@officexapp/vidfarm-devcli 0.21.45 → 0.21.47

package/dist/src/devcli/qa-check.js

@@ -153,6 +153,15 @@ const SLOP_CLASS_PREFIXES = [
 // ("buy now" is a legitimate social line) — this list only escalates a finding
 // when the text also sits inside a button shape.
 const ACTION_COPY = /\b(sign\s?up|get\s?started|learn\s?more|book\s+a\s+(call|demo)|start\s+(your\s+)?free\s+trial|free\s+trial|try\s+(it\s+)?free|click\s+here|subscribe\s+now|shop\s+now|order\s+now|contact\s+us|join\s+now|download\s+now|register\s+now|read\s+more|see\s+plans|view\s+pricing)\b/i;
+// The BRANDED imperative — "TRY DISHCOVERY NOW", "GET ACME FREE", "START YOUR
+// PLAN TODAY". The stock phrases above miss it because the product name sits in
+// the middle, yet it is the exact copy that lands inside a web CTA capsule.
+// Anchored to the whole run and capped in length so a narrative caption line
+// ("we tried three of them today") can never match.
+const BRANDED_CTA_COPY = /^\s*(try|get|start|join|claim|grab|book|order|shop|download|install|discover|explore|unlock|switch)\b[\w\s'&.-]{0,28}\b(now|today|free|here|instantly)\s*[→›»>!.]*\s*$/i;
+function isActionCopy(text) {
+    return ACTION_COPY.test(text) || BRANDED_CTA_COPY.test(text);
+}
 // The stock trust-badge phrases that show up in benefit chip rows.
 const BENEFIT_COPY = /(no\s+credit\s+card|money[-\s]?back|cancel\s+any\s?time|24\/7|free\s+shipping|verified|guarantee|no\s+commitment|risk[-\s]?free)/i;
 // Entrance transitions that leave frame 0 as a flat solid — the worst possible
@@ -394,7 +403,7 @@ export function qaCompositionHtml(html) {
     // "BUY NOW" as a bare caption is legitimate social copy and must not fire.
     for (const node of all) {
         const text = textOf(node);
-        if (!text || text.length > 60 || !ACTION_COPY.test(text))
+        if (!text || text.length > 60 || !isActionCopy(text))
             continue;
         const style = styleString(node);
         const radius = radiusPx(style);
@@ -514,6 +523,85 @@ export function qaCompositionHtml(html) {
             });
         }
     }
+    // ── Rule: layout template — the frame composed like a PAGE ─────────────────
+    // The web hero / modal body: a headline, a support line, and a call to action
+    // stacked inside one centred well. `card-panel` needs a border or a shadow and
+    // `cta-button` needs a capsule, so the FLAT version of the same thing — drop
+    // the box, keep the stack — passed both while still reading as a screenshot of
+    // a landing page. The stack itself is the tell, with or without the box.
+    const layoutFired = new Set();
+    for (const node of all) {
+        if (isMockSocialUi(node) || isAnimatedCaptionPart(node))
+            continue;
+        // Report the OUTERMOST offender only — a hero inside a card would otherwise
+        // fire once per nesting level and bury the real finding.
+        if (selfAndAncestors(node).slice(1).some((a) => layoutFired.has(a)))
+            continue;
+        const kids = Array.from(node.children ?? []).filter((c) => textOf(c).trim().length > 0);
+        if (kids.length < 3)
+            continue;
+        // Three stacked lines are a legitimate title card. Three stacked lines whose
+        // last job is to be CLICKED are a page layout — that is the whole difference.
+        const ctaKid = kids.find((c) => {
+            const t = textOf(c).trim();
+            return t.length <= 60 && isActionCopy(t);
+        });
+        if (!ctaKid)
+            continue;
+        layoutFired.add(node);
+        push({
+            rule: "layout-template",
+            severity: "error",
+            message: `Page layout: ${kids.length} stacked text blocks ending in a call to action ("${textOf(ctaKid).trim().slice(0, 32)}") — headline + subheading + CTA is a web hero/modal, not a video frame.`,
+            where: label(node, "layout"),
+            fix: "Unstack it. Pick the ONE line that carries this beat, set it on the footage in the font regime, and let the next beat carry the next line. A CTA is spoken or a bare caption — never a block in a centred well."
+        });
+    }
+    // ── Rule: modal scrim — a dimmed AND blurred backdrop ──────────────────────
+    // The website-modal frame: the page behind goes dark and out of focus so a
+    // centred box can pop forward. Blur ALONE is legitimate (the blurred fill
+    // behind a 16:9 clip inside a 9:16 frame is a real technique), so this needs
+    // blur AND deliberate dimming — a pair that exists only to push the picture
+    // backwards and make a foreground panel read as "on top of the page".
+    const pctOf = (style, prop) => {
+        const match = style.match(new RegExp(`(?:^|;)\\s*${prop}\\s*:\\s*(-?[\\d.]+)%`));
+        return match ? Number(match[1]) : null;
+    };
+    const isFullFrame = (node) => {
+        const style = styleString(node);
+        if (/(?:^|;)\s*inset\s*:\s*0/.test(style))
+            return true;
+        return (pctOf(style, "width") ?? 0) >= 90 && (pctOf(style, "height") ?? 0) >= 90;
+    };
+    // A dark translucent wash covering the frame — rgba with dark channels and a
+    // partial alpha. This is the "scrim" half of the modal look.
+    const DIM_FILL = /rgba\(\s*\d{1,2}\s*,\s*\d{1,2}\s*,\s*\d{1,2}\s*,\s*0?\.[1-9]/;
+    const hasDimScrim = all.some((node) => isFullFrame(node) && DIM_FILL.test(styleString(node)));
+    for (const node of all) {
+        const style = styleString(node);
+        if (!/(?:^|;)\s*filter\s*:\s*[^;]*blur\(\s*(?!0(?:px)?\s*\))/.test(style))
+            continue;
+        if (!isFullFrame(node))
+            continue;
+        const opacity = Number((style.match(/(?:^|;)\s*opacity\s*:\s*([\d.]+)/) ?? [])[1]);
+        // A backdrop faded almost to nothing is an AMBIENT TEXTURE BED, not a scrim:
+        // you can't read the picture through it, so it isn't staging anything "on
+        // top of the page" — it's just colour behind the frame. Legitimate design.
+        if (Number.isFinite(opacity) && opacity < 0.25)
+            continue;
+        const selfDimmed = (Number.isFinite(opacity) && opacity < 0.95) ||
+            /filter\s*:\s*[^;]*brightness\(\s*0?\.\d/.test(style);
+        if (!selfDimmed && !hasDimScrim)
+            continue;
+        push({
+            rule: "modal-scrim",
+            severity: "error",
+            message: "Backdrop is blurred AND dimmed — that is a web modal scrim, staged so a foreground panel pops off the page.",
+            where: label(node, "backdrop"),
+            fix: "Let the footage be the frame: full-bleed and in focus, with the words set directly on it. If one caption needs legibility, use an outline or a tight band on THAT text — never a full-frame wash to stage a floating block."
+        });
+        break;
+    }
     // ── Rule: gradient text fill ───────────────────────────────────────────────
     if (/background-clip\s*:\s*text|-webkit-background-clip\s*:\s*text/i.test(html)) {
         push({

package/dist/src/devcli/shared-folder.js

@@ -0,0 +1,387 @@
+// `vidfarm shared` — the VISITOR side of a directory share link.
+//
+// A share link (`https://vidfarm.cc/directory/preview/dsh_…/files/<folder>`) is
+// the only vidfarm surface that needs NO account and NO API key. A gigworker or
+// their AI agent gets the link in a task brief and works the folder straight
+// from the terminal: browse it, search it by meaning, make a subfolder for their
+// own proof of work, upload deliverables, download reference footage.
+//
+// The owner mints the link with `vidfarm directory share <path> --mode …`
+// (paid). Everything in this module is free and anonymous.
+//
+// Routes used (all public, token-scoped):
+//   GET  /api/v1/share/:token/directory?path=…      browse
+//   POST /api/v1/share/:token/directory/search      vector search (read mode too)
+//   POST /api/v1/share/:token/directory/folders     make a subfolder (upload/edit)
+//   POST /api/v1/share/:token/attachments/presign   ─┐ big-file upload: the
+//   PUT  <presigned storage url>                     │ multipart route below
+//   POST /api/v1/share/:token/attachments/finalize  ─┘ caps at ~6 MB
+//   POST /api/v1/share/:token/attachments/upload    multipart fallback
+//
+// Uploads ALWAYS try presign → PUT → finalize first. The multipart route goes
+// through the API Lambda, whose request body caps at about 6 MB, so a 40 MB clip
+// answers 413 before the handler runs.
+import { existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { parseArgs } from "node:util";
+const DEFAULT_HOST = process.env.VIDFARM_HOST?.trim() || "https://vidfarm.cc";
+const BOLD = "\x1b[1m";
+const DIM = "\x1b[2m";
+const GREEN = "\x1b[32m";
+const RESET = "\x1b[0m";
+export const SHARED_HELP = `vidfarm shared — use a folder someone shared with you (no account, no API key)
+
+  shared info <link>               What the link is: folder, mode, what you may do
+  shared ls <link> [subfolder]     Browse the shared folder                      → GET  /api/v1/share/:token/directory
+    --limit <n> --offset <n> --json
+  shared search <link> "<query>"   Find files by MEANING inside the share        → POST /api/v1/share/:token/directory/search
+    --subfolder <name> --limit <n> --json
+  shared mkdir <link> <subfolder>  Make a subfolder (upload/edit links only)     → POST /api/v1/share/:token/directory/folders
+  shared put <link> <file…>        Upload files into the share (upload/edit)     → presign → PUT → finalize
+    --subfolder <name>             Land them in a subfolder of the shared folder
+    --json
+  shared get <link> <file-name>    Download one file out of the share
+    --subfolder <name>             Look inside a subfolder
+    --out <dir|file>               Where to write it (default: this folder)
+    --all                          Download every file in the folder instead
+
+  <link> is the URL you were given, or just the dsh_… token (then --host <url>).
+
+  e.g. vidfarm shared info https://vidfarm.cc/directory/preview/dsh_abc/files/project1
+       vidfarm shared mkdir <link> yvette-batch-01
+       vidfarm shared put <link> clip-01.mp4 clip-02.mp4 --subfolder yvette-batch-01
+       vidfarm shared search <link> "founder talking head, no captions"
+       vidfarm shared get <link> brief.md --out ./work
+
+  Modes: read = browse + search · upload = + add files and subfolders (never delete)
+         edit = + rename and delete. Only /files and /temp shares accept uploads.`;
+// Accepts a preview URL, an API URL, or a bare token. The trailing path of a
+// preview URL is kept as the default subfolder so a task brief can point at the
+// exact folder the worker should use.
+export function parseSharedLink(raw, hostOverride) {
+    const value = (raw || "").trim();
+    if (!value)
+        throw new Error("A share link (or dsh_… token) is required.");
+    if (!/^https?:\/\//i.test(value)) {
+        if (!/^dsh_[A-Za-z0-9_-]+$/.test(value)) {
+            throw new Error(`Not a share link or token: ${value}`);
+        }
+        return { host: (hostOverride || DEFAULT_HOST).replace(/\/+$/, ""), token: value, subPath: "" };
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`Not a valid share link: ${value}`);
+    }
+    const segments = url.pathname.split("/").filter(Boolean);
+    const tokenIndex = segments.findIndex((s) => /^dsh_[A-Za-z0-9_-]+$/.test(s));
+    if (tokenIndex < 0)
+        throw new Error(`That URL has no dsh_… share token in it: ${value}`);
+    return {
+        host: (hostOverride || url.origin).replace(/\/+$/, ""),
+        token: segments[tokenIndex],
+        // Everything after the token is /<root>/<folder…> — the share's own path.
+        subPath: segments.slice(tokenIndex + 1).join("/")
+    };
+}
+function apiBase(link) {
+    return `${link.host}/api/v1/share/${link.token}`;
+}
+async function readJson(response) {
+    const text = await response.text();
+    try {
+        return text ? JSON.parse(text) : {};
+    }
+    catch {
+        return { error: text.slice(0, 300) };
+    }
+}
+function fail(action, status, body) {
+    const message = typeof body?.error === "string" ? body.error : `HTTP ${status}`;
+    throw new Error(`${action} failed: ${message}`);
+}
+async function shareGet(link, route, query) {
+    const url = new URL(apiBase(link) + route);
+    for (const [key, value] of Object.entries(query ?? {})) {
+        if (value != null && value !== "")
+            url.searchParams.set(key, value);
+    }
+    const response = await fetch(url, { headers: { accept: "application/json" } });
+    const body = await readJson(response);
+    if (!response.ok)
+        fail(`share ${route}`, response.status, body);
+    return body;
+}
+async function sharePost(link, route, payload) {
+    const response = await fetch(apiBase(link) + route, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(payload)
+    });
+    const body = await readJson(response);
+    if (!response.ok)
+        fail(`share ${route}`, response.status, body);
+    return body;
+}
+// The path a command works on: the link's own folder, plus an optional
+// --subfolder. Never an absolute path — a token cannot leave its own subtree.
+function targetPath(link, basePath, subfolder) {
+    const base = basePath || (link.subPath ? "/" + link.subPath : "");
+    const sub = (subfolder || "").replace(/^\/+|\/+$/g, "");
+    if (!sub)
+        return base;
+    return `${base.replace(/\/+$/, "")}/${sub}`;
+}
+async function loadShare(link, subfolder) {
+    // The first listing tells us the share's canonical base path and mode.
+    const probe = await shareGet(link, "/directory", { path: link.subPath ? "/" + link.subPath : undefined });
+    const basePath = probe.share?.base_path || probe.path || "";
+    const wanted = targetPath(link, basePath, subfolder);
+    if (wanted === probe.path)
+        return { listing: probe, basePath, path: probe.path };
+    const listing = await shareGet(link, "/directory", { path: wanted });
+    return { listing, basePath, path: wanted };
+}
+// ── commands ─────────────────────────────────────────────────────────────────
+function options() {
+    return {
+        host: { type: "string" },
+        json: { type: "boolean" },
+        subfolder: { type: "string" },
+        folder: { type: "string" },
+        out: { type: "string" },
+        limit: { type: "string" },
+        offset: { type: "string" },
+        all: { type: "boolean" }
+    };
+}
+function modeVerbs(mode) {
+    if (mode === "edit")
+        return "browse · search · upload · make folders · rename · delete";
+    if (mode === "upload")
+        return "browse · search · upload · make folders (no delete)";
+    return "browse · search (read only)";
+}
+async function runInfo(argv) {
+    const parsed = parseArgs({ args: argv, allowPositionals: true, options: options() });
+    const link = parseSharedLink(parsed.positionals[0], parsed.values.host);
+    const { listing, basePath } = await loadShare(link);
+    if (parsed.values.json) {
+        console.log(JSON.stringify({ token: link.token, host: link.host, base_path: basePath, share: listing.share }, null, 2));
+        return;
+    }
+    const mode = listing.share?.mode ?? "read";
+    console.log(`${BOLD}${listing.share?.label || "Shared folder"}${RESET}  ${DIM}${link.token}${RESET}`);
+    console.log(`  folder : ${basePath}`);
+    console.log(`  mode   : ${mode} ${DIM}(${modeVerbs(mode)})${RESET}`);
+    console.log(`  files  : ${(listing.files ?? []).length}   folders: ${(listing.folders ?? []).length}`);
+    if (mode !== "read") {
+        console.log(`  ${DIM}Make your own subfolder first: vidfarm shared mkdir <link> <your-name>${RESET}`);
+    }
+}
+async function runLs(argv) {
+    const parsed = parseArgs({ args: argv, allowPositionals: true, options: options() });
+    const link = parseSharedLink(parsed.positionals[0], parsed.values.host);
+    const subfolder = parsed.values.subfolder ?? parsed.positionals[1];
+    const { listing, path: shownPath } = await loadShare(link, subfolder);
+    if (parsed.values.json) {
+        console.log(JSON.stringify(listing, null, 2));
+        return;
+    }
+    console.log(`${BOLD}${shownPath}${RESET} ${DIM}(${listing.share?.mode ?? "read"} link)${RESET}`);
+    for (const folder of listing.folders ?? [])
+        console.log(`  ${BOLD}${folder.name}/${RESET}`);
+    for (const file of listing.files ?? []) {
+        const size = typeof file.sizeBytes === "number" ? `${(file.sizeBytes / (1024 * 1024)).toFixed(1)} MB` : "";
+        console.log(`  ${file.name}  ${DIM}${size}${RESET}`);
+    }
+    if (!(listing.folders ?? []).length && !(listing.files ?? []).length)
+        console.log(`  ${DIM}empty${RESET}`);
+}
+async function runSearch(argv) {
+    const parsed = parseArgs({ args: argv, allowPositionals: true, options: options() });
+    const link = parseSharedLink(parsed.positionals[0], parsed.values.host);
+    const query = parsed.positionals.slice(1).join(" ").trim();
+    if (!query)
+        throw new Error('shared search needs a query: vidfarm shared search <link> "founder talking head"');
+    const { basePath } = await loadShare(link);
+    const scope = targetPath(link, basePath, parsed.values.subfolder);
+    const limit = parsed.values.limit != null ? Number(parsed.values.limit) : undefined;
+    const body = await sharePost(link, "/directory/search", {
+        query,
+        path: scope,
+        ...(limit != null && Number.isFinite(limit) ? { limit } : {})
+    });
+    if (parsed.values.json) {
+        console.log(JSON.stringify(body, null, 2));
+        return;
+    }
+    const results = body.results ?? body.items ?? [];
+    if (!results.length) {
+        console.log(`${DIM}No matches in ${scope}.${RESET}`);
+        return;
+    }
+    for (const hit of results) {
+        console.log(`  ${hit.name ?? hit.path}  ${DIM}${hit.path ?? ""}${RESET}`);
+    }
+}
+async function runMkdir(argv) {
+    const parsed = parseArgs({ args: argv, allowPositionals: true, options: options() });
+    const link = parseSharedLink(parsed.positionals[0], parsed.values.host);
+    const name = parsed.positionals[1] ?? parsed.values.subfolder;
+    if (!name)
+        throw new Error("shared mkdir needs a folder name: vidfarm shared mkdir <link> <subfolder>");
+    const { basePath } = await loadShare(link);
+    const body = await sharePost(link, "/directory/folders", { path: targetPath(link, basePath, name) });
+    if (parsed.values.json) {
+        console.log(JSON.stringify(body, null, 2));
+        return;
+    }
+    console.log(`${GREEN}✓${RESET} Created ${BOLD}${body.path ?? name}${RESET}`);
+}
+// Upload one file: presign → PUT the bytes straight to storage → finalize. Falls
+// back to the multipart route when the server has no presigned transport.
+async function uploadOne(link, filePath, folderPath) {
+    if (!existsSync(filePath))
+        throw new Error(`No such file: ${filePath}`);
+    const stats = statSync(filePath);
+    const fileName = path.basename(filePath);
+    // A server that predates the presign route just 404s — fall back to multipart
+    // (which still works for anything under ~6 MB). Any OTHER refusal is a real
+    // answer (unsupported type, over the size cap, read-only link) and must
+    // surface: retrying it as multipart only turns a clear 400 into a 502.
+    const presign = await sharePost(link, "/attachments/presign", {
+        file_name: fileName,
+        size_bytes: stats.size,
+        folder_path: folderPath
+    }).catch((error) => {
+        if (/HTTP 404/.test(error.message))
+            return { transport: "server" };
+        throw error;
+    });
+    const bytes = await readFileBytes(filePath);
+    // One ArrayBuffer view keeps both transports happy (fetch body / Blob part).
+    const payload = new Uint8Array(bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
+    if (presign.transport !== "presigned" || !presign.upload?.url) {
+        const form = new FormData();
+        form.append("file", new Blob([payload]), fileName);
+        form.append("folder_path", folderPath);
+        const response = await fetch(apiBase(link) + "/attachments/upload", { method: "POST", body: form });
+        const multipartBody = await readJson(response);
+        if (!response.ok)
+            fail(`upload ${fileName}`, response.status, multipartBody);
+        return multipartBody.attachment ?? multipartBody.file ?? multipartBody;
+    }
+    const put = await fetch(presign.upload.url, {
+        method: presign.upload.method || "PUT",
+        headers: presign.upload.headers || {},
+        body: payload
+    });
+    if (!put.ok)
+        throw new Error(`upload ${fileName} failed: storage answered HTTP ${put.status}`);
+    const saved = await sharePost(link, "/attachments/finalize", {
+        file_id: presign.file_id,
+        file_name: presign.file_name,
+        content_type: presign.content_type,
+        size_bytes: stats.size,
+        storage_key: presign.storage_key,
+        folder_path: presign.folder_path
+    });
+    return saved.attachment ?? saved.file ?? saved;
+}
+async function readFileBytes(filePath) {
+    const { readFile } = await import("node:fs/promises");
+    return readFile(filePath);
+}
+async function runPut(argv) {
+    const parsed = parseArgs({ args: argv, allowPositionals: true, options: options() });
+    const link = parseSharedLink(parsed.positionals[0], parsed.values.host);
+    const files = parsed.positionals.slice(1);
+    if (!files.length)
+        throw new Error("shared put needs at least one file: vidfarm shared put <link> clip.mp4 [--subfolder batch-01]");
+    const subfolder = parsed.values.subfolder ?? parsed.values.folder;
+    const { listing, basePath } = await loadShare(link);
+    const mode = listing.share?.mode ?? "read";
+    if (mode === "read")
+        throw new Error("This share link is read-only — ask the owner for an upload link.");
+    // The API wants the folder RELATIVE to the root (no /files prefix).
+    const wanted = targetPath(link, basePath, subfolder);
+    const folderPath = wanted.replace(/^\/(files|temp|raws|approved|projects)\/?/, "");
+    const saved = [];
+    for (const file of files) {
+        const record = await uploadOne(link, file, folderPath);
+        saved.push(record);
+        if (!parsed.values.json)
+            console.log(`${GREEN}✓${RESET} ${path.basename(file)} → ${BOLD}${wanted}${RESET}`);
+    }
+    if (parsed.values.json)
+        console.log(JSON.stringify({ ok: true, uploaded: saved }, null, 2));
+}
+async function downloadTo(url, outPath) {
+    const response = await fetch(url);
+    if (!response.ok)
+        throw new Error(`download failed: HTTP ${response.status}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    mkdirSync(path.dirname(outPath), { recursive: true });
+    writeFileSync(outPath, bytes);
+}
+async function runGet(argv) {
+    const parsed = parseArgs({ args: argv, allowPositionals: true, options: options() });
+    const link = parseSharedLink(parsed.positionals[0], parsed.values.host);
+    const wantedName = parsed.positionals[1];
+    const { listing, path: shownPath } = await loadShare(link, parsed.values.subfolder);
+    const files = listing.files ?? [];
+    const out = parsed.values.out || ".";
+    if (parsed.values.all || !wantedName) {
+        if (!parsed.values.all)
+            throw new Error("shared get needs a file name, or --all to take the whole folder.");
+        for (const file of files) {
+            if (!file.viewUrl)
+                continue;
+            const dest = path.join(out, file.name);
+            await downloadTo(file.viewUrl, dest);
+            console.log(`${GREEN}✓${RESET} ${dest}`);
+        }
+        console.log(`${DIM}${files.length} file(s) from ${shownPath}${RESET}`);
+        return;
+    }
+    const match = files.find((f) => f.name === wantedName) || files.find((f) => String(f.name).includes(wantedName));
+    if (!match)
+        throw new Error(`No file named "${wantedName}" in ${shownPath}.`);
+    if (!match.viewUrl)
+        throw new Error(`"${match.name}" has no downloadable URL.`);
+    const dest = /\.[A-Za-z0-9]+$/.test(out) ? out : path.join(out, match.name);
+    await downloadTo(match.viewUrl, dest);
+    console.log(`${GREEN}✓${RESET} ${dest}`);
+}
+export async function runSharedCommand(argv) {
+    const sub = argv[0];
+    const rest = argv.slice(1);
+    switch (sub) {
+        case "info":
+        case "about": return runInfo(rest);
+        case "ls":
+        case "list": return runLs(rest);
+        case "search":
+        case "find": return runSearch(rest);
+        case "mkdir":
+        case "folder": return runMkdir(rest);
+        case "put":
+        case "upload": return runPut(rest);
+        case "get":
+        case "download": return runGet(rest);
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            console.log(SHARED_HELP);
+            return;
+        default:
+            console.error(`Unknown shared subcommand: ${sub}\n`);
+            console.log(SHARED_HELP);
+            process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=shared-folder.js.map

package/dist/src/devcli/stills.js

@@ -23,6 +23,7 @@ import os from "node:os";
 import path from "node:path";
 import { parseHTML } from "linkedom";
 import { resolveFfmpeg } from "../services/clip-curation/ffmpeg.js";
+import { resolveBundledFfprobe } from "../lib/ffprobe-path.js";
 import { inspectComposition } from "./composition-edit.js";
 const MAX_DEFAULT_STILLS = 8;
 const MAX_GRID_FRAMES = 600;
@@ -41,14 +42,9 @@ async function ensureProducerFfmpegEnv() {
         catch { /* PATH fallback */ }
     }
     if (!process.env.HYPERFRAMES_FFPROBE_PATH?.trim()) {
-        try {
-            const mod = (await import("ffprobe-static"));
-            const resolved = (mod.path ?? mod.default?.path);
-            if (typeof resolved === "string" && resolved && existsSync(resolved)) {
-                process.env.HYPERFRAMES_FFPROBE_PATH = resolved;
-            }
-        }
-        catch { /* PATH fallback */ }
+        const resolved = resolveBundledFfprobe();
+        if (resolved)
+            process.env.HYPERFRAMES_FFPROBE_PATH = resolved;
     }
 }
 /**

package/dist/src/lib/ffprobe-path.js

@@ -0,0 +1,64 @@
+// Single source of truth for the bundled ffprobe binary path.
+//
+// Why this module exists: the previous dependency, `ffprobe-static@3`, ships
+// binaries for EVERY platform in one tarball (335 MB unpacked — darwin 132 MB +
+// linux 99 MB + win32 104 MB). Every `npm i -g @officexapp/vidfarm-devcli` paid
+// for all three. On Windows that cost is multiplied again by Defender scanning
+// each extracted file, which is the single biggest first-run setup delay users
+// report. `@ffprobe-installer/ffprobe` declares one optional dependency per
+// platform, so npm installs ONLY the matching binary (~17 MB).
+//
+// Resolution order (same shape as resolveFfmpeg in services/clip-curation):
+//   1. HYPERFRAMES_FFPROBE_PATH / FFPROBE_PATH env override
+//   2. @ffprobe-installer/ffprobe  (per-platform, the bundled default)
+//   3. ffprobe-static              (legacy; only if something still installs it)
+//   4. null → the caller falls back to a bare `ffprobe` on PATH
+//
+// Windows-on-ARM note: neither ffprobe-installer nor ffmpeg-static publishes a
+// win32-arm64 build, so steps 2/3 return null there and PATH is the only route.
+// That is not a regression — ffmpeg-static already had the same gap.
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+const requireFrom = createRequire(import.meta.url);
+let cached;
+/** Pull `.path` off whichever module shape the installer package exports. */
+function readPath(mod) {
+    if (typeof mod === "string")
+        return mod;
+    if (mod && typeof mod === "object") {
+        const direct = mod.path;
+        if (typeof direct === "string" && direct)
+            return direct;
+        const viaDefault = mod.default?.path;
+        if (typeof viaDefault === "string" && viaDefault)
+            return viaDefault;
+    }
+    return null;
+}
+/**
+ * Absolute path to a bundled ffprobe, or null when none is installed for this
+ * platform. Cached — resolution is a require() plus a stat.
+ */
+export function resolveBundledFfprobe() {
+    if (cached !== undefined)
+        return cached;
+    const envPath = process.env.HYPERFRAMES_FFPROBE_PATH?.trim() || process.env.FFPROBE_PATH?.trim();
+    if (envPath && existsSync(envPath))
+        return (cached = envPath);
+    for (const pkg of ["@ffprobe-installer/ffprobe", "ffprobe-static"]) {
+        try {
+            const resolved = readPath(requireFrom(pkg));
+            if (resolved && existsSync(resolved))
+                return (cached = resolved);
+        }
+        catch {
+            // not installed for this platform — try the next candidate
+        }
+    }
+    return (cached = null);
+}
+/** Same as resolveBundledFfprobe, but falls back to a bare `ffprobe` on PATH. */
+export function resolveFfprobeCommand() {
+    return resolveBundledFfprobe() ?? "ffprobe";
+}
+//# sourceMappingURL=ffprobe-path.js.map

package/dist/src/lib/render-media-prep.js

@@ -32,6 +32,7 @@ import path from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { parseHTML } from "linkedom";
+import { resolveFfprobeCommand } from "./ffprobe-path.js";
 // Trailing pad added to every cut so the renderer never runs out of media on
 // the final frame of a clip (frame quantization + audio priming).
 const SEGMENT_PAD_SECONDS = 0.5;
@@ -71,17 +72,7 @@ async function resolveFfmpegPath() {
     return "ffmpeg";
 }
 async function resolveFfprobePath() {
-    const env = process.env.HYPERFRAMES_FFPROBE_PATH?.trim();
-    if (env && existsSync(env))
-        return env;
-    try {
-        const mod = (await import("ffprobe-static"));
-        const resolved = (mod.path ?? mod.default?.path);
-        if (typeof resolved === "string" && resolved && existsSync(resolved))
-            return resolved;
-    }
-    catch { /* PATH fallback */ }
-    return "ffprobe";
+    return resolveFfprobeCommand();
 }
 function runCommand(bin, args, timeoutMs) {
     return new Promise((resolve, reject) => {

package/dist/src/services/clip-curation/ffmpeg.js

@@ -2,10 +2,11 @@
 // thumbnail extraction, per-scene audio for ASR. Same flags on devcli (local
 // ffmpeg-static) and cloud (bundled ffmpeg-static in the scan Lambda), so both
 // targets cut identical clips. Resolution order matches the rest of the repo:
-// HYPERFRAMES_FFMPEG_PATH/FFPROBE env → ffmpeg-static/ffprobe-static → PATH.
+// HYPERFRAMES_FFMPEG_PATH/FFPROBE env → ffmpeg-static/@ffprobe-installer → PATH.
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync } from "node:fs";
 import path from "node:path";
+import { resolveBundledFfprobe } from "../../lib/ffprobe-path.js";
 let cachedFfmpeg;
 let cachedFfprobe;
 export async function resolveFfmpeg() {
@@ -29,20 +30,8 @@ export async function resolveFfmpeg() {
 export async function resolveFfprobe() {
     if (cachedFfprobe !== undefined)
         return cachedFfprobe ?? "ffprobe";
-    const envPath = process.env.HYPERFRAMES_FFPROBE_PATH?.trim() ?? process.env.FFPROBE_PATH?.trim();
-    if (envPath && existsSync(envPath))
-        return (cachedFfprobe = envPath);
-    try {
-        const mod = (await import("ffprobe-static"));
-        const p = (mod.path ?? mod.default?.path);
-        if (typeof p === "string" && p && existsSync(p))
-            return (cachedFfprobe = p);
-    }
-    catch {
-        /* fall through to PATH */
-    }
-    cachedFfprobe = null;
-    return "ffprobe";
+    cachedFfprobe = resolveBundledFfprobe();
+    return cachedFfprobe ?? "ffprobe";
 }
 /** True if a usable ffmpeg is available (bundled or on PATH). */
 export async function hasFfmpeg() {

package/dist/src/services/clip-curation/local-agent.js

@@ -16,9 +16,13 @@ export function detectLocalAgent(preferred) {
     const candidates = preferred === "claude" ? ["claude"]
         : preferred === "codex" ? ["codex"]
             : ["claude", "codex"];
+    // Windows has no `which` — the equivalent is `where`, which prints one match
+    // per line (take the first). Without this branch, agent detection always
+    // reported "none installed" on Windows even with Claude Code on PATH.
+    const lookup = process.platform === "win32" ? "where" : "which";
     for (const kind of candidates) {
-        const found = spawnSync("which", [kind], { encoding: "utf8" });
-        const bin = (found.stdout || "").trim();
+        const found = spawnSync(lookup, [kind], { encoding: "utf8", shell: process.platform === "win32" });
+        const bin = (found.stdout || "").split(/\r?\n/)[0]?.trim() ?? "";
         if (found.status === 0 && bin)
             return { kind, bin };
     }