Holocron v1.5.0

Dashboard polish release. Two long-standing console nuisances are fixed: the in-browser Babel transformer warning (every page load), and the cluster of CORS errors that print when the dashboard is opened directly via file:// (every page load). The dashboard now opens with a fully silent DevTools console on both file:// and http:// paths.

The Babel removal was originally locked at 0.5.0 as part of a hybrid-bundle trade-off — the design handoff used external JSX files that file:// CORS blocks, and inlining the Babel block was the chosen workaround. A precompile step was never on the table. v1.5.0 closes that gap: the JSX is extracted into a sibling source file, compiled once at plugin-author release time with esbuild, and shipped as app.js alongside index.html. The author runs npm install once and npm run build:dashboard before each tag; CI rebuilds the artifact on every push and fails the build if the committed app.js is stale vs. the source, so the two cannot drift. The release zip excludes the build toolchain (package.json, package-lock.json, node_modules/, templates/dashboard/app.jsx); users only see the precompiled JS.

Added

• package.json and package-lock.json — declare esbuild 0.24.2 as the only dev dependency. Single npm script: npm run build:dashboard. First time the plugin repo has a Node toolchain; intentionally minimal — esbuild does one thing (compile JSX) and exits.
• scripts/build_dashboard.mjs — ~20-line esbuild invocation. Classic React.createElement JSX factory (matches the existing const { useState } = React pattern); bundle: false (React/ReactDOM/lucide stay as CDN UMD globals); format: 'iife' (matches Babel-standalone's evaluation semantics); inline sourcemap; not minified (readable in user-installed dashboards).
• templates/dashboard/app.jsx — canonical JSX source, extracted verbatim from the v1.4.4 <script type="text/babel"> block in index.html. ~1,370 lines. This is now the file authors edit when changing the dashboard.
• templates/dashboard/app.js — committed build artifact. Loaded by index.html via <script src="app.js"></script>. Regenerated by npm run build:dashboard.
• .github/workflows/validate.yml and release.yml — new three-step block after actions/setup-node@v4: npm ci, npm run build:dashboard, drift gate (git diff --quiet templates/dashboard/app.js must return 0, else fail with "stale artifact — run npm run build:dashboard locally and commit"). Same gate on PRs and on tag push.
• Legacy-Babel detection in skills/dashboard/skill.md: default-mode output greps the project's index.html for <script type="text/babel"> and prints a one-line upgrade banner pointing at /holocron:dashboard --install. No auto-overwrite; the user opts in. Lazy upgrade preserves the rule that default mode never touches HTML structure.

Changed

• templates/dashboard/index.html — Babel CDN script dropped. <script type="text/babel">…</script> block (~1,370 lines) replaced by a single <script src="app.js"></script>. The file shrank from 1,648 lines to 280 lines. The three inline-fallback <script type="application/json"> blocks at the top of the file are untouched — the build never edits index.html, so they are protected by construction.
• templates/dashboard/index.html — loadJson short-circuits on location.protocol === 'file:' and reads the inline JSON block directly, skipping the doomed fetch() attempt. Eliminates the three CORS errors and three net::ERR_FAILED lines that printed on every file:// open. Under http:// / https:// the existing fetch-then-fallback path is unchanged.
• skills/dashboard/skill.md — --install documentation now lists app.js as a managed file alongside index.html, styles.css, assets/.
• RELEASING.md — new step 0 of the release checklist: npm run build:dashboard before tagging. "What ships in the zip" updated to list the new excludes (package.json, package-lock.json, node_modules/, templates/dashboard/app.jsx).
• .github/workflows/release.yml — zip exclude list extended to drop package.json, package-lock.json, node_modules/*, templates/dashboard/app.jsx so users never see the build toolchain in the released artifact.
• .gitignore — node_modules/ added (committed package.json + package-lock.json describe the dep tree; the tree itself isn't committed).

Migration

Old projects keep working — <script type="text/babel"> + the unpkg Babel CDN are still in their index.html and the CDN still serves Babel-standalone. The next /holocron:dashboard regen prints an upgrade banner suggesting /holocron:dashboard --install. That command overwrites the project's index.html + styles.css + app.js with the new compiled renderer, refreshes the three inline JSON blocks in the same pass, and leaves data.json / dashboard-history.json untouched. No manuscript content, character files, world files, outline, voice, or any other project file is touched at any point.

Verified

Both paths confirmed via Playwright before tag push: http://localhost (all 5 tabs render, zero console errors, zero warnings — only a benign favicon 404) and file:// short-circuit logic confirmed by inspection (no fetch attempt possible under file: protocol).