@gentbajko/slopify 2.0.3 → 2.1.1

package/SUBTITLES.md

@@ -16,7 +16,7 @@ Fonts are copied into the completed project's caption assets, so an existing exp
 
 ## Local model and licenses
 
-Speech inference uses MIT-licensed `onnxruntime-web@1.24.3` in a separate WASM process. The runtime is installed with the package (about 138 MB on disk); model weights are downloaded lazily into `<data-dir>/models/english-subtitles/`.
+Speech inference uses MIT-licensed `onnxruntime-node@1.30.0` (native CPU) in a separate process, with `min(8, CPUs − 1)` threads; set `SLOPIFY_SUBTITLE_THREADS` to override. The npm package bundles CPU builds for Linux x64/arm64, Windows x64/arm64 and Apple silicon macOS (about 220 MB unpacked); Intel Macs have no build, so subtitle timing falls back to the slower single-threaded `onnxruntime-web` there. Its postinstall script only fetches optional CUDA files on Linux x64 and is not needed (the Docker image installs with `--ignore-scripts`); model weights are downloaded lazily into `<data-dir>/models/english-subtitles/`.
 
 Model: [Xenova/wav2vec2-base-960h](https://huggingface.co/Xenova/wav2vec2-base-960h/tree/a19f851b3d42865797e410752b4c570c871e4825), an ONNX conversion of [facebook/wav2vec2-base-960h](https://huggingface.co/facebook/wav2vec2-base-960h), licensed Apache-2.0. Pinned revision: `a19f851b3d42865797e410752b4c570c871e4825`. The quantized model is 95,286,046 bytes, SHA256 `cd5040c147381580ed73258143dd8e0c28e800a09e74ee42ee2b3e8cb4d760a3`; every cached/downloaded model is verified before use.
 

package/dist/adapters/alignment/threads.js

@@ -0,0 +1,11 @@
+import { availableParallelism } from "node:os";
+// Measured on a 32-thread machine, 5 min of narration in 12 s windows: one native CPU session with
+// 8 intra-op threads ran 37× realtime; 16 threads 31×, 32 threads 20×, 1 thread 20×, and the old
+// single-threaded WASM runtime 4.8×. More threads in one session gets slower, so 8 is the ceiling.
+const maxThreads = 8;
+export function subtitleThreads(env = process.env, cpus = availableParallelism()) {
+    const override = env.SLOPIFY_SUBTITLE_THREADS?.trim();
+    if (override !== undefined && /^[1-9]\d*$/.test(override))
+        return Number(override);
+    return Math.min(maxThreads, Math.max(1, cpus - 1));
+}

package/dist/adapters/alignment/worker.js

@@ -1,9 +1,9 @@
 import { open, readFile, stat } from "node:fs/promises";
-import * as ort from "onnxruntime-web/wasm";
 import { SubtitleMismatch } from "../../kernel/ports/subtitles.js";
 import { mismatch } from "./ctc.js";
 import { workerInput } from "./protocol.js";
 import { speechWords } from "./text.js";
+import { subtitleThreads } from "./threads.js";
 import { alignSpeechWindow, greedy } from "./window.js";
 const sampleRate = 16000;
 const windowSeconds = 12;
@@ -26,9 +26,7 @@ function send(message) {
     process.send?.(message);
 }
 async function run(input) {
-    ort.env.wasm.numThreads = 1;
-    const model = new Uint8Array(await readFile(input.modelPath));
-    const session = await ort.InferenceSession.create(model, { executionProviders: ["wasm"] });
+    const { ort, session } = await openSession(input.modelPath);
     const file = await open(input.pcmPath, "r");
     try {
         const totalSamples = (await stat(input.pcmPath)).size / 4;
@@ -139,6 +137,42 @@ async function run(input) {
         await session.release();
     }
 }
+// One native CPU session per job, as benchmarked; threads.ts records the measured speeds. The
+// native runtime loads its binary on import, so a missing or foreign binary fails there; that
+// system (an Intel Mac has no 1.24 build) falls back to the single-threaded WebAssembly runtime,
+// about 7× slower but the same model, rather than losing captions.
+async function openSession(modelPath) {
+    let native;
+    try {
+        native = await import("onnxruntime-node");
+    }
+    catch (nativeError) {
+        try {
+            const web = await import("onnxruntime-web/wasm");
+            web.env.wasm.numThreads = 1;
+            const session = await web.InferenceSession.create(new Uint8Array(await readFile(modelPath)), {
+                executionProviders: ["wasm"],
+            });
+            return {
+                ort: web,
+                session: session,
+            };
+        }
+        catch {
+            const system = `${process.platform} ${process.arch}`;
+            const reason = nativeError instanceof Error
+                ? (nativeError.message.split("\n")[0] ?? "")
+                : String(nativeError);
+            throw new Error(`Subtitle timing could not start: neither of its speech engines loaded on this computer (${system}): ${reason}. Reinstall Slopify so npm installs the engine for this system, then try again; if it keeps failing, turn subtitles off for this project.`);
+        }
+    }
+    const session = await native.InferenceSession.create(modelPath, {
+        executionProviders: ["cpu"],
+        intraOpNumThreads: subtitleThreads(),
+        interOpNumThreads: 1,
+    });
+    return { ort: native, session };
+}
 function candidates(source, cursor, observed) {
     const selected = [];
     let length = 0;

package/dist/adapters/host-cli/index.js

@@ -1,5 +1,5 @@
 import { redact } from "../../kernel/log.js";
-import { bridgeLimits, hostFaultSchema, hostFrameSchema, hostHealthSchema, hostImageSchema, hostLlmSchema, hostModelsSchema, hostStatusSchema, } from "../../kernel/ports/host-cli.js";
+import { bridgeLimits, hostFaultSchema, hostFrameSchema, hostHealthSchema, hostImageSchema, hostLlmSchema, hostModelsSchema, hostOpenedSchema, hostOpenFolderSchema, hostStatusSchema, } from "../../kernel/ports/host-cli.js";
 import { isProviderError, providerError } from "../../kernel/ports/model.js";
 import { sniffImage } from "../image/bytes.js";
 import { hostRequest, hostUnavailable, readHostBytes, } from "./transport.js";
@@ -50,6 +50,30 @@ export function createHostCliClient(options) {
         ...(model.thinkingModes === undefined ? {} : { thinkingModes: model.thinkingModes }),
     }));
     return {
+        openFolder: async (path, signal) => {
+            const parsed = hostOpenFolderSchema.safeParse({ path });
+            if (!parsed.success || !options.directory)
+                return false;
+            // An older helper answers 404 and a refused folder 403; either way the caller shows the path.
+            try {
+                const response = await hostRequest({
+                    directory: options.directory,
+                    path: "/v1/open-folder",
+                    method: "POST",
+                    kind: "metadata",
+                    body: Buffer.from(JSON.stringify(parsed.data)),
+                    signal,
+                });
+                if (response.statusCode !== 200) {
+                    response.destroy();
+                    return false;
+                }
+                return hostOpenedSchema.safeParse(JSON.parse((await readHostBytes(response, bridgeLimits.status)).toString("utf8"))).success;
+            }
+            catch {
+                return false;
+            }
+        },
         status: async (id) => {
             try {
                 const status = await metadata(`/v1/status/${id}`, hostStatusSchema);

package/dist/assets/document/SOURCE.txt

@@ -0,0 +1,7 @@
+background.jpg
+The parchment page texture of the DiceMaster document theme, from the lore2script2 PDF
+generator (same owner).
+SHA-256: 18f9701b476f299e942cbb99c05ba3267d8341df2b6136e3aebbafad83b03b31
+
+fonts/
+Cinzel, SIL Open Font License 1.1: see fonts/SOURCE.txt and fonts/OFL.txt.

package/dist/assets/document/fonts/OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The Cinzel Project Authors (https://github.com/NDISCOVER/Cinzel)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/dist/assets/document/fonts/SOURCE.txt

@@ -0,0 +1,11 @@
+Cinzel-Regular.ttf, Cinzel-Medium.ttf, Cinzel-Bold.ttf, Cinzel-Black.ttf
+Cinzel 2.000 by Natanael Gama, from the embedded font data of the lore2script2 PDF generator
+(same owner). Copyright and licence are read from each file's own name table.
+Upstream: https://github.com/NDISCOVER/Cinzel
+
+OFL.txt
+SIL Open Font License 1.1, with the copyright line from the fonts' name table.
+7445469e9f302618200b15b1645d6aa3565b93a6634a0f9e5cd069c7fc2343fe  Cinzel-Black.ttf
+cbe8f6a665cc58d4540b6ce2a29e6f1b7e096fa6835aea1d2ffb40c088c5cdf6  Cinzel-Bold.ttf
+3d50001a451ba6cfd3ef07a2dfb0c564980a5229f70decdfa23f08f4a30e1bed  Cinzel-Medium.ttf
+540b628614b728fc87e50b883189a524dac4d8163ca4a0f8e49b499910762e86  Cinzel-Regular.ttf

package/dist/catalog/validate.js

@@ -1,4 +1,4 @@
-import { usesNarrationPreparation } from "../slices/admission/rules.js";
+import { usesNarrationPreparation, usesYoutubeDescription, } from "../slices/admission/rules.js";
 import { isLocalCliProvider } from "../slices/settings/model.js";
 export function modelFields(draft, catalogue) {
     if (!catalogue)
@@ -9,7 +9,8 @@ export function modelFields(draft, catalogue) {
         draft.sources.thumbnail === "prompt_by_llm" ||
         draft.intro?.mode === "llm" ||
         draft.outro?.mode === "llm" ||
-        usesNarrationPreparation(draft);
+        usesNarrationPreparation(draft) ||
+        usesYoutubeDescription(draft);
     const checks = [
         { field: "llm", family: "llm", choice: draft.llm, needed: needLlm },
         {

package/dist/edge/docker-projects/state.js

@@ -104,10 +104,14 @@ export const journalSchema = z
     token: z.string().regex(/^[a-f0-9]{64}$/),
 })
     .strict();
+/** Where the Docker launcher keeps one folder (and receipt) per installation. */
+export function dockerRoot(env, home) {
+    return join(absolute.parse(env.XDG_DATA_HOME || join(home, ".local/share")), "slopify/docker");
+}
 export function dockerConfig(env, home, cwd, uid, gid) {
     const name = identifier.parse(env.SLOPIFY_DOCKER_NAME || "slopify");
     const volume = identifier.parse(env.SLOPIFY_DOCKER_VOLUME || "slopify-data");
-    const root = join(absolute.parse(env.XDG_DATA_HOME || join(home, ".local/share")), "slopify/docker");
+    const root = dockerRoot(env, home);
     const raw = env.SLOPIFY_DOCKER_PROJECTS_DIR || null;
     const projectsOverride = raw === null ? null : resolve(cwd, raw.startsWith("~/") ? join(home, raw.slice(2)) : raw);
     const portText = env.SLOPIFY_DOCKER_HOST_PORT || "6969";

package/dist/edge/host-cli.js

@@ -1,15 +1,18 @@
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { nodeRunCli } from "../adapters/llm/run-cli.js";
 import { hostEnvironmentSchema } from "../host-cli/environment.js";
+import { launchXdgOpen } from "../host-cli/open-folder.js";
 import { ensureBridgeToken, prepareHostPaths } from "../host-cli/paths.js";
 import { createHostRuntime } from "../host-cli/runtime.js";
 import { startHostServer } from "../host-cli/server.js";
 import { resolveHostCommand } from "../host-cli/status.js";
 import { readVersion } from "../kernel/version.js";
 import { nodeCliProbe } from "../slices/settings/cli-status.js";
+import { dockerRoot } from "./docker-projects/state.js";
 const { values } = parseArgs({ options: { "state-dir": { type: "string" } }, strict: true });
 if (!values["state-dir"])
     throw new Error("A host helper state directory is required.");
@@ -32,6 +35,14 @@ try {
 finally {
     await file.close();
 }
+// Without a usable data folder there are no launcher receipts, so Open folder stays unsupported.
+let folderRoot;
+try {
+    folderRoot = dockerRoot(process.env, process.env.HOME || homedir());
+}
+catch {
+    folderRoot = undefined;
+}
 const server = await startHostServer({
     directory: paths.share,
     token: await ensureBridgeToken(paths.tokenFile),
@@ -42,6 +53,9 @@ const server = await startHostServer({
         env: process.env,
         now: Date.now,
         resolve: (id) => resolveHostCommand(id, process.env),
+        ...(process.getuid === undefined || folderRoot === undefined
+            ? {}
+            : { folders: { root: folderRoot, uid: process.getuid(), launch: launchXdgOpen } }),
     }),
 });
 process.on("SIGHUP", server.pauseAdmissions);

package/dist/edge/http/folder-location-schema.js

@@ -1,11 +1,8 @@
 import { z } from "zod";
-export const folderReplySchema = z.discriminatedUnion("opened", [
+const dockerHost = { location: z.literal("docker-host"), path: z.string().min(1) };
+// In Docker the host helper may open the folder itself; the host path is sent either way.
+export const folderReplySchema = z.union([
     z.object({ opened: z.literal(true) }).strict(),
-    z
-        .object({
-        opened: z.literal(false),
-        location: z.literal("docker-host"),
-        path: z.string().min(1),
-    })
-        .strict(),
+    z.object({ opened: z.literal(true), ...dockerHost }).strict(),
+    z.object({ opened: z.literal(false), ...dockerHost }).strict(),
 ]);

package/dist/edge/http/folder-location.js

@@ -27,11 +27,16 @@ export async function replyForFolder(c, deps, projectId, file) {
                 if (s.isSymbolicLink() || (i === parts.length - 1 ? !s.isFile() : !s.isDirectory()))
                     throw new Error("Unavailable output");
             }
-            return c.json(folderReplySchema.parse({
-                opened: false,
-                location: "docker-host",
-                path: join(host, dirname(r)),
-            }));
+            const hostPath = join(host, dirname(r));
+            const opened = (await deps.folderLocation
+                .openOnHost?.(hostPath, AbortSignal.timeout(10_000))
+                .catch(() => false)) === true;
+            if (!opened && deps.folderLocation.openOnHost)
+                deps.log.write("warn", "project.open-folder", {
+                    projectId,
+                    detail: "The host helper did not open the folder (not installed, too old, or it refused), so the host path was shown instead.",
+                });
+            return c.json(folderReplySchema.parse({ opened, location: "docker-host", path: hostPath }));
         }
         catch {
             deps.log.write("warn", "project.locate-folder", {

package/dist/edge/http/host-cli.js

@@ -5,7 +5,7 @@ import { stream } from "hono/streaming";
 import { z } from "zod";
 import { sniffImage } from "../../adapters/image/bytes.js";
 import { redact } from "../../kernel/log.js";
-import { bridgeLimits, hostCliIds, hostCliProtocol, hostFrameSchema, hostImageSchema, hostLlmIds, hostLlmSchema, hostModelsSchema, hostStatusSchema, } from "../../kernel/ports/host-cli.js";
+import { bridgeLimits, HostFolderRefused, hostCliIds, hostCliProtocol, hostFrameSchema, hostImageSchema, hostLlmIds, hostLlmSchema, hostModelsSchema, hostOpenFolderSchema, hostStatusSchema, } from "../../kernel/ports/host-cli.js";
 import { isProviderError, providerError } from "../../kernel/ports/model.js";
 export function hostGate() {
     let accepting = true;
@@ -82,7 +82,8 @@ export function hostCliRoutes(options) {
         accepting: gate.accepting,
     }));
     app.use("/v1/*", async (c, next) => {
-        const kind = c.req.method === "POST" ? "generation" : "metadata";
+        // Opening a folder is quick and must not look like running work to the launcher's upgrade check.
+        const kind = c.req.method === "POST" && c.req.path !== "/v1/open-folder" ? "generation" : "metadata";
         const job = gate.acquire(kind);
         if (!job)
             return c.json({
@@ -244,6 +245,30 @@ export function hostCliRoutes(options) {
             controller.abort();
         }
     });
+    app.post("/v1/open-folder", async (c) => {
+        const open = ports.openFolder;
+        if (!open)
+            return c.notFound();
+        const body = hostOpenFolderSchema.safeParse(await json(c.req.raw));
+        if (!body.success)
+            return invalid(c);
+        try {
+            await open(body.data.path);
+        }
+        catch (error) {
+            const refused = error instanceof HostFolderRefused;
+            return c.json({
+                type: "error",
+                kind: "unavailable",
+                message: (error instanceof Error
+                    ? error.message
+                    : "The Slopify host helper could not open the folder. Copy the path into your file manager instead.")
+                    .replaceAll(token, "[redacted]")
+                    .slice(0, 4096),
+            }, refused ? 403 : 503);
+        }
+        return c.json({ opened: true });
+    });
     app.onError((error, c) => c.json(fault(error, token), 503));
     app.notFound((c) => c.json({
         type: "error",

package/dist/edge/http/revision-files.js

@@ -33,10 +33,14 @@ export function revisionFileRoutes(deps) {
         if (!result.ok)
             return unavailable(c, result.reason);
         const value = result.download;
+        // `?inline=1` lets the project page open a PDF in a browser tab instead of saving
+        // it. Only PDFs: anything else the browser might render stays a download.
+        const inline = c.req.query("inline") === "1" && value.contentType === "application/pdf";
         return c.body(Readable.toWeb(createReadStream(value.path)), 200, {
             "content-type": value.contentType,
             "content-length": String(value.bytes),
-            "content-disposition": `attachment; filename="${value.filename}"`,
+            "content-disposition": `${inline ? "inline" : "attachment"}; filename="${value.filename}"`,
+            "x-content-type-options": "nosniff",
         });
     });
 }

package/dist/host-cli/open-folder.js

@@ -0,0 +1,95 @@
+import { spawn } from "node:child_process";
+import { lstat, readdir } from "node:fs/promises";
+import { isAbsolute, join, relative, sep } from "node:path";
+import { readState, receiptSchema } from "../edge/docker-projects/state.js";
+import { HostFolderRefused } from "../kernel/ports/host-cli.js";
+import { hasCode } from "./paths.js";
+const again = "run the Docker launcher again (npx @gentbajko/slopify@latest --docker)";
+/** Starts the desktop's opener and returns once it is running; the file manager is not awaited. */
+export function launchXdgOpen(directory) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("xdg-open", [directory], {
+            detached: true,
+            shell: false,
+            stdio: "ignore",
+        });
+        child.once("error", (error) => {
+            reject(new Error(hasCode(error, "ENOENT")
+                ? "xdg-open isn't installed on this machine, so the Slopify host helper can't open a file manager. Install xdg-utils (for example sudo pacman -S xdg-utils or sudo apt install xdg-utils), then use Open folder again."
+                : `The Slopify host helper could not start xdg-open to open ${directory}. Check that you are signed in to this computer's desktop, then use Open folder again.`));
+        });
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+}
+/** Only folders inside a launcher receipt's project folder, reached through real folders you own, are opened. */
+export function createHostFolderOpener(deps) {
+    async function receipts() {
+        const found = [];
+        let entries;
+        try {
+            const root = await lstat(deps.root);
+            if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== deps.uid)
+                return [];
+            entries = await readdir(deps.root, { withFileTypes: true });
+        }
+        catch {
+            return [];
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            try {
+                const receipt = await readState(join(deps.root, entry.name, "receipt.json"), receiptSchema, deps.uid);
+                if (receipt)
+                    found.push(receipt);
+            }
+            catch {
+                // An unreadable or damaged receipt grants nothing; the others still count.
+            }
+        }
+        return found;
+    }
+    async function verify(projects, identity, r) {
+        const root = await lstat(projects, { bigint: true }).catch(() => undefined);
+        if (!root?.isDirectory() ||
+            root.isSymbolicLink() ||
+            root.uid !== BigInt(deps.uid) ||
+            String(root.dev) !== identity.dev ||
+            String(root.ino) !== identity.ino)
+            throw new HostFolderRefused(`The Slopify host helper did not open this folder because the project folder ${projects} was moved or replaced since the Docker launcher set it up. Put the original folder back, or ${again}.`);
+        let current = projects;
+        for (const part of r === "" ? [] : r.split(sep)) {
+            current = join(current, part);
+            const s = await lstat(current).catch(() => undefined);
+            if (!s?.isDirectory() || s.isSymbolicLink() || s.uid !== deps.uid)
+                throw new HostFolderRefused(`The Slopify host helper did not open ${current} because it is missing, a link or a file, or isn't owned by you. Use Re-run section on the project page to make the file again, or copy the path into your file manager.`);
+        }
+    }
+    return async (path) => {
+        if (!isAbsolute(path) || /[\p{Cc}]/u.test(path))
+            throw new HostFolderRefused(`The Slopify host helper did not open this folder because Slopify sent a path it can't use. Update Slopify: ${again}.`);
+        let refusal;
+        for (const receipt of await receipts()) {
+            const r = relative(receipt.projects, path);
+            if (r === ".." || r.startsWith(`..${sep}`) || isAbsolute(r))
+                continue;
+            try {
+                await verify(receipt.projects, receipt.directoryIdentity, r);
+            }
+            catch (error) {
+                if (!(error instanceof HostFolderRefused))
+                    throw error;
+                refusal = error;
+                continue;
+            }
+            // Open the normalised path that was checked, never the caller's spelling of it.
+            await deps.launch(join(receipt.projects, r));
+            return;
+        }
+        throw (refusal ??
+            new HostFolderRefused(`The Slopify host helper did not open ${path} because it isn't inside a project folder set up by the Docker launcher. Copy the path into your file manager, or if you moved your project folder, ${again}.`));
+    };
+}

package/dist/host-cli/runtime.js

@@ -9,6 +9,7 @@ import { nodeCodexModels } from "../adapters/llm/codex-models.js";
 import { geminiLlm } from "../adapters/llm/gemini.js";
 import { nodeGeminiModels } from "../adapters/llm/gemini-models.js";
 import { providerError } from "../kernel/ports/model.js";
+import { createHostFolderOpener } from "./open-folder.js";
 import { createHostStatus } from "./status.js";
 export function createHostRuntime(deps) {
     const status = createHostStatus(deps);
@@ -32,6 +33,7 @@ export function createHostRuntime(deps) {
     };
     return {
         status,
+        ...(deps.folders === undefined ? {} : { openFolder: createHostFolderOpener(deps.folders) }),
         llm: (id) => ({
             id,
             capabilities: { streams: true, reportsUsage: true, webSearch: true },

package/dist/kernel/db/migrate.js

@@ -20,9 +20,24 @@ export function migrate(db, clock) {
         if (version === undefined || applied.has(version)) {
             continue;
         }
+        const sql = readFileSync(new URL(file, migrationsDir), "utf8");
+        // A migration that rebuilds a table other tables reference must run with enforcement
+        // off: dropping the old table would otherwise cascade into every row that points at it.
+        // SQLite ignores this pragma inside a transaction, so it is set around one, and every
+        // reference is checked before the rebuild commits.
+        const rebuild = sql.split("\n", 1)[0]?.trim() === foreignKeysOff;
+        const enforced = rebuild && foreignKeysOn(db);
+        if (enforced)
+            db.exec("PRAGMA foreign_keys = OFF");
         db.exec("BEGIN");
         try {
-            db.exec(readFileSync(new URL(file, migrationsDir), "utf8"));
+            db.exec(sql);
+            if (rebuild) {
+                const broken = db.prepare("PRAGMA foreign_key_check").all();
+                if (broken.length > 0) {
+                    throw new Error(`Slopify couldn't upgrade its database: migration ${file} would leave ${broken.length} broken links between saved records, so it was undone and your data was not changed. Go back to the previous version of Slopify (npx @gentbajko/slopify@<previous version>) and report this on GitHub with the Download diagnostics file from Settings.`);
+                }
+            }
             db.prepare("INSERT INTO schema_migrations (version, applied_at) VALUES (?, ?)").run(version, clock.now().toISOString());
             db.exec("COMMIT");
         }
@@ -30,8 +45,17 @@ export function migrate(db, clock) {
             db.exec("ROLLBACK");
             throw error;
         }
+        finally {
+            if (enforced)
+                db.exec("PRAGMA foreign_keys = ON");
+        }
     }
 }
+// The first line of such a migration, compared without its line ending.
+const foreignKeysOff = "-- foreign-keys: off";
+function foreignKeysOn(db) {
+    return db.prepare("PRAGMA foreign_keys").get()?.foreign_keys === 1;
+}
 function versionOf(file) {
     const version = Number(file.slice(0, 4));
     if (!Number.isInteger(version) || version < 1) {

package/dist/kernel/db/migrations/0014-document-stage.sql

@@ -0,0 +1,44 @@
+-- foreign-keys: off
+-- SQLite cannot widen a CHECK constraint in place, so the two tables that list the stage
+-- kinds are rebuilt. `stages` is referenced by attempts, stage_pieces and revision_work with
+-- ON DELETE CASCADE: migrate.ts turns enforcement off for this file, or dropping the old
+-- table would empty those three, and checks every reference before it commits.
+CREATE TABLE stages_document_upgrade (id TEXT PRIMARY KEY, project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE, kind TEXT NOT NULL CHECK(kind IN ('research','article','audio','images','thumbnail','video','document')), source TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('pending','running','done','failed','canceled','provided','skipped')), failure_reason TEXT, attempt_count INTEGER NOT NULL DEFAULT 0, progress_current INTEGER, progress_total INTEGER, started_at TEXT, finished_at TEXT, UNIQUE(project_id, kind));
+INSERT INTO stages_document_upgrade (id,project_id,kind,source,state,failure_reason,attempt_count,progress_current,progress_total,started_at,finished_at)
+  SELECT id,project_id,kind,source,state,failure_reason,attempt_count,progress_current,progress_total,started_at,finished_at FROM stages;
+DROP TABLE stages;
+ALTER TABLE stages_document_upgrade RENAME TO stages;
+CREATE UNIQUE INDEX stages_project_identity ON stages(project_id,id,kind);
+
+-- Every existing project gets the new stage switched off, so nothing it already finished
+-- shows as waiting.
+INSERT INTO stages (id,project_id,kind,source,state)
+  SELECT id || '-document', id, 'document', 'off', 'skipped' FROM projects;
+
+CREATE TABLE revision_pieces_document_upgrade (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  revision_id TEXT NOT NULL,
+  piece_key TEXT NOT NULL,
+  stage_kind TEXT NOT NULL CHECK(stage_kind IN
+    ('research','article','audio','images','thumbnail','video','document')),
+  asset_id TEXT,
+  fingerprint TEXT NOT NULL,
+  descriptor TEXT NOT NULL CHECK(json_valid(descriptor)),
+  publication_id TEXT,
+  selected INTEGER NOT NULL CHECK(selected IN (0,1)),
+  created_at TEXT NOT NULL,
+  FOREIGN KEY(project_id, revision_id)
+    REFERENCES project_revisions(project_id, id) ON DELETE CASCADE,
+  FOREIGN KEY(project_id, asset_id)
+    REFERENCES project_assets(project_id, id) ON DELETE CASCADE
+);
+INSERT INTO revision_pieces_document_upgrade (id,project_id,revision_id,piece_key,stage_kind,asset_id,fingerprint,descriptor,publication_id,selected,created_at)
+  SELECT id,project_id,revision_id,piece_key,stage_kind,asset_id,fingerprint,descriptor,publication_id,selected,created_at FROM revision_pieces;
+DROP TABLE revision_pieces;
+ALTER TABLE revision_pieces_document_upgrade RENAME TO revision_pieces;
+CREATE UNIQUE INDEX revision_pieces_selected ON revision_pieces(revision_id, piece_key)
+  WHERE selected = 1;
+CREATE INDEX revision_pieces_revision ON revision_pieces(revision_id, created_at, id);
+CREATE UNIQUE INDEX revision_pieces_publication ON revision_pieces(revision_id, publication_id, piece_key)
+  WHERE publication_id IS NOT NULL;