
Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
Render HTML to an image and display it inline in Kitty/iTerm2-capable terminals. No browser — CSS layout via DropFlow.
Render HTML to an image and display it inline in a graphics-capable terminal (Kitty, WezTerm, Ghostty, iTerm2).
This is not a headless browser. It's a thin CLI that pipes HTML through DropFlow (a real CSS layout engine, no JS/no Chromium) to a PNG, then emits the Kitty graphics protocol or iTerm2 inline-image protocol on stdout.
Built for AI agents that have something nice to show you — a styled report, a small table, a card — without taking over your screen with a browser.
npm install -g kittyhtml
Or one-shot, no install:
npx kittyhtml --demo
Requires Node 20+. Pulls in @napi-rs/canvas (prebuilt native binary, no compile step) and dropflow. Two deps total, ~90 KB tarball.
kittyhtml --demo # bundled demo page
echo '<h1>hi</h1>' | kittyhtml --width 400
kittyhtml report.html --scale 2 -o report.png # write PNG to file
| flag | default | description |
|---|---|---|
--width N | 800 | viewport width in CSS px |
--height N | auto-fit | fixed canvas height |
--scale N | 1 | pixel ratio (try 2 for retina-sharp text) |
--background CSS | — | fill canvas before painting, e.g. #fff |
--format auto|kitty|iterm2 | auto | output protocol; auto-detect from $TERM/$TERM_PROGRAM |
--out, -o PATH | — | write PNG to file (use - for raw PNG on stdout) |
--demo | — | render the bundled demo page |
import { renderHtml, encode } from 'kittyhtml';
const png = await renderHtml('<h1>hello</h1>', { width: 400, scale: 2 });
process.stdout.write(encode(png, 'kitty'));
Releases publish via GitHub Actions using npm trusted publishing (OIDC, no long-lived token). To cut a release:
npm version patch # or minor / major — bumps package.json and tags
git push --follow-tags
The Publish to npm workflow fires on the v* tag, exchanges a GitHub OIDC token with npm for a one-shot publish token, and publishes with --provenance so each release carries a Sigstore attestation linking it back to the source commit.
DropFlow implements a serious subset of CSS but isn't a browser. Things to know when writing HTML for it (as of DropFlow 0.6.x):
background-color, not the background shorthand.max-width / min-width aren't supported yet — use width.list-style markers don't render; use • or numbers inline.border-radius, box-shadow, transform, and position: absolute/fixed aren't supported yet.--background <css> to fill the canvas.See the DropFlow README for the full support matrix.
Noto Sans (regular, bold, italic, bold-italic) and Noto Sans Mono (regular, bold) ship inside the package as latin-subset TTFs (~160 KB total). No CDN fetch on first run; works offline. Reference them in HTML with font-family: 'Noto Sans', sans-serif and font-family: 'Noto Sans Mono', monospace.
A bundled skill lets Claude Code render output as a styled inline image when you ask for it as "kittyhtml" or "khtml". After a global install:
mkdir -p ~/.claude/skills
cp -r "$(npm root -g)/kittyhtml/skill/kittyhtml" ~/.claude/skills/
Then in any Claude Code session: "give me this report as kittyhtml" — the agent will generate DropFlow-compatible HTML and pipe it through this CLI. The skill is narrow on purpose; it only triggers on those keywords.
If you're an AI agent on a host with kittyhtml installed and the user is on a graphics-capable terminal, pipe your HTML through it instead of dumping markup as text:
echo "$HTML" | kittyhtml --width 700 --scale 2
The image is one frame in the scrollback — no popups, no new windows.
FAQs
Render HTML to an image and display it inline in Kitty/iTerm2-capable terminals. No browser — Rust + Blitz layout, headless CPU rasterization.
The npm package kittyhtml receives a total of 26 weekly downloads. As such, kittyhtml popularity was classified as not popular.
We found that kittyhtml demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.