* fix(player): iPhone Safari keeps every take's sound after the first seconds of an edit
* fix(player): shorten the priming comment
* fix(player): prime iPhone takes only, and only unmuted ones
* fix(player): shorten a comment
* fix(player): skip only clips authored muted, and drop a doc comment
* ci: one regression shard writes the test image cache, so it stops evicting the rest
* test(ci): each image cache has one writer, shard 0 of a main push
* fix(cli): a snapshot still shows what playback shows, whatever other times are asked for
* test(cli): pin that still-capture pages ask for the skipped-frame replay
* perf(cli): give render the heap its auto workers need in small containers
Auto worker sizing caps capture workers at (V8 heap - 1024 MB) / 640 MB.
Node sizes its default heap from visible memory, so in a 10 GB container
the heap is 2,096 MB and every render captures with one worker, whatever
the core count.
When no --workers is given, no --docker, no heap was set by hand, and the
heap is the only bound holding workers back, render relaunches itself once
with --max-old-space-size set to what CPU and memory allow (capped at half
of memory). The engine exposes heapMbForAutoWorkers() for this.
* fix(cli): count a heap-relaunched render once, keep detached renders alive
The relaunched child skips the CLI's command telemetry, update and skills
notices, and app-history notice; the parent already records and prints
them. A detached render no longer gets SIGHUP forwarded, which its
default handler would treat as a kill. A heap set as --max_old_space_size
counts as set by hand.
* fix(engine): keep the desktop app's per-worker heap figure at 640 MB
Inside Electron the heap is a hard 4,192 MB cage, and that is where the
field OOM behind the old figure happened (#5149: 5 auto workers on a heavy
export). The new 320 MB figure is measured only in a system Node, so the
desktop app keeps 640 MB (4 workers there) until a heavy desktop export is
measured. Containers and plain Node keep 320.
* fix(engine): know the packaged desktop app by its client tag, which runs the CLI on plain Node
* fix(ci): skills sync steps past any taken ClawHub version, not one hard-coded skill
* fix(ci): skills sync steps past the five hidden ClawHub versions blocking it
* fix(cli): an unknown command like search says which command does that
* fix(cli): the synonym hint is checked before the spelling match, so list, find and browse reach it
* fix(core): a multi-worker or chunked render lands every frame where an in-order render does
* fix(core): replay only where tweens overlap, and from any off-grid scene time
* fix(core): a film with paused scenes replays only where its tweens overlap
* fix(cli): capture names the network's proxy when it refuses the connection to the site
* fix(cli): capture words a refused tunnel and an unreachable proxy apart, and echoes no raw address
* fix(cli): shorten the proxy failure comment
* fix(cli): check waits as long as the --timeout it was given before it counts as idle
* style(cli): shorten a comment line
* style(cli): drop the idleWindow doc comment the comment ratchet counts
* docs(telemetry): say signed-in usage is linked to your account, not anonymous
After hyperframes auth login the CLI sends a PostHog $identify with the
account email (username as fallback) and merges the install's earlier
anonymous usage; media-use does the same when it finds a signed-in
account. Several places still called all telemetry anonymous. Say it is
anonymous until you sign in, in the CLI reference (media-use, --skill,
feedback, events, telemetry), the hyperframes-cli skill references, and
the CLI help and notice strings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(telemetry): identify signed-in CLI users by their HyperFrames user id
The CLI and media-use identified a signed-in install by account email, so
CLI usage landed on a different PostHog person than the same account in
the HyperFrames web app, which keys on toUUID(username). Identify by that
same sha256-derived id instead, and $set email plus heygen_username on the
person. heygen_username is the cross-project join column for the Snowflake
event table (HeyGen's own project stores it as `name`). An account with no
username still falls back to the lowercased email.
Notices and docs now say usage is keyed on an id derived from the username
with email and username stored on it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore(telemetry): trim comments to the package's comment share
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* feat(telemetry): put heygen_username on every event while signed in
The Snowflake event sync may not carry PostHog person properties, so a
$set alone does not let an event row join across projects. The CLI now
adds the signed-in HeyGen username (raw, from ~/.heygen/credentials) to
every event and drops it once the credentials hold no user; media-use
does the same on each event it sends.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* ci: count auth/paths.ts as an edit-accuracy bench input
Telemetry now imports it to read the signed-in username.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(telemetry): stat and read the credentials through one file handle
CodeQL flagged the stat-then-read as a file system race.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(telemetry): key signed-in events on the account id; fix stale anonymity copy
Genesis review on #6703:
- telemetry --help listed 'Any personally identifiable information' as
never collected, and media-use's meta.md still said anonymous.
- Installs already identified by email under an older CLI never merge
into the new person, so send signed-in events with distinct_id = the
account id (back to the install id after logout), in the CLI and in
media-use, and stop claiming earlier usage always merges.
- A user block with no credential no longer counts as signed in.
- A UUID-shaped username passes through unhashed, as on the web.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix(cli): audio windows read beats off the whole clip; beats snap to the signal and mark silence
A film query that covers part of a clip measures beats, downbeats, bpm and sections on the
whole clip and cuts them to the window, as #6653 did for kind, so a window under 6 s still
has its beats.
One step after every provider ladder moves a provider's beats and downbeats onto the
signal's own beats within a quarter beat (the snapping api did alone) and marks each with
`silent`, true where the beat falls in silence. Beats are marked, never dropped; the JSON
change is the additive `silent` array.
— Jerrai
* fix(cli): beats with no pulse are unheard; a window with none answers no steady beat
Review fixes for #6692:
- The per-beat flag is now `unheard` (renamed from `silent`, not released): true in silence
or where no onset falls within 50 ms of the beat, so hiss, room tone or a held pad no
longer pass as beats.
- A window keeps the whole clip's beats only when at least two of its beats are heard;
otherwise it answers "no steady beat" as before, with no downbeats and no bpm.
- A window's bpm is the tempo of its heard beats, never the whole clip's.
- Comment lines trimmed so analyze.ts, run.ts and api.ts are at or under main's share.
— Jerrai
* fix(cli): a beat is unheard only where two beats in a row have no onset
Scored on the ground-truth set, flagging every onset-less beat also flagged heard beats the
onset detector misses: the drop downbeat after a snare roll, single beats under narration,
quiet beats late in a fade. A pulse gap now needs two onset-less beats in a row; hiss, room
tone and held pads span many beats and stay flagged, and silence is flagged as before.
— Jerrai
* fix(cli): a window with no pulse on the clip's grid reads its own beats, as before
Genesis found a window over a section far under the clip's loudest part answered "no steady
beat" where main, reading the window alone, found every beat: the clip's grid and onsets
skip a section that quiet (from about 40 dB under, for clicks). When a window keeps fewer than
two heard beats from the clip's grid, its beats, downbeats and bpm now come from the window
alone, as they did on main. Hiss still answers "no steady beat" on its own.
The hiss test's noise() repeats every 10,466 samples (0.22 s at 48 kHz), which the window's
own reading took for a pulse; that test now uses a xorshift generator.
— Jerrai
* fix(audio): unheard comes from level-free rhythm evidence, so quiet music stays heard
A beat was flagged by an absolute -50 dBFS silence and by onsets under 10% of the clip's
loudest hit, so music 30 dB or more under the loudest part read as unheard. Now:
- core localBeatEvidence reads the cached standardised onset curve over the 6 s around each
beat: the tracker's steady-beat confidence there (clarity at the local beat lag times the
beat's own lift) and the beat's lift over the span's mean.
- A beat is unheard in digital silence (-80 dBFS), or when its span keeps no steady beat
(confidence under 0.15) and its own onset does not stand out (lift under 1.5). Lift alone
keeps beats under narration heard, where syllables lower the span's clarity.
- A window keeps the clip's beats when at least two, and at least half, of them are heard.
— Jerrai
* fix(producer): a BeginFrame capture that draws no first frame in 20 s switches to screenshot
* test(cli): cover the Chrome launch failure messages a failed render prints
* fix(cli): snapshot reads https video in the Desktop app instead of failing at ffprobe
* fix(cli): give a remote clip download the same 30 s a stalled host had before
* fix(cli): a stopped model download resumes on the next run instead of starting over
* fix(cli): resume whisper models too and take over stale download locks safely
* style(cli): shorten a download lock doc line
A composition with no GSAP timeline was treated as zero length after an edit, which dropped preview audio, and an edit made during playback left the transport stopped. The runtime now keeps the declared length when it rebinds, and the soft reload resumes a transport that was playing.
* fix(studio): an undo or redo counts as a preview change from its key, not from its reload
* refactor(studio): count a history step from its key with the page flag on noteIdle
* fix(producer): a capture that landed every frame is not failed for the work after its last frame
* chore(producer): drop a comment the ratchet counts
* perf(producer): the audio true-peak check seeks to each segment instead of decoding up to it
Each parallel segment scan decoded the AAC from the start and trimmed after, so the last one decoded the whole file. It now seeks to a whole second one second before its segment and trims relative to it: the same peak, measured in about half the time.
* test(producer): the true-peak check's ffmpeg tests run in the integration lane
* fix(cli): check no longer treats a transparent canvas as covering the frame
* fix(cli): a canvas with an opaque CSS background still counts as covering
* fix(studio): a tab's save keeps the newer video version another tab recorded
The thumbnail index merge let this tab's ETags win for every source, including
ones it only read at startup, so another tab's move to a new version was undone
by this tab's next save: the next session validated the old ETag, missed the
disk and decoded once more. Now another tab's ETag wins except for sources this
tab recorded a new version of since its last save.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(studio): the ETag merge says whose moves it keeps in its names, not comments
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(studio): the stored-thumbnail reset forgets this tab's drops and moves too
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
An inert <hf-color-group> holds a lane's data-color-grading; <video>, <img>
and <canvas> join with data-color-group. A member's own grading overrides
its group's. The runtime discovers members, regrades them when the group's
grading or a member's data-color-group changes, and ungrades them when the
group element or its grading goes, drawing only members on screen.
Render keeps group-graded video at full size like directly graded video,
and lint accepts (and still validates) grading on hf-color-group.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
bakeHfColorGradingCube evaluates the runtime shader's colour path on the
CPU (primary, tonal wheels, RGB and hue curves, secondaries, output LUT,
intensity mix) through the same 8-bit texture quantisation, and writes a
red-fastest .cube for ffmpeg's lut3d. Grades with spatial stages (grain,
vignette, effects) throw, as does a grade whose LUT was not passed in.
A Chromium test draws a 4,096-colour lattice through the real runtime
and compares every tile with the bake.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* perf(studio): timeline thumbnails come back from disk in the next session
Reopening a project re-read every video's index and re-decoded every strip:
the frame cache and the source facts lived in memory, keyed by the session.
Now each source's facts (aspect, duration) and every decoded frame are kept
in Cache Storage under the file's ETag, the version the server says it is. A
new session checks each source once with a conditional one-byte read: a 304
means the stored frames are still that file's, and a strip they cover paints
without opening a reader. A new ETag drops what was stored for the old one.
Sources are dropped whole, least recently used first, past 256 MiB. A store
that is missing or fails (private window, quota) warns once and the strip
decodes as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(studio): a reopened project checks its videos again, and the disk index counts a frame once
The stored version a session validated was kept per video for the whole page,
so reopening a project after one of its videos was replaced at the same path
painted the old file's frames until a full reload. It is now kept per video
and project open (its contentVersion): each open re-validates once.
The index now counts a frame stored again under its name once, and merges
with what other tabs saved before writing, keeping caches this tab dropped
out, so the 256 MiB budget holds across tabs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(core): a font declared in a linked stylesheet no longer trips the bundler's font warning
* fix(core): drop the guard's explanatory comment
* fix(core): bundled fonts named only in a CSS font shorthand load
* fix(core): a font shorthand loads faces but never fails the cloud system-font check
* test(producer): regenerate static-volume-future-set for the font shorthand face
* test(producer): regenerate two more fixtures for the font shorthand face
* fix(cli): website capture stops inlining slow images and stylesheets and says what it skipped
* fix(cli): a capture ends at four minutes with its partial bundle unless told otherwise
* fix(cli): a capture's deadline starts once its browser is up, and the kept-image count is exact
* fix(cli): an image whose fetch the deadline cut off always counts as kept
* fix(core): a preview media load that fails is reported, not swallowed
* fix(core): an audio fed by source children reports its failed load; the shape lives in the protocol
* fix(core): the audio load watcher finds elements from any realm
* build(core): regenerate the inline position-edits render script
Miguel Ángel