Arkitect 2.3.1

Added

• A fourth hook, hooks/diagram-read.mjs: before a Read of a whole .drawio, .dio or .excalidraw, it refuses one the session has not analyzed, and one over 64 KB at all, naming the analyze command to run. A line range with limit passes. Editing a diagram, an agent read the whole file straight after references/editing.md told it to analyze; on a file with embedded icons one Read fills the context (#342).
• arkitect report <file|-> runs the report check on any host: the seven headings, a Render section that describes only a picture someone looked at (--png-viewed declares it), no validate warning explained away, no hosted-editor link. Exit 1 names each problem. Every agent adapter and AGENTS.md step 8 name it; step 8 now lists the report's headings and is 4 bytes shorter. The check ran only as Claude Code's Stop hook before (#302).

Fixed

• analyze and build refuse an --out that names the file they read, exit 2. analyze a.drawio --out a.drawio wrote its JSON summary over the diagram, with no backup and exit 0. analyze no longer writes over a .drawio, .dio, .excalidraw or .excalidrawlib, and build writes only its own engine's files: .drawio, .dio or .xml, and .excalidraw or .json. A build to any other extension, which used to succeed, is now refused (#349).
• Draw.io labels draw text in angle brackets and ampersands as typed: List<String> drew as "List" and <<interface>> as "<>". A spec that wrote < to work around this now shows it literally. validate and analyze read a label's entities, so < counts as one character (#350).
• The build-route hook routes a *.spec.json only when it is an Arkitect spec: the file holds nodes or pages or, before it exists, the prompt calls it a diagram. An OpenAPI or Vega spec in any project was sent to a diagram skill (#355).
• The Excalidraw builder wraps Chinese and Japanese labels between characters, never before a closing mark or after an opening one. They drew as one line past their box. Korean and Latin wrap at spaces as before (#357).
• The Codex route budget test measures the adapter blocks at a fixed root, so the suite passes from a checkout path longer than 85 characters (#358).
• Excalidraw validate warns when nodes sit on top of each other. Two shapes in one place, the likeliest result of a spec that leaves out col and row, passed with no warning, and an arrow between them blamed a loop built before 2.0.0 (#351).
• namesAProduct and Excalidraw validate list only products. A plain "Process" or "Memory" box matched a concept glyph and was reported as a product missing its mark, in two shipped patterns (#352).
• Excalidraw validate names the spec node, boundary or edge after each element id it prints. The builder stamps customData.arkitect on everything it draws, so the committed example scenes are rebuilt; a scene without it reads as before (#353).
• The local Excalidraw container serves the app under a Content-Security-Policy that lets the page reach only the container, published on 127.0.0.1 only. The app is excalidraw.com's, and its Share, Live collaboration and AI tools would post a scene to Excalidraw's servers while the docs said it had no backend. "Browse libraries" in the app no longer reaches its catalogue; arkitect excalidraw browse does (#348).
• The report check reads a reply only when it names a file the session's build wrote, by its --out basename. A status message mentioning "an existing .drawio" hours after a build run to reproduce a bug was sent back for six report headings it could not honestly carry (#345).
• The report check sends back, once, a reply that links the hosted editor (app.diagrams.net, viewer.diagrams.net, draw.io), naming Draw.io Desktop's releases page as the link to give. A report linked "Draw.io Desktop" to www.draw.io. The check uses the eval cases' no-hosted-editor pattern, and a test keeps them identical (#340).
• Draw.io validate warns on a plain box named like a boundary (an account, VPC, subnet, region...), naming the cell and pointing it at boundaries, and on a plain box named for one product with a bundled mark, naming the icon to draw. The build listed both under looksLikeBoundary and namesAProduct, five AWS accounts shipped as flat boxes, and validate passed silent (#341).
• Excalidraw validate warns on a plain shape named like a boundary, by the same rule, naming the spec node (#341).
• A build whose --out replaces a file with no sign of an Arkitect build says so first in its notes: the file's own styling, positions and hand-drawn parts are gone, the original is at the named backup, and an edit goes through references/editing.md. Draw.io reads agent="arkitect-drawio" on <mxfile>, which Desktop rewrites on save; Excalidraw reads the customData.arkitect the builder stamps, since the app writes the same source. An agent asked to add one node rebuilt a hand-drawn file in the house style, and the report was silent (#339).

Changed

• Icon sources re-pinned to their current releases: Simple Icons 16.30.0 to 16.35.0, lucide-static 1.45.0 to 1.57.0, @primer/octicons 19.36.0 to 19.40.0. Seven brands marks are added (alphaXiv, Aspire, Godox, Hypit, Notesnook, SumUp, Zensical), each looked at on its review page with its upstream source checked and recorded in reviews/brands.json; no shipped mark was removed or changed its artwork. 4,850 marks now ship their artwork, 6,012 across both engines (#325).
• Changes what existing specs draw. A cloud vendor's mark draws unattended for a generic architecture noun only when the spec's context.packs or the query names that vendor: "router" drew Google's Cloud Router, "etl" AWS Glue, "state machine" Step Functions, "object storage" S3, and 24 of 63 such nouns drew a vendor mark in one engine or both. The generic vocabulary grows by those nouns; 23 aliases that named an idea, not the product, come off AWS, Azure and GCP marks, and a test holds every vendor alias to its product's name. Both resolvers rank a vendor's mark below a vendor-neutral one at equal strength and do not count it as the neutral one's rival, so "oracle database" draws Oracle's mark, "agent" the neutral agent, "router" a neutral router; Excalidraw no longer reads "cloud" as a vendor word and weighs the shared packs against a native vendor item. A generic noun no longer draws a company named for it ("chatbot", "Oracle Directory"). A vendor named in the query now counts as its stack in Draw.io: "Azure Key Vault" and "Google Cloud Router" draw. A Draw.io spec whose context.packs names the stack now settles a close tie in that stack's favour (#347).
• Changes what existing specs draw. A Draw.io boundary grows to hold the nodes and boundaries that name it as parent, with its own padding, captions included, and a nested boundary sits 30px under its parent's name. Its col/row/cols/rows span is now a minimum, and a boundary that gives none is as big as what it holds instead of one cell at the page origin. A default 190px box crossed both sides of a one-cell scope, and validate passed it. The starter template's pipeline moves 12px down, off the "AWS Cloud" label it touched; it is rebuilt and re-rendered. validate warns on a cell drawn outside its container, naming both (#295).
• The /diagram command for Cursor and OpenCode points at AGENTS.md §2 instead of restating the workflow in four steps that left out the engine reason, validation, render and icons from the report (#354).
• Maintainer-only text moved off agents' reading paths into docs/maintenance.md: AGENTS.md's render-helper internals and pull-request ritual, and both learning skills' instructions for rebuilding the shipped house style, which pointed a write into the plugin. AGENTS.md is held at 14,800 bytes (#356).

Removed

• Node 20 is no longer supported. It reached end of life on 2026-04-30. package.json now asks for Node 22 or newer, doctor fails on Node 20 as it did on 18, every "Node 20+" statement reads "Node 22+", and CI tests Node 22, 24 and 26 (26 becomes LTS on 2026-10-28). Nothing in the code needed Node 22, so a Node 20 install still runs today; it is simply no longer tested or promised (#346).