* fix(cli): stop shipping an env var name that endpoint scanners flag
Cisco Secure Endpoint ships an IoC signature that matches the literal
name of the openclaw state-dir env var. Any file containing it is
quarantined, which deletes a CLI dist chunk (the CLI then fails on its
second run) and the Studio app.asar.
Key the openclaw agent-runtime rule on OPENCLAW_CONFIG_PATH only. openclaw
sets both variables on the subprocesses it spawns, so detection is
unchanged. Drop the state-dir name from the comments and from the test,
which now covers detection through the config-path variable.
Fixes#5245
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(cli): keep the openclaw comment under the comment-share ratchet
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(cli): drop the external-repo citation from the openclaw comment
The comment-citations check resolves file:line references against this
repo, and that path lives in the openclaw repo.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
snapshot uploaded every frame to Gemini whenever GEMINI_API_KEY or
GOOGLE_API_KEY was set, even with no flag. Frames now stay local unless
--describe is passed. A bare --describe uses the default prompt (it used
to send an empty one), --describe "question" asks a custom one, and
--describe false still works.
Fixes#6138
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf(studio): music beat analysis no longer freezes the page or runs during playback
* fix(core): media-treatment --analyze finishes on long HDR clips
Grade analysis decoded the clip from the start and kept every frame until the
fps filter had emitted five samples. Past 50 s the filter rate floors at 0.1
fps, so it always decoded the first 40 s at full rate and resolution: a
3-minute 4K60 10-bit HLG clip timed out at 15 s, and every long clip was
graded from its first 40 s only.
Each sample now seeks to the middle of one fifth of the clip and decodes one
frame. The timeout applies per sample and its error names the sample time and
HYPERFRAMES_ANALYZE_TIMEOUT_MS.
* refactor(core): name the keyframe seek instead of commenting it
* fix(core): count one frame per grade sample on ffmpeg 8
* docs(guides): one page per kind of video, with its prompts folded in
* docs(guides): two tiles per row on What to make; list the folded prompt pages as agreed deletions
WORD_RUNS split at apostrophes, so "can't" counted as two words and a line with contractions got a longer hold floor than its real word count.
Refs #6338
* feat(studio): zoom the timeline to the selected clips
Toolbar action and Z fit the selected clips to the visible width, with the
range margin, and stay disabled until something is selected.
* fix(studio): gate zoom-to-selection on a resolvable clip
The scroll clamp already lives in the timeline zoom request. Drop the
unused copy, and disable the button and Z unless the selection matches
a timeline clip with duration. A collapsed timeline cancels
zoomTimelineToRange instead of laying out a percent the view cannot show.
* fix(studio): keep a zoom step when the timeline is collapsed
A collapsed timeline has no track for a range zoom, so zoom in and out
step the percent directly. Z is consumed only when that zoom actually
starts, and zoom-to-selection no longer builds the span three times.
* ci: retrigger checks after workflow approval
The approved run was cancelled during checkout, so the required checks
never executed.
On Windows 11 with Smart App Control on, Code Integrity refuses sharp's
unsigned libvips DLL. With `--against`, the per-frame render | reference
pair sheet called sharp unguarded, so a blocked sharp failed the whole
snapshot with sharp's multi-line error dump, after the first frame.
Guard the pair sheet: a sharp load failure prints one warning, later
frames skip their pair sheet without retrying, and every frame and
reference frame is still written. Any other pair-sheet error still fails
the snapshot. captureSnapshots reports the skip, so the summary lists
only ref-*.png when no pair sheets were made.
describeSharpLoadFailure turns sharp's load error into one line and names
Windows App Control for Win32 error 4551 ("An Application Control policy
has blocked this file"). The contact-sheet warning keeps warning on every
failure and uses it to shorten sharp's message, and --describe no longer
tells the user to install a sharp that is installed but blocked.
Refs #4845
Claude-Session: https://claude.ai/code/session_01JSZqP4FbpqviXu9v2LjBwE
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The skills check resolves main's HEAD with `git ls-remote`. A private or
missing repo answers with an auth challenge, and GIT_TERMINAL_PROMPT=0 only
covers git's own terminal prompt: credential helpers and askpass still run,
and Git Credential Manager (the Git for Windows default helper) opens a
sign-in window that blocks the check until it is closed.
Run ls-remote with credential helpers and askpass disabled
(`-c credential.helper=`, GIT_ASKPASS="", GCM_INTERACTIVE=never). Also skip
git for a slug that does not look like `owner/repo`; such a slug gets a
plain 403 rather than an auth challenge, so this check is defensive. The
repos read here are public, so no credentials are lost.
Fixes#4702
Claude-Session: https://claude.ai/code/session_01JSZqP4FbpqviXu9v2LjBwE
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
EditPopover positions itself with position: fixed and viewport
coordinates, but rendered inline inside the timeline's dockview panel,
whose transformed overlay becomes the containing block. The popover
landed relative to the panel and was clipped below the window. Portal it
to document.body like the other timeline menus.
Fixes#5376
* fix(studio-server): a refused preview frame says so at once instead of timing out
A frame the server refuses (project gone, bad variables) loaded a JSON body: no runtime and no error, so Studio waited three 15s budgets and reported 'waiting for runtime'. The refusal now reaches the frame as a page that reports it, like a failing preview script.
* chore(studio-server): remove redundant preview refusal comments
* fix(engine): ffmpeg steps and downloads stop on no progress, not while still advancing
* test(cli): an ffmpeg step that stops advancing reports inactivity, not a deadline
* fix(sdk): preserve font and image declarations after object edits
* fix(studio): preserve variable object defaults when editing declarations
* fix(studio): show font and image values in bind warnings
* fix(skills): load dotLottie through its browser ESM entry
* chore: prepare conflict resolution against current main
* fix(skills): retain local Lottie setup after syncing main
* chore: prepare conflict resolution against current main
* fix(skills): retain browser dotlottie setup in current runtime guidance
* chore: prepare conflict resolution against current main
* fix(skills): refresh dotLottie fingerprints against current main
* chore: prepare conflict resolution against current main
* chore: merge main and refresh dotLottie skill manifest
* chore: prepare conflict resolution against current main
* fix(skills): keep Lottie setup guidance in its reference
* docs(aws-lambda): explain long-video planning limits
* docs(aws-lambda): prepare planning guidance for main update
* docs(aws-lambda): align planning limits with chunk extraction
* chore: prepare conflict resolution against current main
* docs(aws-lambda): align long-video planning guidance with current extraction limits
* docs(aws-lambda): identify the timeout example construct
* fix(core): a timeline set that hides a timed clip hides it in preview and render
* fix(core): tell a script's hidden clip from the runtime's by the declaration's priority
* fix(core): a scene a script hides takes its timed children with it
* fix(producer): reject regression audio stream mismatches
* chore: prepare conflict resolution against current main
* chore: preserve reviewed fix on current main
* chore: prepare conflict resolution against current main
* fix(producer): retain audio regression checks with current main
* chore: prepare conflict resolution against current main
* fix(producer): preserve audio presence checks on current main
A root composition with no data-duration took its own GSAP timeline's length as its visibility
window, so when media made the composition longer, the whole frame went black from the end of
that timeline in preview and render. The root's window is now open-ended, bounded by the
composition's length. In a framed preview, the duration the runtime stamps on GSAP targets for
Studio's timeline no longer hides the clips inside them either: the ancestor chain check now
skips discovery stamps, as the clip's own visibility pass already does.
* ci: re-run changed test files to catch flaky tests before merge
* ci: give the flake gate the full test workspace setup
* ci: share the test workspace setup between the Test lanes and the flake gate
* ci: split the flake gate main for the fallow complexity gate and format
* ci: run node:test files with node, skip uncollected files, bound the gate's run time
* fix(core): a self-closed audio group no longer hides the clips after it
HTML does not close a custom element on `/>`, so `<hf-audio-group id="sfx" />` takes in every
later sibling, and the runtime's inert style (`display:none`) hid them in preview, snapshot and
render. The style is now `display:contents`: an empty group still makes no box, and anything
inside one renders as written. A lint warning names the elements a group holds, and the docs and
mixing reference show the group closed.
* style(core): cut the audio group comments to the comment length limits
* fix(core): a muted audio group still hides what sits inside it
A muted bus (`data-hidden`) is hidden by an inline display:none that the bus rule outranked, so
clips inside a muted self-closed bus kept painting while their audio and video frames dropped.
* fix(core): a scene callback that throws no longer stops the main timeline in render
Render seeks now leave each scene paused in the root's pass and seek it on its own clock first,
as preview does, so a throwing onUpdate cannot cut the root's tweens short. The error is logged
once per scene as a composition script error, and the render log shows it once per render.
* fix(core): a scene registered without a timeline is not reported as a script error
A placeholder registration ({}) has nothing to seek. seekGsapTimeline now only calls seek()
when the object has one, as player.ts already does, so the new scene-error report stays for
real callback errors.
* fix(core): report a scene callback error as a warning, keeping render failure classes
Logged as a composition script error, a scene callback that threw became a page error, which
turns a timed-out timeline wait into a script failure and cuts the wait short. It is now a
runtime warning the engine forwards to the render log once per render, outside page errors.
* chore(core): regenerate the position-edits render bundle for the new diagnostics export
* fix(engine): the drawElement self-check reads video comps' truth on a separate page too
The video-frame injector now hands out a fresh hook with state of its own, so the check can paint the frames on its disposable page without the render page's injector losing track of what it has painted.
* fix(engine): the truth page gets the media render-id bridge the render page has
Videos that share a plain id (a bare video in each of two scenes) are told apart by a render id the bridge resolves; without it the truth page painted the wrong element.
* perf(core): skip rendering preview scenes far from the playhead
* refactor(core): split the far-scene pass into small helpers
* perf(core): a first render reveals only the clips it reaches
* fix(core): reveal the clips holding first-rendered tweens, wherever their window is
* feat(core): a scene may load a project helper and wait for fonts and still swap
* perf(core): the preview mounts only the scenes near the playhead
* perf(core): a seek waits only for the scene it lands in; neighbours mount one per turn
* feat(studio): selecting a clip in an unmounted scene mounts that scene first
* fix(core): a source a play and a seek both need is fetched and decoded once
* fix(core): a scene mounting during play joins the mix without restarting what plays
* fix(studio): selecting a clip waits on a scene mount only in a preview that unmounts scenes
* fix(core): far scenes still mount after an edit, and an edit to a parked scene keeps its styles
* perf(core): web audio schedules a clip only as the playhead comes near it
* chore(studio): trim the scene hold helper's comments to its package's share
* fix(core): a scene the preview unmounts is freed, not kept by audio, caches or old roots
* fix(studio): an unmounted scene's rows and their state come from the markup it mounts with
* perf(core): the preview mounts scenes ahead of play and keeps recent ones mounted
* refactor(core): keep the far-scene neighbour rule private to its module
* style(core): format the far-scene neighbour rule
* perf(core): the preview unmounts scenes the playhead leaves, as kept ones slowed each mount
* fix(core): scenes that measure text, call their own animate or wait on font loads can unmount
* fix(core): each preview scene carries the helpers it loads, so it mounts on its own
* fix(core): a mounted scene shows though its stand-in was hidden by display
* fix(core): a helper scenes share runs once for the film, and a remounted scene keeps showing
* fix(core): a scene that also publishes its timeline under another id stays mounted
* feat(core): scenes that draw in 2D or chain the timeline they register can unmount
* perf(core): a play frame that draws nothing new skips the hidden-clip lookup
* fix(core): a GSAP file copied into a project counts as the library for scene unmounting
* style(core): drop an unneeded escape in the registered-chain pattern
* chore: core and producer size budgets make room for the preview scene window
* fix(core): a scene that draws on a 2D canvas stays mounted
* fix(core): a scene the preview unmounts lets go of timelines it built after a font wait
* perf(core): a scene leaving the playhead keeps its last rendered size, no forced layout at the cut
* refactor(core): the far-scene skip keeps last-render boxes in their own helper
* fix(core): a mounting scene never records the runtime's root timeline as its own
* chore(producer): raise the size budget to the measured size with the preview runtime inlined
* docs(core): keep the far-scene and scene-memory comments within the comment limits
* perf(core): style each hidden clip visible once ahead of its cut, so the cut frame does not
* fix(core): a seek into a scene still mounting as a neighbour waits for that mount
* chore(core): keep comment share and size budgets to main plus the measured core growth
* perf(engine): fast capture stays on for frames a shadow, blur or clip effect does not touch
A single drop-shadow, blur, backdrop-filter or blend element, or one clip-path or mask
tween, sent the whole render to screenshot capture, 2-3x slower than drawElement. The two
init gates now name the frames the effect can show on. Only those frames capture by
screenshot, in a second browser opened on the first of them; every other frame keeps
drawElement.
* fix(engine): scan effects in a throwaway session; hand risk frames over only where captured
The effect scan seeked the render's own page to the end, leaving its timeline state ahead of
the render. It now runs in a throwaway session with the render's own seek. A hidden effect
element with a visible descendant counts as shown. Per-frame capture is opt-in per caller
(deFrameFallback), so disk, segmented, chunk and parallel-worker sessions keep the
whole-render fallback, and a route that cannot hand frames over drops drawElement up front.
* fix(engine): a timeline callback keeps the whole-render fallback; trim comment share
A tl.call or onComplete can add an effect's class to any element mid-render, so the elements
found at the start are not the only ones it can reach. Such a timeline is unbounded and keeps
the whole-render screenshot fallback.
* style(engine): shorten the live-frame scan comment
* perf(engine): after a timeline callback, not before, every frame may show the effect
A callback can add an effect's class to any element, so only the frames from the first
callback on lose their element bounds. Frames before it keep the scanned bounds, so a late
callback no longer sends the whole render to screenshot capture.
* perf(engine): open the second screenshot browser only when memory is available for it
Per-frame capture needs a second browser (479 MB measured at 1080p). When the render would
leave less than 1.5 GB available after it, the render keeps the whole-render screenshot
fallback instead. getAvailableMemoryMb moves from the CLI to the engine's system-memory
module, which already owns the host's memory readings; os.freemem() reads 367 MB on this
49 GB Mac, so the guard uses free, inactive, speculative and purgeable pages.
* fix(engine): budget the whole 1 GB per-frame capture adds, not just the second browser
The render's process tree goes from 1002 to 2001 MB at 1080p: the screenshot browser (479 MB)
plus a drawElement browser that is itself about 500 MB larger than a screenshot one. The guard
budgeted 500 MB. It now budgets the 1 GB measured, scaled by output pixels.
* ci: run cli tests in their own job so runtime tests stop timing out
* ci: format the test aggregator needs list
* ci: keep the test aggregator needs on one line for the reachability check
* ci(reachability): read wrapped and block needs lists instead of rejecting them
* perf(studio-server): the browser-playable copy of an alpha video encodes on four threads
libvpx runs on one thread unless told, so the alpha copy of a 4K video took several times its length on a small machine.
* docs(studio-server): drop a comment line the name already carries
