unslop-ci 0.1.0

package/dist/action.js

@@ -0,0 +1,1618 @@
+// src/action.ts
+import { appendFileSync as appendFileSync2, writeFileSync } from "fs";
+
+// src/config.ts
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+var DEFAULT_CONFIG_FILENAME = "unslop.config.json";
+var FAIL_ON_VALUES = ["high+bugs", "high", "medium", "any"];
+var SEVERITIES = ["high", "medium", "low", "off"];
+var SCANNER_NAMES = ["code", "text", "ui"];
+var ConfigError = class extends Error {
+};
+function assertStringArray(value, where) {
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) {
+    throw new ConfigError(`${where} must be an array of strings`);
+  }
+}
+function validateConfig(raw, source) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new ConfigError(`${source}: config must be a JSON object`);
+  }
+  const cfg = raw;
+  const known = /* @__PURE__ */ new Set(["failOn", "exclude", "disableRules", "rules", "scanners", "$schema"]);
+  for (const key of Object.keys(cfg)) {
+    if (!known.has(key)) throw new ConfigError(`${source}: unknown key "${key}"`);
+  }
+  if (cfg.failOn !== void 0 && !FAIL_ON_VALUES.includes(cfg.failOn)) {
+    throw new ConfigError(`${source}: failOn must be one of ${FAIL_ON_VALUES.join(", ")}`);
+  }
+  if (cfg.exclude !== void 0) assertStringArray(cfg.exclude, `${source}: exclude`);
+  if (cfg.disableRules !== void 0)
+    assertStringArray(cfg.disableRules, `${source}: disableRules`);
+  if (cfg.rules !== void 0) {
+    if (typeof cfg.rules !== "object" || cfg.rules === null || Array.isArray(cfg.rules)) {
+      throw new ConfigError(`${source}: rules must be an object`);
+    }
+    for (const [id, sev] of Object.entries(cfg.rules)) {
+      if (!SEVERITIES.includes(sev)) {
+        throw new ConfigError(`${source}: rules["${id}"] must be one of ${SEVERITIES.join(", ")}`);
+      }
+    }
+  }
+  if (cfg.scanners !== void 0) {
+    if (typeof cfg.scanners !== "object" || cfg.scanners === null || Array.isArray(cfg.scanners)) {
+      throw new ConfigError(`${source}: scanners must be an object`);
+    }
+    for (const [name, sc] of Object.entries(cfg.scanners)) {
+      if (!SCANNER_NAMES.includes(name)) {
+        throw new ConfigError(`${source}: unknown scanner "${name}"`);
+      }
+      if (sc === false) continue;
+      if (typeof sc !== "object" || sc === null || Array.isArray(sc)) {
+        throw new ConfigError(`${source}: scanners.${name} must be an object or false`);
+      }
+      const sub = sc;
+      for (const key of Object.keys(sub)) {
+        if (!["include", "exclude", "disableRules"].includes(key)) {
+          throw new ConfigError(`${source}: unknown key "scanners.${name}.${key}"`);
+        }
+      }
+      if (sub.include !== void 0)
+        assertStringArray(sub.include, `${source}: scanners.${name}.include`);
+      if (sub.exclude !== void 0)
+        assertStringArray(sub.exclude, `${source}: scanners.${name}.exclude`);
+      if (sub.disableRules !== void 0) {
+        assertStringArray(sub.disableRules, `${source}: scanners.${name}.disableRules`);
+      }
+    }
+  }
+  return cfg;
+}
+function loadConfig(cwd, explicitPath) {
+  const path = explicitPath ?? join(cwd, DEFAULT_CONFIG_FILENAME);
+  if (!existsSync(path)) {
+    if (explicitPath) throw new ConfigError(`config file not found: ${explicitPath}`);
+    return {};
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new ConfigError(`failed to parse ${path}: ${err.message}`);
+  }
+  return validateConfig(raw, path);
+}
+
+// src/diff.ts
+import { spawnSync } from "child_process";
+var GitError = class extends Error {
+};
+function git(args, cwd) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 512 * 1024 * 1024
+  });
+  if (res.error) throw new GitError(`git ${args[0]} failed: ${res.error.message}`);
+  if (res.status !== 0) {
+    throw new GitError(`git ${args.join(" ")} exited ${res.status}: ${res.stderr.trim()}`);
+  }
+  return res.stdout;
+}
+function unquoteGitPath(raw) {
+  if (!raw.startsWith('"') || !raw.endsWith('"')) return raw;
+  const inner = raw.slice(1, -1);
+  const bytes = [];
+  for (let i = 0; i < inner.length; i++) {
+    const ch = inner[i];
+    if (ch !== "\\") {
+      for (const b of Buffer.from(ch, "utf8")) bytes.push(b);
+      continue;
+    }
+    const next = inner[i + 1];
+    if (next === void 0) break;
+    if (/[0-7]/.test(next)) {
+      const oct = inner.slice(i + 1, i + 4).match(/^[0-7]{1,3}/)?.[0] ?? next;
+      bytes.push(parseInt(oct, 8));
+      i += oct.length;
+    } else {
+      const map = { n: "\n", t: "	", r: "\r", "\\": "\\", '"': '"' };
+      for (const b of Buffer.from(map[next] ?? next, "utf8")) bytes.push(b);
+      i += 1;
+    }
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function parseAddedLines(diffText) {
+  const added = /* @__PURE__ */ new Map();
+  let currentFile = null;
+  for (const line of diffText.split("\n")) {
+    if (line.startsWith("+++ ")) {
+      const target = line.slice(4).trim();
+      if (target === "/dev/null") {
+        currentFile = null;
+      } else {
+        const unquoted = unquoteGitPath(target);
+        currentFile = unquoted.startsWith("b/") ? unquoted.slice(2) : unquoted;
+      }
+      continue;
+    }
+    if (currentFile && line.startsWith("@@")) {
+      const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+      if (!m) continue;
+      const start = Number(m[1]);
+      const count = m[2] === void 0 ? 1 : Number(m[2]);
+      if (count === 0) continue;
+      let set = added.get(currentFile);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        added.set(currentFile, set);
+      }
+      for (let l = start; l < start + count; l++) set.add(l);
+    }
+  }
+  return added;
+}
+function getAddedLines(opts) {
+  const mergeBase = opts.mergeBase ?? true;
+  const common = ["diff", "-U0", "--no-color", "--no-ext-diff", "--diff-filter=ACMR"];
+  let args;
+  if (opts.head) {
+    args = [...common, mergeBase ? `${opts.base}...${opts.head}` : `${opts.base}..${opts.head}`];
+    return parseAddedLines(git(args, opts.cwd));
+  }
+  if (mergeBase) {
+    try {
+      return parseAddedLines(git([...common, "--merge-base", opts.base], opts.cwd));
+    } catch {
+    }
+  }
+  return parseAddedLines(git([...common, opts.base], opts.cwd));
+}
+function readFileAt(file, cwd, ref) {
+  if (!ref) return null;
+  try {
+    return git(["show", `${ref}:${file}`], cwd);
+  } catch {
+    return null;
+  }
+}
+
+// src/report/console.ts
+var codes = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  yellow: "\x1B[33m",
+  green: "\x1B[32m",
+  cyan: "\x1B[36m"
+};
+function makePaint(useColor) {
+  return (color, text) => useColor ? `${codes[color]}${text}${codes.reset}` : text;
+}
+var SEV_COLOR = { high: "red", medium: "yellow", low: "dim" };
+function renderConsoleReport(report, opts) {
+  const paint = makePaint(opts.color);
+  const lines = [];
+  const scope = report.mode === "diff" ? `added lines vs ${report.base ?? "?"}${report.head ? `..${report.head}` : " (working tree)"}` : "full tree";
+  lines.push("");
+  lines.push(
+    paint("bold", `unslop-ci ${report.mode}`) + paint("dim", `  (${scope}, fail-on: ${report.failOn})`)
+  );
+  for (const s of report.scanners) {
+    const extra = s.words !== void 0 ? `   words: ${s.words}   density: ${s.densityPer1kWords}/1k` : "";
+    lines.push(
+      paint("dim", `  ${s.scanner.padEnd(5)}`) + `files: ${s.filesScanned}   high: ${s.counts.high}   medium: ${s.counts.medium}   low: ${s.counts.low}   score: ${s.score}${extra}   ${paint("cyan", s.verdict)}`
+    );
+  }
+  if (report.addedLines !== void 0) {
+    lines.push(paint("dim", `  added lines considered: ${report.addedLines}`));
+  }
+  lines.push("");
+  const blocking = report.findings.filter((f) => f.blocking);
+  const rest = report.findings.filter((f) => !f.blocking);
+  if (blocking.length > 0) {
+    lines.push(
+      paint(
+        "red",
+        paint("bold", `  ${blocking.length} blocking finding${blocking.length === 1 ? "" : "s"}`)
+      )
+    );
+    for (const f of blocking) {
+      lines.push(
+        `  ${paint(SEV_COLOR[f.severity], f.severity.toUpperCase().padEnd(6))} ${f.file}:${f.line}  ${paint("bold", `[${f.scanner}/${f.rule}]`)} ${f.match}`
+      );
+      lines.push(paint("dim", `         ${f.snippet}`));
+      lines.push(paint("dim", `         fix: ${f.fix}`));
+    }
+    lines.push("");
+  }
+  if (rest.length > 0) {
+    const byRule = /* @__PURE__ */ new Map();
+    for (const f of rest) {
+      const key = `${f.scanner}/${f.rule}`;
+      const arr = byRule.get(key) ?? [];
+      arr.push(f);
+      byRule.set(key, arr);
+    }
+    lines.push(
+      paint(
+        "yellow",
+        `  ${rest.length} non-blocking finding${rest.length === 1 ? "" : "s"} (warnings)`
+      )
+    );
+    for (const [key, items] of byRule) {
+      const f0 = items[0];
+      lines.push(
+        `  ${paint(SEV_COLOR[f0.severity], f0.severity.toUpperCase().padEnd(6))} ${paint("bold", `[${key}]`)} ${f0.label}  (${items.length} hit${items.length === 1 ? "" : "s"})`
+      );
+      for (const it of items.slice(0, opts.maxExamples)) {
+        lines.push(paint("dim", `         ${it.file}:${it.line}  ${it.snippet}`));
+      }
+      if (items.length > opts.maxExamples) {
+        lines.push(paint("dim", `         ... +${items.length - opts.maxExamples} more`));
+      }
+    }
+    lines.push("");
+  }
+  if (report.findings.length === 0) {
+    lines.push(paint("green", "  Clean. No surface tells on the scanned lines."));
+    lines.push(
+      paint(
+        "dim",
+        "  The loudest tells are structural (tutorial shape, hallucinated APIs, over-engineering)"
+      )
+    );
+    lines.push(paint("dim", "  and need a human or a compiler, not a regex."));
+    lines.push("");
+  } else if (blocking.length === 0) {
+    lines.push(paint("green", "  No blocking findings."));
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// src/report/github.ts
+import { appendFileSync } from "fs";
+var WARNING_ANNOTATION_CAP = 10;
+function escapeData(value) {
+  return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+}
+function escapeProperty(value) {
+  return escapeData(value).replace(/:/g, "%3A").replace(/,/g, "%2C");
+}
+function renderAnnotations(report) {
+  const out = [];
+  let warnings = 0;
+  for (const finding of report.findings) {
+    const level = finding.blocking ? "error" : "warning";
+    if (level === "warning") {
+      warnings++;
+      if (warnings > WARNING_ANNOTATION_CAP) continue;
+    }
+    const title = `unslop-ci ${finding.scanner}/${finding.rule} (${finding.severity})`;
+    const message = `${finding.label}. Fix: ${finding.fix}`;
+    out.push(
+      `::${level} file=${escapeProperty(finding.file)},line=${finding.line},title=${escapeProperty(title)}::${escapeData(message)}`
+    );
+  }
+  const skipped = warnings - WARNING_ANNOTATION_CAP;
+  if (skipped > 0) {
+    out.push(
+      `::notice title=unslop-ci::${skipped} more non-blocking finding${skipped === 1 ? "" : "s"} not annotated; see the job log or JSON report.`
+    );
+  }
+  return out;
+}
+function renderStepSummary(report) {
+  const lines = [];
+  const scope = report.mode === "diff" ? `added lines vs \`${report.base ?? "?"}\`${report.head ? ` \u2192 \`${report.head}\`` : ""}` : "full tree";
+  lines.push(`## unslop-ci \u2014 ${report.blockingCount > 0 ? "blocking findings" : "clean"}`);
+  lines.push("");
+  lines.push(`Scope: ${scope}. Gate: \`${report.failOn}\`.`);
+  lines.push("");
+  lines.push("| scanner | files | high | medium | low | verdict |");
+  lines.push("| --- | ---: | ---: | ---: | ---: | --- |");
+  for (const s of report.scanners) {
+    lines.push(
+      `| ${s.scanner} | ${s.filesScanned} | ${s.counts.high} | ${s.counts.medium} | ${s.counts.low} | ${s.verdict} |`
+    );
+  }
+  lines.push("");
+  const blocking = report.findings.filter((f) => f.blocking);
+  if (blocking.length > 0) {
+    lines.push(`### ${blocking.length} blocking finding${blocking.length === 1 ? "" : "s"}`);
+    lines.push("");
+    lines.push("| file | line | rule | matched | fix |");
+    lines.push("| --- | ---: | --- | --- | --- |");
+    for (const f of blocking) {
+      const match = f.match.replace(/\|/g, "\\|").replace(/`/g, "");
+      const fix = f.fix.replace(/\|/g, "\\|");
+      lines.push(`| \`${f.file}\` | ${f.line} | ${f.scanner}/${f.rule} | \`${match}\` | ${fix} |`);
+    }
+    lines.push("");
+    lines.push(
+      "A line that is intentional can carry `unslop-ignore` (or put `unslop-ignore-next-line` on the line above)."
+    );
+  } else {
+    const warnings = report.findings.length;
+    lines.push(
+      warnings > 0 ? `No blocking findings. ${warnings} non-blocking warning${warnings === 1 ? "" : "s"} annotated.` : "No findings on the scanned lines."
+    );
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function writeStepSummary(report) {
+  const path = process.env.GITHUB_STEP_SUMMARY;
+  if (!path) return false;
+  appendFileSync(path, renderStepSummary(report));
+  return true;
+}
+
+// src/cli-helpers.ts
+import { readFileSync as readFileSync2 } from "fs";
+function resolveBaseFromEnv(env) {
+  if (env.GITHUB_EVENT_PATH) {
+    try {
+      const event = JSON.parse(readFileSync2(env.GITHUB_EVENT_PATH, "utf8"));
+      if (event.pull_request?.base?.sha) return event.pull_request.base.sha;
+      if (event.merge_group?.base_sha) return event.merge_group.base_sha;
+      if (event.before && !/^0+$/.test(event.before)) return event.before;
+    } catch {
+    }
+  }
+  if (env.GITHUB_BASE_REF) return `origin/${env.GITHUB_BASE_REF}`;
+  return void 0;
+}
+
+// src/run.ts
+import { readFileSync as readFileSync3, readdirSync, statSync } from "fs";
+import { extname, join as join2, relative } from "path";
+
+// src/engine.ts
+var IGNORE_MARKER = "unslop-ignore";
+var IGNORE_NEXT_MARKER = "unslop-ignore-next-line";
+function looksMinified(lines) {
+  return lines.length === 1 && (lines[0]?.length ?? 0) > 5e3;
+}
+function isSkippedFilename(name, scanner) {
+  if (!scanner.skipMinified) return false;
+  return name.endsWith(".min.js") || name.endsWith(".min.css") || name.endsWith(".map");
+}
+function toFinding(rule, line, match, snippet) {
+  const finding = {
+    rule: rule.id,
+    label: rule.label,
+    severity: rule.severity,
+    class: rule.class,
+    fix: rule.fix,
+    line,
+    match: match.trim().slice(0, 60),
+    snippet: snippet.trim().slice(0, 160)
+  };
+  if (rule.share !== void 0) finding.share = rule.share;
+  return finding;
+}
+function matchRules(rules, target, rawLine, lineNo, findings) {
+  for (const rule of rules) {
+    if (rule.suppress?.test(rawLine)) continue;
+    for (const rx of rule.patterns) {
+      const m = rx.exec(target);
+      if (m) {
+        findings.push(toFinding(rule, lineNo, m[0], rawLine));
+        break;
+      }
+    }
+  }
+}
+function scanSource(scanner, lines) {
+  const findings = [];
+  let ignoreNext = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const lower = line.toLowerCase();
+    const skip = ignoreNext || lower.includes(IGNORE_MARKER);
+    ignoreNext = lower.includes(IGNORE_NEXT_MARKER);
+    if (skip) continue;
+    matchRules(scanner.rules, line, line, i + 1, findings);
+  }
+  return { findings };
+}
+function stripNoise(line, state) {
+  const out = [];
+  for (const ch of line) {
+    if (state.inCode) {
+      if (ch === "`") state.inCode = false;
+      out.push(" ");
+    } else if (ch === "`") {
+      state.inCode = true;
+      out.push(" ");
+    } else if (ch === '"' || ch === "\u201C" || ch === "\u201D") {
+      state.inQuote = !state.inQuote;
+      out.push(" ");
+    } else {
+      out.push(state.inQuote ? " " : ch);
+    }
+  }
+  return out.join("");
+}
+function scanProse(scanner, lines) {
+  const findings = [];
+  const lineWords = new Array(lines.length + 1).fill(0);
+  let fmEnd = 0;
+  if (lines.length > 0 && (lines[0] ?? "").trim() === "---") {
+    for (let j = 1; j < lines.length; j++) {
+      if ((lines[j] ?? "").trim() === "---") {
+        fmEnd = j + 1;
+        break;
+      }
+    }
+  }
+  let inFence = false;
+  const state = { inCode: false, inQuote: false };
+  let ignoreNext = false;
+  for (let i = 0; i < lines.length; i++) {
+    const lineNo = i + 1;
+    const raw = lines[i] ?? "";
+    if (lineNo <= fmEnd) continue;
+    const stripped = raw.trim();
+    if (!stripped) {
+      state.inCode = false;
+      state.inQuote = false;
+      continue;
+    }
+    if (stripped.startsWith("```") || stripped.startsWith("~~~")) {
+      inFence = !inFence;
+      state.inCode = false;
+      state.inQuote = false;
+      continue;
+    }
+    if (inFence) continue;
+    lineWords[lineNo] = stripped.split(/\s+/).filter(Boolean).length;
+    const lower = raw.toLowerCase();
+    const skip = ignoreNext || lower.includes(IGNORE_MARKER);
+    ignoreNext = lower.includes(IGNORE_NEXT_MARKER);
+    if (skip) {
+      stripNoise(raw, state);
+      continue;
+    }
+    const isQuote = stripped.startsWith(">");
+    const prose = stripNoise(raw, state);
+    for (const rule of scanner.rules) {
+      if (!rule.raw && isQuote) continue;
+      const target = rule.raw ? raw : prose;
+      for (const rx of rule.patterns) {
+        const m = rx.exec(target);
+        if (m) {
+          findings.push(toFinding(rule, lineNo, m[0], stripped));
+          break;
+        }
+      }
+    }
+  }
+  return { findings, lineWords };
+}
+function scanContent(scanner, content) {
+  const lines = content.split(/\r?\n/);
+  if (scanner.skipMinified && looksMinified(lines)) return { findings: [] };
+  return scanner.prose ? scanProse(scanner, lines) : scanSource(scanner, lines);
+}
+
+// src/glob.ts
+var SPECIALS = /[.+^$()|[\]\\]/g;
+function segmentToRegExp(segment) {
+  let out = "";
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i];
+    if (ch === "*") out += "[^/]*";
+    else if (ch === "?") out += "[^/]";
+    else if (ch === "{") {
+      const end = segment.indexOf("}", i);
+      if (end === -1) {
+        out += "\\{";
+      } else {
+        const alts = segment.slice(i + 1, end).split(",").map((a) => a.replace(SPECIALS, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]"));
+        out += `(?:${alts.join("|")})`;
+        i = end;
+      }
+    } else out += ch.replace(SPECIALS, "\\$&");
+  }
+  return out;
+}
+function globToRegExp(glob) {
+  let pattern = glob.replace(/\\/g, "/");
+  if (pattern.endsWith("/")) pattern += "**";
+  const segments = pattern.split("/");
+  const parts = [];
+  for (let i = 0; i < segments.length; i++) {
+    const seg = segments[i];
+    if (seg === "**") {
+      parts.push(i === segments.length - 1 ? ".*" : "(?:[^/]+/)*");
+    } else {
+      parts.push(segmentToRegExp(seg) + (i === segments.length - 1 ? "" : "/"));
+    }
+  }
+  return new RegExp(`^${parts.join("")}$`);
+}
+var GlobSet = class {
+  regexes;
+  basenames;
+  constructor(globs) {
+    this.regexes = [];
+    this.basenames = [];
+    for (const g of globs) {
+      this.regexes.push(globToRegExp(g));
+      if (!g.includes("/")) this.basenames.push(globToRegExp(g));
+    }
+  }
+  matches(path) {
+    const posix = path.replace(/\\/g, "/").replace(/^\.\//, "");
+    if (this.regexes.some((rx) => rx.test(posix))) return true;
+    const base = posix.split("/").pop() ?? posix;
+    return this.basenames.some((rx) => rx.test(base));
+  }
+  get isEmpty() {
+    return this.regexes.length === 0;
+  }
+};
+
+// src/gate.ts
+function isBlocking(finding, failOn) {
+  switch (failOn) {
+    case "high":
+      return finding.severity === "high";
+    case "high+bugs":
+      return finding.severity === "high" || finding.class === "bug";
+    case "medium":
+      return finding.severity === "high" || finding.severity === "medium" || finding.class === "bug";
+    case "any":
+      return true;
+  }
+}
+
+// src/rules/code.ts
+var CMT = String.raw`(?://|#|/\*|\*|--|<!--)`;
+var EMOJI = String.raw`\u{1F300}-\u{1FAFF}\u{2600}-\u{27BF}\u{1F000}-\u{1F0FF}\u{2B00}-\u{2BFF}\u{1F900}-\u{1F9FF}\u{2764}`;
+var iu = (src) => new RegExp(src, "iu");
+var u = (src) => new RegExp(src, "u");
+var CODE_RULES = [
+  {
+    id: "chat-artifact",
+    label: "Leftover chat / assistant / markdown artifact in the code",
+    severity: "high",
+    class: "cosmetic",
+    share: "verified 1.2%, but unmistakable when present",
+    fix: "Delete the assistant's voice before committing: code fences, 'Here's the updated code', 'As an AI', 'Good catch!', a trailing 'Note:'.",
+    patterns: [
+      iu("^\\s*```"),
+      iu(
+        String.raw`\bhere'?s the (updated|complete|full|fixed|revised|new) (code|version|implementation|file)\b`
+      ),
+      iu(String.raw`\bas an? (ai|a\.i\.) (language )?model\b`),
+      iu(String.raw`\bas a large language model\b`),
+      iu(String.raw`\b(good|great) catch!`),
+      iu(String.raw`\byou'?re absolutely right\b`),
+      iu(String.raw`^\s*` + CMT + String.raw`\s*(note|remember|important|keep in mind|tip)\s*:`),
+      iu(String.raw`\b(certainly|sure)! here('?s| is)\b`),
+      iu(String.raw`\bi'?ll (add|update|fix|implement) .{0,40}\bnow\b`),
+      iu(String.raw`\bi hope this helps\b`),
+      iu(String.raw`\blet me know if you'?d?\s*(like|need|want)\b`)
+    ]
+  },
+  {
+    id: "placeholder-comment",
+    label: 'Placeholder / ellipsis comment left in ("// rest of your code")',
+    severity: "high",
+    class: "bug",
+    share: "verified 1.6%, precision ~100%",
+    fix: "Write the actual code. These '... rest of the code' stubs mean the file is unfinished, not just untidy.",
+    patterns: [
+      iu(CMT + String.raw`\s*\.{2,}\s*(rest|the rest|your|remaining|existing|previous|other)\b`),
+      iu(
+        CMT + String.raw`\s*(rest|remainder) of (your |the |my )?(code|implementation|logic|function|file|owl)\b`
+      ),
+      iu(CMT + String.raw`\s*(your|the) (code|logic|implementation|stuff) (goes )?here\b`),
+      iu(
+        CMT + String.raw`\s*(add|insert|implement|put) (your )?(code|logic|implementation) here\b`
+      ),
+      iu(CMT + String.raw`\s*(implementation|code|logic) (goes |go )?here\b`),
+      iu(CMT + String.raw`\s*existing code (here|unchanged|stays|remains)\b`),
+      iu(CMT + String.raw`\s*\.\.\. ?\((?:rest|your|the|existing)[^)]*\)`),
+      iu(CMT + String.raw`\s*TODO:?\s*(implement|add|fill in|finish)\b`)
+    ]
+  },
+  {
+    id: "emoji-in-code",
+    label: "Emoji in code, comments, strings, logs, or commit text",
+    severity: "medium",
+    class: "cosmetic",
+    share: "verified 3.9%, precision ~77% (the highest-precision cosmetic tell)",
+    fix: "Remove emoji from source. They survive from the model\u2019s chat output and read as vibe-coded.",
+    patterns: [iu(`[${EMOJI}]`)]
+  },
+  {
+    id: "swallowed-errors",
+    label: "Catch-all / swallowed errors (bare except, empty catch, empty Go err block)",
+    severity: "medium",
+    class: "bug",
+    share: "verified 3.1% (try/except wrapped around everything)",
+    fix: "Catch specific exceptions and handle them. A bare except, an empty catch, or an empty `if err != nil {}` eats the one clue you needed.",
+    patterns: [
+      iu(String.raw`^\s*except\s*:`),
+      iu(String.raw`^\s*except\s+(Exception|BaseException)\s*:\s*(pass|\.\.\.|$)`),
+      iu(String.raw`\bcatch\s*\([^)]*\)\s*\{\s*\}`),
+      iu(String.raw`\bcatch\s*\{\s*\}`),
+      iu(String.raw`\brescue\s*=>\s*\w+\s*$`),
+      iu(String.raw`\bcatch\s*\([^)]*\)\s*\{\s*//`),
+      iu(String.raw`\bif\s+err\s*!=\s*nil\s*\{\s*\}`),
+      iu(String.raw`\bif\s+err\s*!=\s*nil\s*\{\s*//`)
+    ]
+  },
+  {
+    id: "narrating-comment",
+    label: "Narrating comment that restates the obvious / step-by-step '# Step 1'",
+    severity: "medium",
+    class: "cosmetic",
+    share: "verified 8.5% (over-commenting; the regex catches the obvious-restatement subset)",
+    fix: "Cut comments that say what the next line plainly does. Comment why, not what.",
+    patterns: [
+      iu(CMT + String.raw`\s*(step\s*\d+\b|now we\b|first,|next,|then,|finally,)`),
+      iu(
+        CMT + String.raw`\s*(increment|decrement|initialize|declare|define|create|instantiate|loop (over|through)|iterate over|return the|set the|get the|assign|call the)\b`
+      ),
+      iu(
+        CMT + String.raw`\s*this (function|method|line|loop|variable|class|block) (does|is|will|handles|returns|creates)\b`
+      ),
+      iu(
+        CMT + String.raw`\s*(import|importing) (the |required )?(libraries|modules|dependencies)\b`
+      )
+    ]
+  },
+  {
+    id: "generic-naming",
+    label: "Generic placeholder function name (process_data, handleData, doStuff)",
+    severity: "medium",
+    class: "cosmetic",
+    share: "verified 1.9%, precision ~100% (process_data() is the canonical example)",
+    fix: "Name it for what it actually does in this domain. process_data() that does 11 things is the AI tell.",
+    patterns: [
+      iu(
+        String.raw`\b(def|function|func|fn|fun|sub)\s+(process_?[Dd]ata|handle_?[Dd]ata|do_?[Ss]tuff|do_?[Ss]omething|my_?[Ff]unction|process_?[Ii]tem|process_?[Ii]nput|main_?[Ff]unction)\b`
+      ),
+      iu(String.raw`\b(process_?[Dd]ata|handle_?[Dd]ata|do_?[Ss]tuff|do_?[Ss]omething)\s*\(`)
+    ]
+  },
+  {
+    id: "verbose-naming",
+    label: "Over-verbose, robotically self-documenting identifier",
+    severity: "low",
+    class: "cosmetic",
+    share: "verified 0.4% (inflated; people mostly argue FOR descriptive names)",
+    fix: "A name that is a whole sentence (getUserDataFromApiResponseHandler) reads as machine-generated. Trim it.",
+    caseSensitive: true,
+    patterns: [
+      u(String.raw`\b[a-z]+([A-Z][a-z0-9]+){4,}\b`),
+      u(String.raw`\b[a-z]+(_[a-z0-9]+){5,}\b`)
+    ]
+  },
+  {
+    id: "boilerplate-marker",
+    label: "Boilerplate / dummy-data marker (placeholder keys, sample data, 'Successfully' logs)",
+    severity: "low",
+    class: "cosmetic",
+    share: "weak proxy for the #1 tell (tutorial-shaped code), which is otherwise not regex-detectable",
+    fix: "Replace generated dummy data and placeholders with the real thing. Tutorial-shaped sample data is the loudest tell, but only a human can judge the shape.",
+    patterns: [
+      iu(String.raw`\blorem ipsum\b`),
+      iu(String.raw`\b(your|my)[-_]?api[-_]?key\b`),
+      iu(String.raw`\bYOUR_API_KEY\b`),
+      iu(String.raw`\bexample\.com\b`),
+      iu(String.raw`\b(John|Jane) (Doe|Smith)\b`),
+      iu(String.raw`['"]sk-(xxx|your|placeholder|123)`),
+      iu(
+        String.raw`(console\.log|print|println|fmt\.Print\w*|System\.out\.print\w*)\s*\(\s*['"](\u{2705}|\u{1F680}|Successfully|Done!|Here we go)`
+      )
+    ]
+  }
+];
+var codeScanner = {
+  name: "code",
+  title: "unslop-code",
+  exts: /* @__PURE__ */ new Set([
+    ".py",
+    ".js",
+    ".jsx",
+    ".ts",
+    ".tsx",
+    ".java",
+    ".go",
+    ".rs",
+    ".rb",
+    ".php",
+    ".c",
+    ".h",
+    ".cpp",
+    ".cc",
+    ".hpp",
+    ".cs",
+    ".kt",
+    ".kts",
+    ".swift",
+    ".scala",
+    ".m",
+    ".mm",
+    ".sh",
+    ".bash",
+    ".lua",
+    ".dart",
+    ".vue",
+    ".svelte",
+    ".sql",
+    ".r"
+  ]),
+  skipDirs: /* @__PURE__ */ new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".next",
+    "out",
+    "vendor",
+    "target",
+    "coverage",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".idea",
+    ".gradle",
+    "bin",
+    "obj"
+  ]),
+  rules: CODE_RULES,
+  skipMinified: true,
+  prose: false
+};
+
+// src/rules/text.ts
+var EMOJI2 = String.raw`\u{1F300}-\u{1FAFF}\u{2600}-\u{27BF}\u{1F000}-\u{1F0FF}\u{2190}-\u{21FF}\u{2B00}-\u{2BFF}\u{FE00}-\u{FE0F}\u{2764}`;
+var iu2 = (src) => new RegExp(src, "iu");
+var TEXT_RULES = [
+  {
+    id: "em-dash",
+    label: "Em dash (the single most-cited AI tell)",
+    severity: "high",
+    class: "cosmetic",
+    share: "cited 7.1% / matched 4.5%",
+    raw: true,
+    fix: "Cut it. Use a comma, a period, or parentheses. Do not just swap in a colon; people flag that now too.",
+    patterns: [iu2("\u2014"), iu2("\u2013\u2013"), iu2(String.raw`\s–\s`)]
+  },
+  {
+    id: "not-just-x-y",
+    label: `"It's not just X, it's Y" / "not X, but Y" antithesis cadence`,
+    severity: "high",
+    class: "cosmetic",
+    share: "cited 2.8% / matched 1.9%",
+    fix: "State the thing plainly. The negate-then-assert rhythm is the clearest 'AI accent'.",
+    patterns: [
+      iu2(
+        String.raw`\b(it'?s|its|it is|that'?s|this is|they'?re)\s+not\s+(just|only|merely|simply)\b[^.?!\n]{0,60}\bit'?s\b`
+      ),
+      iu2(String.raw`\bnot\s+(just|only|merely|simply)\s+(a |an |the )?[\w-]+,?\s+but\b`),
+      iu2(String.raw`\bisn'?t\s+(just|only|merely)\b[^.?!\n]{0,60}\bit'?s\b`)
+    ]
+  },
+  {
+    id: "assistant-boilerplate",
+    label: 'Leftover assistant boilerplate ("as an AI language model", a knowledge-cutoff line, a refusal)',
+    severity: "high",
+    class: "cosmetic",
+    share: "cited 1.2%, the ultimate proof when present",
+    fix: "Delete every trace of the assistant voice before publishing: disclaimers, refusals, cutoff dates.",
+    patterns: [
+      iu2(String.raw`\bas an?\s+(ai|a\.i\.)\s+(language\s+)?model\b`),
+      iu2(String.raw`\bas a large language model\b`),
+      iu2(
+        String.raw`\bi (cannot|can'?t|am unable to)\s+(assist|help|fulfil|fulfill|comply|provide)\b`
+      ),
+      iu2(String.raw`\bknowledge cut[- ]?off\b`),
+      iu2(String.raw`\bas of my last (knowledge )?(update|training)\b`),
+      iu2(String.raw`\bi (do not|don'?t) have (personal|the ability|access|feelings|opinions)\b`)
+    ]
+  },
+  {
+    id: "sycophancy-opener",
+    label: `Sycophantic opener ("Great question!", "Certainly!", "I'd be happy to")`,
+    severity: "high",
+    class: "cosmetic",
+    share: "cited 2.5% (sycophancy is the #4 cited tell)",
+    fix: "Drop the flattery and the reflexive agreement. Open with the actual point. Disagree when warranted.",
+    patterns: [
+      iu2(String.raw`\b(great|good|excellent|that'?s a (great|good))\s+question\b`),
+      iu2(
+        String.raw`(^|["'` + "`" + String.raw`(]\s*)(certainly|absolutely|sure thing|of course)\s*[!,]`
+      ),
+      iu2(String.raw`\bi'?d be (happy|glad|delighted) to\b`),
+      iu2(String.raw`\bhappy to help\b`),
+      iu2(String.raw`\byou'?re absolutely right\b`),
+      iu2(String.raw`\bwhat a (great|fascinating|wonderful)\b`)
+    ]
+  },
+  {
+    id: "bolded-lead-in",
+    label: "Bolded lead-in label (**Word:** then a sentence) / title-case mini-headings",
+    severity: "high",
+    class: "cosmetic",
+    share: "matched 2.8% (n=220), rank 3 by keyword pass",
+    fix: "Write a normal sentence without the boldface label. The **Bold:** then clause pattern is a giveaway.",
+    patterns: [
+      iu2(String.raw`(^|\s)\*\*[^*\n]{2,40}:\*\*\s`),
+      iu2(String.raw`(^|\s)\*\*[^*\n]{2,40}\*\*\s*:`),
+      iu2(String.raw`(^|\s)__[^_\n]{2,40}:?__\s*:?\s`)
+    ]
+  },
+  {
+    id: "assistant-offer",
+    label: 'Trailing assistant offer ("Would you like me to ...", "Let me know if ...", "I hope this helps!")',
+    severity: "high",
+    class: "cosmetic",
+    share: "cited 0.4% each, but unmistakable when present",
+    fix: "Delete the meta-offer and the sign-off. A person finishing a thought does not ask if you want a revision.",
+    patterns: [
+      iu2(String.raw`\bwould you like me to\b`),
+      iu2(String.raw`\blet me know if you'?d?\s*(like|need|want|have)\b`),
+      iu2(String.raw`\bi hope this helps\b`),
+      iu2(String.raw`\bhope (this|you'?re|it) .{0,20}finds? you well\b`),
+      iu2(String.raw`\bfeel free to (ask|reach|let me)\b`),
+      iu2(String.raw`\bis there anything else\b`)
+    ]
+  },
+  {
+    id: "ai-diction",
+    label: "AI diction memes (delve, tapestry, leverage, seamless, game-changer, ...)",
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited ~1.3% as a cluster; the keyword pass inflates it (listicle copying)",
+    fix: "Swap for the plain word you would actually say. 'delve into' is 'look at'; 'leverage' is 'use'.",
+    patterns: [
+      iu2(String.raw`\b(delv(e|es|ing|ed))\b`),
+      iu2(String.raw`\btapestr(y|ies)\b`),
+      iu2(String.raw`\bgame[- ]?chang(er|ers|ing)\b`),
+      iu2(String.raw`\bseamless(ly)?\b`),
+      iu2(String.raw`\bleverag(e|es|ing|ed)\b`),
+      iu2(String.raw`\bunleash(es|ing|ed)?\b`),
+      iu2(String.raw`\bunderscore(s|d|ing)?\b`),
+      iu2(String.raw`\btestament\b`),
+      iu2(String.raw`\bembark(s|ing|ed)?\b`),
+      iu2(String.raw`\bmeticulous(ly)?\b`),
+      iu2(String.raw`\bnuanc(e|es|ed)\b`),
+      iu2(String.raw`\belevat(e|es|ing|ed)\b`),
+      iu2(String.raw`\bharness(es|ing|ed)?\b`),
+      iu2(String.raw`\bshowcas(e|es|ing|ed)\b`),
+      iu2(String.raw`\bcaptivat(e|es|ing|ed)\b`),
+      iu2(String.raw`\bever[- ]?(evolving|changing)\b`)
+    ]
+  },
+  {
+    id: "dive-in",
+    label: `"Dive in" / "deep dive" / "let's dive"`,
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited 2.0% / matched 1.6%",
+    fix: "Cut the metaphor and just start the topic. You do not need to announce that you are starting.",
+    patterns: [iu2(String.raw`\b(deep dive|dives? in(to)?|let'?s dive|diving in|dive deep)\b`)]
+  },
+  {
+    id: "listicle-scaffold",
+    label: 'Listicle scaffolding ("5 ways to ...", "7 signs ...", "3 reasons ...")',
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited 1.7% (everything turned into a list)",
+    fix: "Write prose paragraphs. Reserve bullets for genuinely list-like content, not as the default shape.",
+    patterns: [
+      iu2(
+        String.raw`(^|\s)#{0,4}\s*\d+\s+(ways|tips|signs|reasons|things|steps|tricks|secrets|lessons|mistakes|rules)\b`
+      )
+    ]
+  },
+  {
+    id: "fast-paced-opener",
+    label: `Hollow scene-setting opener ("In today's fast-paced world ...")`,
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited 0.7%, iconic",
+    fix: "Delete it and start with something specific. The opener says nothing.",
+    patterns: [
+      iu2(
+        String.raw`\bin today'?s\s+(fast[- ]?paced|digital|ever[- ]?changing|modern|competitive)?\s*(world|age|landscape|era|society|market)\b`
+      ),
+      iu2(String.raw`\bin (the|this) (modern|digital) (world|age|era)\b`)
+    ]
+  },
+  {
+    id: "unlock-potential",
+    label: '"Unlock / unleash the power / potential"',
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited 0.8%",
+    fix: "Say what the thing actually does. The hype verb plus 'potential' is marketing filler.",
+    patterns: [
+      iu2(
+        String.raw`\b(unlock|unleash|harness|tap into)\w*\s+(the\s+|your\s+|its\s+|their\s+|full\s+)*(power|potential|capabilities|secrets)\b`
+      )
+    ]
+  },
+  {
+    id: "emoji-decoration",
+    label: "Emoji used as bullets, icons, or in headings",
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited 0.8% (emoji bullets / headers)",
+    fix: "Use plain text headers and real list markers. Decorative emoji in headings reads as templated.",
+    patterns: [
+      iu2(String.raw`^\s{0,3}#{1,6}\s*[${EMOJI2}]`),
+      iu2(String.raw`^\s{0,3}[${EMOJI2}]\s+\S`),
+      iu2(String.raw`[${EMOJI2}]\s*\*\*`),
+      iu2(String.raw`\*\*\s*[${EMOJI2}]`)
+    ]
+  },
+  {
+    id: "in-conclusion",
+    label: '"In conclusion" / "in summary" / "to summarize" closer',
+    severity: "medium",
+    class: "cosmetic",
+    share: "cited 0.2% / matched 1.0%, a classic giveaway",
+    fix: "End on a real last point, not a signposted recap. If the reader needs a summary, the piece is too long.",
+    patterns: [
+      iu2(String.raw`\bin (conclusion|summary)\b`),
+      iu2(String.raw`\bto (summari[sz]e|conclude|wrap (this |it )?up)\b`),
+      iu2(String.raw`\bin closing\b`)
+    ]
+  },
+  {
+    id: "transition-stack",
+    label: "Stacked formal connectives (Moreover, Furthermore, Additionally, ...)",
+    severity: "low",
+    class: "cosmetic",
+    share: "matched 1.7%, but the keyword pass over-counts (often the poster\u2019s own prose)",
+    fix: "Let ideas connect without scaffolding. As a sentence opener these read as machine-smoothed.",
+    patterns: [
+      iu2(String.raw`(^|\.\s+|\n)\s*(moreover|furthermore|additionally|consequently)\b`),
+      iu2(String.raw`\b(firstly|secondly|thirdly|lastly)\b`)
+    ]
+  },
+  {
+    id: "generic-diction",
+    label: "Inflated generic diction (utilize, comprehensive, robust, crucial, navigate, ...)",
+    severity: "low",
+    class: "cosmetic",
+    share: "matched 1 to 2% each, but mostly the poster\u2019s own prose",
+    fix: "Prefer the plain word: 'utilize' is 'use', 'comprehensive' is 'full', 'navigate' is 'handle'.",
+    patterns: [
+      iu2(String.raw`\butili[sz](e|es|ing|ed|ation)\b`),
+      iu2(String.raw`\bcomprehensive\b`),
+      iu2(String.raw`\brobust\b`),
+      iu2(String.raw`\bfacilitat(e|es|ing|ed)\b`),
+      iu2(String.raw`\bstreamlin(e|es|ing|ed)\b`),
+      iu2(String.raw`\bempower(s|ing|ed|ment)?\b`),
+      iu2(String.raw`\bmyriad\b`),
+      iu2(String.raw`\bplethora\b`),
+      iu2(String.raw`\bparamount\b`),
+      iu2(String.raw`\bpivotal\b`),
+      iu2(String.raw`\bholistic\b`),
+      iu2(String.raw`\bsynerg(y|ies|istic)\b`),
+      iu2(String.raw`\bmultifaceted\b`),
+      iu2(String.raw`\bintricac(y|ies)\b`)
+    ]
+  },
+  {
+    id: "hype-marketing",
+    label: "Marketing hype (revolutionary, transformative, take it to the next level)",
+    severity: "low",
+    class: "cosmetic",
+    share: "cited 0.3% (broader marketing-language category)",
+    fix: "Strip the promotional adjectives and state plain facts about what it does.",
+    patterns: [
+      iu2(String.raw`\brevolution(ary|i[sz]e)\b`),
+      iu2(String.raw`\btransform(ative|s your| ative)\b`),
+      iu2(String.raw`\btransform your (life|business|workflow)\b`),
+      iu2(String.raw`\bto the next level\b`),
+      iu2(String.raw`\bsupercharge\b`),
+      iu2(String.raw`\bsay goodbye to\b`),
+      iu2(String.raw`\blook no further\b`),
+      iu2(String.raw`\bbuckle up\b`),
+      iu2(String.raw`\bgame[- ]?changer\b`),
+      iu2(String.raw`\bwithout further ado\b`)
+    ]
+  },
+  {
+    id: "hedge-cliche",
+    label: 'Hedging / both-sides cliche ("it depends", "on one hand ... on the other")',
+    severity: "low",
+    class: "cosmetic",
+    share: "cited 0.3% (the regex sees the phrase, not the hedging)",
+    fix: "Take a position. Listing every option instead of committing is a tell.",
+    patterns: [
+      iu2(String.raw`\bon (the )?one hand\b[^.\n]{0,120}\bon the other\b`),
+      iu2(String.raw`\bit (really )?depends\b`),
+      iu2(String.raw`\bthere'?s no (one[- ]?size[- ]?fits[- ]?all|right answer)\b`)
+    ]
+  },
+  {
+    id: "note-hedge",
+    label: `"It's worth noting" / "it's important to note" filler`,
+    severity: "low",
+    class: "cosmetic",
+    share: "cited 0.4 to 0.6%",
+    fix: "If it is worth noting, just note it. The preamble adds nothing.",
+    patterns: [
+      iu2(String.raw`\bit'?s worth (noting|mentioning|pointing out)\b`),
+      iu2(String.raw`\b(it'?s |it is )?important to (note|remember|understand|recognize)\b`),
+      iu2(String.raw`\bthat being said\b`),
+      iu2(String.raw`\bneedless to say\b`)
+    ]
+  },
+  {
+    id: "hr-divider",
+    label: "Horizontal-rule dividers (---, ***) between sections",
+    severity: "low",
+    class: "cosmetic",
+    share: "novel, from a vivid citation ('another obvious AI writing marker')",
+    fix: "Use a paragraph break. The rule between every section reads as generated markdown.",
+    // Upstream's `[\s\1]` char class is a Python octal-escape quirk; the
+    // intent (three or more divider chars, optional trailing filler) is
+    // preserved here with an explicit class.
+    patterns: [iu2(String.raw`^\s{0,3}([-*_])\s*\1\s*\1[-*_\s]*$`)]
+  },
+  {
+    id: "honestly-opener",
+    label: 'Fake-relatability opener ("Honestly, ...", "Look, I get it", "Imagine this")',
+    severity: "low",
+    class: "cosmetic",
+    share: "novel; a top thread is devoted to 'Honestly' being 'zombified by AI'",
+    fix: "Cut the throat-clearing and start with the actual point.",
+    patterns: [
+      iu2(String.raw`(^|\n)\s*honestly,\s`),
+      iu2(String.raw`\blook,\s+i (get it|know)\b`),
+      iu2(String.raw`(^|\n)\s*(imagine|picture) this\b`),
+      iu2(String.raw`\blet'?s be (honest|real)\b`)
+    ]
+  }
+];
+var textScanner = {
+  name: "text",
+  title: "unslop-text",
+  exts: /* @__PURE__ */ new Set([".md", ".markdown", ".mdx", ".txt", ".text", ".rst", ".html", ".htm"]),
+  skipDirs: /* @__PURE__ */ new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".next",
+    "out",
+    "vendor",
+    "coverage",
+    "__pycache__",
+    ".venv",
+    "venv"
+  ]),
+  rules: TEXT_RULES,
+  skipMinified: false,
+  prose: true
+};
+
+// src/rules/ui.ts
+var iu3 = (src) => new RegExp(src, "iu");
+var UI_RULES = [
+  {
+    id: "shadcn-default-card",
+    label: "Untouched shadcn default Card / theme",
+    severity: "high",
+    class: "cosmetic",
+    fix: "Theme the tokens (primary, radius, neutrals, spacing). Stock defaults are the giveaway, not shadcn.",
+    patterns: [
+      iu3(String.raw`rounded-lg\s+border\s+bg-card\s+text-card-foreground\s+shadow-sm`),
+      iu3(String.raw`"baseColor"\s*:\s*"(slate|zinc|gray|neutral|stone)"`),
+      iu3(String.raw`--radius\s*:\s*0\.5rem`)
+    ]
+  },
+  {
+    id: "ai-purple",
+    label: "AI purple / indigo / violet as primary color",
+    severity: "high",
+    class: "cosmetic",
+    fix: "Pick a brand color outside the violet/indigo/purple band. It is Tailwind's default, so it reads as 'nobody chose this'.",
+    patterns: [
+      iu3(
+        String.raw`\b(bg|text|from|via|to|border|ring|fill|stroke|decoration|outline)-(indigo|violet|purple|fuchsia)-(400|500|600|700|800)\b`
+      ),
+      iu3(
+        String.raw`#(6366f1|4f46e5|818cf8|7c3aed|6d28d9|8b5cf6|a855f7|9333ea|7e22ce|c026d3|d946ef)\b`
+      )
+    ]
+  },
+  {
+    id: "gradient-text",
+    label: "Gradient-filled text (heading/hero)",
+    severity: "high",
+    class: "cosmetic",
+    fix: "Solid color on headings and copy. Gradient body text is one of the strongest AI tells.",
+    patterns: [
+      iu3(String.raw`bg-clip-text\s+[^"'` + "`" + String.raw`]*text-transparent`),
+      iu3(String.raw`text-transparent\s+[^"'` + "`" + String.raw`]*bg-clip-text`),
+      iu3(String.raw`-webkit-background-clip\s*:\s*text`),
+      iu3(String.raw`\bbackground-clip\s*:\s*text`)
+    ]
+  },
+  {
+    id: "purple-blue-gradient",
+    label: "Purple-to-blue/pink gradient",
+    severity: "high",
+    class: "cosmetic",
+    fix: "Default to solid fills. If you must gradient, keep stops analogous and low-contrast, never the rainbow purple-to-blue.",
+    patterns: [
+      iu3(
+        String.raw`from-(purple|violet|indigo|fuchsia)-\d+\s+(via-[a-z]+-\d+\s+)?to-(blue|indigo|pink|cyan|sky)-\d+`
+      ),
+      iu3(String.raw`linear-gradient\([^)]*#(6366f1|7c3aed|8b5cf6|a855f7)[^)]*\)`)
+    ]
+  },
+  {
+    id: "claude-default-look",
+    label: "The 'tasteful default' look (cream background + serif display)",
+    severity: "high",
+    class: "cosmetic",
+    fix: "This is the 2026 tell, not the fix. Anchor color and type to the real brand or a reference. If cream + serif is a genuine decision, mark the line unslop-ignore.",
+    patterns: [
+      iu3(String.raw`#(faf8f5|f5f1e8|f3eee3|fdfbf7|f7f3ec|faf6ef|f6f1e7|fbf7f0|f4efe4)\b`),
+      iu3(String.raw`\bbg-(stone|amber|orange)-(50|100)\b`),
+      iu3(
+        String.raw`\b(Instrument\s*Serif|Fraunces|Playfair\s*Display|Cormorant|Spectral|DM\s*Serif)\b`
+      )
+    ]
+  },
+  {
+    id: "hero-three-cards",
+    label: "Centered hero + three-feature-card grid skeleton",
+    severity: "medium",
+    class: "cosmetic",
+    fix: "Break the grid. Asymmetric hero with a real screenshot; vary sections instead of stacked 3-up icon cards.",
+    patterns: [iu3(String.raw`grid-cols-1\s+(sm:grid-cols-2\s+)?md:grid-cols-3`)]
+  },
+  {
+    id: "rounded-everything",
+    label: "Large rounded corners / pill buttons everywhere",
+    severity: "medium",
+    class: "cosmetic",
+    fix: "Use a small, intentional radius scale by role. Not everything maximally rounded; pills only occasionally.",
+    patterns: [
+      iu3(String.raw`\brounded-(2xl|3xl|full)\b`),
+      iu3(String.raw`border-radius\s*:\s*(999\d*px|9999px)`)
+    ],
+    // rounded-full on a small sized box is a status dot / avatar / icon,
+    // not a pill button. Skip those.
+    suppress: iu3(String.raw`\b[hw]-(\d|10|11|12|14|16)(\.5)?\b`)
+  },
+  {
+    id: "fade-in-animations",
+    label: "Boilerplate fade-in / hover-grow / scroll animation",
+    severity: "medium",
+    class: "cosmetic",
+    fix: "Motion only when it communicates something; gate behind prefers-reduced-motion. Minor tell, noisier signal.",
+    patterns: [
+      iu3(String.raw`initial=\{\{\s*opacity:\s*0`),
+      iu3(String.raw`whileInView`),
+      iu3(String.raw`whileHover=\{\{\s*scale`),
+      iu3(String.raw`data-aos\s*=`),
+      iu3(String.raw`\bhover:scale-1\d{2}\b`)
+    ]
+  },
+  {
+    id: "neon-glow",
+    label: "Unprompted neon glow shadow",
+    severity: "medium",
+    class: "cosmetic",
+    fix: "Remove glow you did not deliberately design. Dark mode should rely on contrast, not glow.",
+    patterns: [
+      iu3(String.raw`shadow-\[0_0_`),
+      iu3(String.raw`drop-shadow-\[0_0_`),
+      iu3(String.raw`text-shadow\s*:[^;]*\d+px[^;]*(rgba|#|hsl)`),
+      iu3(String.raw`box-shadow\s*:[^;]*\b0\s+0\s+\d{2,}px`)
+    ]
+  },
+  {
+    id: "emoji-as-icons",
+    label: "Emoji used as icons / section bullets",
+    severity: "medium",
+    class: "cosmetic",
+    fix: "Use a real SVG icon set (Lucide/Phosphor/Heroicons) or none. Emoji-as-UI signals low effort.",
+    patterns: [
+      iu3(
+        String.raw`[\u{1F680}\u{2728}\u{26A1}\u{1F525}\u{1F4A1}\u{1F512}\u{2705}\u{1F3AF}\u{1F31F}\u{1F6E1}\u{1F4C8}\u{1F511}\u{1F389}]`
+      )
+    ]
+  },
+  {
+    id: "generic-font",
+    label: "Generic default font (Inter / Geist / Roboto / system)",
+    severity: "medium",
+    class: "cosmetic",
+    fix: "Choose a typeface with character and pair a display + body face. The starter font reads as 'no choice made'.",
+    patterns: [
+      iu3(String.raw`font-family\s*:\s*['"]?(Inter|Geist|Roboto)\b`),
+      iu3(String.raw`\b(Inter|Geist|Geist_Mono|Roboto)\s*\(`),
+      iu3(String.raw`fontFamily\s*:\s*\{[^}]*['"](Inter|Geist|Roboto)`)
+    ]
+  },
+  {
+    id: "hype-copy",
+    label: "Generated marketing copy cliche",
+    severity: "low",
+    class: "cosmetic",
+    fix: "Say what the product literally does, with specifics. Cut the template hype words.",
+    patterns: [
+      iu3(String.raw`\bTransform your\b`),
+      iu3(String.raw`\bSupercharge\b`),
+      iu3(String.raw`\bUnleash\b`),
+      iu3(String.raw`\bEffortlessly\b`),
+      iu3(String.raw`\breimagined\b`),
+      iu3(String.raw`take your [^.]{0,30}to the next level`),
+      iu3(String.raw`\bGame-?changer\b`)
+    ]
+  },
+  {
+    id: "stock-illustration",
+    label: "Generic blob / stock illustration source",
+    severity: "low",
+    class: "cosmetic",
+    fix: "Use real screenshots or commissioned art instead of undraw-style blobs.",
+    patterns: [iu3("undraw"), iu3("storyset"), iu3(String.raw`\bdrawkit\b`)]
+  }
+];
+var uiScanner = {
+  name: "ui",
+  title: "unslop-ui",
+  exts: /* @__PURE__ */ new Set([
+    ".html",
+    ".htm",
+    ".css",
+    ".scss",
+    ".sass",
+    ".less",
+    ".js",
+    ".jsx",
+    ".ts",
+    ".tsx",
+    ".vue",
+    ".svelte",
+    ".astro",
+    ".mdx"
+  ]),
+  skipDirs: /* @__PURE__ */ new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".next",
+    "out",
+    "vendor",
+    "coverage",
+    ".svelte-kit",
+    ".astro",
+    ".turbo",
+    ".cache",
+    "__pycache__"
+  ]),
+  rules: UI_RULES,
+  skipMinified: true,
+  prose: false
+};
+
+// src/types.ts
+var SEVERITY_WEIGHT = { high: 3, medium: 2, low: 1 };
+
+// src/verdict.ts
+function countBySeverity(findings) {
+  const counts = { high: 0, medium: 0, low: 0 };
+  for (const f of findings) counts[f.severity]++;
+  return counts;
+}
+function weightedScore(counts) {
+  return counts.high * SEVERITY_WEIGHT.high + counts.medium * SEVERITY_WEIGHT.medium + counts.low * SEVERITY_WEIGHT.low;
+}
+function densityPer1kWords(weighted, words) {
+  return weighted / Math.max(words, 1) * 1e3;
+}
+function verdict(scanner, counts, weighted, words) {
+  if (scanner === "text") {
+    const hi = counts.high;
+    const med = counts.medium;
+    if (weighted === 0) return "Clean, no tells detected";
+    const w = words ?? 0;
+    const dens = densityPer1kWords(weighted, w);
+    if (hi === 0 && med === 0) return "Mostly clean, minor tells";
+    if (hi >= 3 || weighted >= 15 || w >= 300 && dens >= 10) return "STRONG AI-writing tells";
+    if (hi >= 1) return "Some AI tells present";
+    if (weighted >= 6 && !(w >= 600 && dens < 2)) return "Some AI tells present";
+    return "Mostly clean, minor tells";
+  }
+  const strong = scanner === "ui" ? "STRONG AI-default look" : "STRONG AI-written-code tells";
+  const some = scanner === "ui" ? "Some AI defaults present" : "Some AI tells present";
+  const clean = scanner === "ui" ? "Clean, no tells detected" : "Clean, no surface tells detected";
+  if (counts.high >= 3 || weighted >= 15) return strong;
+  if (counts.high >= 1 || weighted >= 6) return some;
+  if (weighted > 0) return "Mostly clean, minor tells";
+  return clean;
+}
+
+// src/run.ts
+var ALL_SCANNERS = [codeScanner, textScanner, uiScanner];
+function effectiveRules(def, cfg) {
+  const scannerCfg = cfg.scanners?.[def.name];
+  const disabled = /* @__PURE__ */ new Set([
+    ...cfg.disableRules ?? [],
+    ...scannerCfg ? scannerCfg.disableRules ?? [] : []
+  ]);
+  const rules = [];
+  for (const rule of def.rules) {
+    if (disabled.has(rule.id)) continue;
+    const override = cfg.rules?.[rule.id];
+    if (override === "off") continue;
+    rules.push(override ? { ...rule, severity: override } : rule);
+  }
+  return rules;
+}
+function buildEffectiveScanners(cfg, subset) {
+  const out = [];
+  for (const def of ALL_SCANNERS) {
+    if (subset && !subset.includes(def.name)) continue;
+    const scannerCfg = cfg.scanners?.[def.name];
+    if (scannerCfg === false) continue;
+    const sub = scannerCfg ?? {};
+    out.push({
+      def: { ...def, rules: effectiveRules(def, cfg) },
+      include: new GlobSet(sub.include ?? []),
+      exclude: new GlobSet([...cfg.exclude ?? [], ...sub.exclude ?? []])
+    });
+  }
+  return out;
+}
+function inSkippedDir(posixPath, def) {
+  return posixPath.split("/").slice(0, -1).some((seg) => def.skipDirs.has(seg));
+}
+function scannerAppliesTo(posixPath, scanner) {
+  const ext = extname(posixPath).toLowerCase();
+  if (!scanner.def.exts.has(ext)) return false;
+  const base = posixPath.split("/").pop() ?? posixPath;
+  if (isSkippedFilename(base, scanner.def)) return false;
+  if (inSkippedDir(posixPath, scanner.def)) return false;
+  if (!scanner.include.isEmpty && !scanner.include.matches(posixPath)) return false;
+  if (scanner.exclude.matches(posixPath)) return false;
+  return true;
+}
+function newAccumulators() {
+  return /* @__PURE__ */ new Map([
+    ["code", { filesScanned: 0, words: 0, findings: [] }],
+    ["text", { filesScanned: 0, words: 0, findings: [] }],
+    ["ui", { filesScanned: 0, words: 0, findings: [] }]
+  ]);
+}
+function scanOneFile(scanner, acc, file, content, addedLines) {
+  const { findings, lineWords } = scanContent(scanner.def, content);
+  acc.filesScanned++;
+  if (lineWords) {
+    for (let line = 1; line < lineWords.length; line++) {
+      if (!addedLines || addedLines.has(line)) acc.words += lineWords[line] ?? 0;
+    }
+  }
+  for (const f of findings) {
+    if (addedLines && !addedLines.has(f.line)) continue;
+    acc.findings.push({ ...f, scanner: scanner.def.name, file, blocking: false });
+  }
+}
+function walkTree(root, def) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const full = join2(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!def.skipDirs.has(entry.name)) walk(full);
+      } else if (entry.isFile()) {
+        out.push(full);
+      }
+    }
+  };
+  const rootStat = statSync(root);
+  if (rootStat.isFile()) return [root];
+  walk(root);
+  return out;
+}
+var SEV_RANK = { high: 0, medium: 1, low: 2 };
+function sortFindings(findings) {
+  return findings.sort((a, b) => {
+    if (a.blocking !== b.blocking) return a.blocking ? -1 : 1;
+    if (a.severity !== b.severity) return SEV_RANK[a.severity] - SEV_RANK[b.severity];
+    if (a.file !== b.file) return a.file < b.file ? -1 : 1;
+    return a.line - b.line;
+  });
+}
+function finalizeReport(mode, failOn, accumulators, active, extras) {
+  const allFindings = [];
+  const scannerReports = [];
+  for (const scanner of active) {
+    const acc = accumulators.get(scanner.def.name);
+    for (const f of acc.findings) f.blocking = isBlocking(f, failOn);
+    const counts = countBySeverity(acc.findings);
+    const classCounts = { bug: 0, cosmetic: 0 };
+    for (const f of acc.findings) classCounts[f.class]++;
+    const score = weightedScore(counts);
+    const report2 = {
+      scanner: scanner.def.name,
+      filesScanned: acc.filesScanned,
+      counts,
+      classCounts,
+      score,
+      verdict: verdict(scanner.def.name, counts, score, acc.words)
+    };
+    if (scanner.def.prose) {
+      report2.words = acc.words;
+      report2.densityPer1kWords = Math.round(densityPer1kWords(score, acc.words) * 10) / 10;
+    }
+    scannerReports.push(report2);
+    allFindings.push(...acc.findings);
+  }
+  sortFindings(allFindings);
+  const report = {
+    mode,
+    failOn,
+    filesScanned: new Set(allFindings.map((f) => f.file)).size,
+    findings: allFindings,
+    blockingCount: allFindings.filter((f) => f.blocking).length,
+    scanners: scannerReports
+  };
+  if (extras.base !== void 0) report.base = extras.base;
+  if (extras.head !== void 0) report.head = extras.head;
+  if (extras.addedLines !== void 0) report.addedLines = extras.addedLines;
+  report.filesScanned = Math.max(...scannerReports.map((s) => s.filesScanned), 0);
+  return report;
+}
+function run(opts) {
+  const cfg = opts.config ?? loadConfig(opts.cwd, opts.configPath);
+  const failOn = opts.failOn ?? cfg.failOn ?? "high+bugs";
+  const active = buildEffectiveScanners(cfg, opts.scanners);
+  const accumulators = newAccumulators();
+  if (opts.mode === "diff") {
+    if (!opts.base) throw new Error("diff mode requires a base ref");
+    const diffOpts = { base: opts.base, cwd: opts.cwd };
+    if (opts.head !== void 0) diffOpts.head = opts.head;
+    if (opts.mergeBase !== void 0) diffOpts.mergeBase = opts.mergeBase;
+    const added = getAddedLines(diffOpts);
+    let addedTotal = 0;
+    for (const [file, lines] of added) {
+      addedTotal += lines.size;
+      let content = null;
+      let contentLoaded = false;
+      for (const scanner of active) {
+        if (!scannerAppliesTo(file, scanner)) continue;
+        if (!contentLoaded) {
+          contentLoaded = true;
+          content = opts.head ? readFileAt(file, opts.cwd, opts.head) : readWorkingTreeFile(join2(opts.cwd, file));
+        }
+        if (content === null) continue;
+        scanOneFile(
+          scanner,
+          accumulators.get(scanner.def.name),
+          file,
+          content,
+          lines
+        );
+      }
+    }
+    const extras = {
+      base: opts.base,
+      addedLines: addedTotal
+    };
+    if (opts.head !== void 0) extras.head = opts.head;
+    return finalizeReport("diff", failOn, accumulators, active, extras);
+  }
+  const root = opts.scanPath ?? opts.cwd;
+  for (const scanner of active) {
+    const acc = accumulators.get(scanner.def.name);
+    for (const file of walkTree(root, scanner.def)) {
+      const rel = relative(opts.cwd, file).replace(/\\/g, "/");
+      if (!scannerAppliesTo(rel, scanner)) continue;
+      const content = readWorkingTreeFile(file);
+      if (content === null) continue;
+      scanOneFile(scanner, acc, rel, content);
+    }
+  }
+  return finalizeReport("scan", failOn, accumulators, active, {});
+}
+function readWorkingTreeFile(path) {
+  try {
+    return readFileSync3(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+
+// src/action.ts
+function input(name) {
+  const value = process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`];
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+}
+function setOutput(name, value) {
+  const path = process.env.GITHUB_OUTPUT;
+  if (path) appendFileSync2(path, `${name}=${value}
+`);
+}
+function die(message) {
+  process.stderr.write(`::error title=unslop-ci::${message}
+`);
+  process.exitCode = 2;
+}
+function main() {
+  const cwd = input("working-directory") ?? process.cwd();
+  const base = input("base") ?? resolveBaseFromEnv(process.env);
+  if (!base) {
+    die("no base ref: pass the `base` input or run on a pull_request/push event");
+    return;
+  }
+  const failOnRaw = input("fail-on");
+  if (failOnRaw && !["high+bugs", "high", "medium", "any"].includes(failOnRaw)) {
+    die(`invalid fail-on "${failOnRaw}"`);
+    return;
+  }
+  const opts = { cwd, mode: "diff", base };
+  const head = input("head");
+  if (head) opts.head = head;
+  const config = input("config");
+  if (config) opts.configPath = config;
+  if (failOnRaw) opts.failOn = failOnRaw;
+  const scannersRaw = input("scanners");
+  if (scannersRaw) {
+    const scanners = scannersRaw.split(",").map((s) => s.trim());
+    for (const s of scanners) {
+      if (!["code", "text", "ui"].includes(s)) {
+        die(`unknown scanner "${s}"`);
+        return;
+      }
+    }
+    opts.scanners = scanners;
+  }
+  let report;
+  try {
+    report = run(opts);
+  } catch (err) {
+    if (err instanceof ConfigError || err instanceof GitError) {
+      die(err.message);
+      return;
+    }
+    throw err;
+  }
+  process.stdout.write(`${renderConsoleReport(report, { color: false, maxExamples: 10 })}
+`);
+  if (input("annotations") !== "false") {
+    for (const line of renderAnnotations(report)) process.stdout.write(`${line}
+`);
+  }
+  if (input("summary") !== "false") writeStepSummary(report);
+  const reportFile = input("report-file");
+  if (reportFile) writeFileSync(reportFile, `${JSON.stringify(report, null, 2)}
+`);
+  setOutput("blocking-count", String(report.blockingCount));
+  setOutput("finding-count", String(report.findings.length));
+  setOutput("added-lines", String(report.addedLines ?? 0));
+  process.exitCode = report.blockingCount > 0 ? 1 : 0;
+}
+main();