ultra11y 5.20.0 → 5.21.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.20.0",
+      "version": "5.21.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.20.0",
+  "version": "5.21.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.20.0",
+  "version": "5.21.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.20.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.21.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.20.0",
+  "version": "5.21.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.20.0";
+var VERSION = "5.21.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -66779,7 +66779,7 @@ Usage:
   ultra11y hook     --claude-code|--codex|--opencode   (internal: the PreToolUse hook; payload on stdin)
   ultra11y install   --claude-code | --codex | --opencode | --agents-md | --all  [--project] [--dry-run] [--no-skills]
   ultra11y uninstall --claude-code | --codex | --opencode | --agents-md | --all  [--project]
-  ultra11y status   [--json] [--project]        (doctor: which agents will run the review by themselves)
+  ultra11y status   [--json] [--project] [--browser [--cwd <dir>]]   (doctor: which agents run the review; --browser asks whether the scan tier resolves here)
   ultra11y dev      [--port <n>] [--root <dir>] [--standard <pack>] [--lang auto|en|fr]   (dev side-car: live overlay + per-page dashboard)
   ultra11y dev      --next [--port <n>]        (write the Next overlay component, then wire one line into your layout)
 
@@ -67302,6 +67302,10 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "agents-md",
   "all",
   "project",
+  // `status`: ALSO ask whether the browser tier resolves here — the question `scan --runtime
+  // local` answers for itself, exposed so a caller (the GitHub Action) can branch on it
+  // instead of re-deriving it in shell.
+  "browser",
   "no-skills"
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
@@ -68127,8 +68131,9 @@ function reportInstall(results, verb) {
 }
 function cmdStatus(p) {
   const rows = statusReport({ project: p.flags.project === true });
+  const browser = p.flags.browser === true ? localTierStatus(typeof p.flags.cwd === "string" && p.flags.cwd ? p.flags.cwd : ".") : void 0;
   if (p.flags.json === true) {
-    console.log(JSON.stringify({ version: VERSION, targets: rows }, null, 2));
+    console.log(JSON.stringify({ version: VERSION, targets: rows, ...browser ? { browser } : {} }, null, 2));
     return 0;
   }
   console.log(`ultra11y ${VERSION}`);
@@ -68136,6 +68141,11 @@ function cmdStatus(p) {
     console.log(`  ${r.target.padEnd(12)} ${r.wired ? "wired    " : "not wired"}  ${r.path}`);
     if (r.note) console.log(`  ${"".padEnd(12)} ${r.note}`);
   }
+  if (browser) {
+    console.log(
+      `  ${"browser".padEnd(12)} ${browser.ok ? "available" : "unavailable"}  ${browser.ok ? "@playwright/test + @axe-core/playwright" : browser.reason}`
+    );
+  }
   return 0;
 }
 function cmdCriteria(p) {

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.20.0
+  version: 5.21.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.20.0";
+var VERSION = "5.21.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -66779,7 +66779,7 @@ Usage:
   ultra11y hook     --claude-code|--codex|--opencode   (internal: the PreToolUse hook; payload on stdin)
   ultra11y install   --claude-code | --codex | --opencode | --agents-md | --all  [--project] [--dry-run] [--no-skills]
   ultra11y uninstall --claude-code | --codex | --opencode | --agents-md | --all  [--project]
-  ultra11y status   [--json] [--project]        (doctor: which agents will run the review by themselves)
+  ultra11y status   [--json] [--project] [--browser [--cwd <dir>]]   (doctor: which agents run the review; --browser asks whether the scan tier resolves here)
   ultra11y dev      [--port <n>] [--root <dir>] [--standard <pack>] [--lang auto|en|fr]   (dev side-car: live overlay + per-page dashboard)
   ultra11y dev      --next [--port <n>]        (write the Next overlay component, then wire one line into your layout)
 
@@ -67302,6 +67302,10 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "agents-md",
   "all",
   "project",
+  // `status`: ALSO ask whether the browser tier resolves here — the question `scan --runtime
+  // local` answers for itself, exposed so a caller (the GitHub Action) can branch on it
+  // instead of re-deriving it in shell.
+  "browser",
   "no-skills"
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
@@ -68127,8 +68131,9 @@ function reportInstall(results, verb) {
 }
 function cmdStatus(p) {
   const rows = statusReport({ project: p.flags.project === true });
+  const browser = p.flags.browser === true ? localTierStatus(typeof p.flags.cwd === "string" && p.flags.cwd ? p.flags.cwd : ".") : void 0;
   if (p.flags.json === true) {
-    console.log(JSON.stringify({ version: VERSION, targets: rows }, null, 2));
+    console.log(JSON.stringify({ version: VERSION, targets: rows, ...browser ? { browser } : {} }, null, 2));
     return 0;
   }
   console.log(`ultra11y ${VERSION}`);
@@ -68136,6 +68141,11 @@ function cmdStatus(p) {
     console.log(`  ${r.target.padEnd(12)} ${r.wired ? "wired    " : "not wired"}  ${r.path}`);
     if (r.note) console.log(`  ${"".padEnd(12)} ${r.note}`);
   }
+  if (browser) {
+    console.log(
+      `  ${"browser".padEnd(12)} ${browser.ok ? "available" : "unavailable"}  ${browser.ok ? "@playwright/test + @axe-core/playwright" : browser.reason}`
+    );
+  }
   return 0;
 }
 function cmdCriteria(p) {

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.20.0
+  version: 5.21.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/references/ci.md

@@ -367,6 +367,42 @@ crawl is never a job that merely looks hung.
 served HTML, and a listing that links a source file makes the browser start a download instead
 of a navigation — which stops the scan.
 
+### The browser tier comes with the action now (`browser`)
+
+The tier does not travel with the action, and that used to be a silent hole. `scan --runtime
+local` resolves `@playwright/test` + `@axe-core/playwright` from the audited project first and
+from ultra11y's own install second — and consumed as `uses: maxgfr/ultra11y@v5`, that second
+anchor is a checkout with **no `node_modules` beside it**. So a repository that did not pin
+Playwright itself resolved nothing, degraded to Docker, and lost every rendering criterion:
+contrast, zoom, reflow, text spacing. The `urls` input meanwhile promised "a Chromium binary
+for the Playwright that ships with ultra11y". It did not ship.
+
+`browser: auto` (the default) closes it: the action asks the engine whether the tier resolves
+(`status --browser`, the same function `scan` acts on — never a shell re-derivation), and only
+if it does not, installs the two packages **pinned to the action's own manifest** plus a
+Chromium binary into `$RUNNER_TEMP`, then points `--cwd` there. `install` skips the question;
+`off` restores the old behaviour.
+
+Three things it deliberately does:
+
+- **Leaves a project that pins its own Playwright alone.** Two copies in one process hand out
+  `Page` objects the other one's fixtures do not recognise.
+- **Installs into a scratch prefix, never into your tree.** Installing a named package while
+  omitting dev dependencies installs *nothing* when that package is already in the target's own
+  devDependencies — npm answers "up to date" — which is how this repository's own CI once ran
+  with no tier at all. A directory that declares nothing cannot be hit by it.
+- **Never fails the job.** A tier it could not build is a `::warning::` and a scan that degrades
+  exactly as it did before; a missing optional capability must not turn into a red build.
+
+Cache the download to make it free after the first run:
+
+```yaml
+- uses: actions/cache@v4
+  with:
+    path: ~/.cache/ms-playwright
+    key: ms-playwright-${{ runner.os }}
+```
+
 Every scanned page is also **persisted as a snapshot** and folded into the audit
 (`snapshot: 'false'` opts out). That is not a nicety: a page known only by its URL cannot earn
 a conforming verdict — the static rules never ran against its DOM — so without it the per-page

package/skills/ultra11y/references/dynamic.md

@@ -23,6 +23,11 @@ content on hover (1.4.13), target size (2.5.8). The dynamic tier decides them by
   |---|---|
   | ultra11y as an npm dependency (`ultra11y/playwright`, `pnpm exec ultra11y`) | **come with it** — they are its own `dependencies`. Nothing to install. |
   | the standalone skill bundle (`node scripts/ultra11y.mjs` from an installed skill) | **must be in the audited project**, reachable from `--cwd`. An installed skill is a directory of files with no `node_modules` beside it, so the second anchor finds nothing there. |
+  | the **GitHub Action** (`uses: maxgfr/ultra11y@vN`) | **the action installs them for you** (`browser: auto`, the default) into the runner temp directory, plus a Chromium binary, and points `--cwd` at it. Same blind spot as the skill bundle — the action is a checkout with no `node_modules` — but here it is closed rather than documented. A repository that pins its own Playwright is left alone. |
+
+  Which of those you are in is answerable: `status --browser [--cwd <dir>]` asks the very
+  function `scan --runtime local` acts on, and reports `ok` plus, when it is not, WHICH package
+  or binary is missing. That is what the action branches on, rather than re-deriving it.
 
   Either way, a project that installs them itself wins: `--cwd` is tried first, which is what a
   repository with its own pinned Playwright wants. When neither anchor resolves, `auto` degrades

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.20.0";
+var VERSION = "5.21.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -66779,7 +66779,7 @@ Usage:
   ultra11y hook     --claude-code|--codex|--opencode   (internal: the PreToolUse hook; payload on stdin)
   ultra11y install   --claude-code | --codex | --opencode | --agents-md | --all  [--project] [--dry-run] [--no-skills]
   ultra11y uninstall --claude-code | --codex | --opencode | --agents-md | --all  [--project]
-  ultra11y status   [--json] [--project]        (doctor: which agents will run the review by themselves)
+  ultra11y status   [--json] [--project] [--browser [--cwd <dir>]]   (doctor: which agents run the review; --browser asks whether the scan tier resolves here)
   ultra11y dev      [--port <n>] [--root <dir>] [--standard <pack>] [--lang auto|en|fr]   (dev side-car: live overlay + per-page dashboard)
   ultra11y dev      --next [--port <n>]        (write the Next overlay component, then wire one line into your layout)
 
@@ -67302,6 +67302,10 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "agents-md",
   "all",
   "project",
+  // `status`: ALSO ask whether the browser tier resolves here — the question `scan --runtime
+  // local` answers for itself, exposed so a caller (the GitHub Action) can branch on it
+  // instead of re-deriving it in shell.
+  "browser",
   "no-skills"
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
@@ -68127,8 +68131,9 @@ function reportInstall(results, verb) {
 }
 function cmdStatus(p) {
   const rows = statusReport({ project: p.flags.project === true });
+  const browser = p.flags.browser === true ? localTierStatus(typeof p.flags.cwd === "string" && p.flags.cwd ? p.flags.cwd : ".") : void 0;
   if (p.flags.json === true) {
-    console.log(JSON.stringify({ version: VERSION, targets: rows }, null, 2));
+    console.log(JSON.stringify({ version: VERSION, targets: rows, ...browser ? { browser } : {} }, null, 2));
     return 0;
   }
   console.log(`ultra11y ${VERSION}`);
@@ -68136,6 +68141,11 @@ function cmdStatus(p) {
     console.log(`  ${r.target.padEnd(12)} ${r.wired ? "wired    " : "not wired"}  ${r.path}`);
     if (r.note) console.log(`  ${"".padEnd(12)} ${r.note}`);
   }
+  if (browser) {
+    console.log(
+      `  ${"browser".padEnd(12)} ${browser.ok ? "available" : "unavailable"}  ${browser.ok ? "@playwright/test + @axe-core/playwright" : browser.reason}`
+    );
+  }
   return 0;
 }
 function cmdCriteria(p) {

package/src/cli.ts

@@ -143,7 +143,7 @@ Usage:
   ultra11y hook     --claude-code|--codex|--opencode   (internal: the PreToolUse hook; payload on stdin)
   ultra11y install   --claude-code | --codex | --opencode | --agents-md | --all  [--project] [--dry-run] [--no-skills]
   ultra11y uninstall --claude-code | --codex | --opencode | --agents-md | --all  [--project]
-  ultra11y status   [--json] [--project]        (doctor: which agents will run the review by themselves)
+  ultra11y status   [--json] [--project] [--browser [--cwd <dir>]]   (doctor: which agents run the review; --browser asks whether the scan tier resolves here)
   ultra11y dev      [--port <n>] [--root <dir>] [--standard <pack>] [--lang auto|en|fr]   (dev side-car: live overlay + per-page dashboard)
   ultra11y dev      --next [--port <n>]        (write the Next overlay component, then wire one line into your layout)
 
@@ -683,6 +683,10 @@ const BOOLEAN_FLAGS = new Set([
   "agents-md",
   "all",
   "project",
+  // `status`: ALSO ask whether the browser tier resolves here — the question `scan --runtime
+  // local` answers for itself, exposed so a caller (the GitHub Action) can branch on it
+  // instead of re-deriving it in shell.
+  "browser",
   "no-skills",
 ]);
 const KNOWN_FLAGS: ReadonlySet<string> = new Set<string>([...VALUE_FLAGS, ...BOOLEAN_FLAGS]);
@@ -1871,8 +1875,17 @@ function reportInstall(results: ReturnType<typeof installForTargets>, verb: stri
  *  is otherwise invisible until a commit that should have been stopped goes through. */
 function cmdStatus(p: ParsedArgs): number {
   const rows = statusReport({ project: p.flags.project === true });
+  // --browser: CAN THE SCAN TIER RUN HERE? Asked of the engine, answered by the very function
+  // `scan --runtime local` acts on (`localTierStatus`), so a caller that branches on this
+  // cannot end up disagreeing with the command it is branching for. A second implementation
+  // of "does Playwright resolve?" — in a shell script, say — is a second answer.
+  //
+  // Opt-in, because resolving two packages and stat-ing a browser binary is work the harness
+  // doctor has no reason to do. Exit code stays 0 either way: this is a QUESTION, and a doctor
+  // that exits non-zero is one nobody can put in an `if`.
+  const browser = p.flags.browser === true ? localTierStatus(typeof p.flags.cwd === "string" && p.flags.cwd ? p.flags.cwd : ".") : undefined;
   if (p.flags.json === true) {
-    console.log(JSON.stringify({ version: VERSION, targets: rows }, null, 2));
+    console.log(JSON.stringify({ version: VERSION, targets: rows, ...(browser ? { browser } : {}) }, null, 2));
     return 0;
   }
   console.log(`ultra11y ${VERSION}`);
@@ -1880,6 +1893,11 @@ function cmdStatus(p: ParsedArgs): number {
     console.log(`  ${r.target.padEnd(12)} ${r.wired ? "wired    " : "not wired"}  ${r.path}`);
     if (r.note) console.log(`  ${"".padEnd(12)} ${r.note}`);
   }
+  if (browser) {
+    console.log(
+      `  ${"browser".padEnd(12)} ${browser.ok ? "available" : "unavailable"}  ${browser.ok ? "@playwright/test + @axe-core/playwright" : browser.reason}`,
+    );
+  }
   return 0;
 }
 

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.20.0";
+export const VERSION = "5.21.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,