roast-my-design-system 9.0.2 → 9.0.4

package/README.md

@@ -387,7 +387,7 @@ Bugs and questions go to [GitHub Issues](https://github.com/gregkozakiewicz/roas
 What runs on a user's machine, and what does not, in one place.
 
 - **The plugin runs three things, all from its own folder.** Two skills, which run `node` on scripts inside the plugin; one local MCP server, started with `node` on a script inside the plugin; and one edit hook, which runs the bundled CLI on the file that changed. Nothing is downloaded at install or run time, nothing is fetched from the network, and nothing leaves the machine. There is no telemetry and no credential is read.
-- **The rest of the repository is tooling and documentation, never run by the plugin.** `release.mjs` and `.github/workflows` publish new versions from the maintainer's machine and GitHub, and use the maintainer's own GitHub and npm logins; `tools/benchmark` rebuilds the benchmark from public repos; `tests` is the snapshot suite; `docs` is the landing page and the hosted example reports; `assets` holds the README screenshots and the logo. A scanner reading the whole folder sees these too. None of them is reachable from a skill, the server or the hook.
+- **The rest of the repository is tooling and documentation, never run by the plugin.** `.github/workflows` publishes a tagged version to npm and the MCP registry from GitHub, with no stored secrets; the release script that cuts the tag lives outside this repository; `tools/benchmark` rebuilds the benchmark from public repos; `tests` is the snapshot suite; `docs` is the landing page and the hosted example reports; `assets` holds the README screenshots, the logo and the icon. A scanner reading the whole folder sees these too. None of them is reachable from a skill, the server or the hook.
 - **`npx roast-my-design-system@latest` appears in the documentation only.** It is how people run the scanner without the plugin. The plugin itself never calls a package launcher.
 - **Images.** The PNGs are the two README screenshots, the logo marks, and the seven link-preview cards the hosted example pages reference. No code opens them.
 

package/cli/roast.mjs

@@ -209,10 +209,13 @@ const tmp = mkdtempSync(join(tmpdir(), 'roast-'));
 const harvestPath = join(tmp, 'harvest.json');
 const summaryPath = join(tmp, 'summary.json');
 
-function run(script, args, env) {
-  // --json keeps stdout clean for the JSON payload; child chatter is dropped
+function run(script, args) {
+  // --json keeps stdout clean for the JSON payload; child chatter is dropped.
+  // No env is passed: the child inherits the process environment as any
+  // child does, and nothing is copied or added (9.0.4: a plugin scanner
+  // reads an explicit spread of process.env as forwarding credentials).
   const r = spawnSync(process.execPath, [join(SCRIPTS, script), ...args],
-    { stdio: asJson ? 'ignore' : 'inherit', ...(env ? { env: { ...process.env, ...env } } : {}) });
+    { stdio: asJson ? 'ignore' : 'inherit' });
   if (r.status !== 0) {
     rmSync(tmp, { recursive: true, force: true });
     process.exit(r.status ?? 1);
@@ -233,8 +236,8 @@ try {
 
 // the harvest goes to a temp dir this wrapper deletes right after; tell the
 // script so it does not print a path that will be gone seconds later
-run('harvest/index.mjs', [target, '--out', harvestPath,
-  ...excludes.flatMap((e) => ['--exclude', e])], { ROAST_EPHEMERAL_OUT: '1' });
+run('harvest/index.mjs', [target, '--out', harvestPath, '--ephemeral-out',
+  ...excludes.flatMap((e) => ['--exclude', e])]);
 say('');
 run('diagnose/index.mjs', [harvestPath, '--out', outPath, '--theme', theme, '--summary', summaryPath,
   ...(commissionedBy ? ['--by', commissionedBy] : []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roast-my-design-system",
-  "version": "9.0.2",
+  "version": "9.0.4",
   "mcpName": "io.github.gregkozakiewicz/roast-my-design-system",
   "description": "Your AI can write the UI. This makes sure it writes your UI. A deterministic scanner scores your design system 0-100 against 112 public repos, reads React and web components (Stencil, Lit), hands you a copy-paste fix prompt for each top finding, writes rules for Claude, Cursor, Copilot and Windsurf with --apply, and runs as a local MCP server with --mcp.",
   "keywords": [

package/skills/roast-my-design-system/scripts/harvest/index.mjs

@@ -295,7 +295,9 @@ writeFileSync(outPath, JSON.stringify(harvest, null, 2));
 // itself from harvest.json. Run directly (the skill flow), everything prints
 // here in one go, with the real output path at the end.
 for (const l of headerLines(harvest)) console.log(l);
-if (process.env.ROAST_EPHEMERAL_OUT !== '1') {
+// --ephemeral-out: the npx wrapper deletes the harvest right after, so the
+// path is not worth printing (a flag since 9.0.4; it was an env var)
+if (!process.argv.includes('--ephemeral-out')) {
   for (const l of detailLines(harvest)) console.log(l);
   console.log(`\n  → ${outPath}   (${harvest.tookMs}ms)`);
 }

package/skills/roast-my-design-system/scripts/lib/version.mjs

@@ -1,7 +1,7 @@
 // Single version constant for the engine — imported by diagnose (report
 // footer) and rules (generated-by line). This is the bump spot that used to
 // live as a const inside diagnose/index.mjs.
-export const VERSION = '9.0.2';
+export const VERSION = '9.0.4';
 // The shape of harvest.json and summary.json. Bumped only when a field is
 // renamed, removed or changes meaning; a new field is not a new schema. A
 // tool comparing two scans compares like with like by this number, not by VERSION.