@mevdragon/vidfarm-devcli 0.3.1 → 0.3.3

package/SKILL.director.md

@@ -142,6 +142,8 @@ Two modes:
 - **`smart`** — uses the caller's Gemini/OpenAI/OpenRouter key. Samples frames, extracts scenes with labels and viral notes, extracts on-screen captions with positions, and detects viral DNA (hook, retention, payoff). Takes 30-60 seconds. Auto-fires GhostCut for subtitle removal in the background.
 - **`time-slice`** — deterministic equal-duration split. Instant. No AI provider needed.
 
+**Source length cap.** Vidfarm caps auto-decompose (and all inspiration ingest) at **120 seconds** of source video. If the source is longer, the API responds with `400 { ok: false, code: "source_too_long", duration_seconds, max_duration_seconds }` and no scenes are written. Trim the source before forking / ingesting.
+
 Response:
 
 ```
@@ -150,6 +152,8 @@ Response:
 
 If `ghostcut_pending: true`, poll `POST /api/v1/compositions/:forkId/ghostcut-poll` until status transitions to `done` or `failed`.
 
+Read-only state (does **not** advance the job or bill): `GET /api/v1/compositions/:forkId/ghostcut`. Returns `{ status, task_id, original_source_url, mirrored_url, submitted_at_ms, completed_at_ms, failure_reason }`. Use this when you want to know both video URLs without triggering another poll — the AI copilot uses it to pick between the raw upload and the caption-free mirror before feeding a video into a primitive route (image extract, dedupe, trim, ai video edit, etc.). Prefer `mirrored_url` when `status === "done"` and the downstream call should be caption-free; prefer `original_source_url` when the user explicitly wants the raw upload or when `status !== "done"`.
+
 ## Publish
 
 Publishing renders the fork's current working state to an MP4 using shared Remotion Lambda.
@@ -271,6 +275,11 @@ Flags: `--port`, `--dir`, `--host`, `--fork`, `--api-key` (or set `VIDFARM_API_K
 
 The dev source is persisted in `localStorage.VIDFARM_DEV_SOURCE`, so you don't need to keep the `?dev=` param in the URL after the first load.
 
+`dev-serve` (`vidfarm-devcli` 0.3.2+) is realtime-safe:
+- Writes coming through `PUT /composition.html` / `PATCH /composition.json` **do not loop back** as reload events — the server suppresses filesystem notifications for the just-written file for 500ms so the editor's own save never triggers a self-reload.
+- The SSE `hello` event carries an `instance` id + a monotonic `cursor`. If the client reconnects after a server restart the browser detects the new instance and fires a `vidfarm:dev-reload` so the editor resyncs from disk. A 20s heartbeat keeps the SSE connection alive through intermediate proxies.
+- Port collisions surface as a clear `[dev-serve] port <n> is already in use` message instead of a raw stack trace. Request bodies are capped at 8MB and time out after 15s so a stuck client can't hang the server. File paths are canonicalised so `../etc/passwd`-style paths cannot escape `--dir`.
+
 ## What NOT to do
 
 - Do **not** manipulate composition HTML by string concatenation. Always parse, edit, and re-serialize the DOM. The editor and runtime rely on `data-start`, `data-duration`, `data-track-index`, `data-hf-id`, `data-composition-id` attributes being well-formed.

package/SKILL.platform.md

@@ -161,6 +161,7 @@ All three files (`composition.html`, `composition.json`, `manifest.json`) are tr
 - **Player adapter** — exposes `window.__player = { play(), pause(), seek(t), setTime(t), duration, playing, playbackRate, previewMuted, refreshClips() }` for the editor to control the iframe
 - **Media coordination** — respects `data-playback-start`, `data-volume`, and clip-specific mute
 - **Selection sync** — listens for `postMessage({ source: "hf-parent", ... })` from the parent editor to highlight/deselect clips
+- **Origin-scoped messaging** — the runtime rejects inbound `message` events unless `event.source === window.parent`, so sibling iframes / popups cannot spoof play/pause/seek by forging `data.source`. Outbound `window.parent.postMessage(...)` calls are pinned to the parent's origin (seeded from `document.referrer` and refreshed from the first accepted control message) instead of `"*"`, so preview frame coordinates and layer ids no longer leak to any embedding third-party page.
 
 The same runtime is used inside the Trackpad Editor iframe AND when a published fork is embedded elsewhere. It is agnostic to whether it's being edited or viewed.
 
@@ -201,6 +202,8 @@ The Remotion Lambda is **shared across all templates and forks** — it's an inf
 
 Both modes update the composition.html and composition.json in place, and create a fork version snapshot with `reason: "manual"`.
 
+**Source-duration guardrail.** `probeMediaAsset()` in `src/services/media-processing.ts` enforces a hard cap of `MAX_PROBE_DURATION_SECONDS` (120s). If the probed source exceeds it, the probe throws `MediaDurationExceededError` and the route responds with `400 { code: "source_too_long", duration_seconds, max_duration_seconds }`. The same cap applies to inspiration ingest (`ensureInspirationReadyThenFork`) — over-long submissions land as `InspirationRecord { status: "failed", errorMessage }` without ever creating a Template or fork. This is baked into the probe (not the route) so every consumer — auto-decompose, ingest, `video_probe` / `audio_probe` primitives — is protected from repeated probes of long videos being used to burn Lambda / ffmpeg / vision-API budget.
+
 ## GhostCut integration
 
 GhostCut is an external AI subtitle-removal service. Vidfarm proxies to it via `src/services/ghostcut.ts`:
@@ -211,6 +214,8 @@ GhostCut is an external AI subtitle-removal service. Vidfarm proxies to it via `
 
 State is persisted per fork at `compositions/forks/<forkId>/working/ghostcut.json`. The client polls `POST /api/v1/compositions/:forkId/ghostcut-poll` every few seconds during smart decompose.
 
+Read-only companion: `GET /api/v1/compositions/:forkId/ghostcut` returns `{ status, task_id, original_source_url, mirrored_url, submitted_at_ms, completed_at_ms, failure_reason }` without touching GhostCut. Non-billing. Exposed for two reasons: (1) the editor chat harness / AI copilot uses it to look up both video URLs on demand so downstream primitive calls can pick raw-upload vs caption-free-mirror without hardcoding either in chat context; (2) it's `http_request`-allowlisted under `COMPOSITIONS_PREFIX` in `src/app.ts`, which is why the editor chat system prompt (`src/editor-chat.ts`) directs the model to call it before feeding a video into a primitive route. The AI is instructed **not** to call `POST /ghostcut-poll` unless the user explicitly asks to advance subtitle removal.
+
 Configuration: `GHOSTCUT_KEY` and `GHOSTCUT_SECRET` env vars per stage. Pass-through cost: `GHOSTCUT_USD_PER_30S` (default 0.10).
 
 ## Editor Chat
@@ -363,10 +368,13 @@ vidfarm-devcli dev-serve --dir ./my-fork --port 4321
 
 Edit flags: `--port`, `--dir`, `--host`, `--fork`, `--api-key` (or `VIDFARM_API_KEY`), `--share`, `--refetch`.
 
-`dev-serve` behavior:
+`dev-serve` behavior (`vidfarm-devcli` 0.3.2+):
 - Serves `composition.html` / `composition.json` / `manifest.json` (and `/versions/{n}/…`) with CORS `*`.
 - Accepts `PUT /composition.html` and `PATCH /composition.json`.
-- Watches the dir with `fs.watch`, coalesces bursts, fans out reload events via `GET /_events` SSE.
+- Watches the dir with `fs.watch`, coalesces bursts (80ms), fans out reload events via `GET /_events` SSE.
+- Reload loop prevention: any successful `PUT` / `PATCH` marks the target file "self-write suppressed" for 500ms so the fs.watch event fired by the write we just performed does NOT round-trip back to the editor as a reload event.
+- SSE `hello` includes `{ at, instance, cursor }`. `instance` changes on every dev-serve restart so a reconnecting client can detect a restart and force a resync; `cursor` is a monotonic counter that bumps on every broadcast reload. Heartbeat `: heartbeat <ts>` every 20s keeps intermediate proxies from timing out the connection.
+- Safety rails: request bodies capped at 8MB with a 15s body-read timeout; path resolution runs through `path.relative(rootDir, ...)` so `versions/../../etc/passwd`-style paths cannot escape the served directory; `EADDRINUSE` produces a plain-English error instead of a raw stack; broadcast iterates a snapshot of the client set so a mid-broadcast disconnect can't skip healthy clients; `SIGINT` + `SIGTERM` both close cleanly with a 2s hard-exit fallback.
 
-The editor side lives in `demo/src/dev-mode.ts` — a self-installing module imported at the top of `demo/src/main.tsx`. It reads `?dev=<url>` (persisted to `localStorage.VIDFARM_DEV_SOURCE`), monkey-patches `window.fetch` to rewrite `/api/v1/compositions/{forkId}/*` → `${devSource}/*`, injects a persistent orange banner with an Exit button, and dispatches `vidfarm:dev-reload` on SSE reload events. `HyperframesStudioEditor.tsx` listens for that event and re-runs the composition fetch effect with `cache: "reload"`.
+The editor side lives in `demo/src/dev-mode.ts` — a self-installing module imported at the top of `demo/src/main.tsx`. It reads `?dev=<url>` (persisted to `localStorage.VIDFARM_DEV_SOURCE`), monkey-patches `window.fetch` to rewrite `/api/v1/compositions/{forkId}/*` → `${devSource}/*`, injects a persistent orange banner with an Exit button, and dispatches `vidfarm:dev-reload` on SSE reload events. It also caches the `hello.instance` and re-dispatches `vidfarm:dev-reload` with `{ reason: "server-restart" }` when a reconnect sees a different instance. `HyperframesStudioEditor.tsx` listens for that event and re-runs the composition fetch effect with `cache: "reload"`.
 - Lambdas — `infra/lambda/*.ts`

package/dist/src/dev-serve.js

@@ -1,5 +1,5 @@
 import { createServer } from "node:http";
-import { existsSync, mkdirSync, readFileSync, watch, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, statSync, watch, writeFileSync } from "node:fs";
 import path from "node:path";
 import { parseArgs } from "node:util";
 // vidfarm dev-serve — a tiny HTTP layer that lets the browser editor point at
@@ -14,6 +14,17 @@ const CORS_HEADERS = {
     "access-control-allow-headers": "content-type,authorization",
     "access-control-max-age": "600"
 };
+// Cap request bodies at 8MB so a runaway or malicious client can't OOM the
+// dev server. A composition.html + inlined asset is normally <1MB.
+const MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
+// Ignore filesystem events for this long after we write from an HTTP handler,
+// so the editor's own PUT/PATCH doesn't trigger a self-reload loop. `fs.watch`
+// on macOS fires 1–3 events per rename, plus a tail event from the editor's
+// auto-format step.
+const SELF_WRITE_SUPPRESS_MS = 500;
+// Bump on every new dev-serve process so a reconnecting SSE client can tell
+// whether the server restarted (and therefore whether it must resync files).
+const SERVER_INSTANCE_ID = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
 export async function runDevServeCommand(argv) {
     const parsed = parseArgs({
         args: argv,
@@ -24,14 +35,22 @@ export async function runDevServeCommand(argv) {
     });
     const rootDir = path.resolve(process.cwd(), parsed.values.dir);
     const port = Number(parsed.values.port);
+    if (!Number.isFinite(port) || port <= 0 || port > 65535) {
+        throw new Error(`Invalid --port: ${parsed.values.port}`);
+    }
     if (!existsSync(rootDir)) {
         mkdirSync(rootDir, { recursive: true });
     }
     let nextClientId = 1;
+    let mutationCursor = 0;
     const clients = new Set();
+    const selfWriteSuppressUntil = new Map();
     function broadcast(event, data) {
         const payload = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
-        for (const client of clients) {
+        // Snapshot the client set before iterating: `client.res.write` can
+        // synchronously destroy the response (broken pipe), which mutates the
+        // Set mid-iteration and can skip healthy clients.
+        for (const client of [...clients]) {
             try {
                 client.res.write(payload);
             }
@@ -40,16 +59,45 @@ export async function runDevServeCommand(argv) {
             }
         }
     }
+    function isSelfWriteSuppressed(filename) {
+        if (!filename)
+            return false;
+        const until = selfWriteSuppressUntil.get(filename);
+        if (!until)
+            return false;
+        if (Date.now() > until) {
+            selfWriteSuppressUntil.delete(filename);
+            return false;
+        }
+        return true;
+    }
+    function suppressReloadFromSelfWrite(filePath) {
+        const rel = path.relative(rootDir, filePath);
+        if (!rel || rel.startsWith(".."))
+            return;
+        // fs.watch reports filenames relative to the watched root — match both the
+        // basename and the relative path, since macOS emits either form.
+        selfWriteSuppressUntil.set(rel, Date.now() + SELF_WRITE_SUPPRESS_MS);
+        selfWriteSuppressUntil.set(path.basename(filePath), Date.now() + SELF_WRITE_SUPPRESS_MS);
+    }
     // fs.watch fires on any child change. Coalesce bursts so a single save
-    // doesn't spam the editor with 3 reload events.
+    // doesn't spam the editor with 3 reload events. Also drop events for files
+    // we JUST wrote ourselves so PUT/PATCH doesn't loop into a client reload.
     let reloadTimer = null;
+    let pendingReloadFile = null;
     const scheduleReload = (filename) => {
+        if (isSelfWriteSuppressed(filename))
+            return;
+        pendingReloadFile = filename ?? pendingReloadFile;
         if (reloadTimer)
             clearTimeout(reloadTimer);
         reloadTimer = setTimeout(() => {
             reloadTimer = null;
-            broadcast("reload", { file: filename, at: Date.now() });
-            console.log(`[dev-serve] reload → ${filename ?? "(unknown)"}`);
+            const file = pendingReloadFile;
+            pendingReloadFile = null;
+            mutationCursor += 1;
+            broadcast("reload", { file, at: Date.now(), cursor: mutationCursor });
+            console.log(`[dev-serve] reload → ${file ?? "(unknown)"}`);
         }, 80);
     };
     try {
@@ -59,19 +107,50 @@ export async function runDevServeCommand(argv) {
     }
     catch (error) {
         console.warn(`[dev-serve] watch failed: ${error instanceof Error ? error.message : String(error)}`);
+        console.warn("[dev-serve] file changes will NOT trigger editor reloads. On Linux, install inotify-tools or run inside a supported filesystem.");
     }
-    const server = createServer((req, res) => handleRequest(req, res, rootDir, clients, nextClientId++));
+    const server = createServer((req, res) => handleRequest(req, res, {
+        rootDir,
+        clients,
+        clientId: nextClientId++,
+        mutationCursor: () => mutationCursor,
+        suppressReloadFromSelfWrite
+    }));
+    server.on("error", (error) => {
+        if (error.code === "EADDRINUSE") {
+            console.error(`[dev-serve] port ${port} is already in use.`);
+            console.error(`[dev-serve] pass --port <n> to pick a different port, or stop the process bound to ${port}.`);
+            process.exit(1);
+        }
+        console.error(`[dev-serve] server error: ${error.message}`);
+        process.exit(1);
+    });
     server.listen(port, () => {
         console.log(`[dev-serve] serving ${rootDir}`);
         console.log(`[dev-serve] listening on http://localhost:${port}`);
         console.log(`[dev-serve] editor: open with ?dev=${encodeURIComponent(`http://localhost:${port}`)}`);
     });
-    process.on("SIGINT", () => {
+    let shuttingDown = false;
+    const shutdown = () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
         console.log("\n[dev-serve] shutting down");
+        for (const client of clients) {
+            try {
+                client.res.end();
+            }
+            catch { }
+        }
+        clients.clear();
         server.close(() => process.exit(0));
-    });
+        // Fallback: if in-flight sockets keep the server open, force-exit after 2s.
+        setTimeout(() => process.exit(0), 2000).unref();
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
 }
-function handleRequest(req, res, rootDir, clients, clientId) {
+function handleRequest(req, res, ctx) {
     const method = (req.method ?? "GET").toUpperCase();
     const url = new URL(req.url ?? "/", `http://localhost`);
     const pathname = url.pathname;
@@ -85,15 +164,35 @@ function handleRequest(req, res, rootDir, clients, clientId) {
             ...CORS_HEADERS,
             "content-type": "text/event-stream",
             "cache-control": "no-cache",
-            connection: "keep-alive"
+            connection: "keep-alive",
+            "x-accel-buffering": "no"
         });
-        res.write(`event: hello\ndata: ${JSON.stringify({ at: Date.now() })}\n\n`);
-        const client = { res, id: clientId };
-        clients.add(client);
-        req.on("close", () => clients.delete(client));
+        // Include instance id + current cursor so a reconnecting client can tell
+        // if the server restarted (missed events) or if it just needs to catch up.
+        res.write(`event: hello\ndata: ${JSON.stringify({
+            at: Date.now(),
+            instance: SERVER_INSTANCE_ID,
+            cursor: ctx.mutationCursor()
+        })}\n\n`);
+        const client = { res, id: ctx.clientId };
+        ctx.clients.add(client);
+        // Heartbeat keeps intermediate proxies (and iOS Safari) from timing out
+        // the long-lived SSE connection.
+        const heartbeat = setInterval(() => {
+            try {
+                res.write(`: heartbeat ${Date.now()}\n\n`);
+            }
+            catch { }
+        }, 20_000);
+        const cleanup = () => {
+            clearInterval(heartbeat);
+            ctx.clients.delete(client);
+        };
+        req.on("close", cleanup);
+        req.on("error", cleanup);
         return;
     }
-    const filePath = resolveFilePath(rootDir, pathname);
+    const filePath = resolveFilePath(ctx.rootDir, pathname);
     if (!filePath) {
         respondJson(res, 404, { ok: false, error: `Not found: ${pathname}` });
         return;
@@ -103,10 +202,21 @@ function handleRequest(req, res, rootDir, clients, clientId) {
             respondJson(res, 404, { ok: false, error: `Missing ${path.basename(filePath)}` });
             return;
         }
-        const body = readFileSync(filePath);
-        const contentType = pathname.endsWith(".html") ? "text/html; charset=utf-8" : "application/json";
-        res.writeHead(200, { ...CORS_HEADERS, "content-type": contentType });
-        res.end(body);
+        try {
+            const body = readFileSync(filePath);
+            const stat = statSync(filePath);
+            const contentType = pathname.endsWith(".html") ? "text/html; charset=utf-8" : "application/json";
+            res.writeHead(200, {
+                ...CORS_HEADERS,
+                "content-type": contentType,
+                "cache-control": "no-store",
+                etag: `"${stat.size}-${stat.mtimeMs}"`
+            });
+            res.end(body);
+        }
+        catch (error) {
+            respondJson(res, 500, { ok: false, error: `Read failed: ${error instanceof Error ? error.message : String(error)}` });
+        }
         return;
     }
     if (method === "PUT" && pathname.endsWith("/composition.html")) {
@@ -116,27 +226,41 @@ function handleRequest(req, res, rootDir, clients, clientId) {
                 respondJson(res, 400, { ok: false, error: "Composition HTML is missing data-composition-id" });
                 return;
             }
-            mkdirSync(path.dirname(filePath), { recursive: true });
-            writeFileSync(filePath, html, "utf8");
-            respondJson(res, 200, { ok: true, bytes: html.length });
-        }).catch((error) => respondJson(res, 500, { ok: false, error: String(error) }));
+            try {
+                mkdirSync(path.dirname(filePath), { recursive: true });
+                ctx.suppressReloadFromSelfWrite(filePath);
+                writeFileSync(filePath, html, "utf8");
+                respondJson(res, 200, { ok: true, bytes: html.length });
+            }
+            catch (error) {
+                respondJson(res, 500, { ok: false, error: `Write failed: ${error instanceof Error ? error.message : String(error)}` });
+            }
+        }).catch((error) => respondJson(res, 400, { ok: false, error: String(error) }));
         return;
     }
     if (method === "PATCH" && pathname.endsWith("/composition.json")) {
         readBody(req).then((body) => {
-            const patch = JSON.parse(body.toString("utf8") || "{}");
-            const existing = existsSync(filePath) ? JSON.parse(readFileSync(filePath, "utf8") || "{}") : {};
-            const merged = { ...existing, ...patch };
-            mkdirSync(path.dirname(filePath), { recursive: true });
-            writeFileSync(filePath, JSON.stringify(merged, null, 2), "utf8");
-            respondJson(res, 200, merged);
-        }).catch((error) => respondJson(res, 500, { ok: false, error: String(error) }));
+            try {
+                const patch = JSON.parse(body.toString("utf8") || "{}");
+                const existing = existsSync(filePath) ? JSON.parse(readFileSync(filePath, "utf8") || "{}") : {};
+                const merged = { ...existing, ...patch };
+                mkdirSync(path.dirname(filePath), { recursive: true });
+                ctx.suppressReloadFromSelfWrite(filePath);
+                writeFileSync(filePath, JSON.stringify(merged, null, 2), "utf8");
+                respondJson(res, 200, merged);
+            }
+            catch (error) {
+                respondJson(res, 400, { ok: false, error: `PATCH failed: ${error instanceof Error ? error.message : String(error)}` });
+            }
+        }).catch((error) => respondJson(res, 400, { ok: false, error: String(error) }));
         return;
     }
     respondJson(res, 405, { ok: false, error: `Method ${method} not allowed on ${pathname}` });
 }
 // Restrict served paths to the working/version composition files. Anything
-// else 404s so this server isn't a random static host.
+// else 404s so this server isn't a random static host. Also canonicalise the
+// resolved path so `..` segments cannot escape rootDir even through a future
+// refactor of the allowlist.
 function resolveFilePath(rootDir, pathname) {
     const clean = pathname.replace(/^\/+/, "");
     const parts = clean.split("/").filter(Boolean);
@@ -146,13 +270,22 @@ function resolveFilePath(rootDir, pathname) {
     const allowed = ["composition.html", "composition.json", "manifest.json"];
     if (!allowed.includes(filename))
         return null;
+    let candidate;
     // Allow: `composition.html`, `versions/1/composition.html`.
     if (parts.length === 1)
-        return path.join(rootDir, filename);
-    if (parts.length === 3 && parts[0] === "versions" && /^\d+$/.test(parts[1])) {
-        return path.join(rootDir, "versions", parts[1], filename);
+        candidate = path.join(rootDir, filename);
+    else if (parts.length === 3 && parts[0] === "versions" && /^\d+$/.test(parts[1])) {
+        candidate = path.join(rootDir, "versions", parts[1], filename);
     }
-    return null;
+    else {
+        return null;
+    }
+    const resolved = path.resolve(candidate);
+    const rootResolved = path.resolve(rootDir);
+    const rel = path.relative(rootResolved, resolved);
+    if (rel.startsWith("..") || path.isAbsolute(rel))
+        return null;
+    return resolved;
 }
 function respondJson(res, status, body) {
     res.writeHead(status, { ...CORS_HEADERS, "content-type": "application/json" });
@@ -161,9 +294,36 @@ function respondJson(res, status, body) {
 function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
-        req.on("data", (chunk) => chunks.push(chunk));
-        req.on("end", () => resolve(Buffer.concat(chunks)));
-        req.on("error", reject);
+        let total = 0;
+        let settled = false;
+        // Guard against a slow client stringing the connection open forever.
+        const timeout = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            req.destroy();
+            reject(new Error("Request body read timed out after 15s."));
+        }, 15_000);
+        const done = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            fn();
+        };
+        req.on("data", (chunk) => {
+            if (settled)
+                return;
+            total += chunk.length;
+            if (total > MAX_REQUEST_BODY_BYTES) {
+                done(() => reject(new Error(`Request body exceeds ${MAX_REQUEST_BODY_BYTES} bytes.`)));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => done(() => resolve(Buffer.concat(chunks))));
+        req.on("error", (error) => done(() => reject(error)));
     });
 }
 //# sourceMappingURL=dev-serve.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mevdragon/vidfarm-devcli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Local bridge for the Vidfarm Trackpad Editor. Point it at a template id, edit composition.html on disk (Claude Code, Codex, etc.), preview live in the browser at https://vidfarm.cc/editor/.",
   "type": "module",
   "bin": {