@hypit/hypit 0.2.0 → 0.2.2

package/README.md

@@ -110,7 +110,7 @@ Drop in a video and your agent clones the whole workflow — or describe what yo
 
 ## Stay Tuned with Us
 
-Star Hypit to bookmark the project. To receive release notifications, select **Watch → Custom → Releases** on GitHub.
+Star us, and you will receive all release notifications from GitHub without any delay!
 
 ![Stay tuned with us](https://storage.googleapis.com/hypit-public-assets/showcase/npm/2026-09-10/star.gif)
 
@@ -147,6 +147,28 @@ commands and the repository layout.
 ## Launch Partner
 
 <table>
+  <tr>
+    <td width="220" align="center">
+      <a href="https://watcha.cn">
+        <picture>
+          <source media="(prefers-color-scheme: dark)" srcset="./docs/public/watcha-dark.png">
+          <img alt="Watcha" src="./docs/public/watcha-light.png" width="170">
+        </picture>
+      </a>
+    </td>
+    <td>Watcha is an innovative ecosystem and community built for AI builders, connecting great products with high-quality users to turn every Demo into reality. Starting from AI product discovery and genuine feedback, Watcha provides product publishing, distribution, and reputation tracking to support builders from launch to early adoption.</td>
+  </tr>
+  <tr>
+    <td width="220" align="center">
+      <a href="https://tokendance.space/?utm_source=hypit">
+        <picture>
+          <source media="(prefers-color-scheme: dark)" srcset="./docs/public/tokendance-dark.png">
+          <img alt="TokenDance" src="./docs/public/tokendance-light.png" width="165">
+        </picture>
+      </a>
+    </td>
+    <td>TokenDance offers builders a unified multi-model gateway with optimized inference costs. Through programs like the Billion-Token Subsidy and the Developer Program, TokenDance helps early-stage builders cut costs so they can focus on product validation and growth.</td>
+  </tr>
   <tr>
     <td width="220" align="center">
       <a href="https://openagents.org/blog/posts/2026-09-08-pilot-user-program-zh-hypit"><img alt="OpenAgents" src="./docs/public/openagents.png" width="180"></a>

package/examples/provider-package/hypit.runtime.json

@@ -1,11 +1,11 @@
 {
   "format": "hypit.runtime-local@1",
   "dataRoot": ".hypit/execution",
-  "credentials": { "os": { "use": "@hypit/credential-store-os" } },
+  "credentials": { "platform": { "use": "@hypit/credential-store-platform" } },
   "endpoints": {
     "images.personal": {
       "use": "@example/provider-images",
-      "config": { "baseUrl": "https://images.example", "apiKey": { "store": "os", "key": "images.personal" } }
+      "config": { "baseUrl": "https://images.example", "apiKey": { "store": "platform", "key": "images.personal" } }
     }
   },
   "bindings": { "@hypit/gpt-image@1#gpt-image-2": "images.personal" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypit/hypit",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "homepage": "https://hypit.ai",
   "repository": {
     "type": "git",
@@ -205,6 +205,7 @@
     "@hypit/credential-store-env": "workspace:*",
     "@hypit/credential-store-file": "workspace:*",
     "@hypit/credential-store-os": "workspace:*",
+    "@hypit/credential-store-platform": "workspace:*",
     "@hypit/deck-track": "workspace:*",
     "@hypit/deck-track-studio": "workspace:*",
     "@hypit/elevenlabs-speech": "workspace:*",

package/packages/caption-fine-studio/package.json

@@ -17,6 +17,6 @@
     "@hypit/studio-adapter": "workspace:*",
     "@hypit/fonts-open": "workspace:*",
     "@hypit/caption": "workspace:*",
-    "@hypit/timeline": "workspace:*"
+    "@hypit/temporal": "workspace:*"
   }
 }

package/packages/cli/src/commands/environment.ts

@@ -172,7 +172,9 @@ export async function runEnvironmentCommand(input: {
   }
 
   if (args.command === "programs") {
-    if (runtimeProfile === undefined) throw new Error("programs requires a Runtime Profile");
+    if (runtimeProfile === undefined) {
+      throw new Error("programs requires a Runtime; run hypit runtime init, select one with runtime use, or pass --runtime <profile>");
+    }
     const profile = resolve(runtimeProfile);
     const host = await runtimeHost(profile);
     if (args.action === "up" || args.action === "prepare") {
@@ -195,11 +197,13 @@ export async function runEnvironmentCommand(input: {
         : await controller.programs.report(args.endpoints === undefined ? {} : { endpoints: args.endpoints });
     const ready = result.programs.every((item) => item.state.state === "ready");
     const needsAttention = (item: typeof result.programs[number]) => args.action === "down"
-      ? item.state.state !== "down" || (item.action !== "stopped" && item.action !== "nothing-to-stop")
+      ? item.action !== "nothing-to-stop"
+        && (item.state.state !== "down" || item.action !== "stopped")
       : item.state.state !== "ready";
     // Readiness describes the service, not whether a stop was performed. An owned process can
     // still be loading, and another command may have declined a concurrent stop during preparation.
     const lifecycleOk = args.action === "status" || !result.programs.some(needsAttention);
+    const stoppedAny = result.programs.some((item) => item.action === "stopped");
     const relevant = result.programs.filter((item) => args.presentation.verbose || args.action === "status" || needsAttention(item));
     const urgent = relevant.filter(needsAttention);
     const shownPrograms = [...urgent, ...relevant.filter((item) => !needsAttention(item)).slice(0, Math.max(0, args.limit - urgent.length))];
@@ -209,7 +213,8 @@ export async function runEnvironmentCommand(input: {
       : args.action === "up"
       ? lifecycleOk ? "External programs ready" : "External programs need attention"
       : args.action === "down"
-        ? lifecycleOk ? "External programs stopped" : "External program stop needs attention"
+        ? lifecycleOk ? stoppedAny ? "External programs stopped" : "No external programs to stop"
+          : "External program stop needs attention"
         : "External program status";
     write({
       format: "hypit.cli-programs@1",
@@ -232,7 +237,9 @@ export async function runEnvironmentCommand(input: {
   }
 
   if (args.command === "runtime") {
-    if (runtimeProfile === undefined) throw new Error("runtime requires a Runtime Profile");
+    if (runtimeProfile === undefined) {
+      throw new Error("runtime requires a Runtime; run hypit runtime init, select one with runtime use, or pass --runtime <profile>");
+    }
     const profile = resolve(runtimeProfile);
     const controller = await runtimeController(profile);
     if (args.action === "up") {
@@ -298,7 +305,7 @@ export async function runEnvironmentCommand(input: {
       write({ format: "hypit.cli-runtime-down@1", worker: worker.state },
         stopped ? "Runtime Worker is down" : "Runtime Worker is still running",
         stopped ? "success" : "warning", [["Worker", worker.state]],
-        [`Managed programs were left running. To stop them: ${commandHint(["programs", "down"], { projectRoot, runtimeProfile: resolve(profile) })}`]);
+        [`Managed Programs are unchanged. To stop processes started by Hypit: ${commandHint(["programs", "down"], { projectRoot, runtimeProfile: resolve(profile) })}`]);
       if (!stopped) io.setExitCode?.(1);
       return;
     }

package/packages/cli/src/output.ts

@@ -1015,7 +1015,7 @@ export function writeCliHelp(io: CliIo, topic?: string): void {
     row("doctor [profile]", "diagnose selected external setup"),
     row("runtime init|use|unset", "create or select this project's Runtime Profile"),
     row("runtime up|status|logs|down", "prepare and manage the local Build Runtime"),
-    row("programs up|status|down", "manage declared external programs only"),
+    row("programs prepare|up|status|down", "manage declared external programs only"),
     row("packages install|status", "manage pinned upstream packages in the machine home"),
     row("activity [--watch]", "show active Builds and their current phases"),
     row("cancel <build-id>", "withdraw one active Build"),

package/packages/credential-store-file/README.md

@@ -4,7 +4,9 @@ A writable CredentialStore for a deployment that explicitly chooses local file s
 Linux without an OS credential locker. It stores unencrypted credential values in an owner-private
 directory outside the video project. On Windows the selected directory must have a private user ACL;
 POSIX file modes do not set Windows ACLs. Choose `@hypit/credential-store-os` when using macOS Keychain
-or Windows Credential Locker, or `@hypit/credential-store-env` for externally supplied, read-only values.
+or Windows Credential Locker, `@hypit/credential-store-platform` for OS storage on macOS/Windows
+and this file Store on Linux or `@hypit/credential-store-env` for externally
+supplied, read-only values.
 
 ## Select it before login
 

package/packages/credential-store-file/src/activation.ts

@@ -1,10 +1,10 @@
-import { join, resolve } from "node:path";
 import {
   createRuntimeCredentialStoreAdapterFacet,
   runtimeConfigExact,
   runtimeConfigObject,
   runtimeConfigString,
 } from "@hypit/runtime-kit";
+import { resolveCredentialDirectory } from "./paths.js";
 import { FileCredentialStore } from "./store.js";
 
 const fileCredentialStoreAdapter = createRuntimeCredentialStoreAdapterFacet({
@@ -17,8 +17,9 @@ const fileCredentialStoreAdapter = createRuntimeCredentialStoreAdapterFacet({
   open(context) {
     const config = runtimeConfigObject(context.config, "file CredentialStore");
     const path = runtimeConfigString(config.path, "file credential path");
-    return { value: new FileCredentialStore(path === undefined
-      ? join(context.hostStateRoot, "credentials") : resolve(context.hostStateRoot, path)) };
+    return { value: new FileCredentialStore(
+      resolveCredentialDirectory(context.hostStateRoot, path, "file CredentialStore"),
+    ) };
   },
 });
 

package/packages/credential-store-file/src/index.ts

@@ -1 +1,2 @@
 export { FileCredentialStore } from "./store.js";
+export { resolveCredentialDirectory } from "./paths.js";

package/packages/credential-store-file/src/paths.ts

@@ -0,0 +1,16 @@
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+/** Profile `path` is Host-state-relative; it must not write secrets outside that root. */
+export function resolveCredentialDirectory(
+  hostStateRoot: string,
+  path: string | undefined,
+  label: string,
+): string {
+  const root = resolve(hostStateRoot);
+  const directory = path === undefined ? join(root, "credentials") : resolve(root, path);
+  const relation = relative(root, directory);
+  if (relation === ".." || relation.startsWith(`..${sep}`) || isAbsolute(relation)) {
+    throw new Error(`${label} path must stay inside the Host state root`);
+  }
+  return directory;
+}

package/packages/credential-store-file/src/store.ts

@@ -8,6 +8,26 @@ function missing(error: unknown): boolean {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 
+/**
+ * One process reads a credential for one Endpoint action while another action's refresh replaces
+ * it, so a read handle and a replacement can reach the same document at the same instant. Windows
+ * refuses to replace a file any handle still holds. Each document's work takes its turn instead,
+ * keyed by path so separate Store instances over one directory share the same order. Keys are
+ * independent: a turn on one document never delays another.
+ */
+const documentTurns = new Map<string, Promise<unknown>>();
+
+function onDocument<T>(path: string, work: () => Promise<T>): Promise<T> {
+  const turn = (documentTurns.get(path) ?? Promise.resolve()).then(work, work);
+  // The successor waits for this turn to settle, not to succeed, and the last turn clears the path.
+  const settled = turn.then(() => undefined, () => undefined);
+  documentTurns.set(path, settled);
+  void settled.then(() => {
+    if (documentTurns.get(path) === settled) documentTurns.delete(path);
+  });
+  return turn;
+}
+
 function credentialValue(value: unknown): CredentialValue {
   if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid credential value");
   const record = value as Record<string, unknown>;
@@ -44,6 +64,10 @@ export class FileCredentialStore implements WritableCredentialStore {
   async resolve(ref: CredentialRef): Promise<CredentialValue | undefined> {
     if (!this.owns(ref)) return undefined;
     const path = this.#path(ref);
+    return await onDocument(path, async () => await this.#read(path));
+  }
+
+  async #read(path: string): Promise<CredentialValue | undefined> {
     try { await this.#privateDirectory(false); } catch (error) {
       if (missing(error)) return undefined;
       throw error;
@@ -69,21 +93,25 @@ export class FileCredentialStore implements WritableCredentialStore {
   async put(ref: CredentialRef, value: CredentialValue): Promise<void> {
     const path = this.#path(ref);
     const contents = JSON.stringify(credentialValue(value));
-    await this.#privateDirectory(true);
-    const temporary = join(this.directory, `.write-${randomUUID()}.tmp`);
-    const file = await open(temporary, "wx", 0o600);
-    try {
-      try { await file.writeFile(`${contents}\n`, "utf8"); } finally { await file.close(); }
-      await rename(temporary, path);
-    } finally { await rm(temporary, { force: true }); }
+    await onDocument(path, async () => {
+      await this.#privateDirectory(true);
+      const temporary = join(this.directory, `.write-${randomUUID()}.tmp`);
+      const file = await open(temporary, "wx", 0o600);
+      try {
+        try { await file.writeFile(`${contents}\n`, "utf8"); } finally { await file.close(); }
+        await rename(temporary, path);
+      } finally { await rm(temporary, { force: true }); }
+    });
   }
 
   async delete(ref: CredentialRef): Promise<boolean> {
     const path = this.#path(ref);
     // Deletion never opens or decodes the old document.
-    try { await unlink(path); return true; } catch (error) {
-      if (missing(error)) return false;
-      throw error;
-    }
+    return await onDocument(path, async () => {
+      try { await unlink(path); return true; } catch (error) {
+        if (missing(error)) return false;
+        throw error;
+      }
+    });
   }
 }

package/packages/credential-store-os/README.md

@@ -11,3 +11,7 @@ bytes do not appear in command arguments or temporary files.
 
 Use `hypit auth login <endpoint> --runtime <profile>` to write the selected credential and
 `hypit auth logout` to remove it.
+
+A Profile that must also run on Linux can select `@hypit/credential-store-platform`:
+that package uses this Store on macOS and Windows, and an unencrypted, owner-private file on Linux.
+Selecting `@hypit/credential-store-os` directly continues to require macOS or Windows.

package/packages/credential-store-os/src/store.ts

@@ -67,6 +67,8 @@ type WindowsCredentialResult = {
 
 const windowsScript = fileURLToPath(new URL("../runtime/windows-credential.ps1", import.meta.url));
 
+const windowsCredentialTimeoutMs = 10_000;
+
 function windowsCredential(
   operation: "read" | "write" | "delete",
   service: string,
@@ -84,8 +86,13 @@ function windowsCredential(
     const fail = (error: Error): void => {
       if (settled) return;
       settled = true;
+      clearTimeout(timer);
       reject(error);
     };
+    const timer = setTimeout(() => {
+      fail(new Error(`Windows credential ${operation} for ${account} timed out`));
+      child.kill("SIGKILL");
+    }, windowsCredentialTimeoutMs);
     child.on("error", fail);
     child.stdout.on("data", (chunk: Buffer) => {
       stdout += chunk.toString("utf8");
@@ -97,6 +104,7 @@ function windowsCredential(
     });
     child.on("close", (code) => {
       if (settled) return;
+      clearTimeout(timer);
       if (code !== 0) {
         fail(new Error(`Windows credential ${operation} for ${account} failed${stderr.trim().length === 0 ? "" : `: ${stderr.trim()}`}`));
         return;
@@ -142,8 +150,9 @@ function platformBackend(service: string) {
   }
   if (process.platform === "win32") return windowsBackend();
   // A Profile that selects this Store cannot be repaired by anything the user does here, and the
-  // other two Stores are the answer, so name them where the failure is read.
+  // other Stores are the answer, so name them where the failure is read.
   throw new Error("OS CredentialStore supports macOS and Windows only; select "
+    + "@hypit/credential-store-platform (platform locker, owner-private file on Linux), "
     + "@hypit/credential-store-file (owner-private local file) or @hypit/credential-store-env "
     + "(externally supplied value) in this Profile's credentials instead");
 }

package/packages/credential-store-platform/README.md

@@ -0,0 +1,62 @@
+# `@hypit/credential-store-platform`
+
+An explicitly selected CredentialStore policy: macOS Keychain on macOS, Windows Credential Locker
+on Windows, and an unencrypted, owner-private file on Linux. Other platforms are unsupported by this
+package and report an error. Linux may offer other credential services; this package chooses file
+storage there and does not detect or integrate those services.
+
+A Profile can select this package to use that policy on Linux, macOS and Windows.
+`@hypit/credential-store-os`, `@hypit/credential-store-file` and `@hypit/credential-store-env`
+remain selectable directly for a deployment with a different storage choice.
+
+## Select it
+
+```json
+{
+  "credentials": {
+    "platform": { "use": "@hypit/credential-store-platform" }
+  },
+  "endpoints": {
+    "hypihub.default": {
+      "use": "@hypit/provider-hypihub",
+      "config": {
+        "baseUrl": "https://hypit.ai",
+        "apiKey": { "store": "platform", "key": "hypihub.oauth" }
+      }
+    }
+  }
+}
+```
+
+The Endpoint still owns its acquisition flow and the Store only persists the result:
+
+```bash
+hypit auth login hypihub.default --runtime <profile>
+hypit auth status hypihub.default --runtime <profile>
+hypit auth logout hypihub.default --runtime <profile>
+```
+
+## What it does not do
+
+The choice is made once per host, from the platform the Runtime is running on. This is not a lookup
+chain: a miss or failure in one store never tries another, and no credential is migrated between them. A
+credential stored in a locker stays in that locker; a credential stored in a file stays in that file.
+
+## Configuration
+
+- `path` selects the directory for Linux file storage, resolved against the Host state root printed by
+  `hypit paths`. The default is the same `credentials` directory `@hypit/credential-store-file` uses,
+  so on Linux, switching between the two Stores finds the credential already stored.
+- `service` selects the locker service name. The OS Store's own default applies when it is absent.
+
+## Storage on each platform
+
+On macOS and Windows the credential is held by the platform locker, with exactly the rules of
+`@hypit/credential-store-os`: it is encrypted and access-controlled by the operating system, and it
+is not readable from another machine.
+
+On Linux the credential is held by an owner-private document with exactly the rules of
+`@hypit/credential-store-file`: unencrypted JSON, one document per key, directory mode `0700`, file
+mode `0600`, outside the video project, and never enumerated or indexed. Filesystem path-length
+limits apply to an overlong key, which fails rather than selecting another name. A damaged document
+can be replaced by `auth login` or deleted by `auth logout` without decoding the old value.

package/packages/credential-store-platform/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@hypit/credential-store-platform",
+  "version": "0.0.0-dev",
+  "license": "SEE LICENSE IN LICENSE",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "files": [
+    "src",
+    "README.md"
+  ],
+  "hypit": {
+    "activation": "./src/activation.ts"
+  },
+  "dependencies": {
+    "@hypit/credential-store-file": "workspace:*",
+    "@hypit/credential-store-os": "workspace:*",
+    "@hypit/runtime": "workspace:*",
+    "@hypit/runtime-kit": "workspace:*"
+  }
+}

package/packages/credential-store-platform/src/activation.ts

@@ -0,0 +1,37 @@
+import {
+  createRuntimeCredentialStoreAdapterFacet,
+  runtimeConfigExact,
+  runtimeConfigObject,
+  runtimeConfigString,
+} from "@hypit/runtime-kit";
+import { resolveCredentialDirectory } from "@hypit/credential-store-file";
+import { PlatformCredentialStore } from "./store.js";
+
+const platformCredentialStoreAdapter = createRuntimeCredentialStoreAdapterFacet({
+  use: "@hypit/credential-store-platform",
+  validate(context) {
+    const config = runtimeConfigObject(context.config, "platform CredentialStore");
+    runtimeConfigExact(config, ["path", "service"], "platform CredentialStore");
+    runtimeConfigString(config.path, "platform credential path");
+    runtimeConfigString(config.service, "platform credential service");
+  },
+  open(context) {
+    const config = runtimeConfigObject(context.config, "platform CredentialStore");
+    const path = runtimeConfigString(config.path, "platform credential path");
+    const service = runtimeConfigString(config.service, "platform credential service");
+    return {
+      value: new PlatformCredentialStore({
+        // Linux uses the same directory the file Store uses by default, so a Profile
+        // that switches between them on Linux finds the credential it stored.
+        directory: resolveCredentialDirectory(context.hostStateRoot, path, "platform CredentialStore"),
+        ...(service === undefined ? {} : { service }),
+      }),
+    };
+  },
+});
+
+export const hypitPackage = {
+  format: "hypit.node-package@1" as const,
+  hostFacets: [platformCredentialStoreAdapter],
+};
+export default hypitPackage;

package/packages/credential-store-platform/src/index.ts

@@ -0,0 +1 @@
+export { PlatformCredentialStore } from "./store.js";

package/packages/credential-store-platform/src/store.ts

@@ -0,0 +1,89 @@
+import {
+  credentialRef,
+  verifyCredentialRef,
+} from "@hypit/runtime";
+import type {
+  CredentialRef,
+  CredentialValue,
+  WritableCredentialStore,
+} from "@hypit/runtime";
+import { FileCredentialStore } from "@hypit/credential-store-file";
+import { OsCredentialStore } from "@hypit/credential-store-os";
+import type {
+  OsCredentialDeleter,
+  OsCredentialReader,
+  OsCredentialWriter,
+} from "@hypit/credential-store-os";
+
+export type PlatformCredentialStoreOptions = {
+  /** Directory holding the documents this Store selects on Linux. */
+  readonly directory: string;
+  /** Service the locker's entries are filed under; the OS Store's own default applies where absent. */
+  readonly service?: string;
+  /**
+   * The platform to select for, defaulting to the running one. A Profile never states this: it is
+   * separate so the selection can be exercised on one machine for every platform.
+   */
+  readonly platform?: NodeJS.Platform;
+  /** Locker backend to read and write with, where the platform's own locker is not the one to use. */
+  readonly locker?: {
+    readonly read: OsCredentialReader;
+    readonly write: OsCredentialWriter;
+    readonly remove: OsCredentialDeleter;
+  };
+};
+
+/**
+ * An explicitly selected storage policy: OS credentials on macOS/Windows, files on Linux.
+ * The selected backend's errors propagate; other platforms are unsupported by this package.
+ */
+export class PlatformCredentialStore implements WritableCredentialStore {
+  readonly #delegate: WritableCredentialStore;
+  readonly #backing: "os" | "file";
+
+  constructor(options: PlatformCredentialStoreOptions) {
+    const platform = options.platform ?? process.platform;
+    if (platform === "darwin" || platform === "win32") {
+      this.#backing = "os";
+      this.#delegate = new OsCredentialStore({
+        ...(options.service === undefined ? {} : { service: options.service }),
+        ...options.locker,
+      });
+    } else if (platform === "linux") {
+      this.#backing = "file";
+      this.#delegate = new FileCredentialStore(options.directory);
+    } else {
+      throw new Error(`Platform CredentialStore does not support ${platform}; select an explicit CredentialStore supported by this host`);
+    }
+  }
+
+  owns(ref: CredentialRef): boolean {
+    return ref.store === "platform";
+  }
+
+  /**
+   * Each delegate owns its own name and refuses refs filed under another, so a ref this Store owns
+   * is retargeted before the delegate sees it. Only the name changes; the opaque key is untouched.
+   */
+  #translated(ref: CredentialRef): CredentialRef {
+    return credentialRef(this.#backing, ref.key);
+  }
+
+  async resolve(ref: CredentialRef): Promise<CredentialValue | undefined> {
+    verifyCredentialRef(ref);
+    if (!this.owns(ref)) return undefined;
+    return await this.#delegate.resolve(this.#translated(ref));
+  }
+
+  async put(ref: CredentialRef, value: CredentialValue): Promise<void> {
+    verifyCredentialRef(ref);
+    if (!this.owns(ref)) throw new Error(`Platform CredentialStore does not own ${ref.store}`);
+    await this.#delegate.put(this.#translated(ref), value);
+  }
+
+  async delete(ref: CredentialRef): Promise<boolean> {
+    verifyCredentialRef(ref);
+    if (!this.owns(ref)) throw new Error(`Platform CredentialStore does not own ${ref.store}`);
+    return await this.#delegate.delete(this.#translated(ref));
+  }
+}

package/packages/media-execution/src/process-env.ts

@@ -1,4 +1,4 @@
-const windowsProcessCreation = ["PATHEXT", "SYSTEMROOT", "WINDIR", "ComSpec"] as const;
+const windowsProcessCreation = ["PATHEXT", "SYSTEMROOT", "WINDIR", "ComSpec", "TEMP", "TMP"] as const;
 
 /**
  * ffmpeg and ffprobe are started as PATH executables. The Host environment is
@@ -7,9 +7,10 @@ const windowsProcessCreation = ["PATHEXT", "SYSTEMROOT", "WINDIR", "ComSpec"] as
  */
 export function mediaProcessEnv(
   extra?: Readonly<Record<string, string>>,
+  platform: NodeJS.Platform = process.platform,
 ): NodeJS.ProcessEnv {
   const env: NodeJS.ProcessEnv = { PATH: process.env.PATH ?? "" };
-  if (process.platform === "win32") {
+  if (platform === "win32") {
     for (const name of windowsProcessCreation) {
       const value = process.env[name];
       if (value !== undefined && value.length > 0) env[name] = value;

package/packages/performance/package.json

@@ -25,6 +25,7 @@
     "@hypit/markup": "workspace:*",
     "@hypit/temporal": "workspace:*",
     "@hypit/temporal-markup": "workspace:*",
-    "@hypit/media-track": "workspace:*"
+    "@hypit/media-track": "workspace:*",
+    "@hypit/visual-ir": "workspace:*"
   }
 }

package/packages/provider-hyperframes-local/src/process.ts

@@ -35,8 +35,12 @@ export async function mediaExecutablePath(value: string): Promise<string> {
   throw new Error(`HyperFrames media executable ${value} is unavailable; correct the Provider's ffmpegPath or ffprobePath.`);
 }
 
-function processEnvironment(): NodeJS.ProcessEnv {
-  const names = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL"] as const;
+export function processEnvironment(platform: NodeJS.Platform = process.platform): NodeJS.ProcessEnv {
+  // POSIX temp is TMPDIR; Windows is TEMP/TMP. HyperFrames writes extracted
+  // frames under %TEMP%\hf-render-… and ffmpeg creates temporary files the same way.
+  const names = platform === "win32"
+    ? ["PATH", "PATHEXT", "SYSTEMROOT", "WINDIR", "ComSpec", "TEMP", "TMP", "USERPROFILE", "LANG", "LC_ALL"] as const
+    : ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL"] as const;
   return Object.fromEntries(names.flatMap((name) => process.env[name] === undefined
     ? []
     : [[name, process.env[name]]])) as NodeJS.ProcessEnv;

package/packages/runtime-local/src/programs.ts

@@ -504,11 +504,14 @@ export async function takeManagedProgramsDown(
       if (pid === undefined || !processAlive(pid)) {
         if (pid !== undefined) await rm(join(directory(dataRoot, program), "process.pid"), { force: true });
         const state = await program.probe();
-        return state.state === "down"
-          ? { ...base, action: "nothing-to-stop", state }
-          // Someone else's process, or one started by hand. Killing it is not this
-          // command's business; saying so is.
-          : { ...base, action: "not-ours", state, detail: `${program.id} is running without a Hypit process record` };
+        if (state.state === "down" || program.start === undefined) {
+          // Probe-only Programs describe installed tools or resources. Readiness means they are
+          // usable, not that a process exists for Hypit to stop.
+          return { ...base, action: "nothing-to-stop", state };
+        }
+        // Someone else's process, or one started by hand. Killing it is not this
+        // command's business; saying so is.
+        return { ...base, action: "not-ours", state, detail: `${program.id} is running without a Hypit process record` };
       }
       const term = await stopProcessTree(pid);
       if (term === "denied") {

package/packages/video-cli/README.md

@@ -35,10 +35,12 @@ Keep an existing chosen service, or configure the chosen local or hosted Provide
 bindings. HypiHub is the recommended integrated hosted route in the official Distribution; other
 services use project Provider packages. If the user chooses HypiHub,
 `hypit auth login hypihub.default` connects that account after choosing its CredentialStore.
-The starter selects the OS store for macOS Keychain / Windows Credential Locker. On Linux, or when
-explicitly choosing file storage, edit the Profile's `credentials` and Endpoint reference as shown
-in [file CredentialStore](../credential-store-file/README.md#select-it-before-login) before `auth` or
-`runtime up`. This selection is configuration; execution never switches stores automatically.
+The starter selects the [platform CredentialStore](../credential-store-platform/README.md#select-it):
+macOS Keychain or Windows Credential Locker on those two platforms, and an owner-private file on
+Linux, so the Profile it writes needs no edit on any of them. Name another Store in `credentials` and
+in the Endpoint's credential reference — as the
+[file CredentialStore](../credential-store-file/README.md#select-it-before-login) shows — to choose it
+explicitly. This selection is configuration; execution never switches stores automatically.
 `hypit doctor --endpoint <name>` checks a selected Endpoint;
 `hypit runtime up --endpoint <name>` prepares that Endpoint and starts the Worker. Repeat the flag
 for several chosen Endpoints; omitting it prepares the whole Profile. `hypit programs up --endpoint

package/packages/video-cli/package.json

@@ -25,6 +25,7 @@
     "@hypit/protocol": "workspace:*",
     "@hypit/provider-hypihub": "workspace:*",
     "@hypit/runtime": "workspace:*",
+    "@hypit/runtime-kit": "workspace:*",
     "@hypit/runtime-host-node": "workspace:*",
     "@hypit/runtime-local": "workspace:*",
     "@hypit/speech": "workspace:*",

package/packages/video-cli/src/distribution.ts

@@ -25,15 +25,18 @@ export const videoCliDistribution: CliDistribution = {
   initialRuntimeProfile: {
     format: "hypit.runtime-local@1",
     dataRoot: ".hypit/runtimes/local",
+    // The starter selects the portable Store, so the Profile it writes is openable and writable on
+    // Linux as well: macOS and Windows keep the platform locker, and a Linux host uses an
+    // owner-private file. `os` and `file` stay selectable by name for one explicit backend.
     credentials: {
-      os: { use: "@hypit/credential-store-os" },
+      platform: { use: "@hypit/credential-store-platform" },
     },
     endpoints: {
       "hypihub.default": {
         use: "@hypit/provider-hypihub",
         config: {
           baseUrl: "https://hypit.ai",
-          apiKey: { store: "os", key: "hypihub.oauth" },
+          apiKey: { store: "platform", key: "hypihub.oauth" },
         },
       },
       "media.local": {