Open general

SDK should tell bridge authors how to keep the release zip + pkg tarball clean (no hero images, PNGs, MP4s, duplicated skills) — 649 KB found in one audit

John Lauer · 1d ago

Both bridge artifacts silently accumulate junk, and the SDK never tells authors to check. I just audited the KiCad bridge and found 649 KB of dead weight across the two artifacts — none of it referenced by any runtime code or by any skill.

The release zip (worst case — it is auto-bundled into Adom Desktop, so it ships to every user):

  • 219 KB of hero-image .ttf fonts (Satoshi, Familjen Grotesk)
  • five skills/ trees — already shipped by the pkg, so pure duplication
  • demo/ scripts, README.md, CONTRIBUTING.md, plugin-prompt docs
  • a 22 MB mesa-llvmpipe-x64.zip sat in the repo, one bad glob away from shipping

Result: 488.9 KB → 335.7 KB (-31%), zero functional change.

The pkg tarball:

  • hero.png (381 KB), arch.png, verbs.png, outcomes.png = 496 KB downloaded by every pkg install — and the README never referenced them relatively, it already used absolute /blob/ URLs, so they rendered on the page regardless. Pure dead weight.

Result: 525.5 KB → 29.5 KB (-94%).

Ask: the SDK should state the rules and give authors a checklist.

  1. The release zip carries ONLY what the bridge needs to RUN. No docs, no images, no skills, no samples. (Skills belong in the pkg; duplicating them in the zip is the most common bloat.) Keep: code, certs, helper scripts the handlers shell out to, data files the code reads, the bridge manifest files, and the one runtime SKILL.md AD installs. Exclude: skills/**, demo/**, docs/**, every *.md except the runtime skill, every image/font (*.png *.jpg *.svg *.gif *.ttf *.otf *.woff*), every archive/video (*.zip *.tar.gz *.bundle *.mp4).
  2. No images or binaries in the pkg files[]. Page art is pushed with repo push and referenced by absolute https://wiki.adom.inc/blob/app/<slug>/<name>.png URLs, so it renders on the page without riding in every install.
  3. Stage only the declared files[] into a clean dir and pack from there. Packing from the page repo sweeps up hero images, zips and demo videos — this is how it happens.
  4. Verify before publishing: every local import resolves inside the zip, every data file the code reads is present, then deploy and call the bridge's describe verb + one data-file-dependent verb on a real target.

A bridge lint that fails on images/videos/archives in either artifact would catch all of this automatically.

Reference: adom/adom-desktop-kicad-bridge v0.9.62 (zip) / pkg 1.0.15, and its skills/kicad-bridge-publish/SKILL.md now carries the full KEEP/EXCLUDE policy.

0 Replies

Log in to reply.