@crievo/omni 0.1.1 → 0.1.3

package/tools/lib/deps.mjs

@@ -0,0 +1,260 @@
+/* The programs the pipeline runs, brought by the CLI itself into ~/.omni (docs/specs/phase-2-plugin-cli.md,
+   step 4): no Homebrew, no admin password, the same on macOS, Windows and Linux (x64 and arm64).
+
+     ffmpeg, ffprobe   static builds from the ffmpeg-static project (FFMPEG_RELEASE), in ~/.omni/bin
+     chrome            a Chrome, Chromium or Brave already installed, else Chrome Headless Shell (Google's
+                       build for automation) through @puppeteer/browsers, in ~/.omni/browsers; the render
+                       takes it from CHROME_PATH
+     python            uv (UV_VERSION, in ~/.omni/bin) makes the app's .venv with a Python of its own and
+                       installs requirements.txt into it
+     yt-dlp            the project's standalone build (YTDLP_RELEASE), in ~/.omni/bin: a visual style from a
+                       link (tools/reference.mjs). Sites change often, so bump the release when a download breaks
+
+   Each piece is checked by running it, and only fetched when it doesn't answer, so `omni up` can call
+   ensureDeps on every session. What was installed goes in ~/.omni/deps.json; depsEnv() is the PATH and
+   CHROME_PATH the service and `omni run` hand to every tool, so the 60-odd places that spawn "ffmpeg" by
+   name need no change. OMNI_DIR moves ~/.omni (tests). */
+
+import { spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { delimiter, join } from "node:path";
+import { gunzipSync } from "node:zlib";
+
+export const OMNI_DIR = process.env.OMNI_DIR || join(homedir(), ".omni");
+export const BIN_DIR = join(OMNI_DIR, "bin");
+const STATE = join(OMNI_DIR, "deps.json");
+export const FFMPEG_RELEASE = "b6.1.1";
+export const UV_VERSION = "0.12.21";
+export const YTDLP_RELEASE = "2026.08.19";
+const PYTHON_VERSION = "3.12";
+
+const win = process.platform === "win32";
+const exe = (/** @type {string} */ name) => (win ? `${name}.exe` : name);
+/* ffmpeg-static has no Windows arm64 build: the x64 one runs under emulation */
+const arch = () => (process.arch === "arm64" && !win ? "arm64" : "x64");
+
+/** the app's venv Python, as each OS lays a venv out  @param {string} codeRoot */
+export const venvPython = codeRoot =>
+  win ? join(codeRoot, ".venv", "Scripts", "python.exe") : join(codeRoot, ".venv", "bin", "python");
+
+/** @returns {{ chrome?: string }} */
+const readState = () => {
+  try {
+    return JSON.parse(readFileSync(STATE, "utf8"));
+  } catch {
+    return {};
+  }
+};
+const writeState = (/** @type {object} */ patch) => {
+  mkdirSync(OMNI_DIR, { recursive: true });
+  writeFileSync(STATE, `${JSON.stringify({ ...readState(), ...patch }, null, 2)}\n`);
+};
+
+/** the first line a program prints for these args, or null when it doesn't run  @param {string} bin @param {string[]} args */
+const answers = (bin, args) => {
+  const r = spawnSync(bin, args, { encoding: "utf8", timeout: 20_000 });
+  return r.status === 0 ? (r.stdout || r.stderr).trim().split("\n")[0] : null;
+};
+
+/** @param {string} url */
+async function fetchBytes(url) {
+  const r = await fetch(url);
+  if (!r.ok) throw new Error(`download falhou (${r.status}): ${url}`);
+  return Buffer.from(await r.arrayBuffer());
+}
+
+/** writes a binary atomically and makes it executable  @param {string} file @param {Buffer} bytes */
+function install(file, bytes) {
+  mkdirSync(BIN_DIR, { recursive: true });
+  const tmp = `${file}.download`;
+  writeFileSync(tmp, bytes);
+  chmodSync(tmp, 0o755);
+  renameSync(tmp, file);
+}
+
+/* --- ffmpeg and ffprobe ------------------------------------------------------------------ */
+
+export async function ensureFfmpeg() {
+  for (const name of ["ffmpeg", "ffprobe"]) {
+    const file = join(BIN_DIR, exe(name));
+    if (existsSync(file) && answers(file, ["-version"])) continue;
+    const url = `https://github.com/eugeneware/ffmpeg-static/releases/download/${FFMPEG_RELEASE}/${name}-${win ? "win32" : process.platform}-${arch()}.gz`;
+    install(file, gunzipSync(await fetchBytes(url)));
+    if (!answers(file, ["-version"])) throw new Error(`o ${name} baixado não roda neste computador`);
+  }
+}
+
+/* --- Chrome Headless Shell --------------------------------------------------------------- */
+
+/** a Chromium browser already on this machine, which the render can drive just as well */
+export function systemChrome() {
+  const pf = [process.env.PROGRAMFILES, process.env["PROGRAMFILES(X86)"], process.env.LOCALAPPDATA].filter(Boolean);
+  return [
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+    "/Applications/Chromium.app/Contents/MacOS/Chromium",
+    "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+    "/usr/bin/google-chrome",
+    "/usr/bin/chromium",
+    "/usr/bin/chromium-browser",
+    ...pf.map(d => join(/** @type {string} */ (d), "Google", "Chrome", "Application", "chrome.exe")),
+  ].find(p => existsSync(p));
+}
+
+/** the Chrome the render will use: CHROME_PATH, the one fetched into ~/.omni, else one installed */
+export function chromePath() {
+  const fetched = readState().chrome;
+  return [process.env.CHROME_PATH, fetched, systemChrome()].find(p => p && existsSync(p)) ?? null;
+}
+
+export async function ensureChrome() {
+  const known = chromePath();
+  if (known) return known;
+  /* the CLI package depends on it; a development checkout uses the Chrome it has */
+  const browsers = await import("@puppeteer/browsers");
+  const platform = browsers.detectBrowserPlatform();
+  if (!platform) throw new Error(`não há Chrome Headless Shell para ${process.platform}/${process.arch}`);
+  const browser = browsers.Browser.CHROMEHEADLESSSHELL;
+  const buildId = await browsers.resolveBuildId(browser, platform, "stable");
+  const got = await browsers.install({ browser, buildId, platform, cacheDir: join(OMNI_DIR, "browsers") });
+  writeState({ chrome: got.executablePath });
+  return got.executablePath;
+}
+
+/* --- yt-dlp ----------------------------------------------------------------------------- */
+
+/** the release asset for this machine: one universal macOS build, Linux per arch, Windows per arch */
+export function ytdlpAsset(platform = process.platform, cpu = process.arch) {
+  if (platform === "darwin") return "yt-dlp_macos";
+  if (platform === "win32") return cpu === "arm64" ? "yt-dlp_arm64.exe" : "yt-dlp.exe";
+  return cpu === "arm64" ? "yt-dlp_linux_aarch64" : "yt-dlp_linux";
+}
+
+export async function ensureYtdlp() {
+  /* one already on the PATH (a development checkout's Homebrew) serves as well */
+  if (answers("yt-dlp", ["--version"])) return;
+  const file = join(BIN_DIR, exe("yt-dlp"));
+  if (existsSync(file) && answers(file, ["--version"])) return;
+  const url = `https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_RELEASE}/${ytdlpAsset()}`;
+  install(file, await fetchBytes(url));
+  if (!answers(file, ["--version"])) throw new Error("o yt-dlp baixado não roda neste computador");
+}
+
+/* --- uv and the Python venv -------------------------------------------------------------- */
+
+async function ensureUv() {
+  const file = join(BIN_DIR, exe("uv"));
+  if (existsSync(file) && answers(file, ["--version"])) return file;
+  const triple = `${process.arch === "arm64" ? "aarch64" : "x86_64"}-${win ? "pc-windows-msvc" : process.platform === "darwin" ? "apple-darwin" : "unknown-linux-gnu"}`;
+  const archive = `uv-${triple}.${win ? "zip" : "tar.gz"}`;
+  const tmp = mkdtempSync(join(tmpdir(), "omni-uv-"));
+  try {
+    writeFileSync(
+      join(tmp, archive),
+      await fetchBytes(`https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/${archive}`),
+    );
+    /* tar reads both .tar.gz and .zip on macOS and Windows 10+, and .tar.gz on Linux */
+    const x = spawnSync("tar", ["-xf", archive], { cwd: tmp, encoding: "utf8" });
+    if (x.status !== 0) throw new Error(`não consegui abrir o ${archive}: ${x.stderr.trim()}`);
+    const found = readdirSync(tmp, { recursive: true, withFileTypes: true }).find(
+      e => e.isFile() && e.name === exe("uv"),
+    );
+    if (!found) throw new Error(`o ${archive} não tem o uv`);
+    install(file, readFileSync(join(found.parentPath, found.name)));
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+  return file;
+}
+
+/** the venv with requirements.txt installed  @param {string} codeRoot */
+export async function ensurePython(codeRoot) {
+  const python = venvPython(codeRoot);
+  if (existsSync(python) && answers(python, ["-c", "import numpy, soundfile, requests; print('ok')"])) return python;
+  const uv = await ensureUv();
+  const env = {
+    ...process.env,
+    UV_PYTHON_INSTALL_DIR: join(OMNI_DIR, "python"),
+    UV_CACHE_DIR: join(OMNI_DIR, "uv-cache"),
+  };
+  const venv = spawnSync(uv, ["venv", "--python", PYTHON_VERSION, "--allow-existing", join(codeRoot, ".venv")], {
+    encoding: "utf8",
+    env,
+  });
+  if (venv.status !== 0) throw new Error(`uv venv falhou: ${venv.stderr.trim().split("\n").at(-1)}`);
+  const pip = spawnSync(uv, ["pip", "install", "--python", python, "-r", join(codeRoot, "requirements.txt")], {
+    encoding: "utf8",
+    env,
+  });
+  if (pip.status !== 0) throw new Error(`uv pip install falhou: ${pip.stderr.trim().split("\n").at(-1)}`);
+  return python;
+}
+
+/* --- together ---------------------------------------------------------------------------- */
+
+/** the environment every tool runs with: ~/.omni/bin first on PATH, and the Chrome the render uses */
+export function depsEnv(env = process.env) {
+  const chrome = chromePath();
+  return {
+    PATH: [BIN_DIR, env.PATH ?? ""].filter(Boolean).join(delimiter),
+    ...(chrome && !env.CHROME_PATH ? { CHROME_PATH: chrome } : {}),
+  };
+}
+
+/** what answers now: each program's version line, or null  @param {string} codeRoot */
+export function checkDeps(codeRoot) {
+  const env = depsEnv();
+  const on = (/** @type {string} */ name, /** @type {string[]} */ args) => {
+    const r = spawnSync(name, args, { encoding: "utf8", timeout: 20_000, env: { ...process.env, ...env } });
+    return r.status === 0 ? (r.stdout || r.stderr).trim().split("\n")[0] : null;
+  };
+  const python = venvPython(codeRoot);
+  return {
+    ffmpeg: on("ffmpeg", ["-version"]),
+    ffprobe: on("ffprobe", ["-version"]),
+    chrome: chromePath(),
+    python: existsSync(python)
+      ? answers(python, ["-c", "import numpy, soundfile, requests; print('ok')"]) && python
+      : null,
+    ytdlp: on("yt-dlp", ["--version"]),
+  };
+}
+
+/**
+ * Fetches whatever doesn't answer, one piece at a time, and says how it went.
+ * @param {string} codeRoot @param {{ log?: (line: string) => void }} [o]
+ * @returns {Promise<{ ok: boolean, missing: string[], errors: string[] }>}
+ */
+export async function ensureDeps(codeRoot, { log = () => {} } = {}) {
+  /** @type {string[]} */
+  const errors = [];
+  const steps = /** @type {const} */ ([
+    ["ffmpeg", () => ensureFfmpeg()],
+    ["Chrome sem janela", () => ensureChrome()],
+    ["Python", () => ensurePython(codeRoot)],
+    ["yt-dlp", () => ensureYtdlp()],
+  ]);
+  for (const [name, run] of steps) {
+    try {
+      log(`preparando ${name}…`);
+      await run();
+    } catch (e) {
+      errors.push(`${name}: ${/** @type {Error} */ (e).message}`);
+    }
+  }
+  const c = checkDeps(codeRoot);
+  const missing = Object.entries(c)
+    .filter(([, v]) => !v)
+    .map(([k]) => k);
+  return { ok: missing.length === 0, missing, errors };
+}

package/tools/lib/platforms/instagram.mjs

@@ -355,7 +355,7 @@ export function instagramClient({ token, apiVersion, ...deps }) {
 /**
  * Publishes a Reel from a public video URL (and an optional public cover URL).
  * With Instagram login Meta downloads the file itself: the caller provides the
- * URLs (a local tunnel on the CLI, object storage in the cloud) and `release`,
+ * URLs (R2 behind the cloud Worker's /media, for the CLI and the cloud alike) and `release`,
  * called once Instagram has finished downloading.
  * @param {{ client: InstagramClient, userId: string, videoUrl: string, coverUrl?: string | null,
  *   cover?: { version: string } | null, caption: string, shareToFeed: boolean, coverAtS?: number | null,

package/tools/lib/service.mjs

@@ -1,7 +1,8 @@
 /* The studio kept on by launchd (macOS): `bun studio.ts` in <code root>/studio, started at login and again
    whenever it stops (30 s apart, so a studio already open in a terminal holding the port just waits its
    turn). PATH goes along because launchd starts with a minimal one, without claude, ffmpeg or the venv's
-   python; OMNI_HOME goes along when the workspace is not the code root (tools/lib/paths.mjs).
+   python, with ~/.omni/bin (tools/lib/deps.mjs) first; OMNI_HOME goes along when the workspace is not the
+   code root (tools/lib/paths.mjs).
 
    Used by `tools/runner.mjs service` (this repo) and `omni up` (the installed CLI). Throws Errors in
    Portuguese; the callers print them. */
@@ -10,6 +11,7 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { BIN_DIR } from "./deps.mjs";
 import { CODE_ROOT, DATA_ROOT, homeEnvPlist } from "./paths.mjs";
 
 export const AGENT = "com.omnivideo.studio";
@@ -44,6 +46,7 @@ function plist(/** @type {string} */ bun, /** @type {string} */ codeRoot) {
   const x = (/** @type {string} */ v) => v.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   const path = [
     ...new Set([
+      BIN_DIR,
       dirname(bun),
       dirname(process.execPath),
       "/opt/homebrew/bin",

package/tools/lib/up.mjs

@@ -5,24 +5,25 @@
      workspace   ~/OmniVideo (OMNI_HOME): videos/, omnivideo.config.json pointing at the hosted studio, .env
      app         a stable copy of the package in ~/.omni/app/<version>/ (npx's cache can be wiped), and
                  ~/.omni/bin/omni
-     python      the venv of the voice and timing tools, in the app's .venv (in the background on a hook)
+     tools       ffmpeg, the Chrome without a window and Python in ~/.omni (tools/lib/deps.mjs; in the
+                 background on a hook)
      login       none yet: the browser opens on the approval page (at most once an hour)
+     claude      on a hook, the session's Claude Code folder into ~/.omni/claude.json (claude-settings.mjs)
      service     the studio as a launchd agent, from the app, so the hosted studio reaches this Mac
 
-   In this repo (a git checkout) the app, the venv and the service are left to `tools/setup.mjs` and
+   In this repo (a git checkout) the app, the tools and the service are left to `tools/setup.mjs` and
    `tools/runner.mjs service`: `up` never rewires a development machine. */
 
 import { spawn, spawnSync } from "node:child_process";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { copyFileSync, existsSync, mkdirSync, openSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { missingRules } from "./claude-settings.mjs";
+import { missingRules, recordClaudeDir } from "./claude-settings.mjs";
 import { CLI_COMMAND, PACKAGE, STUDIO_URL } from "./cli.mjs";
+import { OMNI_DIR, checkDeps, ensureDeps } from "./deps.mjs";
 import { readTokens } from "./oauth-client.mjs";
 import { CODE_ROOT, DATA_ROOT } from "./paths.mjs";
 import { PLIST, service, serviceInstall } from "./service.mjs";
 
-export const OMNI_DIR = join(homedir(), ".omni");
 const LOGIN_EVERY_MS = 60 * 60_000;
 
 const isDev = (/** @type {string} */ codeRoot) => existsSync(join(codeRoot, ".git"));
@@ -82,26 +83,31 @@ export function ensureApp(log = () => {}, codeRoot = CODE_ROOT) {
   return installed;
 }
 
-/** the venv of the Python tools, inside the app; on a hook in the background, logging to ~/.omni/venv.log
- *  @returns {"ok" | "started" | "creating" | "failed"} */
-export function ensureVenv(codeRoot = CODE_ROOT, { background = false } = {}) {
-  if (existsSync(join(codeRoot, ".venv", "bin", "python"))) return "ok";
-  const lock = join(OMNI_DIR, "venv.lock");
+/** the programs the pipeline runs (tools/lib/deps.mjs), fetched by a process of its own on a hook so the
+ *  session never waits; logs in ~/.omni/deps.log
+ *  @returns {"ok" | "started" | "running" | string} "ok", or what is still missing */
+export function ensureTools(codeRoot = CODE_ROOT, { background = false } = {}) {
+  const c = checkDeps(codeRoot);
+  const missing = Object.entries(c)
+    .filter(([, v]) => !v)
+    .map(([k]) => k);
+  if (!missing.length) return "ok";
   mkdirSync(OMNI_DIR, { recursive: true });
+  const lock = join(OMNI_DIR, "deps.lock");
   try {
-    if (Date.now() - statSync(lock).mtimeMs < 15 * 60_000) return "creating";
+    if (Date.now() - statSync(lock).mtimeMs < 15 * 60_000) return "running";
   } catch {
-    /* no one is creating it */
+    /* no one is fetching them */
   }
+  if (!background) return missing.join(", ");
   writeFileSync(lock, String(process.pid));
-  const script = `python3 -m venv .venv && .venv/bin/python -m pip install -q -r requirements.txt; rm -f "${lock}"`;
-  if (background) {
-    const out = join(OMNI_DIR, "venv.log");
-    spawn("/bin/sh", ["-c", `${script} >> "${out}" 2>&1`], { cwd: codeRoot, detached: true, stdio: "ignore" }).unref();
-    return "started";
-  }
-  const r = spawnSync("/bin/sh", ["-c", script], { cwd: codeRoot, stdio: "inherit" });
-  return r.status === 0 ? "ok" : "failed";
+  const out = openSync(join(OMNI_DIR, "deps.log"), "a");
+  spawn(process.execPath, [join(codeRoot, "tools", "omni.mjs"), "deps", "install", "--unlock"], {
+    detached: true,
+    stdio: ["ignore", out, out],
+    env: { ...process.env, OMNI_HOME: DATA_ROOT },
+  }).unref();
+  return "started";
 }
 
 /** opens the browser on the approval page in a process of its own, at most once an hour
@@ -140,15 +146,23 @@ function devServiceRoot() {
  */
 export async function up({ hook = false, log = () => {} } = {}) {
   const notes = [];
+  /* the session's Claude Code folder, for the studio service: its settings and its default agent account */
+  if (hook) recordClaudeDir();
   if (ensureWorkspace()) notes.push(`workspace criado em ${DATA_ROOT}`);
   const codeRoot = ensureApp(log);
   const dev = isDev(codeRoot);
   const url = studioUrlOf();
 
+  /* ffmpeg, the Chrome without a window and Python, in ~/.omni: in the background on a hook, here otherwise */
   if (!dev) {
-    const venv = ensureVenv(codeRoot, { background: hook });
-    if (venv === "started" || venv === "creating") notes.push("preparando o Python das ferramentas de voz");
-    if (venv === "failed") notes.push("o Python das ferramentas não instalou (veja ~/.omni/venv.log)");
+    if (hook) {
+      const tools = ensureTools(codeRoot, { background: true });
+      if (tools === "started" || tools === "running")
+        notes.push("baixando o ffmpeg, o Chrome sem janela, o Python e o yt-dlp (alguns minutos)");
+    } else {
+      const r = await ensureDeps(codeRoot, { log });
+      if (!r.ok) notes.push(`faltou preparar ${r.missing.join(", ")}: ${r.errors.join("; ")}`);
+    }
   }
 
   const loggedIn = !!readTokens(url);

package/tools/omni.mjs

@@ -12,7 +12,8 @@
      omni logout                 signs this computer out in the cloud and here
      omni allow [--yes]          the Claude Code permission rules the skills need (asks first)
      omni setup                  login, the rules and up, for whoever starts from a terminal
-     omni doctor                 the system programs and keys (tools/setup.mjs check)
+     omni doctor [--json]        whether ffmpeg, ffprobe, the Chrome without a window, Python and yt-dlp answer
+     omni deps install           fetches whichever of them doesn't answer into ~/.omni (tools/lib/deps.mjs)
      omni skill <nome> [--v <versão>] [--part i/n]
                                  one part of a skill's body from the registry (tools/lib/skill-client.mjs)
      omni run <ferramenta> [args…]
@@ -21,12 +22,13 @@
    ============================================================================ */
 
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, rmSync } from "node:fs";
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { allowSkillRules, missingRules, settingsFile } from "./lib/claude-settings.mjs";
 import { CLI_COMMAND, STUDIO_URL } from "./lib/cli.mjs";
+import { OMNI_DIR, checkDeps, depsEnv, ensureDeps } from "./lib/deps.mjs";
 import { serveMcp } from "./lib/mcp-server.mjs";
 import { accessToken, login, logout, readTokens } from "./lib/oauth-client.mjs";
 import { CODE_ROOT, DATA_ROOT, isMainModule } from "./lib/paths.mjs";
@@ -87,6 +89,12 @@ async function statusText(url) {
       ? "O studio deste computador está ligado e atende o studio hospedado."
       : "O studio deste computador está desligado.",
   );
+  const missing = depsMissing();
+  lines.push(
+    missing.length
+      ? `Ainda preparando os programas do pipeline (faltam: ${missing.join(", ")}); o omni up baixa sozinho, ou chame-o de novo se demorar mais de 10 minutos.`
+      : "O computador está pronto: ffmpeg, ffprobe, o Chrome sem janela, o Python e o yt-dlp respondem.",
+  );
   const rules = missingRules();
   lines.push(
     rules.length
@@ -97,6 +105,13 @@ async function statusText(url) {
   return lines.join("\n");
 }
 
+/** which of the pipeline's programs don't answer (tools/lib/deps.mjs), by the name the user knows */
+const DEP_NAMES = { chrome: "Chrome sem janela", python: "Python", ytdlp: "yt-dlp" };
+const depsMissing = () =>
+  Object.entries(checkDeps(CODE_ROOT))
+    .filter(([, v]) => !v)
+    .map(([k]) => DEP_NAMES[/** @type {keyof typeof DEP_NAMES} */ (k)] ?? k);
+
 /** the plugin's MCP tools  @param {string} url */
 const mcpTools = url => [
   {
@@ -194,17 +209,38 @@ export async function main(args) {
     if (!bin) fail(`não existe a ferramenta ${tool}`);
     const r = spawnSync(/** @type {string} */ (bin), [/** @type {string} */ (script), ...rest], {
       stdio: "inherit",
-      env: { ...process.env, OMNI_HOME: DATA_ROOT },
+      env: { ...process.env, ...depsEnv(), OMNI_HOME: DATA_ROOT },
     });
     process.exit(r.status ?? 1);
   }
 
   if (cmd === "doctor") {
-    const r = spawnSync(process.execPath, [join(CODE_ROOT, "tools", "setup.mjs"), "check"], {
-      stdio: "inherit",
-      env: { ...process.env, OMNI_HOME: DATA_ROOT },
-    });
-    process.exit(r.status ?? 1);
+    const c = checkDeps(CODE_ROOT);
+    if (args.includes("--json")) return console.log(JSON.stringify(c));
+    const names = {
+      ffmpeg: "ffmpeg",
+      ffprobe: "ffprobe",
+      chrome: "Chrome sem janela",
+      python: "Python das ferramentas",
+      ytdlp: "yt-dlp (estilo visual por link)",
+    };
+    for (const [k, v] of Object.entries(c))
+      console.log(`${v ? "ok   " : "falta"} ${names[/** @type {keyof typeof names} */ (k)]}${v ? `: ${v}` : ""}`);
+    if (Object.values(c).some(v => !v)) console.log(`Para baixar o que falta: ${CLI_COMMAND} deps install`);
+    return;
+  }
+
+  if (cmd === "deps" && args[1] === "install") {
+    const r = await ensureDeps(CODE_ROOT, { log: line => console.log(line) });
+    /* the background run of `omni up --hook` holds this lock while it fetches */
+    if (args.includes("--unlock")) rmSync(join(OMNI_DIR, "deps.lock"), { force: true });
+    console.log(
+      r.ok
+        ? "Tudo pronto: ffmpeg, ffprobe, o Chrome sem janela, o Python e o yt-dlp respondem."
+        : `Faltou: ${r.errors.join("; ")}`,
+    );
+    if (!r.ok) process.exit(1);
+    return;
   }
 
   const url = studioUrl();
@@ -291,7 +327,7 @@ export async function main(args) {
   }
 
   fail(
-    "uso: omni up [--hook] | login | status [--json] | logout | allow [--yes] | setup | doctor | skill <nome> | run <ferramenta> … | mcp",
+    "uso: omni up [--hook] | login | status [--json] | logout | allow [--yes] | setup | doctor | deps install | skill <nome> | run <ferramenta> … | mcp",
   );
 }
 

package/tools/omnichat.mjs

@@ -72,7 +72,7 @@
      node tools/omnichat.mjs webhook setup | subscribe | status | serve [--port 5434]
          the messaging webhook that the button and the follow gate need: `setup` creates the verify token and says
          what to paste in the Meta panel, `subscribe` signs the account up to messages and postbacks, `serve` listens
-         (behind a tunnel: cloudflared tunnel --url http://127.0.0.1:5434)
+         here for a test (the Callback URL is the cloud Worker's /webhook)
      node tools/omnichat.mjs cloud status | push [videos/<slug>] [--records] [--force] | pull videos/<slug>
          the Worker in cloud/omnichat (cloud.url in the config, OMNICHAT_CLOUD_SECRET in the .env):
          `push` sends the config, the Instagram account and the rules (with --records, the local records too,
@@ -1284,9 +1284,8 @@ async function cloudCmd(sub) {
 /* --- the messaging webhook: the button's tap and the follow gate ------------------------------
    The comment's DM opens with a button (rule.button / rule.require_follow). The tap reaches here as a
    `messaging_postbacks` event; handleTap (tools/lib/omnichat/gate.mjs) checks the criterion and sends the
-   link, or asks to follow. Meta needs a public HTTPS callback URL: `serve` listens on this machine and a
-   tunnel (cloudflared) exposes it while the Mac is awake. A webhook handled elsewhere (a cloud function)
-   uses the same handleWebhook. The record is written under the pass lock, so the agent and the tap
+   link, or asks to follow. Meta needs a public HTTPS callback URL: the cloud Worker's /webhook
+   (cloud/omnichat), which runs the same handleWebhook; `serve` listens on this machine for a test. The record is written under the pass lock, so the agent and the tap
    don't overwrite each other. */
 const WEBHOOK_PORT = 5434;
 const gatedRules = () => videosWithRule().filter(d => gateOn(ruleOf(d) ?? {}));
@@ -1337,10 +1336,9 @@ async function webhook(sub) {
     console.log("✓ INSTAGRAM_WEBHOOK_VERIFY_TOKEN no .env");
     console.log(`
 Faltam estes passos, uma vez só:
-  1. Expor a porta ${port}: node tools/omnichat.mjs webhook serve   e, em outro terminal,
-     cloudflared tunnel --url http://127.0.0.1:${port}   (anote a URL https://….trycloudflare.com)
+  1. A cloud no ar (cloud/omnichat, reference/omnichat.md): é ela que recebe o webhook.
   2. developers.facebook.com/apps → seu app → Instagram → API setup with Instagram login → Configure webhooks:
-       Callback URL:  <a URL do túnel>/webhook
+       Callback URL:  ${cloudSettings().url || "https://omnichat.<você>.workers.dev"}/webhook
        Verify token:  ${token}
      e ligue os campos messages e messaging_postbacks.
   3. node tools/omnichat.mjs webhook subscribe   (inscreve a conta nesses campos)

package/tools/package.mjs

@@ -4,11 +4,12 @@
    this repo into .release/npm/ and packed as a .tgz. It carries the code a user's machine runs (the CLI,
    the pipeline tools, the templates and guides, the studio's API, runner and web) and nothing of the
    skills, which come from the registry. The studio runs on the `bun` dependency, so a machine needs Node,
-   not Bun; Python's venv is made by `omni up`.
+   not Bun; ffmpeg, the Chrome without a window and Python are fetched by `omni up` (tools/lib/deps.mjs).
 
      node tools/package.mjs [--version <x.y.z>]     builds and packs; prints the .tgz path
-     node tools/package.mjs publish [--version …]   builds, packs and publishes to npm with the account in
-                                                    NPM_CONFIG_USERCONFIG (e.g. ~/.npmrc-pedroflp)
+     node tools/package.mjs publish [--version …]   builds, packs and publishes to npm: in CI through npm's
+                                                    trusted publishing (.github/workflows/deploy.yml), by
+                                                    hand with the account in NPM_CONFIG_USERCONFIG
 
    Try it before publishing: npm install --prefix /tmp/omni-test <the .tgz>, then
    /tmp/omni-test/node_modules/.bin/omni status
@@ -93,8 +94,8 @@ function build() {
     os: ["darwin"],
     license: "UNLICENSED",
     homepage: "https://omni.crievo.com",
-    /* the studio's runtime libraries, plus the bun that runs it */
-    dependencies: { ...studio.dependencies, bun: "1.4.3" },
+    /* the studio's runtime libraries, the bun that runs it, and what fetches the Chrome without a window */
+    dependencies: { ...studio.dependencies, bun: "1.4.3", "@puppeteer/browsers": "3.2.3" },
   };
   writeFileSync(join(PKG, "package.json"), `${JSON.stringify(pkg, null, 2)}\n`);
   writeFileSync(
@@ -120,7 +121,8 @@ const tgz = join(OUT, packed.stdout.trim().split("\n").at(-1) ?? "");
 console.log(`${PACKAGE}@${v}: ${(size(PKG) / 1e6).toFixed(1)} MB de arquivos, pacote em ${tgz}`);
 
 if (args[0] === "publish") {
-  if (!process.env.NPM_CONFIG_USERCONFIG)
+  /* CI publishes through npm's trusted publishing (OIDC); by hand, with the account's own login file */
+  if (!process.env.NPM_CONFIG_USERCONFIG && !process.env.GITHUB_ACTIONS)
     fail("defina NPM_CONFIG_USERCONFIG com o login da conta que publica (ex.: ~/.npmrc-pedroflp)");
   const r = spawnSync("npm", ["publish", tgz, "--access", "public", ...(v.includes("-") ? ["--tag", "next"] : [])], {
     stdio: "inherit",