@genex-ai/cli-demo 1.31.2 → 1.32.0-dev.650

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/cli-demo",
-  "version": "1.31.2",
+  "version": "1.32.0-dev.650",
   "description": "Set up your project's agent workspace (.claude/.codex/.cursor in the game folder), authorize, create a game project, generate AI assets, and publish (genex CLI).",
   "type": "module",
   "bin": {
@@ -40,10 +40,10 @@
     "pngjs": "^7.0.0"
   },
   "devDependencies": {
-    "@dimforge/rapier3d-compat": "^0.19.3",
+    "@dimforge/rapier3d-compat": "^0.20.0",
+    "@genex-ai/multiplayer": "workspace:*",
     "@genex/meshy-animation-catalog": "workspace:*",
     "@genex/mobile-scan": "workspace:*",
-    "@genex-ai/multiplayer": "workspace:*",
     "@pixiv/three-vrm": "^3.5.4",
     "@types/pngjs": "^6.0.5",
     "@types/three": "^0.185.0",

package/templates/blender-service/demo/castle.py

@@ -0,0 +1,117 @@
+"""The M0/M1 acceptance artifact: a castle room built from primitives.
+
+Deliberately NOT a torture test of Blender -- it is a torture test of the LOOP.
+It exercises the things a real composition step needs (booleans, arrays,
+materials, instancing, transforms) and produces something a human can judge in
+one glance: either the contact sheet shows a castle room, or it does not.
+"""
+
+import math
+
+import bpy
+
+ROOM = 12.0
+WALL_H = 5.0
+WALL_T = 0.6
+
+
+def _clear():
+    bpy.ops.wm.read_factory_settings(use_empty=True)
+
+
+def _mat(name, rgb, rough=0.85):
+    m = bpy.data.materials.new(name)
+    m.use_nodes = True
+    bsdf = m.node_tree.nodes["Principled BSDF"]
+    bsdf.inputs["Base Color"].default_value = (*rgb, 1.0)
+    # 'Roughness' is stable across 4.x; 'Specular' was RENAMED in 4.0 and is the
+    # single most common KeyError in LLM-written bpy. Do not reach for it.
+    bsdf.inputs["Roughness"].default_value = rough
+    # BOTH, and the second one is the trap: Workbench's MATERIAL colour mode --
+    # what every contact sheet renders -- reads `diffuse_color`, NOT the
+    # Principled BSDF. Setting only the BSDF gives a scene that exports with
+    # correct colours, reports materialCount>0, and renders ENTIRELY GREY.
+    # Numbers cannot catch this; the picture can. Measured 2026-08-31.
+    m.diffuse_color = (*rgb, 1.0)
+    return m
+
+
+def _cube(name, loc, scale, mat):
+    bpy.ops.mesh.primitive_cube_add(size=2.0, location=loc)
+    o = bpy.context.active_object
+    o.name = name
+    o.scale = scale
+    o.data.materials.append(mat)
+    return o
+
+
+def build():
+    _clear()
+    stone = _mat("Stone", (0.46, 0.44, 0.41))
+    dark = _mat("StoneDark", (0.26, 0.25, 0.24))
+    wood = _mat("Wood", (0.24, 0.14, 0.07))
+    roofm = _mat("Roof", (0.35, 0.12, 0.12), rough=0.6)
+    fire = _mat("Fire", (1.0, 0.45, 0.1), rough=0.4)
+
+    _cube("Floor", (0, 0, -0.25), (ROOM / 2, ROOM / 2, 0.25), dark)
+
+    half = ROOM / 2
+    # Three solid walls; the south wall is split to leave a doorway.
+    _cube("Wall_N", (0, half, WALL_H / 2), (half, WALL_T / 2, WALL_H / 2), stone)
+    _cube("Wall_E", (half, 0, WALL_H / 2), (WALL_T / 2, half, WALL_H / 2), stone)
+    _cube("Wall_W", (-half, 0, WALL_H / 2), (WALL_T / 2, half, WALL_H / 2), stone)
+    door = 2.2
+    side = (ROOM - door) / 4
+    for sgn in (-1, 1):
+        _cube(f"Wall_S{'L' if sgn < 0 else 'R'}",
+              (sgn * (door / 2 + side), -half, WALL_H / 2),
+              (side, WALL_T / 2, WALL_H / 2), stone)
+    _cube("Lintel", (0, -half, WALL_H - 0.5), (door / 2, WALL_T / 2, 0.5), stone)
+
+    # Crenellations: a real array, not four hand-placed boxes.
+    for i in range(9):
+        x = -half + 0.6 + i * (ROOM - 1.2) / 8
+        for y in (half, -half):
+            _cube(f"Cren_{i}_{'n' if y > 0 else 's'}",
+                  (x, y, WALL_H + 0.35), (0.35, WALL_T / 2, 0.35), stone)
+
+    # Corner towers with conical roofs.
+    for i, (sx, sy) in enumerate(((1, 1), (1, -1), (-1, 1), (-1, -1))):
+        cx, cy = sx * half, sy * half
+        bpy.ops.mesh.primitive_cylinder_add(radius=1.5, depth=WALL_H + 2.0,
+                                            location=(cx, cy, (WALL_H + 2.0) / 2), vertices=16)
+        t = bpy.context.active_object
+        t.name = f"Tower_{i}"
+        t.data.materials.append(stone)
+        bpy.ops.mesh.primitive_cone_add(radius1=2.0, depth=2.4, vertices=16,
+                                        location=(cx, cy, WALL_H + 2.0 + 1.2))
+        r = bpy.context.active_object
+        r.name = f"TowerRoof_{i}"
+        r.data.materials.append(roofm)
+
+    # A table, so the room reads as inhabited and the sheet has a scale cue.
+    _cube("TableTop", (0, 1.0, 1.1), (2.2, 0.9, 0.12), wood)
+    for dx in (-1.9, 1.9):
+        for dy in (-0.65, 0.65):
+            _cube(f"Leg_{dx}_{dy}", (dx, 1.0 + dy, 0.55), (0.12, 0.12, 0.55), wood)
+
+    # Wall torches -- emissive-ish spheres; they also prove material assignment.
+    for i, (tx, ty) in enumerate(((-half + 0.6, 2.5), (-half + 0.6, -2.5),
+                                  (half - 0.6, 2.5), (half - 0.6, -2.5))):
+        _cube(f"Sconce_{i}", (tx, ty, 3.0), (0.15, 0.15, 0.4), wood)
+        bpy.ops.mesh.primitive_uv_sphere_add(radius=0.32, location=(tx, ty, 3.5), segments=12, ring_count=8)
+        f = bpy.context.active_object
+        f.name = f"Flame_{i}"
+        f.data.materials.append(fire)
+
+    bpy.ops.object.select_all(action="DESELECT")
+    n = len(bpy.context.scene.objects)
+    tris = sum(
+        sum(max(len(p.vertices) - 2, 0) for p in o.data.polygons)
+        for o in bpy.context.scene.objects if o.type == "MESH"
+    )
+    print(f"castle: {n} objects, {tris} tris")
+    return n, tris
+
+
+build()

package/templates/blender-service/gpu_witness.py

@@ -0,0 +1,245 @@
+"""Fail-closed GPU witness.
+
+NAMED gpu_witness, NOT gpu: Blender ships a built-in `gpu` module, and a local
+`gpu.py` is shadowed by it. Measured 2026-09-01 -- `import gpu` returned
+Blender's module, `assert_gpu_or_die` did not exist on it, and the assertion
+never ran. The container still failed closed, which hid the mistake.
+
+There are FIVE independent ways to end up rendering on the CPU with a
+correct-looking image, a 200 response and a zero exit code. This module exists
+because any one of them alone would let the GPU tier pass every functional test
+while delivering nothing but a bill:
+
+  1. EEVEE RENDERS ON THE CPU. Measured on the CPU image (Mesa 22.3.6): a full
+     EEVEE contact sheet with correct shadows, 47.5s vs 0.4s for Workbench. So
+     "EEVEE worked" is a PERFORMANCE signal, never a GPU signal. Dockerfile.gpu
+     installs no Mesa vendor at all, so there is nothing to fall back onto --
+     that absence is the backstop, not this module.
+  2. `prefs.devices` is EMPTY until refresh_devices() populates it, so the
+     obvious enabling loop iterates zero elements and reports success.
+  3. `scene.cycles.device` defaults to 'CPU' and is stored PER SCENE inside the
+     .blend, so perfect preferences still render on CPU.
+  4. Blanket `d.use = True` enables HYBRID CPU+GPU, which every other check
+     still calls "GPU".
+  5. An uncaught exception under --python exits 0. (Handled by
+     --python-exit-code 1 in the CMD; nothing here raises, on purpose.)
+
+Nothing in this module raises. Every failure path calls sys.exit() explicitly.
+"""
+
+import os
+import sys
+import tempfile
+
+import bpy
+
+# 4.2/4.5 renamed the engine; it is BLENDER_EEVEE again on 5.0+. One constant.
+def _eevee_engine():
+    """The EEVEE id for THIS Blender. Renamed to BLENDER_EEVEE_NEXT in 4.2 and
+    renamed BACK to BLENDER_EEVEE in 5.0, so a literal is wrong on one side of
+    that line — and setting an unknown engine id fails at render, far from the
+    cause. Resolved from the running build rather than assumed.
+
+    Mirrored by eeveeEngineFor() in apps/cli/src/lib/blender-local.ts, which
+    gates which Blenders the local lane will drive."""
+    try:
+        items = bpy.types.RenderSettings.bl_rna.properties["engine"].enum_items
+        names = {i.identifier for i in items}
+    except Exception:  # noqa: BLE001
+        names = set()
+    for candidate in ("BLENDER_EEVEE_NEXT", "BLENDER_EEVEE"):
+        if candidate in names:
+            return candidate
+    return "BLENDER_EEVEE_NEXT" if bpy.app.version < (5, 0, 0) else "BLENDER_EEVEE"
+
+
+EEVEE_ENGINE = _eevee_engine()
+
+# Preference order, not a hardcoded value. OptiX first because production is
+# NVIDIA, but the vendor is DISCOVERED from what the build actually offers --
+# which is what lets the identical service be exercised on an Apple-silicon Mac
+# (METAL) or an AMD box (HIP) instead of only on the target hardware.
+# GENEX_BLENDER_CYCLES_BACKEND pins one explicitly.
+CYCLES_BACKEND_PREFERENCE = ("OPTIX", "CUDA", "METAL", "HIP", "ONEAPI")
+SOFTWARE_DEVICES = ("SOFTWARE", "NONE", "UNKNOWN")
+
+
+def _force_context():
+    """Render 4x4 with EEVEE. Returns True if it actually produced pixels.
+
+    ITS SUCCESS IS NOT EVIDENCE OF A GPU. MEASURED 2026-09-01 on the CPU image
+    (Debian bookworm, Mesa 22.3.6 llvmpipe): EEVEE renders correctly, with real
+    shadows, entirely on the CPU -- 47.5s for a 4-view sheet against 0.4s for
+    Workbench. An earlier version of this module treated a successful probe as
+    the strongest GPU signal, which would have PASSED on any GPU-less host that
+    has Mesa installed.
+
+    What it is actually for: forcing the lazily-created GPU context so
+    gpu.platform can be queried at all, and catching a broken graphics stack.
+    The real GPU discriminator is configure_cycles() -- enumerating an OptiX
+    device needs a real driver and cannot be faked by a software rasterizer."""
+    s = bpy.context.scene
+    r = s.render
+    ok = False
+    keep = (r.engine, r.resolution_x, r.resolution_y, r.filepath,
+            r.image_settings.file_format, r.resolution_percentage)
+    try:
+        r.engine = EEVEE_ENGINE
+        r.resolution_x = r.resolution_y = 4
+        r.resolution_percentage = 100
+        r.image_settings.file_format = "PNG"
+        # mkstemp, NOT a fixed path. This is a LIVE SINGLE-TENANT BUG, not
+        # only a multi-seat one: a leftover file from any earlier run makes the
+        # `getsize() > 0` check below true for a probe that rendered nothing, so
+        # a GPU-less box passes an assertion whose entire job is to fail there.
+        # With seats it is also a boot race between children.
+        fd, probe_path = tempfile.mkstemp(prefix="genex-gpu-probe-", suffix=".png")
+        os.close(fd)
+        os.unlink(probe_path)  # Blender must create it, or it proves nothing.
+        r.filepath = probe_path
+        # A camera is required and a fresh scene has none, so the probe must
+        # bring its own or it fails for a reason that has nothing to do with
+        # the GPU. Measured: "Cannot render, no camera".
+        cam_data = bpy.data.cameras.new("__genex_probe_cam")
+        cam = bpy.data.objects.new("__genex_probe_cam", cam_data)
+        s.collection.objects.link(cam)
+        prev_cam, s.camera = s.camera, cam
+        try:
+            bpy.ops.render.render(write_still=True)
+            ok = os.path.exists(probe_path) and os.path.getsize(probe_path) > 0
+        finally:
+            s.camera = prev_cam
+            bpy.data.objects.remove(cam, do_unlink=True)
+            bpy.data.cameras.remove(cam_data)
+            try:
+                os.unlink(probe_path)
+            except OSError:
+                pass
+    except Exception as e:  # noqa: BLE001 - a probe failure is a verdict, not a crash
+        sys.stderr.write("[gpu] probe render failed: %s\n" % e)
+    finally:
+        (r.engine, r.resolution_x, r.resolution_y, r.filepath,
+         r.image_settings.file_format, r.resolution_percentage) = keep
+    return ok
+
+
+def configure_cycles():
+    """Enable OptiX devices and return their names. [] means no GPU device."""
+    addon = bpy.context.preferences.addons.get("cycles")
+    if addon is None:
+        return []
+    prefs = addon.preferences
+    # refresh_devices(), NOT get_devices(): the latter is deprecated on 4.5 and
+    # returns None, so the ubiquitous `prefs.get_devices()[0]` idiom raises
+    # TypeError. And prefs.devices is empty until this call.
+    try:
+        prefs.refresh_devices()
+    except Exception as e:  # noqa: BLE001
+        sys.stderr.write("[gpu] refresh_devices failed: %s\n" % e)
+        return []
+
+    # bl_rna enum_items is EMPTY for this dynamic enum — get_device_types() is
+    # the only reliable way to ask what this build supports.
+    try:
+        available = {t[0] for t in prefs.get_device_types(bpy.context)}
+    except Exception:  # noqa: BLE001
+        available = set()
+    # NONE is always offered and means CPU — never treat it as a GPU backend.
+    available.discard("NONE")
+
+    pinned = os.environ.get("GENEX_BLENDER_CYCLES_BACKEND")
+    if pinned:
+        backend = pinned if pinned in available else None
+    else:
+        backend = next((b for b in CYCLES_BACKEND_PREFERENCE if b in available), None)
+    if backend is None:
+        sys.stderr.write("[gpu] no GPU compute backend offered (have: %s)\n"
+                         % sorted(available))
+        return []
+
+    prefs.compute_device_type = backend
+    prefs.refresh_devices()
+
+    gpus = []
+    for d in prefs.devices:
+        # NOT `d.use = True`. The CPU is ALWAYS in the candidate list, and new
+        # GPU entries already default to use=True, so blanket-enabling silently
+        # turns on hybrid CPU+GPU rendering that still reports as "GPU".
+        d.use = (d.type == backend)
+        if d.use:
+            gpus.append("%s (%s)" % (d.name, backend))
+
+    # Per SCENE, and stored in the .blend — so a restored checkpoint can arrive
+    # with device='CPU' even when preferences are perfect.
+    for scene in bpy.data.scenes:
+        try:
+            scene.cycles.device = "GPU"
+        except AttributeError:
+            pass  # cycles addon present but scene not yet initialised
+    return gpus
+
+
+def witness():
+    """What the renderer actually is, right now. Cheap enough to call at boot."""
+    import gpu as bgpu
+
+    probe_ok = _force_context()
+    try:
+        return {
+            "eeveeProbe": probe_ok,
+            "backend": bgpu.platform.backend_type_get(),
+            "device": bgpu.platform.device_type_get(),
+            "renderer": bgpu.platform.renderer_get(),
+            "vendor": bgpu.platform.vendor_get(),
+            "glVersion": bgpu.platform.version_get(),
+            "cyclesDevices": configure_cycles(),
+            "eeveeEngine": EEVEE_ENGINE,
+        }
+    except Exception as e:  # noqa: BLE001
+        return {"eeveeProbe": probe_ok, "backend": "NONE", "device": "UNKNOWN",
+                "renderer": str(e), "vendor": "", "glVersion": "",
+                "cyclesDevices": configure_cycles(), "eeveeEngine": EEVEE_ENGINE}
+
+
+def assert_gpu_or_die():
+    """Refuse to serve on software. Called BEFORE the socket opens, so a
+    misconfigured GPU pod never accepts a request it would bill for and answer
+    from the CPU."""
+    w = witness()
+    # The verdict rests on INDEPENDENT EVIDENCE, not on gpu.platform alone.
+    # Blender may decline to answer gpu.platform in background mode even when a
+    # GPU is present and working, so treating UNKNOWN as fatal would refuse a
+    # healthy pod and take the whole tier down. Explicit SOFTWARE is fatal; an
+    # unanswered query is only fatal when the EEVEE probe ALSO produced nothing.
+    if w["device"] == "SOFTWARE":
+        sys.stderr.write("[svc] FATAL gpu_tier_on_software: device reported SOFTWARE (%s)\n"
+                         % w["renderer"])
+        sys.stderr.flush()
+        sys.exit(3)
+    if not w["eeveeProbe"]:
+        sys.stderr.write(
+            "[svc] FATAL eevee_unavailable: probe render produced nothing "
+            "(backend=%s device=%s renderer=%r)\n"
+            % (w["backend"], w["device"], w["renderer"]))
+        sys.stderr.flush()
+        sys.exit(3)
+    if w["device"] in ("UNKNOWN", "NONE"):
+        # Not fatal, but no longer silent: on a healthy NVIDIA pod this answers
+        # "NVIDIA", so an unanswered query means the rasterizer path -- the one
+        # every contact sheet uses -- is unverified.
+        sys.stderr.write(
+            "[svc] WARN rasterizer_unverified: gpu.platform reported %s. Cycles "
+            "has a GPU device, but EEVEE/Workbench GPU use is unconfirmed.\n"
+            % w["device"])
+    if not w["cyclesDevices"]:
+        # A software rasterizer cannot enumerate one. If this fires on a box you
+        # believe has a GPU, the driver or container toolkit is the problem.
+        sys.stderr.write("[svc] FATAL no_cycles_device: no GPU compute device "
+                         "enumerated (this is the real GPU gate; EEVEE rendering "
+                         "proves nothing)\n")
+        sys.stderr.flush()
+        sys.exit(4)
+    sys.stderr.write("[svc] GPU ok: %s %s | cycles: %s\n"
+                     % (w["device"], w["renderer"], ", ".join(w["cyclesDevices"])))
+    sys.stderr.flush()
+    return w

package/templates/blender-service/ops.py

@@ -0,0 +1,225 @@
+"""Scene operations. Every mutating call runs on the HTTP server's own thread,
+which is Blender's main thread -- bpy is not thread-safe and the server is
+deliberately non-threading so this holds without a queue."""
+
+import contextlib
+import io
+import os
+import tempfile
+import traceback
+import urllib.parse
+import urllib.request
+
+import bpy
+
+from views import scene_bounds
+
+# The exec namespace PERSISTS across calls, so an agent can define a helper in
+# one step and use it in the next. That is the difference between a REPL and a
+# series of unrelated scripts.
+NAMESPACE = {}
+
+
+def reset_namespace():
+    import math
+    import random
+
+    import bmesh
+    import mathutils
+
+    NAMESPACE.clear()
+    NAMESPACE.update(
+        {"bpy": bpy, "bmesh": bmesh, "mathutils": mathutils, "math": math, "random": random}
+    )
+
+
+def run_script(source):
+    """Execute arbitrary Python against the live scene.
+
+    Arbitrary by design: a fixed tool vocabulary cannot express 'build a castle'.
+    The containment story is the container -- disposable, egress-locked in the
+    hosted path -- never a sanitizer on this string, which does not work.
+    """
+    out, err = io.StringIO(), io.StringIO()
+    error = None
+    with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+        try:
+            exec(compile(source, "<genex-exec>", "exec"), NAMESPACE)
+        except Exception:
+            error = traceback.format_exc(limit=8)
+    return {"stdout": out.getvalue(), "stderr": err.getvalue(), "error": error}
+
+
+def _tri_count(obj):
+    if obj.type != "MESH" or obj.data is None:
+        return 0
+    return sum(max(len(p.vertices) - 2, 0) for p in obj.data.polygons)
+
+
+def scene_info():
+    """The numeric truths. These are the GATE -- the picture is for steering.
+
+    A screenshot judge is measurably bad at pass/fail (WorldCoder-Bench: a
+    screenshot+VLM gate passes 2.7% of outputs), so an agent should assert on
+    these counts and use the render to decide what to change.
+    """
+    objects, total_tris = [], 0
+    for obj in bpy.context.scene.objects:
+        tris = _tri_count(obj)
+        total_tris += tris
+        objects.append(
+            {
+                "name": obj.name,
+                "type": obj.type,
+                "tris": tris,
+                "location": [round(v, 4) for v in obj.location],
+                "dimensions": [round(v, 4) for v in obj.dimensions],
+                "materials": [m.name for m in obj.data.materials if m]
+                if getattr(obj.data, "materials", None)
+                else [],
+                "visible": obj.visible_get(),
+            }
+        )
+    center, radius = scene_bounds()
+    return {
+        "objectCount": len(objects),
+        "meshCount": sum(1 for o in objects if o["type"] == "MESH"),
+        "totalTris": total_tris,
+        "materialCount": len(bpy.data.materials),
+        "bounds": {
+            "center": [round(v, 4) for v in center],
+            "radius": round(radius, 4),
+        },
+        "objects": objects,
+    }
+
+
+def reset_scene():
+    bpy.ops.wm.read_factory_settings(use_empty=True)
+    reset_namespace()
+    return scene_info()
+
+
+# A picture the agent LOOKS AT goes inline; an artifact the GAME SHIPS goes to
+# object storage. Base64 inflates 4/3 plus JSON escaping, so ~7 MB of raw GLB
+# already blows RunPod's 10 MB /run ceiling -- and it fails only on long,
+# successful sessions that generated a lot of texture, which is the worst time.
+INLINE_GLB_MAX_BYTES = 6 * 1024 * 1024
+
+
+def export_glb(path):
+    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
+    bpy.ops.export_scene.gltf(filepath=path, export_format="GLB", use_selection=False)
+    return {"path": path, "bytes": os.path.getsize(path)}
+
+
+def upload_file(path, url, headers=None):
+    """PUT the bytes to a presigned URL. The service never holds an account key
+    -- the caller mints a single-object, short-TTL URL, so code running inside
+    /exec has nothing durable to steal."""
+    import urllib.request
+
+    with open(path, "rb") as f:
+        body = f.read()
+    req = urllib.request.Request(url, data=body, method="PUT")
+    for k, v in (headers or {}).items():
+        req.add_header(k, v)
+    with urllib.request.urlopen(req, timeout=300) as r:  # noqa: S310 - caller-minted
+        return {"status": r.status, "bytes": len(body)}
+
+
+def save_checkpoint(path):
+    """Whole-scene snapshot. Measured elsewhere at tens to hundreds of ms, and
+    it hides inside the agent's think time. What makes a pod disposable."""
+    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
+    bpy.ops.wm.save_as_mainfile(filepath=path, copy=True, compress=True)
+    return os.path.getsize(path)
+
+
+def load_checkpoint(path):
+    """Restore a snapshot. NOTE: this invalidates every live bpy reference, so
+    the exec namespace is reset alongside it -- a held Python handle raises
+    `StructRNA has been removed` long after the restore, somewhere unrelated."""
+    bpy.ops.wm.open_mainfile(filepath=path)
+    reset_namespace()
+
+
+def _host_allowed(url):
+    """Empty allowlist = permissive, which is correct for the admin-only spike
+    and wrong for the hosted lane. GENEX_BLENDER_IMPORT_HOSTS narrows it without
+    a code change when this reaches a session."""
+    allow = [h.strip() for h in os.environ.get("GENEX_BLENDER_IMPORT_HOSTS", "").split(",") if h.strip()]
+    if not allow:
+        return True
+    host = (urllib.parse.urlparse(url).hostname or "").lower()
+    return any(host == a.lower() or host.endswith("." + a.lower().lstrip(".")) for a in allow)
+
+
+def import_glb(url):
+    if not _host_allowed(url):
+        raise ValueError(f"import host not allowed: {urllib.parse.urlparse(url).hostname}")
+    before = {o.name for o in bpy.context.scene.objects}
+    fd, tmp = tempfile.mkstemp(suffix=".glb", prefix="genex-import-")
+    os.close(fd)
+    try:
+        with urllib.request.urlopen(url, timeout=60) as r:  # noqa: S310 - allowlisted above
+            with open(tmp, "wb") as f:
+                f.write(r.read())
+        bpy.ops.import_scene.gltf(filepath=tmp)
+    finally:
+        os.unlink(tmp)
+    added = [o.name for o in bpy.context.scene.objects if o.name not in before]
+    return {"imported": added, "count": len(added)}
+
+
+def scene_digest():
+    """A fingerprint of everything a render depends on, for the sheet-repeat guard.
+
+    Built from the data blocks directly, not from scene_info(): that summary
+    carries location, dimensions and material NAMES, and nothing else — so a
+    rotation, a scale, a modifier, a moved vertex, a dimmed light or a recoloured
+    material all hashed identically and the model was told the picture was
+    unchanged (review finding). Vertex coordinates go through numpy, so a 600k
+    triangle mesh costs one foreach_get and one hash rather than a Python loop.
+    """
+    import hashlib
+    h = hashlib.sha256()
+    scene = bpy.context.scene
+    for obj in scene.objects:
+        # The RNA transform, NOT matrix_world: a script that sets rotation_euler
+        # leaves matrix_world stale until the depsgraph evaluates, which in
+        # background mode is not before this runs. Measured live: a rotation
+        # hashed identical through matrix_world and the guard said "unchanged".
+        parent = obj.parent.name if obj.parent else ""
+        h.update(("%s|%s|%s|%s|%s|%s|%d|%s\n" % (
+            obj.name, obj.type, parent, tuple(obj.location),
+            tuple(obj.rotation_euler), tuple(obj.scale),
+            obj.hide_render, [m.type for m in getattr(obj, "modifiers", [])],
+        )).encode("utf-8"))
+        data = obj.data
+        if obj.type == "MESH" and data is not None:
+            n = len(data.vertices)
+            if n:
+                try:
+                    import numpy as np
+                    buf = np.empty(n * 3, dtype=np.float32)
+                    data.vertices.foreach_get("co", buf)
+                    h.update(buf.tobytes())
+                except Exception:
+                    h.update(str(n).encode())
+            for m in data.materials:
+                if m is None:
+                    continue
+                h.update(("mat:%s:%s\n" % (m.name, tuple(m.diffuse_color))).encode())
+                if m.use_nodes and m.node_tree:
+                    for node in m.node_tree.nodes:
+                        if node.type == "BSDF_PRINCIPLED":
+                            h.update(("bsdf:%s\n" % (tuple(node.inputs["Base Color"].default_value),)).encode())
+        elif obj.type == "LIGHT" and data is not None:
+            h.update(("light:%s:%s:%s\n" % (data.type, data.energy, tuple(data.color))).encode())
+        elif obj.type == "CAMERA" and data is not None:
+            h.update(("cam:%s:%s\n" % (data.lens, data.type)).encode())
+    w = scene.world
+    if w is not None:
+        h.update(("world:%s\n" % (tuple(getattr(w, "color", (0, 0, 0))),)).encode())
+    return h.hexdigest()