mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-09-03 12:54:29 +00:00
Vance Ingalls
608c3b50ba
Review finding 4 plus the workdir-traversal tail item.
**The group loop had no try/catch.** `parseAudioFxChain`, `parseAutomation` and
`applyAudioFxChain` were called bare, so a malformed `data-fx-chain` on a BUS —
hand-authored, or written by a newer studio carrying an effect id this engine
does not know — threw straight out of `processCompositionAudio`. That bypassed
the MixResult/`failures[]` shape every caller handles, and skipped `bail()`, so
the temp dir leaked with it. The per-element loop has always wrapped the
identical calls. Now both do, with the same rule: an `AudioFxRenderError` stays
fatal, because substituting the dry signal for a processed one ships a render
that sounds plausible and is not what was authored.
**The traversal is real, and narrower than it looks.** `group-${groupId}.wav`
defuses a bare `../` — the segment is `group-..`, not `..` — but an id holding a
slash BEFORE the dots escapes: `a/../../escaped` normalizes to
`<workDir>/../escaped.wav`, outside the tree `bail()`'s rmSync can reach.
Verified: without `safePathSegment` the test finds `escaped.wav` sitting beside
workDir. `data-audio-group` reaches this file straight from the document; the
studio's `GROUP_ID_PATTERN` guards only ids the studio itself mints.
Two tests, each verified against a revert of its own fix. engine: 66 files.
@hyperframes/engine
Seekable web-page-to-video rendering engine built on Puppeteer and FFmpeg.
Framework-agnostic: works with GSAP, Lottie, Three.js, CSS animations, or any web content that implements the window.__hf seek protocol.
Install
npm install @hyperframes/engine
Requirements: Node.js >= 22, Chrome/Chromium (auto-downloaded by Puppeteer), FFmpeg
What it does
The engine opens your HTML composition in a headless Chrome instance, seeks frame-by-frame using Chrome's HeadlessExperimental.beginFrame API, captures screenshots, and encodes them into video with FFmpeg.
Key services
| Service | Description |
|---|---|
| browserManager | Launches and pools headless Chrome instances (chrome-headless-shell) |
| frameCapture | Manages capture sessions — seek, screenshot, buffer lifecycle |
| screenshotService | BeginFrame-based capture with CDP (Chrome DevTools Protocol) |
| chunkEncoder | FFmpeg encoding with chunked concat, GPU detection, faststart |
| streamingEncoder | Pipe frames to FFmpeg in real time (no intermediate PNGs on disk) |
| audioMixer | Parse <audio> elements and mix audio tracks via FFmpeg |
| videoFrameExtractor | Extract frames from <video> elements for compositing |
| parallelCoordinator | Split frame ranges across worker processes |
| fileServer | Serve local HTML files to the browser via Hono |
Usage
import {
acquireBrowser,
createCaptureSession,
initializeSession,
captureFrame,
closeCaptureSession,
} from "@hyperframes/engine";
// 1. Launch browser
const browserLease = await acquireBrowser({ captureMode: "beginFrame" });
// 2. Open a capture session
const session = createCaptureSession({
browser: browserLease.browser,
url: "http://localhost:3000/my-composition.html",
width: 1920,
height: 1080,
fps: 30,
});
await initializeSession(session);
// 3. Capture frames
for (let i = 0; i < totalFrames; i++) {
await captureFrame(session, i, `/tmp/frames/frame-${i}.png`);
}
// 4. Clean up
await closeCaptureSession(session);
await browserLease.release();
Most users should use @hyperframes/producer or the hyperframes CLI instead of calling the engine directly.
Documentation
Full documentation: hyperframes.heygen.com/packages/engine
Related packages
@hyperframes/core— types, parsers, frame adapters@hyperframes/producer— high-level render pipeline built on this enginehyperframes— CLI