kodelyth-ecc 2.24.5 → 2.24.7

package/CHANGELOG.md

@@ -2,6 +2,122 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.7 — the brand render scripts could not run (October 2026)
+
+Developer tooling only. Nothing here ships in the npm package — `brand/` is not in
+the `files` allowlist — but it is what kept the published artwork correct.
+
+2.24.6 fixed brand assets that had drifted to v2.7.0 with counts seven releases
+stale. This fixes the reason they drifted: **both scripts meant to regenerate them
+were broken, and had been for months.**
+
+`brand/convert.js` and `brand/veltix-convert.js` each required `puppeteer-core`,
+which is neither installed nor declared in `package.json`, so a clean checkout
+failed with module-not-found before rendering anything. Both also hardcoded
+`/Applications/Google Chrome.app/...`, so neither could have run on Linux or
+Windows even with the dependency present. `.gitignore` names `brand/convert.js`
+as the way to regenerate `brand/*.png`; it pointed at a script that crashed on
+line 9.
+
+`convert.js` was wrong in two further ways. It referenced `favicon.svg`, which
+does not exist in that directory, so three of its eleven entries rendered nothing.
+And it omitted five assets that do have published PNGs — the ECC badge, the icon
+at both 192 and 512, and both ECC lockups, plus the legacy post. Its list is now
+derived from the files actually present.
+
+### What changed
+
+Both now use `rsvg-convert`. That keeps ECC's no-runtime-dependency rule intact —
+adding `puppeteer-core` would pull a large dependency into a package that
+deliberately has none — and matches `scripts/brand/export-assets.js`, so the whole
+brand pipeline renders through one tool.
+
+Sizes reduce to a target **width**. Every published PNG was checked against its
+SVG's viewBox and all twenty-one are exact aspect-preserving scales, with ratios
+from 2x to 6x, so letting rsvg derive the height reproduces each one without a
+second number that can drift from the artwork. Every output keeps its exact
+published dimensions, captured before and after.
+
+The renderer substitution was verified rather than assumed: re-rendering a
+Chrome-produced export gave a byte-comparable file at identical dimensions, and
+the text-bearing assets were viewed after rendering. The old `document.fonts.ready`
+wait needs no counterpart — these SVGs ask for `'Space Grotesk'`, `'Inter'`,
+`system-ui`, which are font-family names resolved against installed fonts rather
+than `@font-face` webfonts, so rsvg resolves them the same way Chrome did.
+
+### One gate for all brand artwork
+
+All four scripts now share a `--check` mode that exits non-zero when anything is
+stale:
+
+```bash
+node brand/convert.js --check \
+  && node brand/veltix-convert.js --check \
+  && node scripts/brand/sync-asset-version.js --check \
+  && node scripts/brand/export-assets.js --check
+```
+
+This release is the first to run that pipeline end to end: bump, stamp the version
+into 46 SVGs across both repositories, then render 70 PNGs.
+
+**672 tests across 43 files.**
+
+## v2.24.6 — brand assets advertised the wrong version and stale counts (October 2026)
+
+Assets and documentation only. No code changes to the toolkit.
+
+### What was wrong
+
+Every social and brand SVG carries its version and headline counts as literal
+artwork, and nothing kept them in step with releases.
+
+ECC's 23 SVGs said `v2.24.1`, four releases behind. The website's copies said
+`v2.18.0` — seven behind — and the two sets had drifted apart, so the marketing
+images on the site advertised a different version from the ones in the README.
+
+The counts were worse, and were nearly missed: grepping for the *correct* values
+(70 agents, 196 skills) found them and suggested the counts were fine. Rendering
+`github-social-preview.png` showed otherwise — **97 COMMANDS** and **22+ HOOKS**
+against an actual 103 and 44, on the flagship image used for the repository's
+social card. Fixed across 11 SVGs per repo: 97 to 103 commands, 22+/20+ to 44
+hooks, 384 to 672 tests, 14 to 15 rules.
+
+The PNG exports were worse still, at `v2.7.0`.
+
+### Root cause
+
+`.gitignore` names `node brand/convert.js` as the way to regenerate the exports.
+That script covers only the `brand/` lockups from a hardcoded list, never the 49
+`social/` exports — and it cannot run at all, because `puppeteer-core` is neither
+installed nor declared in `package.json`. The documented regeneration path was
+broken, and because the PNGs are gitignored build artifacts the drift was
+invisible.
+
+### What ships
+
+Two scripts, so this cannot recur silently:
+
+- `scripts/brand/sync-asset-version.js` stamps the version from `package.json`
+  into every SVG. Takes `--root` so the website's copies are driven from the same
+  source of truth, and `--check` exits non-zero when anything is stale.
+- `scripts/brand/export-assets.js` renders all 49 exports at 7680px, taking each
+  height from the SVG's own viewBox. `--check` compares mtimes and fails when a
+  PNG is older than its source.
+
+Counts are deliberately NOT stamped by script. They are laid out as artwork, and
+some numbers that look like catalog counts are not: "20+ rules stacked" counts
+accumulated lessons, and "4 agents" / "8 agents" describe how many a given
+parallel command fires. A blanket replace would rewrite those into nonsense, so
+each count fix here was read in context first and those were left alone.
+
+### Also
+
+The README now asks for a star. The post-install CLI asked once; the README —
+which is also the npm package page, and the first thing most people see — never
+did.
+
+**672 tests across 43 files.**
+
 ## v2.24.5 — fix path traversal in session bundles (October 2026)
 
 **Security fix.** A session bundle is a portable, shareable artifact — that is the

package/README.md

@@ -1157,6 +1157,20 @@ command you ran, the full error, and your `kodelythecc doctor` output.
 
 <div align="center">
 
+### If ECC saved you time
+
+Starring the repo is the main way other developers find it — the project has no
+marketing budget and no telemetry, so visibility is the only signal that it is
+worth anyone's time.
+
+[![Star on GitHub](https://img.shields.io/github/stars/sifxprime/kodelyth-ecc?style=social)](https://github.com/sifxprime/kodelyth-ecc)
+
+</div>
+
+---
+
+<div align="center">
+
 [![npm](https://img.shields.io/badge/npm-kodelyth--ecc-red.svg)](https://www.npmjs.com/package/kodelyth-ecc)
 [![GitHub](https://img.shields.io/badge/GitHub-sifxprime%2Fkodelyth--ecc-181717.svg)](https://github.com/sifxprime/kodelyth-ecc)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.5",
+  "version": "2.24.7",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/brand/export-assets.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Render every social SVG to its 8K PNG export.
+ *
+ * The PNGs under social/exports/8k/ are rasterised copies of the SVGs, used where
+ * an SVG will not do — GitHub's social preview, and most social platforms, accept
+ * only raster uploads. Nothing regenerated them, so they drifted badly: by v2.24.5
+ * the exports still read v2.7.0, 97 commands and 22+ hooks, against an actual
+ * 103 and 44. The SVGs had been corrected several times; the PNGs never were.
+ *
+ * Every existing export is 7680px wide with the aspect ratio taken from the SVG's
+ * own viewBox, so that is what this reproduces.
+ *
+ *   node scripts/brand/export-assets.js                 # render all
+ *   node scripts/brand/export-assets.js --check         # report stale, change nothing
+ *   node scripts/brand/export-assets.js card-main       # render one, by name
+ *
+ * --check compares mtimes and exits non-zero when any PNG is older than its SVG,
+ * so a release step can catch exports that no longer match their source.
+ *
+ * Requires rsvg-convert (librsvg). It is not installed by default anywhere, so its
+ * absence is reported as a clear instruction rather than a spawn error.
+ *
+ * On the choice of renderer: brand/convert.js already renders the brand/ lockups
+ * with puppeteer-core, chosen there for font fidelity, and consistency would argue
+ * for using it here too. It is not used because it cannot run — puppeteer-core is
+ * neither installed nor declared in package.json, so `node brand/convert.js` fails
+ * on a clean checkout. That is most likely why these exports went stale in the
+ * first place: the tool named in .gitignore for regenerating them does not work.
+ *
+ * rsvg-convert was checked against the output it replaces rather than assumed
+ * equivalent: re-rendering github-social-preview.png produced 491,233 bytes against
+ * the previous Chrome-rendered 491,564 at identical dimensions, and the two were
+ * compared side by side — same fonts, same geometry, differing only in the text
+ * that was actually corrected. If puppeteer-core is ever added as a real
+ * dependency, moving this to the same renderer would be a reasonable tidy-up.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+const ROOT = path.join(__dirname, '..', '..');
+const SVG_DIR = path.join(ROOT, 'social');
+const PNG_DIR = path.join(SVG_DIR, 'exports', '8k');
+const WIDTH = 7680;
+
+function haveRenderer() {
+  try {
+    execFileSync('rsvg-convert', ['--version'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function listPairs(filter) {
+  if (!fs.existsSync(SVG_DIR)) return [];
+  return fs
+    .readdirSync(SVG_DIR)
+    .filter((f) => f.endsWith('.svg'))
+    .map((f) => path.basename(f, '.svg'))
+    .filter((name) => !filter || name === filter)
+    .sort()
+    .map((name) => ({
+      name,
+      svg: path.join(SVG_DIR, `${name}.svg`),
+      png: path.join(PNG_DIR, `${name}.png`),
+    }));
+}
+
+/** A PNG is stale when it is missing or older than the SVG it came from. */
+function isStale({ svg, png }) {
+  if (!fs.existsSync(png)) return true;
+  return fs.statSync(png).mtimeMs < fs.statSync(svg).mtimeMs;
+}
+
+function run({ check = false, only = null } = {}) {
+  const pairs = listPairs(only);
+  if (pairs.length === 0) {
+    console.error(only ? `no such SVG: social/${only}.svg` : `no SVGs in ${SVG_DIR}`);
+    return 1;
+  }
+
+  const stale = pairs.filter(isStale);
+
+  if (check) {
+    for (const p of stale) console.log(`  STALE  ${p.name}.png`);
+    console.log(
+      stale.length === 0
+        ? `  all ${pairs.length} exports are newer than their SVG`
+        : `  ${stale.length} of ${pairs.length} export(s) stale`
+    );
+    return stale.length === 0 ? 0 : 1;
+  }
+
+  if (!haveRenderer()) {
+    console.error('  rsvg-convert not found. Install librsvg:');
+    console.error('    macOS:  brew install librsvg');
+    console.error('    Debian: apt-get install librsvg2-bin');
+    return 1;
+  }
+
+  fs.mkdirSync(PNG_DIR, { recursive: true });
+
+  let ok = 0;
+  const failed = [];
+  for (const p of pairs) {
+    // Width only — rsvg-convert derives the height from the viewBox, so each
+    // card keeps its own aspect ratio without hardcoding 49 different heights.
+    const r = spawnSync('rsvg-convert', ['-w', String(WIDTH), p.svg, '-o', p.png], {
+      stdio: ['ignore', 'ignore', 'pipe'],
+    });
+    if (r.status === 0 && fs.existsSync(p.png) && fs.statSync(p.png).size > 0) {
+      ok += 1;
+    } else {
+      failed.push(`${p.name}: ${String(r.stderr || '').trim() || `exit ${r.status}`}`);
+    }
+  }
+
+  console.log(`  rendered ${ok}/${pairs.length} at ${WIDTH}px wide`);
+  for (const f of failed) console.error(`  FAILED  ${f}`);
+  return failed.length === 0 ? 0 : 1;
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const check = args.includes('--check');
+  const only = args.find((a) => !a.startsWith('--')) || null;
+  process.exit(run({ check, only }));
+}
+
+module.exports = { run, listPairs, isStale, WIDTH };

package/scripts/brand/sync-asset-version.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Stamp the current package version into every brand and social SVG.
+ *
+ * These assets carry a literal "v2.24.1" in their artwork, and nothing kept them
+ * in step with releases. By 2.24.5 the ECC copies were four releases behind and
+ * the website's copies were SEVEN behind, at v2.18.0 — the two sets had drifted
+ * apart as well, so the marketing images on the site advertised a different
+ * version from the ones in the README.
+ *
+ * Only the version token is touched. Counts (70 agents, 196 skills, …) are laid
+ * out as artwork and change rarely, so they stay a deliberate edit; a script that
+ * silently reflowed them would do more harm than the staleness it fixed.
+ *
+ *   node scripts/brand/sync-asset-version.js                  # ECC's own assets
+ *   node scripts/brand/sync-asset-version.js --check          # report, change nothing
+ *   node scripts/brand/sync-asset-version.js --root ../ecc-web/public
+ *
+ * --check exits non-zero when anything is stale, so a release step can refuse to
+ * ship assets that advertise the wrong version.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.join(__dirname, '..', '..');
+const VERSION = require(path.join(ROOT, 'package.json')).version;
+
+// A version token in artwork: "v" followed by semver, as a whole word. Anchored
+// on the leading "v" so it cannot match an IP address — section-dashboard.svg
+// contains "127.0.0.1", which a bare semver pattern happily mangles.
+const VERSION_TOKEN = /\bv\d+\.\d+\.\d+\b/g;
+
+function collectSvgs(root) {
+  const out = [];
+  for (const dir of ['social', 'brand']) {
+    const full = path.join(root, dir);
+    if (!fs.existsSync(full)) continue;
+    for (const name of fs.readdirSync(full)) {
+      if (name.endsWith('.svg')) out.push(path.join(full, name));
+    }
+  }
+  return out.sort();
+}
+
+function run({ root, check }) {
+  const files = collectSvgs(root);
+  if (files.length === 0) {
+    console.error(`no social/ or brand/ SVGs under ${root}`);
+    return 1;
+  }
+
+  const stale = [];
+  let changedFiles = 0;
+  let changedTokens = 0;
+
+  for (const file of files) {
+    const before = fs.readFileSync(file, 'utf8');
+    const found = before.match(VERSION_TOKEN);
+    if (!found) continue;
+
+    const outdated = found.filter((t) => t !== `v${VERSION}`);
+    if (outdated.length === 0) continue;
+
+    stale.push({ file, versions: [...new Set(outdated)], count: outdated.length });
+    changedTokens += outdated.length;
+    changedFiles += 1;
+
+    if (!check) {
+      fs.writeFileSync(file, before.replace(VERSION_TOKEN, `v${VERSION}`), 'utf8');
+    }
+  }
+
+  const rel = (f) => path.relative(root, f);
+  for (const s of stale) {
+    console.log(`  ${check ? 'STALE' : 'updated'}  ${rel(s.file).padEnd(40)} ${s.versions.join(', ')} -> v${VERSION}`);
+  }
+
+  if (stale.length === 0) {
+    console.log(`  all ${files.length} SVGs already at v${VERSION}`);
+    return 0;
+  }
+
+  console.log(
+    `  ${check ? 'stale' : 'synced'}: ${changedFiles} file(s), ${changedTokens} token(s) -> v${VERSION}`
+  );
+  return check ? 1 : 0;
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const check = args.includes('--check');
+  const rootFlag = args.indexOf('--root');
+  const root = rootFlag >= 0 ? path.resolve(args[rootFlag + 1]) : ROOT;
+  process.exit(run({ root, check }));
+}
+
+module.exports = { run, collectSvgs, VERSION_TOKEN };