td-ai-tools 1.2.6 → 1.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "td-ai-tools",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "description": "Install agent skills and packs into your project",
   "type": "module",
   "scripts": {

package/skills/shopify-lint/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shopify-lint
-version: 1.3.0
+version: 1.3.2
 description: Run Shopify CLI Theme Check with Theory Digital's bundled custom checks, including warnings for hard-coded storefront text and script or style tags in Liquid, while reporting and failing only on offenses in files modified on the current Git branch. Use when Codex needs to lint a Shopify theme, validate branch-scoped Liquid or theme changes, enforce Theory theme rules, or avoid surfacing pre-existing Theme Check offenses from untouched files.
 ---
 
@@ -17,7 +17,7 @@ bash .agents/skills/shopify-lint/scripts/setup.sh
 Installing with `td-ai-tools install --setup shopify-lint` runs this automatically. The script:
 
 1. Runs `npm install && npm run build` inside `theme-check-theory/`, producing `dist/index.js` — the CommonJS entry point the root `.theme-check.yml` requires.
-2. Writes a `.theme-check.yml` at the project root wiring in the bundled checks. If one already exists it is left untouched; ensure its `require:` list includes `./.agents/skills/shopify-lint/theme-check-theory` and both `DisallowedScriptOrStyleTag` and `HardcodedText` are enabled.
+2. Writes a `.theme-check.yml` at the project root wiring in the bundled checks. Setup replaces any existing file with the skill's current configuration so installs and updates cannot retain stale or incomplete settings.
 3. Through the installer's shared project-hook setup, installs matching Claude and Codex Stop hooks and merges their registrations into `.claude/settings.json` and `.codex/hooks.json` without replacing unrelated settings or hooks. Re-running setup updates the Shopify Lint hook in place instead of duplicating it.
 
 The Stop hooks run this skill's branch-scoped lint before handoff, return modified-file offenses to the agent, and allow handoff after three unsuccessful fix rounds. They require `jq`, `python3`, and Shopify CLI to be available when the hook runs. Directly running `scripts/setup.sh` performs the package build and Theme Check configuration; use `td-ai-tools install --setup` or `td-ai-tools update --setup` to apply the shared hook manifest as well.
@@ -32,7 +32,7 @@ Run the bundled Python script from the Shopify theme root:
 python3 .agents/skills/shopify-lint/scripts/shopify_lint.py --path .
 ```
 
-The script runs `shopify theme check --output json`, identifies files changed since the current branch's merge-base, adds staged, unstaged, and untracked files, and emits only reports whose paths are in that set. The root `.theme-check.yml` directly requires the bundled `theme-check-theory` package from this skill directory. `DisallowedScriptOrStyleTag` reports HTML `<script>` and `<style>` tags in modified Liquid files. `HardcodedText` reports rendered hard-coded copy, except content inside Liquid `stylesheet`, `javascript`, and `schema` tags.
+The script runs `shopify theme check --output json`, identifies files changed since the current branch's merge-base, adds staged, unstaged, and untracked files, and emits only reports whose paths are in that set. The root `.theme-check.yml` directly requires the bundled `theme-check-theory` package from this skill directory. `DisallowedScriptOrStyleTag` reports inline executable `<script>` and all `<style>` tags in modified Liquid files while allowing external-source and JSON-data scripts. `HardcodedText` reports rendered hard-coded copy, except content inside Liquid `stylesheet`, `javascript`, and `schema` tags.
 
 ## Workflow
 

package/skills/shopify-lint/scripts/setup.sh

@@ -21,7 +21,7 @@ cd "$PKG_DIR"
 npm install
 npm run build
 
-# 2. Generate the project-root .theme-check.yml.
+# 2. Write the project-root .theme-check.yml.
 #
 # The installed layout is <project>/<.agents|.claude>/skills/shopify-lint, so
 # the project root is three levels above the skill directory. Guard against
@@ -37,12 +37,6 @@ fi
 PROJECT_ROOT="$(dirname "$TARGET_DIR")"
 THEME_CHECK_FILE="$PROJECT_ROOT/.theme-check.yml"
 
-if [[ -f "$THEME_CHECK_FILE" ]]; then
-  echo "shopify-lint setup: $THEME_CHECK_FILE already exists; leaving it unchanged."
-  echo "  Ensure its 'require:' list includes ./.agents/skills/shopify-lint/theme-check-theory"
-  exit 0
-fi
-
 cat > "$THEME_CHECK_FILE" <<'YAML'
 extends:
   - theme-check:recommended
@@ -75,4 +69,4 @@ UnguardedMetaobject:
   severity: warning
 YAML
 
-echo "shopify-lint setup: wrote $THEME_CHECK_FILE"
+echo "shopify-lint setup: wrote $THEME_CHECK_FILE (replacing any existing configuration)"

package/skills/shopify-lint/theme-check-theory/README.md

@@ -11,7 +11,7 @@ integrated into Shopify CLI. It is not compatible with the archived Ruby
 
 | Code | Severity | What it catches |
 | --- | --- | --- |
-| `DisallowedScriptOrStyleTag` | warning | An HTML `<script>` or `<style>` tag in a Liquid file. |
+| `DisallowedScriptOrStyleTag` | warning | An inline executable `<script>` or any `<style>` tag in a Liquid file. |
 | `HardcodedText` | warning | Rendered hard-coded storefront copy that should use a dynamic content source. |
 | `UnusedSectionSettings` | warning | A setting declared in `{% schema %}` that is never referenced in the file. |
 | `UnguardedNullableSetting` | warning | A potentially blank setting output with `{{ }}` and no presence guard (`{% if %}`/`{% unless %}`) or `\| default`. |
@@ -22,20 +22,26 @@ integrated into Shopify CLI. It is not compatible with the archived Ruby
 
 HTML `<script>` and `<style>` tags keep JavaScript and CSS embedded in Liquid
 files. Move their contents to theme assets or the appropriate Shopify Liquid
-tags instead. HTML comments and similarly named elements such as
-`<script-template>` are ignored.
+tags instead. Scripts with a non-empty `src` attribute and scripts declared as
+JSON data, including `application/json` and `application/ld+json`, are allowed.
+HTML comments and similarly named elements such as `<script-template>` are
+ignored.
 
 ### HardcodedText
 
 Rendered storefront copy should come from a section setting, translation key,
 metafield, or metaobject. The check reports text nodes, direct quoted output
-with `{{ }}` or `{% echo %}`, and hard-coded `alt`, `title`, `placeholder`, and
-ARIA text attributes. It ignores technical attributes such as classes and IDs,
-Liquid logic strings, comments, and punctuation-only fragments.
+with `{{ }}` or `{% echo %}`, quoted `default` filter fallbacks, hard-coded
+`alt`, `title`, `placeholder`, and ARIA text attributes, and labels in the
+`value` attribute of button-like inputs. It ignores technical attributes such
+as classes and IDs, Liquid logic strings, comments, punctuation-only fragments,
+and text made entirely of HTML character references.
 
 Content inside `{% stylesheet %}`, `{% javascript %}`, and `{% schema %}` is
 ignored. A quoted translation key passed through `t` or `translate` is also
-accepted.
+accepted. Short alphabetic tokens and copyright years remain reportable because
+the check cannot reliably distinguish user-facing copy from currency codes,
+units, or other intentional literals.
 
 ### UnusedSectionSettings
 

package/skills/shopify-lint/theme-check-theory/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "theme-check-theory",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "theme-check-theory",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "license": "UNLICENSED",
       "dependencies": {
         "@shopify/liquid-html-parser": "2.9.2",

package/skills/shopify-lint/theme-check-theory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "theme-check-theory",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Theory Digital's custom Shopify Theme Check rules",
   "type": "commonjs",
   "main": "dist/index.js",

package/skills/shopify-lint/theme-check-theory/src/checks/disallowed-script-or-style-tag.test.ts

@@ -8,7 +8,7 @@ import { DisallowedScriptOrStyleTag } from './disallowed-script-or-style-tag';
 describe('DisallowedScriptOrStyleTag', () => {
   it('reports script and style tags', async () => {
     const source = `
-      <script src="{{ 'theme.js' | asset_url }}" defer></script>
+      <script>window.example = true;</script>
       <style>.example { color: red; }</style>
     `;
 
@@ -26,7 +26,7 @@ describe('DisallowedScriptOrStyleTag', () => {
 
   it('reports case variants and self-closing tags', async () => {
     const source = `
-      <SCRIPT type="application/json">{}</SCRIPT>
+      <SCRIPT type="module">window.example = true;</SCRIPT>
       <STYLE />
     `;
 
@@ -39,6 +39,39 @@ describe('DisallowedScriptOrStyleTag', () => {
     ]);
   });
 
+  it('ignores scripts with an external source', async () => {
+    const source = `
+      <script src="{{ 'theme.js' | asset_url }}" defer></script>
+      <SCRIPT SRC="https://cdn.example.com/widget.js"></SCRIPT>
+    `;
+
+    expect(
+      await runLiquidCheck(DisallowedScriptOrStyleTag, source),
+    ).toEqual([]);
+  });
+
+  it('ignores scripts containing JSON data', async () => {
+    const source = `
+      <script type="application/ld+json">{"@type":"Organization"}</script>
+      <script type="application/json">{"enabled":true}</script>
+    `;
+
+    expect(
+      await runLiquidCheck(DisallowedScriptOrStyleTag, source),
+    ).toEqual([]);
+  });
+
+  it('reports executable scripts with an empty src', async () => {
+    const source = `
+      <script src="">window.example = true;</script>
+      <script type="text/javascript">window.example = true;</script>
+    `;
+
+    expect(
+      await runLiquidCheck(DisallowedScriptOrStyleTag, source),
+    ).toHaveLength(2);
+  });
+
   it('ignores tags in comments and similarly named elements', async () => {
     const source = `
       <!-- <script></script> -->

package/skills/shopify-lint/theme-check-theory/src/checks/disallowed-script-or-style-tag.ts

@@ -1,5 +1,7 @@
 import {
+  AttributeNode,
   HtmlElement,
+  HtmlRawNode,
   HtmlSelfClosingElement,
   NodeTypes,
 } from '@shopify/liquid-html-parser';
@@ -12,6 +14,79 @@ import {
 const DISALLOWED_TAGS = new Set(['script', 'style']);
 
 type NamedHtmlNode = HtmlElement | HtmlSelfClosingElement;
+type ScriptNode = HtmlRawNode | NamedHtmlNode;
+type ValuedAttribute = Extract<AttributeNode, { value: unknown }>;
+
+function isValuedAttribute(
+  attribute: AttributeNode,
+): attribute is ValuedAttribute {
+  return (
+    attribute.type === NodeTypes.AttrDoubleQuoted ||
+    attribute.type === NodeTypes.AttrSingleQuoted ||
+    attribute.type === NodeTypes.AttrUnquoted
+  );
+}
+
+function staticAttributeName(attribute: ValuedAttribute): string | null {
+  if (
+    attribute.name.length !== 1 ||
+    attribute.name[0].type !== NodeTypes.TextNode
+  ) {
+    return null;
+  }
+
+  return attribute.name[0].value.toLowerCase();
+}
+
+function staticAttributeValue(
+  node: ScriptNode,
+  attributeName: string,
+): string | null {
+  const attribute = node.attributes.find(
+    (candidate) =>
+      isValuedAttribute(candidate) &&
+      staticAttributeName(candidate) === attributeName,
+  );
+  if (
+    !attribute ||
+    !isValuedAttribute(attribute) ||
+    !attribute.value.every(({ type }) => type === NodeTypes.TextNode)
+  ) {
+    return null;
+  }
+
+  return attribute.value
+    .map((part) => ('value' in part ? part.value : ''))
+    .join('')
+    .trim()
+    .toLowerCase();
+}
+
+function hasExternalSource(node: ScriptNode): boolean {
+  return node.attributes.some(
+    (attribute) =>
+      isValuedAttribute(attribute) &&
+      staticAttributeName(attribute) === 'src' &&
+      attribute.value.length > 0,
+  );
+}
+
+function containsJsonData(node: ScriptNode): boolean {
+  const type = staticAttributeValue(node, 'type');
+  if (!type) return false;
+
+  const mimeType = type.split(';', 1)[0].trim();
+  return (
+    mimeType.endsWith('/json') ||
+    mimeType.endsWith('+json') ||
+    mimeType === 'importmap' ||
+    mimeType === 'speculationrules'
+  );
+}
+
+function isAllowedScript(node: ScriptNode): boolean {
+  return hasExternalSource(node) || containsJsonData(node);
+}
 
 function staticTagName(node: NamedHtmlNode): string | null {
   if (
@@ -29,7 +104,8 @@ export const DisallowedScriptOrStyleTag: LiquidCheckDefinition = {
     code: 'DisallowedScriptOrStyleTag',
     name: 'Prevent script and style tags in Liquid',
     docs: {
-      description: 'Reports HTML script and style tags in Liquid files.',
+      description:
+        'Reports inline executable script and style tags in Liquid files.',
       recommended: true,
     },
     type: SourceCodeType.LiquidHtml,
@@ -50,6 +126,7 @@ export const DisallowedScriptOrStyleTag: LiquidCheckDefinition = {
     function checkNamedNode(node: NamedHtmlNode) {
       const tagName = staticTagName(node);
       if (!tagName) return;
+      if (tagName === 'script' && isAllowedScript(node)) return;
 
       report(
         tagName,
@@ -60,6 +137,13 @@ export const DisallowedScriptOrStyleTag: LiquidCheckDefinition = {
 
     return {
       async HtmlRawNode(node) {
+        if (
+          node.name.toLowerCase() === 'script' &&
+          isAllowedScript(node)
+        ) {
+          return;
+        }
+
         report(
           node.name.toLowerCase(),
           node.blockStartPosition.start,

package/skills/shopify-lint/theme-check-theory/src/checks/hardcoded-text.test.ts

@@ -41,6 +41,28 @@ describe('HardcodedText', () => {
     expect(offenses).toHaveLength(4);
   });
 
+  it('reports labels in button-like input value attributes', async () => {
+    const source = `
+      <input type="submit" value="Search">
+      <input type=button value='Add to cart'>
+      <input type='RESET' value="Clear form">
+    `;
+
+    const offenses = await runLiquidCheck(HardcodedText, source);
+
+    expect(offenses).toHaveLength(3);
+  });
+
+  it('ignores value attributes that are not rendered as labels', async () => {
+    const source = `
+      <input type="hidden" value="technical-id">
+      <input type="text" value="Initial form value">
+      <button value="submitted-value">{{ button_label }}</button>
+    `;
+
+    expect(await runLiquidCheck(HardcodedText, source)).toEqual([]);
+  });
+
   it('reports static fragments in otherwise dynamic rendered text', async () => {
     const source = `
       <p>Welcome, {{ customer.name }}!</p>
@@ -52,6 +74,18 @@ describe('HardcodedText', () => {
     expect(offenses).toHaveLength(2);
   });
 
+  it('reports hard-coded default filter fallbacks', async () => {
+    const source = `
+      {{ product.title | default: 'Free shipping on all orders' }}
+      {% echo section.settings.label | default: "Shop now" %}
+      {{ translated_title | t | default: 'Fallback after translation' }}
+    `;
+
+    const offenses = await runLiquidCheck(HardcodedText, source);
+
+    expect(offenses).toHaveLength(3);
+  });
+
   it('accepts settings, translation keys, metafields, and metaobjects', async () => {
     const source = `
       <h2>{{ section.settings.heading }}</h2>
@@ -59,12 +93,23 @@ describe('HardcodedText', () => {
       <p>{{ "general.subtitle" | translate }}</p>
       <p>{{ product.metafields.content.description }}</p>
       <p>{{ metaobjects.testimonials.homepage.quote }}</p>
+      <p>{{ product.title | default: 'products.fallback' | t }}</p>
       <img alt="{{ section.settings.image_alt }}" src="{{ section.settings.image | image_url }}">
     `;
 
     expect(await runLiquidCheck(HardcodedText, source)).toEqual([]);
   });
 
+  it('ignores entity-only text while still reporting surrounding copy', async () => {
+    const entities = `
+      &nbsp; &times; &mdash; &hellip; &copy; &#169; &#x00a0;
+    `;
+    const copy = '&nbsp;Welcome&nbsp;';
+
+    expect(await runLiquidCheck(HardcodedText, entities)).toEqual([]);
+    expect(await runLiquidCheck(HardcodedText, copy)).toHaveLength(1);
+  });
+
   it.each([
     [
       'stylesheet',

package/skills/shopify-lint/theme-check-theory/src/checks/hardcoded-text.ts

@@ -3,8 +3,10 @@ import {
 } from '@shopify/liquid-html-parser';
 import type {
   AttributeNode,
+  HtmlVoidElement,
   LiquidHtmlNode,
   LiquidRawTag,
+  LiquidString,
   LiquidVariable,
   TextNode,
 } from '@shopify/liquid-html-parser';
@@ -32,6 +34,11 @@ const TEXT_ATTRIBUTES = new Set([
 
 const TRANSLATION_FILTERS = new Set(['t', 'translate']);
 
+const BUTTON_INPUT_TYPES = new Set(['button', 'reset', 'submit']);
+
+const HTML_CHARACTER_REFERENCE =
+  /&(?:#\d+|#x[\da-f]+|[a-z][\da-z]+);/giu;
+
 type ValuedAttribute = Extract<AttributeNode, { value: unknown }>;
 
 function isValuedAttribute(node: LiquidHtmlNode): node is ValuedAttribute {
@@ -53,6 +60,46 @@ function staticAttributeName(node: ValuedAttribute): string | undefined {
   return node.name[0].value.toLowerCase();
 }
 
+function staticAttributeValue(node: ValuedAttribute): string | undefined {
+  if (
+    node.value.length !== 1 ||
+    node.value[0].type !== NodeTypes.TextNode
+  ) {
+    return undefined;
+  }
+
+  return node.value[0].value.toLowerCase();
+}
+
+function staticInputType(node: HtmlVoidElement): string | undefined {
+  for (const attribute of node.attributes) {
+    if (
+      isValuedAttribute(attribute) &&
+      staticAttributeName(attribute) === 'type'
+    ) {
+      return staticAttributeValue(attribute);
+    }
+  }
+
+  return undefined;
+}
+
+function isInputButtonValue(ancestors: LiquidHtmlNode[]): boolean {
+  let element: HtmlVoidElement | undefined;
+  for (let index = ancestors.length - 1; index >= 0; index -= 1) {
+    const ancestor = ancestors[index];
+    if (ancestor.type === NodeTypes.HtmlVoidElement) {
+      element = ancestor;
+      break;
+    }
+  }
+
+  return (
+    element?.name.toLowerCase() === 'input' &&
+    BUTTON_INPUT_TYPES.has(staticInputType(element) ?? '')
+  );
+}
+
 function rawTagAncestor(
   ancestors: LiquidHtmlNode[],
 ): LiquidRawTag | undefined {
@@ -65,7 +112,9 @@ function rawTagAncestor(
 }
 
 function hasMeaningfulText(value: string): boolean {
-  return /[\p{L}\p{N}]/u.test(value);
+  return /[\p{L}\p{N}]/u.test(
+    value.replace(HTML_CHARACTER_REFERENCE, ''),
+  );
 }
 
 function isHtmlElementName(node: TextNode, parent: LiquidHtmlNode): boolean {
@@ -106,19 +155,38 @@ export const HardcodedText: LiquidCheckDefinition = {
       });
     }
 
+    function reportString(string: LiquidString) {
+      if (!hasMeaningfulText(string.value)) return;
+      report(string.position.start, string.position.end);
+    }
+
     function reportLiteralOutput(variable: LiquidVariable) {
       if (
-        variable.expression.type !== NodeTypes.String ||
-        !hasMeaningfulText(variable.expression.value) ||
-        isTranslation(variable)
+        variable.expression.type === NodeTypes.String &&
+        !isTranslation(variable)
       ) {
-        return;
+        reportString(variable.expression);
       }
 
-      report(
-        variable.expression.position.start,
-        variable.expression.position.end,
-      );
+      for (
+        let filterIndex = 0;
+        filterIndex < variable.filters.length;
+        filterIndex += 1
+      ) {
+        const filter = variable.filters[filterIndex];
+        if (filter.name !== 'default') continue;
+
+        const fallbackIsTranslated = variable.filters
+          .slice(filterIndex + 1)
+          .some(({ name }) => TRANSLATION_FILTERS.has(name));
+        if (fallbackIsTranslated) continue;
+
+        for (const argument of filter.args) {
+          if (argument.type === NodeTypes.String) {
+            reportString(argument);
+          }
+        }
+      }
     }
 
     return {
@@ -139,7 +207,11 @@ export const HardcodedText: LiquidCheckDefinition = {
           if (!parent.value.some((part) => part === node)) return;
 
           const attributeName = staticAttributeName(parent);
-          if (attributeName && TEXT_ATTRIBUTES.has(attributeName)) {
+          if (
+            (attributeName && TEXT_ATTRIBUTES.has(attributeName)) ||
+            (attributeName === 'value' &&
+              isInputButtonValue(ancestors))
+          ) {
             report(node.position.start, node.position.end);
           }
           return;