* fix(cli): check no longer calls films moved by SVG masks, strokes or canvas static
The frozen-sweep guard compared DOM-channel fingerprints only, which never see
SVG mask and clip contents, stroke dashes, or canvas and WebGL pixels. Before
reporting sweep_static, check now compares the rendered frames at the same
sample times; a still verdict stands only when every frame is identical.
* fix(cli): keepsMoving also trusts rendered frames, compared above render noise
keepsMoving read the same DOM liveness channels as the sweep guard, so mask,
stroke and canvas motion failed it as frozen. A span it calls frozen now gets
a frame capture every half maxStaticSec, and spans split where the frames
change. Frames are compared in the page, decoded like the contrast pass, and
count as moved only when at least 16 pixels change by more than 24/255, so
antialiasing and dither noise cannot make a still film pass.
* fix(cli): scoped frame checks see only the scope's own paint
A keepsMoving scope's capture now hides every box outside the scope's subtree,
so a still title over a moving background stays frozen. A span marks only the
frames that still hold its signature, so a span that starts at a cut keeps its
first frame. A scope that matched nothing stays motion_selector_missing. The
sweep counts a frame change only if the first sample time still renders its
first frame, so wall-clock paint is not read as motion under seek.
Color grading paints a video or image into a canvas the runtime inserts right
after it. The layout audit treated that canvas as authored canvas art: the
video's data-layout-* opt-outs never reached it, and canvas_content_at_edge
read full-bleed footage as drawn content cut by the frame. Opt-out lookups now
resolve a grading canvas to its source element, and the edge rule leaves
grading canvases alone, as it does the ungraded video.
* test(player): measure heavy films in real Safari and Chrome on macOS
* test(player): count runtime media seeks and rate writes during the Safari bench
* test(player): compare the Safari bench against native playback of the same media
* test(player): split Safari control playback into per-frame media writes and per-frame transforms
* perf(core): write media volume and mute only when they change
* test(player): presented frame rate and compositor-animation controls in the Safari bench
* perf(core): keep the media volume guard without a new comment line
* test(player): derive presented frames from playback counters and snapshot video state
* test(player): control page plays only listed media, and anchor the Safari process match
* test(player): send the bench as code, and write only validated numbers from the browser
* fix(player): perf host page gives the player a real box, so films are on screen when measured
* fix(player): a player with no height set takes its film's shape instead of collapsing to nothing
The player box had no intrinsic height, so an embed that set only a width (or nothing) was 0 px tall
and showed no picture. An in-flow sizer now carries the composition's aspect ratio; a height the
embed sets still wins, and a height-only embed keeps its full width.
* test(player): label each embed on the player box page
* fix(cli): check, snapshot and Studio read project text as UTF-8
The preview servers sent HTML, CSS, JS and JSON with no charset, so Chrome
read a page without <meta charset> as windows-1252 and stills showed garbled
non-Latin text while the render, whose file server already sends utf-8,
was correct. The shared MIME table now carries charset=utf-8 for text types,
and the two hard-coded headers use it.
* fix(cli): snapshot shows accented text when the page's meta charset sits outside its head
A <meta charset> past Chrome's first 1024 bytes and outside <head> is ignored, so with no
charset in the header the page decoded as windows-1252. The browser test serves such a page
through the static server snapshot uses. play compares the media type without its charset,
so JSON assets keep their content-hash revalidation.
The single-worker inversion and the parallel router decide before capture
whether drawElement will run, but the engine's init-time gates (CSS
effects, at-risk timelines, SwiftShader, ...) only ran when the
conditional browser probe did. Most renders skip that probe, so a comp the
engine then refused was still pinned to 1 (or 3) workers and captured by
screenshot on that pinned count.
When either route is eligible and no probe session exists, open the
capture session early and initialize it; a refused comp is not inverted
or routed, calibration runs, and it renders on the resolver's count. An
accepted comp hands the same session to capture. perfSummary carries the
probe's gate reason, since clamped parallel workers report none.
A check on a project whose videos Chrome cannot decode (HEVC, HDR) first transcodes each
of them, which on phone footage takes minutes and printed nothing until it was done.
* fix(producer): disk-space error suggests --workers 1 only when one worker would stream
* test(producer): streaming-stage suite mocks the new streaming-gate export
captureStage now asks explainStreamingEncodeGate for the disk-space remedy;
the bun module mock of renderOrchestrator in captureStreamingStage.test.ts
lacked it, so the suite failed at import.
* perf(cli): commands run without esbuild, puppeteer-core or sharp until they need them
A host that bundles the CLI can now leave these packages out: each command
loads them only where it uses them, and sharp installs once on first use when
it is missing. The build check fails on any static import of them again.
* fix(cli): use a host's sharp from NODE_PATH and let hosts turn first-use installs off
* fix(cli): capture fails when sharp is missing, and one install serves every caller
A missing sharp now stops the asset download up front instead of counting every
image as unavailable. Concurrent first uses share one install, a failed install
is not retried in the same run, and preview thumbnails report why. Hosts can turn
off installs for a list of packages, e.g. HYPERFRAMES_NO_OPTIONAL_INSTALL=sharp.
* fix(cli): snapshot --describe still works without sharp, resizing only when it is installed
* style(cli): format the sharp loader and its tests
* build(cli): sharp is an optional dependency, so a host can ship the CLI without it
* build(studio-server): keep sharp out of the bundle now that it is optional
* test: queue runs on slow windows runners stop failing four timing tests
* test(cli): the keepalive process test budgets for a cold start on a slow runner
* fix(cli): wait for consent navigation before cataloging assets
A consent click can reload the page (some CMPs reload once consent is
stored). The post-click DOM reads then raced the navigation: the overlay
sweep and scrollHeight probe ran against a torn-down or still-parsing
document, scroll screenshots degraded to a handful of shots, and the
asset catalog observed an empty body (0 assets).
Add waitForPageReady: wait for network idle, then poll document.readyState
so a committed-but-still-parsing reload is also waited out — network-idle
alone stops counting a request once its response headers arrive, and
waitForNavigation deadlocks when armed after the commit. The overlay
sweep now runs on the settled document instead of the pre-reload one,
and the same settle guards the asset catalog boundary.
Fixes#4923
* fix(cli): bound consent-click settle by wall clock and skip it on banner-free pages
waitForPageReady now shares one deadline (timeoutMs, capped by the
remaining capture budget) across its network-idle waits and readyState
poll, uses waitForNetworkIdle concurrency: 2 (the networkidle2 semantic
navigation already uses), races each readyState evaluate against the
deadline, and rethrows degradable evaluate timeouts so the stage can
degrade. captureScrollScreenshots only pays the settle when the consent
sweep clicked a control or performance.timeOrigin shows the document was
swapped; the catalog boundary call degrades to a budget-bounded
readyState check (networkIdle: after-load).
* fix(cli): drop added comments to keep comment share at merge-base
* fix(cli): adapt consent-settle tests to ScreenshotCaptureResult and keep comment share flat
* fix(cli): tolerate missing waitForNetworkIdle in consent settle
waitForPageReady called page.waitForNetworkIdle unconditionally; a
Page-shaped double without it throws a synchronous TypeError that
captureScrollScreenshots' catch-all reports as internal-error with
zero screenshots, breaking the partial-budget contract upstream's
coreExtractionPhase.test.ts exercises with a thin mock page. The idle
wait is best-effort, so make the hook optional and swallow its
failures; also only keep the readyState poll alive while the page
affirmatively reports "loading" so a non-boolean result cannot burn
the settle deadline.
* perf(cli): check splits its samples over a second Chrome when a core and memory are spare
* fix(cli): check keeps its result when the second Chrome fails, and counts container memory
* fix(cli): check's helper Chrome code keeps the files' comment share
* fix(cli): check's sampling comment fits the line limit
* fix(producer): render inside an agent's macOS sandbox no longer dies on uptime
The render work dir's owner stamp falls back to os.uptime() for a boot time
when /proc is missing. The seatbelt refuses uptime (uv_uptime EPERM), so every
render died with that error before Chrome started. The fallback is now
optional like the /proc read, and render reaches the existing message that
says to rerun outside the sandbox.
* fix(producer): a render never reclaims a dir whose owner it cannot place
Without a boot identity, or on Linux without the pid namespace, two missing
values matched, so on a shared output folder a same-hostname machine could
delete another machine's live work dir. Such a scope is now unknown, and the
dir is left alone; macOS, which has no pid namespace, still reclaims by boot.
* perf(producer): the plan's true-peak check runs in parallel segments
The plan's -1 dBTP check ran one single-threaded ebur128 pass over the whole
mix. It now scans fixed segments in parallel and reports the same printed
value: each later segment starts one 100 ms block early and drops that block
(the oversampler's mirrored start can invent a peak, and a scan never measures
its last 16 samples); the last segment falls back to one whole-file pass when
its dropped block alone could be the loudest. Segments decode from the file
start, since the AAC decoder carries noise-substitution state.
* fix(producer): a true-peak scan with no summary fails instead of reading 0 dBFS
A run whose stderr has no Peak line threw before the parser moved; it
parsed as 0 dBFS after, which would lower and re-encode audio that was
never measured. It throws again. When one segment scan fails, the others
are stopped, and only 48 kHz audio is split into segments, since ebur128
resamples any other rate.
* docs(producer): shorter true-peak doc comment
* fix(studio): keep an edit's preview waiting while the window draws no frames
An edit that reloads the preview loads it hidden and swaps it in once it
has drawn two frames. Its 45 s wait ran on the wall clock and paused only
when the page reported itself hidden, but a window behind others on some
Linux desktops draws no frames while still reporting visible. The swap
then gave up and the old preview stayed on screen until the next edit.
A wait budget in which no frame was drawn is no longer spent; the next
frame restarts the full budget, as showing a hidden tab already does.
* fix(studio): keep the frame-wait note in the budget comment
* fix(engine): long 4K video exports no longer time out while frames are still coming
* test(engine): the paced extraction test keeps a wide margin on a loaded runner
* fix(engine): long phone-video exports probe each source once instead of once per cut
* fix(engine): a failed source probe is retried, and probes share the extraction slots
* test(engine): synthesize the tone-mapped concurrency fixture with known input colour
* chore: release v0.8.180
* docs(release): describe chunk sub-ranges as groundwork for split retries
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: release v0.8.180 notes list the empty-frame fix
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Miguel Ángel <miguel.sierra@heygen.com>
* revert(engine): render workers keep the media of FFmpeg-fed videos loaded again
This reverts the behavior change of #5795 (6ed89a1e4). Releasing the media of
videos whose frames come from FFmpeg leaves some worker pages that never paint,
so parallel renders fail intermittently with "Invalid JPEG input at frame N:
empty frame". The shared loopback test fixture it added stays: later tests use it.
* chore(ci): agree the deletion of the reverted release test
* perf(cli): snapshot decodes phone video frames at their on-screen size, several at once
* perf(cli): snapshot decodes phone video frames at their on-screen size, several at once
* test(cli): type the displayed-size snapshot cases instead of splitting strings
* feat(producer): render a distributed chunk as frame sub-ranges
renderChunk and renderChunkV2 take an optional frameRange inside the
chunk's slice, so a slow chunk can be retried as smaller parts rendered in
parallel. A part renders as a chunk of its own: capture, deferred video
frames, GOP size, frame names and the audio packets it carries all follow
the range. Omitting it renders the whole slice as before.
assemble and assembleV2 accept the ordered parts of a chunk in place of
its single output. DISTRIBUTED_RENDER_CAPABILITIES.chunkFrameRange
advertises both.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(producer): keep the chunk sub-range comments within the comment checks
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(core): a paused preview puts a reloaded video back at the playhead
When a video's authoring proxy (or that copy's larger size) loads while the preview is paused, the element restarts at 0 and the paused transport never seeks it again, so a clip stacked with its own cutout showed two moments of the same person. Any media element's loadedmetadata now re-syncs a paused transport.
* fix(core): the reload listener's name carries its reason
* fix(core): keep the paused-video playhead re-sync out of renders
A render drives every video's frames itself. The re-sync now asks the
runtime's one render check (the render config or an injected frame)
instead of only the capture-started pair.
* feat(cli): lambda deploy works from the npm install, no repo checkout
Each release builds the Lambda handler zip on Linux, attaches it to the
GitHub release, and pins its URL and sha256 (plus the SAM template) in
@hyperframes/aws-lambda before npm publish. Outside a checkout, lambda
deploy downloads that zip, refuses it on a sha256 mismatch, and deploys
it with the packaged template. With neither a checkout nor a pinned zip
it fails up front with one message naming every way out.
* fix(cli): lambda deploy test mocks the pinned-handler reader, comments fit the checks
* test(cli): sam tests deploy from a SAM directory, not the repo root
* chore(aws-lambda): raise the package size budget for the pinned handler template
Measured with pnpm@10.17.1 pack on Linux. Release state (prebuilt/ written by pin-handler-zip): 77,307 packed / 285,654 unpacked. CI state (no prebuilt/): 70,104 / 253,390. Packed is the check's 5% headroom over the release size. Unpacked is 292,000 (2.2% over release) because a 5% budget would put the CI pack under the 85% ratchet.
* test(cli): anchor the docs link check in the lambda deploy fallback test
* fix(cli): lambda deploy logs the verified handler sha256 and keeps a presigned query out of errors
* fix(cli): a redirect-limit download error keeps a signed query out of its message
* test(cli): the redirect-limit leak test types its rejection
* docs(aws-lambda): header comments cut to what the code cannot say
* chore(aws-lambda): size budget fits both the CI and the release package
* fix(aws-lambda): old stacks are refused before any upload; stale local copies never re-upload
* docs(aws-lambda): where the CLI keeps a deployed stack's state
* fix(inspector): data-hf-id stamps alone do not make the live preview stale
The source fingerprint hashed html byte for byte, so stamping data-hf-id on disk
(Desktop does at project open and when a run ends) made every live query answer
stale_preview. The preview never reloads for an id-only write, because it already
served those ids, so the error lasted until some other edit. The fingerprint now
reads html without its data-hf-id attributes, the same rule Desktop's change
detection uses.
* fix(inspector): ignore HF IDs only for live previews
* fix(studio): a deselect made while an edit saves stays deselected
A save resyncs the selection it started with once the write returns. It now
does so only while that element is still the one selected, so a deselect or
a different pick made during the save is no longer undone. The preview-reload
sync now routes through the same resync instead of a copy of it.
* refactor(studio): drop two comments the names already say
* ci(repo): the packed consumer check stops failing on npm versions published minutes ago
* fix(repo): a same-day dependency bump still installs in the packed consumer check
* perf(producer): each distributed chunk downloads only its own slice of the plan audio
A v2 plan whose mp4 chunks carry their audio now cuts the mixed track into one
file per chunk (stream copy, the same cut the chunk made itself), and the
manifest sends each chunk only its own file. A chunk muxes its slice with the
timestamps the cut gave it, so its packets match the old in-chunk cut.
* refactor(producer): keep the audio slice comments within the file's comment share
* fix(producer): a sliced chunk muxes the same audio packets on every ffmpeg version
Re-muxing a stream-copied AAC slice changed each chunk's last packet duration
on ffmpeg 6 and 7 (the slice's own edit list trims it), which shortened the
stitched audio timeline by about 2 s on a 30-minute render. The plan now ships
the audio's moov once plus each chunk's packet bytes, and a chunk rebuilds a
sparse copy of the whole file and runs the unchanged cut on it.
* chore(producer): packed size budget to measured x1.05 after main's chunk sizing
* fix(cli): check and snapshot use the pinned Chrome, not an older one another tool cached
* fix(cli): keep the browser-order comment within the line limit
* fix(engine): renders that resolve their own browser follow the same pinned-first rule
* fix(engine): keep the browser rule's reasoning in the PR, not new comments
* fix: a shared-cache shell is used only if it starts, after the pinned build
* fix(engine): import the shared-shell pick, and probe shells with a blank page
* fix(skills): caption scripts launch the browser the CLI chooses
* chore(skills): regenerate the skills manifest for the caption scripts
* fix(studio): a lost preview server or a superseded edit no longer files as a crash
* fix(studio-server): a render's scratch files no longer stream changes or list as compositions
* perf(producer): distributed chunks download only the videos they show
A project video under compiled/ that chunks extract their own frames from
now goes only to the chunks that show it, like video-sources/ files. A
chunk skips the readiness wait for a deferred video it does not show, so
it no longer logs media_load_failed for a file it was never given.
* fix(producer): cloud site uploads pack the files their id hashes, symlinks included
* perf(aws-lambda): chunks read only the byte ranges of a video they need
A chunk that extracts its own frames from a deferred project video now
reads it from S3 by byte range through a short-lived pre-signed URL,
instead of downloading and hashing the whole object first. S3 attests the
object's stored SHA-256 before the URL is signed; every other artifact is
still downloaded and verified as before.
* perf(aws-lambda): upload project files once to a shared content-addressed area
* chore(producer): keep planV2 comment share at the base level
* fix(engine): verify the TLS certificate of https video inputs and never surface their signed query
* fix(aws-lambda): renders re-upload a site's expired files instead of failing
* perf(aws-lambda): the plan step probes project videos in place instead of downloading them
* fix(engine): https video reads reconnect and time out, and redaction covers wrapped causes
Signed-URL reads now pass -rw_timeout, -reconnect and -reconnect_delay_max (both Lambda builds accept them) and ffmpeg also -reconnect_on_network_error, so a transient S3 error or a stalled read fails fast or recovers instead of waiting out the process timeout. Query redaction now descends into error.cause.
* fix(aws-lambda): share entry bundles and ratchet package budget
* fix(aws-lambda): site ids uploaded before files.json still render
A site id from an earlier sites create has only sites/<id>/project.tar.gz.
renderToLambda now falls back to that tarball, which the plan step still
reads, and when neither key exists it fails before starting with both keys
named and the fix (run sites create again).
* fix(aws-lambda): renders fail before upload on a stack too old to read sites
A stack deployed before files.json sites untars the site file in its plan
step and fails after four retries. renderToLambda now reads the state
machine definition first and stops with STACK_TOO_OLD and the redeploy
command when the plan task does not list SITE_MANIFEST_INVALID, which new
SAM and CDK stacks now treat as terminal. The README's upgrade section
drops the planProtocol v1 fallback, which hits the same failure.
* docs(aws-lambda): document shared content storage and the upgrade path
The deploy guide still described the tarball HeadObject short-circuit. It
now covers the cas/sha256/ store and its 30-day lifecycle rule, the
STACK_TOO_OLD, SITE_FILES_MISSING and SITE_NOT_FOUND errors, that old site
ids keep working, and that every project uploads once more after the
upgrade. A test keeps a troubleshooting entry for each pre-submit error.
* fix(producer): chunks log each video they read by URL, without its query
A chunk reading a video straight from the bucket left no trace in its log.
It now logs one line per remote source with the path and the URL minus its
query string, so signatures never reach the log.
* fix(engine): ffmpeg errors never keep part of a signed URL's query
A process's stderr tail was trimmed before its URLs were redacted, so a
cut inside a signed URL left a query fragment the URL pattern no longer
matched, and the fragment reached the error. The stderr tail is now
redacted before every trim, and the redactor also strips a signing
parameter cut off from its URL.
* fix(aws-lambda): comments name the site manifest instead of a file path
* fix(engine): stderr redaction survives chunk splits, and every ffmpeg spawn uses it
The stderr tail was redacted on each chunk and then cut, so once a cut
severed a long URL's scheme, the rest of its signature in the next chunk
matched neither pattern. The tail is now kept raw with 2x slack and
redacted only when the text is produced, then cut to size. The unused
producer audioExtractor (its own spawn, unredacted stderr) is deleted and
the parity harness's PCM decode goes through ManagedChildProcess; a test
fails on any ffmpeg/ffprobe spawn in engine, producer or aws-lambda that
does not.
* chore(producer): record the audioExtractor deletion as intended
* fix(engine): drop a signature fragment the stderr tail cut from its URL
The raw tail is kept at twice the cap, but that cut can itself land inside a
signature, and when redaction shrinks the rest below the cap the fragment
survived. After a cut, the severed token is dropped before redaction.
* refactor(engine): name the severed-token drop instead of commenting it
* test(engine): a cut-off URL leaves nothing behind; aws-lambda size budget to measured
* fix(producer): chunk URL-read tests use main's frame list; producer size budget to measured
* chore(producer): size budget at the measured size, no headroom
* chore(producer): size budget back to measured x1.05, the check's own rule
* docs(changelog): weekly digest 2026-10-12-2026-10-19
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: embed the Oct12-19 weekly changelog video
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Miguel Ángel <miguel.sierra@heygen.com>
Closing the page server now stops the media proxy copies it started (pre-warms and the page's own asks). A copy whose last caller leaves is now stopped even after its ffmpeg started; callers without a signal still always get their copy.
* fix(cli): non-English transcription reaches whisper, and whisper failures say why
transcribe --language <non-English> runs an installed whisper (Parakeet picks its own language); whisper models are pinned by size and sha256 and re-downloaded when damaged; a whisper-cli failure names its build, model file and last stderr lines without paths; the unused --dtw flag is dropped.
* docs(cli): --engine and --language say a non-English language runs an installed whisper
Also strips paths that follow a colon or a bracket from whisper-cli's error tail.
* fix(cli): catalog search never waits on installing the on-device runtime
A plain catalog query on a machine with on-device search set up used to
npm-install onnxruntime-node inline when it was missing, before returning
any results. Only --on-device installs it now; otherwise the search runs
on word matching and says how to turn the on-device tier back on.
* fix(cli): the first-time on-device yes names the command that sets it up
After a yes at the thin-results offer, a plain re-run no longer installs the
runtime, so the follow-up line now names `hyperframes catalog --on-device`
instead of telling the user to run the search again.
* fix(cli): the on-device setup line names the search to repeat with --on-device
* fix(cli): catalog --on-device alone sets up on-device search, so the setup line needs no query
The setup line repeated the user's query, which no quoting keeps intact across
every shell and the argument parser. --on-device without a query now runs the
setup, and both guidance lines name that fixed command. The test runs it through
the real parser.
* perf(cli): check reads a solid text backdrop from styles instead of a screenshot
* perf(cli): check starts Chrome while lint and bundling run
* perf(cli): the CLI reuses compiled bytecode between runs
* test(cli): browser shutdown tests stop their Chrome when a case fails
* fix(cli): snapshot no longer transcodes every iPhone clip it never plays
snapshot served Studio's media proxies by default, so its page server transcoded every browser-hostile clip (every HEVC clip) in full at load. Snapshots show frames extracted with FFmpeg and never use those copies. Proxies are now served only with --proxy; hyperframes.json media.autoProxy no longer turns them on for snapshots.
* docs: snapshot makes no media proxy unless asked
* fix(producer): graded video renders split into chunks that finish inside the worker limit
The distributed planner priced every frame at a fixed cost per pixel, so a
color-graded video, which costs about 10 s a frame on software GL, was
planned into chunks that could never finish before the worker time limit.
When the composition has color grading and the plan sizes chunks from the
worker limit, the planner now captures the renderer's calibration frames in a
session set up like a chunk worker's and prices frames at the measured p95
when it is higher than the estimate. Compositions without grading never pay
for the measurement and keep their current plan.
* docs(producer): cut the moved chunk frame comments to their invariants
Miguel Ángel