mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-09-01 19:42:03 +00:00
* feat(cli): add skills version check, update, and freshness manifest
Give the HyperFrames skill bundle a content fingerprint so agents and
users can tell whether installed skills are the latest version, on any
platform that can run the CLI.
- skills-manifest.json (repo root): per-skill sha256 over the whole skill
directory; minimal {source, skills}, no version/timestamp so it is fully
deterministic. Generated by scripts/gen-skills-manifest.ts.
- `hyperframes skills check` [--json]: compares installed skills to the
manifest; exits non-zero when something is outdated (agent/CI gate).
- `hyperframes skills update`: thin wrapper over `npx skills update`.
- Passive nudge on render/lint/validate when skills are stale (24h cache,
same opt-out as the CLI self-update notice).
- "latest" resolved via `git ls-remote` + SHA-pinned raw URL to dodge
GitHub raw-CDN lag, falling back to the main branch URL.
- CI job + lefthook hook keep skills-manifest.json in sync with skills/.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): add execFile to child_process mock in skills test
skills.test.ts mocks node:child_process but only declared execFileSync
and spawn. Loading skills.js transitively loads skillsManifest.ts, which
runs promisify(execFile) at module load, so vitest threw on the missing
execFile named export. Add a bare stub — these tests never invoke it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(cli): init installs all skills; skills update pulls the full set
Make `hyperframes init` the single place skills are pulled in full, and
make "update" mean "get everything" rather than "refresh what's there".
- init now always installs/refreshes ALL skills (incl. ones not yet
present) instead of prompting "Install AI coding skills?" — opt out
with `init --skip-skills`. Both the interactive and non-interactive
paths pass `--all --yes` so the complete set is fetched.
- `hyperframes skills update` switches from `npx skills update` (which
only refreshes already-installed skills) to `skills add --all`, so it
installs missing skills too — the same install step init runs.
- SKILL.md documents init-installs-all and the new update semantics.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(cli): skills check treats missing skills as needing an update
The full skill set is now the goal (init and `skills update` both pull
all, including ones not installed), so a partial install is no longer
"a choice" — it's something to fix.
- diffSkills: updateAvailable is now true when anything is outdated OR
missing (local-only still doesn't count). So `skills check` exits
non-zero — and renders "Update:" instead of "up to date" — whenever a
skill is missing, not just when one is stale.
- The passive render/lint/validate nudge follows suit: it now counts
missing alongside outdated ("N skills out of date or missing"),
tracked via a new skillsMissingCount cache field.
- SKILL.md documents the stricter check.
Note: platforms that intentionally vendor only a subset of skills (e.g.
a Codex snapshot) will now see check report non-zero.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): install/update skills straight from the GitHub repo
`skills add owner/repo` can resolve through the skills.sh registry, which
lags behind the repo — so `update` could install a stale version while
`check` (which resolves latest directly from GitHub) keeps reporting
"outdated", an endless loop.
Switch the install source to the full GitHub URL
(https://github.com/heygen-com/hyperframes), which makes `skills add`
git-clone the repo directly at latest main, bypassing the registry. This
covers `hyperframes skills`, `hyperframes skills update`, and `init`'s
skill install — all of which go through SOURCES. Now install/update and
check agree on what "latest" means.
The init "install skills" hint now points at `npx hyperframes skills
update` so the manual path uses the same GitHub-direct fetch.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(cli): init checks skills against GitHub, installs only when stale
`hyperframes init` now runs the skills version check first and only
(re)installs when something is outdated or missing — instead of
unconditionally re-pulling every time. Re-running init on an
already-current project is now a no-op ("skills are already up to date").
- New ensureSkillsCurrent() helper, shared by both the interactive and
non-interactive init paths (no duplicated install logic).
- The check resolves "latest" straight from GitHub (same source the
install uses); best-effort — if it can't reach GitHub it installs anyway.
- SKILL.md updated to describe the check-then-install behavior.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(cli): address skills manifest review feedback
From the PR review (points 1, 2, 4, 5):
1. Remove the `local-only` skill status. checkSkills only ever hashes
manifest-listed skills, so a local-only status could never appear in
the end-to-end output — and making it appear would wrongly flag
unrelated skills (the `.../skills` dir is shared across sources).
diffSkills now reports only on manifest skills; skills on disk that
aren't in the manifest are ignored.
2. Drop the redundant per-directory sort in listFilesSorted — the single
final out.sort() is what guarantees a deterministic hash (verified:
manifest unchanged).
4. resolveLatestManifest local-path detection now uses path.isAbsolute,
so Windows absolute paths (C:\...) are treated as local instead of
falling through to a remote fetch.
5. fetchManifest validates the response shape (asSkillsManifest) instead
of a blind `as` cast, so a CDN error page served as 200 fails with a
clear error rather than a cryptic crash later in diffSkills.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): strict skills update + auto-discover any agent host
Address PR review (Magi blocker + James/Rames robustness):
- Blocker (Magi): `skills update` is the documented recovery path for
`skills check || skills update`, but it delegated to installAllSkills()
which swallowed missing-npx and failed `skills add` as "skipped",
exiting 0 even when nothing changed. Add a strict mode that throws on
failure; update sets a non-zero exit (init stays best-effort). New tests
simulate a non-zero `skills add` (exit 1) and the success path.
- Robustness (James/Rames #2): the upstream `skills` CLI installs into
~72 agent conventions; a hard-coded list (4, or even 11) can't track
that. Replace defaultSkillRoots with discoverSkillRoots — it scans cwd +
$HOME for any `<host>/skills/<manifest-skill>/SKILL.md` (plus the XDG
`.config/<host>/skills`), so detection is structural and future-proof,
no closed list. agentFromDir infers the host from the path.
- Tests (Rames #3): temp-fixture detection tests for every convention ×
{project, global}, scope priority, claude-code preference, the
no-install case, the --dir override, and an unknown/new host (proving
the no-closed-list property).
- Docs (Rames #4/#5): SKILL.md notes init's best-effort GitHub round-trip;
findRepoManifest climbs 16 levels (was 8) for deep monorepos.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): resolve CodeQL file-system race + de-flake Windows npx test
Two CI fixes:
- CodeQL (high, js/file-system-race) at gen-skills-manifest.ts: the
existsSync(outPath) precheck followed by writeFileSync(outPath) is a
check-then-write race. Read the committed manifest directly in a
try/catch instead (missing/unreadable ⇒ "no committed manifest"), so
there's no precheck to race against. Behavior is unchanged.
- Windows Tests: npxCommand.test.ts's real `npx --version` smoke test
cold-starts slower than vitest's 5s default on Windows runners and
timed out. Give the test 60s headroom (and a 30s exec timeout). Kept
as a real execution check — mocking would reduce it to a tautology.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cli): repair garbled npx smoke-test timeout comment
The explanatory comment for the 60s timeout was scrambled across the
callback/timeout arguments, failing oxfmt --check (and thus preflight,
which in turn skipped preview-parity and failed the regression gate).
Move it above the it() call so it no longer sits between call arguments.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
309 lines
14 KiB
JavaScript
309 lines
14 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
// ── EPIPE suppression (must run before ANY stdout/stderr write) ────────────
|
|
// When the CLI runs inside a piped agent environment (Claude Code, Codex,
|
|
// Cursor, etc.), the reader may close the pipe before we finish writing.
|
|
// Node treats EPIPE on stdout/stderr as an uncaughtException, which crashes
|
|
// the process. This is a normal lifecycle event — suppress it.
|
|
//
|
|
// commandFailed must be declared here (before the handlers) so the EPIPE
|
|
// stream-error path can set it before process.exit(0). The telemetry exit
|
|
// handler reads this flag to determine success/failure — an EPIPE exit
|
|
// should NOT score as success:true in telemetry.
|
|
let commandFailed = false;
|
|
|
|
for (const stream of [process.stdout, process.stderr]) {
|
|
stream.on("error", (err) => {
|
|
if ((err as NodeJS.ErrnoException).code === "EPIPE") {
|
|
commandFailed = true;
|
|
process.exit(0);
|
|
}
|
|
});
|
|
}
|
|
|
|
// ── Worker entry path bootstrap (must run before any producer/engine load) ──
|
|
// The shaderTransitionWorkerPool lives in the producer package and resolves
|
|
// its worker entry by probing for a sibling `.js` file next to
|
|
// `import.meta.url`. When this CLI is bundled by tsup, the producer code is
|
|
// inlined into `cli.js`, but `import.meta.url` resolves to the producer's
|
|
// own dist path (NOT cli.js) on some module-graph layouts — so the sibling
|
|
// probe lands in a directory that does not contain the bundled worker.
|
|
// We emit the worker entry next to cli.js (see tsup.config.ts) and tell
|
|
// the pool where to find it via the published env-var override.
|
|
import { dirname, join } from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
import { existsSync } from "node:fs";
|
|
|
|
(() => {
|
|
const here = dirname(fileURLToPath(import.meta.url));
|
|
const shader = join(here, "shaderTransitionWorker.js");
|
|
if (!process.env.HF_SHADER_WORKER_ENTRY && existsSync(shader)) {
|
|
process.env.HF_SHADER_WORKER_ENTRY = shader;
|
|
}
|
|
})();
|
|
|
|
// ── Fast-path exits ─────────────────────────────────────────────────────────
|
|
// Check --version before importing anything heavy. This makes
|
|
// `hyperframes --version` near-instant (~10ms vs ~80ms).
|
|
import { VERSION } from "./version.js";
|
|
|
|
const argv = process.argv.slice(2);
|
|
const commandArg = argv[0];
|
|
const rootVersionRequested =
|
|
commandArg === "--version" ||
|
|
commandArg === "-V" ||
|
|
(commandArg === undefined && (argv.includes("--version") || argv.includes("-V")));
|
|
|
|
if (rootVersionRequested) {
|
|
console.log(VERSION);
|
|
process.exit(0);
|
|
}
|
|
|
|
// ── Load .env from CWD ─────────────────────────────────────────────────────
|
|
// Agents run from the project directory where .env holds API keys (Gemini,
|
|
// HeyGen, ElevenLabs). Load it automatically so they don't need `source .env`.
|
|
try {
|
|
const { readFileSync } = await import("node:fs");
|
|
const { resolve } = await import("node:path");
|
|
const envPath = resolve(process.cwd(), ".env");
|
|
const envContent = readFileSync(envPath, "utf-8");
|
|
for (const rawLine of envContent.split("\n")) {
|
|
let line = rawLine.trim();
|
|
if (!line || line.startsWith("#")) continue;
|
|
// Tolerate `export FOO=bar` (common in dotfile-style .env files).
|
|
if (line.startsWith("export ")) line = line.slice(7).trim();
|
|
const eqIdx = line.indexOf("=");
|
|
if (eqIdx < 1) continue;
|
|
const key = line.slice(0, eqIdx).trim();
|
|
let val = line.slice(eqIdx + 1).trim();
|
|
if (val.startsWith('"') || val.startsWith("'")) {
|
|
// Quoted value: take until the matching closing quote; leave the rest.
|
|
// Anything after a closing quote (including `# comment`) is dropped.
|
|
const quote = val.charAt(0);
|
|
const end = val.indexOf(quote, 1);
|
|
if (end > 0) val = val.slice(1, end);
|
|
else val = val.slice(1); // unterminated quote — best-effort, strip opener
|
|
} else {
|
|
// Unquoted value: strip inline `# comment` (requires whitespace before #
|
|
// to avoid eating `pass#word` style values).
|
|
const commentMatch = val.match(/\s+#/);
|
|
if (commentMatch?.index !== undefined) val = val.slice(0, commentMatch.index).trim();
|
|
}
|
|
if (key && !(key in process.env)) process.env[key] = val;
|
|
}
|
|
} catch {
|
|
/* .env not present — fine, env vars may be set another way */
|
|
}
|
|
|
|
// ── Lazy imports ────────────────────────────────────────────────────────────
|
|
// Telemetry, update checks, and heavy modules are imported only when needed.
|
|
// For --help we skip telemetry entirely.
|
|
|
|
import { defineCommand, runMain } from "citty";
|
|
import type { ArgsDef, CommandDef } from "citty";
|
|
import { reportCommandFailure, trackCommandFailures } from "./utils/command-failure-tracking.js";
|
|
|
|
const isHelp = process.argv.includes("--help") || process.argv.includes("-h");
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// CLI definition — all commands are lazy-loaded via dynamic import()
|
|
// ---------------------------------------------------------------------------
|
|
|
|
const commandLoaders = {
|
|
init: () => import("./commands/init.js").then((m) => m.default),
|
|
add: () => import("./commands/add.js").then((m) => m.default),
|
|
catalog: () => import("./commands/catalog.js").then((m) => m.default),
|
|
play: () => import("./commands/play.js").then((m) => m.default),
|
|
present: () => import("./commands/present.js").then((m) => m.default),
|
|
preview: () => import("./commands/preview.js").then((m) => m.default),
|
|
publish: () => import("./commands/publish.js").then((m) => m.default),
|
|
render: () => import("./commands/render.js").then((m) => m.default),
|
|
lint: () => import("./commands/lint.js").then((m) => m.default),
|
|
beats: () => import("./commands/beats.js").then((m) => m.default),
|
|
inspect: () => import("./commands/inspect.js").then((m) => m.default),
|
|
layout: () => import("./commands/layout.js").then((m) => m.default),
|
|
info: () => import("./commands/info.js").then((m) => m.default),
|
|
compositions: () => import("./commands/compositions.js").then((m) => m.default),
|
|
benchmark: () => import("./commands/benchmark.js").then((m) => m.default),
|
|
browser: () => import("./commands/browser.js").then((m) => m.default),
|
|
"remove-background": () => import("./commands/remove-background.js").then((m) => m.default),
|
|
transcribe: () => import("./commands/transcribe.js").then((m) => m.default),
|
|
tts: () => import("./commands/tts.js").then((m) => m.default),
|
|
docs: () => import("./commands/docs.js").then((m) => m.default),
|
|
doctor: () => import("./commands/doctor.js").then((m) => m.default),
|
|
upgrade: () => import("./commands/upgrade.js").then((m) => m.default),
|
|
skills: () => import("./commands/skills.js").then((m) => m.default),
|
|
feedback: () => import("./commands/feedback.js").then((m) => m.default),
|
|
telemetry: () => import("./commands/telemetry.js").then((m) => m.default),
|
|
events: () => import("./commands/events.js").then((m) => m.default),
|
|
validate: () => import("./commands/validate.js").then((m) => m.default),
|
|
snapshot: () => import("./commands/snapshot.js").then((m) => m.default),
|
|
capture: () => import("./commands/capture.js").then((m) => m.default),
|
|
lambda: () => import("./commands/lambda.js").then((m) => m.default),
|
|
cloudrun: () => import("./commands/cloudrun.js").then((m) => m.default),
|
|
cloud: () => import("./commands/cloud.js").then((m) => m.default),
|
|
auth: () => import("./commands/auth.js").then((m) => m.default),
|
|
};
|
|
|
|
// Wrap each command's run() so a thrown failure reports its reason to telemetry
|
|
// before citty catches the error and exits 1. The error is re-thrown unchanged,
|
|
// preserving citty's print + exit-1 behavior. Commands that call process.exit()
|
|
// themselves (e.g. `browser path`) bypass this and report inline.
|
|
const subCommands = Object.fromEntries(
|
|
Object.entries(commandLoaders).map(([name, load]) => [
|
|
name,
|
|
trackCommandFailures(load, (err) => reportCommandFailure(command, err)),
|
|
]),
|
|
);
|
|
|
|
const main = defineCommand({
|
|
meta: {
|
|
name: "hyperframes",
|
|
version: VERSION,
|
|
description: "Create and render HTML video compositions",
|
|
},
|
|
subCommands,
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Telemetry — lazy-loaded, captured references for exit handlers
|
|
// ---------------------------------------------------------------------------
|
|
|
|
const cliCommandArg = process.argv[2];
|
|
// Explicit annotation breaks a type cycle: `subCommands` references `command`
|
|
// (in the failure reporter) and `command` references `subCommands` (the `in`
|
|
// check), so its type can't be inferred from its own initializer.
|
|
const command: string = cliCommandArg && cliCommandArg in subCommands ? cliCommandArg : "unknown";
|
|
const hasJsonFlag = process.argv.includes("--json");
|
|
|
|
// Captured references — populated when the lazy imports resolve.
|
|
// Used in exit handlers where dynamic import() is unsafe (beforeExit loops,
|
|
// exit handler is synchronous-only).
|
|
let _flush: (() => Promise<void>) | undefined;
|
|
let _flushSync: (() => void) | undefined;
|
|
let _trackCliError:
|
|
| ((props: {
|
|
error_name: string;
|
|
error_message: string;
|
|
stack_trace?: string;
|
|
command?: string;
|
|
kind: "uncaught_exception" | "unhandled_rejection" | "command_error";
|
|
}) => void)
|
|
| undefined;
|
|
let _trackCommandResult:
|
|
| ((props: { command: string; success: boolean; exitCode: number; durationMs: number }) => void)
|
|
| undefined;
|
|
let _printUpdateNotice: (() => void) | undefined;
|
|
let _printSkillsUpdateNotice: (() => void) | undefined;
|
|
|
|
// `events` is a telemetry-internal beacon: it self-tracks + self-flushes, so it
|
|
// skips the per-command wrapper (no duplicate cli_command, no first-run notice
|
|
// printed into a skill's captured output).
|
|
if (!isHelp && command !== "telemetry" && command !== "events" && command !== "unknown") {
|
|
import("./telemetry/index.js").then((mod) => {
|
|
_flush = mod.flush;
|
|
_flushSync = mod.flushSync;
|
|
_trackCliError = mod.trackCliError;
|
|
_trackCommandResult = mod.trackCommandResult;
|
|
mod.showTelemetryNotice();
|
|
mod.trackCommand(command);
|
|
if (mod.shouldTrack()) mod.incrementCommandCount();
|
|
});
|
|
}
|
|
|
|
// `events` skips the update check too — a skill-usage beacon must not add
|
|
// network latency or trigger a background self-upgrade on the calling skill.
|
|
if (!isHelp && !hasJsonFlag && command !== "upgrade" && command !== "events") {
|
|
// Report any completed auto-install from the previous run first, before
|
|
// kicking off the next check — so the user sees "updated to vX" once and
|
|
// we don't over-print.
|
|
import("./utils/autoUpdate.js").then((mod) => mod.reportCompletedUpdate()).catch(() => {});
|
|
|
|
import("./utils/updateCheck.js").then(async (mod) => {
|
|
_printUpdateNotice = mod.printUpdateNotice;
|
|
const result = await mod.checkForUpdate().catch(() => null);
|
|
if (result?.updateAvailable) {
|
|
const auto = await import("./utils/autoUpdate.js").catch(() => null);
|
|
auto?.scheduleBackgroundInstall(result.latest, result.current);
|
|
}
|
|
});
|
|
|
|
// Skills freshness nudge — same gating as the CLI self-update notice. The
|
|
// check is cached (24h) and best-effort: it never blocks or fails the command.
|
|
import("./utils/skillsUpdateCheck.js").then(async (mod) => {
|
|
_printSkillsUpdateNotice = mod.printSkillsUpdateNotice;
|
|
await mod.checkSkillsForUpdate().catch(() => null);
|
|
});
|
|
}
|
|
|
|
const commandStart = Date.now();
|
|
|
|
// Async flush for normal exit. `beforeExit` re-fires every time the
|
|
// event loop drains, and the async `_flush()` itself schedules new
|
|
// work — so a plain `on` listener would print the update notice (and
|
|
// re-flush) once per drain (the user-reported double-print). `once`
|
|
// detaches after first invocation, which is what we want for both.
|
|
process.once("beforeExit", () => {
|
|
_flush?.().catch(() => {});
|
|
if (!hasJsonFlag) {
|
|
_printUpdateNotice?.();
|
|
_printSkillsUpdateNotice?.();
|
|
}
|
|
});
|
|
|
|
// Sync-only: exit handlers cannot await promises or drain microtasks.
|
|
// _trackCommandResult / _trackCliError are captured references resolved
|
|
// at init time, so they're callable synchronously here.
|
|
process.on("exit", (code) => {
|
|
_trackCommandResult?.({
|
|
command,
|
|
success: code === 0 && !commandFailed,
|
|
exitCode: code,
|
|
durationMs: Date.now() - commandStart,
|
|
});
|
|
_flushSync?.();
|
|
});
|
|
|
|
process.on("uncaughtException", (error) => {
|
|
if ((error as NodeJS.ErrnoException).code === "EPIPE") {
|
|
commandFailed = true;
|
|
process.exit(0);
|
|
}
|
|
commandFailed = true;
|
|
_trackCliError?.({
|
|
error_name: error.name,
|
|
error_message: error.message,
|
|
stack_trace: error.stack,
|
|
command,
|
|
kind: "uncaught_exception",
|
|
});
|
|
_flushSync?.();
|
|
process.exit(1);
|
|
});
|
|
|
|
// unhandledRejection does not call process.exit() — Node may continue
|
|
// running if the rejection is non-fatal (e.g. a fire-and-forget promise).
|
|
// The exit handler above will still fire with the real exit code.
|
|
process.on("unhandledRejection", (reason) => {
|
|
commandFailed = true;
|
|
const error = reason instanceof Error ? reason : new Error(String(reason));
|
|
_trackCliError?.({
|
|
error_name: error.name,
|
|
error_message: error.message,
|
|
stack_trace: error.stack,
|
|
command,
|
|
kind: "unhandled_rejection",
|
|
});
|
|
});
|
|
|
|
// Lazy-load help renderer — avoids allocating help data on non-help invocations
|
|
async function showUsage<T extends ArgsDef>(
|
|
cmd: CommandDef<T>,
|
|
parent?: CommandDef<T>,
|
|
): Promise<void> {
|
|
const { showUsage: impl } = await import("./help.js");
|
|
return impl(cmd as CommandDef, parent as CommandDef | undefined);
|
|
}
|
|
|
|
runMain(main, { showUsage });
|