm ci will not correct a stale one.
+    ['cli/package-lock.json', json('cli/package-lock.json')?.version],
+    ['cli/package-lock.json (packages "")', json('cli/package-lock.json')?.packages?.['']?.version],
+    // The Cline plugin manifest and, from v3.2.17, the Pi package. Same release.
+    ['package.json', json('package.json')?.version],
+    ['.claude-plugin/plugin.json', json('.claude-plugin/plugin.json')?.version],
+    ['.claude-plugin/marketplace.json', json('.claude-plugin/marketplace.json')?.plugins?.[0]?.version],
+    ['.codex-plugin/plugin.json', json('.codex-plugin/plugin.json')?.version],
+    ['.cursor-plugin/plugin.json', json('.cursor-plugin/plugin.json')?.version],
+    ['.omp-plugin/marketplace.json', json('.omp-plugin/marketplace.json')?.plugins?.[0]?.version],
+    ['.kimi-plugin/plugin.json', json('.kimi-plugin/plugin.json')?.version],
+    // Stamped into every install, so a stale one makes the installer misreport what is on disk.
+    ['skills/antislop/VERSION', read('skills/antislop/VERSION').trim()],
+    ['cli/lib/banner.mjs', read('cli/lib/banner.mjs').match(/installer v(\d+\.\d+\.\d+)/)?.[1]],
+    ['skills/antislop-human/contrast-mcp.py', read('skills/antislop-human/contrast-mcp.py').match(/SERVER_VERSION = "(\d+\.\d+\.\d+)"/)?.[1]],
+    // The contributors image is cached per URL, so a changed version is what makes it redraw.
+    ['README.md (contributors image)', read('README.md').match(/contrib\.rocks\/image\?repo=[^"'&\s]+&v=(\d+\.\d+\.\d+)/)?.[1]],
+  ]
+
+  return found
+    .filter(([, got]) => got !== want)
+    .map(([file, got]) => `${file} says ${got ?? 'nothing'}, cli/package.json says ${want}`)
+}
+
+/** A manifest that does not parse takes its whole install path down. */
+function manifests() {
+  const bad = []
+  for (const file of MANIFESTS) {
+    try {
+      JSON.parse(read(file))
+    } catch (err) {
+      bad.push(`${file} is not valid JSON: ${err.message}`)
+    }
+  }
+  return bad
+}
+
+/** An agent finds a skill by its frontmatter. Without it the folder is inert. */
+function frontmatter() {
+  const bad = []
+  for (const file of SKILLS) {
+    const head = read(file).split('---')[1] ?? ''
+    // [ \t] not \s: \s spans newlines, so an empty value would match the next key.
+    if (!/^name:[ \t]*\S/m.test(head)) bad.push(`${file} has no name in its frontmatter`)
+    if (!/^description:[ \t]*\S/m.test(head)) bad.push(`${file} has no description in its frontmatter`)
+  }
+  return bad
+}
+
+/** A new skill has to be registered in all four places below or it cannot install. */
+function registration() {
+  const names = SKILLS.map((f) => f.split('/')[1])
+  const core = 'antislop'
+  const places = [
+    ['rules/antislop.md', read('rules/antislop.md')],
+    ['rules/antislop.mdc', read('rules/antislop.mdc')],
+    ["cli/index.mjs (EXTRA_SKILLS)", read('cli/index.mjs')],
+    ['cli/lib/install.mjs (SKILL_LINES)', read('cli/lib/install.mjs')],
+  ]
+
+  const bad = []
+  for (const name of names) {
+    for (const [label, text] of places) {
+      // The core is always on, so the picker's optional-extras menu never lists it.
+      if (name === core && label.startsWith('cli/index.mjs')) continue
+      if (!text.includes(name)) bad.push(`${name} is not registered in ${label}`)
+    }
+  }
+  return bad
+}
+
+/** A rule's tier decides its gate block: Hard Gate 1, Purpose-Gate 2, Quality Locks 4. */
+function tiers() {
+  const core = read('antislop.md')
+  const part2 = core.split('## Part 2:')[1]?.split('## Part 3:')[0] ?? ''
+
+  const group = {}
+  let current = null
+  for (const line of part2.split('\n')) {
+    const g = line.match(/^### Group \d: ([^(]+)/)
+    if (g) current = g[1].trim()
+    const r = line.match(/^#### (R-\d{2}) —/)
+    if (r && current) group[r[1]] = current
+  }
+
+  const block = {}
+  let currentBlock = null
+  for (const line of (core.split('## Delivery Gate (Mandatory)')[1] ?? '').split('\n')) {
+    const b = line.match(/^### (Block \d):/)
+    if (b) currentBlock = b[1]
+    for (const m of line.matchAll(/\((R-\d{2})\)/g)) {
+      if (!block[m[1]]) block[m[1]] = currentBlock
+    }
+  }
+
+  const wants = { 'Hard Gate': 'Block 1', 'Purpose-Gate': 'Block 2', 'Quality Locks': 'Block 4' }
+  const bad = []
+  for (const [rule, grp] of Object.entries(group).sort()) {
+    const want = wants[grp]
+    const got = block[rule]
+    if (want && got && want !== got) bad.push(`${rule} is a ${grp} rule but the gate cites it from ${got}`)
+  }
+  return bad
+}
+
+/** A manifest that points at a file that is gone breaks its install path quietly. */
+function manifestPaths() {
+  const bad = []
+  for (const file of MANIFESTS) {
+    let text
+    try {
+      text = read(file)
+    } catch {
+      continue
+    }
+    for (const m of text.matchAll(/"(\.\/[^"]+)"/g)) {
+      const target = m[1].replace(/^\.\//, '')
+      if (!existsExactly(target)) bad.push(`${file} points at ${m[1]}, which does not exist`)
+    }
+    // A plugin-root path is absolute only once the agent expands it, so check the tail.
+    for (const m of text.matchAll(/"\$\{CLAUDE_PLUGIN_ROOT\}\/([^"]+)"/g)) {
+      if (!existsExactly(m[1])) bad.push(`${file} points at \${CLAUDE_PLUGIN_ROOT}/${m[1]}, which does not exist`)
+    }
+  }
+  return bad
+}
+
+/** existsSync misses a case-only rename on macOS; compare the real dir entry. */
+const existsExactly = (target) => {
+  const full = path.join(root, target)
+  const dir = path.dirname(full)
+  if (!fs.existsSync(dir)) return false
+  return fs.readdirSync(dir).includes(path.basename(full))
+}
+
+/** GitHub's anchor rule: lowercase, drop punctuation, spaces to hyphens, duplicates numbered. */
+function anchorsIn(text) {
+  const taken = new Map()
+  const out = new Set()
+  for (const line of text.split(/\r?\n/)) {
+    const m = line.match(/^#{1,6}\s+(.+?)\s*#*\s*$/)
+    if (!m) continue
+    const base = m[1].toLowerCase().replace(/[^\p{L}\p{N}\s-]/gu, '').trim().replace(/\s+/g, '-')
+    const seen = taken.get(base) ?? 0
+    taken.set(base, seen + 1)
+    out.add(seen === 0 ? base : `${base}-${seen}`)
+  }
+  return out
+}
+
+function docLinks() {
+  const bad = []
+  for (const file of ['README.md', 'GUIDE.md', 'ROADMAP.md', 'SECURITY.md', ...COMMUNITY]) {
+    // Markdown links, plus the raw HTML images and badges the README is built from.
+    for (const m of read(file).matchAll(/\]\(([^)\s]+)\)|(?:src|href)="([^"]+)"/g)) {
+      const [target, anchor] = (m[1] ?? m[2]).split('#')
+      if (/^(https?:|mailto:)/.test(target)) continue
+      // Every table of contents is a list of these, and a renamed heading breaks one silently.
+      if (!target) {
+        if (anchor && !anchorsIn(read(file)).has(anchor)) {
+          bad.push(`${file} links to #${anchor}, which is not a heading in it`)
+        }
+        continue
+      }
+      if (!existsExactly(target)) {
+        bad.push(`${file} links to ${target}, which does not exist`)
+        continue
+      }
+      if (anchor && target.endsWith('.md') && !anchorsIn(read(target)).has(anchor)) {
+        bad.push(`${file} links to ${target}#${anchor}, which is not a heading in it`)
+      }
+    }
+  }
+  return bad
+}
+
+/** A YAML file that routes people by URL rots the same way a markdown link does. */
+function repoUrls() {
+  const bad = []
+  const prefix = 'https://github.com/miqdadbadjuber/anti-slop/blob/main/'
+  for (const file of COMMUNITY) {
+    for (const m of read(file).matchAll(/url:\s*(\S+)/g)) {
+      // A URL that leaves this repository is not this check's to resolve.
+      if (!m[1].startsWith(prefix)) continue
+      const target = m[1].slice(prefix.length)
+      if (!existsExactly(target)) bad.push(`${file} points at ${target}, which does not exist`)
+    }
+  }
+  return bad
+}
+
+/** The WCAG formula is duplicated, and only contrast-check.py has a selftest. */
+function contrastTwins() {
+  const check = read('skills/antislop-human/contrast-check.py')
+  const mcp = read('skills/antislop-human/contrast-mcp.py')
+  const constants = ['0.03928', '12.92', '1.055', '0.2126', '0.7152', '0.0722', '0.05']
+
+  const bad = []
+  for (const c of constants) {
+    if (check.includes(c) !== mcp.includes(c)) {
+      bad.push(`the WCAG constant ${c} appears in only one of contrast-check.py and contrast-mcp.py`)
+    }
+  }
+  return bad
+}
+
+/** The guide carries a generated catalogue, so a skill that adds a pattern cannot leave it behind. */
+function skillIndex() {
+  const guide = read('GUIDE.md').replace(/\r\n/g, '\n')
+  const from = guide.indexOf(START)
+  const to = guide.indexOf(END)
+  if (from === -1 || to === -1) return [`GUIDE.md has no ${START} ... ${END} pair`]
+
+  let generated
+  try {
+    generated = buildIndex()
+  } catch (e) {
+    return [e.message]
+  }
+  const shipped = guide.slice(from + START.length, to).replace(/^\n+|\n+$/g, '')
+  if (shipped !== generated.replace(/\n+$/, '')) {
+    return ['the skill catalogue in GUIDE.md is stale: run node scripts/skill-index.mjs']
+  }
+  return []
+}
+
+const CHECKS = [
+  // Manifests first: the later checks read them as data.
+  ['every manifest is valid JSON', manifests],
+  ['no em dash outside the R-02 carve-out', emDashes],
+  ['every rule has a Delivery Gate item', gateCoverage],
+  ['skills cite only rules that exist', skillReferences],
+  ['the version agrees everywhere', versions],
+  ['every skill has usable frontmatter', frontmatter],
+  ['every skill is registered everywhere', registration],
+  ['each rule sits in the gate block its tier implies', tiers],
+  ['every manifest path resolves', manifestPaths],
+  ['every doc link resolves', docLinks],
+  ['every URL in a community file resolves', repoUrls],
+  ['both contrast implementations use the same formula', contrastTwins],
+  ['the skill index in the guide is current', skillIndex],
+]
+
+let failed = 0
+for (const [label, run] of CHECKS) {
+  const problems = run()
+  if (problems.length === 0) {
+    console.log(`ok   ${label}`)
+    continue
+  }
+  failed += 1
+  console.log(`FAIL ${label}`)
+  for (const p of problems) console.log(`       ${p}`)
+}
+
+if (failed > 0) {
+  console.error(`\n${failed} of ${CHECKS.length} checks failed`)
+  process.exit(1)
+}
+console.log(`\nall ${CHECKS.length} checks passed`)