@gizai/cli 2.2.0 → 2.2.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Giz Systems Inc. and the Gizlang contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/cli/giz.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { computerIdentity, managedRevision } from './computer-identity.mjs'
 import { checkForUpdate, explicitUpdate, installSource, maybeNotify } from './update.mjs'
-import { runToolchain, toolchainCommand } from './toolchain.mjs'
+import { GROUPS, runToolchain, toolchainCommand, toolchainRoot, toolchainVersion } from './toolchain.mjs'
 import { createHash, randomBytes } from 'node:crypto'
-import { openAsBlob, statSync } from 'node:fs'
+import { existsSync, openAsBlob, rmSync, statSync } from 'node:fs'
 import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises'
+import { createInterface } from 'node:readline/promises'
 import { createServer } from 'node:http'
 import { once } from 'node:events'
 import { createRequire } from 'node:module'
@@ -457,6 +458,7 @@ async function runCommand(baseUrl, positionals, options) {
     await checkForUpdate({ file: options.cache, url: options.registry })
     return undefined
   }
+  if (command === 'uninstall') return { kind: 'message', value: options.help === true ? help('uninstall') : await uninstall(options) }
   if (command === 'update' && options.help === true) return { kind: 'help', value: help('update') }
   if (command === 'update' && !subcommand) {
     const result = await explicitUpdate({ version: CLI_VERSION, source: installSource() })
@@ -464,14 +466,15 @@ async function runCommand(baseUrl, positionals, options) {
   }
   if (options.version === true) {
     const revision = await managedRevision()
-    return { kind: 'message', value: CLI_VERSION + (revision ? ` (region ${revision.trim()})` : '') }
+    const toolchain = toolchainVersion() ?? `not installed (${toolchainRoot()})`
+    return { kind: 'message', value: `@gizai/cli ${CLI_VERSION}${revision ? ` (region ${revision.trim()})` : ''}\nGizlang toolchain: ${toolchain}` }
   }
   if (!command || command === 'help' || options.help === true) {
     // A script that asks for help on a command that does not exist must fail, not read the overview as success.
     if (command && !gizCommand(command)) {
       throw new CliError(`Unknown command "${command}".`, 'Run: giz --help')
     }
-    return { kind: 'help', value: help(command) }
+    return { kind: 'help', value: help(command, options.all === true) }
   }
   if (command === 'engine' && subcommand === 'run') {
     if (rest[0] !== 'claude') throw new CliError('Only Claude Code is an engine connection.')
@@ -938,7 +941,13 @@ function print(kind, value, json, output = process.stdout) {
   output.write(`${JSON.stringify(value, null, 2)}\n`)
 }
 
-function help(command) {
+function help(command, all = false) {
+  if (command === 'uninstall') return `Usage
+  giz uninstall [--yes] [--credentials]
+
+Removes the Gizlang toolchain (${toolchainRoot()}; GIZ_INSTALL names another folder) after a confirmation.
+--yes skips the confirmation. --credentials also removes your giz.ai login (${configPath}).
+It prints the command that removes @gizai/cli itself.`
   if (command === 'engine') return `Usage
   giz engine run claude "instruction" [--dir path]
 
@@ -1047,6 +1056,7 @@ http uses the client's own OAuth login. Install the chosen client first.`
 Usage
   giz auth login [--device]
   giz update
+  giz uninstall [--yes] [--credentials]
   giz api-key list|create|revoke
   giz chat MODEL "your prompt"
   giz model list [--type TYPE] [--search TEXT]
@@ -1071,8 +1081,8 @@ Usage
 
 Use giz COMMAND --help for parameters and examples.
 
-Gizlang (the toolchain is installed on first use, with its size shown)
-  init, run, build, test, check, deploy, and every other command; gizdb runs the database server.
+Gizlang (giz COMMAND; the toolchain is installed on first use, with its size shown; gizdb runs the database server)
+${gizlangCommands(all)}
   Docs: https://gizstack.com/docs
 
 Global options
@@ -1084,6 +1094,41 @@ Global options
 Docs: https://www.giz.ai/mcp/`
 }
 
+// The toolchain's commands by group, as its own help shows them, from the generated table (toolchain.mjs GROUPS), so the
+// list needs no download. Its Repository group serves a Gizlang checkout and shows only with --all. No line starts with
+// "  giz ": gizCommand reads those as giz.ai's.
+function gizlangCommands(all) {
+  return GROUPS.filter((group) => all || group.name !== 'Repository').map((group) => `  ${group.name}:\n` +
+    group.commands.map((command) => `    ${command.synopsis.padEnd(30)} ${command.summary}`).join('\n')).join('\n')
+}
+
+// Removes the toolchain's folder and nothing else: a folder without the toolchain's program is refused.
+async function uninstall(options) {
+  const root = toolchainRoot()
+  const after = `\nTo remove @gizai/cli itself, run: ${installSource().remove ?? 'npm uninstall -g @gizai/cli'}`
+  const removed = []
+  if (existsSync(root)) {
+    if (!existsSync(path.join(root, 'bin', process.platform === 'win32' ? 'giz.exe' : 'giz'))) {
+      throw new CliError(`${root} does not hold the Gizlang toolchain (no bin/giz); nothing was removed.`)
+    }
+    if (options.yes !== true) {
+      if (!process.stdin.isTTY) throw new CliError(`Removing ${root} needs a confirmation.`, 'Run: giz uninstall --yes')
+      const ask = createInterface({ input: process.stdin, output: process.stderr })
+      const login = options.credentials === true ? ` and your giz.ai login (${configPath})` : ''
+      const answer = await ask.question(`Remove the Gizlang toolchain at ${root}${login}? [y/N] `)
+      ask.close()
+      if (!/^y(es)?$/i.test(answer.trim())) return `Nothing was removed.${after}`
+    }
+    rmSync(root, { recursive: true, force: true })
+    removed.push(root)
+  }
+  if (options.credentials === true && existsSync(configPath)) {
+    rmSync(configPath)
+    removed.push(configPath)
+  }
+  return (removed.length ? `Removed ${removed.join(' and ')}.` : `The Gizlang toolchain is not installed (${root}).`) + after
+}
+
 // giz.ai's commands are the ones its overview lists; every other command is the Gizlang toolchain's (toolchain.mjs).
 function gizCommand(name) {
   return ['help', 'models', '__update-check'].includes(name) ||
@@ -1108,7 +1153,7 @@ async function main() {
   void maybeNotify({ version: CLI_VERSION, source, mode: updateMode, env: { ...process.env, GIZ_JSON: options.json === true ? '1' : process.env.GIZ_JSON } }).catch(() => {})
   const requiresAuth = positionals.length && !options.help && !options.version &&
     !(positionals[0] === 'auth' && ['login', 'logout'].includes(positionals[1])) &&
-    !['update', '__update-check'].includes(positionals[0])
+    !['help', 'update', 'uninstall', '__update-check'].includes(positionals[0])
   const computer = requiresAuth && !process.env.GIZ_TOKEN && !saved?.access_token ? await computerIdentity() : undefined
   const baseUrl = String(options['base-url'] || process.env.GIZ_URL || saved?.baseUrl || computer?.baseUrl || DEFAULT_URL).replace(/\/+$/, '')
   if (typeof options.org === 'string') process.env.GIZ_ORGANIZATION = options.org

package/cli/gizlang-commands.json

@@ -0,0 +1,210 @@
+{
+  "schema": "gizai.gizlang-commands.v1",
+  "groups": [
+    {
+      "name": "Daily work",
+      "commands": [
+        {
+          "name": "init",
+          "synopsis": "init [FLAG...] [DIR]",
+          "summary": "Create a Hello project: `main.giz`, its test `main.test.giz` and a `package.json` that names the entry, or with `--template NAME` a copy of an example app."
+        },
+        {
+          "name": "run",
+          "synopsis": "run [FLAG...] FILE [ARGUMENT...]",
+          "summary": "Build FILE (cached) and run it with the arguments."
+        },
+        {
+          "name": "check",
+          "synopsis": "check [FLAG...] FILE...",
+          "summary": "Check each FILE (`.giz`, `.gizgraph` or `package.json`)."
+        },
+        {
+          "name": "build",
+          "synopsis": "build [FLAG...] FILE",
+          "summary": "Compile FILE to a program for this CPU, and print its path."
+        },
+        {
+          "name": "test",
+          "synopsis": "test [FLAG...] [FILE... | FOLDER | FILTER]",
+          "summary": "Run the tests of each FILE: a test function `testName()`, or vitest's `test(\"name\", () => ...)` with `expect`."
+        },
+        {
+          "name": "live",
+          "synopsis": "live [FLAG...] FILE",
+          "summary": "Run FILE, and replace its code while it runs each time you save a source in its folder."
+        },
+        {
+          "name": "doc",
+          "synopsis": "doc [FLAG...] [NAME]",
+          "summary": "Show the documentation of NAME: a module (`gizlang:json`), a declaration (`Json.get`) or a command (`check`)."
+        },
+        {
+          "name": "repl",
+          "synopsis": "repl",
+          "summary": "Start the read-eval-print loop."
+        },
+        {
+          "name": "fmt",
+          "synopsis": "fmt [FLAG...] FILE...",
+          "summary": "Lay out each FILE by its brackets and spacing rules; a line over 120 characters is cut at its statements, blocks, items and lists."
+        },
+        {
+          "name": "help",
+          "synopsis": "help [--all | COMMAND]",
+          "summary": "Print the commands by group, or the help of COMMAND."
+        },
+        {
+          "name": "version",
+          "synopsis": "version",
+          "summary": "Print the identity of the toolchain."
+        }
+      ]
+    },
+    {
+      "name": "Code and packages",
+      "commands": [
+        {
+          "name": "python",
+          "synopsis": "python [OPTION...] (-c CODE | -m MODULE | FILE | -) [ARGUMENT...]",
+          "summary": "Run Python as `python3` does, on the VM: CPython's options are taken (most have no effect)."
+        },
+        {
+          "name": "wasm",
+          "synopsis": "wasm FILE [ARGUMENT...]",
+          "summary": "Build FILE as a wasm64 module and run it in `runtime/wasm.mjs`, which gives it only the console."
+        },
+        {
+          "name": "outline",
+          "synopsis": "outline [FLAG...] FILE",
+          "summary": "Print the declarations of FILE, one a line: where it is, its signature and effects, and its doc summary under it."
+        },
+        {
+          "name": "context",
+          "synopsis": "context FILE WORD...",
+          "summary": "Print the declarations that mention a WORD in full, and the first lines of their neighbours."
+        },
+        {
+          "name": "project",
+          "synopsis": "project FILE",
+          "summary": "Print the canonical source of FILE, with the sugar spelled out."
+        },
+        {
+          "name": "edit",
+          "synopsis": "edit FILE",
+          "summary": "Apply the JSON edit request on stdin to FILE, if the result checks."
+        },
+        {
+          "name": "lsp",
+          "synopsis": "lsp",
+          "summary": "Start the language server on stdin and stdout."
+        },
+        {
+          "name": "bind",
+          "synopsis": "bind HEADER LIBRARY NAME...",
+          "summary": "Print `declare` lines for the C functions NAME of HEADER in LIBRARY."
+        },
+        {
+          "name": "codec",
+          "synopsis": "codec FILE TYPE...",
+          "summary": "Print JSON functions for the record types TYPE of FILE."
+        },
+        {
+          "name": "i18n",
+          "synopsis": "i18n [FLAG...] DIR",
+          "summary": "Bring the catalogs `locales/TAG.json` of the `.ghtml` files under DIR up to date: add each message a catalog lacks with an empty translation (shown in English until translated), remove the keys no file shows, and print how much of each catalog is translated."
+        },
+        {
+          "name": "pin",
+          "synopsis": "pin DIR",
+          "summary": "Write the sha256 pins in `DIR/package.json` again, dependencies first."
+        },
+        {
+          "name": "get",
+          "synopsis": "get [FLAG...] DIR [NAME@VERSION... npm:NAME@SPEC...]",
+          "summary": "Raise the requirements of the package in DIR, vendor the minimal version selection, run `npm install` (without its scripts) and pin the result."
+        },
+        {
+          "name": "capabilities",
+          "synopsis": "capabilities",
+          "summary": "Write the operations of this command line and the exact identity of the running toolchain."
+        },
+        {
+          "name": "completion",
+          "synopsis": "completion bash",
+          "summary": "Print a bash completion script."
+        },
+        {
+          "name": "vscode",
+          "synopsis": "vscode",
+          "summary": "Install the Gizlang extension of this toolchain into VS Code."
+        },
+        {
+          "name": "licenses",
+          "synopsis": "licenses FILE",
+          "summary": "Print the third-party notices for the native link inputs of FILE."
+        },
+        {
+          "name": "doctor",
+          "synopsis": "doctor",
+          "summary": "Check what this machine gives Gizlang: the system and its glibc, the toolchain, `giz` on PATH, free disk space, each GPU with its memory and driver, the models downloaded and the release host."
+        }
+      ]
+    },
+    {
+      "name": "Deploy and cloud",
+      "commands": [
+        {
+          "name": "deploy",
+          "synopsis": "deploy [FLAG...] [FILE...]",
+          "summary": "Without `--live`, send FILE, else the folder's `app.giz` (and `app.test.giz`), to GizStack with your terminal token (`GIZ_TOKEN`): it checks and tests the change and publishes it into the running app at NAME.giz.sh, or refuses it and the old version keeps serving."
+        },
+        {
+          "name": "ai",
+          "synopsis": "ai [FLAG...] models | pull NAME | chat NAME [PROMPT...] | image PROMPT... | serve NAME... | worker NAME | gate URL CASES DIR | registry",
+          "summary": "Run AI models on this computer by name: `models` lists the catalog (the models of every family in ai/models); any Hugging Face repository (`owner/name`) of a family gizai:llm reads is a chat model too."
+        },
+        {
+          "name": "api",
+          "synopsis": "api [FLAG...] [NAME [FIELD=VALUE...]]",
+          "summary": "Run the GizStack operation NAME with your terminal token (`GIZ_TOKEN`), as the console, MCP and agents do, and print its result as JSON; a refusal prints why and exits 1."
+        },
+        {
+          "name": "ssh-proxy",
+          "synopsis": "ssh-proxy COMPUTER [PORT]",
+          "summary": "Reach a running Giz Computer of your team through GizStack with your terminal token (`GIZ_TOKEN`): standard input and output are copied through a one-use tunnel to PORT (22 by default) of the Computer, with no public address."
+        },
+        {
+          "name": "publish",
+          "synopsis": "publish DIR [NAME@VERSION]",
+          "summary": "Publish the package in DIR under the name and version of its manifest."
+        },
+        {
+          "name": "public-key",
+          "synopsis": "public-key SEED",
+          "summary": "Print the hexadecimal Ed25519 public key of the 32-byte SEED file (`GIZLANG_SIGNING_KEY`), for `GIZLANG_TRUSTED_KEYS`."
+        }
+      ]
+    },
+    {
+      "name": "Repository",
+      "commands": [
+        {
+          "name": "storage",
+          "synopsis": "storage [FLAG...] OPERATION [OPERAND...]",
+          "summary": "Manage a storage range: buckets, objects (`ls`, `cp`, `rm`, `stat`, `presign`), keys, usage, a FUSE mount and block volumes."
+        },
+        {
+          "name": "bench",
+          "synopsis": "bench [FLAG...] list [SUITE] | run|show|compare|record ID...",
+          "summary": "Run the benchmark suites of this toolchain, all or in part."
+        },
+        {
+          "name": "work",
+          "synopsis": "work [FLAG...] OPERATION [OPERAND...]",
+          "summary": "Manage the work items of the git repository here: `list`, `show`, `open`, `drop`, `claim`, `release`, `claims`, `age`, `burndown`, `check`."
+        }
+      ]
+    }
+  ]
+}

package/cli/toolchain.mjs

@@ -1,20 +1,19 @@
 import { spawnSync } from 'node:child_process'
-import { existsSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { createInterface } from 'node:readline/promises'
 
 // The Gizlang toolchain (GizStack: giz init, run, build, test, deploy, … and gizdb) is a native program per OS. This
-// package carries none of it: the first command that needs it installs it with gizstack.com's own install script for
-// this OS, which names the download size, checks the release signature and every file, and selects the version (a
-// project pin or the active one). Later runs execute the installed program at once.
+// package carries none of it: the first command that needs it installs it at once, with no question, by gizstack.com's
+// own install script for this OS, which names the download size first, checks the release signature and every file,
+// and selects the version (a project pin or the active one). Later runs execute the installed program at once.
 const SITE = 'https://gizstack.com'
-// The toolchain's public commands (gizlang tools/cli/commands.giz). Only these, or a program file, install it: an agent
-// that asks for help on a command that does not exist must get an error, not a 200 MB download. Once the toolchain is
-// installed, every command giz.ai does not know goes to it, and it owns the error.
-const COMMANDS = new Set(['init', 'run', 'check', 'build', 'test', 'live', 'doc', 'repl', 'fmt', 'version', 'upgrade',
-  'python', 'wasm', 'outline', 'context', 'project', 'edit', 'lsp', 'bind', 'codec', 'i18n', 'pin', 'get', 'capabilities',
-  'completion', 'vscode', 'licenses', 'doctor', 'deploy', 'ai', 'api', 'ssh-proxy', 'publish', 'public-key', 'storage', 'bench'])
+// The toolchain's public commands by help group, written from its command table (tools/cli/commands.giz) by
+// tools/cli/npm/commands.giz. Only these, or a program file, install it: an agent that asks for help on a command that
+// does not exist must get an error, not a 200 MB download. Once the toolchain is installed, every command giz.ai does not
+// know goes to it, and it owns the error.
+export const GROUPS = JSON.parse(readFileSync(new URL('./gizlang-commands.json', import.meta.url), 'utf8')).groups
+const COMMANDS = new Set(GROUPS.flatMap((group) => group.commands.map((command) => command.name)))
 const windows = process.platform === 'win32'
 
 export function toolchainRoot(env = process.env) {
@@ -30,26 +29,36 @@ function installed(root, program) {
   return path.join(root, 'bin', program + (windows ? '.exe' : ''))
 }
 
-async function confirmed(command) {
-  // A script or CI has no terminal to ask: it asked for the command, so it gets it.
-  if (!process.stdin.isTTY || !process.stderr.isTTY) return true
-  const prompt = createInterface({ input: process.stdin, output: process.stderr })
-  try {
-    const answer = await prompt.question(`giz ${command} needs the Gizlang toolchain, which is not installed. Install it from ${SITE} now? [Y/n] `)
-    return !/^n/i.test(answer.trim())
-  } finally { prompt.close() }
+/** The installed toolchain's identity (`giz version`), or undefined when it is not installed. It never installs it. */
+export function toolchainVersion() {
+  const file = installed(toolchainRoot(), 'giz')
+  if (!existsSync(file)) return undefined
+  const ran = spawnSync(file, ['version'], { encoding: 'utf8' })
+  return ran.status === 0 ? ran.stdout.trim() : undefined
 }
 
 async function install(root) {
   const response = await fetch(`${SITE}/${windows ? 'install.ps1' : 'install'}`)
   if (!response.ok) throw new Error(`cannot download the install script: HTTP ${response.status} from ${SITE}`)
   const script = await response.text()
-  // The script's progress goes to stderr: stdout stays the command's own.
-  const ran = windows
-    ? spawnSync('powershell', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command', '-'], { input: script, stdio: ['pipe', process.stderr, 'inherit'], env: { ...process.env, GIZ_INSTALL: root } })
-    : spawnSync('sh', ['-s', '--', '--no-modify-path'], { input: script, stdio: ['pipe', process.stderr, 'inherit'], env: { ...process.env, GIZ_INSTALL: root } })
-  if (ran.error) throw new Error(`cannot run the install script: ${ran.error.message}`)
-  return ran.status === 0
+  // The script's progress goes to stderr: stdout stays the command's own. PATH is this package's: the script changes none.
+  const env = { ...process.env, GIZ_INSTALL: root, NO_MODIFY_PATH: '1' }
+  if (!windows) {
+    const ran = spawnSync('sh', ['-s', '--', '--no-modify-path'], { input: script, stdio: ['pipe', process.stderr, 'inherit'], env })
+    if (ran.error) throw new Error(`cannot run the install script: ${ran.error.message}`)
+    return ran.status === 0
+  }
+  // PowerShell runs a file whole; from stdin it runs line by line and breaks the script's blocks.
+  const folder = mkdtempSync(path.join(os.tmpdir(), 'giz-install-'))
+  try {
+    const file = path.join(folder, 'install.ps1')
+    writeFileSync(file, script)
+    const ran = spawnSync('powershell', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', file], { stdio: ['ignore', process.stderr, 'inherit'], env })
+    if (ran.error) throw new Error(`cannot run the install script: ${ran.error.message}`)
+    return ran.status === 0
+  } finally {
+    rmSync(folder, { recursive: true, force: true })
+  }
 }
 
 /** Runs PROGRAM (giz or gizdb) of the toolchain with ARGS, installing the toolchain first when it is missing. */
@@ -57,7 +66,6 @@ export async function runToolchain(program, args) {
   const root = toolchainRoot()
   const file = installed(root, program)
   if (!existsSync(file)) {
-    if (!await confirmed(args[0] || program)) { process.exitCode = 1; return }
     if (!await install(root) || !existsSync(file)) {
       process.stderr.write(`The Gizlang toolchain is not installed, so giz ${args[0] || program} cannot run here. Supported platforms: ${SITE}/download\n`)
       process.exitCode = 1

package/cli/update.mjs

@@ -17,10 +17,10 @@ export function installSource(root = packageRoot) {
   const nodeModules = parts.lastIndexOf('node_modules')
   if (nodeModules < 0) return { type: 'source' }
   const normalized = resolved.toLowerCase()
-  if (normalized.includes(`${path.sep}.pnpm${path.sep}`) || /[\\/]pnpm[\\/]global[\\/]/.test(normalized)) return { type: 'pnpm', executable: 'pnpm', args: ['add', '-g', '@gizai/cli'], command: 'pnpm add -g @gizai/cli' }
-  if (normalized.includes(`${path.sep}.bun${path.sep}`)) return { type: 'bun', executable: 'bun', args: ['add', '-g', '@gizai/cli'], command: 'bun add -g @gizai/cli' }
-  if (normalized.includes(`${path.sep}.yarn${path.sep}`) || normalized.includes(`${path.sep}yarn${path.sep}global${path.sep}`)) return { type: 'yarn', executable: 'yarn', args: ['global', 'add', '@gizai/cli'], command: 'yarn global add @gizai/cli' }
-  return { type: 'npm', executable: 'npm', args: ['install', '-g', '@gizai/cli'], command: UPDATE_COMMAND }
+  if (normalized.includes(`${path.sep}.pnpm${path.sep}`) || /[\\/]pnpm[\\/]global[\\/]/.test(normalized)) return { type: 'pnpm', executable: 'pnpm', args: ['add', '-g', '@gizai/cli'], command: 'pnpm add -g @gizai/cli', remove: 'pnpm remove -g @gizai/cli' }
+  if (normalized.includes(`${path.sep}.bun${path.sep}`)) return { type: 'bun', executable: 'bun', args: ['add', '-g', '@gizai/cli'], command: 'bun add -g @gizai/cli', remove: 'bun remove -g @gizai/cli' }
+  if (normalized.includes(`${path.sep}.yarn${path.sep}`) || normalized.includes(`${path.sep}yarn${path.sep}global${path.sep}`)) return { type: 'yarn', executable: 'yarn', args: ['global', 'add', '@gizai/cli'], command: 'yarn global add @gizai/cli', remove: 'yarn global remove @gizai/cli' }
+  return { type: 'npm', executable: 'npm', args: ['install', '-g', '@gizai/cli'], command: UPDATE_COMMAND, remove: 'npm uninstall -g @gizai/cli' }
 }
 
 export function stableVersion(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gizai/cli",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "The official command-line interface for giz.ai: run AI models, Drive, Computers and Apps, connect Claude Code, Codex and other agents over MCP, and run Gizlang (giz init, run, deploy), installed on first use.",
   "keywords": [
     "giz",
@@ -25,7 +25,7 @@
     "name": "Giz Inc.",
     "url": "https://www.giz.ai"
   },
-  "license": "UNLICENSED",
+  "license": "MIT",
   "type": "module",
   "bin": {
     "giz": "cli/giz.mjs",
@@ -34,6 +34,7 @@
   "files": [
     "cli",
     "skills",
+    "LICENSE",
     "plugin.json",
     "mcp.json",
     "README.md"
@@ -47,8 +48,8 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/gizai/giz.git",
-    "directory": "apps/giz/external"
+    "url": "git+https://github.com/gizai/gizlang.git",
+    "directory": "tools/cli/npm"
   },
   "publishConfig": {
     "access": "public"

package/plugin.json

@@ -5,6 +5,6 @@
   "description": "Run Giz models, media generation, Drive, tables, Apps and Computers from any agent: the giz skill plus the Giz MCP server.",
   "author": { "name": "Giz", "url": "https://www.giz.ai" },
   "homepage": "https://www.giz.ai/mcp/",
-  "license": "UNLICENSED",
+  "license": "MIT",
   "keywords": ["giz", "mcp", "media", "drive", "computer"]
 }

package/skills/giz/SKILL.md

@@ -69,9 +69,7 @@ App changes pass the `revision` read from `giz app list` explicitly.
 The `--input` of `create` and `save` carries `id` and `expectedRevision` (0 for a new App).
 The CLI never re-reads the list to substitute a revision, so the server rejects the call if another change landed after your review.
 
-The table below is generated from the CLI dispatcher and the tool descriptors. To refresh it, run:
-`GIZ_UPDATE_CLI_SURFACE=1 pnpm --filter giz-app-giz test --runInBand --runTestsByPath server/external/cli-surface.spec.ts`.
-A normal CI run does not write the document; it fails on any difference in the table.
+The table below is generated from the CLI dispatcher and the tool descriptors of the giz.ai server, which checks it.
 
 <!-- cli-surface:start -->
 | Command | Tool ID | MCP tool | Required input | Scope | Agent discovery |

package/cli/codex-relay.mjs

@@ -1,46 +0,0 @@
-// Runs ONLY inside the user's Computer. stdout is the authenticated gateway wire,
-// never credentials or provider error bodies. No listener or separate credential store.
-import { readFile } from 'node:fs/promises'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-import { execFileSync } from 'node:child_process'
-
-const emit = value => process.stdout.write(JSON.stringify(value) + '\n')
-try {
-  const auth = JSON.parse(await readFile(join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'auth.json'), 'utf8'))
-  const token = auth.tokens?.access_token
-  const account = auth.tokens?.account_id
-  if (auth.OPENAI_API_KEY || !token || !account) {
-    emit({ status: 401 }); process.exitCode = 1
-  } else {
-    const headers = { authorization: `Bearer ${token}`, 'chatgpt-account-id': account, 'content-type': 'application/json', originator: 'codex_cli_rs' }
-    const mode = process.argv[2]
-    if (mode === 'models') {
-      const version = execFileSync('codex', ['--version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim().split(' ').at(-1)
-      const response = await fetch(`https://chatgpt.com/backend-api/codex/models?client_version=${encodeURIComponent(version)}`, { headers, signal: AbortSignal.timeout(30000) })
-      if (!response.ok) emit({ status: response.status })
-      else {
-        const payload = await response.json()
-        emit({ status: 200, models: (payload.models || []).filter(model => model.visibility !== 'hide').map(model => ({ id: model.slug, label: model.display_name || model.slug })).filter(model => typeof model.id === 'string' && model.id.length <= 256) })
-      }
-    } else if (mode === 'responses') {
-      let input = ''
-      for await (const chunk of process.stdin) input += chunk
-      const body = JSON.parse(input)
-      body.store = false
-      body.stream = true
-      body.instructions ??= ''
-      delete body.max_output_tokens
-      delete body.temperature
-      delete body.top_p
-      const response = await fetch('https://chatgpt.com/backend-api/codex/responses', { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(300000) })
-      emit({ status: response.status })
-      if (response.ok) {
-        for await (const chunk of response.body) emit({ chunk: Buffer.from(chunk).toString('base64') })
-        emit({ done: true })
-      }
-    } else emit({ status: 400 })
-  }
-} catch {
-  emit({ status: 503 }); process.exitCode = 1
-}

package/cli/mcp-stdio-client.mjs

@@ -1,81 +0,0 @@
-// The Agent runtime's stdio MCP client. It runs in the person's Computer as
-// `node --input-type=module -e <this source> <request JSON> <server argv...>`: it starts the server, initializes it,
-// sends one request (tools/list follows every cursor) and prints the result as one JSON line. The server's stderr is
-// shown only when the call fails. It replaced `npx @modelcontextprotocol/inspector@0.4.1 --cli`, a version without a
-// CLI mode that opened its web UI and hung every plugin call until it was canceled (10/6).
-import { spawn } from 'node:child_process';
-
-const [requestJson, command, ...args] = process.argv.slice(1);
-const request = JSON.parse(requestJson);
-const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'] });
-let stderr = '';
-child.stderr.on('data', (chunk) => { stderr = (stderr + chunk).slice(-8000); });
-
-function fail(message) {
-  process.stderr.write(`${message}\n${stderr}`);
-  child.kill('SIGKILL');
-  process.exit(1);
-}
-child.on('error', (error) => fail(`MCP server could not start: ${error.message}`));
-child.on('exit', (code, signal) => fail(`MCP server exited (${signal || code}) before it answered.`));
-
-const send = (message) => child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', ...message })}\n`);
-const pending = new Map();
-let nextId = 1;
-let buffer = '';
-child.stdout.setEncoding('utf8');
-child.stdout.on('data', (chunk) => {
-  buffer += chunk;
-  for (let newline = buffer.indexOf('\n'); newline >= 0; newline = buffer.indexOf('\n')) {
-    const line = buffer.slice(0, newline).trim();
-    buffer = buffer.slice(newline + 1);
-    let message;
-    // Like the MCP SDK, a line that is not JSON-RPC (a stray log) is skipped rather than ending the call.
-    try { message = JSON.parse(line); } catch { continue; }
-    if (message?.method && message.id !== undefined) {
-      send(message.method === 'ping' ? { id: message.id, result: {} }
-        : { id: message.id, error: { code: -32601, message: `${message.method} is not supported by this client.` } });
-      continue;
-    }
-    const waiter = pending.get(message?.id);
-    if (!waiter) continue;
-    pending.delete(message.id);
-    if (message.error) fail(`MCP ${waiter.method} failed: ${message.error.message || JSON.stringify(message.error)}`);
-    else waiter.resolve(message.result);
-  }
-});
-
-function call(method, params) {
-  return new Promise((resolve) => {
-    const id = nextId++;
-    pending.set(id, { method, resolve });
-    send({ id, method, ...(params === undefined ? {} : { params }) });
-  });
-}
-
-await call('initialize', { protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'giz-agent', version: '1' } });
-send({ method: 'notifications/initialized' });
-let result;
-if (request.method === 'tools/list') {
-  const tools = [];
-  const cursors = new Set();
-  let cursor;
-  for (;;) {
-    const page = await call('tools/list', cursor === undefined ? undefined : { cursor });
-    if (!Array.isArray(page?.tools)) fail('MCP server returned an invalid tool catalog.');
-    tools.push(...page.tools);
-    if (page?.nextCursor == null) break;
-    if (cursors.has(page.nextCursor) || cursors.size >= 32) fail('MCP server did not finish its tool catalog.');
-    cursors.add(page.nextCursor);
-    cursor = page.nextCursor;
-  }
-  result = { tools };
-} else if (request.method === 'tools/call') {
-  result = await call('tools/call', { name: request.name, arguments: request.arguments ?? {} });
-} else {
-  fail(`Unsupported MCP request ${request.method}.`);
-}
-child.removeAllListeners('exit');
-process.stdout.write(`${JSON.stringify(result)}\n`);
-child.kill();
-process.exit(0);

package/cli/media-capture.mjs

@@ -1,321 +0,0 @@
-// media.capture inside the person's Computer: records a browser scenario at 2x device pixels, logs every pointer target,
-// typing span and wait, shortens long waits, and writes an editable HyperFrames take (camera that follows the action, a
-// redrawn cursor, click and typing feedback, speed chips). The request JSON file (its path is the one argument)
-// is deleted once read: its sign-in steps carry the person's secrets. Result JSON on stdout.
-// Runs with giz-media-node (video-tools runtime): playwright-core and HYPERFRAMES_BROWSER_PATH come from that runtime.
-import { createRequire } from 'node:module';
-import { execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-
-const request = JSON.parse(fs.readFileSync(process.argv[1], 'utf8'));
-fs.rmSync(process.argv[1], { force: true });
-const { chromium } = createRequire(path.join(process.cwd(), 'noop.js'))('playwright-core');
-const out = request.dir;
-const [VW, VH] = request.viewport;
-const [CW, CH] = request.canvas;
-const FPS = 30;
-const SHORTEN_AFTER = 2.5; // A wait longer than this plays at a labelled speed instead of real time.
-const SHORTENED = 1.2;
-fs.mkdirSync(path.join(out, 'frames'), { recursive: true });
-
-const browser = await chromium.launch({ executablePath: process.env.HYPERFRAMES_BROWSER_PATH, args: ['--force-device-scale-factor=2'] });
-const context = await browser.newContext({ viewport: { width: VW, height: VH }, deviceScaleFactor: 2, locale: request.locale,
-  timezoneId: request.timezone });
-const page = await context.newPage();
-const events = [];
-let t0 = 0;
-const now = () => (Date.now() - t0) / 1000;
-const round = (value) => Math.round(value * 1000) / 1000;
-const log = (event) => { if (t0) events.push({ t: round(now()), ...event }); };
-
-function locate(target) {
-  const text = String(target || '');
-  if (text.startsWith('css:')) return page.locator(text.slice(4)).first();
-  if (text.startsWith('label:')) return page.getByLabel(text.slice(6)).locator('visible=true').first();
-  if (text.startsWith('placeholder:')) return page.getByPlaceholder(text.slice(12)).locator('visible=true').first();
-  if (text.startsWith('role:')) {
-    const [, role, ...name] = text.split(':');
-    return page.getByRole(role, { name: name.join(':') || undefined }).locator('visible=true').first();
-  }
-  // Visible text: an exact match first, so "저장" does not pick "저장된 보기".
-  const exact = page.getByText(text, { exact: true }).locator('visible=true');
-  return exact.or(page.getByText(text).locator('visible=true')).first();
-}
-
-async function box(locator) {
-  const b = await locator.boundingBox().catch(() => null);
-  return b && { x: round(b.x), y: round(b.y), w: round(b.width), h: round(b.height) };
-}
-
-// A real pointer path, so hover states appear the way a person causes them.
-async function point(step) {
-  const locator = locate(step.target);
-  await locator.waitFor({ state: 'visible', timeout: step.timeoutMs ?? 15000 });
-  await locator.scrollIntoViewIfNeeded().catch(() => {});
-  const b = await box(locator);
-  if (!b) throw new Error(`${step.target} has no visible box`);
-  const x = b.x + b.w / 2, y = b.y + b.h / 2;
-  await page.mouse.move(x, y, { steps: 18 });
-  return { locator, b, x, y };
-}
-
-const label = (step) => step.label || (step.secret ? '••••' : step.target || step.value || step.action);
-
-async function run(step) {
-  const timeout = step.timeoutMs ?? 15000;
-  switch (step.action) {
-    case 'open': await page.goto(new URL(step.value, page.url() === 'about:blank' ? request.url : page.url()).href, { waitUntil: 'domcontentloaded' }); log({ action: 'open', label: label(step) }); break;
-    case 'click': case 'doubleClick': case 'rightClick': case 'hover': {
-      const { b, x, y } = await point(step);
-      log({ action: step.action, label: label(step), box: b, x, y });
-      if (step.action === 'click') await page.mouse.click(x, y);
-      if (step.action === 'doubleClick') await page.mouse.dblclick(x, y);
-      if (step.action === 'rightClick') await page.mouse.click(x, y, { button: 'right' });
-      break;
-    }
-    case 'type': case 'fill': {
-      const { locator, b, x, y } = await point(step);
-      log({ action: 'click', label: label(step), box: b, x, y });
-      await page.mouse.click(x, y);
-      if (step.action === 'fill') await locator.fill('');
-      const from = now();
-      await locator.pressSequentially(String(step.value ?? ''), { delay: 45 });
-      log({ action: 'typing', label: label(step), box: await box(locator), from: round(from) });
-      break;
-    }
-    case 'press': await page.keyboard.press(step.value); log({ action: 'press', label: step.value }); break;
-    case 'upload': {
-      const files = String(step.value || '').split('\n').filter(Boolean).map((file) => path.resolve('/home/user', file));
-      await locate(step.target).setInputFiles(files, { timeout });
-      log({ action: 'upload', label: step.label || files.map((file) => path.basename(file)).join(', ') });
-      break;
-    }
-    case 'waitFor': {
-      const from = now();
-      await locate(step.target).waitFor({ state: 'visible', timeout: step.timeoutMs ?? 180000 });
-      log({ action: 'wait', label: label(step), from: round(from) });
-      break;
-    }
-    case 'scroll': {
-      const locator = locate(step.target);
-      await locator.waitFor({ state: 'attached', timeout });
-      await locator.evaluate((element) => element.scrollIntoView({ block: 'center', behavior: 'smooth' }));
-      await page.waitForTimeout(900);
-      log({ action: 'scroll', label: label(step), box: await box(locator) });
-      break;
-    }
-    case 'focus': {
-      const locator = locate(step.target);
-      await locator.waitFor({ state: 'visible', timeout });
-      log({ action: 'focus', label: label(step), box: await box(locator) });
-      await page.waitForTimeout(step.ms ?? 1500);
-      break;
-    }
-    case 'pause': await page.waitForTimeout(step.ms ?? 1000); break;
-    case 'mark': log({ action: 'mark', label: label(step) }); break;
-    default: throw new Error(`Unknown capture action: ${step.action}`);
-  }
-}
-
-const frames = [];
-let cdp;
-let failure;
-let failedStep;
-try {
-  await page.goto(request.url, { waitUntil: 'domcontentloaded' });
-  await page.waitForLoadState('networkidle', { timeout: 15000 }).catch(() => {});
-  for (const [index, step] of request.setup.entries()) {
-    failedStep = { phase: 'setup', index };
-    await run(step);
-  }
-  // Only the scenario is recorded; signing in and preparing data stay off camera.
-  cdp = await context.newCDPSession(page);
-  cdp.on('Page.screencastFrame', async (frame) => {
-    const file = `frames/${String(frames.length).padStart(6, '0')}.jpg`;
-    fs.writeFileSync(path.join(out, file), Buffer.from(frame.data, 'base64'));
-    frames.push([frame.metadata.timestamp, file]);
-    await cdp.send('Page.screencastFrameAck', { sessionId: frame.sessionId }).catch(() => {});
-  });
-  t0 = Date.now();
-  await cdp.send('Page.startScreencast', { format: 'jpeg', quality: 92, maxWidth: VW * 2, maxHeight: VH * 2 });
-  await page.waitForTimeout(800);
-  for (const [index, step] of request.steps.entries()) {
-    failedStep = { phase: 'steps', index };
-    await run(step);
-  }
-  await page.waitForTimeout(1200);
-  failedStep = undefined;
-} catch (error) {
-  failure = String(error?.message || error).split('\n')[0];
-  await page.screenshot({ path: path.join(out, 'failed.png') }).catch(() => {});
-} finally {
-  await cdp?.send('Page.stopScreencast').catch(() => {});
-}
-const end = now();
-await context.close();
-await browser.close();
-if (failure) {
-  fs.rmSync(path.join(out, 'frames'), { recursive: true, force: true });
-  console.log(JSON.stringify({ failed: true, failure, step: failedStep, screenshot: 'failed.png' }));
-  process.exit(0);
-}
-
-// Long waits are shortened: a piecewise-linear clock maps recorded time to take time, and the frames, events and speed
-// chips all read that one map, so the cursor and camera stay on the action.
-const spans = events.filter((event) => event.action === 'wait' && event.t - event.from > SHORTEN_AFTER)
-  .map((event) => ({ from: event.from, to: event.t, rate: Math.min(16, (event.t - event.from) / SHORTENED) }));
-const clock = (t) => {
-  let shift = 0;
-  for (const span of spans) {
-    if (t <= span.from) break;
-    const inside = Math.min(t, span.to) - span.from;
-    shift += inside - inside / span.rate;
-  }
-  return round(t - shift);
-};
-const duration = clock(end);
-const start = frames[0][0];
-const list = frames.map(([stamp, file], index) => {
-  const at = clock(stamp - start);
-  const next = index + 1 < frames.length ? clock(frames[index + 1][0] - start) : duration;
-  return `file '${file}'\nduration ${Math.max(0.001, next - at).toFixed(3)}`;
-});
-fs.writeFileSync(path.join(out, 'frames.txt'), `ffconcat version 1.0\n${list.join('\n')}\nfile '${frames.at(-1)[1]}'\n`);
-// A keyframe every second: HyperFrames seeks the recording frame by frame and freezes on sparse keyframes.
-// Threads and lookahead are fixed: ffmpeg sizes them by the cores it sees, and a 2 GB Computer that saw the host's cores
-// was OOM-killed at 1.4 GB on a 2880x1620 take (prod 10/8); fixed, it stays near 0.55 GB on any core count.
-try {
-  execFileSync('ffmpeg', ['-v', 'error', '-y', '-threads', '2', '-filter_threads', '1', '-f', 'concat', '-safe', '0', '-i', path.join(out, 'frames.txt'),
-    '-vf', `fps=${FPS},scale=trunc(iw/2)*2:trunc(ih/2)*2,format=yuv420p`, '-c:v', 'libx264', '-crf', '16', '-preset', 'medium', '-g', String(FPS),
-    '-threads', '2', '-rc-lookahead', '10', '-movflags', '+faststart', path.join(out, 'screen.mp4')]);
-} catch (error) {
-  // The job reports an out-of-memory kill as such (137), not as a stack the Agent would answer by lowering quality.
-  if (error.signal === 'SIGKILL') { console.error('The screen recording encoder ran out of Computer memory.'); process.exit(137); }
-  throw error;
-}
-fs.rmSync(path.join(out, 'frames'), { recursive: true, force: true });
-fs.rmSync(path.join(out, 'frames.txt'), { force: true });
-const timeline = events.map((event) => ({ ...event, t: clock(event.t), ...(event.from !== undefined ? { from: clock(event.from) } : {}) }));
-const shortened = spans.map((span) => ({ from: clock(span.from), to: clock(span.to), rate: Math.round(span.rate * 10) / 10 }));
-fs.writeFileSync(path.join(out, 'events.json'), JSON.stringify({ viewport: [VW, VH], scale: 2, duration, shortened, events: timeline }, null, 1));
-fs.writeFileSync(path.join(out, 'take.html'), composition(timeline, shortened));
-console.log(JSON.stringify({ duration, shortened, events: timeline.map(({ t, action, label: name, from }) => ({ t, action, label: name, ...(from !== undefined ? { from } : {}) })) }));
-
-// The take composition: the screen fills the canvas, the camera frames each cluster of actions and returns to the whole
-// screen between them, and the cursor keeps its size while the camera zooms because it lives inside the camera.
-function composition(timeline, shortened) {
-  const scale = Math.min(CW / VW, CH / VH);
-  const SW = VW * scale, SH = VH * scale, SX = (CW - SW) / 2, SY = (CH - SH) / 2;
-  const maxZoom = request.camera === false ? 1 : request.maxZoom;
-  const id = request.name;
-  const tl = [];
-  const html = [];
-  const frame = (b) => {
-    if (!b || maxZoom <= 1) return { s: 1, x: 0, y: 0 };
-    const pad = 1.3;
-    const s = Math.max(1, Math.min(maxZoom, SW / (b.w * scale * pad), SH / (b.h * scale * pad)));
-    const cx = (b.x + b.w / 2) * scale, cy = (b.y + b.h / 2) * scale;
-    const x = Math.min(0, Math.max(SW - SW * s, SW / 2 - cx * s));
-    const y = Math.min(0, Math.max(SH - SH * s, SH / 2 - cy * s));
-    return { s: round(s), x: Math.round(x), y: Math.round(y) };
-  };
-  const union = (a, b) => {
-    const x = Math.min(a.x, b.x), y = Math.min(a.y, b.y);
-    return { x, y, w: Math.max(a.x + a.w, b.x + b.w) - x, h: Math.max(a.y + a.h, b.y + b.h) - y };
-  };
-  // Actions close in time and space share one framing; a page change or a shortened wait ends it.
-  const clusters = [];
-  for (const event of timeline) {
-    const last = clusters.at(-1);
-    if (event.action === 'open' || event.action === 'wait') { if (last) last.closed = true; continue; }
-    if (!event.box) continue;
-    const begins = event.from ?? event.t;
-    const ends = event.action === 'focus' ? event.t + 1.5 : event.t;
-    if (last && !last.closed && begins - last.end < 3 && frame(union(last.box, event.box)).s >= 1.2) {
-      last.box = union(last.box, event.box);
-      last.end = Math.max(last.end, ends);
-    } else clusters.push({ start: begins, end: ends, box: event.box });
-  }
-  // A framing too wide to zoom is a full-screen shot, so the camera always lands on what the next action shows.
-  const moves = [];
-  const wide = { s: 1, x: 0, y: 0 };
-  let camera = wide, free = 0;
-  for (const [index, cluster] of clusters.entries()) {
-    const framed = frame(cluster.box);
-    const target = framed.s < 1.15 ? wide : framed;
-    if (target.s !== camera.s || target.x !== camera.x || target.y !== camera.y) {
-      const at = Math.max(free, cluster.start - 0.8);
-      moves.push({ at: round(at), d: round(Math.min(0.8, Math.max(0.3, cluster.start - at))), ...target });
-      camera = target;
-    }
-    const hold = cluster.end + 1.4;
-    free = hold;
-    const next = clusters[index + 1];
-    if (camera !== wide && (!next || next.start - 0.8 - hold > 1.6)) {
-      moves.push({ at: round(Math.min(hold, duration - 0.9)), d: 0.9, ...wide });
-      camera = wide;
-      free = hold + 0.9;
-    }
-  }
-  for (const move of moves) {
-    tl.push(`tl.to("#${id}-cam",{scale:${move.s},x:${move.x},y:${move.y},duration:${move.d},ease:"power2.inOut"},${move.at});`);
-    tl.push(`tl.to("#${id}-cursor .scale",{scale:${round(1 / move.s)},duration:${move.d},ease:"power2.inOut"},${move.at});`);
-  }
-  const pointers = timeline.filter((event) => ['click', 'doubleClick', 'rightClick', 'hover'].includes(event.action) && event.x !== undefined);
-  if (pointers.length) {
-    const first = pointers[0];
-    tl.push(`tl.set("#${id}-cursor",{x:${Math.round(Math.min(VW - 40, first.x + 240) * scale)},y:${Math.round(Math.min(VH - 40, first.y + 160) * scale)}},0);`);
-    let previousAt = 0;
-    for (const event of pointers) {
-      const move = round(Math.max(0.25, Math.min(0.7, event.t - previousAt - 0.1)));
-      tl.push(`tl.to("#${id}-cursor",{x:${Math.round(event.x * scale)},y:${Math.round(event.y * scale)},duration:${move},ease:"power2.inOut"},${round(Math.max(0, event.t - move))});`);
-      if (event.action !== 'hover') {
-        tl.push(`tl.to("#${id}-cursor svg",{scale:0.82,duration:0.08,yoyo:true,repeat:1,transformOrigin:"6px 3px"},${event.t});`);
-        tl.push(`tl.fromTo("#${id}-cursor .ring",{scale:0.2,opacity:0.9},{scale:1.6,opacity:0,duration:0.5,ease:"power2.out",immediateRender:false},${event.t});`);
-      }
-      previousAt = event.t;
-    }
-  }
-  for (const [index, event] of timeline.filter((item) => item.action === 'typing' && item.box).entries()) {
-    const b = event.box;
-    html.push(`<div class="typing" id="${id}-type${index}" style="left:${Math.round(b.x * scale - 5)}px;top:${Math.round(b.y * scale - 5)}px;width:${Math.round(b.w * scale + 10)}px;height:${Math.round(b.h * scale + 10)}px"></div>`);
-    tl.push(`tl.fromTo("#${id}-type${index}",{opacity:0},{opacity:1,duration:0.2},${event.from});`);
-    tl.push(`tl.to("#${id}-type${index}",{opacity:0,duration:0.3},${round(event.t + 0.6)});`);
-  }
-  const chips = shortened.map((span, index) => {
-    tl.push(`tl.fromTo("#${id}-speed${index}",{opacity:0,scale:0.9},{opacity:1,scale:1,duration:0.2},${span.from});`);
-    tl.push(`tl.to("#${id}-speed${index}",{opacity:0,duration:0.2},${round(Math.max(span.from + 0.2, span.to - 0.2))});`);
-    return `<div class="speed" id="${id}-speed${index}">▶▶ ${span.rate}×</div>`;
-  });
-  return `<!doctype html>
-<html><head><meta charset="UTF-8">
-<script src="https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js"></script>
-<style>
-#${id}{position:relative;width:${CW}px;height:${CH}px;overflow:hidden;background:#0b0c10;}
-#${id} .screen{position:absolute;left:${SX}px;top:${SY}px;width:${SW}px;height:${SH}px;overflow:hidden;}
-#${id}-cam{position:absolute;inset:0;transform-origin:0 0;}
-#${id}-cam video{position:absolute;inset:0;width:100%;height:100%;object-fit:fill;}
-#${id} .typing{position:absolute;border-radius:10px;border:3px solid #6463cc;box-shadow:0 0 0 6px rgba(100,99,204,.18);opacity:0;}
-#${id}-cursor{position:absolute;left:0;top:0;width:0;height:0;z-index:5;}
-#${id}-cursor .scale{position:absolute;left:-6px;top:-3px;transform-origin:6px 3px;filter:drop-shadow(0 3px 6px rgba(0,0,0,.35));}
-#${id}-cursor .ring{position:absolute;left:-26px;top:-29px;width:64px;height:64px;border-radius:50%;border:3px solid #6463cc;opacity:0;}
-#${id} .speed{position:absolute;right:${Math.round(SX + 28)}px;top:${Math.round(SY + 24)}px;z-index:6;background:rgba(12,14,30,.86);color:#fff;
-  font:600 24px/1 system-ui,sans-serif;padding:12px 20px;border-radius:999px;opacity:0;}
-</style></head>
-<body><div id="${id}" data-composition-id="${id}" data-start="0" data-width="${CW}" data-height="${CH}" data-duration="${duration}">
-<div class="screen"><div id="${id}-cam">
-<video id="${id}-screen" src="screen.mp4" muted playsinline data-start="0" data-duration="${duration}"></video>
-${html.join('\n')}
-<div id="${id}-cursor"${pointers.length ? '' : ' style="display:none"'}><div class="scale"><div class="ring"></div><svg viewBox="0 0 32 32" width="${Math.round(40 * scale / 1.2)}" height="${Math.round(40 * scale / 1.2)}"><path d="M6 3 L6 25 L11.5 19.8 L15.4 28.6 L19.2 27 L15.4 18.4 L23 18.2 Z" fill="#111" stroke="#fff" stroke-width="2" stroke-linejoin="round"/></svg></div></div>
-</div></div>
-${chips.join('\n')}
-</div>
-<script>
-const tl = gsap.timeline({ paused: true });
-${tl.join('\n')}
-window.__timelines = window.__timelines || {};
-window.__timelines["${id}"] = tl;
-</script></body></html>
-`;
-}