* codegen: resync cloud client from EF 354b4cf4
* chore(codegen): keep page_motion_blur in the generated render request
The CLI already sends page_motion_blur (#6087), and experiment-framework adds
it to the public spec in a pending change. Keep it here so the sync does not
break the CLI typecheck in the meantime.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: James <james.russo@heygen.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* docs: links point at hyperframes.studio, the app's new home
* docs: the registry guide publishes to hyperframes.studio
* chore: format README table, regenerate the skills manifest
* docs: leave the browser editor's card wording for its own change
* feat(cli): render --prores-profile picks ProRes 4444, hq, 422, lt or proxy for MOV
* fix(cli): drop a comment line that raised the comment share
* fix(cli): the render plan args type carries --prores-profile
Publishing a registry file (every block file and hyperframes.lock.json) renamed
its staged copy over the destination with a plain rename, which Windows refuses
with EPERM while antivirus or a just-exited process still holds the file. It now
uses the shared rename that waits and retries on those errors.
* fix(cli): a killed remove-background run no longer leaves its CoreML temp files behind
On Apple Silicon, CoreML writes about 340 MB of compiled models to the system
temp folder for every session and removes them only when the session is
released. A run stopped by a signal never released it, so every cancelled run
left them. A signal now stops the run through the CLI's shutdown, which
releases the session, and the next run removes what a killed run listed in its
own manifest.
* style(cli): wrap the CoreML shutdown comment to the line limit
* fix(cli): check fails a full-frame element that covers every other clip, naming it
* test(cli): shorten the cover scene helper's comment
* chore(skills): refresh the manifest for the check reference
* fix(cli): full-frame b-roll over a backdrop is not a covered canvas
* feat(cli): doctor names the tested ffmpeg build and says loudness is only comparable on it
* style(cli): format the doctor ffmpeg note
* fix(cli): drop the doctor ffmpeg comments the comment ratchet counts
* style(cli): format the doctor ffmpeg match
* fix(cli): capture waits for a mid-read navigation to settle and reads the page again once
A site that redirects or reloads after load destroyed the execution context under a page read, and the capture failed with Execution context was destroyed. The capture page's evaluate now settles the new document and runs the read once more on that error only.
* fix(cli): the capture browser opens every page with reads that ride out a navigation
* test(cli): Chrome-driving tests run in their own project after the rest
A Chrome launching beside hundreds of parallel test files was starved past Puppeteer's 30 s launch limit on a 4-core runner. The motion-signature launch also never passed the 120 s ceiling its comment names.
* test(cli): the process tests that start Chrome run in the chrome project too
* test(cli): name the Chrome process tests as one literal glob the reachability check can read
* fix(cli): a nearer copy of another version no longer hides the host's pinned onnxruntime-node
* fix(cli): load the pinned copy by the entry its exports name, and skip a broken stray manifest
* fix(cli): the pinned copy's entry must sit inside the pinned folder, whatever the folder is named
* fix(cli): every managed browser closes within a second even if Chrome never exits
Commands called browser.close() directly, which waits for the Chrome process to exit without a limit. A headless shell that acknowledged Browser.close and then stayed alive left the CLI hanging after its work was done. The managed browser's close() is now the bounded close that kills a browser that has not exited.
* test(cli): browser stand-ins carry the close() a real browser has
Audio effects launched Chrome with its own two flags and no retry, so inside
an agent's macOS seatbelt Chrome died at startup with "Target closed" while
the CLI's own browser launch recovered. The sandbox launch policy now lives
in the engine; the engine's Chrome launch retries once in one process over a
pipe when the sandbox refuses it, and audio effects use the shared Chrome
flags in software GPU mode. The CLI imports the same policy from the engine.
* fix: phone videos with an undecodable first audio track check, preview and render
* fix(engine): a rate-lane clip bakes its ramp from the decodable audio track
* test: phone-clip tests end ffprobe options before the input
* fix(studio-server): an HDR clip previews and snapshots the way the SDR export renders it
Footage tagged HLG or PQ played raw in the preview, where the browser tone-maps it its
own way, while the SDR export tone-maps it with zscale and hable: the same clip came
out lighter and with different reds and blues. HDR video now takes the tone-mapped
preview copy (the filter the export uses), and a snapshot still of HDR footage runs
the same tone map. Without an ffmpeg that has zscale and tonemap the clip plays
natively, with a warning that names the missing library.
* fix(studio-server): an HDR clip is never playable for preview, whatever its codec
Only HDR H.264 and ProRes took the tone-mapped copy: an HDR HEVC, VP9 or AV1 clip kept
its codec's test type, so a browser that can decode it was judged able to play it and
the original played with the browser's own mapping. An HDR clip now has no test type, so
the swap always fires. The missing-library warning no longer names the file.
* test(cli): the HDR still test ends ffprobe's options before its input
The repo's ffprobe argv contract requires "--" immediately before the input path; the new
test passed the still's path without it.
check gave a scene 3 s to signal it was ready, then warned "checking the current page
state" and sampled whatever was on screen. Scenes that build procedural textures or
WebGL canvases routinely need longer, so a pass could miss late content with a warning
nobody could act on. The default wait is now 10 s (it ends the moment the page is
ready), the warning says the scene may still be building and to raise --timeout, and
check_report records render_ready_timed_out so the cases can be counted.
* fix(cli): a browser's orphaned helpers no longer keep a finished snapshot from exiting
The CDP pipe sockets stayed open after Chrome exited whenever a helper process outlived it, so the CLI never reached natural exit. Destroy them when the browser process exits.
* refactor(cli): name the pipe close so launch.ts carries no new comment
* fix(cli): a browser stand-in without stdio no longer throws from the exit listener
* fix(cli): close every pipe of an exited browser, not only the CDP pair
* fix(cli): closing the managed Chrome also ends the helper processes it leaves behind
The close waited a second for Chrome to exit and then killed only Chrome's own process.
Under load that second is often not enough, and the helpers (the GPU and renderer
processes, crashpad_handler) were reparented to init and kept running after a finished
run. The close now records the processes under Chrome before it starts, and ends any of
them still running (under the same command) once Chrome is gone.
* test(cli): the helper-reaping test polls for the helper's exit instead of waiting 200 ms
* fix(cli): the Chrome process listing is bounded and no longer runs at import
The ps call that records Chrome's helpers ran with no time limit before the
bounded browser close, so a stalled ps made the close unbounded. It now has a
2 s limit, and a timeout records no helpers.
execFile is resolved when ps runs, not when the module loads, so tests that
mock node:child_process without execFile import it again.
* fix(cli): audio --read starts music where its sound is sustained
A run of the bed is split where sound fills less than half of the surrounding
2 s, so a short tone and scattered clicks that bridge into the music no longer
pull its start earlier. Sparse stretches are left to effects.
* fix(cli): audio --read finds effects in each stem and levels them from the mix
A sound ends where the next one starts, so a run of kicks is not one long
riser. Effects are searched in the drums and in the bed outside music, each on
its own, so a click inside a tone is still found. Each effect's peak is read
from the decoded mix in dBFS, and the music reference is taken next to the
effect rather than under it, where its own leakage sits.
* fix(cli): audio --read measures the recording through each pause
Pauses carry the whole recording's level so the read can say what keeps
playing while the voice stops.
* feat(cli): audio --read prints peaks, what plays in pauses, voice vs music
Effect lines print the absolute peak and name the reference of the relative
figure; pause lines keep the pause kind and list the effects, music and
ambience under them; sentences over music print voice and music loudness and
which is louder. Read schema version 4.
* fix(cli): audio --read finds bed effects on the whole bed, not a blanked one
Blanking the bed wherever music or ambience played made every blanked
stretch that ended while sound was still audible look like a sound rising
out of silence. Fades and quiet bridges then printed as dings, hits and
whooshes. The bed is now searched whole, and each source carries the
spans it plays music or ambience in. A sound whose onset-to-peak overlaps
one of those spans belongs to it, so it is not an effect. The drums and
the bare mix carry no spans.
— Jerrai
---------
Co-authored-by: Jerrai <jerrai@heygen.com>
* fix(cli): beats given a media file points to hyperframes audio instead of a folder error
* fix(cli): beats names the folder for a composition file and syncs the skills manifest
* fix(cli): snapshot's auto end frame stays within 250 ms of a long composition's end
* test(cli): the end-frame test comment states the cap, not the history
* chore(cli): shorten the snapshot end-frame comment
* fix(cli): audio --read reports noise beds as ambience, not music
A stretch of the non-voice stems counted as music whenever it was above
-55 dB, so room tone and engine rumble separated into "other" printed as
a music piece. A stretch is now music only with a beat, clear tonal chroma
or more than one leading instrument; otherwise it is ambience with its
level in dBFS, called quiet under -45 dBFS, and breaks lie only between
two runs of music. The header lists only stems that carry sound, with
their level, instead of the separator's six fixed names.
* refactor(cli): audio --read gate carries its meaning in names, not comments
* fix(cli): keep ambience out of downstream music measurements
* fix(cli): measure music beat evidence within each stretch
* fix(cli): a check or snapshot that times out says which step it was on
check's idle deadline named only the phase ("while checking samples") and snapshot's
CDP timeout named nothing. check now adds the sample, craft frame or overlap probe it
was on, and snapshot adds the seek or capture of the frame it was on, with its time.
* fix(cli): a snapshot timeout no longer tells the user to raise a setting they do not have
Puppeteer's protocol timeout message ends "Increase the 'protocolTimeout' setting in
launch/connect calls". snapshot has no such option, so the step it was on is now the
last thing the message says.
* feat(cli): check reports where its seek loop spends its time
check_report carried one seek_loop_ms, which lumps the layout grid, the craft pass
(up to 600 frames) and the overlap pass with its hold probes. It now also carries
grid_ms, craft_ms, overlap_ms and composition_s, so a slow check can be tied to a
pass. Nothing about what check does or prints changes.
* chore(cli): drop the pass-timings doc comment so the comment share does not rise
* fix(cli): a Chrome that fails to start says how it ended, and a slow start says so
A failed launch only reported "Protocol error (Target.setDiscoverTargets): Target closed". It now
runs the browser once more on its own with the same flags and reports its exit code (Windows
codes named: missing runtime, out of memory, security software), its last stderr lines, or that
it stayed up. The CLI and the engine's render launch both use it. A start slower than 5 s prints
"Chrome is still starting...", and a --timeout that looks like seconds says it is milliseconds.
* chore(cli): cut the Chrome launch diagnosis comments to the comment limit
* fix(cli): the Chrome startup check runs Chrome as puppeteer does and can be cancelled
The check started the browser with only the caller's flags, so a full Chrome ran headful and
was blamed for a missing X server. It now uses puppeteer's default arguments (headless
included). The check is stopped when the CLI is stopped, and the GPU probe, whose failure
falls back to software anyway, skips it.
* fix(cli): a Chrome launch error is never replaced by a failure to explain it
The startup diagnosis asks puppeteer for its default arguments before re-running
Chrome. If that call fails, its error used to replace the launch error the caller
needed. The launch error is now reported as it was. The core package size budget
rises to cover the new chromeStartup module (about 4.7 KB unpacked).
* refactor(engine): the Chrome startup diagnosis lives in the engine, not core
Both callers launch Chrome through the engine (the CLI already imports it), so the
engine owns the diagnosis. Core's package size budget is back to its old value.
The file-change test fetches an asset and never reads the response, so the file stays
open and Windows fails the later folder move with EPERM (it failed a merge-queue run).
The helper now reads each body to its end.
* fix(cli): check stops making video copies after 10 minutes, and --timeout takes units
The copy phase of check had no overall limit: a source that kept moving was never
stopped, and stdout stays silent the whole time. It now ends after 10 minutes with
an error naming the files still unfinished and the elapsed seconds; finished copies
are reused on the next run. The stderr progress lines are unchanged.
--timeout on check and snapshot is milliseconds, so "--timeout 45" waited 45 ms.
It now accepts 45s, 2m and 45000ms, and a bare number under 1000 warns on stderr
that it is milliseconds. Output on stdout is unchanged.
* chore(cli): cut the --timeout parser comment to the comment limit
* fix(cli): drop the 10 minute wall clock on check's video copies
A copy that keeps making progress must not be cut by a clock, and a re-run would
only start it over. The copy already ends when ffmpeg stops reporting progress
for 3 minutes (finished pieces are kept for the next run), so the phase is
bounded on no progress. The --timeout warning now names the value actually used
when check raises a small value to its 500 ms floor.
* fix(cli): take JSON flags from a file or stdin so PowerShell can pass them
* fix(cli): read BOM-prefixed and UTF-16 JSON from a file or stdin
* style(cli): format the JSON flag reader
* test(cli): feed the bytes PowerShell pipes to the JSON reader
* style(cli): shorten the JSON flag reader's comments
* style(cli): one line for the JSON flag reader's comment
Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Joel Gallardo <joel.gallardo@heygen.com>
Co-authored-by: heygengenesis[bot] <262951085+heygengenesis[bot]@users.noreply.github.com>
* feat(cli): capture accepts a local HTML file again
Adds an explicit --local-file mode. The file's directory (or --local-root) is served
on a loopback port that only Chrome may reach outside the capture proxy; all other
traffic keeps the public-address policy. The URL argument stays public HTTP(S) only.
* fix(cli): local capture output names the file, not the loopback server
In --local-file mode, meta.json, AGENTS.md, extracted files and the returned result
used the temporary 127.0.0.1 origin. One rewriter maps that origin to file:// URLs
under the root, and meta.json records the file as its source. Root and served paths
now resolve with the same native realpath, which Windows needs.
* fix(cli): local capture reads its files from disk and resolves real paths natively
The asset downloader read the local page server with Node's fetch, which an environment proxy
(NODE_USE_ENV_PROXY with HTTP_PROXY) intercepts, so local images and fonts were dropped. It now
reads the file from disk under the server's own checks.
Root and served paths both use the native realpath. The JS realpath kept Windows 8.3 short names
while fs/promises expanded them, so every file answered 404 on Windows.
The default root is the directory the file was named in, so a symlinked entry can no longer widen
it to wherever the link points.
The local-file docs move below the capture policy text so their heading does not swallow it.
* refactor(cli): capture settles a watchdog outcome in one place
* fix(cli): escape every RegExp metacharacter in the local origin rewriter
---------
Co-authored-by: Jerrai <jerrai@heygen.com>
* fix(cli): snapshot counts and lists the stills that are on disk, and fails when some are not
The summary counted frames the run had captured, not files that exist, and printed paths
relative to the project. It now checks every still on disk, prints absolute paths, says
"N of M" when some are missing or empty, names them, and exits non-zero.
* fix(cli): snapshot says when it clears an earlier run's stills from the folder
Without --keep, a run removes the stills an earlier run left in the folder before it captures,
so two runs into one -o folder silently erased the first. The behaviour stays; the console
and --json now say "cleared N stills from an earlier run in <folder>". The on-disk comment is
also cut to the comment limit.
* fix(cli): snapshot judges the stills it wrote, not the frames it was asked for
A --zoom target that is not visible skips a frame on purpose, with a warning, and that frame never
reaches the written list. Comparing the files on disk with the requested count turned that into a
failed run. Only a written still that is missing or empty fails now.
* fix(cli): Kokoro speech works when its espeak data folder path passes 260 characters on Windows
* test(cli): cache test follows the synth script version
Chrome's profile lockfile is held for a moment after the browser exits, so removing the
capture profile threw EBUSY and a finished capture exited 1. The profile and staging
removals now go through a core helper that retries transient locks and, for cleanup of
finished work, warns instead of failing.
* feat(cli): capture can route its traffic through an opt-in upstream proxy
HYPERFRAMES_CAPTURE_PROXY=http://host:port sends the capture browser proxy's
forwarded requests and CONNECT tunnels, and every publicRequest download,
to that proxy by hostname instead of dialing a checked public IPv4. Unset,
behaviour is unchanged.
* fix(cli): keep capture comment share flat and close the new CodeQL findings
Test fixtures record what they receive instead of echoing request data, and
capture --video strips line breaks from a failed download's message before
logging it.
* fix(cli): proxied HTTP downloads send no URL fragment, and a malformed proxy credential is refused
The absolute-form request to the upstream used the URL's href, so a fragment such as
sprite.svg#icon went on the request line, which the pinned path never sends and strict proxies
refuse. A malformed percent-escape in the proxy credentials threw a bare URIError instead of the
usual "not a valid proxy URL" error. The test servers label their echoes text/plain.
* fix(cli): strip line breaks from capture --video errors in the form CodeQL recognizes
* fix(cli): capture --video logs errors through a recognized newline sanitizer
---------
Co-authored-by: Jerrai <jerrai@heygen.com>
render, check and snapshot open project history, which looks for a running
preview by probing 100 loopback ports and 5190. Behind an egress fence every
probe is refused and reported. Setting HYPERFRAMES_NO_PREVIEW_DISCOVERY=1 makes
historyDeps.findServer return null without a request, so history opens directly.
Refs #6204
heygen-rui-bot