@hraness/slopcamera 3.9.2 → 3.10.1

package/PRIVACY.md

@@ -53,3 +53,11 @@ from vulnerability reports.
 
 Report suspected vulnerabilities through GitHub private vulnerability
 reporting at https://github.com/hraness/slopcamera/security/advisories/new.
+
+The public slopcamera.com website sends cookieless page views, page exits,
+performance measurements, explicit link and install-copy actions, missing-page
+reports, and rate-limited redacted client errors to PostHog. It keeps no person
+profiles, analytics cookies, or session recordings and respects Do Not Track.
+Public campaign parameters are retained; other query values and credentials
+are removed. Sensitive paths collapse to `/private` and their campaign
+attribution is removed. Preview builds and the inert preview page send nothing.

package/README.md

@@ -34,11 +34,11 @@ for prompt-only hosted images; model usage is billed separately.
 ## Install SlopCamera
 
 Install [Bun 1.3.14 or newer](https://bun.sh), then install the
-[SlopCamera v3.9.0 release](https://github.com/hraness/slopcamera/releases/tag/v3.9.0)
+[SlopCamera v3.9.2 release](https://github.com/hraness/slopcamera/releases/tag/v3.9.2)
 and its matching Agent Skill:
 
 ```sh
-bun add --global https://github.com/hraness/slopcamera/releases/download/v3.9.0/hraness-slopcamera-3.9.0.tgz
+bun add --global https://github.com/hraness/slopcamera/releases/download/v3.9.2/hraness-slopcamera-3.9.2.tgz
 slopcamera skill install --target agents
 ```
 
@@ -100,6 +100,10 @@ placement and resuming long runs.
 
 </details>
 
+CLI updates in SlopCamera 3.10.0 and newer are enabled by default for supported
+Bun and npm global installations. See [update controls](docs/reference/capabilities.md#cli-updates)
+to keep a version or check for a release.
+
 ## Make a film. Then direct it again.
 
 [Last tram to the moon](https://slopcamera.com/docs/tutorials/first-animation)

package/apps/desktop/application/operation.ts

@@ -4,7 +4,7 @@ import type { z } from "zod";
 
 import type { ApplicationContext } from "./context";
 
-export const SLOPCAMERA_APPLICATION_TOOL_VERSION = "slopcamera-3.9.2" as const;
+export const SLOPCAMERA_APPLICATION_TOOL_VERSION = "slopcamera-3.10.1" as const;
 
 export const OPERATION_KINDS = [
   "scene.audit",

package/apps/desktop/cli/commands.ts

@@ -365,7 +365,7 @@ import {
   workflowRunStore,
 } from "./workflow-runs";
 
-export const SLOPCAMERA_VERSION = "3.9.2";
+export const SLOPCAMERA_VERSION = "3.10.1";
 
 // Legacy direct renders predate per-target output contracts. Keep them
 // bounded generously enough for long-form production while preventing one

package/apps/desktop/cli/entry.ts

@@ -0,0 +1,31 @@
+#!/usr/bin/env bun
+import { fileURLToPath } from "node:url";
+import type { CliUpdateOptions, StartupResult } from "@hraness/cli-update";
+import { SLOPCAMERA_VERSION } from "../../../src/version";
+import { slopcameraUpdatePolicy } from "./update-policy";
+
+type EntryPorts = {
+  update(options: CliUpdateOptions): Promise<StartupResult>;
+  main(): Promise<void>;
+};
+
+export async function runSlopcameraEntrypoint(argv = process.argv.slice(2), ports: Partial<EntryPorts> = {}): Promise<void> {
+  const main = ports.main ?? (async () => (await import("./main")).runMainEntrypoint({}, true));
+  // Compiled private binaries and their embedded workers keep the native installer.
+  if (import.meta.path.includes("$bunfs")) { await main(); return; }
+  // The product renders its own command help; the updater sees an inert help request.
+  const gateArgv = argv[0] === "update" && argv.slice(1).some(arg => arg === "--help" || arg === "-h")
+    ? ["help", "update"] : argv;
+  const update = await (ports.update ?? (async options => (await import("@hraness/cli-update")).runCliUpdate(options)))({
+    packageName: "@hraness/slopcamera", version: SLOPCAMERA_VERSION, binName: "slopcamera",
+    entrypoint: fileURLToPath(import.meta.url), argv: gateArgv,
+    provider: { kind: "github", repository: "hraness/slopcamera", assetName: "hraness-slopcamera-{version}.tgz" },
+    ...slopcameraUpdatePolicy(gateArgv),
+    verifyArtifact: async artifact => (await import("./update-verification")).verifySlopcameraUpdate(artifact),
+  });
+  if (update.handled) { process.exitCode = update.exitCode; return; }
+  try { await main(); }
+  finally { await update.release(); }
+}
+
+if (import.meta.main) await runSlopcameraEntrypoint();

package/apps/desktop/cli/help.ts

@@ -33,6 +33,7 @@ Commands:
   runs list|show|resume|approve|cancel
                                  Inspect and control durable workflow runs
   doctor                         Check local render and asset capabilities
+  update                         Update the CLI or manage automatic updates
   ai models|image|video|speech|transcribe
                                  Discover and run Vercel AI Gateway media models
   credits status|topup|wait|forget
@@ -719,6 +720,13 @@ compiles a bounded set of single-axis candidate plans under cinema/galleries/, e
 re-hashed through the canonical composition digest; it never selects a candidate.
 
 Imported media starts unverified. Align its audio before relying on synchronization. Structural edits are project-time operations and affect every placement. Camera moves address any placed video stream; metadata-driven screen zooms still require a recording-backed source placement. Face analysis and geometry tracks remain local. --select largest follows the largest currently visible prepared-layer face per frame. --require-all-selected makes a missing explicit/all-selected face invoke the chosen gap policy.`,
+  update: `Usage: slopcamera update [check|status|enable|disable] [--json]
+
+Supported Bun and npm global installations on macOS and Linux check the immutable
+GitHub release before work starts, at most once a day. Verification needs GitHub CLI.
+Use slopcamera update disable to keep this version, or HRANESS_NO_UPDATE=1 for one
+invocation. Exact Bun version pins require slopcamera update enable. Local image
+vectorization, SDK imports, and the private compiled binary do not update automatically.`,
   render: `Usage: slopcamera render <plan|run> <recording> [--display <id|primary>] [--output <path>] [--dry-run] [--keep-inactivity] [--json]
 
 Long inactivity is analyzed and removed by default; use --keep-inactivity to opt out.`,
@@ -731,10 +739,11 @@ export function commandHelp(topic: readonly string[]): string {
 
 export function completions(words: readonly string[]): readonly string[] {
   const topLevel = [
-    "capabilities", "operations", "diagram", "direct", "studio", "image", "html", "style", "workflows", "code", "runs", "doctor", "ai", "credits", "media", "support", "outputs", "status", "tui", "commands", "legacy", "recordings", "projects", "project", "scene", "inspect", "events", "edit", "analyze", "align", "faces", "fillers", "render", "assets",
+    "update", "capabilities", "operations", "diagram", "direct", "studio", "image", "html", "style", "workflows", "code", "runs", "doctor", "ai", "credits", "media", "support", "outputs", "status", "tui", "commands", "legacy", "recordings", "projects", "project", "scene", "inspect", "events", "edit", "analyze", "align", "faces", "fillers", "render", "assets",
   ];
   if (words.length <= 1) return topLevel;
   const command = words[0];
+  if (command === "update") return ["check", "status", "enable", "disable"];
   if (command === "support") return ["protocol", "offer", "shown", "release", "dismiss", "snooze", "enable", "status"];
   if (command === "html") return ["catalog", "scaffold", "init", "render", "still", "preview", "deliver"];
   if (command === "style") return ["list", "show"];

package/apps/desktop/cli/html-overlay-renderer.ts

@@ -23,6 +23,8 @@ import { basename, dirname, join } from "node:path";
 
 import { z } from "zod";
 
+import { verifyStableBrowserWatcherBaseline } from "./html-overlay-watcher-baseline";
+
 import {
   chromium,
   type Browser,
@@ -2020,6 +2022,8 @@ export class PlaywrightHtmlOverlayRenderer implements HtmlOverlayRenderer {
         signal,
       );
       browserRuntimeSnapshot = preparedBrowserRuntime;
+      let watcherVersion = 0;
+      let watcherFailure: Error | undefined;
       const runtimeName = basename(preparedBrowserRuntime.runtimeRoot);
       const snapshotName = basename(preparedBrowserRuntime.directory);
       const anchorWatcher = watch(
@@ -2028,11 +2032,13 @@ export class PlaywrightHtmlOverlayRenderer implements HtmlOverlayRenderer {
         (eventType, filename) => {
           const path = filename?.toString() ?? "<snapshot-anchor>";
           if (path === snapshotName) {
+            watcherVersion += 1;
             browserRuntimeMutations.add(`anchor-${eventType}:${path}`);
           }
         },
       );
       anchorWatcher.on("error", error => {
+        watcherFailure = error;
         browserRuntimeMutations.add(`anchor-watch-error:${error.message}`);
       });
       browserRuntimeWatchers.push(anchorWatcher);
@@ -2065,6 +2071,7 @@ export class PlaywrightHtmlOverlayRenderer implements HtmlOverlayRenderer {
             // its exact path identity still detects fixture substitution.
             return;
           }
+          watcherVersion += 1;
           if (path === runtimeName || path.startsWith(`${runtimeName}/`)) {
             browserRuntimeMutations.add(`${eventType}:${path}`);
             return;
@@ -2073,41 +2080,48 @@ export class PlaywrightHtmlOverlayRenderer implements HtmlOverlayRenderer {
         },
       );
       containerWatcher.on("error", error => {
+        watcherFailure = error;
         browserRuntimeMutations.add(`watch-error:${error.message}`);
       });
       browserRuntimeWatchers.push(containerWatcher);
-      await new Promise<void>(resolve => setTimeout(resolve, 25));
-      if (signal.aborted) throw cancellationReason(signal);
-      // FSEvents can deliver the just-created direct-child notification after
-      // both watches attach. Clear that bounded baseline before re-verifying
-      // every manifest and path identity. A swap during this window changes
-      // the already-captured container ctime and therefore fails below.
-      browserRuntimeMutations.clear();
       let browser: Browser | undefined;
       let browserFailure: Readonly<{ error: unknown }> | undefined;
       try {
-        await verifyBrowserRuntimeSnapshot(
-          preparedBrowserRuntime,
-          request.browserRuntime,
-          "immediately before launch",
-          signal,
-        );
-        await assertBrowserRuntimeSnapshotIdentity(
-          preparedBrowserRuntime,
-          request.browserRuntime.manifest.entries,
-          "immediately before launch",
-          signal,
-        );
-        await assertBrowserRuntimeSnapshotContainerIdentity(
-          preparedBrowserRuntime,
-          "immediately before launch",
+        // Delayed preparation notifications can arrive during full verification.
+        // Recheck the SAME pre-wait identities until one pass is stable. Nothing
+        // after the synchronous baseline commit is discarded.
+        await verifyStableBrowserWatcherBaseline({
           signal,
-        );
-        await assertBrowserRuntimeSnapshotAnchorIdentity(
-          preparedBrowserRuntime,
-          "immediately before launch",
-          signal,
-        );
+          version: () => watcherVersion,
+          failure: () => watcherFailure,
+          quietMs: process.platform === "darwin" ? 2_000 : 25,
+          deadlineMs: 10_000,
+          verify: async () => {
+            await verifyBrowserRuntimeSnapshot(
+              preparedBrowserRuntime,
+              request.browserRuntime,
+              "immediately before launch",
+              signal,
+            );
+            await assertBrowserRuntimeSnapshotIdentity(
+              preparedBrowserRuntime,
+              request.browserRuntime.manifest.entries,
+              "immediately before launch",
+              signal,
+            );
+            await assertBrowserRuntimeSnapshotContainerIdentity(
+              preparedBrowserRuntime,
+              "immediately before launch",
+              signal,
+            );
+            await assertBrowserRuntimeSnapshotAnchorIdentity(
+              preparedBrowserRuntime,
+              "immediately before launch",
+              signal,
+            );
+          },
+          commit: () => { browserRuntimeMutations.clear(); },
+        });
         discardProvenLaunchManagedRootMetadataEvent(
           browserRuntimeMutations,
           runtimeName,

package/apps/desktop/cli/html-overlay-watcher-baseline.ts

@@ -0,0 +1,65 @@
+import { setTimeout as delay } from "node:timers/promises";
+
+interface BaselineClock {
+  readonly now: () => number;
+  readonly wait: (milliseconds: number, signal: AbortSignal) => Promise<void>;
+}
+
+const clock: BaselineClock = {
+  now: () => performance.now(),
+  wait: async (milliseconds, signal) => { await delay(milliseconds, undefined, { signal }); },
+};
+
+/** Drain asynchronous preparation notifications before revalidating the saved identities. */
+interface BrowserWatcherBaselineOptions {
+  readonly signal: AbortSignal;
+  readonly version: () => number;
+  readonly failure: () => Error | undefined;
+  readonly quietMs: number;
+  readonly deadlineMs: number;
+  readonly clock?: BaselineClock;
+}
+
+export async function settleBrowserWatcherBaseline(options: BrowserWatcherBaselineOptions): Promise<void> {
+  const timing = options.clock ?? clock;
+  const started = timing.now();
+  let lastActivity = started;
+  let observedVersion = options.version();
+  for (;;) {
+    options.signal.throwIfAborted();
+    const failure = options.failure();
+    if (failure !== undefined) throw failure;
+    const now = timing.now();
+    const version = options.version();
+    if (version !== observedVersion) {
+      observedVersion = version;
+      lastActivity = now;
+    }
+    if (now - started >= options.deadlineMs) {
+      throw new Error("Browser runtime filesystem notifications did not settle before launch.");
+    }
+    if (now - lastActivity >= options.quietMs) return;
+    await timing.wait(Math.min(50, options.quietMs - (now - lastActivity), options.deadlineMs - (now - started)), options.signal);
+  }
+}
+
+/** Every discarded notification batch must precede a stable, complete identity check. */
+export async function verifyStableBrowserWatcherBaseline(options: BrowserWatcherBaselineOptions & {
+  readonly verify: () => Promise<void>;
+  readonly commit: () => void;
+}): Promise<void> {
+  for (let pass = 0; pass < 3; pass += 1) {
+    await settleBrowserWatcherBaseline(options);
+    const version = options.version();
+    await options.verify();
+    options.signal.throwIfAborted();
+    const failure = options.failure();
+    if (failure !== undefined) throw failure;
+    if (options.version() === version) {
+      // No await may separate the stable-generation check from arming the guard.
+      options.commit();
+      return;
+    }
+  }
+  throw new Error("Browser runtime filesystem notifications changed during all three verification passes.");
+}

package/apps/desktop/cli/update-policy.ts

@@ -0,0 +1,18 @@
+export function slopcameraUpdatePolicy(argv: readonly string[]): { effectFree: boolean; offline: boolean } {
+  const [command, action] = argv;
+  const portable = ["diagram", "mcp", "canvas", "skill"].includes(command ?? "")
+    || (command === "style" && !argv.includes("--help") && !argv.includes("-h"))
+    || (command === "code" && ["search", "execute"].includes(action ?? ""))
+    || (command === "media" && action === "soundtrack")
+    || (command === "image" && ["vectorize", "icon", "gallery"].includes(action ?? ""))
+    || (command === "image" && action === "generate" && argv.includes("--output"));
+  const registry = ["status", "tui", "commands", "outputs", "legacy", "support"].includes(command ?? "");
+  return {
+    effectFree: command === undefined || ["help", "--help", "-h", "version", "--version", "__complete", "capabilities"].includes(command)
+      || (command === "diagram" && ["help", "--help", "-h"].includes(action ?? ""))
+      || (!portable && !registry && (argv.includes("--help") || argv.includes("-h"))),
+    offline: command === "diagram"
+      || (command === "image" && ["vectorize", "icon"].includes(action ?? ""))
+      || (command === "media" && action === "soundtrack"),
+  };
+}

package/apps/desktop/cli/update-verification.ts

@@ -0,0 +1,76 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const repository = "hraness/slopcamera";
+const maximumMetadataBytes = 2 * 1024 * 1024;
+type Gh = (args: readonly string[]) => Promise<Buffer>;
+
+const runGh: Gh = args => new Promise((resolve, reject) => {
+  execFile("gh", [...args], {
+    encoding: "buffer", timeout: 30_000, maxBuffer: maximumMetadataBytes,
+    env: { ...process.env, GH_HOST: "github.com", GH_PROMPT_DISABLED: "1", GH_PAGER: "cat" },
+  }, (error, stdout) => {
+    // gh's error can include authenticated response bodies. Keep diagnostics fixed.
+    if (error !== null) reject(new Error("SlopCamera release verification failed. Check GitHub CLI access and retry slopcamera update."));
+    else resolve(stdout);
+  });
+});
+
+function record(value: unknown): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Invalid SlopCamera release metadata.");
+  return value as Record<string, unknown>;
+}
+
+/** Keep the install guide's immutable-release and source-bound attestation checks. */
+export async function verifySlopcameraUpdate(
+  artifact: { path: string; version: string; sha256: string },
+  gh: Gh = runGh,
+): Promise<void> {
+  if (!/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.test(artifact.version)
+    || artifact.version.length > 50 || !/^[a-f0-9]{64}$/u.test(artifact.sha256)) throw new Error("Invalid SlopCamera update identity.");
+  const tag = `v${artifact.version}`;
+  const json = async (path: string) => {
+    const bytes = await gh(["api", path]);
+    if (bytes.length > maximumMetadataBytes) throw new Error("SlopCamera release metadata is too large.");
+    return record(JSON.parse(bytes.toString("utf8")) as unknown);
+  };
+  await gh(["release", "verify", tag, "--repo", repository]);
+  await gh(["release", "verify-asset", tag, artifact.path, "--repo", repository]);
+  const reference = record((await json(`repos/${repository}/git/ref/tags/${tag}`)).object);
+  if (reference.type !== "tag" || typeof reference.sha !== "string" || !/^[a-f0-9]{40}$/u.test(reference.sha)) {
+    throw new Error("SlopCamera updates require an annotated release tag.");
+  }
+  const annotated = await json(`repos/${repository}/git/tags/${reference.sha}`);
+  const source = record(annotated.object);
+  if (annotated.tag !== tag || source.type !== "commit" || typeof source.sha !== "string" || !/^[a-f0-9]{40}$/u.test(source.sha)) {
+    throw new Error("SlopCamera release tag does not identify its source commit.");
+  }
+  const release = await json(`repos/${repository}/releases/tags/${tag}`);
+  if (release.tag_name !== tag || release.immutable !== true || !Array.isArray(release.assets)) {
+    throw new Error("SlopCamera release is not immutable.");
+  }
+  const bundles = release.assets.map(record).filter(asset => asset.name === "provenance.jsonl");
+  const bundle = bundles[0];
+  if (bundles.length !== 1 || bundle === undefined || bundle.state !== "uploaded"
+    || typeof bundle.id !== "number" || !Number.isSafeInteger(bundle.id) || bundle.id <= 0
+    || typeof bundle.size !== "number" || !Number.isSafeInteger(bundle.size) || bundle.size < 1 || bundle.size > maximumMetadataBytes
+    || typeof bundle.digest !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(bundle.digest)) {
+    throw new Error("SlopCamera release lacks a checked provenance bundle.");
+  }
+  const bytes = await gh(["api", `repos/${repository}/releases/assets/${bundle.id}`, "--header", "Accept: application/octet-stream"]);
+  if (bytes.length !== bundle.size || `sha256:${createHash("sha256").update(bytes).digest("hex")}` !== bundle.digest) {
+    throw new Error("SlopCamera provenance bundle differs from the immutable release.");
+  }
+  const directory = await mkdtemp(join(tmpdir(), "slopcamera-update-verification-"));
+  try {
+    const path = join(directory, "provenance.jsonl");
+    await writeFile(path, bytes, { mode: 0o600, flag: "wx" });
+    await gh(["attestation", "verify", artifact.path, "--repo", repository,
+      "--signer-workflow", `${repository}/.github/workflows/release.yml`,
+      "--signer-digest", source.sha, "--source-digest", source.sha,
+      "--source-ref", `refs/tags/${tag}`, "--deny-self-hosted-runners", "--bundle", path]);
+  } finally { await rm(directory, { recursive: true, force: true }); }
+}

package/apps/desktop/cli/verbs.ts

@@ -21,6 +21,11 @@ export interface VerbRow {
 const row = (words: string, opClass: OpClass, summary: string): VerbRow => ({ path: words.split(" "), opClass, summary });
 
 export const CLI_VERBS: readonly VerbRow[] = [
+  row("update", "operate", "Install a verified newer CLI release"),
+  row("update check", "operate", "Check release availability and save the check time"),
+  row("update status", "read", "Show installation support and update preferences"),
+  row("update enable", "operate", "Enable automatic CLI updates"),
+  row("update disable", "operate", "Keep the installed CLI version"),
   row("capabilities", "read", "List what this build can do and how well each part is tested"),
   row("doctor", "read", "Check local render tools, asset caches and old login items"),
   row("operations list", "read", "List the operations agents can run and their limits"),