v10.2.1

Two small corrections to 10.2.0. Nothing the scan counts changes.

• The report's header line now reads "built, generated or minified
  JavaScript files not read": the rule also catches generated source such
  as Spectrum's icon tables and Airflow's API client, which nobody typed
  either.
• The test for that rule wrote a minified-looking line of JavaScript as
  its sample. The sample is now built from plain pieces at test time, so
  no file in the repository holds minified-looking code.

v10.2.0

Built or minified JavaScript committed to a repo is no longer read as the
product's code.

• Built and minified JavaScript is left out, and named. The scan
  already skipped dist/ and .next/ by folder name and left out
  minified stylesheets. It still read a library's bundle kept beside the
  source (casdoor and percona keep Swagger UI's, 221 colours each) and a
  framework's build output kept inside a package (DB-GPT keeps its Next.js
  chunks, 1 MB each with 200 to 500 colours apiece; dkron keeps ui-dist;
  yapi keeps static/prd). Those colours counted as the repo's own, and on
  percona, doocs/md and DB-GPT they were enough to make the repo read as
  token-led. A code file is now left out when its name ends in .min.js
  or when it holds a line longer than 5,000 characters, which no one
  typed. The report's header names the files: "5 built or minified
  JavaScript files not read: swagger-ui-bundle.js, …". The same rule
  applies in the walk, so the report, the MCP server and the guard read
  the same files. A stylesheet called .min.css is left out by name too,
  even when it was pretty-printed afterwards.
• Scores. Of 210 repos scanned before and after, 6 move. Four up,
  where a bundle's colours had been counted as strays: nhost 18 to 30,
  yapi 19 to 24, dkron 80 to 85, casdoor 87 to 91. Two down, where a
  bundle's colours had been counted as tokens and made the repo look
  token-led: DB-GPT 39 to 30, doocs/md 55 to 50. 17 more change a count
  without changing the score. No hosted example moves. The benchmark is
  not rebuilt; yapi, DB-GPT and percona sit in its Ant Design and MUI
  groups.
• One known edge. A hand-written file that carries one pasted blob on
  a single long line (doocs/md keeps a 63,000-character line inside a
  component file) is left out whole. The report names it, so it is
  visible rather than silent.

v10.1.5

One fix, reported in issue #2: the fallback inside var() was counted as
a colour written by hand.

• A var() fallback is not a hardcoded colour. In
  color: var(--TextColor, #333); the #333 only shows if the variable
  is missing. The line reads the theme. The full report already left out
  the simple case in a stylesheet. Three places still counted it:

  • the live checks (--check, the check after each edit, the MCP
    validate and review tools) flagged every fallback;
  • the report counted a fallback written as rgb() or hsl();
  • the report counted a fallback inside an inline style in a component.

  The report, the live checks and the guard now read fallbacks with one
  rule in lib/declarations.mjs. A var() nested inside a fallback is
  still read as a use of that variable. A colour written beside a
  fallback still counts.

• A test that the report and the live checks agree. The rule had been
  fixed in the report's reader on 17 September and not in the reader the
  live checks use, and no test compared the two. The suite now puts 23
  sample lines through both and fails when they give different answers.
  On its first run it found one more difference, which is listed in the
  test as known and open: a colour written loose in a .tsx or .jsx
  file (a constant, a prop, a styled-components block) is flagged by the
  live checks and not counted by the report. Closing it changes what the
  score measures, so it is not part of this release.

• Scores. Of 210 repos scanned before and after, 2 scores move, both
  up: adobe/react-spectrum 50 to 55 and primer/react 55 to 60. 25 more
  change a count without changing the score. In one repo (doocs/md) 18
  colours move from tokens to strays: they were fallback values in a
  theme file that had been read as token definitions. No hosted example
  changes its score. The benchmark is not rebuilt.

v10.1.4

One rule for what a demo is, the Roast icon on the report, and a list of
the files the scan read for the guard.

• One rule for stories, examples and demos. Two places decided what a
  demo is. The scan left out examples/, demos/, tests and
  *.stories.tsx files, and read a stories/ folder. The palette tile
  and the live palette check left the stories/ folder out as well. So a
  story folder's colours were missing from the palette count and present
  in every other tile. Both now read one rule in lib/demo.mjs. Left out
  from this release: folders named stories, __stories__, _stories,
  storybook and fixture, folders whose name starts with storybook
  (an in-app storybook kept as routes/storybook.colors/), and a
  component's stories kept as stories.tsx. Names are matched exactly: a
  file called story.ts or storybook-icon.tsx is still read.
• Scores. Of 210 repos scanned before and after, 3 scores move, all
  up: adobe/spectrum-web-components 72 to 83, adobe/react-spectrum 45 to
  50, twenty 40 to 45. Thirteen more change a count without changing the
  score. The benchmark is not rebuilt. A component that only its own
  stories import now reads as never imported (formbricks: 3 to 10).
• The report carries the Roast icon. The browser tab and a phone's
  home screen showed an older pencil icon and the author's mark. Both now
  show the product icon from assets/roastmds.svg. The footer keeps the
  author's mark beside his name.
• For the guard: the files the scan read. learnSystem() returns
  filesRead, every file the scan's walk read, so guard-my-design-system
  can judge only those files. isDemoPath(file) replaces the pattern
  DEMO_PATH_RE in the engine's doorway.
• The Spectrum example page, the README and the landing page show the new
  score.

v10.1.3

Six small changes so the plugin directory's report reads cleaner. Nothing
the scan, the report, the rules or the MCP server does changes.

• The report's and the rules file's web addresses live in one small
  file. The directory's checker reads a web address beside the word
  "token" as a credential being sent to a server, and the two files that
  print those links talk about design tokens on most lines. The links now
  come from lib/links.mjs; the footer and the rules file print the same
  text as before.
• Two test samples lose a web address they did not need, the plugin
  manifest loses the keyword design-tokens (the marketplace entry and
  the npm package keep it), and the unlisted pins preview page is removed
  from the docs folder; the prototype lives in the private notes.

v10.1.2

The test fixtures and their snapshots are stored one file each. Nothing
the scan, the report, the rules, the MCP server or the npm package does
changes.

• Each test fixture is one JSON file. The suite scans 29 small sample
  repos and compares the result with saved snapshots. They were 403 loose
  files plus 150 snapshot files, and the claude.ai plugin directory counts
  every file in the repository against a limit of 512. Each fixture is now
  tests/fixtures/<name>.json and each fixture's snapshots are
  tests/expected/<name>.json, with text kept line by line so diffs still
  read. The suite unpacks the fixtures into a temporary folder before it
  runs; every check is the same and all 461 pass unchanged. The repository
  has 225 tracked files. node tests/fixtures.mjs unpack <name> gives a
  fixture back as a folder to edit, and pack <name> stores it again.

v10.1.1

The plugin's files are back where they were, at the repository root.

• 10.1.0 moved the plugin into plugin/ to bring the claude.ai plugin
  directory's file count under its 512 limit. The directory does not let
  a submission change its plugin path, so the move would have meant a new
  submission and a new place in the review queue. The files are back at
  the root, the marketplace entry points at ./, the npm package ships
  from the same paths as 10.0.0, and the guard's engine alias is as it
  was.
• The plugin's icon and the fixes to file sizes from 10.0.0 stay.

v10.1.0

The plugin's files move into one folder. Nothing the scan, the report, the
rules or the MCP server does changes.

• The plugin lives in plugin/. The manifest, the two skills, the
  hooks and the command-line entry point now sit in plugin/, with the
  tests, the docs, the benchmark builder and the examples outside it. The
  claude.ai plugin directory counts every file in the folder that holds
  the manifest and holds a plugin for review above 512 files. With the
  manifest at the repo root the count was 716, 585 of them test files;
  the plugin folder now holds 69. The marketplace entry points at the new
  folder, the npm package ships the same files from the new path, and the
  guard imports the engine through the same roast-my-design-system/engine
  alias as before.
• Installing by hand: the copy commands in the README now read
  plugin/skills/....

v10.0.0

The benchmark is rebuilt, so scores move. 17 of 205 scanned repos change,
13 up and 4 down, none by more than 10 points. The hosted examples keep
their scores except Spectrum, which goes from 66 to 72.

• The benchmark counts like the scan. The three builders recomputed
  every number by hand and had drifted from the scan since the benchmark
  was built on 9.0.0. They did not skip email templates, they counted
  greys from hex values alone, they counted duplicate pairs that compose
  each other, and they counted brackets inside installed shadcn code. One
  measurer now runs the scan's own harvest on each repo and takes the
  numbers from the functions the score uses. The fleet medians move: greys
  21 to 28, duplicates 21 to 16, brackets 77 to 56. The shadcn group: greys
  11 to 15, duplicates 21 to 14, inline styles 45 to 33, brackets 131 to
  201. All 34 fleet repos, 10 reference systems and 6 groups were rebuilt
  from the same clones on 3 October 2026.
• A web-components group. A library built with Stencil or Lit is now
  compared with seven such systems (Spectrum Web Components, Shoelace,
  Scale, Ionic, Material Web, Siemens iX, Lion) instead of the React
  fleet. The tiles say "Avg web-component repo". The benchmark now covers
  119 repos.
• On a shadcn repo the theme sheet is the token file. The token file
  was the file with the most token colours. On 26 of 50 shadcn repos that
  was not the theme sheet: nhost's was an MUI theme file, casdoor's a
  swagger bundle. The rules file, the report and the MCP context now name
  the sheet, and the MCP context counts the tokens that file states.
• A CSS keyword is not a typeface. A font-family of "inherit
  !important" reached the typeface list, and lightdash's context named it.
  !important is stripped and the keywords are left out.
• Smaller files for the plugin directory. The unlisted pins preview
  page carried its screenshots as text; they are image files now, and the
  page is 160 KB at the same address. The README's full-page screenshot
  is a 770 KB JPEG instead of a 1.1 MB PNG.

v9.9.0

The colour usage bar reads more of the repo. No score changes on any of
the 205 scanned repos; the bar is display only.

• Colour names, color-mix() and light-dark() are read. A theme value
  written as a name such as whitesmoke, mixed with color-mix() or chosen
  with light-dark() was drawn as a cell with no swatch. All 148 CSS colour
  names now resolve, color-mix() is mixed by weight, and light-dark()
  takes its daylight side. A hand-written colour name in a stylesheet now
  counts as the stray it is.
• A class reads the theme its package can see. A class name a package
  did not define was answered from any package in the repo. formbricks'
  web app imports only its own stylesheet, and its shadcn class names were
  drawn in a sibling package's colours. The bar now follows the
  stylesheets a package imports from code and from other sheets, a bare
  package name through its exports map, a v4 sheet's @config and @source
  lines, and the presets a config reaches. A package with no stylesheet
  import the scan can follow keeps the old reading. A config value built
  in code, such as react-email's slate from @radix-ui/colors, is the
  theme's, drawn without a swatch, rather than a dead name.
• Sass and Less variables are read. $name and @name statements across
  the repo's stylesheets are followed to a literal. A read in a colour
  property counts as the theme by name, with a swatch when the value is
  readable and without one when a function builds it. A variable
  statement's hex now counts as a definition, not a hand-written stray.
• JavaScript theme objects are read. A theme kept as an object literal
  is flattened to paths such as font.color.tertiary, references are
  followed, and functions are left unread. No code is run. A read such as
  theme.colors.primary600 matches an object keyed primary600.
• Nine repos move from the written-value bar to the use bar:
  govuk-frontend, devlake, appsmith, redash, grafana, n8n, outline, twenty
  and bruno. Ten keep the written-value bar, because their theme comes
  from a package outside the repo or is built in code, and the page now
  says so. The "how this is counted" fold says how many Sass, Less and
  JavaScript values the by-name count includes.