roast-my-design-system 9.0.3 → 9.0.5

package/cli/roast.mjs

@@ -209,10 +209,13 @@ const tmp = mkdtempSync(join(tmpdir(), 'roast-'));
 const harvestPath = join(tmp, 'harvest.json');
 const summaryPath = join(tmp, 'summary.json');
 
-function run(script, args, env) {
-  // --json keeps stdout clean for the JSON payload; child chatter is dropped
+function run(script, args) {
+  // --json keeps stdout clean for the JSON payload; child chatter is dropped.
+  // No env is passed: the child inherits the process environment as any
+  // child does, and nothing is copied or added (9.0.4: a plugin scanner
+  // reads an explicit spread of process.env as forwarding credentials).
   const r = spawnSync(process.execPath, [join(SCRIPTS, script), ...args],
-    { stdio: asJson ? 'ignore' : 'inherit', ...(env ? { env: { ...process.env, ...env } } : {}) });
+    { stdio: asJson ? 'ignore' : 'inherit' });
   if (r.status !== 0) {
     rmSync(tmp, { recursive: true, force: true });
     process.exit(r.status ?? 1);
@@ -233,8 +236,8 @@ try {
 
 // the harvest goes to a temp dir this wrapper deletes right after; tell the
 // script so it does not print a path that will be gone seconds later
-run('harvest/index.mjs', [target, '--out', harvestPath,
-  ...excludes.flatMap((e) => ['--exclude', e])], { ROAST_EPHEMERAL_OUT: '1' });
+run('harvest/index.mjs', [target, '--out', harvestPath, '--ephemeral-out',
+  ...excludes.flatMap((e) => ['--exclude', e])]);
 say('');
 run('diagnose/index.mjs', [harvestPath, '--out', outPath, '--theme', theme, '--summary', summaryPath,
   ...(commissionedBy ? ['--by', commissionedBy] : []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roast-my-design-system",
-  "version": "9.0.3",
+  "version": "9.0.5",
   "mcpName": "io.github.gregkozakiewicz/roast-my-design-system",
   "description": "Your AI can write the UI. This makes sure it writes your UI. A deterministic scanner scores your design system 0-100 against 112 public repos, reads React and web components (Stencil, Lit), hands you a copy-paste fix prompt for each top finding, writes rules for Claude, Cursor, Copilot and Windsurf with --apply, and runs as a local MCP server with --mcp.",
   "keywords": [

package/skills/roast-my-design-system/scripts/harvest/index.mjs

@@ -295,7 +295,9 @@ writeFileSync(outPath, JSON.stringify(harvest, null, 2));
 // itself from harvest.json. Run directly (the skill flow), everything prints
 // here in one go, with the real output path at the end.
 for (const l of headerLines(harvest)) console.log(l);
-if (process.env.ROAST_EPHEMERAL_OUT !== '1') {
+// --ephemeral-out: the npx wrapper deletes the harvest right after, so the
+// path is not worth printing (a flag since 9.0.4; it was an env var)
+if (!process.argv.includes('--ephemeral-out')) {
   for (const l of detailLines(harvest)) console.log(l);
   console.log(`\n  → ${outPath}   (${harvest.tookMs}ms)`);
 }

package/skills/roast-my-design-system/scripts/lib/version.mjs

@@ -1,7 +1,7 @@
 // Single version constant for the engine — imported by diagnose (report
 // footer) and rules (generated-by line). This is the bump spot that used to
 // live as a const inside diagnose/index.mjs.
-export const VERSION = '9.0.3';
+export const VERSION = '9.0.5';
 // The shape of harvest.json and summary.json. Bumped only when a field is
 // renamed, removed or changes meaning; a new field is not a new schema. A
 // tool comparing two scans compares like with like by this number, not by VERSION.