
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
Render HTML to an image and display it inline in Kitty/iTerm2-capable terminals. No browser — CSS layout via DropFlow.
Render HTML to an image and display it inline in a graphics-capable terminal (Kitty, WezTerm, Ghostty, iTerm2).
This is not a headless browser. It's a thin CLI that pipes HTML through DropFlow (a real CSS layout engine, no JS/no Chromium) to a PNG, then emits the Kitty graphics protocol or iTerm2 inline-image protocol on stdout.
Built for AI agents that have something nice to show you — a styled report, a small table, a card — without taking over your screen with a browser.
# from this directory, until published
npm install
npm link # exposes the `kittyhtml` binary on your PATH
Requires Node 20+. Pulls in @napi-rs/canvas (prebuilt native binary, no compile step) and dropflow.
kittyhtml --demo # bundled demo page
echo '<h1>hi</h1>' | kittyhtml --width 400
kittyhtml report.html --scale 2 -o report.png # write PNG to file
| flag | default | description |
|---|---|---|
--width N | 800 | viewport width in CSS px |
--height N | auto-fit | fixed canvas height |
--scale N | 1 | pixel ratio (try 2 for retina-sharp text) |
--background CSS | — | fill canvas before painting, e.g. #fff |
--format auto|kitty|iterm2 | auto | output protocol; auto-detect from $TERM/$TERM_PROGRAM |
--out, -o PATH | — | write PNG to file (use - for raw PNG on stdout) |
--demo | — | render the bundled demo page |
import { renderHtml, encode } from 'kittyhtml';
const png = await renderHtml('<h1>hello</h1>', { width: 400, scale: 2 });
process.stdout.write(encode(png, 'kitty'));
Releases publish via GitHub Actions using npm trusted publishing (OIDC, no long-lived token). To cut a release:
npm version patch # or minor / major — bumps package.json and tags
git push --follow-tags
The Publish to npm workflow fires on the v* tag, exchanges a GitHub OIDC token with npm for a one-shot publish token, and publishes with --provenance so each release carries a Sigstore attestation linking it back to the source commit.
DropFlow implements a serious subset of CSS but isn't a browser. Things to know when writing HTML for it (as of DropFlow 0.6.x):
background-color, not the background shorthand.max-width / min-width aren't supported yet — use width.list-style markers don't render; use • or numbers inline.border-radius, box-shadow, transform, and position: absolute/fixed aren't supported yet.--background <css> to fill the canvas.See the DropFlow README for the full support matrix.
First run fetches Noto fonts from a CDN via DropFlow's bundled register-noto-fonts.js. Subsequent renders reuse what was loaded. Bundled offline fonts are on the roadmap.
A bundled skill lets Claude Code render output as a styled inline image when you ask for it as "kittyhtml" or "khtml":
mkdir -p ~/.claude/skills
cp -r skill/kittyhtml ~/.claude/skills/kittyhtml
Then in any Claude Code session: "give me this report as kittyhtml" — the agent will generate DropFlow-compatible HTML and pipe it through this CLI. The skill is narrow on purpose; it only triggers on those keywords.
If you're an AI agent on a host with kittyhtml installed and the user is on a graphics-capable terminal, pipe your HTML through it instead of dumping markup as text:
echo "$HTML" | kittyhtml --width 700 --scale 2
The image is one frame in the scrollback — no popups, no new windows.
FAQs
Render HTML to an image and display it inline in Kitty/iTerm2-capable terminals. No browser — Rust + Blitz layout, headless CPU rasterization.
The npm package kittyhtml receives a total of 28 weekly downloads. As such, kittyhtml popularity was classified as not popular.
We found that kittyhtml demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.