From 6d61ae73a5f461521a8a40b098f12e7360660edb Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 27 Sep 2026 22:02:37 +0300 Subject: [PATCH 1/4] docs: link screenshot limits and package contents to their sources --- README.md | 12 +++++------- docs/DISTRIBUTION.md | 16 ++++++++-------- 2 files changed, 13 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index f819d40..c56fe12 100644 --- a/README.md +++ b/README.md @@ -114,13 +114,11 @@ traversal, backslashes, control characters, and percent-encoded path segments. Generated output paths must stay within the current working directory. Screenshots append a timestamp to the requested filename and report the actual path written, so repeated captures do not reuse cache-prone filenames. -Captures reject non-JPEG/PNG responses and detected framing or decoding errors. -JPEG scan completion and restart order are checked before saving. -Captures accept up to 64 MiB of compressed data and 8,847,360 pixels (including -3840×2160 UHD and 4096×2160 DCI 4K); JPEG decoding has a 256 MiB memory limit. -PNG width and height are each limited to 8192 to bound decoder row allocations; -decompression is bounded by the declared pixel dimensions. Original image -bytes are preserved. Detected image errors use the normal capture retry path. +Captures are decoded and checked before saving, then written as the original +bytes. Non-JPEG/PNG responses, framing or decoding errors, and images beyond the +size limits in [`src/screenshot-image.ts`](https://github.com/putdotio/rokit/blob/main/src/screenshot-image.ts) +(4096×2160 DCI 4K fits) go through the normal capture retry path and fail if +they persist. ## Library Use diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index b3aa313..56ffab5 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -9,9 +9,9 @@ Merges to `main` are considered publishable. The CI workflow runs: 1. `verify` on pull requests and `main` pushes. 2. semantic-release on `main` after `verify` passes. -semantic-release analyzes conventional commits, publishes to npm, creates GitHub Releases, and writes release metadata when needed. +semantic-release analyzes Conventional Commits; a releasable commit publishes to npm, creates a GitHub Release, and commits the released `package.json` version back to `main` with `[skip ci]`. -The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a tagged commit; the semantic-release action and plugin pins live there. [`scan.yml`](../.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. +The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a tagged commit; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/rokit/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch. ## Release Credentials @@ -30,11 +30,11 @@ Release writes use the `putio-releaser` installation token. The default `GITHUB_ ## Package Contents -The npm package includes `dist`, `README.md`, `docs`, `examples`, `skills`, -`AGENTS.md`, `CONTRIBUTING.md`, and `SECURITY.md`. The docs, consumer skill, and -generic live probe are included so agents consuming the package can inspect -distribution, security, and generic Roku proof mechanics without cloning extra -private context. +`files` in [`package.json`](https://github.com/putdotio/rokit/blob/main/package.json) +lists what the npm package ships. It carries the docs, consumer skill, and +generic live probe so agents consuming the package can inspect distribution, +security, and Roku proof mechanics without cloning the repository. Packaged docs +link files outside the tarball by absolute GitHub URL. The published dependencies pin Effect, platform-node, and platform-node-shared to the same prerelease. Keep those pins aligned: a consumer does not inherit this @@ -58,7 +58,7 @@ gh release list --repo putdotio/rokit --limit 5 npm view @putdotio/rokit version ``` -Live Roku behavior is not required for npm release. Real-device checks are local/manual because they require a developer-enabled Roku: +Releases do not need a Roku. Real-device checks stay local because they require a developer-enabled device: ```bash ROKIT_TARGET= pnpm live:smoke From dff5f1ae33610b8fbba64ba6c7d1fed2cc217df5 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 27 Sep 2026 22:05:14 +0300 Subject: [PATCH 2/4] docs: point the skill at describe instead of unpackaged source --- skills/rokit/references/live-proof.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/skills/rokit/references/live-proof.md b/skills/rokit/references/live-proof.md index 06fc244..a60f5ca 100644 --- a/skills/rokit/references/live-proof.md +++ b/skills/rokit/references/live-proof.md @@ -13,8 +13,8 @@ rokit describe proof ``` Use `README.md` for the public command overview. Use the one-command form to -keep context small when you already know the command family. Use `src/cli.ts` -when command behavior and docs disagree. +keep context small when you already know the command family. When the docs and +`rokit describe` disagree, trust `describe`. ## Quick Reads From 4a2a1129093943167b137ea495199ee65100539b Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 27 Sep 2026 22:07:28 +0300 Subject: [PATCH 3/4] docs: keep screenshot limits in the packaged README --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index c56fe12..4c5c5f4 100644 --- a/README.md +++ b/README.md @@ -115,10 +115,10 @@ Generated output paths must stay within the current working directory. Screenshots append a timestamp to the requested filename and report the actual path written, so repeated captures do not reuse cache-prone filenames. Captures are decoded and checked before saving, then written as the original -bytes. Non-JPEG/PNG responses, framing or decoding errors, and images beyond the -size limits in [`src/screenshot-image.ts`](https://github.com/putdotio/rokit/blob/main/src/screenshot-image.ts) -(4096×2160 DCI 4K fits) go through the normal capture retry path and fail if -they persist. +bytes. Limits: 64 MiB compressed, 8,847,360 pixels (4096×2160 DCI 4K fits), +8192 px per PNG side, and 256 MiB of JPEG decoder memory. Non-JPEG/PNG +responses, framing or decoding errors, and images over a limit go through the +normal capture retry path and fail if they persist. ## Library Use From 7dbcb687e5e66a70c8dbf1e905bda3f36ee0e2f0 Mon Sep 17 00:00:00 2001 From: Altay Date: Sun, 27 Sep 2026 22:08:04 +0300 Subject: [PATCH 4/4] docs: link the packaged package.json relatively --- docs/DISTRIBUTION.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md index 56ffab5..eca5eb7 100644 --- a/docs/DISTRIBUTION.md +++ b/docs/DISTRIBUTION.md @@ -30,7 +30,7 @@ Release writes use the `putio-releaser` installation token. The default `GITHUB_ ## Package Contents -`files` in [`package.json`](https://github.com/putdotio/rokit/blob/main/package.json) +`files` in [`package.json`](../package.json) lists what the npm package ships. It carries the docs, consumer skill, and generic live probe so agents consuming the package can inspect distribution, security, and Roku proof mechanics without cloning the repository. Packaged docs