v2.1.4 — On-screen dice roller for no-phones games

Co-authored with @ethan-piper. Consolidates the on-screen dice roller + the hardening follow-ups (#47 / #48 / #49) plus the release-cut completion in #51.

What's in 2.1.4

On-screen dice roller (#48)

A fifth Dice launcher on the editorial rail slides out a drawer hosting the same `#dice-pad` players use on their phones — reel, die grid, advantage, modifier, label, prescribed-roll prefill — reused 1:1, costs zero screen space when closed.

Under `roll_mode: players`, the DM prescribes a roll via `send.py --dice-request … --wait`; the server tracks which characters have a live phone bound (`/stream?character=`) and routes the roll there if so, or auto-opens the on-screen drawer if the target has no phone. A Settings "Roll on screen" toggle forces on-screen rolling regardless.

Rolls go through the existing `POST /player-input/dice` (server-authoritative, resolves the request, releases the DM's `--wait`). Editorial-skin only; opt-in.

Pref endpoint hardening (#47)

`/narration-pref` and `/roll-pref` now sit behind the same `_token_ok()` + rate-limit gate as every other write endpoint (they previously accepted any LAN request). `/roll-pref` additionally validates the `character` field with `_char_ok()` — it gets templated into a `[[ roll mode: …]]` directive in the DM's prompt, so an unsanitized value was a prompt-injection surface.

Editorial NPC dialogue size fix (#51)

NPC pull-quotes dropped from `1.5em` to `1.2em` (line-height `1.42`) — the previous 1.5× jump over body text was overlarge and overflowed the reading column.

Internal hardening (#49)

Defensive `_prefill` guard + dev `console.warn` around the TV-view dice-routing wrap, and unit tests for `_phone_present()` (routing-presence semantics).

Update

```
/plugin update dm
```

then `/reload-plugins` (or restart Claude Code) to pick it up. As of #51 the marketplace correctly advertises 2.1.4, so this serves the new code.

v2.1.3 — Roll handling · Phone turn-flow · Editorial sheet · TCC-safe autorun

Bundles v2.1.0 → v2.1.3 onto v2.0.x. Co-authored with @ethan-piper.

Highlights

2.1.0 — Reading text size · Narration length · Phone turn-flow

• Text Size stepper in Settings (A− / A+, click % to reset) scales the reading column via font-size multiplier so narration stays legible across the room from a Chromecast. Persists per-browser (localStorage["dnd-text-scale"]), applied anti-FOUC.
• Narration length slider (250–2500 words) — POSTs to /narration-pref; check_input.py prepends a [[Narration length…]] directive so the DM honors it as a hard per-turn budget.
• Phone turn-flow redesign — plain status strip (Your move → Sending… → Sent → ✓ DM has your move → narrating), one-tap staging (auto-ready), trust-LAN default for device approval (DND_REQUIRE_APPROVAL=1 restores the gate).

2.1.1 — Enforced roll handling + move-received confirmation

• No more silent auto-rolling of PCs. Roll handling is chosen at game start (/dm:dnd new and /dm:dnd load ask "Dice rolls?") and stored as roll_mode in state.md. Under players, the DM calls each PC d20 by name and waits; under auto, rolls openly with full math. Initiative + NPC/monster rolls stay DM-rolled.
• Per-player roll override — phone Settings Rolls toggle flips a bound PC between Players / Auto. POSTs to /roll-pref; surfaced as a [[<Char> roll mode: …]] directive that overrides the campaign default.
• "Move received" confirmation — phone shows ✓ The DM has your move when the DM actually picks up the queued action.

2.1.2 — Editorial character-sheet theming

• Character-sheet modal innards fully themed for Editorial: vermilion titles + ability modifiers, ink body text, hairline dividers, portrait drop-shadow removed, broken class-icon onerror removal. Before this, sheet innards still rendered Vellum gold inside the editorial paper canvas. Now coherent end-to-end.

2.1.3 — TCC-safe autorun wait

• Autorun mode no longer breaks under macOS TCC. The shell autorun-wait.sh redirect is silently blocked by TCC when the data root lives under `~/Documents`. Replaced with autorun_wait.py — identical output contract, python file I/O that TCC permits.

Plus

Folds in the v2.0.1 doc-fix queue: stale `/dnd` → `/dm:dnd` sweep, broken README image paths corrected. No separate v2.0.1 release needed.

Update

```
/plugin update dm
```

then `/reload-plugins` (or restart Claude Code) to pick it up.

v2.0.1 — Doc fixes (README images, /dnd → /dm:dnd)

Patch release. No behavior changes; doc-only fixes flagged during the v2.0.0 review.

• README image paths fixed. Top-level README icons (logo + every feature bullet) now resolve. The v2.0.0 restructure moved display/icons/*.png to skills/dnd/display/icons/*.png but the top-level README still pointed at the old path, so the repo page rendered with broken images for ~24 hours after v2.0.0.
• Stale /dnd command refs swept to /dm:dnd. ~148 internal references across SKILL.md, SKILL-commands.md, and SKILL-scripts.md. The model loads these as its operating playbook, so an instruction to "type /dnd save" wouldn't resolve under the plugin. Path references like ~/.claude/dnd/ and skills/dnd/ are unaffected.
• update_skill.py plugin-mode heuristic narrowed from any /plugins/ path substring to .claude/plugins/ specifically. Prevents a dev tree with a plugins directory from false-positively reporting plugin-managed mode.

No migration needed. /plugin update dm (or wait for Claude Code's marketplace auto-refresh).

v2.0.0 — Plugin-only · Neural Initiative org · v1→v2 migration

v2.0.0 ships the D&D skill as a Claude Code plugin at the new home neuralinitiative/claude-dnd-skill. The standalone install (~/.claude/skills/dnd, /dnd) is retired; the skill now installs as dm@neural-initiative and invokes as /dm:dnd.

Install

/plugin marketplace add neuralinitiative/claude-dnd-skill
/plugin install dm@neural-initiative

Then use /dm:dnd.

If you have a v1 standalone install

Run the one-time migration helper after installing the plugin:

python3 <plugin>/skills/dnd/scripts/migrate_v1_to_v2.py

It carries over device approvals, the display auth token, and TLS certs so paired phones stay paired and HTTPS stays trusted. Campaign data is never moved — it lives at the shared data root and both versions read it identically. Full guide: MIGRATING.md.

What's new

• Plugin-only distribution. One supported packaging path; v1.x frozen on legacy-1.x branch (unmaintained).
• Runtime state survives /plugin update. Device approvals, TLS certs, auth tokens, and session state moved out of the code dir into <data-root>/.runtime so they aren't wiped when the plugin code dir refreshes.
• Neural Initiative org. Repo at github.com/neuralinitiative/claude-dnd-skill; the hosted version is at neuralinitiative.ai. GitHub's permanent redirects keep existing Bobby-Gray/* URLs resolving — no external breakage.
• One-time v1→v2 migration helper with --dry-run / --yes / --keep-standalone, symlink-safe, idempotent, never deletes (backs up to dnd.v1-backup-<timestamp>).

Co-authored with @ethan-piper, whose #43 landed the restructure and migration helper.

Rollback

Nothing is deleted. To return to v1, move the backup dir back, or reinstall from the frozen legacy-1.x branch.

---

Full notes in CHANGELOG.md. Migration edge cases → please file an issue.