claude-dev-env 8.65.0 → 8.66.0

package/.agents/skills/grok-spawn/SKILL.md

@@ -108,54 +108,10 @@ Flag sets and profile meaning:
 
 ### 3. Write the batch JSON spec
 
-Shape:
-
-```json
-{
-  "role": "bugteam",
-  "should_ping": false,
-  "workers": [
-    {
-      "role_name": "investigate-hooks",
-      "prompt_parts": [
-        "/abs/path/to/readonly-brief.md",
-        "/abs/path/to/task-body.md",
-        "/abs/path/to/report-contract.md"
-      ],
-      "cwd": "/abs/path/to/worktree",
-      "tool_profile": "readonly",
-      "timeout_seconds": 600,
-      "is_repo_only": true,
-      "agent_name": "poteto-agent"
-    }
-  ]
-}
-```
-
-| Field | Meaning |
-|---|---|
-| `role` | Preflight role configuration to check (default `bugteam`) |
-| `should_ping` | When true, preflight runs the opt-in live ping |
-| `workers` | Non-empty list of worker objects |
-| `role_name` | Label on the summary report for this worker |
-| `prompt_parts` | Ordered absolute paths to part files |
-| `cwd` | Working directory for that worker |
-| `tool_profile` | `readonly` or `build` |
-| `timeout_seconds` | Per-worker timeout (default 600, ceiling 5400). A spec asking for more is refused |
-| `is_repo_only` | Readonly only: when true, also pass `--disable-web-search` |
-| `agent_name` | Use `poteto-agent`; prompts carry the worker role. |
-
-Workers run with no turn cap. The timeout is the only bound on a worker's
-length, and a worker that hits it is killed with its whole process tree and
-reported as `timeout`.
-
-A worker entry accepts these fields and no others. Any other key fails the
-load with an error naming the stray key and listing the accepted set, so a
-misspelled field shows up at startup rather than passing for a setting that
-took effect.
-
-Put the spec file under the run state directory (or any path you pass to
-`--spec`).
+Write the spec from the shape and field table in
+[`reference/batch-spec.md`](reference/batch-spec.md). A worker entry accepts
+only the listed fields. Put the spec file under the run state directory (or any
+path you pass to `--spec`).
 
 ### 4. Launch the batch
 
@@ -222,14 +178,9 @@ Build workers stop at stage-ready edits and a written report. They do not run
 | File | Purpose |
 |---|---|
 | `SKILL.md` | Trigger, gotchas, process, batch shape, composition |
-| `CLAUDE.md` | Package map for this skill folder |
 | `reference/worker-briefs.md` | Readonly brief, build brief, report contract templates |
 | `reference/flag-profiles.md` | Readonly vs build flags, shared flags, socket and stagger rules |
-
-## Folder map
-
-- `SKILL.md` — hub and process.
-- `reference/` — brief templates and flag profiles.
+| `reference/batch-spec.md` | Batch JSON spec shape and worker fields |
 
 ## Worker advisors
 

package/.agents/skills/grok-spawn/reference/batch-spec.md

@@ -0,0 +1,49 @@
+# Batch JSON spec
+
+Shape:
+
+```json
+{
+  "role": "bugteam",
+  "should_ping": false,
+  "workers": [
+    {
+      "role_name": "investigate-hooks",
+      "prompt_parts": [
+        "/abs/path/to/readonly-brief.md",
+        "/abs/path/to/task-body.md",
+        "/abs/path/to/report-contract.md"
+      ],
+      "cwd": "/abs/path/to/worktree",
+      "tool_profile": "readonly",
+      "timeout_seconds": 600,
+      "is_repo_only": true,
+      "agent_name": "poteto-agent"
+    }
+  ]
+}
+```
+
+| Field | Meaning |
+|---|---|
+| `role` | Preflight role configuration to check (default `bugteam`) |
+| `should_ping` | When true, preflight runs the opt-in live ping |
+| `workers` | Non-empty list of worker objects |
+| `role_name` | Label on the summary report for this worker |
+| `prompt_parts` | Ordered absolute paths to part files |
+| `cwd` | Working directory for that worker |
+| `tool_profile` | `readonly` or `build` |
+| `timeout_seconds` | Per-worker timeout (default 600, ceiling 5400). A spec asking for more is refused |
+| `is_repo_only` | Readonly only: when true, also pass `--disable-web-search` |
+| `agent_name` | Use `poteto-agent`; prompts carry the worker role. |
+
+Workers run with no turn cap. The timeout is the only bound on a worker's
+length, and a worker that hits it is killed with its whole process tree and
+reported as `timeout`.
+
+A worker entry accepts these fields and no others. Any other key fails the
+load with an error naming the stray key and listing the accepted set, so a
+misspelled field fails at startup.
+
+Put the spec file under the run state directory (or any path you pass to
+`--spec`).

package/.agents/skills/orchestrator/test_orchestrator_skill_contract.py

@@ -7,11 +7,9 @@ _SKILL_DIR = Path(__file__).resolve().parent
 _REFRESH_PATH = _SKILL_DIR.parent / "orchestrator-refresh" / "SKILL.md"
 _ORCHESTRATOR_PATHS = (
     _SKILL_DIR / "SKILL.md",
-    _SKILL_DIR / "AGENTS.md",
     _SKILL_DIR / "reference" / "consult-the-orchestrator.md",
     _SKILL_DIR / "reference" / "executor-consult-block.md",
     _SKILL_DIR / "reference" / "host-detect.md",
-    _SKILL_DIR / "reference" / "AGENTS.md",
     _REFRESH_PATH,
 )
 _FOREIGN_MARKERS = (

package/.agents/skills/pull-request/SKILL.md

@@ -8,21 +8,6 @@ description: >-
 
 # Pull request
 
-## Contents
-
-- [Principle](#principle)
-- [When this applies](#when-this-applies)
-- [Constraints](#constraints)
-- [Dependencies](#dependencies)
-- [Sub-skills](#sub-skills)
-- [Task seeding](#task-seeding)
-- [Process](#process)
-- [Exit handling](#exit-handling)
-- [Examples](#examples)
-- [Gotchas](#gotchas)
-- [File index](#file-index)
-- [Folder map](#folder-map)
-
 ## Principle
 
 Publish one GitHub pull request action from validated local files and a
@@ -151,12 +136,8 @@ failure. Never print the value.
 
 ### 6. Recover a selected legacy record
 
-Run `.agents/skills/pull-request/scripts/recover_legacy_author.py
-<exact-state-file> --confirm-inactive` only when the user selects one legacy
-state file. The command checks the record's age, secure file metadata, and
-contents. The confirmation flag records that the caller verified inactivity.
-Leave every other record untouched. Delete the selected record only after a
-successful restore. Mark this step `N/A` when no legacy state file is selected.
+Follow `reference/legacy-author-recovery.md` only when the user selects one
+legacy state file. Mark this step `N/A` otherwise.
 
 ### 7. Run the action
 
@@ -185,24 +166,12 @@ only after remote readback proves the requested state.
 
 ## Examples
 
-Create example: the writer produces `pr-body.md`. The linter exits `0` for
-`pr-create`. `pull_request.py create` publishes one ready pull request. The
-readback matches the title, body, head SHA, and draft state.
-
-Rejected comment example: the comment body names a worktree file. The linter
-returns a non-zero exit. No account lookup or GitHub request runs. Replace the
-path with inline text or a permanent artifact URL, then rerun.
-
-Recovery example: one old record remains after an interrupted legacy account
-swap. The user selects that exact file and confirms its session is inactive.
-The recovery command restores the named account and deletes only that record.
+Read `reference/examples.md` for a create, a rejected comment, and a recovery.
 
 ## Gotchas
 
 - Relative body-file paths depend on the caller directory. Use an absolute path
   when another process or worktree starts the command.
-- A record older than 30 minutes can still belong to a live session. Require
-  `--confirm-inactive` before recovery.
 - Normal pull request actions never call `gh auth switch`. If that command
   appears outside explicit recovery, stop.
 - `gh auth switch`, `login`, and `logout` change the account for every session
@@ -217,6 +186,8 @@ The recovery command restores the named account and deletes only that record.
 |---|---|
 | `SKILL.md` | Hub for pull request publication, validation, author selection, recovery, and readback |
 | `reference/publication-tasks.md` | Ordered tasks for every publication gate |
+| `reference/legacy-author-recovery.md` | Recovery of one selected legacy author record |
+| `reference/examples.md` | Worked create, rejected comment, and recovery examples |
 | `scripts/pull_request.py` | Command for author selection and create, edit, comment, and review actions |
 | `scripts/github_pr_command_constants/` | Constants for pull request actions, recovery, exit codes, and generic messages |
 | `scripts/test_pull_request.py` | Tests for `pull_request.py` |
@@ -226,18 +197,3 @@ The recovery command restores the named account and deletes only that record.
 | `<managed-root>/scripts/durable_post_lint.py` | Shared action-aware title, body, and path validator |
 | `scripts/gh_artifact_upload.py` | Helper for permanent GitHub binary evidence URLs |
 | `scripts/tests/test_gh_artifact_upload.py` | Tests for binary evidence upload |
-
-## Folder map
-
-```text
-pull-request/
-├── SKILL.md
-├── reference/
-│   └── publication-tasks.md
-└── scripts/
-    ├── pull_request.py
-    ├── github_pr_command_constants/
-    ├── recover_legacy_author.py
-    ├── test_pull_request.py
-    └── test_recover_legacy_author.py
-```

package/.agents/skills/pull-request/reference/examples.md

@@ -0,0 +1,13 @@
+# Pull request examples
+
+Create example: the writer produces `pr-body.md`. The linter exits `0` for
+`pr-create`. `pull_request.py create` publishes one ready pull request. The
+readback matches the title, body, head SHA, and draft state.
+
+Rejected comment example: the comment body names a worktree file. The linter
+returns a non-zero exit. No account lookup or GitHub request runs. Replace the
+path with inline text or a permanent artifact URL, then rerun.
+
+Recovery example: one old record remains after an interrupted legacy account
+swap. The user selects that exact file and confirms its session is inactive.
+The recovery command restores the named account and deletes only that record.

package/.agents/skills/pull-request/reference/legacy-author-recovery.md

@@ -0,0 +1,11 @@
+# Recover a selected legacy author record
+
+Run `.agents/skills/pull-request/scripts/recover_legacy_author.py
+<exact-state-file> --confirm-inactive` only when the user selects one legacy
+state file. The command checks the record's age, secure file metadata, and
+contents. The confirmation flag records that the caller verified inactivity.
+Leave every other record untouched. Delete the selected record only after a
+successful restore.
+
+A record older than 30 minutes can still belong to a live session. Require
+`--confirm-inactive` before recovery.

package/bin/install.settings-defaults.test.mjs

@@ -32,7 +32,7 @@ const PACKAGE_SETTINGS_PATH = join(PACKAGE_ROOT, 'settings.json');
 const INSTALL_ENTRY = join(PACKAGE_ROOT, 'bin', 'install.mjs');
 
 const EXPECTED_DENY_ENTRIES = [];
-const EXPECTED_ALLOW_ENTRIES = ['WebFetch(domain:docs.github.com)'];
+const EXPECTED_ALLOW_ENTRIES = ['WebFetch(domain:docs.github.com)', 'Read(~/.claude/docs/**)'];
 const PROFILE_ALLOW_ENTRIES = DECLARED_PROFILE_SETTINGS
     .find((eachEntry) => eachEntry.keyPath.join('.') === 'permissions.allow').items;
 const SAMPLE_MANAGED_DENY_ENTRIES = ['Edit($HOME/.claude/managed-test/**)'];

package/docs/references/working-style.md

@@ -0,0 +1,40 @@
+# Working style
+
+The SessionStart hook `hooks/session/working_style_prompt.py` points every session here. Read this file once, before your first reply.
+
+## Records
+
+- Document each task in a location that remains easy to find later.
+- Keep a running scratch text ledger as you work.
+
+## Presentation
+
+- Use ELI5 for beginner framing, large visuals, minimal text, one stable self-contained HTML artifact, update-in-place continuity, and sharing when a user-facing response needs that presentation.
+- Apply `~/.claude/rules/asd-ste100-language.md` for user-facing word choice, sentence style, tone, punctuation, and prose form.
+- Keep responses focused, brief, and concise. Keep disclaimers and caveats short while giving the main answer most of the response.
+- Give a high-level explanation by default and provide depth when the request calls for it.
+- Match written-document length to the task. Cover the substance and keep every section, summary, and phrase useful.
+- Use current, immediately relevant context. Use full terms and specific names for repository work. Keep all text concise, clear, direct, and useful.
+
+## Replies
+
+- On a typed request, state your next action in one sentence before the first tool call.
+- Finish with the outcome in the first sentence.
+- Send the user only what they must act on or need to know.
+- When a background event, such as a task notification, an agent message, or a scheduled wake, starts a turn and nothing in it needs the user, end the turn with no text.
+- A report that a fix is done carries three lines: the fix acknowledged, what changed, and the proof that it works. Put the rest of the detail in the pull request or a linked file.
+
+## Scope
+
+- Deliver the requested work at its intended scope. Make routine judgment calls yourself.
+- Ask for direction when different interpretations would produce materially different work.
+- When a request seems mistaken or a better approach exists, state the concern briefly and continue with the requested task.
+- A request to remove something is complete once it is gone. Put nothing in its place, and pass a replacement idea to the requester as a question.
+- Finish the complete task and keep actions within the requested scope.
+
+## Questions
+
+- When a request has multiple reasonable interpretations, state your understanding and the assumptions that shape the work.
+- Ask one focused clarification question when the ambiguity changes the outcome, scope, audience, format, or risk.
+- Use a clearly stated low-risk assumption when the intended result remains stable.
+- Pause for the user's choice before making a high-impact decision.

package/hooks/blocking/artifact_dark_mode_gate.py

@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""PreToolUse hook that stops an artifact page from publishing when dark mode hides its text.
+
+The artifact service wraps every published page in a skeleton whose style pins
+``body`` to a light background and dark text. A page that flips its theme
+tokens on ``html`` alone keeps that light body in dark mode, and its light
+dark-mode text lands on it. A plain local render has no wrapper, so the page
+looks fine there and fails once published.
+
+This gate renders the page inside that same wrapper in headless Chromium,
+once under ``prefers-color-scheme: dark`` and once with ``data-theme="dark"``
+on the root element::
+
+    Artifact {"action": "publish", "file_path": "page.html"}  -> rendered
+        body stays light, or visible text under 4.5:1      -> denied
+        every check holds                                  -> allowed
+    Artifact {"action": "read", ...}                       -> allowed
+    Artifact {"asset": true, ...} or {"type_url": ...}     -> allowed
+    a publish whose file_path is not .html                 -> allowed
+
+A host without Playwright or Chromium is denied with the install command,
+because an unrendered page is the case this gate exists to stop.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+hooks_root_directory = str(Path(__file__).resolve().parent.parent)
+if hooks_root_directory not in sys.path:
+    sys.path.insert(0, hooks_root_directory)
+
+from hooks_constants.artifact_dark_mode_gate_constants import (
+    ALL_SKIPPED_PUBLISH_INPUT_KEYS,
+    ALLOW_EXIT_CODE,
+    ARTIFACT_ACTION_INPUT_KEY,
+    ARTIFACT_FILE_PATH_INPUT_KEY,
+    ARTIFACT_PUBLISH_ACTION,
+    ARTIFACT_TOOL_NAME,
+    BLOCK_EXIT_CODE,
+    DARK_MODE_FAILURE_HEADER,
+    GATE_EVENT_NAME,
+    HTML_FILE_SUFFIX,
+    PUBLISH_SKELETON_PREFIX,
+    RENDERER_MISSING_EXIT_CODE,
+    RENDERER_MISSING_HEADER,
+    RENDERER_SCRIPT_PATH,
+    RENDERER_TIMEOUT_SECONDS,
+    RETRY_INSTRUCTION,
+)
+from hooks_constants.hook_block_logger import log_hook_block
+from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin
+from hooks_constants.spawn_readiness_hook_constants import TOOL_INPUT_KEY, TOOL_NAME_KEY
+
+
+def published_page_path(tool_name: object, tool_input: object) -> Path | None:
+    """Return the local HTML page a call publishes as an artifact page, or None.
+
+    >>> published_page_path("Artifact", {"file_path": "/tmp/page.html"})
+    PosixPath('/tmp/page.html')
+    >>> published_page_path("Artifact", {"action": "read", "url": "x"}) is None
+    True
+
+    Args:
+        tool_name: The tool the session called.
+        tool_input: The tool input.
+
+    Returns:
+        The page path for a page publish, or None for any other call.
+    """
+    if tool_name != ARTIFACT_TOOL_NAME or not isinstance(tool_input, dict):
+        return None
+    if (
+        tool_input.get(ARTIFACT_ACTION_INPUT_KEY, ARTIFACT_PUBLISH_ACTION)
+        != ARTIFACT_PUBLISH_ACTION
+    ):
+        return None
+    if any(tool_input.get(each_key) for each_key in ALL_SKIPPED_PUBLISH_INPUT_KEYS):
+        return None
+    file_path = tool_input.get(ARTIFACT_FILE_PATH_INPUT_KEY)
+    if not isinstance(file_path, str) or not file_path.lower().endswith(HTML_FILE_SUFFIX):
+        return None
+    return Path(file_path)
+
+
+def wrap_in_publish_skeleton(page_source: str) -> str:
+    """Return the page as the artifact service serves it, inside its skeleton.
+
+    Args:
+        page_source: The HTML the session is about to publish.
+
+    Returns:
+        The skeleton head and body opening followed by the page source.
+    """
+    return PUBLISH_SKELETON_PREFIX + page_source
+
+
+def _run_renderer(wrapped_page_path: Path) -> subprocess.CompletedProcess[str] | str:
+    try:
+        return subprocess.run(
+            ["node", str(RENDERER_SCRIPT_PATH), str(wrapped_page_path)],
+            capture_output=True,
+            text=True,
+            timeout=RENDERER_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except FileNotFoundError:
+        return "node is not installed; install Node.js, then run: npm install -g playwright && npx playwright install chromium"
+    except subprocess.TimeoutExpired:
+        return f"the render took longer than {RENDERER_TIMEOUT_SECONDS} seconds"
+
+
+def render_findings(page_source: str) -> tuple[dict[str, list[str]] | None, str]:
+    """Render the wrapped page in both dark signals and return what failed.
+
+    Args:
+        page_source: The HTML the session is about to publish.
+
+    Returns:
+        The findings by dark signal (empty when the page passes) and an empty
+        message, or None and the reason the renderer could not run.
+    """
+    with tempfile.TemporaryDirectory() as scratch_directory:
+        wrapped_page_path = Path(scratch_directory) / "wrapped_page.html"
+        wrapped_page_path.write_text(wrap_in_publish_skeleton(page_source), encoding="utf-8")
+        completed_render = _run_renderer(wrapped_page_path)
+    if isinstance(completed_render, str):
+        return None, completed_render
+    if completed_render.returncode == RENDERER_MISSING_EXIT_CODE:
+        return None, completed_render.stderr.strip()
+    try:
+        findings_by_signal = json.loads(completed_render.stdout)
+    except json.JSONDecodeError:
+        return None, completed_render.stderr.strip() or "the renderer printed no result"
+    return findings_by_signal, ""
+
+
+def format_block_reason(findings_by_signal: dict[str, list[str]]) -> str:
+    """Return the deny message that lists each failed check under its dark signal.
+
+    Args:
+        findings_by_signal: Findings keyed by the dark signal that produced them.
+
+    Returns:
+        The message the session reads when the publish is denied.
+    """
+    all_lines = [DARK_MODE_FAILURE_HEADER]
+    for each_signal, each_signal_findings in findings_by_signal.items():
+        all_lines.append(f"Under {each_signal}:\n")
+        all_lines.extend(f"- {each_finding}\n" for each_finding in each_signal_findings)
+    return "".join(all_lines) + RETRY_INSTRUCTION
+
+
+def main() -> int:
+    hook_input = read_hook_input_dictionary_from_stdin()
+    if hook_input is None:
+        return ALLOW_EXIT_CODE
+    page_path = published_page_path(hook_input.get(TOOL_NAME_KEY), hook_input.get(TOOL_INPUT_KEY))
+    if page_path is None or not page_path.is_file():
+        return ALLOW_EXIT_CODE
+    findings_by_signal, renderer_problem = render_findings(page_path.read_text(encoding="utf-8"))
+    if findings_by_signal is None:
+        block_reason = RENDERER_MISSING_HEADER + renderer_problem
+    elif findings_by_signal:
+        block_reason = format_block_reason(findings_by_signal)
+    else:
+        return ALLOW_EXIT_CODE
+    log_hook_block(
+        Path(__file__).name,
+        GATE_EVENT_NAME,
+        block_reason,
+        tool_name=ARTIFACT_TOOL_NAME,
+        offending_input_preview=str(page_path),
+    )
+    sys.stderr.write(block_reason)
+    return BLOCK_EXIT_CODE
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/hooks/blocking/artifact_dark_mode_render.cjs

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+"use strict";
+
+const childProcess = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const MINIMUM_CONTRAST_RATIO = 4.5;
+const MAXIMUM_DARK_PAGE_LUMINANCE = 0.2;
+const MAXIMUM_REPORTED_TEXT_FAILURES = 8;
+const TEXT_SNIPPET_LENGTH = 60;
+const PAGE_LOAD_TIMEOUT_MILLISECONDS = 15000;
+const RENDERER_MISSING_EXIT_CODE = 3;
+const ALL_DARK_SIGNALS = [
+  { name: "prefers-color-scheme: dark", colorScheme: "dark", dataTheme: null },
+  { name: 'data-theme="dark"', colorScheme: "light", dataTheme: "dark" },
+];
+
+function loadPlaywright() {
+  try {
+    return require("playwright");
+  } catch (localError) {
+    const globalRoot = childProcess.execSync("npm root -g", { encoding: "utf8" }).trim();
+    return require(path.join(globalRoot, "playwright"));
+  }
+}
+
+function measurePage([maximumDarkPageLuminance, minimumContrastRatio, snippetLength]) {
+  const parseColor = (colorText) => {
+    const channels = (colorText.match(/[\d.]+/g) || []).map(Number);
+    return { red: channels[0] || 0, green: channels[1] || 0, blue: channels[2] || 0, alpha: channels.length > 3 ? channels[3] : 1 };
+  };
+  const channelLuminance = (channel) => {
+    const scaled = channel / 255;
+    return scaled <= 0.03928 ? scaled / 12.92 : Math.pow((scaled + 0.055) / 1.055, 2.4);
+  };
+  const luminance = (color) => 0.2126 * channelLuminance(color.red) + 0.7152 * channelLuminance(color.green) + 0.0722 * channelLuminance(color.blue);
+  const contrastRatio = (first, second) => {
+    const lighter = Math.max(luminance(first), luminance(second));
+    const darker = Math.min(luminance(first), luminance(second));
+    return (lighter + 0.05) / (darker + 0.05);
+  };
+  const canvasColor = { red: 255, green: 255, blue: 255, alpha: 1 };
+  const effectiveBackground = (element) => {
+    for (let current = element; current; current = current.parentElement) {
+      const background = parseColor(getComputedStyle(current).backgroundColor);
+      if (background.alpha > 0.5) {
+        return background;
+      }
+    }
+    return canvasColor;
+  };
+  const isVisible = (element) => {
+    const style = getComputedStyle(element);
+    const box = element.getBoundingClientRect();
+    return style.visibility !== "hidden" && style.display !== "none" && Number(style.opacity) > 0 && box.width > 0 && box.height > 0;
+  };
+  const allFindings = [];
+  const pageBackground = effectiveBackground(document.body);
+  if (luminance(pageBackground) > maximumDarkPageLuminance) {
+    allFindings.push(`the page background stays light (${getComputedStyle(document.body).backgroundColor} on body); give body an explicit background from the theme tokens`);
+  }
+  const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
+  const seenElements = new Set();
+  for (let textNode = walker.nextNode(); textNode; textNode = walker.nextNode()) {
+    const element = textNode.parentElement;
+    const text = textNode.textContent.trim();
+    if (!text || !element || seenElements.has(element) || ["SCRIPT", "STYLE", "TEMPLATE", "NOSCRIPT"].includes(element.tagName)) {
+      continue;
+    }
+    seenElements.add(element);
+    if (!isVisible(element)) {
+      continue;
+    }
+    const foreground = parseColor(getComputedStyle(element).color);
+    const background = effectiveBackground(element);
+    const ratio = contrastRatio(foreground, background);
+    if (ratio < minimumContrastRatio) {
+      allFindings.push(`text "${text.slice(0, snippetLength)}" has contrast ${ratio.toFixed(2)}:1 (${getComputedStyle(element).color} on rgb(${background.red}, ${background.green}, ${background.blue}))`);
+    }
+  }
+  return allFindings;
+}
+
+async function checkSignal(browser, pageHtml, darkSignal) {
+  const page = await browser.newPage({ colorScheme: darkSignal.colorScheme });
+  page.setDefaultTimeout(PAGE_LOAD_TIMEOUT_MILLISECONDS);
+  try {
+    await page.setContent(pageHtml, { waitUntil: "load", timeout: PAGE_LOAD_TIMEOUT_MILLISECONDS }).catch(() => undefined);
+    if (darkSignal.dataTheme) {
+      await page.evaluate((themeName) => document.documentElement.setAttribute("data-theme", themeName), darkSignal.dataTheme);
+    }
+    const allFindings = await page.evaluate(measurePage, [MAXIMUM_DARK_PAGE_LUMINANCE, MINIMUM_CONTRAST_RATIO, TEXT_SNIPPET_LENGTH]);
+    return allFindings;
+  } finally {
+    await page.close();
+  }
+}
+
+async function main() {
+  const pagePath = process.argv[2];
+  const pageHtml = fs.readFileSync(pagePath, "utf8");
+  let playwright;
+  try {
+    playwright = loadPlaywright();
+  } catch (loadError) {
+    process.stderr.write("Playwright is not installed; run: npm install -g playwright && npx playwright install chromium\n");
+    return RENDERER_MISSING_EXIT_CODE;
+  }
+  let browser;
+  try {
+    browser = await playwright.chromium.launch();
+  } catch (launchError) {
+    process.stderr.write(`Chromium did not start for Playwright; run: npx playwright install chromium (${launchError.message.split("\n")[0]})\n`);
+    return RENDERER_MISSING_EXIT_CODE;
+  }
+  const report = {};
+  try {
+    for (const darkSignal of ALL_DARK_SIGNALS) {
+      const allFindings = await checkSignal(browser, pageHtml, darkSignal);
+      if (allFindings.length > 0) {
+        report[darkSignal.name] = allFindings.slice(0, MAXIMUM_REPORTED_TEXT_FAILURES + 1);
+      }
+    }
+  } finally {
+    await browser.close();
+  }
+  process.stdout.write(JSON.stringify(report));
+  return 0;
+}
+
+main().then((exitCode) => process.exit(exitCode));