ultra11y 5.14.1 → 5.14.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.14.1",
+      "version": "5.14.3",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.14.1",
+  "version": "5.14.3",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.14.1",
+  "version": "5.14.3",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.14.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.14.3";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.14.1",
+  "version": "5.14.3",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.14.1";
+var VERSION = "5.14.3";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -19918,6 +19918,7 @@ function isUrlPath(file) {
   return /^https?:\/\//i.test(file);
 }
 function repoRelative(file, baseDir) {
+  if (typeof file !== "string" || !file) return "";
   const posix3 = file.split("\\").join("/").replace(/^\.\//, "");
   const base = baseDir.split("\\").join("/").replace(/\/+$/, "");
   if (base && posix3.startsWith(`${base}/`)) return posix3.slice(base.length + 1);
@@ -56863,12 +56864,27 @@ function sectionBody(md, n) {
 function checkSampleCaptured(root = ".", lang = "en") {
   const fr = lang === "fr";
   let declared = [];
+  const rc = join34(root, ".ultra11yrc.json");
+  let raw;
   try {
-    const cfg = JSON.parse(readFileSync18(join34(root, ".ultra11yrc.json"), "utf8"));
-    declared = cfg.sample?.pages ?? [];
+    raw = readFileSync18(rc, "utf8");
   } catch {
     return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   }
+  try {
+    const cfg = JSON.parse(raw);
+    declared = cfg.sample?.pages ?? [];
+  } catch (e) {
+    return {
+      ok: false,
+      issues: [
+        fr ? `.ultra11yrc.json est pr\xE9sent mais illisible (${e instanceof Error ? e.message : String(e)}) \u2014 impossible de savoir quelles pages ce run devait couvrir. La porte de couverture ne peut pas r\xE9pondre, et ne r\xE9pondra donc pas \xAB couvert \xBB.` : `.ultra11yrc.json is present but unreadable (${e instanceof Error ? e.message : String(e)}) \u2014 there is no way to know which pages this run was meant to cover. The coverage gate cannot answer, so it does not answer "covered".`
+      ],
+      missing: [],
+      declared: 0,
+      captured: 0
+    };
+  }
   if (!declared.length) return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   let captured = /* @__PURE__ */ new Set();
   try {
@@ -58072,6 +58088,13 @@ function applyAdjudication(audit2, adj, opts = {}) {
     } else if (v === "NC") {
       if (!it.findings || it.findings.length === 0) blame(it.criteriaId, `criterion ${it.criteriaId}: an NC verdict requires at least one groundable finding`);
       for (const f of it.findings ?? []) {
+        if (typeof f.file !== "string" || !f.file.trim()) {
+          blame(
+            it.criteriaId,
+            `criterion ${it.criteriaId}: an NC finding must name the file it was observed in \u2014 nobody can act on a non-conformity with no location`
+          );
+          continue;
+        }
         if (!f.normativeRef || !f.normativeRef.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? void 0 : it.criteriaId)) {
@@ -58088,7 +58111,13 @@ function applyAdjudication(audit2, adj, opts = {}) {
     } else {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unknown verdict "${String(v)}" \u2014 expected one of ${VERDICTS.join(" | ")}`);
     }
-    for (const rec of it.recommendations ?? []) toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    for (const rec of it.recommendations ?? []) {
+      if (typeof rec.file !== "string" || !rec.file.trim()) {
+        blame(it.criteriaId, `criterion ${it.criteriaId}: a recommendation must name the file it was observed in`);
+        continue;
+      }
+      toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    }
   }
   const grounding = { grounded: 0, moved: 0, failed: 0, issues: [] };
   for (const [criteriaId, inputs] of groundInputs) {

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.14.1
+  version: 5.14.3
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.14.1";
+var VERSION = "5.14.3";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -19918,6 +19918,7 @@ function isUrlPath(file) {
   return /^https?:\/\//i.test(file);
 }
 function repoRelative(file, baseDir) {
+  if (typeof file !== "string" || !file) return "";
   const posix3 = file.split("\\").join("/").replace(/^\.\//, "");
   const base = baseDir.split("\\").join("/").replace(/\/+$/, "");
   if (base && posix3.startsWith(`${base}/`)) return posix3.slice(base.length + 1);
@@ -56863,12 +56864,27 @@ function sectionBody(md, n) {
 function checkSampleCaptured(root = ".", lang = "en") {
   const fr = lang === "fr";
   let declared = [];
+  const rc = join34(root, ".ultra11yrc.json");
+  let raw;
   try {
-    const cfg = JSON.parse(readFileSync18(join34(root, ".ultra11yrc.json"), "utf8"));
-    declared = cfg.sample?.pages ?? [];
+    raw = readFileSync18(rc, "utf8");
   } catch {
     return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   }
+  try {
+    const cfg = JSON.parse(raw);
+    declared = cfg.sample?.pages ?? [];
+  } catch (e) {
+    return {
+      ok: false,
+      issues: [
+        fr ? `.ultra11yrc.json est pr\xE9sent mais illisible (${e instanceof Error ? e.message : String(e)}) \u2014 impossible de savoir quelles pages ce run devait couvrir. La porte de couverture ne peut pas r\xE9pondre, et ne r\xE9pondra donc pas \xAB couvert \xBB.` : `.ultra11yrc.json is present but unreadable (${e instanceof Error ? e.message : String(e)}) \u2014 there is no way to know which pages this run was meant to cover. The coverage gate cannot answer, so it does not answer "covered".`
+      ],
+      missing: [],
+      declared: 0,
+      captured: 0
+    };
+  }
   if (!declared.length) return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   let captured = /* @__PURE__ */ new Set();
   try {
@@ -58072,6 +58088,13 @@ function applyAdjudication(audit2, adj, opts = {}) {
     } else if (v === "NC") {
       if (!it.findings || it.findings.length === 0) blame(it.criteriaId, `criterion ${it.criteriaId}: an NC verdict requires at least one groundable finding`);
       for (const f of it.findings ?? []) {
+        if (typeof f.file !== "string" || !f.file.trim()) {
+          blame(
+            it.criteriaId,
+            `criterion ${it.criteriaId}: an NC finding must name the file it was observed in \u2014 nobody can act on a non-conformity with no location`
+          );
+          continue;
+        }
         if (!f.normativeRef || !f.normativeRef.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? void 0 : it.criteriaId)) {
@@ -58088,7 +58111,13 @@ function applyAdjudication(audit2, adj, opts = {}) {
     } else {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unknown verdict "${String(v)}" \u2014 expected one of ${VERDICTS.join(" | ")}`);
     }
-    for (const rec of it.recommendations ?? []) toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    for (const rec of it.recommendations ?? []) {
+      if (typeof rec.file !== "string" || !rec.file.trim()) {
+        blame(it.criteriaId, `criterion ${it.criteriaId}: a recommendation must name the file it was observed in`);
+        continue;
+      }
+      toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    }
   }
   const grounding = { grounded: 0, moved: 0, failed: 0, issues: [] };
   for (const [criteriaId, inputs] of groundInputs) {

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.14.1
+  version: 5.14.3
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.14.1";
+var VERSION = "5.14.3";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -19918,6 +19918,7 @@ function isUrlPath(file) {
   return /^https?:\/\//i.test(file);
 }
 function repoRelative(file, baseDir) {
+  if (typeof file !== "string" || !file) return "";
   const posix3 = file.split("\\").join("/").replace(/^\.\//, "");
   const base = baseDir.split("\\").join("/").replace(/\/+$/, "");
   if (base && posix3.startsWith(`${base}/`)) return posix3.slice(base.length + 1);
@@ -56863,12 +56864,27 @@ function sectionBody(md, n) {
 function checkSampleCaptured(root = ".", lang = "en") {
   const fr = lang === "fr";
   let declared = [];
+  const rc = join34(root, ".ultra11yrc.json");
+  let raw;
   try {
-    const cfg = JSON.parse(readFileSync18(join34(root, ".ultra11yrc.json"), "utf8"));
-    declared = cfg.sample?.pages ?? [];
+    raw = readFileSync18(rc, "utf8");
   } catch {
     return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   }
+  try {
+    const cfg = JSON.parse(raw);
+    declared = cfg.sample?.pages ?? [];
+  } catch (e) {
+    return {
+      ok: false,
+      issues: [
+        fr ? `.ultra11yrc.json est pr\xE9sent mais illisible (${e instanceof Error ? e.message : String(e)}) \u2014 impossible de savoir quelles pages ce run devait couvrir. La porte de couverture ne peut pas r\xE9pondre, et ne r\xE9pondra donc pas \xAB couvert \xBB.` : `.ultra11yrc.json is present but unreadable (${e instanceof Error ? e.message : String(e)}) \u2014 there is no way to know which pages this run was meant to cover. The coverage gate cannot answer, so it does not answer "covered".`
+      ],
+      missing: [],
+      declared: 0,
+      captured: 0
+    };
+  }
   if (!declared.length) return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   let captured = /* @__PURE__ */ new Set();
   try {
@@ -58072,6 +58088,13 @@ function applyAdjudication(audit2, adj, opts = {}) {
     } else if (v === "NC") {
       if (!it.findings || it.findings.length === 0) blame(it.criteriaId, `criterion ${it.criteriaId}: an NC verdict requires at least one groundable finding`);
       for (const f of it.findings ?? []) {
+        if (typeof f.file !== "string" || !f.file.trim()) {
+          blame(
+            it.criteriaId,
+            `criterion ${it.criteriaId}: an NC finding must name the file it was observed in \u2014 nobody can act on a non-conformity with no location`
+          );
+          continue;
+        }
         if (!f.normativeRef || !f.normativeRef.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? void 0 : it.criteriaId)) {
@@ -58088,7 +58111,13 @@ function applyAdjudication(audit2, adj, opts = {}) {
     } else {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unknown verdict "${String(v)}" \u2014 expected one of ${VERDICTS.join(" | ")}`);
     }
-    for (const rec of it.recommendations ?? []) toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    for (const rec of it.recommendations ?? []) {
+      if (typeof rec.file !== "string" || !rec.file.trim()) {
+        blame(it.criteriaId, `criterion ${it.criteriaId}: a recommendation must name the file it was observed in`);
+        continue;
+      }
+      toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    }
   }
   const grounding = { grounded: 0, moved: 0, failed: 0, issues: [] };
   for (const [criteriaId, inputs] of groundInputs) {

package/src/adjudicate.ts

@@ -879,6 +879,18 @@ export function applyAdjudication(
     } else if (v === "NC") {
       if (!it.findings || it.findings.length === 0) blame(it.criteriaId, `criterion ${it.criteriaId}: an NC verdict requires at least one groundable finding`);
       for (const f of it.findings ?? []) {
+        // AN NC NOBODY CAN OPEN IS NOT A FINDING. Checked before the normativeRef, because a
+        // finding with no file cannot be grounded at all — there is nothing to go and read.
+        // Measured once: a model returned an NC with no `file`, the fold minted it anyway, and
+        // it reached `repoRelative`, which crashed on `undefined.split` and took SARIF, the
+        // annotations, the comment, the report, the HTML and the artifact upload with it.
+        if (typeof f.file !== "string" || !f.file.trim()) {
+          blame(
+            it.criteriaId,
+            `criterion ${it.criteriaId}: an NC finding must name the file it was observed in — nobody can act on a non-conformity with no location`,
+          );
+          continue;
+        }
         // FAIL-CLOSED: every NC finding must cite a precise, resolvable test of the active
         // standard. A good practice with no normative test is a recommendation, not an NC.
         if (!f.normativeRef || !f.normativeRef.trim()) {
@@ -905,7 +917,15 @@ export function applyAdjudication(
     // Recommendations are independent of the verdict (a C criterion may still carry a good
     // practice) and are grounded exactly like an NC finding — no normativeRef required, as
     // a recommendation has no normative test by definition.
-    for (const rec of it.recommendations ?? []) toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    for (const rec of it.recommendations ?? []) {
+      // Same contract, same reason: a recommendation is rendered through the very surfaces an
+      // NC is, so one with no location breaks them just as thoroughly.
+      if (typeof rec.file !== "string" || !rec.file.trim()) {
+        blame(it.criteriaId, `criterion ${it.criteriaId}: a recommendation must name the file it was observed in`);
+        continue;
+      }
+      toGround(it.criteriaId, { file: rec.file, line: rec.line, selector: rec.selector, snippet: rec.snippet });
+    }
   }
 
   // Content-level grounding of every agent NC finding, every C/NA citation, and every

package/src/check.ts

@@ -362,14 +362,36 @@ export interface SampleCoverage {
 export function checkSampleCaptured(root = ".", lang: Lang = "en"): SampleCoverage {
   const fr = lang === "fr";
   let declared: { id: string; name?: string; url?: string }[] = [];
+  const rc = join(root, ".ultra11yrc.json");
+  let raw: string;
   try {
-    const cfg = JSON.parse(readFileSync(join(root, ".ultra11yrc.json"), "utf8")) as {
-      sample?: { pages?: { id: string; name?: string; url?: string }[] };
-    };
-    declared = cfg.sample?.pages ?? [];
+    raw = readFileSync(rc, "utf8");
   } catch {
+    // NO CONFIG AT ALL — nothing is declared, so there is nothing to answer for. This is the
+    // one silence that may pass: a gate that fails on its own absence is a gate that gets
+    // turned off.
     return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
   }
+  try {
+    const cfg = JSON.parse(raw) as { sample?: { pages?: { id: string; name?: string; url?: string }[] } };
+    declared = cfg.sample?.pages ?? [];
+  } catch (e) {
+    // A CONFIG THAT EXISTS AND CANNOT BE READ is the opposite case, and it must not pass. The
+    // file is where the sample is declared, so an unparseable one means this gate does not know
+    // what the run was supposed to cover — and answering "covered" to that is how a gate
+    // disarms itself at exactly the moment something is wrong.
+    return {
+      ok: false,
+      issues: [
+        fr
+          ? `.ultra11yrc.json est présent mais illisible (${e instanceof Error ? e.message : String(e)}) — impossible de savoir quelles pages ce run devait couvrir. La porte de couverture ne peut pas répondre, et ne répondra donc pas « couvert ».`
+          : `.ultra11yrc.json is present but unreadable (${e instanceof Error ? e.message : String(e)}) — there is no way to know which pages this run was meant to cover. The coverage gate cannot answer, so it does not answer "covered".`,
+      ],
+      missing: [],
+      declared: 0,
+      captured: 0,
+    };
+  }
   if (!declared.length) return { ok: true, issues: [], missing: [], declared: 0, captured: 0 };
 
   let captured = new Set<string>();

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.14.1";
+export const VERSION = "5.14.3";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,

package/src/util.ts

@@ -36,6 +36,13 @@ export function isUrlPath(file: string): boolean {
  *  under `baseDir`; leave it as-is when it does not, rather than inventing a path that
  *  resolves nowhere. */
 export function repoRelative(file: string, baseDir: string): string {
+  // A finding with no file at all. It should never reach here — the adjudication fold refuses
+  // an NC that names none — but an AuditResult can also be hand-written or produced by an
+  // external tool's adapter, and neither goes through that gate. Measured once: one such
+  // finding threw here and took SARIF, the annotations, the pull-request comment, the report,
+  // the HTML and the artifact upload with it, because every one of those steps runs after.
+  // A rendering surface that explodes on bad input tells its reader nothing at all.
+  if (typeof file !== "string" || !file) return "";
   const posix = file.split("\\").join("/").replace(/^\.\//, "");
   const base = baseDir.split("\\").join("/").replace(/\/+$/, "");
   if (base && posix.startsWith(`${base}/`)) return posix.slice(base.length + 1);