@mevdragon/vidfarm-devcli 0.8.0 → 0.9.0

package/dist/src/devcli/telemetry.js

@@ -0,0 +1,236 @@
+// Opt-out crash telemetry for the vidfarm devcli — the `vidfarm ...` commands
+// AND the local `serve` editor server. Unlike the backend/browser Sentry setups
+// (which run on OUR infrastructure), this runs on END USERS' machines, so it is
+// built defensively:
+//
+//   * DEDICATED DSN — never the backend or browser project. Ships EMPTY, i.e.
+//     fully DISABLED, until VIDFARM_DEVCLI_SENTRY_DSN (or the DEVCLI_SENTRY_DSN
+//     constant below) points at a Sentry project created specifically for the
+//     CLI. That keeps devcli crashes out of product error streams and means the
+//     published package never carries a DSN that could be abused for quota spam.
+//   * OPT-OUT — honors DO_NOT_TRACK (https://consoledonottrack.com) and
+//     VIDFARM_TELEMETRY=off|0|false|no|disabled.
+//   * CRASH-ONLY — deliberate `throw new Error("...")` user errors (bad args,
+//     HTTP 4xx, missing files) and transient network failures are NOT reported;
+//     only unexpected bugs (TypeError/RangeError/… and non-Error throws) are.
+//   * SCRUBBED — beforeSend strips home-dir paths, api keys, auth headers, and
+//     known env secrets before anything leaves the machine; PII is off; console
+//     breadcrumbs (which can carry prompts / composition text) are dropped.
+//   * FLUSHED — flushTelemetry() drains the queue before the short-lived CLI exits.
+//
+// Every entry point is wrapped so telemetry can NEVER break a user's command.
+import { readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import * as Sentry from "@sentry/node";
+// Set this to a DSN for a Sentry project dedicated to the devcli (NOT the
+// backend or browser project). Left empty so the published package is silent
+// until such a project exists; VIDFARM_DEVCLI_SENTRY_DSN overrides it at runtime.
+const DEVCLI_SENTRY_DSN = "";
+let initialized = false;
+// Env vars whose values must never leave the machine, even if they surface in
+// an error message or stack. Values are collected at init and redacted verbatim.
+const SECRET_ENV_KEYS = [
+    "VIDFARM_API_KEY",
+    "VIDFARM_STAGING_BOOTSTRAP_API_KEY",
+    "OPENAI_API_KEY",
+    "OPENROUTER_API_KEY",
+    "GEMINI_API_KEY",
+    "PERPLEXITY_API_KEY",
+    "GHOSTCUT_KEY",
+    "GHOSTCUT_SECRET",
+    "ENCRYPTION_SECRET",
+    "API_KEY_SALT",
+    "WEBHOOK_SECRET",
+    "RESEND_API_KEY",
+    "AWS_ACCESS_KEY_ID",
+    "AWS_SECRET_ACCESS_KEY"
+];
+const HOME_DIR = safeHomedir();
+let secretValues = [];
+// Token-shaped strings redacted regardless of source (belt-and-suspenders on top
+// of the exact env-value match above).
+const TOKEN_PATTERNS = [
+    /\b(?:vf|sk|rk|pk|key)_[A-Za-z0-9_-]{8,}\b/g, // vidfarm / provider-style keys
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, // JWT
+    /\bAKIA[0-9A-Z]{16}\b/g, // AWS access key id
+    /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi
+];
+// Transient / environmental failures we never want to page on — they are the
+// user's network, not our bug.
+const BENIGN_MESSAGE = /(fetch failed|ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|socket hang up|getaddrinfo|network|and requires a connection)/i;
+function safeHomedir() {
+    try {
+        return os.homedir() || "";
+    }
+    catch {
+        return "";
+    }
+}
+function isOptedOut() {
+    // DO_NOT_TRACK: any value other than unset / "0" / "false" means opt out.
+    const dnt = process.env.DO_NOT_TRACK?.trim();
+    if (dnt && dnt !== "0" && dnt.toLowerCase() !== "false")
+        return true;
+    const flag = process.env.VIDFARM_TELEMETRY?.trim().toLowerCase();
+    if (flag && ["0", "off", "false", "no", "disabled"].includes(flag))
+        return true;
+    return false;
+}
+function resolveDsn() {
+    return (process.env.VIDFARM_DEVCLI_SENTRY_DSN?.trim() || DEVCLI_SENTRY_DSN || "").trim();
+}
+function readPackageVersion() {
+    try {
+        let dir = path.dirname(fileURLToPath(import.meta.url));
+        for (let i = 0; i < 6; i++) {
+            try {
+                const parsed = JSON.parse(readFileSync(path.join(dir, "package.json"), "utf8"));
+                if (parsed.name === "@mevdragon/vidfarm-devcli" && parsed.version) {
+                    return `vidfarm-devcli@${parsed.version}`;
+                }
+            }
+            catch {
+                // keep walking up
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    catch {
+        // ignore — release tag is best-effort
+    }
+    return undefined;
+}
+function scrubString(input) {
+    let s = input;
+    if (HOME_DIR && s.includes(HOME_DIR))
+        s = s.split(HOME_DIR).join("~");
+    for (const secret of secretValues) {
+        if (secret && s.includes(secret))
+            s = s.split(secret).join("[REDACTED]");
+    }
+    for (const re of TOKEN_PATTERNS)
+        s = s.replace(re, "[REDACTED]");
+    // `--api-key <value>` on the command line and `header: value` shaped pairs.
+    s = s.replace(/(--api-key[=\s]+)\S+/gi, "$1[REDACTED]");
+    s = s.replace(/((?:vidfarm-api-key|authorization|x-api-key)["']?\s*[:=]\s*["']?)[^"'\s,}]+/gi, "$1[REDACTED]");
+    return s;
+}
+function scrubDeep(value, depth) {
+    if (value == null || depth > 8)
+        return value;
+    if (typeof value === "string")
+        return scrubString(value);
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++)
+            value[i] = scrubDeep(value[i], depth + 1);
+        return value;
+    }
+    if (typeof value === "object") {
+        const record = value;
+        for (const key of Object.keys(record))
+            record[key] = scrubDeep(record[key], depth + 1);
+        return record;
+    }
+    return value;
+}
+/** Deliberate `throw new Error("...")` user errors have name "Error"; genuine
+ *  bugs surface as TypeError/RangeError/ReferenceError/… or as non-Error throws.
+ *  Transient network failures are treated as expected. */
+export function isUnexpectedCrash(error) {
+    if (!(error instanceof Error))
+        return true;
+    if (BENIGN_MESSAGE.test(error.message))
+        return false;
+    return error.name !== "Error";
+}
+export function isTelemetryEnabled() {
+    return initialized;
+}
+export function initTelemetry(commandName) {
+    try {
+        if (initialized)
+            return;
+        if (isOptedOut())
+            return;
+        const dsn = resolveDsn();
+        if (!dsn)
+            return;
+        secretValues = SECRET_ENV_KEYS.map((key) => process.env[key]?.trim() ?? "").filter((v) => v.length >= 8);
+        Sentry.init({
+            dsn,
+            environment: "devcli",
+            release: process.env.VIDFARM_DEVCLI_RELEASE?.trim() || readPackageVersion(),
+            // Short-lived CLI: no performance tracing, no log capture (logs can carry
+            // prompts / composition text), tiny breadcrumb budget.
+            tracesSampleRate: 0,
+            enableLogs: false,
+            sendDefaultPii: false,
+            maxBreadcrumbs: 20,
+            beforeBreadcrumb(breadcrumb) {
+                if (breadcrumb.category === "console")
+                    return null;
+                try {
+                    return scrubDeep(breadcrumb, 0);
+                }
+                catch {
+                    return null; // if scrubbing fails, drop rather than risk leaking
+                }
+            },
+            beforeSend(event) {
+                try {
+                    if (event.request) {
+                        delete event.request.data;
+                        delete event.request.cookies;
+                        delete event.request.headers;
+                    }
+                    return scrubDeep(event, 0);
+                }
+                catch {
+                    return null; // scrub failed → drop the event entirely, never leak raw
+                }
+            }
+        });
+        Sentry.setTags({
+            "vidfarm.surface": "devcli",
+            "vidfarm.node": process.version,
+            "vidfarm.platform": `${process.platform}-${process.arch}`,
+            ...(commandName ? { "vidfarm.command": commandName } : {})
+        });
+        initialized = true;
+    }
+    catch {
+        // Telemetry must never break the CLI.
+        initialized = false;
+    }
+}
+/** Report an unexpected top-level CLI crash (no-op for expected user errors,
+ *  transient network errors, or when telemetry is disabled), then flush. */
+export async function reportCliCrash(error) {
+    try {
+        if (!initialized)
+            return;
+        if (!isUnexpectedCrash(error))
+            return;
+        Sentry.captureException(error);
+        await flushTelemetry();
+    }
+    catch {
+        // swallow — never let telemetry change the exit path
+    }
+}
+export async function flushTelemetry(timeoutMs = 2000) {
+    try {
+        if (!initialized)
+            return;
+        await Sentry.flush(timeoutMs);
+    }
+    catch {
+        // swallow
+    }
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/src/frontend/template-editor-chat.js

@@ -3501,6 +3501,213 @@ export function TemplateEditorChat({ boot }) {
         }
         await appendFiles(files);
     }
+    // "create me a video of…" / "replicate this URL…" — the discover-chat-only
+    // create_video tool returns the user's intent; we run the SAME pipeline the
+    // devcli `create`/`replicate` commands run, here in the browser, updating this
+    // assistant message as it progresses and appending an "Open in editor" link
+    // when the new video is ready. Long-running but visible; all same-origin API
+    // calls (the source download happens server-side in the ingest primitive).
+    async function runCreateVideoFlow(threadId, messageId, intentRaw) {
+        const intent = intentRaw ?? {};
+        const apiKey = boot.vidfarmApiKey;
+        const origin = window.location.origin;
+        const jsonHeaders = buildAuthHeaders(apiKey, "application/json");
+        const getHeaders = buildAuthHeaders(apiKey);
+        const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+        const patch = (status, appendText) => {
+            updateThread(threadId, (thread) => ({
+                ...thread,
+                updatedAt: new Date().toISOString(),
+                messages: thread.messages.map((message) => (message.id === messageId
+                    ? {
+                        ...message,
+                        isPending: false,
+                        statusText: status ?? message.statusText,
+                        text: appendText ? appendDistinctMessageText(message.text, appendText) : message.text
+                    }
+                    : message))
+            }));
+        };
+        const readJson = async (res) => {
+            const text = await res.text();
+            try {
+                return text ? JSON.parse(text) : null;
+            }
+            catch {
+                return null;
+            }
+        };
+        const pollInspirationReady = async (inspirationId) => {
+            const deadline = Date.now() + 5 * 60 * 1000;
+            for (;;) {
+                const res = await fetch(new URL(`/api/v1/videos/${encodeURIComponent(inspirationId)}`, origin), { headers: getHeaders });
+                const json = await readJson(res);
+                const status = String(json?.status ?? "");
+                if (status === "ready")
+                    return json;
+                if (status === "failed")
+                    throw new Error(`source video download failed${json?.error ? `: ${json.error}` : ""}.`);
+                if (Date.now() > deadline)
+                    throw new Error("source video download timed out.");
+                await sleep(5000);
+            }
+        };
+        const resolveJobMediaUrl = (job) => {
+            const readStr = (value) => (typeof value === "string" && value.trim() ? value.trim() : null);
+            const result = (job?.result && typeof job.result === "object") ? job.result : {};
+            const output = (result.output && typeof result.output === "object") ? result.output : result;
+            const direct = readStr(output?.primary_file_url) ?? readStr(output?.video?.file_url) ?? readStr(output?.image?.file_url) ?? readStr(output?.render?.output_url);
+            if (direct)
+                return direct;
+            if (Array.isArray(output?.files)) {
+                for (const file of output.files) {
+                    const url = readStr(typeof file === "string" ? file : (file?.file_url ?? file?.url));
+                    if (url)
+                        return url;
+                }
+            }
+            if (Array.isArray(job?.artifacts)) {
+                for (const artifact of job.artifacts) {
+                    const url = readStr(artifact?.public_url);
+                    if (url)
+                        return url;
+                }
+            }
+            return null;
+        };
+        const pollJobMedia = async (jobId) => {
+            const deadline = Date.now() + 8 * 60 * 1000;
+            for (;;) {
+                await sleep(5000);
+                const res = await fetch(new URL(`/api/v1/user/me/jobs/${encodeURIComponent(jobId)}`, origin), { headers: getHeaders });
+                const json = await readJson(res);
+                const status = String(json?.status ?? "");
+                const url = resolveJobMediaUrl(json);
+                if (url)
+                    return url;
+                if (status === "failed" || status === "cancelled")
+                    throw new Error(`generation ${status}.`);
+                if (Date.now() > deadline)
+                    throw new Error("generation timed out.");
+            }
+        };
+        // Wrap a generated MP4 into a new template via the upload-ingest path (the
+        // same route `inspiration-add <file>` uses). The generated media lives on
+        // public-read storage (bucket CORS allows a browser GET), so we can pull the
+        // blob and re-upload it.
+        const ingestGeneratedVideo = async (mediaUrl, title) => {
+            const blob = await (await fetch(mediaUrl)).blob();
+            const presignRes = await fetch(new URL("/discover/templates/upload/presign", origin), {
+                method: "POST",
+                headers: jsonHeaders,
+                body: JSON.stringify({ file_name: "generated.mp4", content_type: "video/mp4", size_bytes: blob.size })
+            });
+            const presign = await readJson(presignRes);
+            if (!presignRes.ok)
+                throw new Error(presign?.error || `upload presign failed (${presignRes.status})`);
+            let storageKey = presign?.storage_key;
+            let uploadedName = presign?.file_name || "generated.mp4";
+            if (presign?.transport === "presigned" && presign?.upload?.url) {
+                const put = await fetch(presign.upload.url, { method: presign.upload.method || "PUT", headers: presign.upload.headers || {}, body: blob });
+                if (!put.ok)
+                    throw new Error(`upload failed (${put.status})`);
+            }
+            else {
+                const form = new FormData();
+                form.append("file", blob, "generated.mp4");
+                const up = await fetch(new URL(presign?.upload?.url || "/discover/templates/upload", origin), { method: "POST", headers: getHeaders, body: form });
+                const upJson = await readJson(up);
+                if (!up.ok || !upJson?.storage_key)
+                    throw new Error(upJson?.error || `upload failed (${up.status})`);
+                storageKey = upJson.storage_key;
+                uploadedName = upJson.file_name || "generated.mp4";
+            }
+            if (!storageKey)
+                throw new Error("upload did not return a storage key.");
+            const addRes = await fetch(new URL("/discover/templates", origin), {
+                method: "POST",
+                headers: jsonHeaders,
+                body: JSON.stringify({ upload: { storage_key: storageKey, file_name: uploadedName }, title })
+            });
+            const add = await readJson(addRes);
+            if (!addRes.ok)
+                throw new Error(add?.error || `ingest failed (${addRes.status})`);
+            return add;
+        };
+        try {
+            if (!apiKey) {
+                patch(null, "⚠️ You need to be logged in to create a video.");
+                return;
+            }
+            const mode = intent.mode === "replicate" ? "replicate" : intent.mode === "generate" ? "generate" : null;
+            let inspiration;
+            let userPrompt;
+            if (mode === "replicate") {
+                const sourceUrl = (intent.source_url ?? "").trim();
+                if (!/^https?:\/\//i.test(sourceUrl)) {
+                    patch(null, "⚠️ I need a video URL (TikTok/YouTube/Instagram/X) to replicate.");
+                    return;
+                }
+                userPrompt = (intent.instructions ?? "").trim() || null;
+                patch("Fetching the source video…");
+                const addRes = await fetch(new URL("/discover/templates", origin), { method: "POST", headers: jsonHeaders, body: JSON.stringify({ source_url: sourceUrl }) });
+                const add = await readJson(addRes);
+                if (!addRes.ok)
+                    throw new Error(add?.error || `couldn't fetch that URL (${addRes.status})`);
+                inspiration = add?.status === "ready" ? add : await pollInspirationReady(add?.inspiration_id);
+            }
+            else if (mode === "generate") {
+                const prompt = (intent.prompt ?? "").trim();
+                if (!prompt) {
+                    patch(null, "⚠️ Tell me what the video should be about and I'll create it.");
+                    return;
+                }
+                userPrompt = prompt;
+                patch("Generating your video… (this can take a couple of minutes)");
+                const genRes = await fetch(new URL("/api/v1/primitives/videos/generate", origin), {
+                    method: "POST",
+                    headers: jsonHeaders,
+                    body: JSON.stringify({ tracer: `chat-create-${Date.now().toString(36)}`, payload: { prompt } })
+                });
+                const gen = await readJson(genRes);
+                if (!genRes.ok)
+                    throw new Error(gen?.error || `couldn't start generation (${genRes.status})`);
+                const mediaUrl = await pollJobMedia(gen?.job_id);
+                patch("Building an editable template from the generated video…");
+                const add = await ingestGeneratedVideo(mediaUrl, prompt.slice(0, 80));
+                inspiration = add?.status === "ready" ? add : await pollInspirationReady(add?.inspiration_id);
+            }
+            else {
+                patch(null, "⚠️ I couldn't tell whether to generate a new video or replicate a URL — try rephrasing.");
+                return;
+            }
+            const templateId = inspiration?.template_id;
+            const inspirationId = inspiration?.inspiration_id;
+            if (!templateId || !inspirationId)
+                throw new Error("the template wasn't created from the video.");
+            patch(mode === "replicate" ? "Recreating the scenes… (about a minute)" : "Analyzing into an editable timeline…");
+            const decRes = await fetch(new URL(`/api/v1/inspirations/${encodeURIComponent(inspirationId)}/decompose`, origin), {
+                method: "POST",
+                headers: jsonHeaders,
+                body: JSON.stringify({ user_prompt: userPrompt })
+            });
+            if (!decRes.ok) {
+                const dec = await readJson(decRes);
+                throw new Error(dec?.error || `scene analysis failed (${decRes.status})`);
+            }
+            patch("Finalizing your editable copy…");
+            const forkRes = await fetch(new URL("/api/v1/compositions", origin), { method: "POST", headers: jsonHeaders, body: JSON.stringify({ template_id: templateId }) });
+            const fork = await readJson(forkRes);
+            if (!forkRes.ok)
+                throw new Error(fork?.error || `couldn't create an editable copy (${forkRes.status})`);
+            const forkId = fork?.fork_id;
+            const editorUrl = `${origin}/editor/${encodeURIComponent(templateId)}${forkId ? `?fork=${encodeURIComponent(forkId)}` : ""}`;
+            patch("Your video is ready.", `✅ Your video is ready — [Open it in the editor](${editorUrl}).`);
+        }
+        catch (error) {
+            patch(null, `⚠️ I couldn't finish creating the video: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     async function handleSend() {
         if (!canSend) {
             return;
@@ -3661,6 +3868,11 @@ export function TemplateEditorChat({ boot }) {
                 onToolResult: (toolResult) => {
                     const sanitizedToolResult = sanitizeToolResult(toolResult.result);
                     const pendingCall = pendingToolCalls.get(toolResult.toolCallId);
+                    if (toolResult.toolName === "create_video") {
+                        // Fire-and-forget: run the ingest→decompose→fork pipeline in the
+                        // browser, streaming progress into this assistant message.
+                        void runCreateVideoFlow(threadId, assistantMessage.id, toolResult.result);
+                    }
                     if (toolResult.toolName === "frontend_action") {
                         const actionResult = toolResult.result;
                         if (actionResult?.action === "add_tracer") {

package/dist/src/services/hyperframes.js

@@ -1671,6 +1671,27 @@ async function callOpenAIVision(input) {
             image_url: { url: `data:image/jpeg;base64,${frame.data}` }
         });
     }
+    // OpenRouter proxies many models and still accepts the classic Chat
+    // Completions params. Native OpenAI's current models (gpt-5.x / o-series)
+    // rejected `max_tokens` (they require `max_completion_tokens`) and only allow
+    // the default temperature, so sending `max_tokens`/`temperature:0.15` 400s
+    // every call. Branch the body by endpoint.
+    const isOpenRouter = Boolean(input.endpoint && input.endpoint.includes("openrouter"));
+    // Give the JSON response room to breathe so a video with 12+ text overlays
+    // doesn't get truncated (same rationale as Gemini's maxOutputTokens).
+    const OUTPUT_TOKEN_BUDGET = 16384;
+    const body = {
+        model: input.model,
+        response_format: { type: "json_object" },
+        messages: [{ role: "user", content }]
+    };
+    if (isOpenRouter) {
+        body.temperature = 0.15;
+        body.max_tokens = OUTPUT_TOKEN_BUDGET;
+    }
+    else {
+        body.max_completion_tokens = OUTPUT_TOKEN_BUDGET;
+    }
     const response = await fetch(input.endpoint ?? "https://api.openai.com/v1/chat/completions", {
         method: "POST",
         headers: {
@@ -1678,15 +1699,7 @@ async function callOpenAIVision(input) {
             "authorization": `Bearer ${input.apiKey}`,
             ...(input.extraHeaders ?? {})
         },
-        body: JSON.stringify({
-            model: input.model,
-            temperature: 0.15,
-            // Same rationale as Gemini's maxOutputTokens: give the JSON response room
-            // to breathe so a video with 12+ text overlays doesn't get truncated.
-            max_tokens: 16384,
-            response_format: { type: "json_object" },
-            messages: [{ role: "user", content }]
-        })
+        body: JSON.stringify(body)
     });
     const raw = await response.text();
     if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mevdragon/vidfarm-devcli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Local bridge for the Vidfarm Trackpad Editor. `vidfarm serve <template_id>` boots the FULL editor on localhost (disk-backed records/storage, free in-process render); edit composition.html on disk (Claude Code, Codex, etc.) and the browser live-morphs it.",
   "type": "module",
   "bin": {