@1agh/maude 0.42.0 → 0.43.0

package/apps/studio/dom-selection.ts

@@ -463,6 +463,31 @@ export function hoverTargetToSelection(target: HoverTarget, file?: string): Sele
     worldW: el instanceof HTMLElement ? Math.round(el.offsetWidth) : undefined,
     worldH: el instanceof HTMLElement ? Math.round(el.offsetHeight) : undefined,
     html: el ? (el.outerHTML ?? '').slice(0, 4000) : '',
+    // feature-photo-editor (Task 14) — flag a content-addressed artboard `<img>`
+    // so the Inspector can offer the Photo tab. Only a real `assets/<sha8>.<ext>`
+    // src qualifies (an external URL / SVG icon / data: URI has no sidecar).
+    // `data-photo-asset` (stamped by canvas-lib's PhotoPreviewBridge the first
+    // time it bakes an edit into this element) is checked FIRST — once an edit
+    // is applied, the live `src` is a `data:` URL (the baked composite), which
+    // no longer matches the asset regex. Without this, an already-edited photo
+    // would lose its Photo tab the moment you select it (the exact regression
+    // this fixes — the bridge's own direct-src-swap made the element's `src`
+    // stop being a reliable asset key).
+    ...(() => {
+      if (el?.tagName?.toLowerCase() !== 'img') return {};
+      // The canvas iframe is untrusted content (DDR-054) — an authored `<img
+      // data-photo-asset="...">` is attacker-controllable, so the tag is only
+      // trusted when it actually has the `assets/<sha8>.<ext>` shape (security
+      // review finding: an unshaped value would ride unbounded into
+      // `_active.json`/the WS broadcast via inspect.ts's `enrich()`).
+      const assetRe = /assets\/[0-9a-f]{8}\.[a-z0-9]+/i;
+      const tagged = (el as HTMLElement).getAttribute?.('data-photo-asset');
+      if (tagged && assetRe.test(tagged))
+        return { photoKind: 'artboard-img' as const, photoAsset: tagged };
+      const src = (el as HTMLImageElement).getAttribute?.('src') || '';
+      const m = assetRe.exec(src);
+      return m ? { photoKind: 'artboard-img' as const, photoAsset: m[0] } : {};
+    })(),
     ...styleMapsFor(el),
   };
 }

package/apps/studio/exporters/jobs.ts

@@ -93,6 +93,49 @@ const HISTORY_DEPTH = 20;
 const MAX_JOB_AGE_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_JOB_TIMEOUT_MS = 5 * 60 * 1000;
 
+// Video/animation exports run a per-frame capture loop, so they legitimately
+// take far longer than the 5-min default that's fine for image exports. The
+// fast one-pass renderMediaOnWeb path is quick, but a comp that can't use it —
+// e.g. it overflows @remotion/web-renderer's recursive precompositing (RCA
+// issue-video-mp4-rendermediaonweb-stack-overflow) — degrades to frame-step
+// screenshots at ~1.5–2 s/frame (2× scale). A 900-frame comp then runs 20–30
+// min, so the image default would abort it mid-render (the "Target page closed
+// at frame ~180/900" failure). Size the budget to the WORK — a generous
+// per-frame estimate × the frame count — clamped to [5 min, 60 min]. The lower
+// bound is deliberately the same 5 min as image exports (not a flat 30 min): a
+// tiny clip that WEDGES shouldn't hold a scarce render slot for half an hour,
+// and a security review flagged that a hostile comp which reliably overflows
+// the renderer could otherwise turn a fast-fail into a long slot occupation.
+// The upper bound is a runaway backstop. MAUDE_EXPORT_VIDEO_TIMEOUT_MS overrides
+// end-to-end for renders bigger than the ceiling (e.g. if MAX_FRAMES is raised)
+// — it DELIBERATELY bypasses the 60-min cap, since removing the backstop is the
+// whole point of an operator escape hatch (trusted env, not attacker-reachable).
+const VIDEO_FORMATS = new Set(['mp4', 'webm', 'gif']);
+const VIDEO_TIMEOUT_MIN_MS = 5 * 60 * 1000; // 5 min — same baseline as image exports
+const VIDEO_TIMEOUT_CEIL_MS = 60 * 60 * 1000; // 60 min hard ceiling (runaway backstop)
+const VIDEO_PER_FRAME_BUDGET_MS = 2500; // ~2.5 s/frame — covers the slow frame-step path up to 3× scale
+const VIDEO_SETUP_BUDGET_MS = 60 * 1000; // boot + goto + renderMediaOnWeb attempt before fallback
+
+/** Wall-clock render budget for a job — sized to the frame count for video, 5 min otherwise. */
+function jobTimeoutMs(args: EnqueueArgs): number {
+  if (!VIDEO_FORMATS.has(args.format)) return DEFAULT_JOB_TIMEOUT_MS;
+  // Operator escape hatch — intentionally uncapped (see note above).
+  const envOverride = Number(process.env.MAUDE_EXPORT_VIDEO_TIMEOUT_MS);
+  if (Number.isFinite(envOverride) && envOverride > 0) return envOverride;
+  const o = args.options ?? {};
+  const fps = Number(o.fps) || 30;
+  const explicitFrames = Number(o.frames);
+  const durationMs = Number(o.durationMs);
+  const frames =
+    Number.isFinite(explicitFrames) && explicitFrames > 0
+      ? explicitFrames
+      : Number.isFinite(durationMs) && durationMs > 0
+        ? Math.round((durationMs / 1000) * fps)
+        : 900; // no duration hint → assume the frame cap (worst case)
+  const est = VIDEO_SETUP_BUDGET_MS + frames * VIDEO_PER_FRAME_BUDGET_MS;
+  return Math.min(VIDEO_TIMEOUT_CEIL_MS, Math.max(VIDEO_TIMEOUT_MIN_MS, est));
+}
+
 /**
  * Security fan-out finding (defender, /flow:done) — MEDIUM: `enqueue()` had
  * no cap on queued/running jobs, so a flood of `POST /_api/export-jobs`
@@ -258,11 +301,10 @@ export function createExportJobQueue(bus: Bus, designRoot: string): ExportJobQue
       const release = await semaphore.acquire();
       // Started here, not at enqueue — the timeout bounds RENDER time (the
       // intent), not queue-wait time. A job can legitimately sit `queued`
-      // behind MAUDE_EXPORT_MAX_CONCURRENT other jobs for longer than
-      // DEFAULT_JOB_TIMEOUT_MS; arming the timer before the semaphore
-      // resolves would abort it before it ever ran (code-review finding,
-      // /flow:done).
-      const timer = setTimeout(() => controller.abort(), DEFAULT_JOB_TIMEOUT_MS);
+      // behind MAUDE_EXPORT_MAX_CONCURRENT other jobs for longer than its
+      // render budget; arming the timer before the semaphore resolves would
+      // abort it before it ever ran (code-review finding, /flow:done).
+      const timer = setTimeout(() => controller.abort(), jobTimeoutMs(args));
       try {
         job.status = 'running';
         job.startedAt = new Date().toISOString();

package/apps/studio/exporters/video.ts

@@ -124,17 +124,37 @@ async function runVideo(
     const stdoutLines = await runShim(args, {
       cwd: path.dirname(VIDEO_PLAYWRIGHT),
       signal: hooks?.signal,
-      // No MAUDE_PROGRESS line from this shim yet — frame-count progress is a
-      // follow-up (video scope is always a single artboard, never multi).
+      // Frame-step capture emits `MAUDE_PROGRESS {current,total}` per frame → a
+      // live "N of M" progress bar in the Exports panel. This is exactly the
+      // slow path (the renderMediaOnWeb-overflow fallback can run many minutes);
+      // the fast one-pass renderer finishes before progress matters and reports
+      // none until done (it exposes no per-frame hook) — acceptable.
+      onProgress: hooks?.onProgress,
     });
     const body = new Uint8Array(readFileSync(outPath));
     // The container can differ from the request (mp4 → webm fallback when the
-    // browser has no H.264 encoder). Read the summary line for the real ext.
+    // browser has no H.264 encoder). Read the summary line for the real ext, and
+    // for the degradation marker the shim sets when it had to fall back from the
+    // renderMediaOnWeb audio path to frame-step screenshots (RCA
+    // issue-video-mp4-rendermediaonweb-stack-overflow) — surfaced here so the
+    // dropped audio isn't silent (job stderr / logs; a UI toast is a follow-up).
     let ext: string = format;
     try {
       const lastLine = stdoutLines.at(-1) ?? '{}';
-      const summary = JSON.parse(lastLine) as { container?: string };
+      const summary = JSON.parse(lastLine) as {
+        container?: string;
+        degraded?: boolean;
+        audioDropped?: boolean;
+        fallbackReason?: string;
+      };
       if (summary.container) ext = summary.container;
+      if (summary.degraded) {
+        console.error(
+          `⚠ ${format} export degraded: the audio renderer failed ` +
+            `(${summary.fallbackReason ?? 'unknown'}), so this file was captured ` +
+            'frame-by-frame and has no audio.'
+        );
+      }
     } catch {
       /* keep the requested ext */
     }

package/apps/studio/footage/schema.test.ts

@@ -0,0 +1,195 @@
+// footage/schema — validator + helper coverage (feature-footage-analysis-director).
+// Mirrors the photo/schema house style: a valid fixture round-trips, and every
+// rejection lane (unknown key / bad type / out-of-range / non-relative asset /
+// end≤start / end>duration / bad transition presentation) is asserted so a
+// crafted field can never reach disk via the `/_api/footage` route.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  EDL_VERSION,
+  type Edl,
+  emptyFootageAnalysis,
+  FOOTAGE_ANALYSIS_VERSION,
+  type FootageAnalysis,
+  isEmptyAnalysis,
+  validateEdl,
+  validateFootageAnalysis,
+} from './schema.ts';
+
+const GOOD_ANALYSIS: FootageAnalysis = {
+  version: FOOTAGE_ANALYSIS_VERSION,
+  asset: 'assets/a1b2c3d4.mp4',
+  durationSec: 12.5,
+  width: 1920,
+  height: 1080,
+  keyframes: 12,
+  shots: [
+    {
+      start: 0,
+      end: 3.2,
+      kind: 'establishing',
+      motion: 'push-in',
+      subject: 'drone push over the river',
+      lighting: 'golden hour',
+      mood: 'calm',
+      quality: 0.9,
+      usable: true,
+      note: 'hero shot',
+    },
+    { start: 4, end: 6, kind: 'detail', usable: false },
+  ],
+  summary: 'Calm aspirational exterior b-roll.',
+  tags: ['rebrand', 'exterior'],
+};
+
+const GOOD_EDL: Edl = {
+  version: EDL_VERSION,
+  title: 'Alligators rebrand reel',
+  fps: 30,
+  width: 1920,
+  height: 1080,
+  beats: [
+    {
+      clip: 'assets/a1b2c3d4.mp4',
+      startSec: 0,
+      durationFrames: 60,
+      name: 'intro',
+      transition: null,
+    },
+    {
+      clip: 'assets/a1b2c3d4.mp4',
+      startSec: 8,
+      durationFrames: 45,
+      why: 'second shot from the same clip',
+      transition: { presentation: 'fade', frames: 15 },
+      overlay: { kind: 'title', text: 'Alligators' },
+      name: 'hero',
+    },
+  ],
+  music: { asset: 'assets/deadbeef.mp3', fadeOutFrames: 20 },
+};
+
+describe('validateFootageAnalysis', () => {
+  test('accepts a well-formed analysis', () => {
+    expect(validateFootageAnalysis(GOOD_ANALYSIS)).toEqual({ ok: true, errors: [] });
+  });
+
+  test('accepts an empty analysis from the helper', () => {
+    expect(validateFootageAnalysis(emptyFootageAnalysis('assets/a1b2c3d4.mp4')).ok).toBe(true);
+  });
+
+  test('rejects a non-object root', () => {
+    expect(validateFootageAnalysis(null).ok).toBe(false);
+    expect(validateFootageAnalysis(42).ok).toBe(false);
+  });
+
+  test('rejects an unknown top-level key', () => {
+    const r = validateFootageAnalysis({ ...GOOD_ANALYSIS, evil: 1 });
+    expect(r.ok).toBe(false);
+    expect(r.errors.join()).toContain('unknown key "evil"');
+  });
+
+  test('rejects a non-relative / traversing asset path', () => {
+    for (const asset of ['/etc/passwd', '../secret.mp4', 'assets/../x.mp4', 'http://x/y.mp4']) {
+      expect(validateFootageAnalysis({ ...GOOD_ANALYSIS, asset }).ok).toBe(false);
+    }
+  });
+
+  test('rejects a shot whose end ≤ start', () => {
+    const r = validateFootageAnalysis({
+      ...GOOD_ANALYSIS,
+      shots: [{ start: 5, end: 5 }],
+    });
+    expect(r.ok).toBe(false);
+    expect(r.errors.join()).toContain('end must be > start');
+  });
+
+  test('rejects a shot that runs past the clip duration', () => {
+    const r = validateFootageAnalysis({
+      ...GOOD_ANALYSIS,
+      durationSec: 5,
+      shots: [{ start: 1, end: 9 }],
+    });
+    expect(r.ok).toBe(false);
+    expect(r.errors.join()).toContain('exceeds clip duration');
+  });
+
+  test('rejects an out-of-range quality + bad shot kind', () => {
+    expect(
+      validateFootageAnalysis({ ...GOOD_ANALYSIS, shots: [{ start: 0, end: 1, quality: 2 }] }).ok
+    ).toBe(false);
+    expect(
+      validateFootageAnalysis({ ...GOOD_ANALYSIS, shots: [{ start: 0, end: 1, kind: 'nope' }] }).ok
+    ).toBe(false);
+  });
+});
+
+describe('isEmptyAnalysis', () => {
+  test('true for null / no shots / no usable shots', () => {
+    expect(isEmptyAnalysis(null)).toBe(true);
+    expect(isEmptyAnalysis({ shots: [] })).toBe(true);
+    expect(isEmptyAnalysis({ shots: [{ start: 0, end: 1, usable: false }] })).toBe(true);
+  });
+  test('false when at least one shot is usable', () => {
+    expect(isEmptyAnalysis(GOOD_ANALYSIS)).toBe(false);
+  });
+});
+
+describe('validateEdl', () => {
+  test('accepts a well-formed EDL', () => {
+    expect(validateEdl(GOOD_EDL)).toEqual({ ok: true, errors: [] });
+  });
+
+  test('rejects a beat with no clip', () => {
+    const r = validateEdl({ ...GOOD_EDL, beats: [{ startSec: 0, durationFrames: 30 }] });
+    expect(r.ok).toBe(false);
+    expect(r.errors.join()).toContain('clip');
+  });
+
+  test('rejects a non-relative beat clip', () => {
+    expect(
+      validateEdl({ ...GOOD_EDL, beats: [{ clip: '/x.mp4', startSec: 0, durationFrames: 30 }] }).ok
+    ).toBe(false);
+  });
+
+  test('rejects durationFrames < 1 / non-integer', () => {
+    expect(
+      validateEdl({
+        ...GOOD_EDL,
+        beats: [{ clip: 'assets/a1b2c3d4.mp4', startSec: 0, durationFrames: 0 }],
+      }).ok
+    ).toBe(false);
+    expect(
+      validateEdl({
+        ...GOOD_EDL,
+        beats: [{ clip: 'assets/a1b2c3d4.mp4', startSec: 0, durationFrames: 12.5 }],
+      }).ok
+    ).toBe(false);
+  });
+
+  test('rejects an unbundled transition presentation', () => {
+    const r = validateEdl({
+      ...GOOD_EDL,
+      beats: [
+        {
+          clip: 'assets/a1b2c3d4.mp4',
+          startSec: 0,
+          durationFrames: 30,
+          transition: { presentation: 'dreamy-zoom', frames: 10 },
+        },
+      ],
+    });
+    expect(r.ok).toBe(false);
+    expect(r.errors.join()).toContain('presentation');
+  });
+
+  test('rejects an fps above 120 / below 1', () => {
+    expect(validateEdl({ ...GOOD_EDL, fps: 999 }).ok).toBe(false);
+    expect(validateEdl({ ...GOOD_EDL, fps: 0 }).ok).toBe(false);
+  });
+
+  test('rejects a music bed with a non-relative asset', () => {
+    expect(validateEdl({ ...GOOD_EDL, music: { asset: 'http://x/y.mp3' } }).ok).toBe(false);
+  });
+});