feat(lint): add cta-hierarchy-mismatch rule to lintArtifact

[EthanGuo-coder]

Closes #2251

Why

Adds a cta-hierarchy-mismatch lint rule so commerce CTAs in header/nav/hero regions that use a non-primary button class are flagged as a P1 advisory.

What users will see

A new advisory finding cta-hierarchy-mismatch (severity P1) appears in the artifact lint badge when a <header>, <nav>, or <section class="hero"> contains a commerce CTA (Buy / Purchase / Checkout / Order now / Get started / Shop now / Add to cart / Subscribe / Sign up / Start free / Book now / Reserve) whose class list omits the artifact's detected primary button class. P1 surfaces as a warning in the chat UI and does not gate emit — outline CTAs in the header are a legitimate design choice. No change to existing findings, no new exports, no API surface change.

Surface area

• UI — new page / dialog / panel / menu item / setting / empty state in apps/web or apps/desktop (including Electron menu bar)
• Keyboard shortcut — new or changed
• CLI / env var — new od subcommand or flag, new tools-dev / tools-pack / tools-pr flag, or new OD_* env var
• API / contract — new /api/* endpoint, new SSE event, or changed shape in packages/contracts
• Extension point — new entry under skills/, design-systems/, design-templates/, or craft/, or change to the skills protocol
• i18n keys — added new translation keys (see TRANSLATIONS.md for the locale workflow)
• New top-level dependency — adding any new entry to the root package.json (dependencies or devDependencies); workspace-package package.json files are out of scope. Include a paragraph on what we get vs. what bytes we ship (see CONTRIBUTING.md → Code style)
• Default behavior change — changes what existing users experience without opting in (default model, default setting, file/SQLite schema, auto-network on startup, auto-install)
• None — internal refactor, docs, tests, or translation update only

Daemon-internal: one rule block + five private helpers inside the existing apps/daemon/src/lint-artifact.ts seam (the maintainer-identified home for new lint rules). No new file, no new export, no contract change. The finding rides the existing POST /api/artifacts/lint response.

Validation

• pnpm --filter @open-design/daemon test -- lint-artifact.test — 109 tests pass (was 96, +13 new for cta-hierarchy-mismatch).
• pnpm --filter @open-design/daemon typecheck — clean.
• pnpm guard — clean.

[nettee]

I found a few correctness issues in the new CTA hierarchy lint that can produce false positives or unstable counts. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[nettee]

I found one blocking correctness issue in the primary-class detector and one smaller follow-up in the new alpha parser. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[nettee]

I found one remaining blocking correctness issue in the primary-class detector. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[EthanGuo-coder]

@nettee All three threads are addressed: nested-region dedup and alpha-aware isPaintedBackground in 453e1bb9, and the interactive-class filter on findPrimaryButtonClass in 4e779e50.

[EthanGuo-coder]

@nettee Pushed a single follow-up that addresses both round-2 threads and an unrelated CI tsc break I introduced in the prior commit:

• Grouped selectors (#3270972993 / #3271386686): findPrimaryButtonClass now parses each rule's full prelude, splits on commas, and extracts class tokens from every branch — .btn-primary, .btn-primary:visited { ... } now enters the candidate set; regression test reproduces your <header><button class="btn"> + <main><button class="btn-primary"> + grouped CSS layout.
• calc()/NaN alpha (#3270972994): extracted a parseAlpha helper using Number.isFinite that recognizes calc(0) and calc(0%); the rgba/hsla parser was also tightened to balance nested parens (previously truncated args at the first nested ), which made the calc path unreachable). New matrix rows cover rgba(... calc(0)), rgb(... / calc(0%)), and rgba(... calc(0.5)) as a positive control.
• CI tsc: prior commit's alpha branches had unguarded args[...] accesses (TS18048). Strict guards added so pnpm --filter @open-design/daemon build is green; the local validator only ran vitest before, which is why this slipped — fixed in the run's tooling now too.

128 lint-artifact tests pass (vitest 129/129 including the new rows). The earlier review-summary acknowledgment was premature — both round-2 threads are addressed in 3840e9cd.

[nettee]

I found one blocking correctness issue in the primary-button detector. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[EthanGuo-coder]

@nettee Fixed in eb0f47c2: findPrimaryButtonClass now picks the last declaration in source order whose prop is background or background-color (a single-pass scan over decls), so reset-then-fill rules like .btn-primary { background: none; background-color: #2f6feb; ... } are correctly recognized as painted. Added two regressions in apps/daemon/tests/lint-artifact.test.ts — the reviewer's exact fixture, plus the reverse order (background-color then background: none) to guard against over-correction. 131/131 lint-artifact tests pass; tsc clean.

[nettee]

I found one remaining blocking correctness issue in the primary-class detector. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[EthanGuo-coder]

@nettee Fixed in 2be5fc68: extractSelectorClassNames now splits each branch by combinator (\s / > / + / ~), takes the rightmost compound only, and discards branches whose last compound carries a pseudo-element marker (:: or the legacy single-colon :before / :after / :first-line / :first-letter). Pseudo-classes (:hover, :focus, :visited, etc.) and type+class compounds (button.btn-primary) still nominate the host class. Added five regressions in apps/daemon/tests/lint-artifact.test.ts — your exact .btn-primary .icon fixture (no false positive), child combinator (>), pseudo-element (::before), plus positive controls for :hover and button.btn-primary so the next pass doesn't over-correct. 136/136 lint-artifact tests pass; tsc clean.

[nettee]

I found one remaining correctness issue in the new selector parsing for cta-hierarchy-mismatch. Details are inline.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[nettee]

extractSelectorClassNames() now identifies the last compound with branch.trim().split(/[\s>+~]+/), but that split is not selector-aware. Any valid selector that contains whitespace inside an attribute selector or functional pseudo gets chopped in the middle before we choose last. For example, button.btn-primary[aria-label="Buy now"] { ... } becomes ["button.btn-primary[aria-label="Buy", "now"]"], so .btn-primary never reaches eligible and cta-hierarchy-mismatch silently disappears even though the real primary button class is still present. That breaks the rule this PR is adding on common selectors that annotate buttons with accessible labels or :is(...) branches containing spaces. Please replace the raw split with a right-to-left scan that ignores combinators inside [], (), and quoted strings, and add a regression in apps/daemon/tests/lint-artifact.test.ts for a selector like button.btn-primary[aria-label="Buy now"] { background: ... }.

_{🔁 Powered by Looper · runner=reviewer · agent=opencode · An autonomous AI dev team for your GitHub repos.}

[EthanGuo-coder]

@nettee Done — extractSelectorClassNames now uses splitTopLevel(',') and a []/()/quote-aware right-to-left scan, with a regression test for button.btn-primary[aria-label="Buy now"] plus an :is(...) guard in apps/daemon/tests/lint-artifact.test.ts. e03ea6fa2c377c7f9c466f350ab882356396c999