@crievo/omni 0.1.2 → 0.1.4

package/studio/web/styles/index.css

@@ -114,3 +114,26 @@
 @import "./pages/agent.css";
 @import "./components/omni.css";
 @import "./components/omni-cards.css";
+
+/* Bencho ports (the /bencho gallery): its own palette, the page, then one file per component */
+@import "./components/bencho/tokens.css";
+@import "./components/bencho/scope.css";
+@import "./components/bencho/gallery.css";
+@import "./components/bencho/pull.css";
+@import "./components/bencho/liq-toggle.css";
+@import "./components/bencho/checklist.css";
+@import "./components/bencho/sound.css";
+@import "./components/bencho/dock.css";
+@import "./components/bencho/slosh.css";
+@import "./components/bencho/liq-create.css";
+@import "./components/bencho/picker.css";
+@import "./components/bencho/slide-confirm.css";
+@import "./components/bencho/image-accordion.css";
+@import "./components/bencho/action-node.css";
+@import "./components/bencho/generate.css";
+@import "./components/bencho/one-time-code.css";
+@import "./components/bencho/upload-dropzone.css";
+@import "./components/bencho/voice-note.css";
+@import "./components/bencho/toast-stack.css";
+@import "./components/toaster.css";
+@import "./components/bencho/stacked-bars.css";

package/studio/web/styles/pages/getting-started.css

@@ -164,3 +164,49 @@
     padding-left: 16px;
   }
 }
+
+/* --- "Este computador": what the CLI is still preparing, live -------------------------------- */
+.onboarding-computer {
+  margin: 16px 0 4px;
+  padding: 14px 16px 16px;
+  border-radius: var(--radius);
+  background: var(--surface);
+}
+.onboarding-computer.ok {
+  background: var(--ok-bg);
+}
+.onboarding-computer > header {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 10px;
+}
+.onboarding-computer h2 {
+  margin: 0;
+  font-size: 15px;
+  font-weight: 600;
+}
+.onboarding-computer > p {
+  margin: 0 0 12px;
+  font-size: 13px;
+}
+.onboarding-computer .badge .spinning {
+  width: 10px;
+  height: 10px;
+  border-width: 1.5px;
+}
+.onboarding-computer .onboarding-items li.preparing .onboarding-item-mark {
+  background: none;
+}
+.onboarding-computer .onboarding-items li.preparing .spinning {
+  width: 12px;
+  height: 12px;
+}
+.onboarding-ask {
+  padding: 10px 12px;
+  border-radius: var(--radius-sm);
+  background: var(--warning-bg);
+}
+.onboarding-ask q {
+  font-weight: 600;
+}

package/studio/web/styles/pages/settings/shell.css

@@ -359,3 +359,7 @@
   flex: 1;
   min-width: 0;
 }
+/* the default Claude Code without a login: the sentence above the folder field */
+.agent-missing small {
+  flex-basis: 100%;
+}

package/studio/web/styles/pages/video/layout.css

@@ -41,10 +41,7 @@
   padding: 4px 24px;
   background: none;
   border-bottom: 1px solid var(--border);
-  overflow-x: auto;
-}
-.rail .stepper {
-  min-width: 900px;
+  /* no scroll box: the stage cards' fans hang below the rail and a scroller would clip them; the cards wrap instead */
 }
 /* sentinel at the rail's natural position (takes no space): when it leaves through the top, the rail
    is stuck and gets the panel background */

package/studio/web/styles/pages/video/sound-timeline.css

@@ -244,6 +244,9 @@
   position: absolute;
   left: 6px;
   top: 4px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
 }
 .sound-header {
   position: absolute;
@@ -670,3 +673,8 @@
   border-top-color: transparent;
   animation: spin 0.8s linear infinite;
 }
+.sound-add-buttons {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}

package/studio/web/styles/theme/identity/shell.css

@@ -89,44 +89,28 @@ main.with-sidebar {
   background: var(--el-nav-active-bg);
   color: var(--el-nav-active-text);
 }
-/* the "Criar vídeo" + inside the Videos row */
+/* the "Criar" pill (components/bencho/CreateMenu) inside the Conteúdos row: it sits over the link at the right edge, as a
+   sibling (a button inside <a> is not valid HTML), and its menu hangs from the pill's top right corner. Out of flow,
+   centred on the row by margin rather than a transform: a transformed box would be a stacking context of its own. */
 .menu .menu-item-with-action {
   position: relative;
   display: flex;
   flex-direction: column;
 }
 .menu .menu-item-with-action > a {
-  padding-right: 36px;
+  padding-right: 100px;
 }
-.menu .menu-action {
+.menu .menu-create {
   position: absolute;
   top: 50%;
-  right: 4px;
-  transform: translateY(-50%);
-  display: inline-flex;
-  align-items: center;
-  gap: 4px;
-  height: 24px;
-  padding: 0 8px 0 6px;
-  font: 500 12px / 1 var(--sans);
-  border: 0;
-  border-radius: var(--el-radius-nav);
-  background: transparent;
-  color: var(--text-2);
-  cursor: pointer;
-}
-.menu .menu-action svg {
-  width: 12px;
-  height: 12px;
-}
-.menu .menu-action:hover,
-.menu .menu-action:focus-visible {
-  background: var(--surface-2);
-  color: var(--text);
+  right: 3px;
+  margin-top: calc(var(--pill-h) / -2);
 }
 @media (max-width: 900px) {
   .menu {
     width: auto;
+    /* the bar has no fixed height to scroll in, and the create menu hangs below it */
+    overflow: visible;
   }
   .brand {
     margin-bottom: 0;
@@ -213,7 +197,7 @@ main.with-sidebar {
   }
   .menu-collapsed .brand-omni,
   .menu-collapsed .menu-label,
-  .menu-collapsed .menu-action {
+  .menu-collapsed .menu-create {
     display: none;
   }
   .menu-collapsed .menu-group-name {

package/tools/lib/agents.mjs

@@ -8,20 +8,28 @@
      a session stays on the account it runs on while that one is free.
    - Limit: an account that hits its usage limit is set aside until it resets
      (`.accounts/state.json`), and the work goes on in the next free one.
-   - ~/.claude (Claude Code's default account, which may be the work one) is
-     refused here, whatever the config says.
+   - Empty list: the Claude Code this machine uses, the folder the plugin's hook
+     recorded (claude-settings.mjs), else ~/.claude. Without a login there the
+     studio says so and the user puts the right folder in Settings. A machine
+     that must stay off ~/.claude (a work account) lists its accounts.
+   - ~/.claude is Claude Code's own folder: its login is ~/.claude.json and the
+     child runs without CLAUDE_CONFIG_DIR (set to it, Claude Code looks for
+     another keychain entry and finds no login).
    ============================================================================ */
 
 import { cpSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { delimiter, join, resolve } from "node:path";
+import { DEFAULT_CLAUDE_DIR, recordedClaudeDir } from "./claude-settings.mjs";
 
 export const PROVIDERS = ["claude", "codex"];
 export const PROVIDER_LABEL = { claude: "Claude", codex: "Codex" };
-/* the one dir no account may use */
-export const FORBIDDEN_DIR = join(homedir(), ".claude");
-/* before `agents` existed, the studio only ran here */
-export const DEFAULT_ACCOUNTS = [{ id: "claude-personal", provider: "claude", dir: "~/.claude-personal" }];
+/* with no list: the Claude Code this machine uses */
+export const defaultAccounts = () => [
+  { id: "claude", provider: "claude", dir: recordedClaudeDir() ?? DEFAULT_CLAUDE_DIR },
+];
+/* Claude Code's own folder, which runs without CLAUDE_CONFIG_DIR */
+const isDefaultClaude = a => a.provider === "claude" && expandHome(a.dir) === DEFAULT_CLAUDE_DIR;
 /* the Codex CLI the ChatGPT app ships, when there is no `codex` on the PATH */
 export const CODEX_APP_BIN = "/Applications/ChatGPT.app/Contents/Resources/codex-cli/bin/codex";
 export const CODEX_DEFAULTS = { model: "gpt-6-luna", effort: "medium", sandbox: "auto" };
@@ -70,8 +78,6 @@ export function accountProblem(a) {
   if (!PROVIDERS.includes(a?.provider)) return `provedor desconhecido: ${a?.provider}`;
   if (!String(a.dir ?? "").trim()) return "falta a pasta da conta";
   const dir = expandHome(a.dir);
-  if (dir === FORBIDDEN_DIR || dir.startsWith(`${FORBIDDEN_DIR}/`))
-    return "o ~/.claude é a conta padrão do Claude Code (pode ser a do trabalho): o omnivideo não roda nela";
   if (dir === homedir()) return "a pasta da conta não pode ser a home";
   return null;
 }
@@ -84,12 +90,13 @@ const slug = s =>
     .replace(/^-|-$/g, "") || "conta";
 
 /**
- * The accounts in order, normalized: `dir` absolute, `id` unique, the forbidden ones left out.
- * @returns {{ id: string, provider: "claude"|"codex", dir: string, label: string, enabled: boolean }[]}
+ * The accounts in order, normalized: `dir` absolute, `id` unique, the invalid ones left out. `implicit`:
+ * the default account, from an empty list.
+ * @returns {{ id: string, provider: "claude"|"codex", dir: string, label: string, enabled: boolean, implicit: boolean }[]}
  */
 export function accountsOf(cfg) {
-  const raw =
-    Array.isArray(cfg?.agents?.accounts) && cfg.agents.accounts.length ? cfg.agents.accounts : DEFAULT_ACCOUNTS;
+  const listed = Array.isArray(cfg?.agents?.accounts) && cfg.agents.accounts.length > 0;
+  const raw = listed ? cfg.agents.accounts : defaultAccounts();
   const seen = new Set();
   const out = [];
   for (const a of raw) {
@@ -105,6 +112,7 @@ export function accountsOf(cfg) {
       dir,
       label: String(a.label ?? "").trim() || tildify(dir),
       enabled: a.enabled !== false,
+      implicit: !listed,
     });
   }
   return out;
@@ -151,7 +159,8 @@ const jwtPayload = token => {
  */
 export function loginOf(a) {
   if (a.provider === "claude") {
-    const o = readJson(join(a.dir, ".claude.json"))?.oauthAccount;
+    const file = isDefaultClaude(a) ? join(homedir(), ".claude.json") : join(a.dir, ".claude.json");
+    const o = readJson(file)?.oauthAccount;
     if (!o) return null;
     const org =
       o.organizationName && o.organizationName !== `${o.emailAddress}'s Organization` ? o.organizationName : null;
@@ -171,6 +180,7 @@ export function loginOf(a) {
 /* the command that logs an account in, for the screen and the CLI hints */
 export function loginCommand(a, cfg) {
   const dir = tildify(a.dir);
+  if (isDefaultClaude(a)) return "claude auth login";
   return a.provider === "claude"
     ? `CLAUDE_CONFIG_DIR=${dir} claude auth login`
     : `CODEX_HOME=${dir} ${codexBin(cfg) === "codex" ? "codex" : `"${codexBin(cfg)}"`} login`;
@@ -194,6 +204,7 @@ export const binOf = (a, cfg) => (a.provider === "claude" ? claudeBin(cfg) : cod
 export function envFor(a, base = process.env, extra = {}) {
   const env = { ...base, ...extra };
   for (const k of INHERITED) delete env[k];
+  if (isDefaultClaude(a)) return env;
   if (a.provider === "claude") env.CLAUDE_CONFIG_DIR = a.dir;
   else env.CODEX_HOME = a.dir;
   return env;

package/tools/lib/claude-settings.mjs

@@ -3,15 +3,44 @@
    call `<cli> run …` through Bash, and their sibling files sit in a temporary folder outside the working
    one. Written only with the user's yes (the MCP's omni_allow_skills, after Claude asks, or `omni setup`).
 
-   The settings file is $CLAUDE_CONFIG_DIR/settings.json, else ~/.claude/settings.json. The rules are added
-   to permissions.allow; nothing else in the file changes. */
+   The settings file is settings.json in the Claude Code folder (claudeConfigDir). The rules are added to
+   permissions.allow; nothing else in the file changes.
+
+   The Claude Code folder is $CLAUDE_CONFIG_DIR, else the one `omni up --hook` recorded in ~/.omni/claude.json,
+   else ~/.claude. The hook runs inside the user's session, with its CLAUDE_CONFIG_DIR; the studio service
+   runs outside it and only knows the folder through that record. */
 
 import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { CLI_COMMAND } from "./cli.mjs";
+import { OMNI_DIR } from "./deps.mjs";
+
+/* Claude Code's own folder when CLAUDE_CONFIG_DIR is unset (its login then sits in ~/.claude.json) */
+export const DEFAULT_CLAUDE_DIR = join(homedir(), ".claude");
+const RECORD = join(OMNI_DIR, "claude.json");
+
+/** the folder the hook recorded, or null  @returns {string | null} */
+export function recordedClaudeDir() {
+  try {
+    const dir = JSON.parse(readFileSync(RECORD, "utf8")).config_dir;
+    return typeof dir === "string" && dir ? dir : null;
+  } catch {
+    return null;
+  }
+}
+
+/** records the session's Claude Code folder (on the hook only: a terminal may lack the variable)
+ *  @returns {boolean} whether it changed */
+export function recordClaudeDir(dir = process.env.CLAUDE_CONFIG_DIR || DEFAULT_CLAUDE_DIR) {
+  if (recordedClaudeDir() === dir) return false;
+  mkdirSync(OMNI_DIR, { recursive: true });
+  writeFileSync(RECORD, `${JSON.stringify({ config_dir: dir }, null, 2)}\n`);
+  return true;
+}
 
-export const settingsFile = () => join(process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude"), "settings.json");
+export const claudeConfigDir = () => process.env.CLAUDE_CONFIG_DIR || recordedClaudeDir() || DEFAULT_CLAUDE_DIR;
+export const settingsFile = () => join(claudeConfigDir(), "settings.json");
 
 /** the rules, for this CLI command and this machine's temporary folder (both spellings of it on macOS) */
 export function skillRules(cli = CLI_COMMAND) {

package/tools/lib/deps.mjs

@@ -7,6 +7,8 @@
                        takes it from CHROME_PATH
      python            uv (UV_VERSION, in ~/.omni/bin) makes the app's .venv with a Python of its own and
                        installs requirements.txt into it
+     yt-dlp            the project's standalone build (YTDLP_RELEASE), in ~/.omni/bin: a visual style from a
+                       link (tools/reference.mjs). Sites change often, so bump the release when a download breaks
 
    Each piece is checked by running it, and only fetched when it doesn't answer, so `omni up` can call
    ensureDeps on every session. What was installed goes in ~/.omni/deps.json; depsEnv() is the PATH and
@@ -34,6 +36,7 @@ export const BIN_DIR = join(OMNI_DIR, "bin");
 const STATE = join(OMNI_DIR, "deps.json");
 export const FFMPEG_RELEASE = "b6.1.1";
 export const UV_VERSION = "0.12.21";
+export const YTDLP_RELEASE = "2026.08.19";
 const PYTHON_VERSION = "3.12";
 
 const win = process.platform === "win32";
@@ -128,6 +131,25 @@ export async function ensureChrome() {
   return got.executablePath;
 }
 
+/* --- yt-dlp ----------------------------------------------------------------------------- */
+
+/** the release asset for this machine: one universal macOS build, Linux per arch, Windows per arch */
+export function ytdlpAsset(platform = process.platform, cpu = process.arch) {
+  if (platform === "darwin") return "yt-dlp_macos";
+  if (platform === "win32") return cpu === "arm64" ? "yt-dlp_arm64.exe" : "yt-dlp.exe";
+  return cpu === "arm64" ? "yt-dlp_linux_aarch64" : "yt-dlp_linux";
+}
+
+export async function ensureYtdlp() {
+  /* one already on the PATH (a development checkout's Homebrew) serves as well */
+  if (answers("yt-dlp", ["--version"])) return;
+  const file = join(BIN_DIR, exe("yt-dlp"));
+  if (existsSync(file) && answers(file, ["--version"])) return;
+  const url = `https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_RELEASE}/${ytdlpAsset()}`;
+  install(file, await fetchBytes(url));
+  if (!answers(file, ["--version"])) throw new Error("o yt-dlp baixado não roda neste computador");
+}
+
 /* --- uv and the Python venv -------------------------------------------------------------- */
 
 async function ensureUv() {
@@ -204,6 +226,7 @@ export function checkDeps(codeRoot) {
     python: existsSync(python)
       ? answers(python, ["-c", "import numpy, soundfile, requests; print('ok')"]) && python
       : null,
+    ytdlp: on("yt-dlp", ["--version"]),
   };
 }
 
@@ -219,6 +242,7 @@ export async function ensureDeps(codeRoot, { log = () => {} } = {}) {
     ["ffmpeg", () => ensureFfmpeg()],
     ["Chrome sem janela", () => ensureChrome()],
     ["Python", () => ensurePython(codeRoot)],
+    ["yt-dlp", () => ensureYtdlp()],
   ]);
   for (const [name, run] of steps) {
     try {

package/tools/lib/platforms/instagram.mjs

@@ -355,7 +355,7 @@ export function instagramClient({ token, apiVersion, ...deps }) {
 /**
  * Publishes a Reel from a public video URL (and an optional public cover URL).
  * With Instagram login Meta downloads the file itself: the caller provides the
- * URLs (a local tunnel on the CLI, object storage in the cloud) and `release`,
+ * URLs (R2 behind the cloud Worker's /media, for the CLI and the cloud alike) and `release`,
  * called once Instagram has finished downloading.
  * @param {{ client: InstagramClient, userId: string, videoUrl: string, coverUrl?: string | null,
  *   cover?: { version: string } | null, caption: string, shareToFeed: boolean, coverAtS?: number | null,

package/tools/lib/up.mjs

@@ -8,6 +8,7 @@
      tools       ffmpeg, the Chrome without a window and Python in ~/.omni (tools/lib/deps.mjs; in the
                  background on a hook)
      login       none yet: the browser opens on the approval page (at most once an hour)
+     claude      on a hook, the session's Claude Code folder into ~/.omni/claude.json (claude-settings.mjs)
      service     the studio as a launchd agent, from the app, so the hosted studio reaches this Mac
 
    In this repo (a git checkout) the app, the tools and the service are left to `tools/setup.mjs` and
@@ -16,7 +17,7 @@
 import { spawn, spawnSync } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, openSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { missingRules } from "./claude-settings.mjs";
+import { missingRules, recordClaudeDir } from "./claude-settings.mjs";
 import { CLI_COMMAND, PACKAGE, STUDIO_URL } from "./cli.mjs";
 import { OMNI_DIR, checkDeps, ensureDeps } from "./deps.mjs";
 import { readTokens } from "./oauth-client.mjs";
@@ -145,6 +146,8 @@ function devServiceRoot() {
  */
 export async function up({ hook = false, log = () => {} } = {}) {
   const notes = [];
+  /* the session's Claude Code folder, for the studio service: its settings and its default agent account */
+  if (hook) recordClaudeDir();
   if (ensureWorkspace()) notes.push(`workspace criado em ${DATA_ROOT}`);
   const codeRoot = ensureApp(log);
   const dev = isDev(codeRoot);
@@ -155,7 +158,7 @@ export async function up({ hook = false, log = () => {} } = {}) {
     if (hook) {
       const tools = ensureTools(codeRoot, { background: true });
       if (tools === "started" || tools === "running")
-        notes.push("baixando o ffmpeg, o Chrome sem janela e o Python (alguns minutos)");
+        notes.push("baixando o ffmpeg, o Chrome sem janela, o Python e o yt-dlp (alguns minutos)");
     } else {
       const r = await ensureDeps(codeRoot, { log });
       if (!r.ok) notes.push(`faltou preparar ${r.missing.join(", ")}: ${r.errors.join("; ")}`);

package/tools/omni.mjs

@@ -12,7 +12,7 @@
      omni logout                 signs this computer out in the cloud and here
      omni allow [--yes]          the Claude Code permission rules the skills need (asks first)
      omni setup                  login, the rules and up, for whoever starts from a terminal
-     omni doctor [--json]        whether ffmpeg, ffprobe, the Chrome without a window and Python answer
+     omni doctor [--json]        whether ffmpeg, ffprobe, the Chrome without a window, Python and yt-dlp answer
      omni deps install           fetches whichever of them doesn't answer into ~/.omni (tools/lib/deps.mjs)
      omni skill <nome> [--v <versão>] [--part i/n]
                                  one part of a skill's body from the registry (tools/lib/skill-client.mjs)
@@ -93,7 +93,7 @@ async function statusText(url) {
   lines.push(
     missing.length
       ? `Ainda preparando os programas do pipeline (faltam: ${missing.join(", ")}); o omni up baixa sozinho, ou chame-o de novo se demorar mais de 10 minutos.`
-      : "O computador está pronto: ffmpeg, ffprobe, o Chrome sem janela e o Python respondem.",
+      : "O computador está pronto: ffmpeg, ffprobe, o Chrome sem janela, o Python e o yt-dlp respondem.",
   );
   const rules = missingRules();
   lines.push(
@@ -105,11 +105,12 @@ async function statusText(url) {
   return lines.join("\n");
 }
 
-/** which of the pipeline's programs don't answer (tools/lib/deps.mjs) */
+/** which of the pipeline's programs don't answer (tools/lib/deps.mjs), by the name the user knows */
+const DEP_NAMES = { chrome: "Chrome sem janela", python: "Python", ytdlp: "yt-dlp" };
 const depsMissing = () =>
   Object.entries(checkDeps(CODE_ROOT))
     .filter(([, v]) => !v)
-    .map(([k]) => k);
+    .map(([k]) => DEP_NAMES[/** @type {keyof typeof DEP_NAMES} */ (k)] ?? k);
 
 /** the plugin's MCP tools  @param {string} url */
 const mcpTools = url => [
@@ -221,6 +222,7 @@ export async function main(args) {
       ffprobe: "ffprobe",
       chrome: "Chrome sem janela",
       python: "Python das ferramentas",
+      ytdlp: "yt-dlp (estilo visual por link)",
     };
     for (const [k, v] of Object.entries(c))
       console.log(`${v ? "ok   " : "falta"} ${names[/** @type {keyof typeof names} */ (k)]}${v ? `: ${v}` : ""}`);
@@ -234,7 +236,7 @@ export async function main(args) {
     if (args.includes("--unlock")) rmSync(join(OMNI_DIR, "deps.lock"), { force: true });
     console.log(
       r.ok
-        ? "Tudo pronto: ffmpeg, ffprobe, o Chrome sem janela e o Python respondem."
+        ? "Tudo pronto: ffmpeg, ffprobe, o Chrome sem janela, o Python e o yt-dlp respondem."
         : `Faltou: ${r.errors.join("; ")}`,
     );
     if (!r.ok) process.exit(1);

package/tools/omnichat.mjs

@@ -72,7 +72,7 @@
      node tools/omnichat.mjs webhook setup | subscribe | status | serve [--port 5434]
          the messaging webhook that the button and the follow gate need: `setup` creates the verify token and says
          what to paste in the Meta panel, `subscribe` signs the account up to messages and postbacks, `serve` listens
-         (behind a tunnel: cloudflared tunnel --url http://127.0.0.1:5434)
+         here for a test (the Callback URL is the cloud Worker's /webhook)
      node tools/omnichat.mjs cloud status | push [videos/<slug>] [--records] [--force] | pull videos/<slug>
          the Worker in cloud/omnichat (cloud.url in the config, OMNICHAT_CLOUD_SECRET in the .env):
          `push` sends the config, the Instagram account and the rules (with --records, the local records too,
@@ -1284,9 +1284,8 @@ async function cloudCmd(sub) {
 /* --- the messaging webhook: the button's tap and the follow gate ------------------------------
    The comment's DM opens with a button (rule.button / rule.require_follow). The tap reaches here as a
    `messaging_postbacks` event; handleTap (tools/lib/omnichat/gate.mjs) checks the criterion and sends the
-   link, or asks to follow. Meta needs a public HTTPS callback URL: `serve` listens on this machine and a
-   tunnel (cloudflared) exposes it while the Mac is awake. A webhook handled elsewhere (a cloud function)
-   uses the same handleWebhook. The record is written under the pass lock, so the agent and the tap
+   link, or asks to follow. Meta needs a public HTTPS callback URL: the cloud Worker's /webhook
+   (cloud/omnichat), which runs the same handleWebhook; `serve` listens on this machine for a test. The record is written under the pass lock, so the agent and the tap
    don't overwrite each other. */
 const WEBHOOK_PORT = 5434;
 const gatedRules = () => videosWithRule().filter(d => gateOn(ruleOf(d) ?? {}));
@@ -1337,10 +1336,9 @@ async function webhook(sub) {
     console.log("✓ INSTAGRAM_WEBHOOK_VERIFY_TOKEN no .env");
     console.log(`
 Faltam estes passos, uma vez só:
-  1. Expor a porta ${port}: node tools/omnichat.mjs webhook serve   e, em outro terminal,
-     cloudflared tunnel --url http://127.0.0.1:${port}   (anote a URL https://….trycloudflare.com)
+  1. A cloud no ar (cloud/omnichat, reference/omnichat.md): é ela que recebe o webhook.
   2. developers.facebook.com/apps → seu app → Instagram → API setup with Instagram login → Configure webhooks:
-       Callback URL:  <a URL do túnel>/webhook
+       Callback URL:  ${cloudSettings().url || "https://omnichat.<você>.workers.dev"}/webhook
        Verify token:  ${token}
      e ligue os campos messages e messaging_postbacks.
   3. node tools/omnichat.mjs webhook subscribe   (inscreve a conta nesses campos)

package/tools/package.mjs

@@ -7,8 +7,9 @@
    not Bun; ffmpeg, the Chrome without a window and Python are fetched by `omni up` (tools/lib/deps.mjs).
 
      node tools/package.mjs [--version <x.y.z>]     builds and packs; prints the .tgz path
-     node tools/package.mjs publish [--version …]   builds, packs and publishes to npm with the account in
-                                                    NPM_CONFIG_USERCONFIG (e.g. ~/.npmrc-pedroflp)
+     node tools/package.mjs publish [--version …]   builds, packs and publishes to npm: in CI through npm's
+                                                    trusted publishing (.github/workflows/deploy.yml), by
+                                                    hand with the account in NPM_CONFIG_USERCONFIG
 
    Try it before publishing: npm install --prefix /tmp/omni-test <the .tgz>, then
    /tmp/omni-test/node_modules/.bin/omni status
@@ -120,7 +121,8 @@ const tgz = join(OUT, packed.stdout.trim().split("\n").at(-1) ?? "");
 console.log(`${PACKAGE}@${v}: ${(size(PKG) / 1e6).toFixed(1)} MB de arquivos, pacote em ${tgz}`);
 
 if (args[0] === "publish") {
-  if (!process.env.NPM_CONFIG_USERCONFIG)
+  /* CI publishes through npm's trusted publishing (OIDC); by hand, with the account's own login file */
+  if (!process.env.NPM_CONFIG_USERCONFIG && !process.env.GITHUB_ACTIONS)
     fail("defina NPM_CONFIG_USERCONFIG com o login da conta que publica (ex.: ~/.npmrc-pedroflp)");
   const r = spawnSync("npm", ["publish", tgz, "--access", "public", ...(v.includes("-") ? ["--tag", "next"] : [])], {
     stdio: "inherit",