Files
hyperframes/packages/cli
James RussoandClaude Opus 4.8 88fffb04d1 feat(cli): surface and prune skills removed upstream (#1740)
* feat(cli): surface and prune skills removed upstream

`skills add` / `init` / `hyperframes skills update` only ever add or
refresh — none of them delete a skill that was renamed or dropped
upstream (e.g. graphic-overlays → talking-head-recut). `skills check`
also ignored any installed skill not in the manifest, so a stale bundle
lingered forever with no signal and no cleanup path.

- skills check: detect "removed" skills by cross-referencing the
  vercel-labs/skills lock — a skill the lock attributes to our manifest
  `source` that the manifest no longer lists. Surface them in the human
  and --json output and count them toward the non-zero exit so the
  `check || update` contract gates on them.
- skills update: after `skills add --all`, prune those skills via
  `skills remove -g --yes` so the install fully reconciles with the
  manifest. Best-effort — a cleanup failure doesn't fail the update.

Attribution is via the lock's source field, never the bare directory
name: `.../skills` is shared across sources, so skills from other
sources (e.g. greensock/gsap-skills) are never touched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(cli): prune removed skills only in the scope they were attributed from

Make the cleanup in `skills update` impossible to misfire onto a user's
own skills. The prune already only targets names the lock attributes to
our source, but it hardcoded `skills remove -g` (global) while `skills
add` defaults to project scope — so detection could attribute from one
scope's lock while removal hit another, potentially deleting a global
skill of the same name from a different source.

- checkSkills now returns the located install's `scope`.
- skills update removes in that exact scope (`-g` only when global), so
  attribution scope and removal scope always match.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(cli): validate skill names before passing them to skills remove

Addresses review feedback: skill names fed to `skills remove` originate
as lock-file JSON keys, so a corrupt or crafted lock entry could smuggle
a flag-like (`--config=…`) or shell-special token into the spawn — which
matters most on the Windows cmd.exe path where arg escaping is fragile.

Filter the names through a strict kebab-case pattern and warn on any that
are rejected, rather than relying on a `--` separator (the upstream
`skills` arg parser silently ignores unknown `-`-prefixed tokens and has
no `--` end-of-options handling, so `--` would be a no-op there).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-26 09:23:37 -07:00
..

hyperframes

CLI for creating, previewing, and rendering HTML video compositions.

Install

npm install -g hyperframes

Or use directly with npx:

npx hyperframes <command>

Requirements: Node.js >= 22, FFmpeg

Commands

init

Scaffold a new Hyperframes project from a template:

npx hyperframes init my-video
cd my-video

preview

Start the live preview studio in your browser:

npx hyperframes preview
# Studio running at http://localhost:3002

npx hyperframes preview --port 4567

render

Render a composition to MP4:

npx hyperframes render ./my-composition.html -o output.mp4

lint

Validate your Hyperframes HTML:

npx hyperframes lint ./my-composition
npx hyperframes lint ./my-composition --json      # JSON output for CI/tooling
npx hyperframes lint ./my-composition --verbose   # Include info-level findings

By default only errors and warnings are shown. Use --verbose to also display informational findings (e.g., external script dependency notices). Use --json for machine-readable output with errorCount, warningCount, infoCount, and a findings array.

compositions

List compositions found in the current project:

npx hyperframes compositions

benchmark

Run rendering benchmarks:

npx hyperframes benchmark ./my-composition.html

doctor

Check your environment for required dependencies (Chrome, FFmpeg, Node.js):

npx hyperframes doctor

browser

Manage the bundled Chrome/Chromium installation:

npx hyperframes browser

info

Print version and environment info:

npx hyperframes info

docs

Open the documentation in your browser:

npx hyperframes docs

upgrade

Check for updates and show upgrade instructions:

npx hyperframes upgrade
npx hyperframes upgrade --check --json  # machine-readable for agents

Documentation

Full documentation: hyperframes.heygen.com/packages/cli