ultra11y 2.24.0 → 2.26.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,22 @@
+{
+  "name": "ultra11y",
+  "owner": {
+    "name": "maxgfr",
+    "url": "https://github.com/maxgfr"
+  },
+  "description": "Accessibility tooling for coding agents: WCAG 2.2 AA and country standards, engine-decided where it can be, agent-adjudicated where it must be.",
+  "plugins": [
+    {
+      "name": "ultra11y",
+      "source": "./",
+      "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
+      "version": "2.26.0",
+      "author": { "name": "maxgfr" },
+      "homepage": "https://github.com/maxgfr/ultra11y",
+      "repository": "https://github.com/maxgfr/ultra11y",
+      "license": "MIT",
+      "category": "quality",
+      "keywords": ["accessibility", "a11y", "wcag", "rgaa", "code-review", "audit"]
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "ultra11y",
+  "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
+  "version": "2.26.0",
+  "author": { "name": "maxgfr" },
+  "homepage": "https://github.com/maxgfr/ultra11y",
+  "repository": "https://github.com/maxgfr/ultra11y",
+  "license": "MIT"
+}

package/README.md

@@ -1,5 +1,24 @@
 # ultra11y
 
+[![CI](https://github.com/maxgfr/ultra11y/actions/workflows/ci.yml/badge.svg)](https://github.com/maxgfr/ultra11y/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/ultra11y?logo=npm)](https://www.npmjs.com/package/ultra11y)
+[![Claude Code plugin](https://img.shields.io/badge/Claude_Code-plugin-6b46c1)](#add-to-claude-code)
+[![node](https://img.shields.io/node/v/ultra11y)](https://nodejs.org)
+[![license](https://img.shields.io/npm/l/ultra11y)](LICENSE)
+
+### Add to Claude Code
+
+Two lines, and the accessibility review runs **by itself** before every commit, push and
+pull request — you never type the skill's name:
+
+```
+/plugin marketplace add maxgfr/ultra11y
+/plugin install ultra11y@ultra11y
+```
+
+<sub>Prefer the skills only, without the automatic hook? `npx skills add maxgfr/ultra11y`.
+Full details, thresholds and off-switches under [Install](#install).</sub>
+
 > Audit HTML/CSS/JSX against **WCAG 2.2 AA** accessibility and produce a dated compliance report — or author/review accessible markup without regressions. A [skills.sh](https://skills.sh) agent skill: a deterministic, zero-dependency static engine **plus** the agent's judgment, with `check`/`verify` gates against hallucinated non-conformities. **The central deliverable is the auditor conformance block** — theme, criterion + official wording, test(s), WCAG mapping + level, finding, expected state, verification, `file:line` occurrences — rendered identically by the `report` (compliance doc), the `prd` backlog and the GitHub issues, in the active standard's vocabulary and **in your language** (`--lang auto` follows the conversation/repo). **WCAG is the worldwide core; country standards (RGAA, …) are pluggable in-repo packs.**
 
 ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 78 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
@@ -45,6 +64,32 @@ install-free engine.
 npx skills add maxgfr/ultra11y
 ```
 
+**As a Claude Code plugin** — the same two skills, plus the hook that makes the review
+**automatic**. Installed this way, a pending `git commit`, `git push` or `gh pr create`
+that carries accessibility findings is stopped once and the agent is handed the findings,
+so `review-a11y` runs before the work goes out — you never type the skill's name.
+
+```
+/plugin marketplace add maxgfr/ultra11y
+/plugin install ultra11y@ultra11y
+```
+
+Three things worth knowing, because they bound what "automatic" means here:
+
+- A hook **cannot force** a skill to be invoked. It blocks the command and hands over the
+  reason and the findings; the agent is what invokes `review-a11y`. In practice a motivated
+  `deny` is enough — it is not a guarantee.
+- **Hooks do not enable themselves.** Installing the plugin is what turns them on.
+- Claude Code has **no git event** (no `PreCommit`, no `PRCreated`), which is why the hook
+  listens on `PreToolUse` for the Bash tool and recognises the commands that publish work.
+
+The gate never blocks twice for the same findings, so a retry always lands. It stays out of
+the way when git's own `no-verify` bypass is used, outside a repository, and whenever the
+engine cannot answer.
+Disable it per-repo with `"hook": { "failOn": "off" }` in `.ultra11yrc.json`, per-command
+with `SKIP_A11Y=1`, or per-session with `ULTRA11Y_HOOK=off`; raise or lower the bar with
+`ULTRA11Y_HOOK_FAIL_ON=blocking|major|minor` (default `blocking`).
+
 **As an MCP server** — so an agent drives the engine as tools instead of shelling out:
 
 ```sh
@@ -159,7 +204,7 @@ yours**.
 
 ### Resources — the skill's own documentation
 
-`SKILL.md` and all 28 `references/*.md` are served under `skill://`, read off
+`SKILL.md` and all 32 `references/*.md` are served under `skill://`, read off
 disk at request time — so a documentation fix reaches every client without a
 rebuild.
 

package/hooks/hooks.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/pre-tool-use.mjs\"",
+            "timeout": 30
+          }
+        ]
+      }
+    ]
+  }
+}

package/hooks/pre-tool-use.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// The plugin's PreToolUse guard — deliberately tiny.
+//
+// Claude Code has no git-aware hook event, so this runs on EVERY Bash tool call. The
+// engine next to it is a 2.4 MB bundle; parsing that before each shell command would be
+// an unacceptable tax on a session. So the split is: this file pays only a bare Node
+// start and answers "could this possibly be a publishing command?", and the engine —
+// spawned only when the answer is yes — makes the real decision (src/hook.ts).
+//
+// The prefilter is intentionally OVER-permissive: it matches any command mentioning git
+// or gh at all. Precision lives in one place, `matchGitIntent`, so the two cannot drift.
+//
+// Contract with Claude Code: print the hook JSON on stdout to act, print nothing to stay
+// out of the way. Exit code is ALWAYS 0 — a guard that errors out on a user's `git push`
+// is worse than no guard, so every failure path here is silence.
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+try {
+  const payload = JSON.parse(readFileSync(0, "utf8"));
+  if (payload.tool_name !== "Bash") process.exit(0);
+  const command = payload.tool_input?.command ?? "";
+  // Prefilter: no mention of git or gh ⇒ nothing to do, and we never touched the engine.
+  if (!/\bgit\b|\bgh\b/.test(command)) process.exit(0);
+
+  const here = dirname(fileURLToPath(import.meta.url));
+  // The engine ships inside the review-a11y skill of this same plugin; the repo checkout
+  // keeps its own copy at the root. Both are the same bytes (scripts/copy-bundle.mjs).
+  const engine = [join(here, "..", "skills", "review-a11y", "scripts", "ultra11y.mjs"), join(here, "..", "scripts", "ultra11y.mjs")].find((p) => existsSync(p));
+  if (!engine) process.exit(0);
+
+  const run = spawnSync(process.execPath, [engine, "hook", "--claude-code"], {
+    input: JSON.stringify(payload),
+    encoding: "utf8",
+    timeout: 20_000,
+    maxBuffer: 8 * 1024 * 1024,
+  });
+  const out = (run.stdout ?? "").trim();
+  // Only ever forward something that parses as the expected decision — a stray warning on
+  // stdout must not reach Claude Code as a malformed hook response.
+  if (out.startsWith("{") && out.includes("hookSpecificOutput")) process.stdout.write(out);
+} catch {
+  /* unreadable payload, spawn failure, timeout — say nothing */
+}
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "2.24.0",
+  "version": "2.26.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
@@ -11,7 +11,9 @@
     "scripts",
     "src",
     "skills",
-    "docker"
+    "docker",
+    ".claude-plugin",
+    "hooks"
   ],
   "engines": {
     "node": ">=22.18.0"

package/scripts/sync-version.mjs

@@ -35,9 +35,19 @@ edit("src/types.ts", (s) => s.replace(/(export const VERSION = ")[^"]+(";)/, `$1
 // Each skill's SKILL.md — the indented `version:` under the `metadata:` block.
 // BOTH skills ship from this repo; forgetting one leaves its published
 // frontmatter (and, without the matching .releaserc asset, its bundle) stale.
+// NOTE: setVersionField rewrites the FIRST indented `version:` line, so any new
+// frontmatter key added above `metadata:` must not itself be an indented
+// `version:` — verify-skill-bundle.mjs also asserts the shape.
 edit("skills/ultra11y/SKILL.md", setVersionField);
 edit("skills/review-a11y/SKILL.md", setVersionField);
 
+// The Claude Code plugin manifests — what carries the automatic-review hook. A stale
+// version here is what makes an installed plugin report the wrong engine; both list it,
+// so both are rewritten (verify-skill-bundle.mjs fails the build if they drift).
+const setJsonVersion = (s) => s.replace(/("version":\s*")[^"]+(")/, `$1${version}$2`);
+edit(".claude-plugin/plugin.json", setJsonVersion);
+edit(".claude-plugin/marketplace.json", setJsonVersion);
+
 console.log(
-  `sync-version: set ${version} in package.json, src/types.ts, skills/ultra11y/SKILL.md, skills/review-a11y/SKILL.md`,
+  `sync-version: set ${version} in package.json, src/types.ts, skills/ultra11y/SKILL.md, skills/review-a11y/SKILL.md, .claude-plugin/plugin.json, .claude-plugin/marketplace.json`,
 );