ultra11y 5.27.0 → 5.29.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.27.0",
+      "version": "5.29.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.27.0",
+  "version": "5.29.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.27.0",
+  "version": "5.29.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.27.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.29.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -371,7 +371,7 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
   fills an input or resizes the viewport — otherwise the snapshot would record our own
   instrumentation instead of the site.
 - **Page by page** — RGAA is a per-page norm; the engine's verdict is scope-wide. `pages`
-  bridges the two: one row per criterion, one column per page, embedded in `report` and
+  bridges the two: one row per criterion, one column per page URL, embedded in `report` and
   rebuilt from a committed `audit.json` alone. The per-page status is not recomputed — a
   per-page *view* of the audit runs through the very same projection the report uses, so grid
   and report agree by construction. Two rules hold the line: a finding is attributed to a page

package/dist/playwright.mjs

@@ -287,14 +287,17 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   if (!count) return [];
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
+  let prevKey = null;
   for (let i = 0; i < limit; i++) {
     if (deadline?.out()) break;
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
+    if (r.key === prevKey) continue;
     if (seen.has(r.key)) break;
     seen.add(r.key);
+    prevKey = r.key;
     if (!r.changed) {
       hits.push({
         selector: r.selector,
@@ -306,11 +309,23 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   }
   return hits;
 }
+var NATIVE_SEGMENT_STOPS = {
+  date: 5,
+  time: 5,
+  "datetime-local": 8,
+  month: 4,
+  week: 4
+};
+function tabPressBudget(count, limits) {
+  return Math.min(count * 2 + 20, limits.maxFocusables * 2 + 20);
+}
 var FOCUS_WHERE_PROBE = `(() => { ${PRELUDE}
   const e = document.activeElement;
   if (!e || e === document.body || e === document.documentElement) return null;
   const key = e.getAttribute && e.getAttribute('data-u11y-f');
-  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e) };
+  const stops = ${JSON.stringify(NATIVE_SEGMENT_STOPS)};
+  const type = e.tagName === 'INPUT' ? (e.getAttribute('type') || 'text').toLowerCase() : '';
+  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e), segments: stops[type] || 1 };
 })()`;
 async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const count = await page.evaluate(focusSetupExpr("", limits.maxFocusables));
@@ -318,7 +333,7 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const confirmPresses = 2;
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
   let prev = null;
   for (let i = 0; i < limit; i++) {
     if (deadline?.out()) break;
@@ -326,8 +341,9 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
     const now = await page.evaluate(FOCUS_WHERE_PROBE);
     if (!now) break;
     if (prev?.tagged && now.tagged && now.key === prev.key) {
+      const budget = Math.max(confirmPresses, (now.segments ?? 1) - 1);
       let stuck = true;
-      for (let k = 0; k < confirmPresses && stuck; k++) {
+      for (let k = 0; k < budget && stuck; k++) {
         if (deadline?.out()) break;
         await page.keyboard.press("Tab");
         const again = await page.evaluate(FOCUS_WHERE_PROBE);
@@ -337,13 +353,15 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
         hits.push({
           selector: now.selector,
           html: now.html,
-          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + confirmPresses} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
+          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + budget} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
         });
         break;
       }
     }
-    if (seen.has(now.key)) break;
-    seen.add(now.key);
+    if (now.key !== prev?.key) {
+      if (seen.has(now.key)) break;
+      seen.add(now.key);
+    }
     prev = now;
   }
   return hits;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.27.0",
+  "version": "5.29.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
@@ -57,6 +57,7 @@
     "verify:bundle": "node scripts/verify-skill-bundle.mjs",
     "check:build": "tsup && node scripts/copy-bundle.mjs && git diff --exit-code -- scripts/ultra11y.mjs skills/ultra11y/scripts/ultra11y.mjs skills/review-a11y/scripts/ultra11y.mjs dist && node scripts/build-extension-icons.mjs --check && node scripts/verify-skill-bundle.mjs && node scripts/sync-engine.mjs --check",
     "build:wcag": "node scripts/build-standards.mjs",
+    "check:standards": "node scripts/build-standards.mjs --check",
     "build:pack:rgaa": "node scripts/build-pack-rgaa.mjs",
     "check:pack:rgaa": "node scripts/build-pack-rgaa.mjs --check",
     "build:guidance:wcag": "node scripts/build-guidance-wcag.mjs",

package/scripts/build-pack-rgaa.mjs

@@ -251,9 +251,16 @@ const RULE_TO_CRITERIA = {
   "error-not-associated": ["11.10"], "aria-invalid-no-description": ["11.10"],
   "axe:label": ["11.1"], "axe:form-field-multiple-labels": ["11.1"], "axe:select-name": ["11.1"], "axe:label-title-only": ["11.1"],
   "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"], "axe:input-button-name": ["11.9"], "axe:button-name": ["11.9"],
-  // Theme 12 — navigation (12.7 skip link, 12.8 tab order)
+  // Theme 12 — navigation (12.7 skip link, 12.8 tab order, 12.9 keyboard trap)
   "skip-link-target-missing": ["12.7"], "axe:skip-link": ["12.7"], "axe:bypass": ["12.7"],
   "positive-tabindex": ["12.8"], "axe:tabindex": ["12.8"],
+  // 12.9 « la navigation ne doit pas contenir de piège au clavier ». The probe that answers it
+  // has existed since `probeKeyboardTrap` landed, and it was mapped to WCAG 2.1.2 alone — so a
+  // trap the browser had just walked into raised a blocking WCAG non-conformity and left RGAA
+  // 12.9 « à évaluer », to be bought from a paid adjudicator on every run. The evidence was
+  // measured and then never delivered to the criterion it answers. No axe rule joins it: axe
+  // has none for keyboard traps, which is why the probe was written in the first place.
+  "dyn-keyboard-trap": ["12.9"],
   // Theme 13 — consultation (13.1 time limits, 13.8 moving/blinking)
   "meta-refresh-redirect": ["13.1"], "blink-marquee": ["13.8"], "autoplay-media": ["4.10", "13.8"],
   "axe:no-autoplay-audio": ["4.10"], "axe:blink": ["13.8"], "axe:marquee": ["13.8"],

package/scripts/build-standards.mjs

@@ -42,6 +42,29 @@ function biomeFormat(text, relPath) {
   return execFileSync(BIOME, ["format", `--stdin-file-path=${relPath}`], { input: text, encoding: "utf8" });
 }
 
+// CHECK MODE — the gate this generator was the only one of the three to lack.
+//
+// scripts/build-pack-rgaa.mjs and scripts/build-guidance-wcag.mjs both compare their
+// generated text to the committed file and exit 1 on drift; this one only ever wrote. So a
+// hand edit to src/data/wcag.json passed every gate and was found by the NIGHTLY refresh
+// instead — on main, a day later, in a workflow nobody watches. Measured: SC 1.3.1 carried
+// three presentational-* rules that RULE_SC_COVERAGE below never cited, and
+// standards-refresh went red every night for two days before anyone read the log.
+//
+// Every write goes through `emit` so the check compares EXACTLY what a build would write —
+// a check that recomputed the text a second way could agree with itself and still be wrong.
+const CHECK = process.argv.includes("--check");
+const drift = [];
+function emit(relPath, text) {
+  const abs = join(root, relPath);
+  if (CHECK) {
+    if (!existsSync(abs) || readFileSync(abs, "utf8") !== text) drift.push(relPath);
+    return;
+  }
+  mkdirSync(dirname(abs), { recursive: true });
+  writeFileSync(abs, text);
+}
+
 // ---------------------------------------------------------------------------
 // Refresh mode: parse a w3c/wcag checkout into the vendored SC snapshot.
 // SC numbers are positional within guidelines/index.html (principle → guideline →
@@ -623,6 +646,7 @@ const RULE_SC_COVERAGE = {
     "sortable-header-no-aria-sort", "nav-landmark-missing", "nav-landmark-unnamed", "aria-required-parent",
     "headers-attr-dangling", "th-no-data-cells",
     "radio-checkbox-group-ungrouped", "table-empty-data-cell", "css-generated-content-informative",
+    "presentational-element", "presentational-attribute", "presentational-spacing",
   ],
   "1.3.5": ["field-purpose-incomplete", "autocomplete-token-invalid"],
   "1.4.2": ["autoplay-media"],
@@ -708,8 +732,7 @@ function buildUniverse(shipped) {
     provenance: univ.provenance,
     criteria,
   };
-  mkdirSync(DATA, { recursive: true });
-  writeFileSync(join(DATA, "wcag-universe.json"), biomeFormat(JSON.stringify(out, null, 2) + "\n", "src/data/wcag-universe.json"));
+  emit("src/data/wcag-universe.json", biomeFormat(JSON.stringify(out, null, 2) + "\n", "src/data/wcag-universe.json"));
 
   const coreIds = new Set(criteria.filter((c) => c.status === "core-AA").map((c) => c.id));
   const shippedIds = new Set(shipped.map((c) => c.sc));
@@ -724,6 +747,7 @@ function buildUniverse(shipped) {
   }
   const tally = { "core-AA": 0, "out-of-core": 0, removed: 0 };
   for (const c of criteria) tally[c.status]++;
+  if (CHECK) return;
   console.log(
     `build-standards: ${criteria.length} WCAG 2.x SCs classified — core-AA ${tally["core-AA"]}, out-of-core ${tally["out-of-core"]}, removed ${tally.removed} → src/data/wcag-universe.json`,
   );
@@ -839,8 +863,7 @@ function build() {
     // resolve in either language off one list.
     glossaryFr: frGlossary,
   };
-  mkdirSync(DATA, { recursive: true });
-  writeFileSync(join(DATA, "wcag.json"), biomeFormat(JSON.stringify(out, null, 2) + "\n", "src/data/wcag.json"));
+  emit("src/data/wcag.json", biomeFormat(JSON.stringify(out, null, 2) + "\n", "src/data/wcag.json"));
 
   // --- guards
   const all = new Set(criteria.map((c) => c.sc));
@@ -863,6 +886,7 @@ function build() {
 
   const tally = { static: 0, "needs-rendering": 0, judgment: 0 };
   for (const c of criteria) tally[c.automatability]++;
+  if (CHECK) return void buildUniverse(criteria);
   console.log(`build-standards: ${criteria.length} WCAG 2.2 A/AA criteria → src/data/wcag.json`);
   console.log(`build-standards: automatability — static ${tally.static}, needs-rendering ${tally["needs-rendering"]}, judgment ${tally.judgment}`);
   console.log(`build-standards: seeded techniques from ${sources.length ? sources.map((s) => s.replace(root + "/", "")).join(", ") : "(no pack found — empty)"}`);
@@ -872,12 +896,26 @@ function build() {
 
 async function main() {
   const refreshIdx = process.argv.indexOf("--refresh");
+  // A check that first goes and fetches is not a check: it would compare the committed
+  // dataset against a source that moved under it, and call an upstream change a local drift.
+  // `--check` reads the vendored snapshots and nothing else.
+  const refreshing = refreshIdx !== -1 || process.argv.some((a) => a.startsWith("--refresh-"));
+  if (CHECK && refreshing) {
+    console.error("build-standards --check: --check is offline by construction; it cannot be combined with a --refresh flag.");
+    process.exit(1);
+  }
   if (refreshIdx !== -1) deriveSnapshot(process.argv[refreshIdx + 1]);
   if (process.argv.includes("--refresh-universe")) await deriveUniverse();
   if (process.argv.includes("--refresh-core")) refreshCore();
   if (process.argv.includes("--refresh-fr")) await deriveFr();
   if (process.argv.includes("--refresh-text")) await deriveText();
   build();
+  if (!CHECK) return;
+  if (drift.length) {
+    console.error(`build-standards --check: OUT OF DATE vs the vendored source — re-run \`pnpm run build:wcag\`: ${drift.join(", ")}`);
+    process.exit(1);
+  }
+  console.log("build-standards --check: src/data/wcag.json and src/data/wcag-universe.json match the vendored source.");
 }
 
 main().catch((e) => {