Conversation
…tool The forward asked for the W3C's WCAG-EM Report Tool as a command. It is a Svelte page with no CLI and no headless mode, and cannot be one: it is a form for the five steps of the evaluation methodology, and most success criteria need a person to decide them. What a machine can do is the part that is machine-shaped, and `wcag` does that: choose the structured sample (step 3), load each page in headless Chrome, run axe-core over it, print one row per success criterion, and write the tool's own evaluation file so "Open evaluation" starts the evaluator at the judgement calls (step 4) rather than at an empty form. The sample is the home page and then one page per section of the sitemap before a second of any, because WCAG-EM wants pages that differ and the first N a crawler lists are N posts from one archive. A site with no sitemap gives its own links; `--url` names a page whatever the sample says. Nothing is ever marked passed. axe proves a failure but "no rule fired" proves nothing about a criterion, since its rules cover a part of each one, so a criterion with only passing checks lands as "cannot tell" with the checks listed. The exit status is 1 on any failure within the target. The browser is driven over the DevTools protocol with Node's own WebSocket rather than through Puppeteer or Playwright, which would each bring a Chrome download and a driver to open a page and evaluate two scripts. The box's Chrome is found instead — CHROME_PATH, PATH, the two caches — and a bare Puppeteer build runs when its libraries are staged under ~/.local/share/chrome-deps, which is what this box has. axe-core is the one dependency; it is pure JavaScript and is read from the package, not fetched. The evaluation file mirrors the tool's export, read from its source rather than guessed, and was verified by replaying its open() with the jsonld version it pins: every assertion restores, for 2.2 and for 2.1. That replay caught the one thing reading the code did not. The tool's context stops at WCAG21, and a 2.2 id like `WCAG22:reflow` survives its processor only as an IRI with an unknown scheme; defining the prefix, as seemed correct, expanded every id into a form the tool cannot fold back and dropped all 33. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Khk1C6Ese6xjdHAWLVstca
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| /** `linux-152.0.7977.42` after `linux-131.0.6778.204`: newest first by version, not by string. */ | ||
| const byVersionDesc = (a: string, b: string): number => { | ||
| const parse = (name: string): number[] => (/(\d+(?:\.\d+)*)/.exec(name)?.[1] ?? '0').split('.').map(Number); |
ThreatCrush Security Scan13 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 5 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
ralyodio
marked this pull request as ready for review
September 13, 2026 01:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bot@ forward asked for https://www.w3.org/WAI/eval/report-tool/ as a command in cli-tools. That tool is a Svelte web app with no CLI and no headless mode, so this adds
wcag, which does the automated half of a WCAG-EM evaluation and hands the file to the tool for the human half.--urladds pages by hand.earl:failed, anything elseearl:cantTellwith the checks listed.CHROME_PATH, then PATH, then the Puppeteer and Playwright caches; the staged~/.local/share/chrome-depslibraries are wired in so a bare Puppeteer build runs on this box.open()with the jsonld version it pins — 33/33 assertions restore for 2.2, 30/30 for 2.1. The replay caught that defining aWCAG22:prefix in the context (which looks correct) makes the tool drop every 2.2 assertion, so the prefix is deliberately left undefined, as the tool does.Live run on profullstack.com, 3 pages: 1.4.3 Contrast (Minimum) fails on 2 of 3 pages,
color-contraston 36 elements; everything else axe checked needs a person.Tests: 43 new, suite 923/924 (the one failure is
torrent.test.tsagainst a real client, flaky on master).pnpm typecheckhas no errors in the new files;argontv.tsandfree-names.tsalready fail it on master.🤖 Generated with Claude Code
https://claude.ai/code/session_01Khk1C6Ese6xjdHAWLVstca