tackbox 0.1.65 → 0.1.67

package/README.md

@@ -24,9 +24,12 @@ it's written: hooked into the agent's edit loop it flags the finding
 before the turn ends, and the same rules gate pre-commit and CI -
 one coverage bar for hand-written and agent-written code.
 
-There are no per-rule disable flags. A local exception stays visible as
-a reasoned `// no-report: <reason>` marker at the site, and the agent
-hook asks for your approval before a new suppression lands.
+There are no per-rule disable flags. A local exception stays visible
+as a reasoned `// no-report: <reason>` marker at the site, and every
+marker must be covered by a line in the committed approval manifest
+(`.tackbox/approvals`). Adding that line is the act that draws the
+approval ask in an agent session; an uncovered marker keeps lint,
+`dev.py check`, and CI red until it is approved or reverted.
 
 ```go
 resp, err := client.Do(req)
@@ -138,6 +141,11 @@ The `path` scope and the change filters compose:
 This scope filter is unrelated to the `escapes` command's `--since`
 `<rev>`, which selects inventory entries new against a revision.
 
+The approvals consistency check (see Approval manifest) is exempt
+from all scope filters: it always covers the whole tree and reports
+under an `approvals (whole tree):` header, scoped runs included - a
+scoped CI lint cannot scope the wall away.
+
 ## Exit codes
 
 Across commands, `2` is a usage or setup error the command cannot run
@@ -150,11 +158,17 @@ past (argparse misuse, and the per-command cases below).
   changes the code.
 - **doctor** - `0` all checks pass, `1` at least one failed; every
   check always runs (no short-circuit).
-- **hook** - `0` a no-op, a clean re-lint, or a JSON decision (a
+- **approvals** - `0` consistent, `2` inconsistent (uncovered
+  markers, orphaned entries, or unresolvable files), `1` infra.
+  `--draft` is a generator, not a gate: `0` when every uncovered
+  marker was drafted (an orphan-only tree included), `2` only when
+  unresolvable files leave the draft incomplete.
+- **hook** - `0` a no-op, a clean event, or a JSON decision (a
   PreToolUse approval prompt or a PostToolUse Bash block); `1` a
   non-blocking infra error (unreadable stdin, a git failure); `2` a
-  PostToolUse finding on the edited lines or a non-compiling Go
-  package, which blocks the edit in-loop.
+  PostToolUse finding on the edited lines, a non-compiling Go
+  package, or an approvals inconsistency anywhere in the worktree,
+  which blocks the edit in-loop.
 - **escapes** - `0` whenever it runs, entries or not (an inventory,
   not a gate); `1` only for a bad `--since` rev.
 
@@ -339,7 +353,9 @@ By design, the ruleset is a single non-negotiable bundle. There are
 no flags to disable individual rules. Suppressing a finding requires
 the explicit per-site marker (`// no-report`, `// parse-skip`,
 `// nil-return`, `// test-skip`, `// dup-ok`) with a reason of at
-least 10 characters - non-empty was too cheap (`ok` / `todo` passed).
+least 10 characters - non-empty was too cheap (`ok` / `todo` passed) -
+plus a covering line in the approval manifest below: the reason
+explains the exception, the manifest line records its approval.
 
 Capture helpers are recognized by origin, not by name: a Go call
 counts only when its callee resolves (type info / import) to the
@@ -348,7 +364,7 @@ counts only when its callee resolves (type info / import) to the
 `nl.tsym.tackbox.report.Report` call or a known logger sink (e.g.
 slf4j, `java.lang.System.Logger`) at `ERROR` / `WARNING` - tier-1.
 Every language also honors a function declared in a repo-root
-`.tackbox-reporters` file (`file#function: reason`) - tier-2. A
+`.tackbox/reporters` file (`file#function: reason`) - tier-2. A
 declaration names a report sink - it is not an exclude: it disables no
 rule, and a declared call is honored only when the caught error flows
 into its arguments. Python resolves tier-1 by import origin too (D010),
@@ -370,6 +386,77 @@ on a non-Go file is rejected - a dead line would be silent. The format
 is language-uniform; the restriction lifts as other engines adopt the
 contract.
 
+### Suppression marker forms
+
+Every marker is `<keyword>: <reason>` carried by the language's
+ordinary comment token:
+
+- Go, Java, JS/TS: a `//` line comment. Block comments are never
+  markers; the one exception is `dup-ok`, where the duplication
+  engine also accepts a standalone single-line `/* ... */` (see its
+  section).
+- Python: a `#` comment.
+- Markdown: the `tackbox: lang=` HTML comment (see the Markdown
+  engine section) is the only Markdown marker.
+- Svelte: inside `<script>` blocks the `//` form works as in JS/TS;
+  the template adds two forms - a `//` comment inside a `{...}`
+  expression (line-adjacent, as ever) and an HTML comment
+  immediately above an element:
+
+```text
+<!-- no-report: inline handler failure is tolerated here -->
+<button onclick={...}>go</button>
+```
+
+The HTML-comment form suppresses within that whole element
+(deliberately wider than line adjacency: an inline handler can span
+lines - D011 A8) and stops at the element boundary; following
+siblings still report. `<style>` content takes no markers.
+
+Placement per rule (above the `try`, standalone above the block,
+directly above the statement) is each rule's own contract; the
+10-character reason floor (D009) is universal.
+
+## Approval manifest
+
+Suppression markers are approved in one committed file,
+`.tackbox/approvals` at the repo root - one line per approved
+occurrence: an address (file plus named-scope chain) and the exact
+marker text.
+
+```text
+py/app/svc.py#Handler.process: no-report: legacy path, covered upstream
+js/src/boot.ts#init.<h4f2a9c1e>: no-report: splash fallback, reported upstream
+tools/gen.py: parse-skip: config validated upstream
+```
+
+The chain walks functions, classes, methods, or Markdown headings,
+joined by `.`; an entry with no `#` sits at file scope. Anonymous
+scopes (lambdas, arrows, IIFEs) appear as 8-hex content hashes; Java
+overloads carry a parameter-type signature; same-name siblings take
+an `@k` ordinal. Repeat the line for each identical occurrence.
+
+The check is bidirectional and always covers the whole tree: a
+marker without a covering entry and an entry without a live marker
+(an orphan) are both findings, reported by `tackbox lint` under the
+`approvals (whole tree):` header whatever the lint scope.
+`tackbox approvals` runs the same check standalone;
+`tackbox approvals --draft` prints a ready entry line for every
+uncovered marker - the address is computed for you, so approving a
+marker you just wrote is one append away, and bootstrapping a repo
+that already carries markers is: generate, review line by line,
+commit.
+
+Approving is adding the line. In an agent session the edit that adds
+a manifest line draws the PreToolUse ask quoting the entry (several
+lines in one edit draw one all-or-nothing ask), so the only route to
+a green check passes through a visible diff and a human decision.
+Writing a marker itself never asks - by any channel, Edit or shell -
+it merely leaves the tree inconsistent, which every later hook
+event, `dev.py check`, and CI reports until the entry lands or the
+marker is reverted. Removing a manifest line is free; a marker whose
+text, scope, or count changes needs its entry updated the same way.
+
 ## Runtime reporting helpers
 
 Direct reporting helpers ship per language; their shared runtime behavior -
@@ -387,24 +474,23 @@ specified in [docs/report-contracts.md](docs/report-contracts.md).
 Claude Code hook event on stdin and dispatches by `hook_event_name`:
 
 - **PostToolUse** on an Edit/Write re-lints the edited file (Go: its
-  package). On a finding it exits 2 with the finding on stderr, so the
-  model sees it and fixes it in-loop. On a **Bash** command it instead
-  diffs the whole worktree against HEAD and blocks if the command
-  planted a new suppression marker (on a lintable file) or a new
-  `.tackbox-reporters` line - containment for a marker a shell wrote
-  behind the Edit gate. Stateless: HEAD is the approval record, so an
-  approved marker stops asking once committed (worst case, a repeated
-  question, never a silent pass). The authoritative gate stays
-  pre-commit / CI.
-- **PreToolUse** asks for approval before a new suppression marker
-  (`// no-report`, `// parse-skip`, `// nil-return`, `// test-skip`,
-  `// dup-ok`) or a new `.tackbox-reporters` line lands;
-  removing one is free.
-
-Both marker gates ask only about files an engine would lint (D012): a
-marker in a Go `testdata/` path or a non-lintable fixture extension
-(a `.java.txt`) is dead text and draws no question, while the
-`.tackbox-reporters` gate stays unconditional.
+  package). On a finding it exits 2 with the finding on stderr, so
+  the model sees it and fixes it in-loop. Every Post event - **Bash**
+  included - also runs the whole-tree approvals consistency check:
+  an unapproved marker, an orphaned entry, or an unresolvable file
+  blocks with the entry named and the fix - add the manifest line,
+  which asks, or revert. Stateless and tree-shaped: a commit changes
+  nothing, and the block repeats on every event until the tree is
+  consistent. The authoritative gate stays pre-commit / CI.
+- **PreToolUse** asks for approval before a new `.tackbox/approvals`
+  line or a new `.tackbox/reporters` line lands; removing one is
+  free. Editing markers in code draws no Pre ask - the consistency
+  check owns them.
+
+Only markers in files an engine would lint participate in the check
+(D012): a marker in a Go `testdata/` path or a non-lintable fixture
+extension (a `.java.txt`) is dead text - no entry needed, no
+question - while the `.tackbox/reporters` gate stays unconditional.
 
 The hook is a no-op unless the edit's `cwd` is a git repo with a
 `dev.py` at its root. Wire it once, globally, in
@@ -438,7 +524,7 @@ enumerates:
 - **suppression markers** (`// no-report`, `// parse-skip`,
   `// nil-return`, `// long-comment`, `// test-skip`, `// dup-ok`, plus
   the markdown `tackbox: lang=` marker), each with its reason;
-- **`.tackbox-reporters` declarations** - the tier-2 sinks;
+- **`.tackbox/reporters` declarations** - the tier-2 sinks;
 - **notify / quiet lane choices** - the call sites of the user-lane-only
   `notify` and the telemetry-only `quiet` verbs.
 
@@ -464,7 +550,7 @@ uvx tackbox@latest escapes --since origin/main --context 5
      "text": "no-report: central boundary already captures it",
      "reason": "central boundary already captures it",
      "context": ["...", "...", "..."]},
-    {"kind": "reporter-decl", "file": ".tackbox-reporters", "line": 2,
+    {"kind": "reporter-decl", "file": ".tackbox/reporters", "line": 2,
      "text": "src/app/errors.py#report_api_error: the API sink",
      "context": ["..."]},
     {"kind": "notify-site", "file": "js/foo.js", "line": 40,
@@ -481,7 +567,7 @@ uvx tackbox@latest escapes --since origin/main --context 5
   kinds, even at zero, so consumers see a stable shape.
 - `since` echoes the `--since` rev, or `null`.
 - `text` is the trimmed source line; for a marker it runs from the marker
-  keyword to end of line (the hook's own `_markers` extraction).
+  keyword to end of line.
 - `reason` (markers only) is what follows the keyword's colon, trimmed -
   possibly empty (the `tackbox: lang=` marker carries none).
 - `context` is the surrounding source, `--context N` lines each side
@@ -494,7 +580,7 @@ uvx tackbox@latest escapes --since origin/main --context 5
 
 The scan covers the same lintable source set the linter would scan (the
 D012 predicate: extension match plus each engine's path filter, so a Go
-`testdata/` file is out), plus the root `.tackbox-reporters` (every
+`testdata/` file is out), plus the root `.tackbox/reporters` (every
 non-empty line is one declaration - the file has no comment syntax).
 notify / quiet call sites are detected **textually per language**
 (`report_quiet` / `notify` in Python, `reportQuiet` / `notify` in the JS
@@ -516,6 +602,7 @@ one stderr line, exit 1.
 ## Layout
 
 ```text
+.tackbox/approvals                     # suppression-approval manifest
 dev.py                                 # lint / test / e2e / check (dev-script)
 hygiene.py                             # dev.py lint hygiene (conflict/yaml/ws/newline)
 go.mod                                 # Go module

package/bin/tackbox-eslint.js

@@ -42,7 +42,7 @@ function parseModule(file, code) {
 }
 
 // hasBinding: the AST defines a function or const-arrow named `name`. Existence
-// check for `.tackbox-reporters` symbol validation; a deep walk keeps it parser
+// check for `.tackbox/reporters` symbol validation; a deep walk keeps it parser
 // shape-agnostic across espree / ts / svelte.
 function hasBinding(ast, name) {
   const seen = new Set()
@@ -86,16 +86,16 @@ function validateDeclarations(decls) {
     try {
       code = fs.readFileSync(abs, 'utf8')
     } catch (e) {
-      throw new Error(`.tackbox-reporters: cannot read ${d.file}: ${e.message}`, { cause: e })
+      throw new Error(`.tackbox/reporters: cannot read ${d.file}: ${e.message}`, { cause: e })
     }
     let ast
     try {
       ast = parseModule(d.file, code)
     } catch (e) {
-      throw new Error(`.tackbox-reporters: cannot parse ${d.file}: ${e.message}`, { cause: e })
+      throw new Error(`.tackbox/reporters: cannot parse ${d.file}: ${e.message}`, { cause: e })
     }
     if (!hasBinding(ast, d.fn)) {
-      throw new Error(`.tackbox-reporters: no top-level function ${d.fn} in ${d.file}`)
+      throw new Error(`.tackbox/reporters: no top-level function ${d.fn} in ${d.file}`)
     }
   }
 }

package/js/README.md

@@ -119,11 +119,30 @@ Full constraints per rule:
   bare `fit` / `fdescribe` / `ftest`, disables the rest of the suite. No
   escape hatch; the focused test must be removed.
 
+### Svelte template markers
+
+`svelte-eslint-parser` drives `.svelte` files; the `//` marker form
+works inside `<script>` blocks and `{...}` expressions exactly as in
+plain JS/TS. The template adds one form - an HTML comment
+immediately above an element:
+
+```text
+<!-- no-report: inline handler failure is tolerated here -->
+<button onclick={...}>go</button>
+```
+
+It suppresses a marker-honoring rule's finding anywhere inside that
+element - element-wide on purpose, since an inline handler can span
+lines (D011 A8) - and stops at the element boundary: following
+siblings still report. Recognition reads the enclosing element's
+preceding `SvelteHTMLComment` sibling; `/* ... */` block comments
+are never markers.
+
 ## Reporter recognition
 
 A call counts as a reporter only when its callee resolves to one of the
 reporter names imported from `tackbox` / `tackbox/report` (tier-1), or
-to a function declared in a repo-root `.tackbox-reporters` file
+to a function declared in a repo-root `.tackbox/reporters` file
 (tier-2). A bare identifier that merely shares the name is not trusted.
 
 Names: `reportError`, `reportWarn`, `reportQuiet`, `reportApiError`,
@@ -141,7 +160,7 @@ Tier-1 covers named, renamed, default- or namespace-member, and CJS
 to tier-1 calls; declared sinks carry only the argument-flow contract
 (the caught error must flow into the call).
 
-`.tackbox-reporters` lines are `file#function: reason`. The `tackbox`
+`.tackbox/reporters` lines are `file#function: reason`. The `tackbox`
 CLI parses and validates the file. When you consume this ESLint plugin
 directly (without the CLI), populate `settings.tackbox.reporters` (a
 list of `"file#function"` strings) in your own config; symbol
@@ -151,7 +170,7 @@ mode.
 ## Report helper
 
 ```js
-import { init, reportError, reportWarn, setupGlobalHandlers, flush } from 'tackbox/report'
+import { init, reportError, reportWarn, flush } from 'tackbox/report'
 
 init({
   dsn: import.meta.env.VITE_SENTRY_DSN || '',
@@ -159,7 +178,6 @@ init({
   verify: true,         // confirm connectivity at startup
   debug: false,
 })
-setupGlobalHandlers()
 // ... on shutdown:
 await flush(2000)
 
@@ -176,6 +194,22 @@ and stays log-only. `init({ verify: true })` sends one healthcheck
 event with `fingerprint: ["report.startup"]` and flushes; glitchtip
 groups all startups under one issue, no spam.
 
+### Global handlers
+
+The helper installs no process-global hook. To route uncaught errors and
+promise rejections into the report lane, the app owns the listeners:
+
+```js
+window.addEventListener('error', e => {
+  reportError('uncaught global error', e.error || e.message,
+    { source: 'window.error' }, 'global.uncaught')
+})
+window.addEventListener('unhandledrejection', e => {
+  reportError('unhandled promise rejection', e.reason,
+    { source: 'window.unhandledrejection' }, 'global.unhandled')
+})
+```
+
 ## Bundled API
 
 - `init(opts)`, `flush(timeout)`, `verify(timeout)`, `isReady()`
@@ -188,22 +222,20 @@ groups all startups under one issue, no spam.
   the user lost connectivity)
 - `reportSynthError(msg, tags, dedupKey)`
 - `reportPanic(name, recovered)`
-- `setupGlobalHandlers()` wires `window.error` and
-  `window.unhandledrejection` to `reportError`
 
-The `tackbox:error` custom event is the user lane: it is dispatched on the
-window before the init + rate-window gate (and is never rate-limited) after
-each `reportError` / `reportWarn` / `notify` / `reportPanic` call, so a
-single top-level component can render a toast. `reportQuiet` does not
-dispatch it. The event `detail` carries `{ msg, cause, tags, dedupKey,
-level }`; the listener coalesces on `dedupKey`. Capture is gated behind init
-and the per-`dedupKey` rate window; the user lane is not.
+Sink ordering, the never-suppressed user lane, and the per-`dedupKey` capture
+rate window are the cross-language runtime contract:
+[`../docs/report-contracts.md`](../docs/report-contracts.md). JS-specific: the
+user lane is the `tackbox:error` custom event, dispatched on the window after
+each `reportError` / `reportWarn` / `notify` / `reportPanic` call (`reportQuiet`
+does not dispatch it). The event `detail` carries `{ msg, cause, tags, dedupKey,
+level }`; the listener coalesces on `dedupKey`.
 
 Platform limit: a `tackbox:error` listener that throws is not observable from
 `dispatchEvent` - the browser routes a listener failure to `window.onerror` by
 design. So the JS user lane cannot capture its own listener's failure the way
 Go, Python, and Java capture a throwing `report.notifier`. A module-level
 re-entrancy guard stops the one loop this opens (a throwing listener reaching
-`window.onerror`, which `setupGlobalHandlers` turns back into
+`window.onerror`, which an app-owned global handler turns back into
 `reportError` -> dispatch): a dispatch already in progress on the stack skips
 the nested one and logs locally instead. Sequential dispatches are unaffected.

package/js/markdownlint-rules/no-non-ascii.js

@@ -10,7 +10,7 @@
 // scripts) is still flagged, and a misplaced / duplicate / malformed
 // marker is a finding that leaves the file strict-ASCII.
 //
-//   <!-- tackbox: lang=ru personal experimental repo -->
+//   <!-- tackbox lang ru personal experimental repo -->
 //
 // The marker is read from micromark HTML-comment tokens, not params.lines:
 // markdownlint masks HTML-comment interiors in `lines`, so the raw code is

package/js/report.js

@@ -128,16 +128,6 @@ function reportPanic(name, recovered) {
   })
 }
 
-function setupGlobalHandlers() {
-  if (typeof window === 'undefined') return
-  window.addEventListener('error', e => {
-    reportError('uncaught global error from window', e.error || e.message, { source: 'window.error' }, 'global.uncaught')
-  })
-  window.addEventListener('unhandledrejection', e => {
-    reportError('unhandled promise rejection from window', e.reason, { source: 'window.unhandledrejection' }, 'global.unhandled')
-  })
-}
-
 function maskDSN(dsn) {
   // no-report: malformed user DSN, opaque marker is the recovery
   try {
@@ -154,9 +144,9 @@ function dispatchEventSafely(name, detail) {
   if (typeof window === 'undefined' || typeof CustomEvent === 'undefined') return
   // Re-entrancy guard: a throwing `tackbox:error` listener surfaces via
   // window.onerror (the DOM routes listener failures there, not to dispatchEvent),
-  // which setupGlobalHandlers turns back into reportError -> dispatch on the same
-  // stack. Skip the nested dispatch so that cannot loop; sequential dispatches
-  // are unaffected (D005 deliver-always intact).
+  // which an app-owned global handler can turn back into reportError -> dispatch
+  // on the same stack. Skip the nested dispatch so that cannot loop; sequential
+  // dispatches are unaffected (D005 deliver-always intact).
   if (dispatching) {
     console.warn('[tackbox] report: nested tackbox:error dispatch skipped (listener-failure re-entry)')
     return
@@ -183,5 +173,4 @@ module.exports = {
   reportSynthError,
   notify,
   reportPanic,
-  setupGlobalHandlers,
 }

package/js/rules/_shared.js

@@ -4,7 +4,7 @@ const fs = require('fs')
 // Canonical reporter names. A call counts as a reporter only when its
 // callee resolves (scope analysis) to an import of `tackbox`/`tackbox/report`
 // carrying one of these names (tier-1), or to a function declared in
-// `.tackbox-reporters` (tier-2). A bare identifier that merely shares the
+// `.tackbox/reporters` (tier-2). A bare identifier that merely shares the
 // name is not trusted - name-only matching is dead.
 const REPORTER_NAMES = new Set([
   'reportError',
@@ -151,7 +151,7 @@ function isTier1ReporterCall(context, call) {
   return tier1ReporterName(context, call) !== null
 }
 
-// --- tier-2: .tackbox-reporters declarations -----------------------------
+// --- tier-2: .tackbox/reporters declarations -----------------------------
 
 function declaredReporters(context) {
   const s = context.settings && context.settings.tackbox && context.settings.tackbox.reporters
@@ -280,7 +280,7 @@ function argFlows(call, errName) {
 }
 
 // resolvesToDeclaredReporter: `call`'s callee resolves to a function declared in
-// `.tackbox-reporters` for its origin file. Pure origin recognition - the single
+// `.tackbox/reporters` for its origin file. Pure origin recognition - the single
 // declared-reporter resolver. no-swallow layers an argument-flow gate on top
 // (the caught err must reach the call).
 function resolvesToDeclaredReporter(context, call) {
@@ -297,7 +297,7 @@ function isDeclaredReporterCall(context, call, errName) {
 }
 
 // isInDeclaredReporterBody: `node` is lexically inside a function declared in
-// `.tackbox-reporters` for this file - no-console-error does not apply there
+// `.tackbox/reporters` for this file - no-console-error does not apply there
 // (the declared function is itself the reporter).
 function isInDeclaredReporterBody(context, node) {
   const decls = declaredReporters(context)
@@ -384,11 +384,38 @@ function blockHasReport(context, block, errName) {
   return found
 }
 
-// hasMarkerAbove returns true when the comment block directly above node
-// carries `// <prefix>: <reason>` (reason at least MIN_REASON chars, D009) on
-// any of its lines - not only the line immediately above, so a long reason can
-// be followed by human context. A blank line breaks the block (adjacency
-// required).
+// markerText reports whether a comment's raw text is `<prefix>: <reason>` with
+// reason at least MIN_REASON chars (D009) - the shared marker shape.
+function markerText(raw, prefix) {
+  const text = raw.trim()
+  if (!text.startsWith(prefix + ':')) return false
+  return text.slice(prefix.length + 1).trim().length >= MIN_REASON
+}
+
+// precedingSvelteSibling returns the template node immediately before `el` among
+// its parent's children (Program.body at the top level, SvelteElement.children
+// when nested), skipping whitespace-only text; null when there is none.
+function precedingSvelteSibling(el) {
+  const parent = el.parent
+  if (!parent) return null
+  const sibs = parent.children || parent.body
+  if (!Array.isArray(sibs)) return null
+  for (let k = sibs.indexOf(el) - 1; k >= 0; k--) {
+    const s = sibs[k]
+    if (s.type === 'SvelteText' && typeof s.value === 'string' && s.value.trim() === '') continue
+    return s
+  }
+  return null
+}
+
+// hasMarkerAbove returns true when a suppression marker `<prefix>: <reason>`
+// (reason at least MIN_REASON chars, D009) sits above node. Two forms: a `//`
+// comment block directly above node - any of its contiguous lines, so a long
+// reason can be followed by human context, a blank line breaking the block - and,
+// in a Svelte template, an HTML comment `<!-- ... -->` immediately above an
+// enclosing element, which covers the whole element (residual A8: an inline
+// handler can span lines). getAllComments omits SvelteHTMLComment nodes, so the
+// template form is read off the element's preceding sibling.
 function hasMarkerAbove(context, node, prefix) {
   if (!node || !node.loc) return false
   const sourceCode = context.sourceCode || context.getSourceCode()
@@ -397,10 +424,12 @@ function hasMarkerAbove(context, node, prefix) {
     if (c.type === 'Line') byEndLine.set(c.loc.end.line, c)
   }
   for (let line = node.loc.start.line - 1; byEndLine.has(line); line--) {
-    const text = byEndLine.get(line).value.trim()
-    if (!text.startsWith(prefix + ':')) continue
-    const reason = text.slice(prefix.length + 1).trim()
-    if (reason.length >= MIN_REASON) return true
+    if (markerText(byEndLine.get(line).value, prefix)) return true
+  }
+  for (let cur = node.parent; cur; cur = cur.parent) {
+    if (cur.type !== 'SvelteElement') continue
+    const sib = precedingSvelteSibling(cur)
+    if (sib && sib.type === 'SvelteHTMLComment' && markerText(sib.value, prefix)) return true
   }
   return false
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tackbox",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "ESLint and Markdown lint plugins plus direct error-reporting helpers for JavaScript and TypeScript.",
   "license": "MIT",
   "main": "./js/eslint-plugin.js",