v2.2.2

Install or upgrade with npx framesmith, or npm i -g framesmith.

Approvals now notice design-system changes

A canvas's versionHash covered only the tokens stored on the canvas, not the workspace and project design-system tokens it inherits. Editing a shared design system restyled every inheriting canvas while every hash stayed the same, so framesmith verify kept printing OK.

The hash now covers the whole set of tokens the canvas inherits (workspace → project → canvas), whether or not the canvas uses each one. Any edit at either inherited layer, even adding a token no screen uses yet, moves the hash of every canvas under it, so expect to re-record approvals after a design-system edit. The one exception is a token a canvas overrides itself: an inherited edit to it doesn't change that canvas, and its hash stays the same. (Corrected after release: these notes first said only canvases that use the changed token were affected. #221) Metadata still never moves the hash. (#217, #218)

Thanks to @jacksunny18 for the report.

A bound server no longer overwrites pulled design-system changes

A framesmith server bound to a repo read .framesmith/workspace.json only at startup. If the file changed while it ran, for example after a git pull, the server kept rendering the old tokens. Its next workspace or project change, even an unrelated one like creating a project, wrote the old tokens back over the pulled ones. The server now reloads the file when it changes on disk, as it already did for canvas files. (#219)

Upgrading

• New hash format. New hashes look like sha256r:<16 hex>. Old sha256: hashes still verify, with a warning: verify prints it to stderr and adds a warning field to --json output, and canvas_version adds the same field. An old hash keeps the old blind spot, so re-record your approvals with the current versionHash when you can. A script that checks that hashes start with sha256: needs updating.
• Every hash changes once. The prefix changes for every canvas, and the hex part changes too for any canvas that inherits tokens, so a re-recorded approval never equals the old string.
• Treat a missing hash as a failure. verify exits 2 without --hash. A gate that treats a non-zero exit as "skip" can't tell "never approved" apart from "approved and unchanged".