@vosjs/cli 0.74.0 → 0.75.0

package/dist/{chunk-EYF3WJIC.js → chunk-X6NQNBDF.js}

@@ -36,7 +36,7 @@ import {
   uploadDocRefs,
   uploadManifest,
   writeJson
-} from "./chunk-Y5E672GT.js";
+} from "./chunk-M3QIN457.js";
 import {
   CREDENTIALS_PATH,
   MEDIA_HEAD_BYTES,
@@ -133,7 +133,7 @@ function landedLines(l) {
 // src/plugin/run.ts
 import { mkdir as mkdir8, readFile as readFile13, rm as rm2 } from "fs/promises";
 import { existsSync as existsSync23 } from "fs";
-import { join as join25, resolve as resolve13 } from "path";
+import { join as join25, resolve as resolve14 } from "path";
 import {
   END_CARD_FROM as END_CARD_FROM2,
   docOutputDuration as docOutputDuration3,
@@ -2014,7 +2014,7 @@ function mediaProbeLints(results) {
 // src/plugin/framesTake.ts
 import { mkdir as mkdir2, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { join as join3, resolve as resolve3 } from "path";
 import { compileVosConfig } from "@vosjs/core";
 import {
   docStillTime,
@@ -2028,9 +2028,10 @@ import {
 
 // src/plugin/server.ts
 import { createServer } from "http";
-import { existsSync, readFileSync, statSync } from "fs";
+import { randomBytes } from "crypto";
+import { existsSync, readFileSync, realpathSync, statSync } from "fs";
 import { writeFile } from "fs/promises";
-import { extname, join } from "path";
+import { extname, join, resolve, sep } from "path";
 var MIME = {
   ".html": "text/html",
   ".js": "text/javascript",
@@ -2052,9 +2053,46 @@ var MIME = {
   ".m4a": "audio/mp4",
   ".ogg": "audio/ogg"
 };
+var SAVE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var SAVE_NEVER = /* @__PURE__ */ new Set([
+  "doc.json",
+  "actions.json",
+  "vos.json",
+  "meta.json",
+  "cursor.json"
+]);
+function saveNameOk(name) {
+  return SAVE_NAME.test(name) && !name.includes("..") && !SAVE_NEVER.has(name);
+}
+function fileInRoot(rootDir, pathname) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+  const file = resolve(rootDir, `.${decoded}`);
+  if (!existsSync(file) || !statSync(file).isFile()) return null;
+  const root = realpathSync(rootDir);
+  const real = realpathSync(file);
+  return real.startsWith(root + sep) ? real : null;
+}
+function ownReader(req) {
+  const site = req.headers["sec-fetch-site"];
+  return site === void 0 || site === "same-origin" || site === "none";
+}
 function startTakeServer(rootDir, pages) {
+  const token = randomBytes(16).toString("hex");
+  const prefix = `/t/${token}`;
   const server = createServer((req, res) => {
-    const url = new URL(req.url ?? "/", "http://x");
+    const raw = new URL(req.url ?? "/", "http://x");
+    const tokened = raw.pathname === prefix || raw.pathname.startsWith(`${prefix}/`);
+    if (!tokened && req.method !== "OPTIONS" && !ownReader(req)) {
+      res.writeHead(404).end();
+      return;
+    }
+    const url = tokened ? new URL(raw.pathname.slice(prefix.length) || "/", "http://x") : raw;
+    url.search = raw.search;
     res.setHeader("access-control-allow-origin", "*");
     res.setHeader("access-control-allow-private-network", "true");
     if (req.method === "OPTIONS") {
@@ -2067,10 +2105,11 @@ function startTakeServer(rootDir, pages) {
       return;
     }
     if (req.method === "POST" && url.pathname === "/save") {
-      const name = (url.searchParams.get("name") ?? "out.bin").replace(
-        /[^\w.-]/g,
-        ""
-      );
+      const name = url.searchParams.get("name") ?? "out.bin";
+      if (tokened || !ownReader(req) || !saveNameOk(name)) {
+        res.writeHead(404).end();
+        return;
+      }
       const chunks = [];
       req.on("data", (c) => chunks.push(c));
       req.on("end", () => {
@@ -2086,8 +2125,8 @@ function startTakeServer(rootDir, pages) {
       res.end(pages[url.pathname]);
       return;
     }
-    const file = join(rootDir, decodeURIComponent(url.pathname));
-    if (existsSync(file) && statSync(file).isFile()) {
+    const file = fileInRoot(rootDir, url.pathname);
+    if (file) {
       const size = statSync(file).size;
       const buf = readFileSync(file);
       const type = sniffMediaType(buf.subarray(0, MEDIA_HEAD_BYTES)) ?? MIME[extname(file)] ?? "application/octet-stream";
@@ -2120,10 +2159,13 @@ function startTakeServer(rootDir, pages) {
     res.writeHead(404).end();
   });
   return new Promise(
-    (resolve14) => server.listen(0, () => {
+    (done) => server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
       const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolve14({ base: `http://localhost:${port}`, close: () => server.close() });
+      done({
+        base: `http://127.0.0.1:${port}${prefix}`,
+        close: () => server.close()
+      });
     })
   );
 }
@@ -2708,7 +2750,7 @@ function applyAndValidate(doc, o) {
 // src/plugin/digestTake.ts
 import { mkdir, readFile as readFile2, rename, writeFile as writeFile2 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
-import { join as join2, resolve } from "path";
+import { join as join2, resolve as resolve2 } from "path";
 import {
   CHANGE_GRID,
   CHANGE_LEAD,
@@ -2969,7 +3011,7 @@ async function digestTake(browser, dir, opts = {}) {
   const meta = doc.source.meta;
   let plan = planForDigest(doc);
   const transcript = opts.transcript ?? await discoverTranscript(dir);
-  const outDir = resolve(opts.outDir ?? join2(dir, DIGEST_DIR));
+  const outDir = resolve2(opts.outDir ?? join2(dir, DIGEST_DIR));
   await mkdir(outDir, { recursive: true });
   const fullMax = opts.full ?? DIGEST_FULL_MAX;
   const cropMax = opts.crop ?? DIGEST_CROP_MAX;
@@ -3380,7 +3422,7 @@ async function framesTake(browser, dir, opts) {
     throw new Error(
       "no frame times \u2014 pass --times/--frame, --at-zooms, --at-moments or --at-still"
     );
-  const outDir = resolve2(opts.outDir ?? join3(dir, "stills"));
+  const outDir = resolve3(opts.outDir ?? join3(dir, "stills"));
   await mkdir2(outDir, { recursive: true });
   const named = shots.map((s, i) => ({
     ...s,
@@ -3484,7 +3526,7 @@ async function writeIndexJson(result) {
 
 // src/plugin/deliver.ts
 import { mkdir as mkdir3, writeFile as writeFile5 } from "fs/promises";
-import { join as join4, relative, resolve as resolve3 } from "path";
+import { join as join4, relative, resolve as resolve4 } from "path";
 import { existsSync as existsSync4 } from "fs";
 import { readFile as readFile4 } from "fs/promises";
 import { parseFrontmatter } from "@vosjs/shared/frontmatter";
@@ -4062,7 +4104,7 @@ async function deliverTake(browser, dir, opts) {
   const doc = take.doc;
   const duration = docOutputDuration2(doc);
   const videoSeconds = opts.range ? Math.min(opts.range[1], duration) - Math.min(opts.range[0], duration) : duration;
-  const outDir = resolve3(opts.outDir ?? join4(dir, "kit"));
+  const outDir = resolve4(opts.outDir ?? join4(dir, "kit"));
   await mkdir3(outDir, { recursive: true });
   const destinations = opts.channels.flatMap((c) => destinationsForChannel(c));
   const assets = [];
@@ -4156,10 +4198,147 @@ async function deliverTake(browser, dir, opts) {
   return { kit, kitFile, outDir };
 }
 
+// src/plugin/login.ts
+import { hostname } from "os";
+var LoginUnsupportedError = class extends Error {
+  constructor() {
+    super("this origin does not support browser login");
+  }
+};
+var MAX_TRANSIENT_FAILURES = 5;
+var MAX_INTERVAL_MS = 3e4;
+async function launchDefaultBrowser(url) {
+  const { spawn: spawn2 } = await import("child_process");
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn2(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function verifyUrlOk(verifyUrl, origin) {
+  try {
+    return new URL(verifyUrl).origin === new URL(origin).origin;
+  } catch {
+    return false;
+  }
+}
+async function browserLogin(origin, r, opts) {
+  const create = await apiJson(origin, "/api/cli/login", {
+    method: "POST",
+    body: {
+      hostname: hostname().slice(0, 64),
+      ...opts.label ? { label: opts.label.slice(0, 64) } : {}
+    }
+  });
+  if (create.status === 404) throw new LoginUnsupportedError();
+  if (create.status !== 201) throw new Error(apiError("start login", create));
+  const code = create.body.code;
+  const secret = create.body.secret;
+  const verifyUrl = create.body.verifyUrl;
+  const expiresAt = Date.parse(String(create.body.expiresAt ?? ""));
+  const baseIntervalMs = (typeof create.body.interval === "number" ? create.body.interval : 3) * 1e3;
+  if (!code || !secret || !verifyUrl || Number.isNaN(expiresAt)) {
+    throw new Error("start login \u2192 malformed response from the platform");
+  }
+  r.event({ event: "login_await", url: verifyUrl, code, expiresAt });
+  r.log(`Confirm this code in the browser: ${code}`);
+  r.log(`Sign in at ${verifyUrl}`);
+  if (opts.openBrowser && verifyUrlOk(verifyUrl, origin))
+    void launchDefaultBrowser(verifyUrl);
+  r.log("Waiting for approval\u2026 (Ctrl-C to cancel)");
+  const sleep = opts.sleep ?? ((ms) => new Promise((res) => setTimeout(res, ms)));
+  let intervalMs = baseIntervalMs;
+  let failures = 0;
+  let capNoted = false;
+  while (Date.now() < expiresAt) {
+    await sleep(intervalMs);
+    let res;
+    try {
+      res = await apiJson(origin, "/api/cli/login/poll", {
+        method: "POST",
+        body: { secret }
+      });
+      failures = 0;
+    } catch (e) {
+      if (++failures >= MAX_TRANSIENT_FAILURES) {
+        throw new Error(
+          `lost the connection while waiting (${e instanceof Error ? e.message : String(e)}) \u2014 run \`vos login\` again`
+        );
+      }
+      continue;
+    }
+    const status = res.body.status;
+    if (res.status === 200 && status === "pending") {
+      intervalMs = baseIntervalMs;
+      continue;
+    }
+    if (res.status === 200 && status === "ok") {
+      const path = (opts.store ?? writeCredential)(res.body.key);
+      const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
+      return { path, user };
+    }
+    if (res.status === 429) {
+      if (status === "key_limit" && !capNoted) {
+        capNoted = true;
+        r.log(`${res.body.error} \u2014 ${res.body.hint}`);
+      }
+      intervalMs = Math.min(intervalMs * 2, MAX_INTERVAL_MS);
+      continue;
+    }
+    if (res.status === 403 && status === "denied") {
+      throw new Error("the sign-in was denied in the browser");
+    }
+    throw new Error(
+      typeof res.body.error === "string" ? res.body.error : apiError("poll login", res)
+    );
+  }
+  throw new Error(
+    "no approval within 15 minutes \u2014 run `vos login` again, or mint a key at https://vos.so/app/api and pass --key"
+  );
+}
+var HANDOFF_URL = /^(https?:\/\/[^/]+)\/h\/(vos_ho_[A-Za-z0-9_-]+)$/;
+function parseHandoffUrl(url) {
+  const m = HANDOFF_URL.exec(url.trim());
+  return m ? { origin: m[1], token: m[2] } : null;
+}
+async function handoffLogin(url, r, opts = {}) {
+  const parsed = parseHandoffUrl(url);
+  if (!parsed)
+    throw new Error(
+      "--handoff wants the link a person copied from vos.so, https://vos.so/h/vos_ho_\u2026"
+    );
+  r.log(`exchanging the setup link at ${parsed.origin}\u2026`);
+  const res = await apiJson(parsed.origin, "/api/cli/login/exchange", {
+    method: "POST",
+    body: { token: parsed.token, hostname: hostname().slice(0, 64) }
+  });
+  if (res.status === 200 && res.body.status === "ok") {
+    const path = (opts.store ?? writeCredential)(res.body.key);
+    const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
+    return {
+      path,
+      user,
+      keyName: String(res.body.keyName ?? ""),
+      origin: parsed.origin
+    };
+  }
+  if (res.status === 404 && !res.body.status) {
+    throw new Error(
+      `${parsed.origin} does not support setup links yet \u2014 run \`vos login\` instead`
+    );
+  }
+  const said = typeof res.body.error === "string" ? res.body.error : apiError("exchange", res);
+  const hint = typeof res.body.hint === "string" ? ` ${res.body.hint}` : "";
+  throw new Error(`${said}${hint}`);
+}
+
 // src/plugin/markAsset.ts
 import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
-import { isAbsolute, join as join5, resolve as resolve4 } from "path";
+import { isAbsolute, join as join5, resolve as resolve5 } from "path";
 function markExtension(url) {
   const m = /\.(svg|png|webp|jpe?g)(?:[?#]|$)/i.exec(url);
   if (!m) return null;
@@ -4240,7 +4419,7 @@ async function fetchBrandMarks(takeDir, roles) {
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
         bytes = new Uint8Array(await res.arrayBuffer());
       } else {
-        const file = isAbsolute(src) ? src : resolve4(takeDir, src);
+        const file = isAbsolute(src) ? src : resolve5(takeDir, src);
         if (!existsSync5(file)) throw new Error("no such file");
         bytes = new Uint8Array(await readFile5(file));
       }
@@ -5269,10 +5448,10 @@ async function openSession(name, url, opts = { log: () => {
   opts.log(
     `a Chrome window opened on session "${name}": sign in to ${new URL(url).host}, ${leave}`
   );
-  return new Promise((resolve14, reject) => {
+  return new Promise((resolve15, reject) => {
     const child = spawn(exe, args, { stdio: "ignore" });
     child.on("error", reject);
-    child.on("exit", (code) => resolve14({ code }));
+    child.on("exit", (code) => resolve15({ code }));
   });
 }
 async function withSession(name, fn, opts = {}) {
@@ -5989,11 +6168,33 @@ function scriptToWrite(doc, hasLocal) {
   return `${JSON.stringify(script, null, 2)}
 `;
 }
+function publicScript(script) {
+  const setup = script.setup;
+  if (!Array.isArray(setup)) return script;
+  return {
+    ...script,
+    setup: setup.map((step) => {
+      if (!step || typeof step !== "object") return step;
+      const s = step;
+      if (s.do === "type" && typeof s.text === "string")
+        return { ...s, text: "[typed value not stored]" };
+      if (s.do === "goto" && typeof s.url === "string") {
+        try {
+          const u = new URL(s.url);
+          return { ...s, url: `${u.origin}${u.pathname}` };
+        } catch {
+          return s;
+        }
+      }
+      return s;
+    })
+  };
+}
 function embedScript(doc, dir) {
   const path = join11(dir, "actions.json");
   if (!existsSync10(path)) return;
   const script = scriptFromText(readFileSync2(path, "utf8"));
-  if (script) doc.source.script = script;
+  if (script) doc.source.script = publicScript(script);
 }
 async function writeScriptBeside(dir, doc) {
   const path = join11(dir, "actions.json");
@@ -6800,133 +7001,9 @@ import {
 } from "@vosjs/core";
 import { lowerProgramDoc, migrateHostedDoc as migrateHostedDoc3 } from "@vosjs/studio-core";
 
-// src/plugin/login.ts
-import { hostname } from "os";
-var LoginUnsupportedError = class extends Error {
-  constructor() {
-    super("this origin does not support browser login");
-  }
-};
-var MAX_TRANSIENT_FAILURES = 5;
-var MAX_INTERVAL_MS = 3e4;
-async function launchDefaultBrowser(url) {
-  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  const { exec } = await import("child_process");
-  exec(`${opener} ${JSON.stringify(url)}`, () => {
-  });
-}
-async function browserLogin(origin, r, opts) {
-  const create = await apiJson(origin, "/api/cli/login", {
-    method: "POST",
-    body: {
-      hostname: hostname().slice(0, 64),
-      ...opts.label ? { label: opts.label.slice(0, 64) } : {}
-    }
-  });
-  if (create.status === 404) throw new LoginUnsupportedError();
-  if (create.status !== 201) throw new Error(apiError("start login", create));
-  const code = create.body.code;
-  const secret = create.body.secret;
-  const verifyUrl = create.body.verifyUrl;
-  const expiresAt = Date.parse(String(create.body.expiresAt ?? ""));
-  const baseIntervalMs = (typeof create.body.interval === "number" ? create.body.interval : 3) * 1e3;
-  if (!code || !secret || !verifyUrl || Number.isNaN(expiresAt)) {
-    throw new Error("start login \u2192 malformed response from the platform");
-  }
-  r.event({ event: "login_await", url: verifyUrl, code, expiresAt });
-  r.log(`Confirm this code in the browser: ${code}`);
-  r.log(`Sign in at ${verifyUrl}`);
-  if (opts.openBrowser) void launchDefaultBrowser(verifyUrl);
-  r.log("Waiting for approval\u2026 (Ctrl-C to cancel)");
-  const sleep = opts.sleep ?? ((ms) => new Promise((res) => setTimeout(res, ms)));
-  let intervalMs = baseIntervalMs;
-  let failures = 0;
-  let capNoted = false;
-  while (Date.now() < expiresAt) {
-    await sleep(intervalMs);
-    let res;
-    try {
-      res = await apiJson(origin, "/api/cli/login/poll", {
-        method: "POST",
-        body: { secret }
-      });
-      failures = 0;
-    } catch (e) {
-      if (++failures >= MAX_TRANSIENT_FAILURES) {
-        throw new Error(
-          `lost the connection while waiting (${e instanceof Error ? e.message : String(e)}) \u2014 run \`vos login\` again`
-        );
-      }
-      continue;
-    }
-    const status = res.body.status;
-    if (res.status === 200 && status === "pending") {
-      intervalMs = baseIntervalMs;
-      continue;
-    }
-    if (res.status === 200 && status === "ok") {
-      const path = (opts.store ?? writeCredential)(res.body.key);
-      const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
-      return { path, user };
-    }
-    if (res.status === 429) {
-      if (status === "key_limit" && !capNoted) {
-        capNoted = true;
-        r.log(`${res.body.error} \u2014 ${res.body.hint}`);
-      }
-      intervalMs = Math.min(intervalMs * 2, MAX_INTERVAL_MS);
-      continue;
-    }
-    if (res.status === 403 && status === "denied") {
-      throw new Error("the sign-in was denied in the browser");
-    }
-    throw new Error(
-      typeof res.body.error === "string" ? res.body.error : apiError("poll login", res)
-    );
-  }
-  throw new Error(
-    "no approval within 15 minutes \u2014 run `vos login` again, or mint a key at https://vos.so/app/api and pass --key"
-  );
-}
-var HANDOFF_URL = /^(https?:\/\/[^/]+)\/h\/(vos_ho_[A-Za-z0-9_-]+)$/;
-function parseHandoffUrl(url) {
-  const m = HANDOFF_URL.exec(url.trim());
-  return m ? { origin: m[1], token: m[2] } : null;
-}
-async function handoffLogin(url, r, opts = {}) {
-  const parsed = parseHandoffUrl(url);
-  if (!parsed)
-    throw new Error(
-      "--handoff wants the link a person copied from vos.so, https://vos.so/h/vos_ho_\u2026"
-    );
-  r.log(`exchanging the setup link at ${parsed.origin}\u2026`);
-  const res = await apiJson(parsed.origin, "/api/cli/login/exchange", {
-    method: "POST",
-    body: { token: parsed.token, hostname: hostname().slice(0, 64) }
-  });
-  if (res.status === 200 && res.body.status === "ok") {
-    const path = (opts.store ?? writeCredential)(res.body.key);
-    const user = typeof res.body.user === "object" && res.body.user !== null ? res.body.user.name ?? "" : "";
-    return {
-      path,
-      user,
-      keyName: String(res.body.keyName ?? ""),
-      origin: parsed.origin
-    };
-  }
-  if (res.status === 404 && !res.body.status) {
-    throw new Error(
-      `${parsed.origin} does not support setup links yet \u2014 run \`vos login\` instead`
-    );
-  }
-  const said = typeof res.body.error === "string" ? res.body.error : apiError("exchange", res);
-  const hint = typeof res.body.hint === "string" ? ` ${res.body.hint}` : "";
-  throw new Error(`${said}${hint}`);
-}
-
 // src/plugin/programFiles.ts
 import { basename as basename2, extname as extname2, relative as relative2 } from "path";
-import { existsSync as existsSync12, realpathSync } from "fs";
+import { existsSync as existsSync12, realpathSync as realpathSync2 } from "fs";
 function isLocalName(value) {
   if (/^(https?:|data:|blob:|asset:|media:)/.test(value)) return false;
   if (value.startsWith("$")) return false;
@@ -6978,7 +7055,7 @@ function liftNamedFiles(config, dir) {
 }
 function localDataRefs(config, dir) {
   const refs = [];
-  const root = realpathSync(dir);
+  const root = realpathSync2(dir);
   const walk = (value, where, set) => {
     if (typeof value === "string") {
       if (!isLocalName(value) || !FILE_EXT.test(value)) return;
@@ -8493,7 +8570,7 @@ function trackingCwd(vosId) {
 
 // src/plugin/buildProgram.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { basename as basename5, dirname as dirname3, join as join16, resolve as resolve5 } from "path";
+import { basename as basename5, dirname as dirname3, join as join16, resolve as resolve6 } from "path";
 import { pathToFileURL } from "url";
 import { parse } from "acorn";
 import { fullAncestor } from "acorn-walk";
@@ -8693,7 +8770,7 @@ async function cmdBuild(argv) {
   if (!source)
     throw new UsageError("vos build <program.mjs> [--out config.json] [--json]");
   const r = createReporter(flags.json === true);
-  const file = resolve5(source);
+  const file = resolve6(source);
   const text = readFileSync5(file, "utf8");
   const mod = await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
   const program = mod.default ?? mod.program;
@@ -8710,7 +8787,7 @@ async function cmdBuild(argv) {
     );
     return EXIT_ERROR;
   }
-  const out = resolve5(
+  const out = resolve6(
     strFlag(flags, "out") ?? join16(dirname3(file), "config.json")
   );
   writeFileSync2(out, JSON.stringify(built.config, null, 2) + "\n");
@@ -8729,7 +8806,7 @@ async function cmdBuild(argv) {
 // src/plugin/compare.ts
 import { spawnSync } from "child_process";
 import { existsSync as existsSync15, mkdirSync as mkdirSync2, statSync as statSync4, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname4, join as join17, resolve as resolve6 } from "path";
+import { dirname as dirname4, join as join17, resolve as resolve7 } from "path";
 var BOOLEAN_FLAGS7 = /* @__PURE__ */ new Set(["json", "help"]);
 function sampleTimes(duration, every) {
   const step = every > 0 ? every : 1;
@@ -8790,7 +8867,7 @@ async function cmdCompare(argv) {
     );
   requireFfmpeg();
   const r = createReporter(flags.json === true);
-  const ref = resolve6(against);
+  const ref = resolve7(against);
   const loaded = await loadVosConfig(source);
   for (const w of loaded.warnings) r.log(`note: ${w}`);
   const config = loaded.config;
@@ -8812,7 +8889,7 @@ async function cmdCompare(argv) {
   const threshold = Number(strFlag(flags, "threshold") ?? 0.95);
   const timesRaw = strFlag(flags, "times");
   const times = timesRaw ? parseTimes(timesRaw, duration) : sampleTimes(duration, Number(strFlag(flags, "every") ?? 1));
-  const outDir = resolve6(strFlag(flags, "out") ?? "compare");
+  const outDir = resolve7(strFlag(flags, "out") ?? "compare");
   mkdirSync2(outDir, { recursive: true });
   const browser = await launchBrowser();
   const scores = [];
@@ -8916,7 +8993,7 @@ async function cmdCompare(argv) {
 
 // src/plugin/port.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname7, join as join21, resolve as resolve9 } from "path";
+import { dirname as dirname7, join as join21, resolve as resolve10 } from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 
 // src/plugin/portInventory.ts
@@ -8928,7 +9005,7 @@ import {
   readdirSync as readdirSync4,
   statSync as statSync6
 } from "fs";
-import { dirname as dirname5, join as join19, relative as relative3, resolve as resolve7 } from "path";
+import { dirname as dirname5, join as join19, relative as relative3, resolve as resolve8 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 import { findFontFamily as findFontFamily3 } from "@vosjs/shared";
 
@@ -9551,7 +9628,7 @@ var SEEK_AND_READ = `((args) => {
   return out
 })`;
 async function readInventory(source, opts) {
-  const abs = resolve7(source);
+  const abs = resolve8(source);
   const dir = existsSync17(abs) && statSync6(abs).isDirectory() ? abs : dirname5(abs);
   const engine = detectEngine(dir);
   const page = sourcePage(abs);
@@ -9719,7 +9796,7 @@ async function readInventory(source, opts) {
 // src/plugin/portScaffold.ts
 import { spawnSync as spawnSync3 } from "child_process";
 import { copyFileSync, existsSync as existsSync18, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { basename as basename7, dirname as dirname6, join as join20, resolve as resolve8 } from "path";
+import { basename as basename7, dirname as dirname6, join as join20, resolve as resolve9 } from "path";
 import { findFontFamily as findFontFamily4, fontFaceUrl, nearestFontWeight } from "@vosjs/shared";
 
 // src/plugin/painterLib.ts
@@ -10128,7 +10205,7 @@ function planScaffold(inv, opts) {
   const audio = [];
   const copies = [];
   inv.media.filter((m) => m.kind === "audio" && m.src).forEach((m, i) => {
-    const from = resolve8(opts.sourceDir, m.src);
+    const from = resolve9(opts.sourceDir, m.src);
     const name = basename7(from);
     if (!existsSync18(from)) {
       report.push(
@@ -10181,9 +10258,18 @@ function planScaffold(inv, opts) {
 }
 function programSource(p) {
   const j = (v) => JSON.stringify(v, null, 2).replace(/\n/g, "\n  ");
-  const sceneTodos = p.scenes.length ? p.scenes.map(
-    (s) => `    // TODO scene "${s.name}" (${s.start}s${s.duration ? ` to ${s.start + s.duration}s` : ""}): translate its motion onto ctx.elements.get(id).props / .segments here`
-  ).join("\n") : "    // TODO: translate the source's motion here, one block per scene (tl.addLabel above names them)";
+  const word = (v) => JSON.stringify(
+    Array.from(String(v), (ch) => {
+      const code = ch.charCodeAt(0);
+      return code < 32 || code === 8232 || code === 8233 ? " " : ch;
+    }).join("")
+  );
+  const secs = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+  const sceneTodos = p.scenes.length ? p.scenes.map((s) => {
+    const start = secs(s.start) ?? 0;
+    const duration = secs(s.duration);
+    return `    // TODO scene ${word(s.name)} (${start}s${duration ? ` to ${start + duration}s` : ""}): translate its motion onto ctx.elements.get(id).props / .segments here`;
+  }).join("\n") : "    // TODO: translate the source's motion here, one block per scene (tl.addLabel above names them)";
   const springHint = p.uses.includes("spring") ? `
     // The source springs. Put a spring ON THE TIMELINE with the spring ease:
     //   tl.to(p, { y: 0, ease: 'spring(200)', duration: content.refs.lib.springSeconds({ damping: 200 }) }, at)
@@ -10360,11 +10446,11 @@ async function inventory(argv) {
   const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS8);
   const source = positionals[0] ?? ".";
   const r = createReporter(flags.json === true);
-  const outDir = resolve9(strFlag(flags, "out") ?? "port");
+  const outDir = resolve10(strFlag(flags, "out") ?? "port");
   mkdirSync5(outDir, { recursive: true });
   const renderFlag = strFlag(flags, "render");
   const inv = await readInventory(source, {
-    render: renderFlag === void 0 ? void 0 : resolve9(renderFlag),
+    render: renderFlag === void 0 ? void 0 : resolve10(renderFlag),
     outDir,
     log: (l) => r.log(`note: ${l}`)
   });
@@ -10400,13 +10486,13 @@ function summary(inv) {
 async function scaffold(argv) {
   const { flags } = parseArgs(argv, BOOLEAN_FLAGS8);
   const r = createReporter(flags.json === true);
-  const from = resolve9(strFlag(flags, "from") ?? join21("port", "inventory.json"));
+  const from = resolve10(strFlag(flags, "from") ?? join21("port", "inventory.json"));
   if (!existsSync19(from))
     throw new UsageError(
       `no inventory at ${from}: run npx vos port inventory <source> first`
     );
   const inv = JSON.parse(readFileSync8(from, "utf8"));
-  const outDir = resolve9(
+  const outDir = resolve10(
     strFlag(flags, "out") ?? join21(dirname7(from), "program")
   );
   const plan = planScaffold(inv, {
@@ -10431,7 +10517,7 @@ async function scaffold(argv) {
 }
 function scaffoldSourceDir(inv) {
   if (inv.root) return inv.root;
-  return inv.source.endsWith(".html") ? dirname7(resolve9(inv.source)) : resolve9(inv.source);
+  return inv.source.endsWith(".html") ? dirname7(resolve10(inv.source)) : resolve10(inv.source);
 }
 
 // src/plugin/recipe.ts
@@ -10523,7 +10609,7 @@ async function cmdRecipe(argv) {
 
 // src/plugin/brand.ts
 import { writeFile as writeFile10 } from "fs/promises";
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 import { parseFrontmatter as parseFrontmatter2 } from "@vosjs/shared/frontmatter";
 import { lookKindForGround } from "@vosjs/studio-core";
 var HEX_RE = /#(?:[0-9a-f]{6}|[0-9a-f]{3})\b/gi;
@@ -10842,7 +10928,7 @@ async function cmdBrand(argv) {
     throw new UsageError(`not a URL: ${raw}`);
   }
   const r = createReporter(flags.json === true);
-  const out = resolve10(strFlag(flags, "out") ?? "BRAND.md");
+  const out = resolve11(strFlag(flags, "out") ?? "BRAND.md");
   r.log(`reading ${origin}/design.md and /llms.txt\u2026`);
   const [designText, llmsText] = await Promise.all([
     fetchText(`${origin}/design.md`),
@@ -10992,7 +11078,7 @@ async function recordHosted(input) {
 
 // src/plugin/agentBrowser.ts
 import { writeFile as writeFile11 } from "fs/promises";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 function parseAgentBrowserLog(text) {
   const records = [];
   const problems = [];
@@ -11463,7 +11549,7 @@ async function cmdActions(argv) {
     );
   }
   const r = createReporter(flags.json === true);
-  const out = resolve11(strFlag(flags, "out") ?? "actions.json");
+  const out = resolve12(strFlag(flags, "out") ?? "actions.json");
   const viewportFlag = strFlag(flags, "viewport");
   let viewport;
   if (viewportFlag) {
@@ -11472,7 +11558,7 @@ async function cmdActions(argv) {
     viewport = { width: Number(m[1]), height: Number(m[2]) };
   }
   const { readFile: readFile14 } = await import("fs/promises");
-  const text = await readFile14(resolve11(input), "utf8");
+  const text = await readFile14(resolve12(input), "utf8");
   const { records, problems } = parseAgentBrowserLog(text);
   for (const p of problems) r.log(`  ${p}`);
   const result = convertAgentBrowser(records, {
@@ -11511,7 +11597,7 @@ async function cmdActionsScript(input, flags) {
   const r = createReporter(flags.json === true);
   const { readFile: readFile14 } = await import("fs/promises");
   const { shotList, formatShotList } = await import("./shotList-MAQVLZBY.js");
-  const raw = JSON.parse(await readFile14(resolve11(input), "utf8"));
+  const raw = JSON.parse(await readFile14(resolve12(input), "utf8"));
   const errors = validateActions(raw);
   if (errors.length) throw new UsageError(`${input}:
   ${errors.join("\n  ")}`);
@@ -11523,7 +11609,7 @@ async function cmdActionsScript(input, flags) {
 // src/plugin/ingest.ts
 import { existsSync as existsSync20 } from "fs";
 import { copyFile, mkdir as mkdir7, readFile as readFile12, stat as stat2 } from "fs/promises";
-import { basename as basename9, join as join22, resolve as resolve12 } from "path";
+import { basename as basename9, join as join22, resolve as resolve13 } from "path";
 import { inflateRawSync } from "zlib";
 import {
   cursorFromPlaywrightTrace,
@@ -11640,10 +11726,10 @@ async function cmdIngest(argv) {
     throw new UsageError(
       "vos ingest <video.webm|mp4> [--cursor <trace.zip|steps.jsonl|cursor.csv>] [--as footage|take] [--out take] [--offset <ms>] [--viewport WxH] [--background <slug|url|none>] [--json]"
     );
-  const videoPath = resolve12(source);
+  const videoPath = resolve13(source);
   if (!existsSync20(videoPath)) throw new UsageError(`${source}: no such file`);
   const r = createReporter(flags.json === true);
-  const outDir = resolve12(strFlag(flags, "out") ?? "take");
+  const outDir = resolve13(strFlag(flags, "out") ?? "take");
   const offsetMs = numFlag(flags, "offset", 0);
   const viewportFlag = parseViewport(strFlag(flags, "viewport"));
   const cursorPath = strFlag(flags, "cursor");
@@ -11665,7 +11751,7 @@ async function cmdIngest(argv) {
   }
   let trace = null;
   if (cursorPath) {
-    trace = await readTraceFile(resolve12(cursorPath), offsetMs);
+    trace = await readTraceFile(resolve13(cursorPath), offsetMs);
     for (const n of trace.notes) r.log(`note: ${n}`);
   }
   if (existsSync20(join22(outDir, "meta.json"))) {
@@ -12670,7 +12756,7 @@ function takeBrowserArgs(multi) {
 function takeStorageState(flags) {
   const raw = strFlag(flags, "storage-state");
   if (!raw) return void 0;
-  const path = resolve13(raw);
+  const path = resolve14(raw);
   if (!existsSync23(path))
     throw new UsageError(`--storage-state: no such file: ${path}`);
   return path;
@@ -12753,7 +12839,7 @@ async function cmdRecord(argv) {
   const url = strFlag(flags, "url") ?? actions.url;
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
-  const outDir = resolve13(strFlag(flags, "out") ?? "take");
+  const outDir = resolve14(strFlag(flags, "out") ?? "take");
   const storageState = takeStorageState(flags);
   const sessionName = takeSessionName(flags, storageState);
   const browserArgs = takeBrowserArgs(multi);
@@ -12880,7 +12966,9 @@ async function cmdRecord(argv) {
       const carried = [
         ...strFlag(flags, "storage-state") ? [`--storage-state ${strFlag(flags, "storage-state")}`] : [],
         ...browserArgs.map((a) => `--browser-arg=${a}`),
-        ...Object.entries(headers).map(([k, v]) => `--header ${k}=${v}`),
+        // A header value is a bypass token more often than not: named, never
+        // printed.
+        ...Object.keys(headers).map((k) => `--header ${k}=\u2026`),
         ...sessionName ? [`--session ${sessionName}`] : [],
         ...flags["allow-wall"] === true ? ["--allow-wall"] : []
       ].join(" ");
@@ -12996,7 +13084,7 @@ async function cmdCreate2(argv) {
   const url = strFlag(flags, "url") ?? actions.url;
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
-  const outDir = resolve13(strFlag(flags, "out") ?? "take");
+  const outDir = resolve14(strFlag(flags, "out") ?? "take");
   const format = videoFormat(strFlag(flags, "format"), positionals[0]);
   const out = positionals[0] ?? join25(outDir, `out.${format}`);
   const parallel = numFlag(flags, "parallel", 1);
@@ -13123,7 +13211,7 @@ async function cmdPlan(argv) {
   }
   let reuse;
   if (flags.reuse === true) {
-    const from = resolve13(strFlag(flags, "from") ?? join25(dir, PREV_DOC_NAME));
+    const from = resolve14(strFlag(flags, "from") ?? join25(dir, PREV_DOC_NAME));
     if (!existsSync23(from)) {
       throw new UsageError(
         `--reuse: ${from} does not exist \u2014 a re-record into this take writes doc.prev.json, or pass --from <doc.json>`
@@ -13181,7 +13269,7 @@ async function cmdPlan(argv) {
     ${s.reuse.flagged.join("\n    ")}` : "") : "";
   r.done(
     {
-      take: resolve13(dir),
+      take: resolve14(dir),
       fresh: s.fresh,
       cursorKept: s.cursorKept,
       zoomAuto: s.zoomAuto,
@@ -13547,7 +13635,7 @@ async function resolveStyleRef(flags) {
 }
 async function resolveDocRef(ref, flags, what) {
   const styleRef = ref;
-  const file = existsSync23(styleRef) ? resolve13(
+  const file = existsSync23(styleRef) ? resolve14(
     styleRef,
     existsSync23(join25(styleRef, "doc.json")) ? "doc.json" : ""
   ) : null;
@@ -13673,7 +13761,7 @@ async function cmdOpen(argv) {
     /\/+$/,
     ""
   );
-  const server = await startTakeServer(resolve13(dir), {});
+  const server = await startTakeServer(resolve14(dir), {});
   const url = `${studio}/studio?take=${encodeURIComponent(server.base)}`;
   r.event({ event: "open", server: server.base, url });
   r.log(`take served at ${server.base}`);
@@ -13681,10 +13769,7 @@ async function cmdOpen(argv) {
 `);
   if (flags.print !== true) {
     r.log("opening the studio\u2026 (Ctrl-C to stop serving)");
-    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    const { exec } = await import("child_process");
-    exec(`${opener} ${JSON.stringify(url)}`, () => {
-    });
+    await launchDefaultBrowser(url);
   } else {
     r.log("serving (\u2014 --print: not launching a browser; Ctrl-C to stop)");
   }
@@ -13970,7 +14055,7 @@ async function cmdPush3(argv) {
     );
   const refusal = takePushRefusal({
     vos: strFlag(flags, "vos"),
-    trackedVosId: readSyncState(resolve13(dir))?.vosId ?? null,
+    trackedVosId: readSyncState(resolve14(dir))?.vosId ?? null,
     programOnly: ["slug", "desc", "tags", "base", "remix-of", "still"].filter(
       (name) => hasFlag(flags, name)
     )
@@ -13986,7 +14071,7 @@ async function cmdPush3(argv) {
         `--claimable creates a NEW claimable vos; ${iterating.map((f) => `--${f}`).join(", ")} ${iterating.length > 1 ? "apply" : "applies"} to a keyed push`
       );
     const claim = await pushTakeClaimable(
-      resolve13(dir),
+      resolve14(dir),
       {
         api: strFlag(flags, "api"),
         origin: strFlag(flags, "origin"),
@@ -14008,7 +14093,7 @@ reference and the only credential.`
   }
   const overrides = multi.override;
   const result = await pushTake(
-    resolve13(dir),
+    resolve14(dir),
     {
       key: strFlag(flags, "key"),
       api: strFlag(flags, "api"),
@@ -14062,7 +14147,7 @@ async function cmdPull2(argv) {
   const dir = positionals[0] ?? ".";
   const r = createReporter(flags.json === true);
   const result = await pullTake(
-    resolve13(dir),
+    resolve14(dir),
     {
       key: strFlag(flags, "key"),
       api: strFlag(flags, "api"),
@@ -14362,4 +14447,4 @@ export {
   verbHelp,
   run
 };
-//# sourceMappingURL=chunk-EYF3WJIC.js.map
+//# sourceMappingURL=chunk-X6NQNBDF.js.map