@crievo/omni 0.1.7 → 0.1.9

package/tools/lib/up.mjs

@@ -5,26 +5,33 @@
      workspace   ~/OmniVideo (OMNI_HOME): videos/, omnivideo.config.json pointing at the hosted studio, .env
      app         a stable copy of the package in ~/.omni/app/<version>/ (npx's cache can be wiped), and
                  ~/.omni/bin/omni
-     tools       ffmpeg, the Chrome without a window and Python in ~/.omni (tools/lib/deps.mjs; in the
-                 background on a hook)
+     tools       ffmpeg, the Chrome without a window and Python in ~/.omni (tools/lib/deps.mjs)
      login       none yet: the browser opens on the approval page (at most once an hour)
      claude      on a hook, the session's Claude Code folder into ~/.omni/claude.json (claude-settings.mjs)
      service     the studio kept on at login (a launchd agent on macOS, a scheduled task on Windows, both in
                  tools/lib/service.mjs), from the app, so the hosted studio reaches this computer
 
+   The hook only decides and starts: no login yet opens the browser, and the process that waits for it goes on,
+   once the user approves, to the whole setup (`omni setup --auto`); a login without the rest of the setup
+   starts that same process. Nothing in a hook waits on the network. The setup reports each piece as it goes
+   (tools/lib/setup-progress.mjs), so the hosted page shows it to the user while the studio is not yet
+   connected.
+
    In this repo (a git checkout) the app, the tools and the service are left to `tools/setup.mjs` and
    `tools/runner.mjs service`: `up` never rewires a development machine. */
 
 import { spawn, spawnSync } from "node:child_process";
-import { copyFileSync, existsSync, mkdirSync, openSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { hostname } from "node:os";
 import { join } from "node:path";
 import { missingRules, recordClaudeDir } from "./claude-settings.mjs";
 import { CLI_COMMAND, PACKAGE, STUDIO_URL } from "./cli.mjs";
-import { OMNI_DIR, checkDeps, ensureDeps } from "./deps.mjs";
-import { readTokens } from "./oauth-client.mjs";
+import { DEP_STEPS, OMNI_DIR, checkDeps, ensureDep, ensureDeps } from "./deps.mjs";
+import { accessToken, readTokens } from "./oauth-client.mjs";
 import { CODE_ROOT, DATA_ROOT } from "./paths.mjs";
 import { npmCommand } from "./platform.mjs";
 import { service, serviceInstall, serviceWorkingDir } from "./service.mjs";
+import { createReporter, setupRunning, silentReporter } from "./setup-progress.mjs";
 
 const LOGIN_EVERY_MS = 60 * 60_000;
 
@@ -100,37 +107,48 @@ export function ensureApp(log = () => {}, codeRoot = CODE_ROOT) {
   return installed;
 }
 
-/** the programs the pipeline runs (tools/lib/deps.mjs), fetched by a process of its own on a hook so the
- *  session never waits; logs in ~/.omni/deps.log
- *  @returns {"ok" | "started" | "running" | string} "ok", or what is still missing */
-export function ensureTools(codeRoot = CODE_ROOT, { background = false } = {}) {
-  const c = checkDeps(codeRoot);
-  const missing = Object.entries(c)
-    .filter(([, v]) => !v)
-    .map(([k]) => k);
-  if (!missing.length) return "ok";
+/** whether the app is already where the service runs it from: this checkout, an installed package, or the
+ *  copy of this version in ~/.omni/app  @param {string} codeRoot */
+export function appInstalled(codeRoot = CODE_ROOT) {
+  if (isDev(codeRoot) || !inNpxCache(codeRoot)) return true;
+  const version = JSON.parse(readFileSync(join(codeRoot, "package.json"), "utf8")).version;
+  return existsSync(join(OMNI_DIR, "app", version, "node_modules", ...PACKAGE.split("/"), "package.json"));
+}
+
+/** whether anything of the setup is still to do (the hook starts it when so): the app of this version, the
+ *  programs, the studio service  @param {string} codeRoot */
+export function needsSetup(codeRoot = CODE_ROOT) {
+  if (isDev(codeRoot)) return false;
+  if (!appInstalled(codeRoot)) return true;
+  if (Object.values(checkDeps(codeRoot)).some(v => !v)) return true;
+  return (process.platform === "darwin" || process.platform === "win32") && !devServiceRoot() && !service().loaded;
+}
+
+/** a process of its own that runs `omni setup --auto` (the login if it is missing, then the whole setup), so
+ *  the session never waits  @param {string} codeRoot */
+function spawnSetup(codeRoot) {
   mkdirSync(OMNI_DIR, { recursive: true });
-  const lock = join(OMNI_DIR, "deps.lock");
-  try {
-    if (Date.now() - statSync(lock).mtimeMs < 15 * 60_000) return "running";
-  } catch {
-    /* no one is fetching them */
-  }
-  if (!background) return missing.join(", ");
-  writeFileSync(lock, String(process.pid));
-  const out = openSync(join(OMNI_DIR, "deps.log"), "a");
-  spawn(process.execPath, [join(codeRoot, "tools", "omni.mjs"), "deps", "install", "--unlock"], {
+  spawn(process.execPath, [join(codeRoot, "tools", "omni.mjs"), "setup", "--auto"], {
     detached: true,
     windowsHide: true,
-    stdio: ["ignore", out, out],
+    stdio: "ignore",
     env: { ...process.env, OMNI_HOME: DATA_ROOT },
   }).unref();
-  return "started";
 }
 
-/** opens the browser on the approval page in a process of its own, at most once an hour
+/** Starts the setup in the background, unless one is running.
+ *  @returns {boolean} whether it started now */
+export function startSetup(codeRoot = CODE_ROOT) {
+  if (setupRunning()) return false;
+  spawnSetup(codeRoot);
+  return true;
+}
+
+/** Opens the browser on the approval page, in the process that goes on to the setup once the user
+ *  approves; at most once an hour, and never while one is already waiting.
  *  @returns {boolean} whether it opened now */
 export function startLogin(codeRoot = CODE_ROOT) {
+  if (setupRunning()) return false;
   const marker = join(OMNI_DIR, "login-opened");
   mkdirSync(OMNI_DIR, { recursive: true });
   try {
@@ -139,12 +157,7 @@ export function startLogin(codeRoot = CODE_ROOT) {
     /* never opened */
   }
   writeFileSync(marker, new Date().toISOString());
-  spawn(process.execPath, [join(codeRoot, "tools", "omni.mjs"), "login"], {
-    detached: true,
-    windowsHide: true,
-    stdio: "ignore",
-    env: { ...process.env, OMNI_HOME: DATA_ROOT },
-  }).unref();
+  spawnSetup(codeRoot);
   return true;
 }
 
@@ -155,53 +168,155 @@ function devServiceRoot() {
   return root && existsSync(join(root, ".git")) ? root : "";
 }
 
+const deviceName = () => hostname().replace(/\.local$/, "");
+
+/** the studio as a service, unless this is a development machine or a system without one
+ *  @returns {boolean} whether it changed anything  @param {string} codeRoot @param {(line: string) => void} log */
+function installService(codeRoot, log) {
+  if (isDev(codeRoot) || devServiceRoot()) return false;
+  if (process.platform !== "darwin" && process.platform !== "win32") return false;
+  return serviceInstall({ codeRoot, onlyIfChanged: true, log }).changed;
+}
+
+/**
+ * Does one step of the setup again, or every step that isn't done (what the page's "Tentar de novo" asks for), and
+ * tells the reporter. Once nothing is left failing, the studio's own step goes last: it waits for the others, so
+ * the page doesn't leave the setup screen with a step still broken. `fns` are the steps themselves, replaced in tests.
+ * @param {string} step an id of tools/lib/setup-progress.mjs, or "all"
+ * @param {{ reporter: import("./setup-progress.mjs").Reporter, log?: (line: string) => void, fns?: Record<string, () => unknown> }} o
+ */
+export async function retrySetup(step, { reporter, log = () => {}, fns }) {
+  let codeRoot = CODE_ROOT;
+  const dev = () => isDev(codeRoot);
+  const steps = fns ?? {
+    workspace: () => ensureWorkspace(),
+    app: () => {
+      codeRoot = ensureApp(log);
+    },
+    ...Object.fromEntries(DEP_STEPS.map(id => [id, () => (dev() ? undefined : ensureDep(id, codeRoot))])),
+    studio: () => installService(codeRoot, log),
+  };
+  /* the programs and the service run from the app: find it first, quietly, when this isn't the app's own step */
+  if (!fns && step !== "app" && step !== "workspace") {
+    try {
+      codeRoot = ensureApp(log);
+    } catch {
+      /* the app step reports its own failure when it is retried */
+    }
+  }
+  const failing = () => reporter.record.steps.some(s => s.state === "error");
+  const ids =
+    step === "all" ? reporter.record.steps.filter(s => s.state !== "done" && s.id !== "studio").map(s => s.id) : [step];
+  for (const id of ids) {
+    if (id === "studio" || !steps[id]) continue;
+    reporter.step(id, "running");
+    try {
+      await steps[id]();
+      reporter.step(id, "done");
+    } catch (e) {
+      reporter.step(id, "error", /** @type {Error} */ (e).message);
+    }
+  }
+  const studio = reporter.record.steps.find(s => s.id === "studio");
+  if (studio?.state !== "done" && !failing() && steps.studio) {
+    reporter.step("studio", "running");
+    try {
+      await steps.studio();
+      reporter.step("studio", "done");
+    } catch (e) {
+      reporter.step("studio", "error", /** @type {Error} */ (e).message);
+    }
+  }
+  await reporter.flush();
+}
+
 /**
- * @param {{ hook?: boolean, log?: (line: string) => void }} [o]
+ * @param {{ hook?: boolean, log?: (line: string) => void, report?: boolean }} [o] `report`: tell the hosted
+ *   page each step as it happens (the setup does; a plain `omni up` stays quiet)
  * @returns {Promise<{ line: string, codeRoot: string, loggedIn: boolean, missingRules: string[] }>}
  */
-export async function up({ hook = false, log = () => {} } = {}) {
+export async function up({ hook = false, log = () => {}, report = false } = {}) {
   const notes = [];
   /* the session's Claude Code folder, for the studio service: its settings and its default agent account */
   if (hook) recordClaudeDir();
-  if (ensureWorkspace()) notes.push(`workspace criado em ${DATA_ROOT}`);
-  const codeRoot = ensureApp(log);
-  const dev = isDev(codeRoot);
   const url = studioUrlOf();
+  const loggedIn = !!readTokens(url);
 
-  /* ffmpeg, the Chrome without a window and Python, in ~/.omni: in the background on a hook, here otherwise */
-  if (!dev) {
-    if (hook) {
-      const tools = ensureTools(codeRoot, { background: true });
-      if (tools === "started" || tools === "running")
-        notes.push("baixando o ffmpeg, o Chrome sem janela, o Python e o yt-dlp (alguns minutos)");
-    } else {
-      const r = await ensureDeps(codeRoot, { log });
-      if (!r.ok) notes.push(`faltou preparar ${r.missing.join(", ")}: ${r.errors.join("; ")}`);
-    }
+  if (hook) {
+    /* decide and start; the work happens in a process of its own */
+    if (ensureWorkspace()) notes.push(`workspace criado em ${DATA_ROOT}`);
+    if (!loggedIn)
+      notes.push(startLogin() ? "abri o navegador para entrar no OmniVideo" : "falta entrar no OmniVideo (omni login)");
+    else if (needsSetup())
+      notes.push(startSetup() ? "preparando este computador em segundo plano" : "ainda preparando este computador");
+    return finish({ notes, loggedIn, codeRoot: CODE_ROOT });
   }
 
-  const loggedIn = !!readTokens(url);
-  if (!loggedIn)
-    notes.push(
-      startLogin(codeRoot) ? "abri o navegador para entrar no OmniVideo" : "falta entrar no OmniVideo (omni login)",
-    );
+  /* no login yet: the process that opens the browser carries on to the whole setup once the user approves, so
+     doing it here too would run two at once */
+  if (!loggedIn) {
+    notes.push(startLogin() ? "abri o navegador para entrar no OmniVideo" : "falta entrar no OmniVideo (omni login)");
+    return finish({ notes, loggedIn, codeRoot: CODE_ROOT });
+  }
+
+  const rep = report
+    ? createReporter({ studioUrl: url, token: () => accessToken(url), device: deviceName() })
+    : silentReporter;
+  rep.start();
+  let broke = false;
+  /** one step of the setup: running, then done, or error with what went wrong
+   *  @template T @param {string} id @param {() => T | Promise<T>} fn @returns {Promise<T | undefined>} */
+  const step = async (id, fn) => {
+    rep.step(id, "running");
+    try {
+      const r = await fn();
+      rep.step(id, "done");
+      return r;
+    } catch (e) {
+      broke = true;
+      rep.step(id, "error", /** @type {Error} */ (e).message);
+      notes.push(/** @type {Error} */ (e).message);
+      return undefined;
+    }
+  };
+
+  await step("workspace", () => {
+    if (ensureWorkspace()) notes.push(`workspace criado em ${DATA_ROOT}`);
+  });
+  const root = await step("app", () => ensureApp(log));
+  const codeRoot = root ?? CODE_ROOT;
+  const dev = isDev(codeRoot);
+
+  /* ffmpeg, the Chrome without a window, Python and yt-dlp, in ~/.omni */
+  if (!dev) {
+    const r = await ensureDeps(codeRoot, { log, onStep: (id, state, error) => rep.step(id, state, error) });
+    if (!r.ok) {
+      broke = true;
+      notes.push(`faltou preparar ${r.missing.join(", ")}: ${r.errors.join("; ")}`);
+    }
+  } else for (const id of ["video", "render", "voice", "style"]) rep.step(id, "done");
 
   /* a development studio already kept on by launchd (this repo's runner.mjs) is never swapped for the app */
   const devService = devServiceRoot();
   if (!dev && devService)
     notes.push(`o studio de desenvolvimento (${devService}) continua sendo o serviço deste computador`);
-  if (!dev && !devService && (process.platform === "darwin" || process.platform === "win32")) {
-    try {
-      if (serviceInstall({ codeRoot, onlyIfChanged: true, log }).changed) notes.push("studio ligado como serviço");
-    } catch (e) {
-      notes.push(`o serviço do studio não ligou: ${/** @type {Error} */ (e).message}`);
-    }
-  }
+  /* the studio connects last, and (when the page is watching) only when nothing failed: it is what takes the page off
+     the setup screen, and a step still broken is better fixed there, with its "Tentar de novo", than found missing
+     later */
+  if (report && broke) notes.push("o studio liga quando as etapas que falharam terminarem");
+  else
+    await step("studio", () => {
+      if (installService(codeRoot, log)) notes.push("studio ligado como serviço");
+    });
+  await rep.flush();
+  return { ...finish({ notes, loggedIn, codeRoot, dev }), reporter: rep, failed: report && broke };
+}
 
+/** the one line `up` prints, and what it found  @param {{ notes: string[], loggedIn: boolean, codeRoot: string, dev?: boolean }} o */
+function finish({ notes, loggedIn, codeRoot, dev = isDev(codeRoot) }) {
   const rules = missingRules({ cli: CLI_COMMAND });
   if (rules.length)
     notes.push("as skills ainda precisam de permissão: peça ao Claude para liberar as skills do OmniVideo");
-
   const s = service();
   const state = [
     loggedIn ? "logado" : "sem login",

package/tools/metrics.mjs

@@ -203,7 +203,12 @@ async function pull(only) {
 }
 
 async function cloudPush() {
-  if (!cloudSettings().ready) fail("cloud não configurada: cloud.url no config e OMNICHAT_CLOUD_SECRET no .env");
+  if (!cloudSettings().jobsReady)
+    fail(
+      cloudSettings().user.on
+        ? "cloud não configurada: cloud.studio_url no config"
+        : "cloud não configurada: cloud.url no config e OMNICHAT_CLOUD_SECRET no .env",
+    );
   const { token, id } = await instagramToken();
   await cloudApi("PUT", "/api/account", { id, token });
   const videos = published(null);

package/tools/omni.mjs

@@ -12,7 +12,8 @@
      omni status [--json]        the account, the plan, the credits and this computer
      omni logout                 signs this computer out in the cloud and here
      omni allow [--yes]          the Claude Code permission rules the skills need (asks first)
-     omni setup                  login, the rules and up, for whoever starts from a terminal
+     omni setup [--auto]         login, the rules and the whole setup (reported step by step to the hosted page);
+                                 --auto is what the plugin's hook starts in the background: no questions
      omni doctor [--json]        whether ffmpeg, ffprobe, the Chrome without a window, Python and yt-dlp answer
      omni deps install           fetches whichever of them doesn't answer into ~/.omni (tools/lib/deps.mjs)
      omni skill <nome> [--v <versão>] [--part i/n]
@@ -37,7 +38,8 @@ import { pickPython } from "./lib/platform.mjs";
 import { service } from "./lib/service.mjs";
 import { vaultName } from "./lib/vault.mjs";
 import { skillText } from "./lib/skill-client.mjs";
-import { up } from "./lib/up.mjs";
+import { acquireSetupLock, watchRetries } from "./lib/setup-progress.mjs";
+import { retrySetup, startSetup, up } from "./lib/up.mjs";
 import { cloudSettings } from "./platforms.mjs";
 
 const fail = (/** @type {string} */ m) => {
@@ -131,7 +133,9 @@ const mcpTools = url => [
     inputSchema: { type: "object", properties: {} },
     run: async () => {
       const t = await login(url, { deviceName: deviceName() });
-      return `Pronto: "${t.device_name}" entrou no OmniVideo. O studio deste computador passa a usar o login em até 30 segundos.`;
+      /* the login is half of it: the programs and the studio service come next, shown on the hosted page */
+      startSetup();
+      return `Pronto: "${t.device_name}" entrou no OmniVideo. Estou preparando o computador em segundo plano (alguns minutos); o studio liga sozinho quando terminar.`;
     },
   },
   {
@@ -287,20 +291,41 @@ export async function main(args) {
   }
 
   if (cmd === "login" || cmd === "setup") {
-    if (cmd === "login" || !readTokens(url)) {
-      const t = await login(url, { deviceName: flag("name") || deviceName(), log: line => console.log(line) }).catch(
-        e => fail(String(e.message)),
-      );
-      console.log(`Pronto: "${t.device_name}" entrou no OmniVideo. O login ficou no ${vaultName()}.`);
+    const auto = args.includes("--auto");
+    /* one setup at a time: the hook starts this in the background, and so may the user */
+    const release = cmd === "setup" ? acquireSetupLock() : null;
+    if (cmd === "setup" && !release) return console.log("O OmniVideo já está sendo preparado neste computador.");
+    try {
+      if (cmd === "login" || !readTokens(url)) {
+        const t = await login(url, { deviceName: flag("name") || deviceName(), log: line => console.log(line) }).catch(
+          e => fail(String(e.message)),
+        );
+        console.log(`Pronto: "${t.device_name}" entrou no OmniVideo. O login ficou no ${vaultName()}.`);
+      }
+      if (cmd === "login") return console.log("O studio deste computador passa a usar este login em até 30 segundos.");
+      if (
+        !auto &&
+        missingRules().length &&
+        (args.includes("--yes") || (await confirm("Liberar as skills do OmniVideo nas settings do Claude Code?")))
+      )
+        allowSkillRules();
+      const done = await up({ log: line => console.log(line), report: true });
+      console.log(done.line);
+      /* a step failed: stay here, so the page's "Tentar de novo" has someone to ask (only in the background: an
+         interactive setup just prints what failed) */
+      if (auto && done.failed)
+        await watchRetries({
+          studioUrl: url,
+          token: () => accessToken(url),
+          reporter: done.reporter,
+          run: step => retrySetup(step, { reporter: done.reporter }),
+        });
+    } finally {
+      release?.();
     }
-    if (cmd === "login") return console.log("O studio deste computador passa a usar este login em até 30 segundos.");
-    if (
-      missingRules().length &&
-      (args.includes("--yes") || (await confirm("Liberar as skills do OmniVideo nas settings do Claude Code?")))
-    )
-      allowSkillRules();
-    console.log((await up({ log: line => console.log(line) })).line);
-    return console.log("Para usar no Claude Code: claude plugin install omnivideo --marketplace pedroflp/omni-plugin");
+    if (!auto)
+      console.log("Para usar no Claude Code: claude plugin install omnivideo --marketplace pedroflp/omni-plugin");
+    return;
   }
 
   if (cmd === "logout") {

package/tools/omnichat.mjs

@@ -1111,7 +1111,7 @@ async function status() {
   );
   if (s.studio)
     console.log(
-      `  studio hospedado: ${s.studio.paired ? `este Mac (${s.studio.name}) ${s.studio.online ? "atende por ele agora" : "não está conectado: o studio hospedado mostra a última cópia (node tools/runner.mjs status)"}` : "este Mac não está pareado (node tools/runner.mjs login)"}`,
+      `  studio hospedado: ${s.studio.paired ? `esta máquina (${s.studio.name}) ${s.studio.online ? "atende por ela agora" : "não está conectada: o studio hospedado mostra a última cópia (node tools/runner.mjs status)"}` : "esta máquina não está pareada (node tools/runner.mjs login)"}`,
     );
   if (s.pause) console.log(`  em pausa até ${dayTime(s.pause.until)}: ${s.pause.reason}`);
   if (!s.rules.length) console.log("  nenhum vídeo com regra");
@@ -1129,8 +1129,11 @@ async function status() {
    once, so whoever already got the DM never gets it again. While cloud.omnichat is false nothing
    else changes. With owns: true the cloud is the one answering: every saved rule goes up on its own,
    the record is read from there (and mirrored into omnichat-record.json for the studio), the manual
-   send goes through it, and the local agent and webhook stop answering. */
-const cloudReady = () => cloudSettings().ready;
+   send goes through it, and the local agent and webhook stop answering.
+   With cloud.user the omnichat lives in the user's own cloud (the studio's UserCloud, signed in with the Omni
+   login, cloud.studio_url) instead of the Worker: cloudApi translates, so nothing below changes. That cloud
+   verifies Meta's events with this user's own app secret, which `cloud push` sends as a secret. */
+const cloudReady = () => cloudSettings().jobsReady;
 const cloudOwns = () => cloudSettings().owns.omnichat;
 const CLOUD = {
   get url() {
@@ -1160,6 +1163,20 @@ async function pushRule(dir) {
   return true;
 }
 
+/* The user's own cloud checks Meta's events with this user's own app secret and answers the handshake with their
+   verify token: both go up as write-only secrets. The Worker had them as its own secrets, set by hand. */
+async function pushWebhookSecrets() {
+  if (!cloudSettings().user.on) return [];
+  const sent = [];
+  for (const name of ["INSTAGRAM_APP_SECRET", "INSTAGRAM_WEBHOOK_VERIFY_TOKEN"]) {
+    const value = env(name);
+    if (!value) continue;
+    await cloudApi("PUT", `/api/cloud/secrets/${name}`, { value });
+    sent.push(name);
+  }
+  return sent;
+}
+
 /* a saved rule goes up when the cloud answers (the CLI waits for it before exiting: flushCloud) */
 const pendingCloud = [];
 function syncRule(dir) {
@@ -1220,10 +1237,17 @@ async function cloudHealth() {
 
 async function cloudCmd(sub) {
   if (sub === "status") {
-    console.log(
-      `${CLOUD.url ? "✓" : "·"} cloud.url${CLOUD.url ? `: ${CLOUD.url}` : " (falta no omnivideo.config.json)"}`,
-    );
-    console.log(`${env("OMNICHAT_CLOUD_SECRET") ? "✓" : "·"} OMNICHAT_CLOUD_SECRET no .env`);
+    const user = cloudSettings().user;
+    if (user.on) {
+      console.log(
+        `${user.url ? "✓" : "·"} cloud.user: a cloud do usuário${user.url ? ` em ${user.url}` : " (falta cloud.studio_url no omnivideo.config.json)"}`,
+      );
+    } else {
+      console.log(
+        `${CLOUD.url ? "✓" : "·"} cloud.url${CLOUD.url ? `: ${CLOUD.url}` : " (falta no omnivideo.config.json)"}`,
+      );
+      console.log(`${env("OMNICHAT_CLOUD_SECRET") ? "✓" : "·"} OMNICHAT_CLOUD_SECRET no .env`);
+    }
     console.log(`  quem responde: ${cloudOwns() ? "a cloud (cloud.omnichat)" : "esta máquina"}`);
     if (!cloudReady()) return;
     const s = await cloudApi("GET", "/api/status");
@@ -1259,6 +1283,13 @@ async function cloudCmd(sub) {
       expires: env("INSTAGRAM_TOKEN_EXPIRES") || null,
     });
     console.log(`config e conta @${acc.username} na cloud`);
+    const secrets = await pushWebhookSecrets();
+    if (cloudSettings().user.on)
+      console.log(
+        secrets.length === 2
+          ? "segredo do app e token de verificação do webhook na cloud"
+          : `webhook: faltam no .env ${["INSTAGRAM_APP_SECRET", "INSTAGRAM_WEBHOOK_VERIFY_TOKEN"].filter(n => !secrets.includes(n)).join(" e ")} (node tools/omnichat.mjs webhook setup)`,
+      );
     for (const dir of only ? [only] : videosWithRule()) {
       if (!(await pushRule(dir))) {
         if (only) console.log(`${nameOf(dir)}: sem regra ou ainda não publicado`);
@@ -1348,11 +1379,16 @@ async function webhook(sub) {
       `${secret ? "✓" : "·"} INSTAGRAM_APP_SECRET no .env${secret ? "" : " (falta: o segredo do app Instagram, em API setup with Instagram login → App secret)"}`,
     );
     console.log("✓ INSTAGRAM_WEBHOOK_VERIFY_TOKEN no .env");
+    /* the user's own cloud has its own address for Meta: /hook/<its id> */
+    const callback = cloudSettings().user.on
+      ? ((await cloudApi("GET", "/api/cloud/status").catch(() => null))?.hook_url ??
+        `${cloudSettings().user.url || "https://<studio>"}/hook/<id da sua cloud: entre na conta Omni>`)
+      : `${cloudSettings().url || "https://omnichat.<você>.workers.dev"}/webhook`;
     console.log(`
 Faltam estes passos, uma vez só:
-  1. A cloud no ar (cloud/omnichat, reference/omnichat.md): é ela que recebe o webhook.
+  1. A cloud no ar${cloudSettings().user.on ? " (a sua, na conta Omni; `cloud push` manda o segredo do app e o token abaixo para ela)" : " (cloud/omnichat, reference/omnichat.md)"}: é ela que recebe o webhook.
   2. developers.facebook.com/apps → seu app → Instagram → API setup with Instagram login → Configure webhooks:
-       Callback URL:  ${cloudSettings().url || "https://omnichat.<você>.workers.dev"}/webhook
+       Callback URL:  ${callback}
        Verify token:  ${token}
      e ligue os campos messages e messaging_postbacks.
   3. node tools/omnichat.mjs webhook subscribe   (inscreve a conta nesses campos)

package/tools/platforms.mjs

@@ -9,7 +9,9 @@
 
 import { readFileSync, writeFileSync, renameSync } from "node:fs";
 import { join } from "node:path";
+import { userRoute } from "./lib/cloud-user.mjs";
 import { request as coreRequest, sleep, DAY } from "./lib/http.mjs";
+import { accessToken } from "./lib/oauth-client.mjs";
 import { igBase, instagramToken as coreInstagramToken, instagramClient } from "./lib/platforms/instagram.mjs";
 import { DATA_ROOT as ROOT } from "./lib/paths.mjs";
 
@@ -79,27 +81,41 @@ export function writeEnv(values) {
   renameSync(tmp, ENV_FILE);
 }
 
-/* --- the cloud (cloud/omnichat: one Worker for omnichat, metrics and the schedule) ------------
-   `cloud` in the config: { url, omnichat, metrics, schedule }, each flag saying the cloud does that job
-   instead of this machine (the old omnichat.cloud { url, owns } still reads). OMNICHAT_CLOUD_SECRET in the
-   .env is the Worker's SYNC_SECRET; OMNICHAT_CLOUD_URL points at another Worker (wrangler dev, a test). */
+/* --- the cloud ----------------------------------------------------------------------------
+   `cloud` in the config: { url, omnichat, metrics, schedule, user }, each job flag saying the cloud does that job
+   instead of this machine (the old omnichat.cloud { url, owns } still reads).
+
+   Two clouds, while the move to a cloud of each user's own is under way (docs/specs/phase-3-per-user-cloud.md):
+   - the omnichat Worker (cloud/omnichat): `cloud.url`, with OMNICHAT_CLOUD_SECRET in the .env (its SYNC_SECRET;
+     OMNICHAT_CLOUD_URL points at another Worker: wrangler dev, a test). It does everything today.
+   - the user's own cloud (UserCloud in cloud/studio): `cloud.user: true`, at `cloud.studio_url`, signed in with the
+     Omni login of this computer. The omnichat, the Instagram account and the metrics go there; the schedule, the
+     media published now and the YouTube/TikTok credentials stay on the Worker until publishing moves (last step). */
 export function cloudSettings() {
   const top = CFG.cloud ?? {};
   const legacy = CFG.omnichat?.cloud ?? {};
   const url = process.env.OMNICHAT_CLOUD_URL || top.url || legacy.url || "";
   const secret = env("OMNICHAT_CLOUD_SECRET");
   const ready = !!(url && secret);
+  const studioUrl = String(process.env.OMNIVIDEO_STUDIO_URL || top.studio_url || "").replace(/\/+$/, "");
+  const user = { on: top.user === true, url: studioUrl };
+  /* whichever cloud the omnichat and the metrics are on can be asked */
+  const jobsReady = user.on ? !!studioUrl : ready;
   return {
     url: String(url).replace(/\/+$/, ""),
     ready,
+    /** the omnichat and the metrics are in the user's own cloud (the login is checked when it is called) */
+    user,
+    /** the cloud those two jobs live in is configured */
+    jobsReady,
     owns: {
-      omnichat: ready && (top.omnichat ?? legacy.owns) === true,
-      metrics: ready && top.metrics === true,
+      omnichat: jobsReady && (top.omnichat ?? legacy.owns) === true,
+      metrics: jobsReady && top.metrics === true,
       schedule: ready && top.schedule === true,
     },
     /* the hosted studio (cloud/studio): this machine connects to it as the runner */
     studio: {
-      url: String(process.env.OMNIVIDEO_STUDIO_URL || top.studio_url || "").replace(/\/+$/, ""),
+      url: studioUrl,
       on: !!(process.env.OMNIVIDEO_STUDIO_URL || top.studio_url) && top.studio === true,
     },
   };
@@ -131,13 +147,11 @@ export async function runnerStatus() {
   return out;
 }
 
-/** One call to the cloud's API; throws `cloud <method> <path>: <status> <error>` with `status`. */
-export async function cloudApi(/** @type {string} */ method, /** @type {string} */ path, /** @type {unknown} */ body) {
-  const c = cloudSettings();
-  if (!c.ready) throw new Error("cloud não configurada: cloud.url no config e OMNICHAT_CLOUD_SECRET no .env");
-  const r = await fetch(`${c.url}${path}`, {
+/* one JSON call; throws `<label>: <status> <error>` with `status` */
+async function callJson(label, url, method, headers, body) {
+  const r = await fetch(url, {
     method,
-    headers: { authorization: `Bearer ${env("OMNICHAT_CLOUD_SECRET")}`, "content-type": "application/json" },
+    headers: { ...headers, "content-type": "application/json" },
     body: body === undefined ? undefined : JSON.stringify(body),
   });
   const text = await r.text();
@@ -150,7 +164,7 @@ export async function cloudApi(/** @type {string} */ method, /** @type {string}
   if (!r.ok) {
     /** @type {Error & { status?: number }} */
     const e = new Error(
-      `cloud ${method} ${path}: ${r.status} ${j?.error ?? text.slice(0, 200)}${j?.problems ? `: ${j.problems.join("; ")}` : ""}`,
+      `${label}: ${r.status} ${j?.error ?? text.slice(0, 200)}${j?.problems ? `: ${j.problems.join("; ")}` : ""}`,
     );
     e.status = r.status;
     throw e;
@@ -158,6 +172,53 @@ export async function cloudApi(/** @type {string} */ method, /** @type {string}
   return j ?? {};
 }
 
+/** One call to the cloud's API, with the omnichat Worker's paths and bodies (cloud/omnichat); throws
+ *  `cloud <method> <path>: <status> <error>` with `status`. With cloud.user, the omnichat, account and metrics calls
+ *  go to the user's own cloud, translated (lib/cloud-user.mjs); the rest still goes to the Worker. */
+export async function cloudApi(/** @type {string} */ method, /** @type {string} */ path, /** @type {unknown} */ body) {
+  const c = cloudSettings();
+  const label = `cloud ${method} ${path}`;
+  const mapped = c.user.on ? userRoute(method, path, body) : null;
+  if (mapped) {
+    if (!c.user.url) throw new Error("cloud.user pede cloud.studio_url no omnivideo.config.json");
+    const token = await accessToken(c.user.url);
+    if (!token)
+      throw new Error(
+        "esta máquina não está logada na conta Omni: abra uma sessão do Claude Code (o plugin faz o login)",
+      );
+    const out = await callJson(
+      label,
+      `${c.user.url}${mapped.path}`,
+      mapped.method,
+      { authorization: `Bearer ${token}` },
+      mapped.body,
+    );
+    /* the Worker that still publishes needs the same Instagram token */
+    if (method === "PUT" && path === "/api/account" && c.owns.schedule)
+      await legacyApi(c, method, path, body).catch(e =>
+        console.error(`aviso: o Worker que publica não recebeu a conta do Instagram (${e.message})`),
+      );
+    return out;
+  }
+  return legacyApi(c, method, path, body);
+}
+
+function legacyApi(
+  /** @type {ReturnType<typeof cloudSettings>} */ c,
+  /** @type {string} */ method,
+  /** @type {string} */ path,
+  /** @type {unknown} */ body,
+) {
+  if (!c.ready) throw new Error("cloud não configurada: cloud.url no config e OMNICHAT_CLOUD_SECRET no .env");
+  return callJson(
+    `cloud ${method} ${path}`,
+    `${c.url}${path}`,
+    method,
+    { authorization: `Bearer ${env("OMNICHAT_CLOUD_SECRET")}` },
+    body,
+  );
+}
+
 /* The cloud's copy of the Instagram token. While the cloud does any job, a token this machine renews or
    receives goes up too, so the two never drift: Meta does not promise that
    the token before a renewal keeps working. A failure is only a warning: `omnichat.mjs cloud push` redoes it. */