linear-grab-bridge 0.24.1 → 0.25.1

package/linear-grab-bridge.mjs

@@ -13,11 +13,20 @@
  * Binds 127.0.0.1 only — never exposed to the network.
  */
 import { createServer } from 'node:http';
-import { spawn, execFile } from 'node:child_process';
+import { spawn, execFile, execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { createHash } from 'node:crypto';
-import { appendFileSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir, platform, tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 const argv = process.argv.slice(2);
@@ -28,7 +37,16 @@ const flag = (name, fallback) => {
 const PORT = Number(flag('--port', '4577'));
 const DIR = flag('--dir', process.cwd());
 const CLAUDE_BIN = flag('--claude', 'claude');
-const VERSION = '0.24.1';
+const VERSION = '0.25.1';
+
+// ---- audit subcommand dispatch ---------------------------------------------
+// `npx linear-grab-bridge audit` is a headless design gate — it sweeps a
+// running dev app route-by-route in Chromium (driven over raw CDP), runs the
+// slop-scan design-contract scan, writes a report, and exits nonzero when new
+// violations exceed the baseline. It must NEVER start the HTTP server below.
+// Guarded here, dispatched at the very bottom (after every const/fn is
+// initialized) so audit mode short-circuits the entire server module body.
+const AUDIT_MODE = argv[0] === 'audit';
 
 /** Best-effort command runner (git/gh introspection). Never throws. */
 function run(cmd, args, cwd = DIR) {
@@ -456,7 +474,7 @@ function sendMessage(task, text) {
 
 // ---- HTTP ------------------------------------------------------------------
 
-createServer(async (req, res) => {
+const server = createServer(async (req, res) => {
   try {
     if (req.method === 'OPTIONS') {
       res.writeHead(204, CORS);
@@ -915,7 +933,9 @@ createServer(async (req, res) => {
   } catch (err) {
     json(res, 500, { error: err instanceof Error ? err.message : String(err) });
   }
-}).listen(PORT, '127.0.0.1', () => {
+});
+if (!AUDIT_MODE)
+  server.listen(PORT, '127.0.0.1', () => {
   const B = '\x1b[1m';
   const D = '\x1b[2m';
   const C = '\x1b[36m';
@@ -942,3 +962,674 @@ createServer(async (req, res) => {
   console.log(`${D}──────────────────────────────────────────────────${R}`);
   loadHistory();
 });
+
+// ============================================================================
+// audit — headless, CI-able design gate (raw CDP, zero deps)
+// ============================================================================
+
+// Colored console helpers, matching the bridge banner style.
+const A = {
+  B: '\x1b[1m',
+  D: '\x1b[2m',
+  C: '\x1b[36m',
+  G: '\x1b[32m',
+  Y: '\x1b[33m',
+  Rd: '\x1b[31m',
+  R: '\x1b[0m',
+};
+const alog = (s) => console.log(s);
+const die = (msg) => {
+  console.error(`${A.Rd}audit: ${msg}${A.R}`);
+  process.exit(2);
+};
+
+/** Locate a Chromium-family browser. --chrome wins; else probe known paths. */
+function findBrowser() {
+  const explicit = flag('--chrome', null);
+  if (explicit) {
+    if (!existsSync(explicit)) die(`--chrome path does not exist: ${explicit}`);
+    return explicit;
+  }
+  const probed = [];
+  const os = platform();
+  if (os === 'darwin') {
+    const apps = [
+      'Google Chrome.app/Contents/MacOS/Google Chrome',
+      'Google Chrome Beta.app/Contents/MacOS/Google Chrome Beta',
+      'Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary',
+      'Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
+      'Brave Browser.app/Contents/MacOS/Brave Browser',
+      'Chromium.app/Contents/MacOS/Chromium',
+    ];
+    for (const app of apps) {
+      for (const root of ['/Applications', join(homedir(), 'Applications')]) {
+        const p = join(root, app);
+        probed.push(p);
+        if (existsSync(p)) return p;
+      }
+    }
+  } else if (os === 'linux') {
+    for (const name of ['google-chrome', 'chromium', 'chromium-browser', 'microsoft-edge']) {
+      probed.push(name);
+      const out = whichSync(name);
+      if (out) return out;
+    }
+  } else if (os === 'win32') {
+    const pf = process.env['PROGRAMFILES'] ?? 'C:\\Program Files';
+    const pf86 = process.env['PROGRAMFILES(X86)'] ?? 'C:\\Program Files (x86)';
+    const cands = [
+      join(pf, 'Google/Chrome/Application/chrome.exe'),
+      join(pf86, 'Google/Chrome/Application/chrome.exe'),
+      join(pf, 'Microsoft/Edge/Application/msedge.exe'),
+      join(pf86, 'Microsoft/Edge/Application/msedge.exe'),
+    ];
+    for (const p of cands) {
+      probed.push(p);
+      if (existsSync(p)) return p;
+    }
+  }
+  die(
+    `no Chrome/Edge/Brave/Chromium found. Probed:\n  ${probed.join('\n  ')}\nPass --chrome <path> to point at a browser binary.`,
+  );
+}
+
+/** Resolve a binary via `which` (linux). Synchronous, best-effort. */
+function whichSync(name) {
+  try {
+    return execFileSync('which', [name], { encoding: 'utf8' }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/** Poll for the CDP DevToolsActivePort file; return ws:// endpoint. */
+async function waitForEndpoint(tmp) {
+  const portFile = join(tmp, 'DevToolsActivePort');
+  for (let i = 0; i < 150; i++) {
+    if (existsSync(portFile)) {
+      const [port, path] = readFileSync(portFile, 'utf8').split('\n');
+      if (port && path) return `ws://127.0.0.1:${port.trim()}${path.trim()}`;
+    }
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  die('browser did not open a debugging port within 15s (DevToolsActivePort never appeared)');
+}
+
+/** Minimal promise-based CDP client over one WebSocket. */
+function makeCdp(ws) {
+  let nextId = 1;
+  const pending = new Map();
+  // event listeners keyed by sessionId ('' = browser) → Map<method, Set<fn>>
+  const listeners = new Map();
+  ws.addEventListener('message', (ev) => {
+    let msg;
+    try {
+      msg = JSON.parse(ev.data);
+    } catch {
+      return;
+    }
+    if (msg.id != null && pending.has(msg.id)) {
+      const { resolve, reject } = pending.get(msg.id);
+      pending.delete(msg.id);
+      if (msg.error) reject(new Error(msg.error.message ?? JSON.stringify(msg.error)));
+      else resolve(msg.result);
+      return;
+    }
+    if (msg.method) {
+      const sid = msg.sessionId ?? '';
+      const byMethod = listeners.get(sid);
+      const set = byMethod?.get(msg.method);
+      if (set) for (const fn of [...set]) fn(msg.params ?? {});
+    }
+  });
+  const send = (method, params = {}, sessionId) =>
+    new Promise((resolve, reject) => {
+      const id = nextId++;
+      pending.set(id, { resolve, reject });
+      ws.send(JSON.stringify({ id, method, params, ...(sessionId ? { sessionId } : {}) }));
+    });
+  const on = (method, sessionId, fn) => {
+    const sid = sessionId ?? '';
+    if (!listeners.has(sid)) listeners.set(sid, new Map());
+    const byMethod = listeners.get(sid);
+    if (!byMethod.has(method)) byMethod.set(method, new Set());
+    byMethod.get(method).add(fn);
+    return () => byMethod.get(method)?.delete(fn);
+  };
+  /** Resolve on the next matching event, or reject after ms. */
+  const once = (method, sessionId, ms) =>
+    new Promise((resolve, reject) => {
+      const off = on(method, sessionId, (p) => {
+        off();
+        clearTimeout(t);
+        resolve(p);
+      });
+      const t = setTimeout(() => {
+        off();
+        reject(new Error(`timeout waiting for ${method}`));
+      }, ms);
+    });
+  return { send, on, once };
+}
+
+/** Read the slop-scan bundle once: local file next to the bridge, else CDN. */
+async function loadBundleSource() {
+  const local = new URL('./slop-scan.global.js', import.meta.url);
+  try {
+    return readFileSync(local, 'utf8');
+  } catch {
+    /* fall through to CDN */
+  }
+  try {
+    const res = await fetch('https://cdn.jsdelivr.net/npm/linear-grab@latest/dist/slop-scan.global.js');
+    if (!res.ok) throw new Error(`CDN ${res.status}`);
+    return await res.text();
+  } catch (e) {
+    die(
+      `could not load the slop-scan bundle. Looked for ${local.pathname} and the jsDelivr CDN fallback (${e instanceof Error ? e.message : e}).`,
+    );
+  }
+}
+
+/** The audit itself. Returns the process exit code. */
+async function runAudit() {
+  if (typeof WebSocket === 'undefined') {
+    die(`audit needs Node 22+ (built-in WebSocket); you have ${process.version}`);
+  }
+
+  const url = flag('--url', 'http://localhost:3000').replace(/\/+$/, '');
+  const themeFlag = flag('--theme', 'both');
+  const themes = themeFlag === 'both' ? ['light', 'dark'] : [themeFlag];
+  const [vw, vh] = flag('--viewport', '1440x900')
+    .split('x')
+    .map((n) => Number(n) || 0);
+  const settleMs = Number(flag('--wait', '1500'));
+  const pageTimeout = Number(flag('--timeout', '30000'));
+  const failOn = flag('--fail-on', 'error'); // error | warn | none
+  const updateBaseline = argv.includes('--update-baseline');
+  const auditDir = join(DIR, '.lineargrab');
+  const outPath = flag('--out', join(auditDir, 'slop-report.md'));
+  const baselinePath = join(auditDir, 'slop-baseline.json');
+  const ndjsonPath = join(auditDir, 'scan.ndjson');
+
+  // Routes: --routes, else auditRoutes in <DIR>/.lineargrab.json, else ['/'].
+  let routes = flag('--routes', null)
+    ?.split(',')
+    .map((r) => r.trim())
+    .filter(Boolean);
+  if (!routes || !routes.length) {
+    try {
+      const cfg = JSON.parse(readFileSync(join(DIR, '.lineargrab.json'), 'utf8'));
+      if (Array.isArray(cfg.auditRoutes) && cfg.auditRoutes.length) routes = cfg.auditRoutes;
+    } catch {
+      /* no config */
+    }
+  }
+  if (!routes || !routes.length) routes = ['/'];
+
+  const BUNDLE_SOURCE = await loadBundleSource();
+  const bin = findBrowser();
+
+  // Auth: headless Chromium has no session — auth-gated routes would grade
+  // the login page. `audit --login` opens a VISIBLE browser on a persistent
+  // per-repo profile; sign in once, press Enter, and every later audit
+  // reuses that profile (auto-detected). --fresh forces a clean throwaway.
+  const defaultProfile = join(
+    HISTORY_DIR,
+    `audit-profile-${createHash('sha1').update(DIR).digest('hex').slice(0, 8)}`,
+  );
+  const explicitProfile = flag('--profile', null);
+  const loginMode = argv.includes('--login');
+  const fresh = argv.includes('--fresh');
+  const persistentProfile =
+    explicitProfile ?? (!fresh && (loginMode || existsSync(defaultProfile)) ? defaultProfile : null);
+
+  if (loginMode) {
+    const profile = persistentProfile ?? defaultProfile;
+    mkdirSync(profile, { recursive: true });
+    alog('');
+    alog(`${A.B}◆ linear-grab audit --login${A.R}`);
+    alog(`  A browser window is opening on ${A.C}${url}${A.R}.`);
+    alog(`  Sign in there, then come back and press ${A.B}Enter${A.R} to save the session.`);
+    alog(`  ${A.D}profile: ${profile}${A.R}`);
+    const loginChild = spawn(
+      bin,
+      [`--user-data-dir=${profile}`, '--no-first-run', '--no-default-browser-check', url],
+      { stdio: 'ignore', detached: false },
+    );
+    await new Promise((resolve) => process.stdin.once('data', resolve));
+    try {
+      loginChild.kill('SIGTERM');
+    } catch {
+      /* already closed by the user */
+    }
+    alog(`${A.G}✓${A.R} session saved — future ${A.C}audit${A.R} runs use it automatically.`);
+    return 0;
+  }
+
+  alog('');
+  alog(`${A.B}◆ linear-grab audit${A.R} ${A.D}v${VERSION}${A.R}`);
+  alog(`${A.D}──────────────────────────────────────────────────${A.R}`);
+  alog(`  url      ${A.C}${url}${A.R}`);
+  alog(`  routes   ${A.C}${routes.length}${A.R} ${A.D}${routes.join(', ')}${A.R}`);
+  alog(`  themes   ${A.C}${themes.join(', ')}${A.R}`);
+  alog(`  browser  ${A.C}${bin}${A.R}`);
+  if (persistentProfile) alog(`  profile  ${A.C}${persistentProfile}${A.R} ${A.D}(signed-in session)${A.R}`);
+  alog(`${A.D}──────────────────────────────────────────────────${A.R}`);
+
+  const tmp = persistentProfile ?? mkdtempSync(join(tmpdir(), 'lg-audit-'));
+  let child = null;
+  let ws = null;
+  const cleanup = () => {
+    try {
+      if (child && !child.killed) {
+        child.kill('SIGTERM');
+        const c = child;
+        setTimeout(() => {
+          try {
+            c.kill('SIGKILL');
+          } catch {
+            /* gone */
+          }
+        }, 2000).unref?.();
+      }
+    } catch {
+      /* ignore */
+    }
+    try {
+      // Ephemeral profiles only — a signed-in persistent profile is the
+      // user's saved session and must survive the run.
+      if (!persistentProfile) rmSync(tmp, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  };
+  const onSigint = () => {
+    cleanup();
+    process.exit(130);
+  };
+  process.on('SIGINT', onSigint);
+
+  /** @type {Array<any>} */
+  const allFindings = [];
+  const failedRoutes = [];
+
+  try {
+    // A reused profile keeps the previous run's DevToolsActivePort — remove
+    // it so waitForEndpoint can't connect to a dead port.
+    try {
+      rmSync(join(tmp, 'DevToolsActivePort'), { force: true });
+    } catch {
+      /* fresh profile */
+    }
+    child = spawn(
+      bin,
+      [
+        '--headless=new',
+        '--remote-debugging-port=0',
+        `--user-data-dir=${tmp}`,
+        '--no-first-run',
+        '--no-default-browser-check',
+        '--disable-extensions',
+        '--hide-scrollbars',
+        'about:blank',
+      ],
+      { stdio: 'ignore' },
+    );
+    child.on('error', (e) => die(`failed to launch browser: ${e.message}`));
+
+    const endpoint = await waitForEndpoint(tmp);
+    ws = new WebSocket(endpoint);
+    await new Promise((resolve, reject) => {
+      ws.addEventListener('open', resolve, { once: true });
+      ws.addEventListener('error', () => reject(new Error('WebSocket error')), { once: true });
+    });
+    const cdp = makeCdp(ws);
+
+    // One reusable page target for the whole sweep.
+    const { targetId } = await cdp.send('Target.createTarget', { url: 'about:blank' });
+    const { sessionId } = await cdp.send('Target.attachToTarget', { targetId, flatten: true });
+    await cdp.send('Page.enable', {}, sessionId);
+    await cdp.send('Runtime.enable', {}, sessionId);
+    await cdp.send(
+      'Emulation.setDeviceMetricsOverride',
+      { width: vw, height: vh, deviceScaleFactor: 1, mobile: false },
+      sessionId,
+    );
+
+    for (const route of routes) {
+      const target = url + route;
+      // Collect per-theme findings so we can dedupe across the two themes.
+      /** @type {Map<string, any>} */
+      const routeMap = new Map();
+
+      for (const theme of themes) {
+        const started = Date.now();
+        await cdp.send(
+          'Emulation.setEmulatedMedia',
+          { features: [{ name: 'prefers-color-scheme', value: theme }] },
+          sessionId,
+        );
+
+        const loaded = cdp.once('Page.loadEventFired', sessionId, pageTimeout).then(
+          () => true,
+          () => false,
+        );
+        await cdp.send('Page.navigate', { url: target }, sessionId);
+        if (!(await loaded)) {
+          failedRoutes.push({ route, theme, reason: `load timeout (>${pageTimeout}ms)` });
+          alog(`  ${A.Rd}✗${A.R} ${padRoute(route)} ${padTheme(theme)} ${A.D}load timeout${A.R}`);
+          continue;
+        }
+        await new Promise((r) => setTimeout(r, settleMs));
+
+        // Inject the scan bundle.
+        const inj = await cdp.send(
+          'Runtime.evaluate',
+          { expression: BUNDLE_SOURCE, returnByValue: false },
+          sessionId,
+        );
+        if (inj.exceptionDetails) {
+          const reason = inj.exceptionDetails.exception?.description ?? 'inject failed';
+          failedRoutes.push({ route, theme, reason });
+          alog(`  ${A.Rd}✗${A.R} ${padRoute(route)} ${padTheme(theme)} ${A.D}${reason.slice(0, 60)}${A.R}`);
+          continue;
+        }
+
+        // Lazy content mounts on scroll (marketing sections, consent banners,
+        // virtualized lists) — sweep to the bottom and back so the DOM we
+        // grade is the DOM users actually see, not a timing accident.
+        await cdp.send(
+          'Runtime.evaluate',
+          {
+            expression: `(async () => {
+              const d = document.scrollingElement || document.documentElement;
+              const step = Math.max(400, innerHeight * 0.8);
+              for (let y = 0; y < d.scrollHeight && y < 20000; y += step) {
+                scrollTo(0, y);
+                await new Promise((r) => setTimeout(r, 120));
+              }
+              scrollTo(0, 0);
+              await new Promise((r) => setTimeout(r, 400));
+            })()`,
+            awaitPromise: true,
+            returnByValue: false,
+          },
+          sessionId,
+        );
+
+        // Run it — until two consecutive scans agree. Dynamic pages settle
+        // over a second or two; a single-shot scan makes the baseline flaky
+        // ("9 new findings" on an unchanged page = the gate crying wolf).
+        let findings = null;
+        let scanFailed = null;
+        for (let attempt = 0; attempt < 3; attempt++) {
+          const evalRes = await cdp.send(
+            'Runtime.evaluate',
+            {
+              // Attributed run resolves Component @ file:line via the page's
+              // own react-grab (loaded by linear-grab's script tag); falls
+              // back to the sync scan on older bundles.
+              expression:
+                '__SLOP_SCAN__.runAttributed ? __SLOP_SCAN__.runAttributed() : __SLOP_SCAN__.run()',
+              awaitPromise: true,
+              returnByValue: true,
+            },
+            sessionId,
+          );
+          if (evalRes.exceptionDetails) {
+            scanFailed = evalRes.exceptionDetails.exception?.description ?? 'scan threw';
+            break;
+          }
+          const next = Array.isArray(evalRes.result?.value) ? evalRes.result.value : [];
+          if (findings && next.length === findings.length) {
+            findings = next;
+            break;
+          }
+          findings = next;
+          await new Promise((r) => setTimeout(r, 600));
+        }
+        if (scanFailed) {
+          failedRoutes.push({ route, theme, reason: scanFailed });
+          alog(`  ${A.Rd}✗${A.R} ${padRoute(route)} ${padTheme(theme)} ${A.D}${scanFailed.slice(0, 60)}${A.R}`);
+          continue;
+        }
+        findings ??= [];
+
+        // Dedupe across themes within this route.
+        for (const f of findings) {
+          const key = `${f.ruleId}|${f.selector}|${f.evidence}`;
+          const existing = routeMap.get(key);
+          if (existing) {
+            if (!existing.themes.includes(theme)) existing.themes.push(theme);
+          } else {
+            routeMap.set(key, { ...f, route, themes: [theme] });
+          }
+        }
+
+        const errs = findings.filter((f) => f.severity === 'error').length;
+        const warns = findings.filter((f) => f.severity === 'warn').length;
+        alog(
+          `  ${A.G}✓${A.R} ${padRoute(route)} ${padTheme(theme)} ` +
+            `${String(errs).padStart(4)} ${A.D}errors${A.R}  ${String(warns).padStart(3)} ${A.D}warns${A.R} ` +
+            `${A.D}${Date.now() - started}ms${A.R}`,
+        );
+      }
+      for (const f of routeMap.values()) allFindings.push(f);
+    }
+  } finally {
+    try {
+      ws?.close();
+    } catch {
+      /* ignore */
+    }
+    process.off('SIGINT', onSigint);
+    cleanup();
+  }
+
+  // ---- baseline ------------------------------------------------------------
+  const bkey = (f) => `${f.ruleId}|${f.route}|${f.selector}`;
+  const currentKeys = [...new Set(allFindings.map(bkey))];
+
+  bootstrapAuditDir(auditDir);
+
+  if (updateBaseline) {
+    writeFileSync(
+      baselinePath,
+      JSON.stringify({ createdAt: new Date().toISOString(), keys: currentKeys }, null, 2),
+    );
+    alog('');
+    alog(`${A.G}✓${A.R} baseline updated — ${A.B}${currentKeys.length}${A.R} keys recorded`);
+    alog(`  ${A.D}${baselinePath}${A.R}`);
+    // Still write the report + ndjson so the artifacts stay in sync.
+    for (const f of allFindings) f.isNew = false;
+    writeReportAndNdjson(allFindings, {
+      url,
+      routes,
+      themes,
+      outPath,
+      ndjsonPath,
+      newCount: 0,
+    });
+    return 0;
+  }
+
+  let baselineKeys = null;
+  let hasBaseline = false;
+  try {
+    baselineKeys = new Set(JSON.parse(readFileSync(baselinePath, 'utf8')).keys ?? []);
+    hasBaseline = true;
+  } catch {
+    /* no baseline yet */
+  }
+
+  for (const f of allFindings) f.isNew = hasBaseline ? !baselineKeys.has(bkey(f)) : true;
+  const newFindings = allFindings.filter((f) => f.isNew);
+
+  // ---- write artifacts -----------------------------------------------------
+  const totalErr = allFindings.filter((f) => f.severity === 'error').length;
+  const totalWarn = allFindings.filter((f) => f.severity === 'warn').length;
+  writeReportAndNdjson(allFindings, {
+    url,
+    routes,
+    themes,
+    outPath,
+    ndjsonPath,
+    newCount: newFindings.length,
+  });
+
+  // ---- exit decision -------------------------------------------------------
+  const gate =
+    failOn === 'none'
+      ? []
+      : failOn === 'warn'
+        ? newFindings.filter((f) => f.severity === 'error' || f.severity === 'warn')
+        : newFindings.filter((f) => f.severity === 'error');
+  const willFail = gate.length > 0;
+
+  alog('');
+  alog(`${A.D}──────────────────────────────────────────────────${A.R}`);
+  alog(
+    `  ${A.B}totals${A.R}  ${totalErr} errors  ${totalWarn} warns  ` +
+      `across ${routes.length} route(s) × ${themes.length} theme(s)`,
+  );
+  if (failedRoutes.length) {
+    alog(`  ${A.Y}${failedRoutes.length} route-theme sweep(s) failed${A.R} ${A.D}(see ✗ above)${A.R}`);
+  }
+  if (!hasBaseline) {
+    alog(
+      `  ${A.Y}no baseline${A.R} — all ${newFindings.length} findings count as NEW. ` +
+        `Run ${A.C}--update-baseline${A.R} to create the ratchet.`,
+    );
+  } else {
+    alog(`  ${A.B}new vs baseline${A.R}  ${newFindings.length} findings`);
+  }
+  alog(`  report  ${A.C}${outPath}${A.R}`);
+  if (willFail) {
+    alog(
+      `  ${A.Rd}${A.B}FAIL${A.R} — ${gate.length} new ${failOn === 'warn' ? 'error/warn' : 'error'}-severity finding(s) (fail-on=${failOn})`,
+    );
+  } else {
+    alog(`  ${A.G}${A.B}PASS${A.R} — 0 new findings at/above fail-on=${failOn}`);
+  }
+  alog(`${A.D}──────────────────────────────────────────────────${A.R}`);
+  return willFail ? 1 : 0;
+}
+
+const padRoute = (r) => r.slice(0, 24).padEnd(24);
+const padTheme = (t) => t.padEnd(5);
+
+/** Bootstrap the .lineargrab dir + self-gitignore (mirrors /scan/events). */
+function bootstrapAuditDir(dir) {
+  try {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, '.gitignore'), '*\n', { flag: 'wx' });
+  } catch {
+    /* exists */
+  }
+}
+
+/** Append audit findings to scan.ndjson with the same rotation as telemetry. */
+function appendNdjson(file, findings) {
+  const lines =
+    findings
+      .slice(0, 5000)
+      .map((f) =>
+        JSON.stringify({
+          kind: 'slop-scan',
+          mode: 'headless',
+          route: f.route,
+          themes: f.themes,
+          at: Date.now(),
+          ruleId: f.ruleId,
+          part: f.part,
+          severity: f.severity,
+          description: f.description,
+          selector: f.selector,
+          evidence: f.evidence,
+          component: f.component ?? null,
+          source: f.source ?? null,
+          isNew: !!f.isNew,
+        }),
+      )
+      .join('\n') + '\n';
+  try {
+    appendFileSync(file, lines);
+    const size = statSync(file).size;
+    if (size > 2_000_000) {
+      const keep = readFileSync(file, 'utf8');
+      writeFileSync(file, keep.slice(Math.floor(keep.length / 2)).replace(/^[^\n]*\n/, ''));
+    }
+  } catch {
+    /* disk issues — never fail the audit on telemetry */
+  }
+}
+
+/** Write the markdown report + append NDJSON events. */
+function writeReportAndNdjson(findings, { url, routes, themes, outPath, ndjsonPath, newCount }) {
+  const totalErr = findings.filter((f) => f.severity === 'error').length;
+  const totalWarn = findings.filter((f) => f.severity === 'warn').length;
+
+  const lines = [
+    '# Design slop-scan report',
+    '',
+    `- **url**: ${url}`,
+    `- **routes**: ${routes.length} (${routes.join(', ')})`,
+    `- **themes**: ${themes.join(', ')}`,
+    `- **totals**: ${totalErr} errors / ${totalWarn} warns`,
+    `- **new vs baseline**: ${newCount}`,
+    `- **generated**: ${new Date().toISOString()}`,
+    '',
+  ];
+
+  // Group by route → rule. Errors first, then by count desc.
+  const byRoute = new Map();
+  for (const f of findings) {
+    if (!byRoute.has(f.route)) byRoute.set(f.route, []);
+    byRoute.get(f.route).push(f);
+  }
+  for (const route of routes) {
+    const rf = byRoute.get(route);
+    if (!rf || !rf.length) continue;
+    lines.push(`## ${route}`, '');
+    const byRule = new Map();
+    for (const f of rf) {
+      if (!byRule.has(f.ruleId)) byRule.set(f.ruleId, []);
+      byRule.get(f.ruleId).push(f);
+    }
+    const rules = [...byRule.entries()].sort((a, b) => {
+      const sev = (list) => (list.some((x) => x.severity === 'error') ? 0 : 1);
+      return sev(a[1]) - sev(b[1]) || b[1].length - a[1].length;
+    });
+    for (const [ruleId, list] of rules) {
+      const head = list[0];
+      const sevBadge = head.severity === 'error' ? 'error' : 'warn';
+      lines.push(
+        `### ${ruleId} \`(${sevBadge})\`${head.part ? ` §${head.part}` : ''}`,
+        head.description ? `${head.description}` : '',
+        '',
+      );
+      for (const f of list) {
+        const where = f.component || f.source ? ` — ${[f.component, f.source].filter(Boolean).join(' @ ')}` : '';
+        lines.push(
+          `- \`${f.selector}\` — ${f.evidence}${where} [${f.themes.join('/')}]${f.isNew ? ' **NEW**' : ''}`,
+        );
+      }
+      lines.push('');
+    }
+  }
+
+  try {
+    mkdirSync(join(outPath, '..'), { recursive: true });
+  } catch {
+    /* ignore */
+  }
+  writeFileSync(outPath, lines.join('\n'));
+  appendNdjson(ndjsonPath, findings);
+}
+
+// Dispatch audit LAST — every const/fn above is now initialized, so no TDZ.
+if (AUDIT_MODE) {
+  const code = await runAudit();
+  process.exit(code);
+}

package/package.json

@@ -1,18 +1,26 @@
 {
   "name": "linear-grab-bridge",
-  "version": "0.24.1",
+  "version": "0.25.1",
   "description": "Local bridge for Linear Grab — delegate issues from the browser panel to headless Claude Code sessions running in your repo, with live status and an upload relay.",
   "type": "module",
   "bin": {
     "linear-grab-bridge": "./linear-grab-bridge.mjs"
   },
   "files": [
-    "linear-grab-bridge.mjs"
+    "linear-grab-bridge.mjs",
+    "slop-scan.global.js"
   ],
   "engines": {
     "node": ">=18"
   },
-  "keywords": ["linear", "claude-code", "cursor", "agent", "bridge", "linear-grab"],
+  "keywords": [
+    "linear",
+    "claude-code",
+    "cursor",
+    "agent",
+    "bridge",
+    "linear-grab"
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ahmedbanihanibh/linear-grab.git"

package/slop-scan.global.js

@@ -0,0 +1,3 @@
+(function(){function e(e){return e.split(`,`).map(e=>{let t=e.trim();return t.endsWith(`ms`)?parseFloat(t)||0:t.endsWith(`s`)?(parseFloat(t)||0)*1e3:0})}var t=new Set(`width.height.min-width.min-height.max-width.max-height.top.left.right.bottom.inset.margin.margin-top.margin-right.margin-bottom.margin-left.padding.padding-top.padding-right.padding-bottom.padding-left.font-size.line-height.letter-spacing.box-shadow.filter.background-position.grid-template-columns.grid-template-rows.flex-basis.gap`.split(`.`));function n(e){return e.includes(`all`)?[`all (includes layout/paint props)`]:e.filter(e=>t.has(e))}function r(e){let t=i(e);if(t===`ease-in`||t===`ease-in-out`)return t;let n=t.match(/cubic-bezier\(\s*([\d.]+)\s*,\s*(-?[\d.]+)/);if(n){let e=parseFloat(n[1]),r=parseFloat(n[2]);if(e>=.4&&r<e/2)return t}return null}function i(e){let t=0;for(let n=0;n<e.length;n++){let r=e[n];if(r===`(`)t++;else if(r===`)`)t--;else if(r===`,`&&t===0)return e.slice(0,n).trim()}return e.trim()}var a=`[data-slot*="content"], [role="menu"], [role="dialog"], [role="listbox"]`,o=new Set([`width`,`height`,`flex-basis`,`grid-template-columns`,`grid-template-rows`,`grid-template-areas`]);function s(e,t){if(e instanceof SVGElement)return!0;try{if(e.closest(`svg`))return!0}catch{}try{if(e.closest(a))return!0}catch{}try{if(e.closest(`[data-panel]`))return!t||t.length===0||t.every(e=>o.has(e))}catch{}return!1}function c(e){let t=e.id?`#${e.id}`:``,n=typeof e.className==`string`&&e.className?`.${e.className.split(/\s+/).filter(Boolean).slice(0,2).join(`.`)}`:``;return`${e.tagName.toLowerCase()}${t}${n}`}function l(e,t,n){return{ruleId:e.id,part:e.part,severity:e.severity,description:e.description,selector:c(t),evidence:n,el:typeof WeakRef<`u`?new WeakRef(t):void 0}}function u(e){return e.getBoundingClientRect()}function d(e){return e.split(`/`)[0].trim().split(/\s+/).filter(Boolean).map(e=>e.endsWith(`px`)?parseFloat(e):NaN)}function f(e){let t=e.match(/rgba?\(([^)]+)\)/);return t?t[1].split(`,`).map(e=>e.trim()).join(`,`):null}function p(e,t){let n=t,r=n.maskImage||n.webkitMaskImage||``;if(r&&r!==`none`)return r;let i=(e.getAttribute(`style`)??``).match(/(?:^|;|\s)(?:-webkit-)?mask-image\s*:\s*([^;]+)/i);return i&&i[1].trim()&&i[1].trim()!==`none`?i[1].trim():``}var m=new Set([0,8,12,16]),h={light:f(`rgb(240, 240, 241)`),dark:f(`rgb(35, 35, 37)`)},g=new Set([`#50e3c2`,`#ee0000`,`#f5a623`]),_=`button, a, [role="button"], [role="tab"], [role="menuitem"], [role="option"], input, textarea, select`;function v(e){let t=[],n=e=>{for(let r of Array.from(e)){let e=r;if(e.cssRules&&e.cssRules.length){n(e.cssRules);continue}let i=r.selectorText;i&&i.includes(`:hover`)&&t.push(i.replace(/:hover/g,``))}};for(let t of Array.from(e.styleSheets))try{n(t.cssRules)}catch{}return t}function y(e,t){for(let n of t)if(n.trim())try{if(e.matches(n))return!0}catch{}return!1}function b(e){return!e.matches(`button, [role="button"]`)||e.querySelectorAll(`svg`).length===0?!1:(e.textContent??``).trim().length===0}function x(e){let t=e.parentElement;for(;t;){try{let e=S(t).overflowY;if(e===`auto`||e===`scroll`)return t}catch{}t=t.parentElement}return null}var S=e=>getComputedStyle(e),C={id:`radius-vocabulary`,part:`§40`,severity:`error`,description:`§40: radius vocabulary is {8, 12, 16, full} — never rounded-md/[4px]/[6px]/[10px]. Off-vocabulary radius.`,check(e){let t=[];for(let n of e.els){let r=e.css(n).borderRadius;if(!r||r===`0px`)continue;let i=d(r);if(i.some(e=>Number.isNaN(e)))continue;let a=Math.max(...i);if(a===0)continue;let o=u(n),s=Math.min(o.width||0,o.height||0);s>0&&a>=s/2-.5||i.every(e=>m.has(e))||t.push(l(this,n,`border-radius: ${r}`))}return t}},w={id:`row-radius-token`,part:`§40`,severity:`error`,description:`§40: list rows consume --row-radius (8px) or 0 — no bespoke per-surface row radius.`,check(e){let t=[];for(let n of e.els){let r=u(n).height;if(r<26||r>50||!x(n))continue;let i=n.parentElement;if(!i||Array.from(i.children).filter(e=>{let t=u(e);return Math.abs(t.height-r)<2}).length<3)continue;let a=d(e.css(n).borderRadius);if(a.some(e=>Number.isNaN(e)))continue;let o=Math.max(0,...a);o===0||o===8||t.push(l(this,n,`row radius ${e.css(n).borderRadius} (want 0 or var(--row-radius)=8px)`))}return t}},T={id:`active-fill-token`,part:`§11`,severity:`error`,description:`§11: active/selected fill must be var(--selected) (theme-safe) — never bg-secondary (#F0F0F1 / #232325).`,check(e){let t=[],n=null;try{let t=e.root.documentElement??document.documentElement;t&&(n=f(e.css(t).getPropertyValue(`--selected`).trim()))}catch{}let r=[h.light,h.dark].filter(Boolean);if(n&&r.includes(n)){let t=e.root.documentElement??document.documentElement;return[l({id:this.id,part:this.part,severity:`warn`,description:`§11: active-fill-token unverifiable — --selected resolves EQUAL to bg-secondary this theme; cannot distinguish the token from the anti-pattern.`},t??e.els[0],`--selected == bg-secondary (${n})`)]}for(let n of e.els){if(!(n.matches(`[role="tab"], [role="button"], [aria-selected], [role="option"]`)||n.closest(`[role="tablist"], [role="menu"], [data-rail], nav`)))continue;let i=f(e.css(n).backgroundColor);i&&r.includes(i)&&t.push(l(this,n,`background bg-secondary (${e.css(n).backgroundColor}) — use var(--selected)`))}return t}},E={id:`inline-style-state`,part:`§40`,severity:`error`,description:`§40: the shared row-action class owns ALL visual states; inline styles carry LAYOUT ONLY — an inline background/color kills the class state.`,check(e){let t=[];for(let n of e.els){let e=typeof n.className==`string`?n.className:``;if(!/pb-row-action|row-action/.test(e))continue;let r=n.getAttribute(`style`)??``;/(^|;|\s)(background|color)\s*:/.test(r)&&t.push(l(this,n,`inline style="${r}" on a row-action element`))}return t}},D={id:`icon-button-no-hover`,part:`§40`,severity:`warn`,description:`§40/Part 10: every interactive control changes color on hover — icon-only button with no :hover rule and no .pb-row-action.`,check(e){let t=[],n=v(e.root.styleSheets?e.root:document);for(let r of e.els){if(!b(r))continue;let i=typeof r.className==`string`?r.className:``;/pb-row-action|row-action/.test(i)||r.hasAttribute(`data-framer-appear-id`)||Array.from(r.attributes).some(e=>e.name.startsWith(`data-framer`))||e.css(r).willChange.includes(`transform`)||y(r,n)||t.push(l(this,r,`icon-only ${r.tagName.toLowerCase()} with no hover rule / .pb-row-action`))}return t}},O={id:`icon-button-no-tooltip`,part:`§7`,severity:`warn`,description:`§7: every icon-only button gets the shared Tooltip — needs aria-describedby / data-slot="tooltip-trigger" (menu-row title exempt).`,check(e){let t=[];for(let n of e.els)b(n)&&(n.hasAttribute(`aria-describedby`)||n.getAttribute(`data-slot`)===`tooltip-trigger`||n.closest(`[data-slot="tooltip-trigger"]`)||n.closest(`[role="menuitem"]`)&&n.hasAttribute(`title`)||t.push(l(this,n,`icon-only ${n.tagName.toLowerCase()} with no tooltip trigger / aria-describedby`)));return t}},k={id:`unvirtualized-scroller`,part:`§0`,severity:`error`,description:`§0: every dynamic-length scrolling list virtualizes — a tall scroller with 60+ direct children is unvirtualized.`,check(e){let t=[];for(let n of e.els){let r=e.css(n);if(![r.overflowY,r.overflowX,r.overflow].some(e=>e===`auto`||e===`scroll`)||n.scrollHeight<=2*n.clientHeight)continue;let i=n.children.length;i<=60||t.push(l(this,n,`${i} direct children, scrollHeight ${n.scrollHeight} > 2×clientHeight ${n.clientHeight}`))}return t}},A={id:`scroll-no-fade`,part:`§1`,severity:`warn`,description:`§1: a horizontal scroller needs a truthful scroll fade — no scroll-fade-x/scroll-fade-x-js class and no mask-image.`,check(e){let t=[];for(let n of e.els){if(n.scrollWidth<=n.clientWidth+8)continue;let r=typeof n.className==`string`?n.className:``;/scroll-fade-x(-js)?/.test(r)||p(n,e.css(n))||t.push(l(this,n,`horizontal scroller (scrollWidth ${n.scrollWidth} > clientWidth ${n.clientWidth}) with no fade`))}return t}},j={id:`phantom-fade`,part:`§1`,severity:`warn`,description:`§1: a fade must NEVER paint when nothing is hidden — mask-image present but scrollWidth ≤ clientWidth (the fade lies).`,check(e){let t=[];for(let n of e.els)p(n,e.css(n))&&(n.scrollWidth>n.clientWidth||t.push(l(this,n,`mask-image fade but scrollWidth ${n.scrollWidth} ≤ clientWidth ${n.clientWidth}`)));return t}},M={id:`scrollbar-flush`,part:`Part 5`,severity:`warn`,description:`Part 5: scrollables carry asymmetric right padding so content clears the scrollbar — padding-right < 8px while overflowing vertically with content reaching the right edge.`,check(e){let t=[];for(let n of e.els){let r=e.css(n);if(![r.overflowY,r.overflow].some(e=>e===`auto`||e===`scroll`)||n.scrollHeight<=n.clientHeight)continue;let i=parseFloat(r.paddingRight)||0;if(i>=8)continue;let a=u(n);Array.from(n.children).some(e=>{let t=u(e);return a.right-t.right<=4})&&t.push(l(this,n,`padding-right ${i}px (<8px) with content flush to the scrollbar`))}return t}},N=/^("?(Geist|Geist Mono)"?|ui-monospace|ui-sans-serif|-apple-system|system-ui)/i,P={id:`font-family`,part:`Part 5`,severity:`warn`,description:`Part 5: Geist / Geist Mono ONLY — computed font-family does not start with the Geist / ui-monospace fallback chain.`,check(e){let t=[];for(let n of e.els){if(!q(n))continue;let r=e.css(n).fontFamily;r&&(N.test(r.trim())||t.push(l(this,n,`font-family: ${r}`)))}return t}},F={id:`uppercase-label`,part:`§25`,severity:`error`,description:`§25: group/section labels are sentence-case — never uppercase (text-transform: uppercase on small <13px text).`,check(e){let t=[];for(let n of e.els){if(!q(n))continue;let r=e.css(n);r.textTransform===`uppercase`&&((parseFloat(r.fontSize)||0)>=13||t.push(l(this,n,`text-transform: uppercase at ${r.fontSize}`)))}return t}},I={id:`hardcoded-status-hex`,part:`Part 5`,severity:`warn`,description:`Part 5: raw hex only for the status trio (#50E3C2/#EE0000/#F5A623) — a saturated non-token color on small UI text.`,check(e){let t=[];for(let n of e.els){if(!q(n))continue;let r=(n.getAttribute(`style`)??``).match(/#[0-9a-fA-F]{6}/g)??[],i=e.css(n);if((parseFloat(i.fontSize)||0)>=16)continue;for(let e of r)g.has(e.toLowerCase())||t.push(l(this,n,`hardcoded ${e} (not the brand status trio)`));let a=f(i.color);if(a&&r.length===0){let[e,r,o]=a.split(`,`).map(e=>parseFloat(e));Number.isFinite(e)&&J(e,r,o)&&t.push(l(this,n,`saturated non-token color ${i.color} on small UI text`))}}return t}},L={id:`editor-shadow`,part:`Part 5`,severity:`error`,description:`Part 5: editor surfaces are FLAT — box-shadow that is not a 0.5px hairline ring / approved popover/card/input token shadow.`,check(e){let t=[];if(!(e.root.querySelector?.(`[data-editor-surface]`)||typeof location<`u`&&/\/editor\//.test(location.pathname)))return t;for(let n of e.els){if(!n.closest(`[data-editor-surface]`)&&!/\/editor\//.test(typeof location<`u`?location.pathname:``))continue;let r=e.css(n).boxShadow;!r||r===`none`||Y(r)||t.push(l(this,n,`box-shadow: ${r}`))}return t}},R={id:`focusring-clip`,part:`§24`,severity:`warn`,description:`§24/Part 5: focus rings never clip — a focusable element whose nearest overflow-hidden ancestor sits <4px from its border box.`,check(e){let t=[];for(let n of e.els){if(!n.matches(_)&&n.getAttribute(`tabindex`)==null)continue;let r=n.parentElement;for(;r;){let t=e.css(r);if([t.overflow,t.overflowX,t.overflowY].some(e=>e===`hidden`))break;r=r.parentElement}if(!r)continue;let i=u(n),a=u(r);if(i.width===0&&i.height===0)continue;let o=Math.min(i.left-a.left,a.right-i.right,i.top-a.top,a.bottom-i.bottom);o>=4||t.push(l(this,n,`overflow-hidden ancestor ${o.toFixed(1)}px from border box — focus ring will clip`))}return t}},z={id:`fixed-width-in-pane`,part:`§24`,severity:`warn`,description:`§24: no fixed field widths in resizable panes — w-[Npx] (N ≥ 200) inside a [data-panel] / flex-basis sibling clips at the pane edge.`,check(e){let t=[];for(let n of e.els){if(!n.closest(`[data-panel]`))continue;let e=typeof n.className==`string`?n.className:``,r=n.getAttribute(`style`)??``,i=e.match(/w-\[(\d+)px\]/)??r.match(/(?:^|;|\s)width\s*:\s*(\d+)px/);if(!i)continue;let a=parseFloat(i[1]);a<200||t.push(l(this,n,`fixed width ${a}px inside a resizable pane — use w-full max-w-[${a}px]`))}return t}},B={id:`menu-icons-all-or-none`,part:`§21`,severity:`error`,description:`§21: within one menu ALL items carry a leading icon or NONE do — a mixed set reads broken.`,check(e){let t=[],n=Array.from(e.root.querySelectorAll(`[role="menu"]`));for(let e of n){let n=Array.from(e.querySelectorAll(`[role="menuitem"]`));if(n.length<2)continue;let r=n.filter(e=>e.querySelector(`svg`)).length;r===0||r===n.length||t.push(l(this,e,`${r}/${n.length} menu items have a leading icon`))}return t}},V={id:`menu-icon-mixed-weight`,part:`§21`,severity:`warn`,description:`§21: menu icons are ONE stroke family — some filled (fill=currentColor) and some stroke-based, or rendered sizes differing >2px, mixes two design systems.`,check(e){let t=[],n=Array.from(e.root.querySelectorAll(`[role="menu"]`));for(let e of n){let n=Array.from(e.querySelectorAll(`[role="menuitem"] svg`));if(n.length<2)continue;let r=0,i=0,a=[];for(let e of n){Array.from(e.querySelectorAll(`path, circle, rect, polygon`)).some(e=>{let t=(e.getAttribute(`fill`)??``).toLowerCase();return t===`currentcolor`||t&&t!==`none`})?r++:i++;let t=u(e);a.push(Math.max(t.width,t.height))}let o=Math.max(...a),s=Math.min(...a),c=r>0&&i>0,d=o>0&&o-s>2;!c&&!d||t.push(l(this,e,c?`${r} filled + ${i} stroke-based icons in one menu`:`icon sizes differ by ${(o-s).toFixed(1)}px`))}return t}},H={id:`chrome-selectable`,part:`Part 5`,severity:`warn`,description:`Part 5: chrome (rails/pills/tabs) is select-none — a rail/pill/tab without user-select:none.`,check(e){let t=[];for(let n of e.els){if(!(n.matches(`[role="tab"]`)||n.closest(`[role="tablist"], [data-rail], nav`)||/\bpill\b/.test(typeof n.className==`string`?n.className:``)))continue;let r=e.css(n).userSelect||e.css(n).webkitUserSelect;r!==`none`&&t.push(l(this,n,`chrome element without user-select:none (user-select: ${r||`auto`})`))}return t}},U={id:`cursor-mismatch`,part:`Part 5`,severity:`warn`,description:`Part 5: cursor semantics — buttons get pointer, static text gets default. A button with cursor:text, or static text with cursor:pointer and no interactive ancestor.`,check(e){let t=[];for(let n of e.els){let r=e.css(n).cursor;if(n.matches(`button, [role="button"]`)&&r===`text`){t.push(l(this,n,`interactive control with cursor:text`));continue}if(r===`pointer`&&n.matches(`p, h1, h2, h3, h4, h5, h6, span, label`)){if(n.closest(`button, a, [role="button"], [onclick]`)||n.matches(`button, a, [role="button"]`))continue;t.push(l(this,n,`static ${n.tagName.toLowerCase()} with cursor:pointer and no interactive ancestor`))}}return t}};function W(e){let t=e.transitionProperty.split(`,`).map(e=>e.trim()).filter(Boolean);return t.length===1&&t[0]===`none`?[]:t}var G=[C,w,T,E,D,O,k,A,j,M,P,F,I,L,R,z,B,V,H,U,{id:`transition-all`,part:`§42`,severity:`error`,description:`§42: never transition-all — scope to what changes (transition-colors / transition-[transform,...]).`,check(e){let t=[];for(let n of e.els){if(!n.matches(_))continue;let r=W(e.css(n));r.includes(`all`)&&(s(n,r)||t.push(l(this,n,`transition-property: all`)))}return t}},{id:`transition-paint-prop`,part:`§42`,severity:`error`,description:`§42: never transition layout/paint props (box-shadow, width, height, top/left, margin, padding) — they reflow/repaint every frame; focus rings SNAP, shadows animate a pseudo-element opacity.`,check(e){let t=[];for(let r of e.els){let i=W(e.css(r)),a=n(i).filter(e=>e!==`all (includes layout/paint props)`);a.length!==0&&(s(r,i)||t.push(l(this,r,`transitions layout/paint props: ${a.join(`, `)}`)))}return t}},{id:`transition-too-slow`,part:`§42`,severity:`error`,description:`§42: interaction feedback is ≤100ms (duration-75 for small controls) — the 100ms theme default is fine; an explicit duration-150+ crept in.`,check(t){let n=[];for(let r of t.els){if(!r.matches(_))continue;let i=t.css(r),a=W(i);if(a.length===0||s(r,a))continue;let o=e(i.transitionDuration),c=Math.max(0,...o);c<=100||n.push(l(this,r,`transition-duration ${c}ms (>100ms) on [${a.join(`, `)}]`))}return n}},{id:`ease-in-feedback`,part:`§42`,severity:`warn`,description:`§42: house curve is cubic-bezier(.2,0,.1,1) ease-out — never ease-in / ease-in-out (or an ease-in-shaped bezier) on feedback.`,check(e){let t=[];for(let n of e.els){if(!n.matches(_))continue;let i=e.css(n),a=W(i);if(a.length===0||s(n,a))continue;let o=r(i.transitionTimingFunction);o&&t.push(l(this,n,`transition-timing-function: ${o}`))}return t}},{id:`press-instant-rule-missing`,part:`§42`,severity:`error`,description:"§42: the global press-instant rule (globals.css) must exist — `button:active{transition-duration:0s}` (or transition:none). Absent = press feedback animates instead of snapping.",check(e){let t=e.root.styleSheets?e.root:document,n=!1,r=e=>{for(let t of Array.from(e)){if(n)return;let e=t;if(e.cssRules&&e.cssRules.length){r(e.cssRules);continue}let i=t,a=i.selectorText;if(a&&/:active\b/.test(a)&&/(^|[\s,])(button|a|\[role=("|')?(button|tab|menuitem|option)("|')?\])/i.test(a))try{let e=i.style.transitionDuration,t=i.style.transition;if(e===`0s`||/(^|\s)none(\s|$)/.test(t)||/\b0s\b/.test(t)){n=!0;return}}catch{}}};try{for(let e of Array.from(t.styleSheets)){if(n)break;try{r(e.cssRules)}catch{}}}catch{}if(n)return[];let i=e.root.documentElement??e.els[0]??document.documentElement;return[l(this,i,"no `button:active { transition-duration: 0s }` rule on this page")]}}],K=[];function q(e){for(let t of Array.from(e.childNodes))if(t.nodeType===3&&(t.textContent??``).trim().length>0)return!0;return!1}function J(e,t,n){let r=Math.max(e,t,n);return r<40?!1:r-Math.min(e,t,n)>60}function Y(e){return!!(/\b0px\s+0px\s+0px\s+0?\.?5px\b/.test(e)||/\b0px?\s+0px?\s+0px?\s+0?\.?5px\b/.test(e))}function X(e=typeof document<`u`?document:{}){let t=new Map,n=e=>{let n=t.get(e);return n||(n=getComputedStyle(e),t.set(e,n)),n};S=n;let r=Array.from(e.querySelectorAll(`*`)),i=[],a=e.documentElement??null,o=e.body??null;for(let e of r){if(e===a||e===o||e.closest(`#linear-grab-root, #claude-agent-glow-border, [id^="react-scan"]`))continue;let t=u(e);t.width===0&&t.height===0&&e.children.length===0||i.push(e)}let s={root:e,els:i,css:n},c=[];for(let e of[...G,...K])try{c.push(...e.check(s))}catch{}return S=e=>getComputedStyle(e),c}function Z(e){let t=new Map;for(let n of e){let e=t.get(n.ruleId);e?e.push(n):t.set(n.ruleId,[n])}let n=Array.from(t.entries()).sort((e,t)=>{let n=e[1][0].severity===`error`?0:1,r=t[1][0].severity===`error`?0:1;return n===r?t[1].length===e[1].length?e[0].localeCompare(t[0]):t[1].length-e[1].length:n-r}),r=e.length,i=e.filter(e=>e.severity===`error`).length,a=new Set(e.map(e=>e.page).filter(Boolean)).size>1,o=[`# Slop scan — ${i} error${i===1?``:`s`}, ${r-i} warn (${r} total)`,``];for(let[e,t]of n){let n=t[0];o.push(`## ${e} — ${n.severity} ×${t.length} [${n.part}]`),o.push(n.description);for(let e of t){let t=e.component||e.source?` — ${[e.component,e.source].filter(Boolean).join(` @ `)}`:``;o.push(`- ${a&&e.page?`\`${e.page}\` `:``}\`${e.selector}\` — ${e.evidence}${t}`)}o.push(``)}return o.join(`
+`)}function Q(e){return[`Below is a design-system SLOP report from my running app — each finding is a`,"live-DOM violation of the Linear/Protocolbase primitives contract (`Linear","-primitives.md`). Every rule cites its §id. Goal: zero errors. Rules:",``,`1. Fix at the TOKEN / VARIANT level, not the call sites. Most of these come`,`   from shared row/button/menu variants — change --row-radius, --selected,`,`   .pb-row-action, the Button/Input variant, or the globals.css §42 rules —`,`   not one component at a time.`,`2. Cite the primitives §id in your fix (each finding carries it). Radius →`,`   §40 vocabulary {8,12,16,full}; active fill → §11 var(--selected); menus →`,`   §21 all-or-none icons + one stroke family; uppercase labels → §25;`,`   editor flatness → Part 5; scrollers → §0–1 virtualize + truthful fade.`,`3. §42 group (transition-all / paint-prop / too-slow / ease-in / press-`,`   instant): scope transitions to what changes, drop box-shadow/width/height`,`   from transition lists, keep feedback ≤100ms (duration-75 small controls),`,`   use ease-out (cubic-bezier(.2,0,.1,1)), and keep the global`,"   `button:active{transition-duration:0s}` press-instant rule.",`4. Do NOT touch EXEMPT intentional motion — popover/menu/dialog entry-exit,`,`   svg icon micro-motion, and panel width/height transitions are §42-blessed.`,`   The scan already excludes them; do not "fix" them.`,`5. 'unverifiable' warnings mean the token collapsed to the anti-pattern this`,`   theme — verify the intent in BOTH themes, do not just silence it.`,"6. Findings carry `Component @ file:line` when the fiber source resolved.",`   When one file:line repeats across many components it is the nearest-`,`   debug-fiber fallback — locate the real code by the selector classes.`,`7. PROOF REQUIRED: after the change I will re-run the scan — it must show 0`,`   errors. State what you changed per token/variant; do not claim done blind.`,``,`---`,``,Z(e)].join(`
+`)}function $(){return X(document).map(({el:e,...t})=>t)}async function ee(){let e=X(document),t=window.__REACT_GRAB__;if(t&&(t.getDisplayName||t.getSource)){let n=new Map;for(let t of e){let e=t.el?.deref();if(!e)continue;let r=n.get(e);r?r.push(t):n.set(e,[t])}let r=300;for(let[e,i]of n){if(r--<=0)break;let n=null,a=null;try{n=t.getDisplayName?.(e)??null}catch{}try{let n=await t.getSource?.(e);n?.filePath&&(a=`${n.filePath}${n.lineNumber==null?``:`:${n.lineNumber}`}`)}catch{}if(!(!n&&!a))for(let e of i)e.component=n,e.source=a}}return e.map(({el:e,...t})=>t)}window.__SLOP_SCAN__={version:`0.25.1`,run:$,runAttributed:ee,report:Z,prompt:Q}})();