900 Commits

Include renames

Author	SHA1	Message	Date
Miguel Ángel	c86d4013f5	Revert "feat(registry): the video-primitive moves, documented and customisable (#3090)" (#3162) ... This reverts commit 3b53bfd2f7.	2026-08-10 14:47:47 -04:00
Miguel Ángel	3b53bfd2f7	feat(registry): the video-primitive moves, documented and customisable (#3090) ... * feat(registry): add the video-primitive moves, and rebuild the catalog around them Adds the motion primitives: 277 new components and the blocks that go with them, plus the ui-primitives, themes and generators they are produced by. The registry index goes from 176 items to 454, and the search catalog is rebuilt so the set that is ranked is the set that can be installed. Additive on purpose. An earlier pass of this port used rsync --delete, which removed 101 files that exist on main because the incoming set is not a superset of the current one: beat-freeze-cut and camcorder-hud among them. Whether the re-port replaces those or sits alongside them is a product decision and not one a sync flag should make, so nothing is removed here. If any of them are meant to go, that belongs in its own commit where it can be seen. The generator is ported too. Main's version only scans examples, so running it without this change silently rewrote the index down to nine items. It also rewrites example manifests from templates.json and will overwrite hand-edits; those were reverted here after each run, and the diff is worth reading rather than trusting. Not covered. The 445 moves are not individually reviewed in this commit; the machinery that ranks and installs them landed separately so it could be read on its own. The internal evaluation corpus is deliberately absent: it is 1,400 files of briefs, gold labels and verdicts, and this repository is public. * docs(catalog): publish the primitive and component pages Adds the Mintlify pages for the moves this PR ships: 163 component pages, 13 primitive pages, and the navigation that lists them. Without these the moves land installable and undocumented, which is the worse half of a catalog. Three things left out deliberately. The 78 MB of docs/public. Nothing references it: every page loads its preview from static.heygen.ai, so those bytes would be weight in a public repo with no reader. Checked rather than assumed, by grepping the pages for the path. Pages for the thirteen moves that were specified and never built. They had documentation but no registry item, so a reader would have followed a page to a `hyperframes add` that fails. Their nav entries are pruned with them, and every one of the 309 remaining catalog and primitive nav entries was verified to point at a page that exists. Spike and scratch files that sit alongside the real docs on the source branch: qa-gallery.html, experiment pages, bundled player javascript. They are working artifacts, not documentation. Not covered: the pages are generated output and have not been read individually. The nav is verified to resolve, and the previews load from a CDN this commit does not control, so a broken image would show up in review rather than here. * docs: list the primitive and component pages in the site navigation The pages this PR adds were unreachable: nothing in docs.json pointed at them. This appends a Motion primitives group to the existing Catalog tab and a Primitives tab, both built from main's navigation rather than replacing it. Copying the source branch's docs.json wholesale was the first attempt and was wrong. That file describes a different site, tabs Documentation / Catalog / Primitives / Packages / SDK / Reference against main's Guides / Studio / Catalog / Developers, and it references pages only that branch has, so the preview server reported six dead links. Verified by running the preview and resolving every entry: 484 page refs, 0 dead, no warnings. Group-relative refs are why a flat existence check is the wrong validator here: cursor resolves through catalog/components and mcp through guides, so checking docs/<ref>.mdx flat pruned 22 entries that were fine. * fix(registry): restore what the port took from main's components Two regressions this branch introduced into items main already ships. Both were found by the repo's own gates in packages/cli, not by reading the diff, and neither is visible to the no-deletions check: no file was deleted, the contents of files were changed. The four liquid-glass blocks stopped installing their library. main lists lib/liquid-glass.iife.js as a second file on each; the port wrote the older manifest over main's and dropped that entry. The file is still in git and still on disk, it simply stopped being something `hyperframes add` writes, so the installed composition's <script src="lib/liquid-glass.iife.js"> would have resolved to nothing. Every one of the 294 registry-item.json files this branch touches was then audited against main: these four lost a file entry, and no item lost a top-level key. Fourteen caption components gained an empty <video>. The port added `<video id="wp-video" ...></video>` — no src, no <source> — to each component and its demo. It renders nothing and the registry linter rejects it as media_missing_src. Removed rather than given a placeholder, because main's version of each of these composes over whatever the host composition provides, so the element only ever added a broken node; a made-up src would ship a reference to footage that does not exist. The removal is deliberately surgical. Four of the fourteen also carry a substantial rewrite from the port, and only the media element and the rule that styled it are touched, so a blunt revert cannot take the rewrite with it. Verified: 2540 CLI tests pass, `bun run lint` exits 0. Before this, three tests failed. * docs(catalog): play the real composition, and show what can be changed Four changes to generate-catalog-pages.ts, so all 445 pages stay consistent rather than 445 files being edited by hand. The preview plays the composition instead of pointing at a video. Every new page pointed at static.heygen.ai/<name>.mp4 and every one of those answered 403, so the reader got a black box where the whole point of the page is to show them the thing. The objects were never uploaded and rendering 445 of them would have to happen again on every change. The player is already the thing being documented, so the page embeds it: the item's directory is copied under docs/public and an iframe loads it through a small wrapper. 444 of 445 pages play; the remaining one is a texture item that uses its own preview panel. The iframe is not decoration. Compositions set styles on `body`, so dropping the element straight into the MDX would put a composition's global CSS in the same document as the documentation around it. Three things this got wrong first, all found by opening the page rather than reading the output: - The wrapper loaded itself. `../<dir>/<name>.html` from inside preview/<dir>/ resolves back into preview/<dir>/. The player embedded the player and the frame went black with a second set of controls shrinking into the corner. - Copying only demo.html was not enough. Most demos are a mount shell whose child carries data-composition-src="./<name>.html", so the sibling has to come with it. Every URL answered 200 and the frame was still empty. - `autoplay` and `loop` are not player attributes. Writing them did nothing and every preview sat paused on frame 0 — which is blank for any composition that animates in. The wrapper drives play() and loops on `ended` instead. The Variables table. generateParams reads `params`; every item ported from the video-primitives work declares `variables`, a richer schema with a type, a default and a range. 112 items carry one and not a single page showed it, so the most useful thing on the page was the one thing missing. Nav groups. `if (entry.type === "component") return "Effects"` was the catch-all, so Effects held 267 of 445 pages: an alphabetical wall. Rules keyed on tags that already exist in the manifests split it; the largest group is now 73. An install command with a visible copy button. A plain code fence renders one on hover only, and it was absent from the accessibility tree entirely. This is the one line every reader comes to take. navigator.clipboard is unavailable on insecure origins, which is exactly the local preview these pages are written against, so the fallback path is load-bearing and is what was exercised in testing. Verified: 888 preview URLs fetched, 0 failures. Regenerating three times in a row produces no change, after a first attempt where "Variables" was added to GENERATED_HEADINGS with a capital V — the set is compared lowercased, so each run carried the previous section forward and appended a new one. Not covered: the 445 pages were not read individually. Coverage here is that every preview resolves and that a page from each of the block and component paths was opened and watched. * docs(catalog): put the code on the page A reviewer with no stake in the work compared these pages against shadcn/ui's component pages and motion.dev, and returned one gap: the pages carry almost no code, so they are pointers to a file the reader does not have yet. Its sharpest example was the Variables table — names, defaults and accepted values, headed "set the ones you want to change on the element", on a page that never shows an element or the syntax for setting anything on one. Two additions, in the generator so all 445 pages get them. A snippet under the Variables table: the real mount element with data-variable-values filled in from the item's own defaults, so it is copy-and-run correct before it is edited. That is the syntax the demos actually use, not an illustration written for the page. The item's source, in a collapsed Accordion. These files run 99 to 463 lines, so inlining them raw would bury everything else; collapsed, the code is on the page and one click away. Accordion is already what these docs use for this. A second reviewer, fresh, confirmed the change landed: it called the table and snippet actionable rather than filler and said the collapsed source earns its place. Also here: the preview retries play() until the clock moves. `ready` can flip before the runtime the player injects for a mounted sub-composition has finished wiring up, and a play() landing in that window silently does nothing. Both reviewers additionally reported every preview frozen at 0:00 and called it fatal. It is not. The player's clock runs on requestAnimationFrame (direct-timeline-clock.ts), browsers suspend rAF in a hidden tab, and the reviewing tab was hidden: document.visibilityState read "hidden" while the player reported ready and not paused, and a one-second rAF loop never completed a single tick. Seeking the same composition by hand renders it correctly at any offset. So the retry stops after ~15s instead of spinning forever, and the comment says why an automated check of a background tab will always read 0. Not covered: the reviewers' other standing finding, that only some items carry variables at all, so the pages do not have one shape. 125 of the 206 items tagged as a primitive declare none, and giving them variables means authoring them into each composition, not editing metadata. Verified: lint exits 0, the no-deletions gate passes, nav resolves 598 refs with 0 dead, and regenerating three times running changes nothing. * feat(registry): give 55 primitives variables that actually do something The catalog pages listed variables for 112 of 454 items and nothing for the rest, so most pages could show a reader what a piece looks like but not what they could change about it. This adds them to 55 more, taking the count to 167. These are not metadata. A variable is only real if the composition reads it, so each one is declared on the root, validated in the composition's own script, and wired to something visible: travel distance, blur radius, direction, density, accent family, tone, label text. Declaring a knob the code ignores would put a table in the published docs that lies about the piece, which is worse than having no table. Every one falls back to its declared default when the incoming value is missing or unrecognised, so a bad override degrades to the shipped look rather than to a broken frame. With no overrides at all, each item renders exactly as it did before: that was checked per item against `git show HEAD:` in a real browser, comparing computed styles rather than eyeballing. Four things this ran into that are worth writing down. An apostrophe anywhere in a description terminates the single-quoted data-composition-variables attribute and breaks the HTML parse. Every declaration in the registry now parses; that is checked, not assumed. Where a timeline drives GSAP's own y/scale/filter, GSAP writes inline styles that beat any CSS custom property, so those knobs cannot be won from the composition. Most of these items keep their motion in a user-owned "Timeline integration" comment rather than in code, so no timing variables were declared for them at all. A direction knob on a wipe can still be wired honestly, by remapping clip-path inset sides through multipliers whose defaults reproduce the original exactly. Colour tokens that only reach a :focus-visible outline, or an element sitting at opacity 0 at rest, render identically in a video. Those were skipped rather than shipped as knobs that appear to do nothing. CSS shorthand defaults need care: `border: var(--x, 0 solid transparent)` moves computed border-color off currentColor even at zero width. Defaults were chosen to reproduce the original computed style, not merely to look equivalent. Not covered: 72 primitives still have no variables, and the UI-primitive demos that scripts/sync-ui-primitives.ts mirrors are now stale for the converted items. Nothing runs that script in CI today. Verified: every declaration parses and deep-equals its manifest array, every declared id is read by the composition, no demo.html changed, and lint exits 0. * feat(registry): variables for 16 more primitives, and stop the snippet clipping Takes the count from 167 to 183 of 454. Same contract as the last batch: each variable is declared on the root, validated in the composition's own script, and wired to something visible, because a knob the code ignores would put a table in the published docs that lies about the piece. The snippet under each Variables table was clipping. Its data-variable-values payload is one long line and the code block cut it off mid-value, with no wrap and no scrollbar, so the one line on the page that exists to be copied could not be read. The fence now carries `wrap`. Worth noting how that survived: the generated markdown was correct and every mechanical check passed. It only failed in a browser, which is where it was eventually seen. Two techniques this round that are worth keeping. Where an accent has a themed token family, the knob sets a new custom property consumed by that one surface, with a fallback to the existing token, rather than overriding the shared accent. Default therefore sets nothing, so an externally themed accent is not clobbered, and the non-default options still follow the theme in both light and dark. Where GSAP owns the property outright and no CSS multiply can win — number-wheel animates `y` inline — the knob is wired at build time instead: extra revolutions lengthen the digit strip and move the target, so travel changes while the resting frame stays identical. That is a real answer rather than a skipped knob. Motion knobs that multiply a timeline-driven custom property collapse to identity at rest, so every one of them was verified with that property pinned to a mid-flight value rather than at t=0, where all options look the same by construction. Not covered: 56 primitives still have no variables. Verified: every declaration parses and deep-equals its manifest array, every declared id is read by the composition, no demo.html changed, lint exits 0, and the wrap fix was confirmed on the rendered page rather than in the markdown. * feat(registry): variables for 21 more primitives Takes the count from 183 to 204 of 454. Same contract: declared on the root, validated in the composition script, wired to something visible, defaults reproducing the pre-edit render exactly. Three kinds of knob were turned down this round rather than faked, and the reasons are worth keeping. A knob that contradicts its own motion. The sheet panel could be moved to the left, but the recipe drives GSAP x from the right, so the panel would slide in from the wrong side while the control claimed otherwise. A knob that needs two defaults. A separator length means width horizontally and height vertically, so one token would be wrong half the time. An option that is not an option. Two components were given a green accent that probed byte-identical to their default, because the theme accent already is that token. A row in the docs table that does nothing is worse than a missing row, so it was replaced with one that differs. Accent knobs set a new property with a fallback to the shared token rather than overriding it, verified by rendering with an external accent in place and confirming the default still yields to it. Motion knobs multiply a timeline-driven property so they never fight the inline styles GSAP writes; because those collapse to identity at rest, each was checked twice, once at rest against HEAD and once with the driven property pinned mid-flight. Verified: every declaration parses and deep-equals its manifest array, every declared id is read, defaults match HEAD on computed styles and on a pixel hash of the rendered element, no demo.html changed, lint exits 0, and the no-deletions gate passes. * feat(registry): variables for 4 more primitives, and make manifests agree with their compositions Takes the count to 207 of 454. Four items carried a different description for their exit variable in registry-item.json than in their own data-composition-variables. The catalog page renders the manifest, so the published table described the knob one way while the composition header described it another. The composition wins: it is the file that implements the variable and the declaration is what the runtime reads. The skill docs no longer describe a hosted tier, since the CLI now ships the two local tiers only, and skills-manifest.json is regenerated to match. * feat(registry): variables for 4 more primitives Takes the count to 211 of 454. Two knobs are worth calling out because they touch things the timeline also touches. skeleton-block slide multiplies the driven row offset, so it is identity at rest and only bends the middle of the move. slider value sets the resting fill together with the readout text, aria-valuenow and aria-valuetext, so all three agree; a composition that tweens the fill takes over from there and owns the readout, which the comment header states plainly rather than hiding. A multiplier was rejected there because a 0 to 1 tween would push the fill past the end of the track. Knobs on elements that sit at opacity 0 at rest were kept only where the shipped recipe reveals them, and verified with the reveal forced on as well as at rest. Skipped: an aria-label string knob that never renders, and an accent token declared in one item CSS that nothing consumes. * refactor(registry): drop the UI primitives, this is a video catalog Removes 66 items tagged ui-primitive: accordions, buttons, inputs, dialogs, a calendar. They are a shadcn-style interface component set that happens to be expressible as HTML. None of them animate anything, so in a catalog whose job is to offer moves for video they widen the surface without making it more useful, and each one is a page a reader has to skip past to reach something that moves. Every one is new on this branch. None exists on main, so nothing main ships is being taken away; that was confirmed against origin/main before deleting rather than assumed, and the no-deletions gate still passes. Removed with them: registry/ui-primitives, the Operator Black token and contract files only these items consumed, and the tooling that maintained them (sync-ui-primitives.ts and scripts/lib/ui-primitives). No other registry item declares a dependency on any of the 66, so nothing else loses a piece. The now empty UI Primitives navigation rule goes too. Generated output is pruned with the sources. The page generator writes files but never removes ones whose source has gone, so a stale page would have survived and 404d its own preview. Verified: 0 orphan pages, 0 orphan previews, and the navigation resolves 532 references with none dead. This does discard variables authored for 54 of them earlier on this branch. That work is in the history if these ever come back, and it is the right trade: they should not have been in a video catalog to begin with. The catalog is now 388 items. Lint exits 0 and 2522 CLI tests pass. * feat(registry): every motion and transition primitive is now customisable The last 16 primitives get variables, so none is left without them. 173 of 388 items now declare variables; the rest are blocks and showcases, which are whole scenes rather than parameterised moves. Same contract throughout: declared on the root, validated in the composition script, wired to something visible, and falling back to the declared default on missing or unrecognised input. With no overrides every item renders exactly as it did before, verified per item against the pre-change render in a real browser at rest and at pinned mid-flight states, comparing computed styles and rects and in most cases a screenshot hash. This round refused several knobs rather than shipping ones that only look real. A tilt-card depth knob was written, measured, and thrown away: the card sets overflow hidden, which forces transform-style flat, so the authored translateZ is already inert and every option probed identical. It ships a glow knob instead, which drives inset and visibly changes at rest and under the drift. slot-machine-roll has no free travel knob because the roll is exactly one row height and any multiplier lands the reel off-register; size scales row height and roll distance together, which is the only honest version. soft-blur-in offers up and down but not left and right, because the shipped tween resets y and not x, so a horizontal offset would never animate away. Two pre-existing bugs surfaced while checking honestly, both left alone as out of scope but worth recording. zoom-through-transition and tracking-in each tween a custom property that is never set, so CSS reads it as zero and the move starts from zero rather than from its authored value. The depth and tracking knobs are scoped around that and their headers say so, rather than pretending the tween is what it appears to be. Verified: 388 items, 0 primitives without variables, 0 items where the manifest and the composition disagree, 0 declared-but-unread variables, nav resolves 532 references with none dead, no demo.html changed, lint exits 0, and the no-deletions gate passes. * feat(registry): raise the catalog quality bar, and add eight primitives Cuts 37 components, adds 8, and writes down the standard both decisions were made against. The 37 removals are all new on this branch and absent from main, so nothing shipped is withdrawn. Each was audited with two pieces of evidence: source identity after name normalisation, and a composition-level contact sheet showing the members animate identically. The largest group was 13 files byte-identical apart from an h3 and one sentence. Nothing marqueed, panned, zoomed, deployed or dragged. An honesty tiebreak decided survivors: frosted-glass-wipe has no backdrop-filter, spring-scale-in has no spring, masked-slide-reveal has no mask, short-slide-right travels up, and three-particle-ribbon differs from three-orbiting-cards by one number while having neither particles nor a ribbon. Two independent audits agreed 10 out of 10 on a shared calibration sample, in both directions, including three items a first pass wrongly condemned. The rubric is the durable part. Fatal criteria are separated from fixable ones, because no-timeline alone hits 97 items including some of the best; promoting it would have cut 97 and left a worse catalog. It also records the harness rules that make a verdict reproducible: render from the composition rather than the demo, since demos carry content the installed item does not, and mount sub-compositions rather than inlining them, since inlining renders black frames indistinguishable from a dead item. The eight additions target measured gaps. Camera language ranked first because PSNR across 30 reference demos showed the most impressive environments barely move: they are sets, not shots. camera-shake carries nine lens-accurate profiles, amplitude scaled by focal length so a wide lens shakes differently from a telephoto. rack-focus splats each light through the aperture shape, so a defocused point becomes an image of the iris, with flux conserved so highlights survive defocus. camera-dolly-zoom solves focal length from distance, holding subject size to 0.000 percent drift while the background grows 53 percent. Plus oscilloscope-trace with history-free phosphor persistence, bar-chart-race, split-flap-board, spiral-galaxy and vfx-anamorphic-flare. Each is verified by rendered frames and a seek-equals-playback check rather than by check passing, which is not a visual gate. * fix(registry): let the split-flap board finish flipping on screen The board declared 8s but every flap had settled by 3.5s, so more than half the composition was a still frame and the catalog preview opened on it. * fix(registry): keep the thread-message-stack payload parseable A line wrap had put literal newlines inside the JSON string literals of the blocks data-hf-primitive-data payload, so JSON.parse threw in the browser and the composition never ran. The preview script hid it: it rewrote the payload in the temporary copy it captured from, so the catalog picture looked right while every installed copy stayed broken. That repair pass is gone and the payload is fixed where it ships. Its two tests could not have caught this. Both were written against vitest in a directory the repo runs with node:test, so neither was in test:scripts and neither had ever run. They are converted and registered, along with a new one that JSON.parses every payload in the registry, and that one was checked against the re-wrapped shape before being kept. * fix(registry): close the apostrophe that truncated a variables declaration chromatic-aberration-wipe described its accent as "the incoming scene's gradient" inside a single-quoted data-composition-variables attribute, so the attribute ended mid-JSON and the tag never closed. The formatter refused to parse the file, which is how it surfaced, but the runtime would have read a truncated declaration. Also formats the 159 registry and docs files the branch had left unformatted, regenerates the skills manifest, and drops docs/primitives: those 13 pages import /snippets/PrimitivePlayer.jsx and read docs/public/primitives/, neither of which is on this branch, so mint failed the build on them. Nothing links to them and they ship whole on feat-video-primitives. CI ran test:scripts before building core, so the preview test added here failed on a missing dist rather than on anything it checks. It now runs after the builds. * fix(registry): make the review findings real fixes Ten items declared variables on their composition root but had no variables key in the manifest, so their generated pages shipped no explorer at all. Their manifests now mirror the root. Two more disagreed only in description text, and the root was the truthful side: both compositions paint an inset ring, not the slabs or colour pair the manifest described. The caption <video> removal left 24 CSS rules addressing elements that no longer exist. Removed, excluding the four ids that were already orphaned on main. thread-message-stack could not stay fixed: oxfmt reflows a divs contents and lands a newline inside a JSON string literal, so the payload broke again on the next format. A script tag is not an option because the runtime strips every script out of the mounted clone. The reader normalizes HTML whitespace instead, which is what makes it survive any reflow, and the guard test now asserts that contract rather than the byte layout. downloadFile had lost its 30s timeout, DownloadOptions, and the mid-pipeline error plumbing in a rewrite that was only meant to fix redirects. Five callers were left with no stall guard. Restored, redirect handling kept. warnUnknownEnumValues re-did the parse readDeclaredDefaults had already done. Both now share one readDeclarations, and the rest splits into compositionLabel, declaredOptions and unknownEnumValue. 1909 core tests unchanged. Deletes build-qa-gallery, theme-gate and generate-primitive-pages: nothing invokes them, two read a coverage map four directories above the repo root, and the pages the third generates are no longer on this branch. Wires check-no-main-deletions, which is the opposite case, real and tested and never run. * fix(registry): stop shipping a stale copy of the catalog-search work This branch carried re-authored copies of the CLI search commits rather than the ones on their own PR, so merging it would have rolled back six later fixes: the vector cache that refuses a half download, the 0o700/0o600 modes, the rebuilt-from-registry index generator, the coverage gate and its CI job, and the scripts typecheck. Those files now come from that branch. registry.json still listed 64 items whose directories the UI-primitive removal deleted, so hyperframes add would resolve a name and then fail on missing files. Regenerated from disk: 358 searchable items, 358 vectors, gate green. Also drops an internal provenance block from thread-message-stack, along with the type and the two JSON schemas that existed only to describe it. It published an artifact id, a version id and a heygenverse:// URI, none of which mean anything to someone installing a block, and a public registry is the wrong place for them. Typechecking scripts/ for the first time surfaced 45 errors in this branch. Fixed rather than suppressed: the geometry test reads positions through one accessor that names a missing index instead of letting NaN reach a tolerance compare, and the null-returning shape helper is asserted at its call sites, except in the test whose subject is the null. * refactor(scripts): split the page builder into its numbered sections generateItemMdx had grown to cyclomatic 26 across 196 lines while its own comments already named the seams. previewSection, usageSection and footerSection now own one each, taking it to 13. Regenerating all 358 pages afterwards produces a byte-identical tree, which is the check that matters for a generator. * fix(cli): repair what the cross-branch file take broke Taking files wholesale from the catalog-search branch reverted the downloadFile timeout restored one commit earlier, so five callers were back to no stall guard at HEAD. Restored on both branches this time, since that branch never had it either. It also took that branch test:scripts line without the vitest it depends on, so the script exited 127 and the CI Test job would have failed on a missing binary rather than a test. vitest is a root devDependency now, and the run is scoped to scripts/catalog/ with the slash: without it the prefix also matched catalog-preview-temp.test.ts, a node:test file with no vitest suite in it. Both branches had that one. Four registry items and their docs copies carried absolute paths from a working directory. A public registry is the wrong place for them and history is permanent, so the sentences now name the source without the path. Skill docs came from before the code they describe: the catalog command reports unindexed and applies installability after ranking, and both SKILL.md files now say so. Also drops a double type assertion and ten dead ?? NaN coalesces from the geometry test, the second of which reintroduced exactly the NaN-into-a-tolerance-compare that the checked accessor exists to prevent. * fix(ci): resolve core from source and take only item directories The scripts typecheck failed on generate-registry-items importing @hyperframes/core by package name. It resolves on a machine with a warm node_modules, which is why it passed locally, and not in CI. Every other script in the directory already imports core from source and says why in a comment. The preview job derived its item list with a sed that needs a trailing slash, so registry/components/CATALOG.md never matched, survived as a full path, and was handed to the renderer as an item name. The grep now requires a directory component. Simulated against this PR: 219 items, none of them a path. * refactor(registry): load gsap from the cdn like every other item store-badge-lockup vendored gsap 3.14.2 as a 4,200 line minified file and installed it into the users project, while 540 other items load that exact version from jsDelivr. Repointed, the copy deleted and the manifest entry with it, so hyperframes add store-badge-lockup no longer writes a second copy of gsap into someone elses compositions directory. Re-rendered and re-generated: the preview still draws. * feat(registry): swap in the detailed device models Replaces the iPhone and MacBook models in the three device blocks. The old assets were untitled meshes with no keyboard on the laptop; these name every part and model the keycaps, speaker grilles, antenna bands and camera plateau. Not a drop-in. The compositions found the screen by side effects, the material that happened to carry an emissiveMap for the phone and a mesh literally called matte for the laptop, and neither exists now. They select front-glass and display instead. Both panels ship UVs authored for a tiling material, the laptop runs u -6.3 to 6.3, so one screen image clamped and smeared across the panel. Planar UVs are derived from each panel bounds at load. The old phone display sat at the model minimum Z and the timeline spins assume a screen facing -Z. These face +Z, so the model is aligned by reading which of its own parts is front rather than re-timing the animation. Removes the hand-drawn Apple logo from two blocks: the replacement ships apple-logo meshes, and the drawn one used coordinates read off the old lid, so it floated beside the device. The preview copy only took top level files, so models/, lib/ and assets/ never reached docs/public and 38 items rendered there without their assets. That is the source of the non-blocking 404s in the preview job. It recurses now, which also brings vendored bundles across, so the generated tree is out of the lint scope. The html-in-canvas notice is a Danger callout: without the flag the preview is a black rectangle, which is a prerequisite rather than a caveat. * chore(registry): rebase onto the merged catalog search This branch carried its own copy of the catalog-search work so that merging it in either order could not regress the other. That copy is now the older one: main has the consent fix, the contributor path for someone without the embedding model, the restored download test and the corrected gate message. Every file main owns is taken from main, and the three duplicated CLI commits are dropped rather than replayed. Regenerated afterwards, because the registry it describes has changed: registry.json, the vector index, the catalog pages and the skills manifest. * fix(scripts): stop the rebase reverting the preview pipeline Resolving the rebase in favour of this branch took three files whose newer versions had already merged, so the branch quietly reverted them. generate-catalog-previews.ts lost encodeForWeb, which exists because publishing masters directly put 25 Mbps files on the docs CDN and one 20-second preview was 60 MB. It also lost the ffmpeg transcode, so a jpeg capture was being written straight to a .png path while the comment above still said it transcoded, and it lost openOpaqueCapture, re-creating the second copy of a capture setup that was extracted precisely to stop there being two. This PR renders previews for over 200 items, so all three shipped at scale. scripts/tsconfig.json regained exclusions that hole the gate, and generate-template-previews.ts went back to importing the producer by package name, which is the CI failure that import was changed to fix. All three are taken from main. Also drops an alignScreenToMinusZ copied into the laptop block, which has no front and back to compare and never called it, and makes the preview copy lstat so a symlinked directory cannot send it outside the repo. * fix(registry): clear the five items this PR added that the linter rejects The registry linter is not wired into CI, so five items this PR adds were shipping with real render defects nobody would have seen fail. caption-camera-follow and grade-split-reveal styled their root by its own class. Sub-composition CSS is scoped to [data-composition-id=...] <selector>, so a selector whose leftmost part is the root class becomes a descendant selector and stops matching the root: the scene renders unstyled at render time while looking correct in every static check and in preview. Both now key off the attribute the scoper already adds. logo-brand-close tweened letterSpacing, which the browser snaps to integer device pixels, so the ease-out tail stutters under seek-by-frame capture. It is a scaleX now. terminal-simulator named SFMono-Regular, which the renderer cannot resolve, so the text silently fell back. oversized-cursor was a false positive: the rule scans raw source for head tags and a literal one written inside a JS comment paired with the real closing tag. Confirmed against a render, nothing leaks into frame, so the comment says head element rather than the tag. Also stops generate-registry-items.ts dropping catalogArtifact.revision. build-local-vectors.ts stamps it so the CLI and the coverage gate can tell whether the published vectors still describe this registry; regenerating the item list erased it, and the gate then failed until someone rebuilt the index. 41 items still fail the linter, every one of them pre-existing on main.	2026-08-10 14:26:55 -04:00
Vance Ingalls	bd1c1af291	chore: release v0.7.105 (#3152)	2026-08-10 08:08:16 -07:00
Miguel Ángel	68205dbbc1	feat(cli): search the catalog by meaning, on this machine (#3089) ... * feat(cli): search the catalog by meaning, in three named tiers Browsing the registry means matching names and tags, which fails whenever the author's wording differs from yours. "make the pace feel faster" finds nothing when the move is described as "velocity-driven blur". This ranks by meaning instead. Three tiers, and the command always says which one answered: words shared vocabulary, free, offline, no account on-device bge-small, free, offline, one opt-in download hosted Gemini, free for signed-in HeyGen users The tier is stated because a quietly worse answer looks exactly like a good one. --json carries it as a token alongside dropped, shown, total and top_score, so an agent reads provenance as data rather than matching English that is written to be reworded. Two consents, asked once each, and never conflated. Sending a query is a privacy question, so the prompt says the query is sent. Downloading a model is a disk and bandwidth question, so that prompt talks about size. Neither fires without a terminal: an unattended run sends nothing and downloads nothing unless a flag records that a person agreed. The catalog is derived from registry-item.json rather than from a separate document, so the set that is ranked and the set that can be installed are the same object by construction. Only the on-device vectors are committed; the hosted vectors are nine megabytes and belong on the server. top_score is reported and never acted on. A "nothing matched" threshold looked clean on long briefs and collapsed on the short queries people type: "a logo appears" scores 0.6181 and keyboard mash scores 0.6417, so any cut that catches the noise rejects the real query. The measurement is in the evals directory rather than in this branch. Not covered here. The published recall figures were measured against a separate hand-written document, not against registry text, so they should not be quoted for this catalog until re-measured. The offline tier needs a normal install: a single-file build cannot load the native ONNX runtime, which the command now reports instead of silently degrading. And the drop-detection path has never been observed firing outside its author's tests. * fix(cli): make this branch pass the repo's own gates Three things `bun run lint` and `fallow audit --base origin/main` rejected. CI runs both, so none of this branch would have gone green. Found by running them, not by reading the diff. process.exit in catalog.ts, twice: an invalid --type and a cancelled picker. check:cli-process-ownership reserves that for cli.ts, and the rule is not cosmetic — process.exit tears the process down where it stands, so anything cli.ts has queued to run on the way out is dropped. finishCommand throws a CliResultSignal that cli.ts turns into the exit code, which is what init.ts already does for a cancelled prompt. Three exports with no consumers. normalize keeps its body and loses its export; localEmbedder is the only caller. modelsDirectory goes entirely, having no caller inside its file or out. The WordPieceConfig re-export goes, and with it the import it existed to forward: the type is exported from wordpiece.ts, where its consumers already take it from. Complexity. prepareOnDeviceTier is lifted out of run(), which took run from 64 cyclomatic and CRAP 948 to 54 and 684. That block is one decision — can the offline tier run, and if not, why not — and its only product is a list of warnings, so it reads and tests as a unit, which it could not do inline. The rest is suppressed rather than refactored, each with its reason on the line above. Finishing run() means extracting its three output paths, and that is a refactor of a command this branch already changes for other reasons: a separate initiative, not something to absorb here. Every suppression says what shape the function has and why; a bare marker on a function nobody can justify is how a threshold stops meaning anything. Verified: `bun run lint` exits 0, fallow reports no issues across 27 changed files, and 2540 CLI tests pass. * feat(cli): ship the local search tiers only, drop the hosted one Search now has two tiers, both local: shared-vocabulary word matching, and the opt-in on-device model. The hosted tier, which sent the query to a HeyGen endpoint and ranked it with a hosted model, is removed. This is a scope decision, not a defect. The endpoint works and its own change is reviewed and green; it is simply not what we want to ship first. Landing local only means the feature has no backend dependency, no auth requirement, and nothing leaves the machine unless someone opts into downloading a model. Gone: registry/smartSearch.ts and its test, the --smart and --no-smart flags, the outcome plumbing through the command, the remote branch of applySearch, the remote tier, and the hosted-only JSON fields (ranking, catalog_version, top_score). Also the smartSearchEnabled consent field in telemetry config, which was the persisted storage behind the hosted consent and would otherwise have been left as dead configuration surface. Kept exactly as they were: both local tiers, the --on-device and --yes flags, the download consent prompt, and the runtime check that happens before the download rather than after it. The --json envelope still reports query, tier, tier_detail, shown, total, dropped, warnings and results, so an agent can still tell which tier answered and why. tierToken now distinguishes on-device from words. Verified: lint exits 0, fallow reports no issues, 2522 CLI tests pass, and the command was exercised directly. A query answers on the on-device tier where the model is installed and falls back to word matching where it is not, reporting that fallback in warnings rather than silently. An unknown --type still exits 1 with a readable message, and --smart is now rejected as an unknown flag. * fix(cli): count only moves this registry cannot install as dropped The dropped count was computed against the list left after the user's own --type and --tag filters, so every move the user excluded was reported as one the registry is missing. Filtering made the number go up: the same query reported 277 unfiltered and 302 with --type block. The count exists so a caller can tell "nothing matched your words" apart from "the ranker suggested things this project cannot install". Conflating it with user filtering destroys exactly that signal, and worse, genuine index skew and a self-inflicted filter printed a byte-identical line with opposite remedies -- one means refresh the shelf, the other means drop a flag, and refreshing does nothing. Now counted against the registry rather than the filtered view. The manifest is already fetched whole and narrowed in memory, so keeping the unnarrowed name set costs no extra request, and item loading still runs only on the filtered subset. Verified against ground truth rather than by eye: the vector artifact holds 411 names, the registry holds 168 installable items, and 134 of those names exist in both, so 277 are genuinely uninstallable. The count now reads 277 unfiltered, 277 under --type block, 277 under --type component and 277 under --tag, and the skew it reports is real -- the artifact predates dropping the UI primitives and still ranks moves that are no longer on the shelf. Reported by Vance Ingalls, who also noted this closes an item the status doc listed as unverified. Two earlier sweeps could not make the count fire because neither combined a filter with a query. Tests pin the three cases: a genuinely absent name counts, a filter-excluded name does not, and a fully installable ranking reports zero. * fix(cli): tell the user when meaning search cannot see the catalog The on-device index was fetched once and never revalidated: the only freshness check was two existsSync calls. A move added after that fetch was invisible to meaning search permanently, not down-ranked but absent from the candidate set. The registry manifest on the same command carries a 24h TTL, so the two halves of one feature disagreed about staleness. The dropped count reported over-coverage only, names the index has that the registry lacks. Under-coverage was never computed, so the harmless direction was instrumented and the costly one was silent. Reproduced with an index truncated to 120 of 168 moves: dropped read 0, perfect health, while 48 moves were unreachable. Counts under-coverage from the name list the artifact already carries, so no extra request. Warns only when non-zero, and names the remedy. The remedy had to be made true: --on-device could not refresh a stale index because hasLocalVectors short-circuited the fetch. That flag now refetches when the index is absent or no longer covering. Two defects the reproduction surfaced. A failed refresh reported the tier unavailable while the old vectors were still on disk and still ranking. And the fetch wrote its two files one at a time, so failing between them paired a new name list with an old matrix, a hard load error rather than stale data. It now writes both or neither, which matters more once refresh runs on staleness. top_score returns, scoped to the on-device tier and set to the score of the best result actually shown rather than the ranking head, which can describe a row the caller never received. Also: scripts/ is now typechecked. It never was, which is how a build script that crashes after the paid embedding call, and two scripts whose imports do not resolve at all, went unnoticed. 43 errors fixed, no suppressions. And the docs stop describing a --smart hosted tier that was deleted, an item that does not exist, and a registry refresh that cannot fix a stale vector index. * ci: fail when the search index stops covering the registry The catalog vector artifact is regenerated by hand. Nothing in CI, in package.json or in a hook rebuilds it, because embedding needs the 32 MB model. So adding a registry item silently makes it invisible to meaning search until someone remembers to regenerate. The failure is asymmetric, which is what makes it easy to miss. Removing an item is self-healing: the ranker still scores the dead vector, then filters the name before display, so a user is never offered something they cannot install. Adding one is not: the item is absent from the candidate set entirely, not ranked low. Comparing the two name lists needs neither the model nor a network call, so the gate runs in seconds. CI checks rather than fixes, for the same reason it cannot regenerate. Scoped to blocks and components. Examples are starter projects a user scaffolds, never something catalog ranks, and the artifact carries no vector for them, so demanding one would keep this gate permanently red and it would be ignored within a week. Verified in both directions rather than assumed: adding an unindexed item exits 1 and names it, restoring the registry exits 0. * fix(catalog): rebuild the search index from the registry build-local-vectors.ts read registry/catalog-artifact/catalog.json, a file no script in this repo writes and which is not committed, so the documented regeneration command failed on a missing path. That is why the index could drift from the registry with nothing to run to fix it. It now reads registry/blocks/* and registry/components/* through catalogFromRegistry, the existing helper that already produced the right shape but had no caller. Rebuilding reproduces the shipped 168 rows byte for byte. A lefthook catalog-index command regenerates and re-stages both artifact files whenever a staged registry-item.json changes, mirroring the skills-manifest pattern, so adding or removing an item keeps the index in sync without anyone remembering to. Verified end to end: staging a new item took the artifact 168 to 169 rows and staged it in 0.80s. * fix(cli): refuse a half-downloaded vector cache The two artifact files have to agree on how many rows there are, and until now nothing checked that before writing them. A truncated or wrong-model response landed in the cache and only failed at load, on every later search, until someone cleared it by hand. The pair is now checked first and refused as a unit, and the cache is created 0o700 with 0o600 files rather than inheriting the umask of a directory the caller may have pointed anywhere. Also lifts the capture setup the two preview generators had drifted into sharing into scripts/preview-capture.ts, and splits the vector builders batching and packing out of main. Both were findings the audit attributed to this branch. * fix(cli): keep the catalog vitest run with the tests it runs Restacking took the base package.json wholesale, which dropped the vitest dependency and the scripts/catalog run this PR adds. Both belong here rather than under it. * fix(cli): stop the declined model download from happening anyway Answering no to the on-device download offer recorded no and warned, then carried on. The guard below it is localModelConsent() !== false, which the decline had just made false, so it was skipped rather than taken: control reached recordLocalModelConsent(true), overwrote the answer with yes, and fetched the 32 MB model the user had refused. Next run it never asked again. No test could catch it. The stub pinned localModelStatus to ready, so the prompt never fired, and recordLocalModelConsent was a no-op that recorded nothing. Two tests now cover the offer, and they need three things the old stubs did not model: the run has to look like a terminal, because off one the command treats --on-device as the consent and never asks; the ONNX probe has to answer true, or an accepted offer returns at the runtime guard before it can download; and the status has to follow the recorded answer, or the second offer later in the run fires as well. Removing the return makes the decline test fail. * fix(catalog): let someone without the model still add a component The pre-commit hook rebuilds the search index, and rebuilding needs the 32 MB embedding model. An outside contributor adding a registry item does not have it, so their commit died inside the ONNX loader on an ENOENT naming a path they never set, and the CI gate then told them to run the command that had just crashed. The model is an opt-in for search, not a build dependency, so nobody is charged for it to contribute. The builder checks first and explains itself, exiting 3 for cannot as distinct from 1 for failed. The hook treats 3 as skip and lets the commit through. The gate now names both paths: regenerate if you have the model, leave it if you do not and a maintainer will. Verified both ways: with no model the builder explains and the hook exits 0; with the model it still regenerates byte-identically. * docs: say that anyone can add a registry item, and stop hand-editing a generated file Two defects, one of them the reason 64 stale entries survived in registry.json. The checklist told contributors to add their item to registry/registry.json. That file is generated from the item directories, so an entry added by hand survives until the next regeneration and then vanishes, and one left behind for a directory that no longer exists is worse: hyperframes add resolves the name and then fails on missing files. Both CONTRIBUTING.md and the agent-facing skill reference now run the generator instead. Nothing said contribution was maintainer-only, but nothing said it was not either, and two steps do need assets an outside contributor has no reason to install. Those are now named in a table with what happens if you do not have them, matching how the preview image was already handled. The search index is the new one: the model behind it is a 32 MB opt-in for search, not a build dependency. * fix(cli): harden on-device catalog search * fix(cli): refresh stale catalog vectors * test: create catalog vector temp dirs securely	2026-08-09 22:59:15 -07:00
Miguel Ángel	c96b30c717	chore: release v0.7.104 (#3147)	2026-08-09 17:19:31 -07:00
Vance Ingalls	adb13ce125	chore: release v0.7.103 (#3127)	2026-08-09 03:14:27 -07:00
Santhi Prakash	b4bd670402	fix(core): retry bpm-detective import after transient failure (#2736) ... loadBpmDetective cached the promise returned by dynamic import even when that import rejected. A transient failure (network hiccup, bundler issue, missing module at first access) was therefore cached as null for the rest of the session, silently disabling BPM detection. - Reset the cached promise on import failure so the next call retries. - Only cache the default production import; custom loaders bypass the cache. - Make loadBpmDetective testable by accepting an optional importFn. - Add regression tests for failure/retry and module/default resolution.	2026-08-08 22:32:10 -07:00
Vance IngallsandClaude Fable 5	19defeabfe	feat(core,cli): ship the DE parallel router fleet-wide — remove the canary gate ... Deletes the `de-parallel-router` canary entry and the `isCanaryEnabled` guard in render.ts together, leaving the producer's default-ON in place. Net effect for users: the parallel drawElement router is on for everyone again. ## Why, and why not a ramp Gating at 5% was itself the regression. Measured 2026-08-08, the day after v0.7.101 shipped the canary: fleet router exposure fell from 3.13-4.25% of non-CI renders to **0.13%**, roughly 25x, because out-of-cohort installs are explicitly disarmed and #2840 deleted the everyone-armed trial in the same change. 2,537 installs lost a feature they already had. Severity is speed only, never output, and nothing is persisted to disk. PR #2840's body claimed "the canary does not make exposure smaller; it makes it chosen and revertible." That was true of the end state and false of the first step. This lands the end state. Entry and guard go together deliberately: at >=100 the evaluator short-circuits ahead of the CI/seedless exclusions, so removing only the entry would have flipped whatever still resolved false at deletion time, unstaged. ## Both stated blockers are void - **≤4-CPU / Docker coverage gap.** Docker renders never use drawElement — 0 of 4,281 across every CPU tier, software GL gates it out — and the router requires it. No percentage could ever expose Docker, so no ramp closes that gap. ≤4 CPUs yields ~42 drawElement candidates in three days. - **PRINFRA-372.** Its signature has hits on 0.4.12, 0.4.37, 0.6.52, 0.6.93, 0.6.109 and 0.6.110 — versions predating drawElement (v0.7.38) and therefore this router. It is real, still live on 0.7.101, and belongs to the screenshot/beginframe path. 11 reproduction runs across four configurations on the enriched profile (darwin/arm64 25.5.0) came back clean. ## Safety unchanged The per-install circuit breaker and the per-render self-verify are untouched; `HF_DE_PARALLEL_ROUTER=false` remains the user-facing kill switch. Post-canary data at 14 days: >8 CPUs 3.02% revert (177/5,857), 5-8 CPUs 2.40% (6/250) — consistent with the 2.75-3.16% baseline. Revert path is now a code revert rather than a registry edit. That is the trade this shape accepts in exchange for one release instead of two. ## Corrects two claims that shipped wrong `~17x jump in exposure onto <=4 CPUs / Docker` overstated the reach, and `~11% of installs already route` was an OUTCOME (the share clearing eligibility and the old 25-render cap), not an exposure setting — read as a rollout knob it inverts the arithmetic, which is how gating at 5% came to cut exposure rather than ramp it. Both are recorded in render.ts so they are not reintroduced. ## Tests Removed the core wiring assertion and the two CLI canary-gating tests, which pinned a gate that no longer exists. Added the inverse guarantee in its place: an ordinary install must come out of the breaker with the var UNSET so the producer default applies — writing "false" there is precisely what disarmed the fleet at 5%. core 1701 passing, cli 2491 passing, studio canary 29 passing. The 2 failures in play.test.ts reproduce on clean origin/main and are unrelated (#3114 area). oxlint and oxfmt clean. Note: telemetry for this rollout stops with the entry — `$feature/canary-de-parallel-router` and `canary_reason_de_parallel_router` are emitted from the registry, so the `Ramp —` tiles and the exposure-floor alert on PostHog dashboard 1918875 go blank once this ships. Watch drawElement engagement on 1807532 instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-08 14:10:25 -07:00
Miguel Ángel	b1f7d8881b	chore: release v0.7.102 (#3119)	2026-08-08 13:13:50 -07:00
Miguel Ángel	b6ff3ab745	fix: preserve the composition query and serve the runtime before author scripts (#3114) ... * fix(player): stop re-encoding the composition query Every src the player sets goes through withShaderQueryParams, which parsed the author's whole query with URLSearchParams and re-serialised it with toString(). That is a form encoder: it writes a space as +, while callers percent-encode and read back with decodeURIComponent. Those two codecs are not inverses, so any space in any query value arrived corrupted. It ran even when there was nothing to inject. With no shader attributes both params are deleted, so the round-trip was pure loss, on every src, for every consumer. Append the two params to the raw query instead of re-serialising it. The player now hands a composition its query back byte-identical. Empirically space was the only casualty: plus, ampersand, equals, hash, percent, question mark, quotes and non-ASCII all survived a URLSearchParams round-trip. That is narrow, but a space in a headline or in SVG path data is the common case, and invalid path data renders nothing at all. Latent until now: no shipped consumer depended on query preservation, so this surfaced only once compositions began carrying variable payloads. * fix(cli): serve the runtime ahead of every author script injectRuntime appended its script before </body>, so it landed after any inline script the composition carried. At the moment a composition's own script ran, window.__hyperframes was undefined and getVariables() was unreachable: our documented API did not exist at the point authors are told to call it. Served order was gsap at line 6, the composition's init script at 20, the runtime at 37. A probe inside the composition's IIFE recorded hfTypeAtInit undefined with no variable keys, and the element rendered its hardcoded fallback rather than the declared value. The runtime is designed to load early. Its entry assigns __timelines, installs the authored-opacity capture (whose own comment says it must run while the document is still parsing), and exposes __hyperframes synchronously, deferring real work to DOMContentLoaded. End-of-body injection defeated all three, and nothing in it needs a parsed DOM, so no defer is wanted. Injects at head start instead, reusing the placement cascade injectScriptsAtHeadStart already implemented rather than adding a fourth copy of it. Head start rather than the closing tag so the runtime also precedes author scripts inside head. injectRuntime has exactly one consumer, the play server's composition route. Every other surface reaches the runtime through the bundler, which already injects into head, or deliberately serves raw. Two registry blocks had independently worked around this by parsing the authored attribute themselves. Those stay, but the workaround is no longer the only way to read a variable at init.	2026-08-08 13:07:10 -07:00
Vance Ingalls	b08cefea63	Merge pull request #3105 from heygen-com/fix/caption-declared-color-states ... fix(core): let a composition declare its caption colour states	2026-08-07 20:25:35 -07:00
Vance IngallsandClaude Opus 5	cef0dde5f2	fix(core): draw the dim baseline only from tweens the guess still applies to ... Review catch. The baseline was taken from the first colour tween unconditionally, so a tween declared "active" at index 0 set the reference its undeclared siblings were compared against -- and the genuinely dim tween beside it was classified active and given the wrong override. A partial migration could therefore end up worse off than a composition that declared nothing. The reference is now a declared "dim" tween if one exists, else the first undeclared one: the heuristic stops drawing its inputs from records the declaration has already spoken to. Also pins the fallback for a malformed declaration -- a typo, a number, a null, or a non-object `data` -- so a future tightening of the accepted union cannot quietly turn an unrecognised value into a broken composition. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 20:14:51 -07:00
Vance Ingalls	eba96feda7	chore: release v0.7.101	2026-08-07 19:50:48 -07:00
Vance Ingalls	867eeabc0f	Merge pull request #2840 from heygen-com/07-27-feat_producer_enable_parallel-de_router_by_default ... feat(cli,core,producer): ramp the parallel-DE router through the canary at 5%	2026-08-07 19:49:32 -07:00
Vance IngallsandClaude Opus 5	1e7799bfbb	fix(core): let a composition declare its caption colour states ... Classification by colour equality has to guess: it takes the first colour tween's value as the dim baseline and calls everything else active. A composition whose two states share a colour therefore has every tween classified dim, and the caller's activeColor is silently dropped -- a real failure, now covered by a test that fails without this change. A tween may declare its state as data: { captionState: "dim" | "active" }. GSAP passes unknown vars through untouched, so declaring costs nothing at runtime, and resolution is per tween -- a composition can declare some and leave the rest to the fallback, which is unchanged for anything undeclared. This is the composition telling us what it built rather than us inferring it from what it happens to look like. The data-driven caption templates already author their state tweens from resolved values and never guess; this closes part of that capability gap. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 19:48:12 -07:00
Vance IngallsandMiguel Ángel	d9b00e57eb	chore: release v0.7.100 (#3093) ... Co-authored-by: Miguel Ángel <miguel.sierra@heygen.com>	2026-08-07 16:12:25 -07:00
Miguel Ángel	57ec008cb2	refactor(core): settle the four remaining preview-vs-render divergences (#3097) ... ## Why #3094 fixed one way the mount and render paths disagreed, and added the gate that catches disagreement. It deliberately left the rest. Four divergences are still live. Each one means a composition assembles differently depending on whether it is being previewed or rendered — the same class of defect that shipped three catalog components unstyled, just with smaller blast radii. ## How Both paths now derive root discovery, scope identity, asset sources and order, hoisted links, variable carriers and nested-host enumeration from the shared module #3094 introduced. Each keeps its own I/O, which is where they genuinely differ. The compiler's local depth cap and root lookup and the runtime's three pre-filtered head parameters are gone; the runtime hands over the head node and lets the module decide what comes out of it. Four behaviour changes, each stated by what actually differs rather than by the edit: **Inline `<head>` scripts.** The compiler looped head scripts with a `src` branch and no `else`, so an inline one was silently discarded on render while the runtime ran it. That is losing code, not holding a convention — the runtime's answer wins. Head and content scripts now share one loop, head first, order preserved. A non-templated sub-composition with an inline head script went from **0 collected scripts to 1**, wrapped, body intact. **`<link>` hoisting.** Conditional on render, unconditional on mount, so a templated sub-composition's webfont link was dropped in video and kept in preview. Hoisting is the superset and matches what the author declared. A templated composition with a stylesheet link went from **no external links to that link**. The parity fixture that previously recorded this shape as a known exclusion now gates it. **Anonymous hosts.** With a host naming no id, the compiler fell back to the first declared composition and scoped to it; the mount left the content unflattened and injected its stylesheet into the host `<head>` **unscoped**, so a composition's CSS leaked into whatever mounted it. The compiler's answer wins. The injected rule went from a bare `.label { … }` to `[data-composition-id="scoped-text"] .label { … }`. **Scope ids.** The compiler splits the CSS scope id from the script composition id; they differ only when a host names an id the content does not declare, and there the scripts follow the declared id so their self-referencing queries resolve. The runtime used one for both. The split wins: a host naming `captions-comp` over content declaring `captions` now emits scripts bound to `captions` while its CSS still scopes to `captions-comp`. ## Test plan - [x] Unit tests added/updated - [x] Manual testing performed - [ ] Documentation updated (if applicable) Core 1694 passing, producer 574 passing, the parity contract now gates the two divergences it can observe (the other two carry no contract field, so they are gated by unit tests naming the exact before/after). Lint 0, `typecheck:runtime` and the runtime preview guards clean, package cycles unchanged. Characterization-first: both suites were run and recorded green before any decision moved, so a behavioural drift would surface as a red test rather than a silent difference. **One assertion changed, deliberately.** A runtime test asserted that an anonymous host's composition is *not* flattened, and documented that as intentional. That premise is now false. What the test actually cared about — the root and its content present under the host — still holds and is still asserted; the "not flattened" claim flipped, and the test now also asserts the scoping that was missing. ## Not covered The variable-carrier divergence and its `TODO(template-var-carriers)` are untouched by design, as is recursion on the mount path — a sub-composition containing its own `data-composition-src` is still silently dropped in live preview. Both are behaviour changes with their own units, and both are now one-line-ish changes because the shared module already reports what they need. `runtimeScopeCompositionId` no longer falls back to the authored scope id. This is a functional change beyond the four above, surfaced in review: for an anonymous host with authored variable defaults, the runtime previously stashed them under the declared id, and now does not. It removes a runtime-vs-compiler divergence in the correct direction — the runtime was doing work the compiler never did, and the compiler is authoritative for a shipped composition — but a caller relying on runtime-only variable exposure loses it. The three copies each of the flattened-root helper and the id assignment are left alone: they look mergeable and are not cheaply, and they touch the instancing contract the pixel harness guards. ## Worth knowing The parity test's compiler arms import core's **built dist** while the mount arm imports source, so core must be rebuilt before that lane means anything after a compiler change. Skipping it produces a phantom divergence that looks exactly like a real one.	2026-08-07 15:32:20 -07:00
Vance IngallsandClaude Opus 5	4a2514232b	feat(cli,core): ramp the default-on router through the canary ... Rebased onto main (was 308 behind) and gated the new default-on behaviour on the de-parallel-router canary, at 5%. Default-ON without a ramp is a ~17x exposure jump: from ~6% of eligible renders today to all of them, landing on profiles the opt-in trial never covered (<=4 CPUs and Docker, ~12% of eligible renders between them). 0.7.60-0.7.64 is why that matters — every unclamped render reverted for five consecutive releases and nobody noticed. The gate reuses the breaker's own disarm: non-enrolled installs get an explicit HF_DE_PARALLEL_ROUTER=false, because with default-ON polarity deleting the var means ON. Setting the registry percentage to 0 is therefore a full fleet-wide revert with no release. Today's ~11% of installs routing is emergent — the product of eligibility rules and a capped trial — so it drifts with fleet composition and cannot be turned off without shipping. The point of the canary is that the number becomes chosen and revertible, not that it is smaller. Also replaces the registry test that pinned the percentage to 0. Its intent was 'ramp only alongside the circuit breaker', but pinning 0 blocks the ramp forever and never checks the wiring it names. It now asserts the wiring directly, and fails if either the canary gate or the breaker consult is removed. Hold at 5% until PRINFRA-372 resolves: --workers auto crashes every worker on macOS arm64 while --workers 1 is clean, and the router forces 3 workers. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-07 15:10:47 -07:00
Miguel Ángel	8d9db3df73	fix(core): stop dropping a mounted composition styles, and gate the divergence (#3094) ... ## Why A composition mounted as a sub-composition lost its entire stylesheet and scripts whenever they were authored as siblings of the composition root inside its `<template>`. That shape is legal and common, so three catalog components — `oversized-cursor`, `device-frame-stage`, `touch-indicator` — rendered **completely unstyled** in the live preview. `oversized-cursor` drew its pointer at 1280px against an authored `7cqw` (~134px at 1920), because `width: 7cqw` was never declared at all. Confirmed in the mounted document, where only the host's own `<style>` was present. The rendered video was correct the entire time. This was a preview-versus-render divergence, and it survived a fully green test suite. ## How **The fix.** `mountCompositionContent` collected assets from the composition root element, so sibling nodes were invisible to it. It now collects from the source node — a superset of the root, and the single point every mount path routes through (external fetch, inline template, nested). It also strips the mounted *clone* rather than the source: the previous code removed extracted nodes from the node it was handed, which on the inline-template path is a live `<template>` still in the document, so a remount would have found it emptied. **Why nothing caught it.** Every CLI gate — `check`, `lint`, `validate` — reaches the compiler path through `bundleToSingleHtml`, and the compiler always collected from the whole template. Nothing in the CLI exercises the mount path, which is reachable only through the player and Studio. The repo's own parity test assembled a fixture two ways and deep-equalled a contract across them, but **both arms were static-compiler paths** — which is exactly why the runtime could drift unnoticed. **The gate.** A third arm mounts the same fixture through `loadExternalCompositions` and extracts the same contract. Three fixtures run through all three arms, one authoring its assets as root siblings — the shape that broke. `authoredStyleSignatures` was already in the contract and is exactly the signal that was missing, so no contract field was added. **The owner.** Both paths answer the same questions — which nodes are a composition's assets, in what order its scripts run, how its CSS is scoped, which head elements hoist, how nested hosts are discovered, which element carries variable defaults. They now have one module to answer them from. It holds decisions only, never I/O: the two paths differ at their boundary in ways that are essential (Node + linkedom + synchronous + strings; browser + fetch + live DOM + script *execution*), and the runtime ships as a bundle to a CDN, so anything it can reach is weight and risk. Hence zero imports, a structural input type rather than `Document`, and a test asserting the import surface stays empty. Routing both paths through that module is deliberately **not** in this PR — it changes behaviour in four places (below) and belongs where each can be judged and reverted on its own. ## Test plan - [x] Unit tests added/updated - [x] Manual testing performed - [ ] Documentation updated (if applicable) Every claim here was verified in both directions rather than assumed. The fix's regression test fails on pre-fix code and passes after — run both ways. The parity arm was proven able to fail: with the fix reverted, the sibling fixture fails and names the composition's own scoped selector against an empty list, while the other two fixtures stay green, so the arm is targeted rather than blanket-red. Restored, 7/7 pass. `bun run lint` exits 0. Core: 1690 tests passing, plus `typecheck:runtime` and `lint:runtime-preview-guards` clean. Producer: 571 tests passing. The shared module's own defect was reproduced by mutation — collecting from the composition root instead of the whole template fails three of its 17 tests, including the sibling case. ## Found while doing this, not fixed here Deriving the shared decisions surfaced **four more live divergences**, none of them the reported bug, each a behaviour change to decide deliberately: - The compiler silently drops inline `<head>` scripts — it handles the `src` case and has no `else` — while the runtime executes them. - `<link>` hoisting is conditional on render and unconditional on mount, so a templated sub-composition's webfont link is dropped in video and kept in preview. This one reproduces under the new parity arm and is explicitly excluded from its contract, with the reason recorded in the file. - For a host naming no id, the compiler falls back to the first declared composition and scopes to it; the runtime mounts the content whole, unflattened and unscoped. - The compiler keeps two scope ids, CSS and scripts, so a script's self-referencing query resolves when a host names an id the content does not declare; the runtime keeps one. Separately: the mount path **does not recurse at all**, so a sub-composition containing its own `data-composition-src` is silently dropped in live preview. The compiler has a dedicated recursive-discovery suite; the runtime has no nesting, circularity or depth coverage. Each is recorded with its evidence in the commit messages here, and sequenced so the behaviour-changing ones land separately, after this gate exists to catch a mistake in them. ## Not covered This does not heal the published docs by itself. Previews load `@hyperframes/player` unpinned, but the player bakes a version-pinned core runtime URL at build time, and core and player publish in lockstep — so the live catalog only recovers after both ship. There is no hotfix path short of a release.	2026-08-07 14:28:03 -07:00
Miguel Ángel	9aa90f6e3e	chore: release v0.7.99	2026-08-07 15:31:57 +00:00
Vance Ingalls	6114749d8e	chore: release v0.7.98	2026-08-06 23:37:23 -07:00
Miguel Ángel	c4b41072c7	chore: release v0.7.97	2026-08-07 05:16:27 +00:00
Vance Ingalls	026e6941ac	chore: release v0.7.96	2026-08-06 14:53:26 -07:00
Vance IngallsandClaude Opus 5	076657a639	feat(core,cli): emit the canary decision reason alongside the assignment ... The calibration contract deferred this until the stability check came back dirty. It did: the first fleet read found 304 installs (1.08%) reporting both values for a canary whose percentage never moved, and the genuinely anomalous ones could not be separated from a developer toggling HF_CANARY_*, because the assignment alone is identical in both cases. resolveCanary has always computed the reason and canaryEventProperties dropped it. Now every canary emits canary_reason_<name> beside its assignment. Deliberately outside the $feature/ namespace: PostHog treats those as flag values, and a non-boolean there would corrupt the flag's own breakdowns. Two of the six wire values are immediately useful beyond override attribution. 'excluded' identifies CI installs, which today have to be dropped by joining on is_ci — conflating them with out_of_cohort is what made the first accuracy read look like a significant failure (9.22% against a 10% target) when it was not. 'no_unit_id' surfaces the fails-closed corner. The reason is optional on the core helper so existing callers are unaffected. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-06 13:57:08 -07:00
Miguel Ángel	fc0298de4a	chore: release v0.7.95 (#3068)	2026-08-06 10:12:20 -07:00
ukimsanov	d373c3f4a0	fix(catalog): explicit section ownership, no body-sniffing heuristic ... carriedSectionsFrom() decided whether a ## Usage section was generated by matching its first line against a list of historical opener phrases — so a hand-written Usage section that happened to open that way was classified as generated and silently deleted on regeneration. Ownership is now purely set membership: a section is generated iff its heading is one the template emits, and ambiguous 'usage' is no longer in that set (the template never emits it), so any ## Usage is carried. Exported carriedSectionsFrom behind an entrypoint guard and added two executable preservation fixtures. Flagged by Magi (#5).	2026-08-05 10:23:37 -07:00
ukimsanov	aa49f7d924	Merge remote-tracking branch 'origin/main' into docs/pages-show-not-tell	2026-08-05 05:56:59 -07:00
ukimsanov	6ff6601dd0	fix(catalog): restore the required Related topics section on generated pages ... My generator rebuild replaced the '## Related topics' section (still required by docs/AGENTS.md) with the provenance footer, dropping it from all 168 generated Catalog pages. Emit it again as the final section so pages end with it, and stop carriedSectionsFrom() breaking at the footer marker so a human section appended below the generated tail survives a regeneration. Adds a per-page regeneration assertion so a future drop fails CI. Flagged by Magi (P1) and Rames.	2026-08-05 05:38:58 -07:00
Miguel Ángel	29f004cfc0	chore: release v0.7.94 (#3045)	2026-08-04 20:42:17 -07:00
Miguel Ángel	a4eb602ee2	chore: release v0.7.93 (#3044)	2026-08-04 20:27:07 -07:00
Vance Ingalls	f9ec93459f	Merge pull request #2945 from heygen-com/ffprobe-6-argv-sweep ... fix(cli,core,lint,producer,studio-server): terminate ffprobe options everywhere, pin the contract	2026-08-04 10:43:14 -07:00
Vance IngallsandClaude Opus 5	1664fe6ad7	fix(core,producer,skills): unicode paths, non-Error rejections, shell callers ... Three R3 findings. The redactor's segment classes were ASCII `\w`, so `/数据/客户/秘密视频.mp4` and `/data/客户/secret.mp4` went out verbatim — and the generic redactor also feeds CLI telemetry and producer observation messages, where no known-path list compensates. Segments are now defined by their delimiters instead of an alphabet, which is correct for every script by construction rather than requiring Unicode classes to be kept correct. The bare-relative lookbehind had the same ASCII assumption and let a match start mid-token, redacting `客户/秘密/视频.mp4` to `客户[path]`; it is now a token boundary, and bare-relative runs before absolute so it claims the whole token. sanitizeProbeFailure cast the rejection reason to Error and read `.message`. An injected probe can reject with anything, so `Promise.reject("failed")` gave `undefined` and threw inside the redactor — converting a returned failure result into a rejected promise. Normalized at the boundary, and redactKnownPaths no longer throws on a non-string. The contract only admitted .ts/.js/.mjs/.cjs, so it missed shipped shell and Python callers. frame_strip.sh passed a user-controlled path as ffprobe's last positional with no terminator; render-and-composite.sh had four more. Both fixed, and the sweep now covers .py/.sh. Python list argvs are bracket literals so they get the same position check; shell command lines get a separate presence check, because checking position there needs a shell parser — stated as the weaker guarantee it is rather than implied to be equal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 03:18:21 -07:00
Vance IngallsandClaude Opus 5	e79ab3ab31	fix(core,producer): redact bare relative paths and the known input path ... The generic scrub still missed a relative path with no `./` prefix: `customer/acme-secret/video.mp4` and `assets/bgm.mp3` reached telemetry completely unredacted, because the absolute rule needs a leading slash and the `./` rule needs the dot. Adds a rule for them that still leaves `N/A`, `24/1` and `48000/1001` alone. Shape matching is a net with holes by construction, so audioPadTrim now also redacts the exact path it put in the argv, plus its basename, before the generic scrub runs. It built the argv, so it does not have to guess. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 02:23:35 -07:00
Vance IngallsandClaude Opus 5	d04569e37f	fix(core): redact any path in telemetry, not an allowlist of roots ... redactTelemetryString enumerated roots — /Users, /home, /opt, /tmp and a handful more — so a project on /data, /Volumes, an NFS mount or any root a user invented reached telemetry verbatim. Relative paths and bare basenames were never redacted at all, and audioPadTrim routes raw ffprobe stderr through this on every probe failure. Now redacts by shape: absolute paths under any root (two or more segments, so N/A and a 24/1 frame rate are not mistaken for one), relative paths including dash-prefixed ones, and bare basenames with an asset extension. URLs still keep their host and drop only the query. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 02:23:35 -07:00
Vance IngallsandClaude Opus 5	47564ab94c	fix(cli,core,lint,producer): terminate ffprobe options at every call site ... #2740 added `--` to one of nine independent ffprobe invocations, so the bug class it closed stayed open everywhere else while CI reported it fixed — the regression test asserts the argv of that single site. Reproduced on ffprobe 8.1.1: an asset named `-intro.mp4` probes fine through extractMediaMetadata but fails with "Missing argument for option 'intro.mp4'" in audio pad/trim (mid-render), `hyperframes init`, whisper duration probing and webmAlphaCheck. hevcPreviewLint catches and returns false, so a dash-prefixed HEVC preview silently passes the lint rule. Terminated at all of them: producer/services/render/audioPadTrim.ts (x2) producer/plan-parity-analysis.ts cli/commands/init.ts cli/utils/webmAlphaCheck.ts cli/whisper/transcribe.ts (x2) core/mediaGradeAnalyzer.ts lint/hevcPreviewLint.ts audioPadTrim's runFfprobeJson is a near-verbatim clone of the engine's runFfprobe and structurally cannot add the terminator itself, because callers bake the input path into `args`. It now asserts the terminator is present rather than letting a dash-prefixed path through, takes the same stdio ["ignore", ...] as the engine helper, and redacts its stderr — it was throwing raw ffprobe output, which echoes the input path, into logs and telemetry. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 02:23:34 -07:00
Vance Ingalls	df8b9604fe	chore: release v0.7.92	2026-08-04 01:49:05 -07:00
Vance Ingalls	8c6cf90ff9	chore: release v0.7.91	2026-08-03 22:48:00 -07:00
Vance Ingalls	71fd96bbf1	Merge pull request #2854 from heygen-com/feat/canary-rollouts ... feat(core): percentage-based canary rollouts + calibration experiment	2026-08-03 22:35:37 -07:00
Miguel Ángel	4e7fcf7f2a	fix(core): resolve sub-composition sibling asset paths everywhere (#2994) ... Extends the studio-preview fix to the render path and the asset-discovery utilities, which share the same resolver and had the same defect. `rewriteAssetPath` takes an optional `assetExists` probe. A plain relative ref authored in a sub-composition (`_shared.css`, `clip.mp4`) is re-pointed at the composition's own directory when that sibling exists on disk; project-root refs with no sibling (the registry's `assets/logo.png` convention) stay as authored. Callers that can see the filesystem supply the probe, so the module stays free of node:fs. Also fixes a second defect in the inliner: `<head>` <link> hrefs and external script srcs are hoisted into the root document but never went through the rewrite at all, so even the documented `../` form escaped the project and 404'd at render time. Wired into the preview bundler, the producer compiler, the studio preview builder, the HEVC preview lint, the project lint's asset scans, publish proxy baking, and media-treatment source resolution.	2026-08-03 21:13:35 -07:00
James Russo	1e51eaec2c	chore: release v0.7.90 (#2958)	2026-08-02 21:57:19 -07:00
Miguel Ángel	411ada0d90	chore: release v0.7.89 (#2953)	2026-08-02 20:25:14 +02:00
Vance IngallsandClaude Opus 5	3f8dca165d	fix(cli,core): refresh telemetry posture at the render boundary ... R6/R7 blockers. An already-open Studio kept emitting server-side render telemetry after another process disabled CLI telemetry. refreshTelemetryPosture() only ran while serving a fresh SPA document and on /api/telemetry-identity, which Studio has no consumer for, so the render POST and its async outcome used the posture cached when the preview server booted. It now refreshes at the render boundary and again immediately before the completion/error event, so an opt-out during a long render is honoured. The identity tests were passing vacuously: their mocks omitted readConfigFresh and resetTelemetryPostureCache, and the resulting missing-export error was swallowed by the refresh's own catch. Mocked properly, plus the enabled -> external disable -> next response transition and the suppression path at the layer that drops the event. A full reset also did not persist its new lineage in a long-lived process: syncInstallState returned early on a process-lifetime memo even after ~/.hyperframes was deleted, so install-state was never recreated and the next config-only re-mint rolled a third seed instead of inheriting the second. The memo is now revalidated against the file. Also drops a stale reference to assertNoOverdueCanaries and stops the workflow and docs claiming the sunset job routes anything to the owner — it names them in the run log and notifies nobody. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 18:11:45 -07:00
Vance IngallsandClaude Opus 5	6f0df2640b	fix(cli,studio,core): close five R5 telemetry and canary findings ... - A long-lived preview cached its telemetry posture in two places (readConfig and shouldTrack). Running `telemetry disable` in another terminal left it resolving canaries and injecting the CLI id for hours. Both caches are now dropped together at a request boundary. - Studio minted and shipped a telemetry id for every render regardless of the browser profile's opt-out, and the server emitted the outcome under CLI policy, which cannot see localStorage or DNT. The browser now sends an explicit telemetryOptOut, distinct from an old client's omission. - Any non-empty HYPERFRAMES_PREVIEW_HOST disabled the DNS-rebinding guard, so even a loopback bind accepted a hostile Host. The guard now holds for loopback binds and, on a LAN bind, admits only names this machine answers on. - sunsetAfter had no reader of the current date. A scheduled workflow runs scripts/check-canary-sunset.ts weekly, so a failure lands on the rollout's owner rather than on an unrelated PR author. - The install-state seed memo outlived `rm -rf ~/.hyperframes`, resurrecting a cleared cohort. Removed; it only saved a read on a readConfig cache miss. Docs updated for the Host rule and the 100% exclusion carve-out. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-01 17:21:41 -07:00
Vance Ingalls	74fadf69c4	chore: release v0.7.88	2026-08-01 16:53:08 -07:00
Miguel Ángel	89e970fbd7	chore: release v0.7.87 (#2935)	2026-07-31 22:36:46 +02:00
Vance IngallsandClaude Opus 5	3f69a2c635	fix(cli,core,studio): close 15 review findings + 2 R5 blockers ... R5 blockers - Negative install-state latch was cached for the process lifetime, but only `true` is monotonic across processes. A long-lived preview server held a stale `false` and could re-enrol after another process tripped the breaker. Only the positive is cached now; `false` re-reads. - The real breaker writer used writeConfig(), which collapses {ok:true, mirrored:false} to success, so a run that mirrored nothing reported done with the latch only on the erasable store. It consumes writeConfigWithResult and retries until both stores carry it. Bucketing integrity - Storage-restricted Studio profiles all bucketed on the literal "anonymous": computed against the shipped hash, 100% of them were enrolled in calibration-50 rather than 50%, and they merged into one PostHog person. Per-session random id instead — persists nothing. - bucketSeed had read/write authority backwards: install-state is write-once authoritative, but readConfig took config.json's blindly, so the stores could hold different seeds until a re-mint flipped every cohort. Merged on read, like the latch. - An unwritable ~/.hyperframes with no config.json re-minted per call, re-rolling the seed on every command, and the "cohorts will not be stable" warning was unreachable on that path. - A corrupt PRE-MOVE state file was never deleted, so a machine reset with `rm -rf ~/.hyperframes` reported predecessorFound/stateFileCorrupt forever — poisoning the exact metric this work exists to produce. Opt-out honoring - CLI canary decisions memoized per process, so `hyperframes telemetry disable` during a running preview server was ignored for hours while the server kept serving pre-opt-out decisions. The memo is keyed on the telemetry posture. - shouldTrack() memoized, contradicting policy.ts's documented "not memoized" contract that policy.test.ts asserts. - The Studio override path resolved the bucket unit eagerly as an argument, minting and PERSISTING a tracking id for an opted-out profile — a value evaluateCanary discards unread. - Storage reads could throw out of telemetry into a post-commit catch block, reporting an already-committed edit as failed. - readConfig printed an unsilenceable stderr warning on every invocation for installs that opted out of telemetry entirely. Host split - isLoopbackHost rejected 0.0.0.0, so the documented HYPERFRAMES_PREVIEW_HOST LAN mode silently lost CLI→Studio identity stitching and split one user across two PostHog persons. Identity is now allowed when the operator explicitly opted into LAN binding. - Corrected the comment claiming the guard refuses spoofed Hosts: a non-browser client sets Host freely. It is a browser DNS-rebinding mitigation, not access control, and now says so. Semantics and test hygiene - percentage:100 did not mean everyone — exclude and no_unit_id sat above the fast path, so the registry's "delete the entry at 100" step was an unstaged flip for CI and seedless installs. - CLI cohort adoption returned before evaluateCanary, dropping Studio's own webdriver exclusion. - overdueCanaries() was asserted against wall-clock time, so the whole core suite would go red on 2026-09-15 for every unrelated PR; and `>` against midnight made a canary overdue ON its sunset date. - Statistical assertions ran on unseeded randomUUID() populations tight enough to fail ~1 run in 200. Seeded. Also: broke a config -> policy -> transport -> config import cycle by moving POSTHOG_API_KEY to a leaf module. Tests: 2347 CLI (bundle absent), 3153 Studio, 1450 core. Fault injection covers the latch, seed authority, LAN identity, webdriver exclusion and the anonymous-bucket fix. Two pre-existing tests asserted behaviour these findings identify as wrong (shouldTrack memoization, 100%-excludes-CI) and were rewritten with the reasoning stated. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-31 01:27:37 -07:00
James Russo	3a6b7f0612	fix: align local WebGPU capture behavior (#2907) ... * fix: align local WebGPU capture behavior * fix: address WebGPU capture review feedback * fix: retain overlapping GPU seek work * fix: satisfy runtime seek completion types * fix: drain concurrent GPU seek work * fix: prevent WebGPU capture barrier starvation * fix: keep WebGPU presentation active during render seeks	2026-07-30 21:52:30 -07:00
Vance IngallsandClaude Opus 5	31361b8e5b	fix(cli,core): close the remaining canary review findings ... Six findings from review, none behaviour-critical on their own but three of them quietly corrupt the data the rollout is judged by. Endpoint no longer serves bucketSeed (studioServer.ts). Studio gets its canary answers from the injected decisions map now, so nothing needed the seed over HTTP — and an unauthenticated local endpoint is a strictly worse place for it than a script scoped to Studio's own document. The endpoint itself predates this PR and still serves distinctId, so it also gains a Host guard: a remote page can rebind its hostname to 127.0.0.1 and read the response as same-origin, but the request still carries THAT hostname, which is what makes it refusable. predecessorFound no longer reports corruption as a fresh install. It returned null for both "file absent" and "file unreadable", so a partial disk write looked like a new machine — understating recoverable churn, the one thing the field measures. Now distinguishes absent from corrupt and emits install_state_file_corrupt alongside. A mangled markerAt no longer discards a salvageable bucketSeed. markerAt is only a timestamp and can be restamped; the seed cannot be recovered, and losing it silently re-rolls the install's cohort. The seed backfill no longer ignores its write result. An unwritable ~/.hyperframes meant a different seed every invocation with no diagnostic, and made the field's own "backfilled once" docstring false. Warns once per process with the underlying error. FNV-1a's ASCII constraint is now explicit rather than incidental. It hashes UTF-16 code units while reference FNV-1a is byte-oriented, so the two agree only on ASCII; the registry's kebab-case assertion is what makes non-ASCII unreachable, and both ends now say so. Not a live bug — names are kebab-case and units are UUIDs. de-parallel-router is pinned at 0%. The registry is data, so a ramp is a one-line edit with no review surface, and its own description says to ramp only alongside the circuit breaker. Tests: 8 new (corruption vs absence, seed salvage, backfill write failure, 17 host-guard cases, registry pin). One existing test asserted predecessorFound: false on corruption — that was the bug, updated with a note. Fault injection: restoring the old corrupt handling fails 4. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 16:38:11 -07:00
Vance IngallsandClaude Opus 5	4f464dc424	feat(cli,studio): telemetry opt-out is canary opt-out ... Both reviewers flagged the same gap: seed injection was gated on telemetryShouldTrack(), but canary EVALUATION was not. An install with DO_NOT_TRACK=1 was still bucketed and still had real code paths flipped (e.g. HF_DE_PARALLEL_ROUTER), silently and unmeasurably. A canary is a measured rollout — we enrol a slice precisely so it can be compared against everyone else. An install that sends nothing can't be compared, so enrolling it buys no signal and only changes that user's code path, on an experimental feature, without their knowledge. That is the wrong side of an opt-out. Resolves to a new `telemetry_opt_out` reason BEFORE bucketing, so no cohort is assigned at all. Distinct from `excluded` because "why is my canary off" has a very different answer for CI than for opted-out, and the reason never reaches telemetry by construction. Covers every opt-out route: persisted preference, the runtime env vars and dev/telemetry-disabled builds via policy.ts, and Studio's hyperframes-studio:telemetryDisabled. An explicit HF_CANARY_* / ?hf_canary_*= override still wins — a deliberate local choice, not silent enrolment, and the documented way to exercise a canary with telemetry off. The CLI check mirrors shouldTrack() rather than importing it: client.ts already imports canary.ts for canaryEventProperties, so depending on it would be a cycle. Both read the same two inputs, so they cannot disagree. Tests: 9 new across CLI and Studio (preference off, each runtime override, no bucket assigned, override still honoured, flag properties all-false). Fault injection: removing the CLI gate fails 6, removing the Studio gate fails 3. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 16:11:34 -07:00
Vance IngallsandClaude Opus 5	6f6f01c8ea	docs(canary): correct the loose-toggle count in the registry header ... Verified against packages/*/src env reads: 57 distinct HF_*/PRODUCER_* toggles pre-existing this branch (the raw grep said 59, but two of those are HF_CANARY_TEST_* fixtures introduced by this branch's own tests). The number is cited externally now, so it should match what the repo actually has. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 15:14:59 -07:00