ultra11y 5.38.0 → 5.38.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.38.0",
+      "version": "5.38.2",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.38.0",
+  "version": "5.38.2",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.38.0",
+  "version": "5.38.2",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.38.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.38.2";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -25,7 +25,7 @@ Full details, thresholds and off-switches under [Install](#install).</sub>
 
 > Audit HTML/CSS/JSX against **WCAG 2.2 AA** accessibility and produce a dated compliance report — or author/review accessible markup without regressions. A [skills.sh](https://skills.sh) agent skill: a deterministic, zero-dependency static engine **plus** the agent's judgment, with `check`/`verify` gates against hallucinated non-conformities. **The central deliverable is the auditor conformance block** — theme, criterion + official wording, test(s), WCAG mapping + level, finding, expected state, verification, `file:line` occurrences — rendered identically by the `report` (compliance doc), the `prd` backlog and the GitHub issues, in the active standard's vocabulary and **in your language** (`--lang auto` follows the conversation/repo). **WCAG is the worldwide core; country standards (RGAA, …) are pluggable in-repo packs.**
 
-ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 91 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
+ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 93 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
 
 - **Automatable (engine):** missing `alt`/`lang`/`title`, unlabeled fields, empty links/buttons, icon-only controls, iframes without title, tables without headers, heading-level skips, empty/dangling headings & labels, duplicate ids, invalid/broken ARIA, positive `tabindex`, autoplay/timed-refresh/`blink`/`marquee` media…
 - **Agent judgment (gated):** alt-text relevance, link purpose in context, reading/tab order, caption accuracy — the agent rules on these via `verify --manual` → `--apply`, each verdict carrying a justification (or a groundable NC), never a silent "conforming".
@@ -316,12 +316,12 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
 
 ### What RGAA automation actually covers
 
-The engine's 91 rules are not 91 RGAA criteria: several rules can evidence the same official
+The engine's 93 rules are not 93 RGAA criteria: several rules can evidence the same official
 test, and a rule can detect a useful symptom without exhausting the criterion's alternatives,
 exceptions or relevance checks. The generated contract classifies all **258 official RGAA
 tests**:
 
-- **26 `static` tests across 19 criteria:** `1.1`, `2.1`, `5.7`, `5.8`, `6.2`, `7.1`,
+- **27 `static` tests across 19 criteria:** `1.1`, `2.1`, `5.7`, `5.8`, `6.2`, `7.1`,
   `8.2`, `8.3`, `8.4`, `8.5`, `8.10`, `9.3`, `10.1`, `10.12`, `11.1`, `11.5`,
   `11.6`, `11.8`, `11.9`.
 - **3 `rendered` tests across 3 criteria:** `1.1`, `8.1`, `10.7`.
@@ -331,12 +331,12 @@ tests**:
   41 receive candidate evidence, with overlap. One additional criterion receives only an
   advisory signal. A candidate is forwarded to adjudication and never changes a verdict by
   itself.
-- Only **8.5 and 10.1** may earn `C` from a complete silent measurement. For the other
+- Only **8.3, 8.5 and 10.1** may earn `C` from a complete silent measurement. For the other
   mechanically detectable tests, silence can mean “no subject found” or “an alternative or
   exception still needs judging”, so it cannot prove conformity.
-- The remaining **229 `judgment` tests across 92 criteria** all enter the AI worklist,
+- The remaining **228 `judgment` tests across 92 criteria** all enter the AI worklist,
   including an apparently absent subject whose `NA` still needs confirmation. Overall,
-  **104 of 106 criteria require adjudication to earn `C`**.
+  **103 of 106 criteria require adjudication to earn `C`**.
 
 The number can grow, but the useful target is **more observed, exact failures**, not a larger
 marketing count. The best next candidates are complete rendered probes for zoom/reflow and

package/dist/playwright.mjs

@@ -136,10 +136,30 @@ var COLLECT_SNAPSHOT = `(() => {
 var PRELUDE = `
 const __sel = (e) => {
   if (!e || !e.tagName) return '\u2014';
-  const t = e.tagName.toLowerCase();
-  if (e.id) return t + '#' + e.id;
-  const c = typeof e.className === 'string' ? e.className.trim().split(/\\s+/)[0] : '';
-  return c ? t + '.' + c : t;
+  const esc = (v) => (typeof CSS !== 'undefined' && CSS.escape) ? CSS.escape(v) : String(v).replace(/[^a-zA-Z0-9_-]/g, '\\\\$&');
+  const unique = (s) => { try { return document.querySelectorAll(s).length === 1; } catch { return false; } };
+  const short = (n) => {
+    const t = n.tagName.toLowerCase();
+    if (n.id) return t + '#' + esc(n.id);
+    const c = typeof n.className === 'string' ? n.className.trim().split(/\\s+/)[0] : '';
+    return c ? t + '.' + esc(c) : t;
+  };
+  const first = short(e);
+  if (unique(first)) return first;
+  const parts = [];
+  for (let n = e; n && n.tagName; n = n.parentElement) {
+    let part = short(n);
+    if (n.id && unique(part)) { parts.unshift(part); return parts.join(' > '); }
+    const parent = n.parentElement;
+    if (parent) {
+      const same = Array.from(parent.children).filter((x) => x.tagName === n.tagName);
+      if (same.length > 1) part += ':nth-of-type(' + (same.indexOf(n) + 1) + ')';
+    }
+    parts.unshift(part);
+    const path = parts.join(' > ');
+    if (unique(path)) return path;
+  }
+  return parts.join(' > ') || first;
 };
 const __vis = (e) => {
   const r = e.getBoundingClientRect();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.38.0",
+  "version": "5.38.2",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -221,6 +221,7 @@ const RULE_TO_CRITERIA = {
   "aria-hidden-focusable": ["7.1"], "redundant-aria": ["7.1"], "nested-interactive": ["7.1"],
   "cross-prop-drilled-name-lost": ["7.1"],
   "presentational-children-focusable": ["7.1"], "menuitem-empty-name": ["7.1"],
+  "button-empty-name": ["7.1"], "label-in-name-mismatch": ["7.1"],
   "clickable-noninteractive": ["7.3"], "live-region-conflict": ["7.5"], "status-message-not-assertive": ["7.5"],
   // Dynamic tier (scan --local): the live-region probe projects onto WCAG 4.1.3 → RGAA 7.5
   // (status messages) — the WCAG-faithful home. Ara ALSO classifies the source finding under
@@ -233,6 +234,7 @@ const RULE_TO_CRITERIA = {
   "axe:aria-required-attr": ["7.1"], "axe:aria-required-children": ["7.1"], "axe:aria-required-parent": ["7.1"],
   "axe:aria-valid-attr": ["7.1"], "axe:aria-valid-attr-value": ["7.1"], "axe:nested-interactive": ["7.1"],
   "axe:aria-hidden-focus": ["7.1"], "axe:presentation-role-conflict": ["7.1"],
+  "axe:button-name": ["7.1"], "axe:input-button-name": ["7.1"],
   // Theme 8 — document (8.2 valid code, 8.3 default lang, 8.4 lang relevant, 8.5 title, 8.7/8.8 lang changes)
   "duplicate-id": ["8.2"], "axe:duplicate-id": ["8.2"], "axe:duplicate-id-aria": ["8.2"], "axe:duplicate-id-active": ["8.2"],
   "html-lang-missing": ["8.3"], "axe:html-has-lang": ["8.3"],
@@ -258,11 +260,11 @@ const RULE_TO_CRITERIA = {
   "control-label-missing": ["11.1"], "label-for-dangling": ["11.1"], "placeholder-as-label": ["11.1"],
   "form-field-multiple-labels": ["11.1"], "select-has-option": ["11.1"], "control-name-title-only": ["11.1"],
   "radio-checkbox-group-ungrouped": ["11.5"], "date-fields-ungrouped": ["11.5"],
-  "field-purpose-incomplete": ["11.1", "11.13"], "fieldset-legend-missing": ["11.6"], "button-empty-name": ["11.9"],
-  "autocomplete-token-invalid": ["11.13"], "label-in-name-mismatch": ["11.9"],
+  "field-purpose-incomplete": ["11.1", "11.13"], "fieldset-legend-missing": ["11.6"], "form-button-empty-name": ["11.9"],
+  "autocomplete-token-invalid": ["11.13"], "form-label-in-name-mismatch": ["11.9"],
   "error-not-associated": ["11.10"], "aria-invalid-no-description": ["11.10"],
   "axe:label": ["11.1"], "axe:form-field-multiple-labels": ["11.1"], "axe:select-name": ["11.1"], "axe:label-title-only": ["11.1"],
-  "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"], "axe:input-button-name": ["11.9"], "axe:button-name": ["11.9"],
+  "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"],
   // Theme 12 — navigation (12.7 skip link, 12.8 tab order, 12.9 keyboard trap)
   "skip-link-target-missing": ["12.7"], "axe:skip-link": ["12.7"], "axe:bypass": ["12.7"],
   "positive-tabindex": ["12.8"], "axe:tabindex": ["12.8"],
@@ -316,15 +318,20 @@ const DECISIVE_RULE_TESTS = {
   "11.1|control-label-missing": ["1"],
   "11.6|axe:fieldset": ["1"],
   "11.6|fieldset-legend-missing": ["1"],
-  "11.9|axe:button-name": ["1"],
-  "11.9|axe:input-button-name": ["1"],
-  "11.9|button-empty-name": ["1"],
-  "11.9|label-in-name-mismatch": ["2"],
+  "11.9|form-button-empty-name": ["1"],
+  "11.9|form-label-in-name-mismatch": ["2"],
   "11.5|radio-checkbox-group-ungrouped": ["1"],
   "5.7|headers-attr-dangling": ["4"],
   "5.7|table-scope-invalid": ["2", "3"],
   "5.8|layout-table-data-markup": ["1"],
-  "7.1|menuitem-empty-name": ["3"],
+  // An absent accessible name fails the prerequisite name/role/value test (7.1.1).
+  // Test 7.1.3 asks whether an already-accessible name/role is pertinent; it cannot be the
+  // attachment for a component that has no name at all.
+  "7.1|menuitem-empty-name": ["1"],
+  "7.1|button-empty-name": ["1"],
+  "7.1|axe:button-name": ["1"],
+  "7.1|axe:input-button-name": ["1"],
+  "7.1|label-in-name-mismatch": ["3"],
 };
 
 // Candidate evidence is test-scoped too. The fallback remains all tests only when one rule id
@@ -388,7 +395,7 @@ const CANDIDATE_RULE_TESTS = {
   "13.8|axe:marquee": ["1"],
 };
 
-const COMPLETE_BY_SILENCE = new Set(["8.5", "10.1"]);
+const COMPLETE_BY_SILENCE = new Set(["8.3", "8.5", "10.1"]);
 const renderedTier = (ruleId) =>
   ruleId.startsWith("rendered-") || ruleId.startsWith("dyn-") || ruleId.startsWith("axe:") ? "rendered" : "static";
 const mergeTestTier = (current, next) => (current === "static" || next === "static" ? "static" : next);

package/scripts/build-standards.mjs

@@ -664,7 +664,7 @@ const RULE_SC_COVERAGE = {
   "2.4.3": ["positive-tabindex"],
   "2.4.7": ["rendered-focus-not-visible"],
   "2.4.4": ["link-empty-name", "icon-only-control-unnamed"],
-  "2.5.3": ["label-in-name-mismatch"],
+  "2.5.3": ["label-in-name-mismatch", "form-label-in-name-mismatch"],
   "3.2.2": ["on-input-context-change"],
   "3.3.8": ["credential-entry-blocked"],
   "3.1.1": ["html-lang-missing", "document-language-missing", "html-lang-xml-lang-mismatch", "lang-invalid"],
@@ -675,7 +675,7 @@ const RULE_SC_COVERAGE = {
     "iframe-title-missing", "invalid-aria-role", "aria-ref-missing-id", "redundant-aria",
     "clickable-noninteractive", "aria-required-children", "aria-hidden-focusable", "nested-interactive", "invalid-aria-attr", "invalid-aria-value", "aria-required-attr", "aria-prohibited-attr",
     "duplicate-id", "duplicate-attribute", "control-label-missing", "placeholder-as-label", "form-field-multiple-labels",
-    "select-has-option", "button-empty-name", "icon-only-control-unnamed", "control-name-title-only",
+    "select-has-option", "button-empty-name", "form-button-empty-name", "icon-only-control-unnamed", "control-name-title-only",
     "field-purpose-incomplete", "disabled-context-content", "presentational-children-focusable",
     "decorative-marked-exposed", "menuitem-empty-name",
   ],

package/scripts/sync-version.mjs

@@ -41,6 +41,11 @@ edit("src/types.ts", (s) => s.replace(/(export const VERSION = ")[^"]+(";)/, `$1
 edit("skills/ultra11y/SKILL.md", setVersionField);
 edit("skills/review-a11y/SKILL.md", setVersionField);
 
+// GitLab installs the published package rather than consuming the repository checkout. Keep
+// its default exact pin on the release that owns the template, so a later `latest` cannot
+// silently change an old pipeline's audit semantics.
+edit("skills/ultra11y/templates/gitlab-ci.yml", (s) => s.replace(/(ULTRA11Y_VERSION:\s*')[^']+(')/, `$1${version}$2`));
+
 // The plugin manifests — what carries the automatic-review hook. A stale version here is
 // what makes an installed plugin report the wrong engine, so every harness's manifest is
 // rewritten (verify-skill-bundle.mjs fails the build if they drift). Codex resolves