@onexeor/lumo 0.0.1 → 0.0.3

package/README.md

@@ -1,6 +1,6 @@
 # lumo — installer
 
-One-command installer for [Lumo](https://github.com/OneXeor/lumo): mobile
+One-command installer for [Lumo](https://github.com/OneXeor-Dev/lumo): mobile
 UI/UX design intelligence for AI coding assistants.
 
 ```bash
@@ -31,7 +31,7 @@ Under the hood the installer:
 
 1. Locates a Python 3.10+ interpreter and creates a Lumo-owned venv at
    `~/.lumo/venv` so your system Python stays clean.
-2. `pip install`s [`lumo-tools`](https://pypi.org/project/lumo-tools/) into
+2. `pip install`s [`lumo-mobile`](https://pypi.org/project/lumo-mobile/) into
    that venv. The CLIs (`lumo-wcag`, `lumo-theory`, `lumo-parity`,
    `lumo-mcp`) become available at absolute paths the MCP configs point to.
 3. Copies the `SKILL.md` bundle into the chosen client's skill directory.
@@ -42,6 +42,24 @@ Under the hood the installer:
 The installer never modifies anything outside `~/.lumo`, the chosen
 client's skill directory, and the chosen client's MCP config file.
 
+## Publishing (maintainers only)
+
+The installer ships with no npm lifecycle scripts on purpose — Socket.dev
+and similar supply-chain scanners penalise packages that auto-execute
+code on install or pack, even when that code is benign. To publish a
+new version:
+
+```bash
+cd installer
+bash scripts/release.sh --dry-run   # bundles /skill into installer/skill, npm pack --dry-run
+bash scripts/release.sh             # same, but actually publishes
+```
+
+`release.sh` is the only sanctioned way to build the tarball. Running
+`npm pack` or `npm publish` directly will produce a broken tarball
+without the bundled `SKILL.md`, so `lumo init` would fail
+post-install. The script makes the bundling explicit and Socket-clean.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onexeor/lumo",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Install Lumo — mobile UI/UX design intelligence for AI coding assistants (Claude Code, Cursor, Codex, MCP clients).",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "scripts": {
     "start": "node src/index.js",
-    "prepack": "node scripts/bundle-skill.js"
+    "bundle-skill": "node scripts/bundle-skill.js"
   },
   "keywords": [
     "mobile",
@@ -37,7 +37,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/OneXeor/lumo.git"
+    "url": "https://github.com/OneXeor-Dev/lumo.git"
   },
   "engines": {
     "node": ">=18"

package/skill/SKILL.md

@@ -43,7 +43,15 @@ mobile UI concern, stay out.
 
 Lumo ships with Python tools. Each tool has a single CLI entry-point with
 deterministic output. Invoke via Bash. Tools live in `tools/lumo/<area>/cli.py`
-and are exposed as console scripts after `pip install -e tools/`.
+and are exposed as console scripts after `pip install -e tools/` or
+`pipx install lumo-mobile`.
+
+When running inside an MCP-aware client (Cursor, Continue, Aider, Goose,
+Zed, Codex, or Claude Code with MCP enabled), the same four tools are
+also exposed as MCP functions: `lumo_wcag_check`, `lumo_wcag_fix`,
+`lumo_theory_check`, `lumo_parity_diff`. Prefer the MCP function over
+spawning a Bash subprocess when available — the structured response is
+already JSON and the user does not see noisy command output.
 
 ### `lumo-wcag` — WCAG contrast validator + OKLCH auto-correct
 
@@ -135,10 +143,16 @@ Layout JSON schema:
 - `group` is a free-form string used by Hick (equal-weight overload) and
   Gestalt proximity.
 - `source` reports honesty: `measured` means the coordinates came from a
-  real device (Espresso, XCUITest, Compose `onGloballyPositioned`,
-  SwiftUI `GeometryReader`); `code-estimated` from static code parsing;
-  `description-estimated` from a description or screenshot. The tool
-  propagates this value to every finding so the user can weigh confidence.
+  real device or a snapshot-testing framework — Espresso, XCUITest,
+  Compose `onGloballyPositioned`, SwiftUI `GeometryReader`, **Paparazzi**
+  (Compose snapshot tests by Cash App / JetBrains), or
+  `xcodebuild test --only-testing` with `XCTAttachment` /
+  `swift-snapshot-testing`. `code-estimated` means the layout was parsed
+  from source code statically (theme tokens, `fillMaxWidth`, dynamic
+  type — anything that resolves at runtime — is a guess).
+  `description-estimated` means the layout was built from a screenshot
+  description or natural-language prompt. The tool propagates this value
+  to every finding so the user can weigh confidence.
 
 When you (the model) construct a layout from a screenshot or from Compose
 / SwiftUI source code, set `source` to the matching honest label. Do not

package/src/commands/init.js

@@ -40,7 +40,7 @@ export async function initCommand(opts) {
 
   const targets = await pickClient(opts.ai, opts.all);
 
-  console.log(kleur.dim("→ installing Python tools (lumo-tools) into ~/.lumo/venv ..."));
+  console.log(kleur.dim("→ installing Python tools (lumo-mobile) into ~/.lumo/venv ..."));
   try {
     if (opts.dev) {
       const dev = devSource();

package/src/index.js

@@ -8,7 +8,7 @@
  *   uninstall [--ai <client>]      Remove the Lumo skill (Python tools left intact).
  *
  * Supported AI clients in v0.1: claude, cursor, codex, generic.
- * Other clients can still consume Lumo via `npx skills add OneXeor/lumo`
+ * Other clients can still consume Lumo via `npx skills add OneXeor-Dev/lumo`
  * or by pointing their MCP config at `lumo-mcp`.
  */
 
@@ -27,7 +27,7 @@ program
     "Mobile UI/UX design intelligence — WCAG / parity / cognitive-science checks " +
       "for Jetpack Compose, Android XML, SwiftUI, UIKit."
   )
-  .version("0.0.1");
+  .version("0.0.3");
 
 program
   .command("init")

package/src/lib/python.js

@@ -1,10 +1,10 @@
 /**
- * Python detection and lumo-tools install helpers.
+ * Python detection and lumo-mobile install helpers.
  *
  * Strategy:
  *   - Locate a Python ≥3.10 interpreter (python3, python, py -3 on Windows).
  *   - Maintain a Lumo-owned venv at ~/.lumo/venv so user system Python stays clean.
- *   - Install lumo-tools into that venv via pip — from PyPI by default,
+ *   - Install lumo-mobile into that venv via pip — from PyPI by default,
  *     from a local git path when --dev was passed.
  *   - Expose absolute paths to each console script so SKILL.md and MCP configs
  *     can reference them without depending on PATH.
@@ -65,11 +65,11 @@ export async function ensureVenv() {
 }
 
 /**
- * Install lumo-tools into the Lumo-owned venv.
+ * Install lumo-mobile into the Lumo-owned venv.
  *
  * @param {object} opts
  * @param {string} [opts.source]  Local path to install from (used with --dev).
- *                                When omitted, installs `lumo-tools` from PyPI.
+ *                                When omitted, installs `lumo-mobile` from PyPI.
  */
 export async function installLumoTools(opts = {}) {
   await ensureVenv();
@@ -78,7 +78,7 @@ export async function installLumoTools(opts = {}) {
   if (opts.source) {
     args.push("-e", opts.source);
   } else {
-    args.push("lumo-tools");
+    args.push("lumo-mobile");
   }
   await execFileP(pip, args, { maxBuffer: 20 * 1024 * 1024 });
 }