roast-my-design-system 9.0.1 → 9.0.2

package/README.md

@@ -1,4 +1,4 @@
-<img src="https://raw.githubusercontent.com/gregkozakiewicz/roast-my-design-system/main/assets/roster_logo_v1.png?v=8.2.0" width="100" alt="roast-my-design-system">
+<img src="assets/roster_logo_v1.png?v=8.2.0" width="100" alt="roast-my-design-system">
 
 # roast-my-design-system
 
@@ -117,11 +117,11 @@ Not to be confused with each other: **"Why this matters"** is generic, ships wit
 
 The full report for vercel/ai-chatbot, top to bottom, including "What the numbers mean", Claude's read of the scan, embedded right under the verdict:
 
-![The full diagnosis report for vercel/ai-chatbot in dark mode: a fixed side panel with the health score and what it measures, the stack, how the repo was read as a shadcn install, an index of every section and what is not the team's and not counted; then the summary, the What the numbers mean analysis written by Claude, priced Where to start moves each with its copy-the-fix-prompt button, the wrapped present with the agent rules, an agent trap callout, 3-yardstick tiles including the 2 shadcn tiles, the adoption map treemap, palette forensics, the shadcn theme variable by variable, spacing receipts, typography specimens, offenders, duplicates, and the component usage ledger](https://raw.githubusercontent.com/gregkozakiewicz/roast-my-design-system/main/assets/report-full-dark.png?v=9.0.0)
+![The full diagnosis report for vercel/ai-chatbot in dark mode: a fixed side panel with the health score and what it measures, the stack, how the repo was read as a shadcn install, an index of every section and what is not the team's and not counted; then the summary, the What the numbers mean analysis written by Claude, priced Where to start moves each with its copy-the-fix-prompt button, the wrapped present with the agent rules, an agent trap callout, 3-yardstick tiles including the 2 shadcn tiles, the adoption map treemap, palette forensics, the shadcn theme variable by variable, spacing receipts, typography specimens, offenders, duplicates, and the component usage ledger](assets/report-full-dark.png?v=9.0.0)
 
 The same report in light mode (one file, built-in toggle):
 
-![The diagnosis report in light mode](https://raw.githubusercontent.com/gregkozakiewicz/roast-my-design-system/main/assets/report-light-hero.png?v=9.0.0)
+![The diagnosis report in light mode](assets/report-light-hero.png?v=9.0.0)
 
 ## What it works on
 
@@ -382,6 +382,15 @@ Review my UI changes against the design system.
 
 Bugs and questions go to [GitHub Issues](https://github.com/gregkozakiewicz/roast-my-design-system/issues). Everything else reaches Greg through [gregkozakiewicz.com](https://gregkozakiewicz.com). Security problems: see [SECURITY.md](SECURITY.md).
 
+## For reviewers
+
+What runs on a user's machine, and what does not, in one place.
+
+- **The plugin runs three things, all from its own folder.** Two skills, which run `node` on scripts inside the plugin; one local MCP server, started with `node` on a script inside the plugin; and one edit hook, which runs the bundled CLI on the file that changed. Nothing is downloaded at install or run time, nothing is fetched from the network, and nothing leaves the machine. There is no telemetry and no credential is read.
+- **The rest of the repository is tooling and documentation, never run by the plugin.** `release.mjs` and `.github/workflows` publish new versions from the maintainer's machine and GitHub, and use the maintainer's own GitHub and npm logins; `tools/benchmark` rebuilds the benchmark from public repos; `tests` is the snapshot suite; `docs` is the landing page and the hosted example reports; `assets` holds the README screenshots and the logo. A scanner reading the whole folder sees these too. None of them is reachable from a skill, the server or the hook.
+- **`npx roast-my-design-system@latest` appears in the documentation only.** It is how people run the scanner without the plugin. The plugin itself never calls a package launcher.
+- **Images.** The PNGs are the two README screenshots, the logo marks, and the seven link-preview cards the hosted example pages reference. No code opens them.
+
 ## Privacy
 
 The tool reads the repository you point it at and writes its output next to it. It makes no network requests, collects no data, and has no telemetry. The MCP server answers from the same local scan and never leaves the machine. Nothing about your code, your prompts or your conversation is sent to anyone, including the author.
@@ -416,4 +425,4 @@ Building your own report, summary or audit from this tool's scores, counts or be
 
 **roast-my-design-system**™ and the GK mark are trademarks of Greg Kozakiewicz. Forking is welcome, republishing under this name is not: see [brand and attribution](https://gregkozakiewicz.github.io/roast-my-design-system/brand.html).
 
-Built and designed by <a href="https://gregkozakiewicz.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/gregkozakiewicz/roast-my-design-system/main/assets/gk-mark-dark.png?v=3.10.1"><img src="https://raw.githubusercontent.com/gregkozakiewicz/roast-my-design-system/main/assets/gk-mark.png?v=3.10.1" height="15" alt="GK mark"></picture> Greg Kozakiewicz</a>.
+Built and designed by <a href="https://gregkozakiewicz.com"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/gk-mark-dark.png?v=3.10.1"><img src="assets/gk-mark.png?v=3.10.1" height="15" alt="GK mark"></picture> Greg Kozakiewicz</a>.

package/cli/roast.mjs

@@ -82,6 +82,8 @@ Run it yourself
   --sarif         also write design-system-roast.sarif for GitHub code
                   scanning: findings annotated on files in the Security tab
   --by <name>     put a name in the report header, for when you ran it for
+  --og-url <url>  the address a hosted report lives at, for link previews
+  --og-image <url> its 1200x630 preview card, for link previews
                   someone else ("commissioned by <name>")
   --exclude <p>   leave a folder out of the scan (repo-relative, e.g.
                   --exclude lab/ --exclude piglet/ or --exclude lab/,piglet/;
@@ -168,6 +170,11 @@ const askedNoOpen = flag('no-open') === true;
 const noOpen = askedNoOpen || asJson;
 const theme = opt('theme', 'dark');
 const commissionedBy = opt('by', null);
+// A hosted report's own address and its 1200x630 preview card, so a shared
+// link shows the card (Open Graph). Passed through to the report; never
+// guessed for a local file.
+const ogUrl = opt('og-url', null);
+const ogImage = opt('og-image', null);
 const notesFile = opt('notes', null);
 const sections = optPairs('section');
 const excludes = optAll('exclude');
@@ -232,6 +239,8 @@ say('');
 run('diagnose/index.mjs', [harvestPath, '--out', outPath, '--theme', theme, '--summary', summaryPath,
   ...(commissionedBy ? ['--by', commissionedBy] : []),
   ...(notesFile ? ['--notes', resolve(notesFile)] : []),
+  ...(ogUrl ? ['--og-url', ogUrl] : []),
+  ...(ogImage ? ['--og-image', ogImage] : []),
   ...sections.flatMap(([title, file]) => ['--section', title, resolve(file)])]);
 
 // The verdict leads, the evidence follows: harvest details print here, after

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roast-my-design-system",
-  "version": "9.0.1",
+  "version": "9.0.2",
   "mcpName": "io.github.gregkozakiewicz/roast-my-design-system",
   "description": "Your AI can write the UI. This makes sure it writes your UI. A deterministic scanner scores your design system 0-100 against 112 public repos, reads React and web components (Stencil, Lit), hands you a copy-paste fix prompt for each top finding, writes rules for Claude, Cursor, Copilot and Windsurf with --apply, and runs as a local MCP server with --mcp.",
   "keywords": [

package/skills/roast-my-design-system/scripts/lib/version.mjs

@@ -1,7 +1,7 @@
 // Single version constant for the engine — imported by diagnose (report
 // footer) and rules (generated-by line). This is the bump spot that used to
 // live as a const inside diagnose/index.mjs.
-export const VERSION = '9.0.1';
+export const VERSION = '9.0.2';
 // The shape of harvest.json and summary.json. Bumped only when a field is
 // renamed, removed or changes meaning; a new field is not a new schema. A
 // tool comparing two scans compares like with like by this number, not by VERSION.