crew-runner 0.2.0 → 0.2.2

package/README.md

@@ -77,7 +77,17 @@ Press Ctrl+C (or close the window) to stop the runner. Notes for Windows:
   auto-allows `git`, because a repository's own settings can run code. Leaving plan mode, steps too
   long to show in full on a card, and Claude Code's own settings and history are refused. Opening a web page or search, deleting, `git push`, sending (mail, `curl`, `ssh`, AppleScript and
   similar), paying, changing files outside those folders, and any command the runner cannot read with certainty (pipes,
-  `$(...)`, redirects, quotes, unknown programs) wait for your yes on a card in CrewCortex. No answer within the run is a no.
+  `$(...)`, redirects, unknown programs) wait for your yes on a card in CrewCortex. No answer within the run is a no.
+- Reading a public web page runs without a card when it is one plain `curl` that only downloads: a GET of one `http(s)`
+  address on a public name (no login, port, local or numeric address, no redirects), printed or saved with `-o` to a new
+  file inside `~/CrewCortex/<workspace>`, with no data, headers, uploads, cookies or config file (`~/.curlrc` makes every curl ask).
+  This holds only until the run has read files on this computer (other than pages it downloaded): after that a download
+  asks, because its address could carry what was read. The address still leaves your computer, as with any web page,
+  and a public name can point at a private address. `wget`, `-L`, pipes and other programs ask.
+- On a card for a web request that sends only what its own command line shows, **Allow for this task** also lets later
+  requests of the same kind in the same run go ahead without a card: web searches, page reads from that one host, or curl
+  requests with that one method to that one host (with or without data or headers, and redirects, as on the card). It ends with the run, never covers uploads of local files, deletes,
+  pushes or anything else, and each step it covers is in the action log with the card that allowed it.
 - It never changes Claude Code settings (`.claude` folders, `~/.claude.json`), and refuses to start in a workspace folder that has them.
 - Claude Code's own files under `~/.claude` (settings, other sessions' history, task lists) and `~/.claude.json` are denied
   to it by permission rules that Claude Code checks before anything it would allow by itself, and every tool that reads,

package/STUDIO.md

@@ -71,11 +71,11 @@ V2 source-audio admission is deliberately narrower than legacy: no audio, or **o
 
 Admission regressions prove refusal before the snapshot or video units for a real 120s/100s-gap source, the same-duration/sample-count gap-plus-overlap bypass, and ALAC (with a retained legacy ALAC render control). Real 8kHz mono and 96kHz/8-channel controls pass. Parser tests cover profile/channel/rate/clock/frame/count boundaries and cumulative gaps; owned-child tests cover empty scans, oversized lines/bytes, cancellation, consent expiry and lock cleanup.
 
-Bounds: source <=90 minutes, <=2 GiB, 1-120fps, <=3840x2160; each sequential render unit <=30 seconds, <=384 units; aggregate intermediate files <=512 MiB, final export <=512 MiB. Disk admission requires snapshot size + both 512 MiB budgets +256 MiB reserve. Snapshot uses a 1 MiB streaming buffer and hashes copied bytes; originals are not loaded wholesale into memory. Consent and the entire job share a <=15-minute deadline, source/final decode or final encoding <=10 minutes, individual segments <=90 seconds. Decoder/encoder/filter threads stay at 2. These are conservative admission limits, not a promise that every admitted 4K recording finishes within the deadline. Source metadata/decode must succeed before source-frame EOF display padding (at most one source-frame interval) is applied. FFmpeg is not an OS memory sandbox.
+Bounds: source <=3 hours, <=6 GiB, 1-120fps, <=3840x2160; each sequential render unit <=30 seconds, <=576 units; aggregate intermediate files <=512 MiB, final export <=512 MiB. Disk admission requires snapshot size + both 512 MiB budgets +256 MiB reserve. Snapshot uses a 1 MiB streaming buffer and hashes copied bytes; originals are not loaded wholesale into memory. Consent and the entire job share a <=15-minute deadline, source/final decode or final encoding <=10 minutes, individual segments <=90 seconds. Decoder/encoder/filter threads stay at 2. These are conservative admission limits, not a promise that every admitted 4K recording finishes within the deadline. Source metadata/decode must succeed before source-frame EOF display padding (at most one source-frame interval) is applied. FFmpeg is not an OS memory sandbox.
 
 The existing project lock, cancellation and fail-closed crash recovery remain. Per-segment `progress.json` is a bounded checkpoint, not resumable authorization: process death can leave lock/private partial files; inspect owned processes before human cleanup, never automatically rerun a lost acknowledgement. Successful UUID versions have source/output SHA-256 plus plan/mapping, and earlier versions survive failed edits. Export files remain local. No automatic transfer, scanned upload, hosted version registration or publication exists here.
 
-Intro prepending: an optional `"intro": "brand/intro.mp4"` names ONE existing project MP4 that the member chose (for example a workspace's saved usual intro or a file they supplied with the request). The engine never picks, generates or scores an intro; choosing which file, and showing that choice for approval, belongs to the caller. The intro is snapshotted and hashed like the source, then admitted before the source with the same strict v2 decode and audio-clock rules (one AAC-LC stream or none, positive gaps <=2s), at most 120 seconds (checked from metadata before any full decode) and 100 MiB; its copy is disk-checked before it is written, and an edited programme plus intro over 90 minutes is refused before the source is opened. Its picture is letterboxed/pillarboxed into the export frame (never stretched or cropped; the source crop does not apply to it) and resampled to the 30fps grid; only its whole 30fps frames are used, in <=30s video-only units. Its audio is placed by PTS, converted to 48kHz stereo with FFmpeg's standard rematrix (mono goes to both channels at -3 dB, as for sources without an intro; multichannel is downmixed), padded with silence or trimmed to exactly 1600 samples per intro frame and joined once before the unchanged source chain; an intro with no audio contributes silence, never music. Source mapping keeps original-source times; `manifest.json.intro` records path, sha256, frames and output span, and every `mapping` outputStart is shifted by the intro's whole frames. Regression: a 1080p 25fps mono 44.1kHz intro and a 31s silent portrait intro both give exact frame counts, the intro picture to the last intro frame, source frame 5.000s as the first programme frame and 0-sample source lag after the seam. Legacy `supportingAsset` still appends and is not an intro. Ripple-audio deletion remains a separate slice. Actual source, hold duration/frame, crop and intro must be reviewed before editing private client footage.
+Intro prepending: an optional `"intro": "brand/intro.mp4"` names ONE existing project MP4 that the member chose (for example a workspace's saved usual intro or a file they supplied with the request). The engine never picks, generates or scores an intro; choosing which file, and showing that choice for approval, belongs to the caller. The intro is snapshotted and hashed like the source, then admitted before the source with the same strict v2 decode and audio-clock rules (one AAC-LC stream or none, positive gaps <=2s), at most 120 seconds (checked from metadata before any full decode) and 100 MiB; its copy is disk-checked before it is written, and an edited programme plus intro over 3 hours is refused before the source is opened. Its picture is letterboxed/pillarboxed into the export frame (never stretched or cropped; the source crop does not apply to it) and resampled to the 30fps grid; only its whole 30fps frames are used, in <=30s video-only units. Its audio is placed by PTS, converted to 48kHz stereo with FFmpeg's standard rematrix (mono goes to both channels at -3 dB, as for sources without an intro; multichannel is downmixed), padded with silence or trimmed to exactly 1600 samples per intro frame and joined once before the unchanged source chain; an intro with no audio contributes silence, never music. Source mapping keeps original-source times; `manifest.json.intro` records path, sha256, frames and output span, and every `mapping` outputStart is shifted by the intro's whole frames. Regression: a 1080p 25fps mono 44.1kHz intro and a 31s silent portrait intro both give exact frame counts, the intro picture to the last intro frame, source frame 5.000s as the first programme frame and 0-sample source lag after the seam. Legacy `supportingAsset` still appends and is not an intro. Ripple-audio deletion remains a separate slice. Actual source, hold duration/frame, crop and intro must be reviewed before editing private client footage.
 
 Remote reproduction (owned Linux checkout only):
 
@@ -89,7 +89,7 @@ PATH=/owned/tools:$PATH node packages/runner/test/studio-source-pilot.mjs /owned
 
 The `crew-render` image also runs this engine for hosted webinar edits, one job per disposable Fly machine (`infra/render/studio.mjs`, chosen when the machine gets `RENDER_STUDIO_URL`). The image owns the FFmpeg 7.1 static digest pin, which `scripts/ci-ffmpeg.sh` reads from `infra/render/Dockerfile`; it is installed at `/opt/ffmpeg-7.1`, first on PATH for Studio mode only; the motion-video modes keep the distribution FFmpeg. The engine source is copied unchanged and run by Node's type stripping.
 
-The machine downloads the approved source and optional intro from short-lived URLs, refusing more bytes than the worker declared and checking Drive's md5 when one was given. It fills `sourceDuration` from ffprobe on the 30fps grid, so the approved edit lists (source seconds) are the only plan input. It calls `openStudio(grant, limits)` with hosted limits instead of `LOCAL_LIMITS`: a job deadline of at most `HOSTED_MAX_JOB_MS` (two hours, downloads included), longer per-unit and decode/final windows, more encoder threads, a 1080p export and larger intermediate budget, never above the 512 MiB export cap. The local CLI and MCP bridge always use `LOCAL_LIMITS` (15-minute job, 90s units, two threads, 720p), so their behaviour and pilot outputs are unchanged. It uploads the export and a JPEG still, then writes a status JSON (bytes, SHA-256, duration, size, render time, peak memory) or a failure reason.
+The machine downloads the approved source and optional intro from short-lived URLs, refusing more bytes than the worker declared and checking Drive's md5 when one was given. It fills `sourceDuration` from ffprobe on the 30fps grid, so the approved edit lists (source seconds) are the only plan input. It calls `openStudio(grant, limits)` with hosted limits instead of `LOCAL_LIMITS`: a job deadline of at most `HOSTED_MAX_JOB_MS` (four hours, downloads included), longer per-unit and decode/final windows, more encoder threads, a 1080p export and intermediate budgets of up to `HOSTED_EXPORT_BYTES` (4 GiB) and `HOSTED_INTERMEDIATE_BYTES` (16 GiB). When the export budget could bind for the programme's length, the final encode gets a peak video rate (`-maxrate`, 2x `-bufsize`) sized so the whole export fits (90% of the budget less 200 kbit/s for audio and container); short and local exports keep their exact argv. A dropped or stalled download resumes with an HTTP Range request (up to five attempts, 90 s stall timeout) and the md5 covers the whole stream. Measured on performance-4x (4 dedicated CPUs, 8 GB): a 75-minute 1080p30 webinar-like source rendered in 37 minutes (about half real time), with a 1.42 GB export. The local CLI and MCP bridge always use `LOCAL_LIMITS` (15-minute job, 90s units, two threads, 720p), so their behaviour and pilot outputs are unchanged. It uploads the export and a JPEG still, then writes a status JSON (bytes, SHA-256, duration, size, render time, peak memory) or a failure reason.
 
 Real-media check, inside the built image: `node --test /app/studio.test.mjs` with `/opt/ffmpeg-7.1` first on PATH (synthetic 1080p 25fps source, 44.1kHz intro, a cut and a mute; md5 and size refusals; edit past the end refused).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crew-runner",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "description": "Runs a CrewCortex assistant on your own computer using the Claude Code or Codex app you already signed in to.",
   "keywords": [

package/src/acp.ts

@@ -241,6 +241,7 @@ export async function runAcp(agent: AgentName, pkg: Claimed, sink: Sink, opts: R
   const cwd = computer ? computer.cwd : await mkdtemp(join(tmpdir(), "crew-run-"));
   let child: ReturnType<typeof spawn> | undefined;
   let timer: NodeJS.Timeout | undefined;
+  let ended = false;
   let flushTimer: NodeJS.Timeout | undefined;
   let graceTimer: NodeJS.Timeout | undefined;
   let onAbort: (() => void) | undefined;
@@ -262,10 +263,34 @@ export async function runAcp(agent: AgentName, pkg: Claimed, sink: Sink, opts: R
       proc.on("close", () => reject(new Error("runner_failed")));
     });
     exited.catch(() => undefined);
+    // The run clock. It stops while a computer-mode request waits on `decide` (the owner's card, which expires on its own timer),
+    // so time the owner takes to answer never counts toward the run limit. Claude Code may ask about parallel tool calls at once,
+    // hence a count of pending decisions rather than a flag. Computer mode has no MCP server, so no run token can lapse meanwhile.
+    let left = opts.timeoutMs;
+    let since = 0;
+    let waiting = 0;
+    let expire: () => void = () => undefined;
     const timedOut = new Promise<never>((_, reject) => {
-      timer = setTimeout(() => reject(new Error("runner_timeout")), opts.timeoutMs);
+      expire = () => reject(new Error("runner_timeout"));
     });
     timedOut.catch(() => undefined);
+    const resume = () => {
+      if (ended) return; // a decision that outlived the run
+      since = Date.now();
+      timer = setTimeout(expire, left);
+    };
+    const paused = async <T>(work: () => Promise<T>): Promise<T> => {
+      if (waiting++ === 0) {
+        clearTimeout(timer);
+        left -= Date.now() - since;
+      }
+      try {
+        return await work();
+      } finally {
+        if (--waiting === 0) resume();
+      }
+    };
+    resume();
 
     // Serialised sink, text coalesced so a token stream is not one HTTP call per chunk.
     let chain: Promise<void> = Promise.resolve();
@@ -320,7 +345,7 @@ export async function runAcp(agent: AgentName, pkg: Claimed, sink: Sink, opts: R
     const session = acp
       .client({ name: "crew-runner" })
       .onRequest(acp.methods.client.session.requestPermission, async (ctx) => {
-        const d = computer ? optionFor(ctx.params, await computer.decide(ctx.params, calls).catch(() => false)) : decide(spec, ctx.params, calls);
+        const d = computer ? optionFor(ctx.params, await paused(() => computer.decide(ctx.params, calls)).catch(() => false)) : decide(spec, ctx.params, calls);
         return { outcome: d.optionId ? { outcome: "selected" as const, optionId: d.optionId } : { outcome: "cancelled" as const } };
       })
       .connectWith(stream, async (ctx) => {
@@ -381,6 +406,7 @@ export async function runAcp(agent: AgentName, pkg: Claimed, sink: Sink, opts: R
   } catch {
     return failed("runner_failed");
   } finally {
+    ended = true;
     clearTimeout(timer);
     clearTimeout(flushTimer);
     clearTimeout(graceTimer);

package/src/api.ts

@@ -12,7 +12,8 @@ export type Claimed = {
 };
 
 export type ClaimMode = "default" | "computer";
-export type CardAnswer = "pending" | "approved" | "rejected" | "expired";
+// "approved_task": approved with "Allow for this task" (the server sends status approved, scope task).
+export type CardAnswer = "pending" | "approved" | "approved_task" | "rejected" | "expired";
 
 export type RunEvent =
   | { type: "text"; text: string }
@@ -57,10 +58,11 @@ export function createApi(cfg: Stored, fetchImpl: typeof fetch = fetch) {
       await call("complete", body);
     },
     // Computer mode: a confirmation card for the owner. Null when it could not be asked (the step is then refused).
-    async askOwner(runId: string, category: string, detail: string): Promise<string | null> {
+    // `grant`: the card may offer "Allow for this task" for later steps of the same kind in this run.
+    async askOwner(runId: string, category: string, detail: string, grant?: string): Promise<string | null> {
       // The policy refuses anything longer than a card shows; never cut what the owner approves.
       if (detail.length > CARD_DETAIL_MAX) return null;
-      const res = await call("approval", { run_id: runId, category, detail });
+      const res = await call("approval", { run_id: runId, category, detail, ...(grant ? { grant } : {}) });
       if (!res.ok) return null;
       const body = (await res.json()) as { approval_id?: unknown };
       return typeof body.approval_id === "string" ? body.approval_id : null;
@@ -68,7 +70,8 @@ export function createApi(cfg: Stored, fetchImpl: typeof fetch = fetch) {
     async ownerAnswer(runId: string, approvalId: string): Promise<CardAnswer | null> {
       const res = await call("approval/status", { run_id: runId, approval_id: approvalId });
       if (!res.ok) return null;
-      const body = (await res.json()) as { status?: unknown };
+      const body = (await res.json()) as { status?: unknown; scope?: unknown };
+      if (body.status === "approved" && body.scope === "task") return "approved_task";
       return body.status === "pending" || body.status === "approved" || body.status === "rejected" || body.status === "expired" ? body.status : null;
     },
     // Computer mode: is this run still running? false only when the server says so (the owner's off switch); null when

package/src/computer-run.ts

@@ -5,7 +5,7 @@ import type { Outcome } from "./claude.ts";
 import { chmod, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { computerFolders, computerPrompt, judge, prepareWorkspaceFolder, type Verdict } from "./computer.ts";
+import { computerFolders, computerPrompt, judgeInRun, newRunMemory, noteAllowed, prepareWorkspaceFolder, type Folders, type Grant, type Verdict } from "./computer.ts";
 
 const POLL_MS = 3_000;
 // How often a computer run checks it is still running. The owner's off switch cancels it on the server.
@@ -19,18 +19,58 @@ const sleep = (ms: number, signal?: AbortSignal) =>
 type Ask = Pick<RunnerApi, "askOwner" | "ownerAnswer" | "alive">;
 
 // Waits for the owner's answer on their CrewCortex card. Anything but a yes (no, expired, run stopped, network) is a no.
-export async function ownerSaysYes(api: Pick<RunnerApi, "askOwner" | "ownerAnswer">, runId: string, v: Extract<Verdict, { kind: "ask" }>, signal?: AbortSignal, pollMs = POLL_MS): Promise<boolean> {
-  const id = await api.askOwner(runId, v.category, v.detail).catch(() => null);
-  if (!id) return false;
+// "task": the owner chose "Allow for this task" on a card that offered it; on any other card it counts once.
+export type Yes = "once" | "task";
+async function answerTo(api: Pick<RunnerApi, "ownerAnswer">, runId: string, card: string, v: Extract<Verdict, { kind: "ask" }>, signal?: AbortSignal, pollMs = POLL_MS): Promise<Yes | false> {
   while (!signal?.aborted) {
-    const answer = await api.ownerAnswer(runId, id).catch(() => null);
-    if (answer === "approved") return true;
+    const answer = await api.ownerAnswer(runId, card).catch(() => null);
+    if (answer === "approved_task") return v.grant ? "task" : "once";
+    if (answer === "approved") return "once";
     if (answer !== "pending") return false;
     await sleep(pollMs, signal);
   }
   return false;
 }
 
+const ask = (api: Pick<RunnerApi, "askOwner">, runId: string, v: Extract<Verdict, { kind: "ask" }>) =>
+  (v.grant ? api.askOwner(runId, v.category, v.detail, v.grant) : api.askOwner(runId, v.category, v.detail)).catch(() => null);
+
+export async function ownerSaysYes(api: Pick<RunnerApi, "askOwner" | "ownerAnswer">, runId: string, v: Extract<Verdict, { kind: "ask" }>, signal?: AbortSignal, pollMs = POLL_MS): Promise<Yes | false> {
+  const card = await ask(api, runId, v);
+  return card ? answerTo(api, runId, card, v, signal, pollMs) : false;
+}
+
+// One run's decisions. Grants the owner gave with "Allow for this task", and whether the run has read anything on this
+// computer yet, live here and nowhere else, so they end with the run and never reach another one. Every step that runs under a grant is written to the action log with the card that
+// allowed it; a step runs only once its record is saved, and a refusal is recorded as well as possible.
+export function stepDecider(api: Pick<RunnerApi, "askOwner" | "ownerAnswer">, runId: string, f: Folders, record: (output: Record<string, unknown>) => Promise<boolean>, signal?: AbortSignal) {
+  const grants = new Map<Grant, string>();
+  const mem = newRunMemory();
+  return async (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>): Promise<boolean> => {
+    const v = judgeInRun(f, p, calls, mem);
+    const why = v.kind === "allow" ? {} : v.kind === "deny" ? { reason: v.reason } : { asked: v.category, detail: v.detail };
+    let how: Record<string, unknown> = {};
+    let yes = v.kind === "allow";
+    if (v.kind === "ask") {
+      const grantedBy = v.grant && grants.get(v.grant);
+      if (grantedBy) {
+        yes = true;
+        how = { allowed_by_card: grantedBy };
+      } else {
+        const card = await ask(api, runId, v);
+        const answer = card ? await answerTo(api, runId, card, v, signal) : false;
+        yes = answer !== false;
+        if (answer === "task" && card) how = { card, scope: "task" };
+        if (answer === "task" && v.grant && card) grants.set(v.grant, card);
+      }
+    }
+    const allowed = yes && (await record({ decision: "allowed", ...why, ...how }));
+    if (allowed) noteAllowed(f, p, calls, v, mem);
+    else await record({ decision: "refused", ...why, ...how });
+    return allowed;
+  };
+}
+
 // Claude Code's working folder for one run: new, empty and read-only, so Claude Code never finds anything there to read
 // or run without asking the runner, and no approved step can leave a file or link there. Removed after the run.
 export async function makeScratch(): Promise<string> {
@@ -91,14 +131,7 @@ export async function runComputer(api: Ask, pkg: Claimed, sink: (events: RunEven
     }
     return false;
   };
-  const decide = async (p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>): Promise<boolean> => {
-    const v = judge(f, p, calls);
-    const why = v.kind === "allow" ? {} : v.kind === "deny" ? { reason: v.reason } : { asked: v.category, detail: v.detail };
-    const allowed = (v.kind === "allow" || (v.kind === "ask" && (await ownerSaysYes(api, pkg.run_id, v, stop.signal))))
-      && (await record({ decision: "allowed", ...why }));
-    if (!allowed) await record({ decision: "refused", ...why });
-    return allowed;
-  };
+  const decide = stepDecider(api, pkg.run_id, f, record, stop.signal);
   const systemPrompt = `${computerPrompt(f, slug)}\n\nWorkspace guidance (from CrewCortex):\n${pkg.instructions}`;
   try {
     return await runAcp("claude", pkg, sink, {

package/src/computer-web.ts

@@ -0,0 +1,187 @@
+// Web requests in computer mode. A plain curl that only downloads a public page (to the screen or into this workspace's
+// folder) runs without asking. A curl that sends what its own command line shows can be allowed for the rest of a task.
+// Anything this cannot read with certainty is left to the card. Reading is strict on purpose: it accepts a small part of
+// what zsh accepts and gives up on everything else, so a command never means more to the shell than it does here.
+
+// Unquoted characters zsh gives no meaning to in an argument. "~" is handled at the start of a word only; "=" and "%"
+// never start one, and "=" never follows "=" or ":" (zsh expands =name to a program's path, also after = or : under
+// MAGIC_EQUAL_SUBST).
+const PLAIN_CHAR = /^[A-Za-z0-9_\-./:@%+,=]$/;
+
+// The words of one plain command, or null when anything could be expanded, chained, redirected or read differently by
+// zsh: unquoted specials, $, backticks, !, escapes, "''" (one quote under RC_QUOTES), non-ASCII and control characters.
+// `quoted`: the word had a quote in it, so a leading ~ is a literal folder name, not the home folder.
+export function plainWords(command: string): { words: string[]; quoted: boolean[] } | null {
+  if (!/^[\x20-\x7e]*$/.test(command)) return null;
+  const words: string[] = [];
+  const quoted: boolean[] = [];
+  let word: string | null = null;
+  let q = false;
+  const end = () => {
+    if (word !== null) {
+      words.push(word);
+      quoted.push(q);
+    }
+    word = null;
+    q = false;
+  };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i]!;
+    if (c === " ") {
+      end();
+    } else if (c === "'") {
+      const close = command.indexOf("'", i + 1);
+      if (close < 0 || command[close + 1] === "'") return null;
+      word = (word ?? "") + command.slice(i + 1, close);
+      q = true;
+      i = close;
+    } else if (c === '"') {
+      const close = command.indexOf('"', i + 1);
+      if (close < 0) return null;
+      const inner = command.slice(i + 1, close);
+      // Inside double quotes zsh still expands $, ` and !, and a backslash escapes only those and \ and ". A backslash
+      // before a letter or digit stays as it is (curl reads "\n" in a write-out format itself).
+      if (/[$`!]/.test(inner) || /\\(?![A-Za-z0-9])/.test(inner)) return null;
+      word = (word ?? "") + inner;
+      q = true;
+      i = close;
+    } else if (c === "~" && word === null && (command[i + 1] === "/" || command[i + 1] === " " || i + 1 === command.length)) {
+      word = "~";
+    } else if (PLAIN_CHAR.test(c) && !(c === "=" && (word === null || /[=:]$/.test(word))) && !(word === null && c === "%")) {
+      word = (word ?? "") + c;
+    } else {
+      return null;
+    }
+  }
+  end();
+  return { words, quoted };
+}
+
+const MAX_ADDRESS = 500;
+// Names that only make sense on a local network or are reserved for testing.
+const PRIVATE_SUFFIXES = new Set(["localhost", "local", "localdomain", "internal", "intranet", "lan", "home", "corp", "private", "arpa", "test", "invalid"]);
+const LABEL = "[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?";
+// http(s), a dotted name and nothing else before the path: no login, no port, no numeric or bracketed address.
+const ADDRESS = new RegExp(`^https?://(${LABEL}(?:\\.${LABEL})+)(?=[/?#]|$)[A-Za-z0-9\\-._~:/?#@!$&'()*+,;=%]*$`);
+
+// The host of a web address on a public name that curl and the WHATWG parser read the same way, or null. Letter case,
+// brackets and braces (curl expands those into several addresses) and anything unusual are refused, not interpreted.
+// A public name can still resolve to a private address; that reaches only ports 80 and 443 with a GET.
+export function publicHost(raw: string): string | null {
+  if (raw.length > MAX_ADDRESS) return null;
+  const m = ADDRESS.exec(raw);
+  if (!m) return null;
+  const host = m[1]!;
+  const top = host.slice(host.lastIndexOf(".") + 1);
+  if (!/^[a-z]{2,}$/.test(top) && !/^xn--[a-z0-9-]+$/.test(top)) return null;
+  if (PRIVATE_SUFFIXES.has(top)) return null;
+  try {
+    const url = new URL(raw);
+    return url.hostname === host && url.username === "" && url.password === "" && url.port === "" ? host : null;
+  } catch {
+    return null;
+  }
+}
+
+// curl's options a download may use. Switches only change what curl prints or how it waits; none sends anything.
+// Following redirects (-L) is not among them: a public site could send the request on to a local address, so it gets a
+// card (and may then be allowed for the task, for that host).
+const DOWNLOAD_SHORT = "sSfiI";
+const DOWNLOAD_SWITCHES = new Set(["--silent", "--show-error", "--fail", "--include", "--head", "--compressed", "--create-dirs"]);
+const REDIRECT_SWITCH = "--location";
+const NUMBER = /^\d{1,3}$/;
+// A write-out format of plain text and %{variable} only: %output{} writes a file, %header{} and @file read more.
+const WRITE_OUT = /^(?:[^%@\\]|%\{[a-z_]+\}|\\[nrt])*$/;
+const DOWNLOAD_VALUED: ReadonlyMap<string, (v: string) => boolean> = new Map([
+  ["-m", (v: string) => NUMBER.test(v)],
+  ["--max-time", (v: string) => NUMBER.test(v)],
+  ["--connect-timeout", (v: string) => NUMBER.test(v)],
+  ["--retry", (v: string) => /^[0-5]$/.test(v)],
+  ["-A", () => true],
+  ["--user-agent", () => true],
+  ["-w", (v: string) => WRITE_OUT.test(v)],
+  ["--write-out", (v: string) => WRITE_OUT.test(v)],
+]);
+// What a request may also carry when the owner allowed web requests for the task: only text written on the command line.
+// A value starting with @ would read a local file (curl's -d @file, -H @file, --json @file).
+const inline = (v: string) => !v.startsWith("@");
+const SEND_VALUED: ReadonlyMap<string, (v: string) => boolean> = new Map([
+  ["-X", (v: string) => /^[A-Z]{1,10}$/.test(v)],
+  ["--request", (v: string) => /^[A-Z]{1,10}$/.test(v)],
+  ["-d", inline],
+  ["--data", inline],
+  ["--data-raw", () => true],
+  ["--json", inline],
+  ["-H", inline],
+  ["--header", inline],
+]);
+const OUTPUT = new Set(["-o", "--output"]);
+const DATA = new Set(["-d", "--data", "--data-raw", "--json"]);
+
+// "download": a read-only GET (or HEAD) of one public address, printed or saved where `saveOk` allows. "web": also sends
+// text written on the command line (a method, data, headers) or follows redirects, so it needs a card but can be allowed
+// for the task for the same method and host. null: not a curl request this can read with certainty (an upload of a file,
+// a login, a cookie jar, a config file, a pipe, another program), so it gets a card and is never covered by a task grant.
+// `output`: the file a download saves to, as written.
+// `redirects`: follows redirects (-L). `extras`: carries data or headers.
+export type CurlRequest = { kind: "download" | "web"; method: string; host: string; output: string | null; redirects: boolean; extras: boolean };
+
+export function curlRequest(command: string, saveOk: (path: string, quoted: boolean) => boolean): CurlRequest | null {
+  const parsed = plainWords(command);
+  if (!parsed || parsed.words[0] !== "curl") return null;
+  const { words, quoted } = parsed;
+  let sends = false;
+  let method: string | null = null;
+  let head = false;
+  let data = false;
+  let redirects = false;
+  let extras = false;
+  let host: string | null = null;
+  let output: string | null = null;
+  let outputs = 0;
+  for (let i = 1; i < words.length; i++) {
+    const w = words[i]!;
+    const value = words[i + 1];
+    if (!w.startsWith("-")) {
+      if (host !== null) return null;
+      host = publicHost(w);
+      if (host === null) return null;
+    } else if (/^-[A-Za-z]+$/.test(w) && [...w.slice(1)].every((c) => DOWNLOAD_SHORT.includes(c) || c === "L")) {
+      if (w.includes("L")) redirects = sends = true;
+      if (w.includes("I")) head = true;
+    } else if (w === REDIRECT_SWITCH) {
+      redirects = sends = true;
+    } else if (DOWNLOAD_SWITCHES.has(w)) {
+      if (w === "--head") head = true;
+    } else if (OUTPUT.has(w)) {
+      if (value === undefined || (value !== "-" && !saveOk(value, quoted[i + 1]!))) return null;
+      output = value === "-" ? null : value;
+      outputs++;
+      i++;
+    } else if (DOWNLOAD_VALUED.has(w)) {
+      if (value === undefined || !DOWNLOAD_VALUED.get(w)!(value)) return null;
+      i++;
+    } else if (SEND_VALUED.has(w)) {
+      if (value === undefined || !SEND_VALUED.get(w)!(value)) return null;
+      if (w === "-X" || w === "--request") method = value;
+      if (DATA.has(w)) data = true;
+      if (w !== "-X" && w !== "--request") extras = true;
+      sends = true;
+      i++;
+    } else {
+      return null;
+    }
+  }
+  if (host === null || outputs > 1) return null;
+  return { kind: sends ? "web" : "download", method: method ?? (data ? "POST" : head ? "HEAD" : "GET"), host, output, redirects, extras };
+}
+
+
+// Where curl reads a config file without being told to (curl -q is the only way to skip it). A config can add data,
+// uploads or a login to every request, so while one exists a download is never run without a card.
+export function curlConfigFiles(home: string, env: Record<string, string | undefined>): string[] {
+  const files = [`${home}/.curlrc`, `${home}/.config/curlrc`, `${home}/.config/.curlrc`];
+  if (env.CURL_HOME) files.push(`${env.CURL_HOME}/.curlrc`);
+  if (env.XDG_CONFIG_HOME) files.push(`${env.XDG_CONFIG_HOME}/curlrc`, `${env.XDG_CONFIG_HOME}/.curlrc`);
+  return files;
+}

package/src/computer.ts

@@ -4,6 +4,7 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, posix, relative, sep } from "node:path";
 import type * as acp from "@agentclientprotocol/sdk";
 import type { SeenCall } from "./acp.ts";
+import { curlConfigFiles, curlRequest, publicHost } from "./computer-web.ts";
 
 // Computer mode (crew-runner start --computer): the owner's @mac agent works on this computer with Claude Code's own
 // tools, inside allowlisted folders. Every tool request Claude Code asks about comes here. Allowed work runs; a guarded
@@ -11,18 +12,27 @@ import type { SeenCall } from "./acp.ts";
 // policy cannot read with certainty asks the owner. It never picks an "always" option.
 
 // `caseless`: the file system ignores letter case (macOS and Windows by default), so ~/crewcortex is ~/CrewCortex.
-export type Folders = { home: string; crewRoot: string; workspaceRoot: string; allowed: string[]; caseless: boolean };
+// `curlConfig`: files curl reads by itself; while one exists no web request runs or is covered without a card.
+export type Folders = { home: string; crewRoot: string; workspaceRoot: string; allowed: string[]; caseless: boolean; curlConfig: string[] };
 export type Category = "delete" | "git_push" | "send" | "payment" | "outside_folder" | "other";
-export type Verdict = { kind: "allow" } | { kind: "deny"; reason: string } | { kind: "ask"; category: Category; detail: string };
+// `grant`: the owner may answer this card with "Allow for this task", which then covers later steps with exactly the same
+// grant in the same run. Only web requests that send nothing but what their own command line shows get one, keyed by
+// kind and host (and method for curl): "search", "fetch:<host>", "curl:<METHOD>:<host>". A search never covers a curl.
+export type Grant = string;
+type Ask = { kind: "ask"; category: Category; detail: string; grant?: Grant };
+type NotAllowed = { kind: "deny"; reason: string } | Ask;
+// `download`: a public download that runs without a card only until the run has read anything on this computer; `card`
+// is what it asks after that, and `file` the real path it saves to.
+export type Verdict = { kind: "allow"; download?: { file: string | null; card: NotAllowed } } | NotAllowed;
 
 const SLUG = /^[a-z0-9][a-z0-9-]{0,62}$/;
 
 // The three folders Haydo approved: his dev projects, Downloads, and this workspace's own folder under ~/CrewCortex.
-export function computerFolders(slug: string, home = homedir(), caseless = process.platform !== "linux"): Folders {
+export function computerFolders(slug: string, home = homedir(), caseless = process.platform !== "linux", env: Record<string, string | undefined> = process.env): Folders {
   if (!SLUG.test(slug)) throw new Error("bad workspace slug");
   const crewRoot = join(home, "CrewCortex");
   const workspaceRoot = join(crewRoot, slug);
-  return { home, crewRoot, workspaceRoot, allowed: [join(home, ".cursor", "dev projects"), join(home, "Downloads"), workspaceRoot], caseless };
+  return { home, crewRoot, workspaceRoot, allowed: [join(home, ".cursor", "dev projects"), join(home, "Downloads"), workspaceRoot], caseless, curlConfig: curlConfigFiles(home, env) };
 }
 
 // Creates this workspace's folder (owner-only mode) and refuses one that is a link to somewhere else, or one holding
@@ -91,6 +101,18 @@ export function place(f: Folders, raw: string): Place {
   }) ? "allowed" : "outside";
 }
 
+// A file a download may be saved to: an absolute or unquoted ~/ path inside this workspace's own folder (not Downloads or
+// dev projects, and never a repository's .git or Claude Code's files).
+function savesInWorkspace(f: Folders, raw: string, quoted: boolean): boolean {
+  if (!fixedPath(raw) || (quoted && raw.startsWith("~")) || place(f, raw) !== "allowed") return false;
+  const p = resolved(f, raw);
+  const own = real(f.workspaceRoot);
+  return p !== null && own !== null && inside(f, p, own) && p !== own;
+}
+
+// The real location of an absolute or ~/ path, or null.
+const resolved = (f: Folders, raw: string): string | null => (fixedPath(raw) ? real(raw === "~" ? f.home : raw.startsWith("~/") ? `${f.home}${sep}${raw.slice(2)}` : raw) : null);
+
 const field = (v: unknown, key: string): unknown => (v && typeof v === "object" ? (v as Record<string, unknown>)[key] : undefined);
 const str = (v: unknown): string | null => (typeof v === "string" && v.length > 0 ? v : null);
 
@@ -161,19 +183,32 @@ function categoryOf(command: string): Category {
 // A command's relative paths and its no-path form read the shell's current folder, which Claude Code can change by
 // itself (it runs some cd commands without asking), so they are never auto-allowed. Only absolute or ~/ paths that
 // resolve into the allowed folders run without asking.
-export function judgeCommand(f: Folders, command: string): Verdict {
-  const v = commandVerdict(f, command);
+// `plainInput`: the step carries nothing but its command, a description and a timeout (not a background run).
+export function judgeCommand(f: Folders, command: string, plainInput = true): Verdict {
+  const v = commandVerdict(f, command, plainInput);
   return fits(v.kind === "ask" && mentionsOtherWorkspace(f, command) ? { kind: "deny", reason: OTHER_WORKSPACE } : v);
 }
 
 const fixedPath = (p: string) => isAbsolute(p) || p === "~" || p.startsWith("~/");
 
-function commandVerdict(f: Folders, command: string): Verdict {
-  const ask = (): Verdict => ({ kind: "ask", category: categoryOf(command), detail: `${command} (the shell starts in an empty scratch folder)` });
+function commandVerdict(f: Folders, command: string, plainInput: boolean): Verdict {
+  const ask = (): Ask => ({ kind: "ask", category: categoryOf(command), detail: `${command} (the shell starts in an empty scratch folder)` });
   const tokens = command.trim().split(/ +/).filter(Boolean);
   // Another workspace's folder and Claude Code's own files are never touched, whatever the command or argument.
   const refused = refusal(tokens.slice(1).filter((t) => !t.startsWith("-")).map((t) => place(f, t)));
   if (refused) return refused;
+  // A web request curl reads no config file for: a public download runs, one that sends its own text can be allowed for the
+  // task, for its method and host.
+  const web = f.curlConfig.some((file) => existsSync(file)) ? null : curlRequest(command, (p, quoted) => savesInWorkspace(f, p, quoted));
+  if (web) {
+    const card: Ask = { kind: "ask", category: "send", detail: ask().detail, grant: `curl:${web.method}${web.redirects ? "+L" : ""}${web.extras ? "+D" : ""}:${web.host}` };
+    // A download saves only to a new file: curl leaves an existing file as it was when the request fails, and the run
+    // would then read the owner's file as if it were a downloaded page.
+    const file = web.output ? resolved(f, web.output) : null;
+    const fresh = file === null ? web.output === null : !lstatSync(file, { throwIfNoEntry: false });
+    if (web.kind === "download" && plainInput && fresh) return { kind: "allow", download: { file, card: fits(card) as NotAllowed } };
+    return card;
+  }
   if (tokens.length === 0 || SHELL_SPECIAL.test(command) || /[^\x20-\x7e]/.test(command)) return ask();
   const [prog, ...args] = tokens as [string, ...string[]];
   if (NO_FILES.has(prog)) return { kind: "allow" };
@@ -201,6 +236,38 @@ export function judge(f: Folders, p: acp.RequestPermissionRequest, calls: Readon
   return fits(withInput(judgeRequest(f, p, calls), p, calls, f));
 }
 
+// What one run has done so far that changes what may run without a card. Kept in that run's memory only.
+export type RunMemory = { readLocal: boolean; downloaded: Set<string> };
+export const newRunMemory = (): RunMemory => ({ readLocal: false, downloaded: new Set() });
+
+// Once a run has read anything on this computer (other than pages it downloaded itself), a download's address could carry
+// what it read out, so from then on a download gets a card like any other web request.
+export function judgeInRun(f: Folders, p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>, mem: RunMemory): Verdict {
+  const v = judge(f, p, calls);
+  return v.kind === "allow" && v.download && mem.readLocal ? v.download.card : v;
+}
+
+// Records a step that was allowed (with or without a card). Planning, web requests, a page this run downloaded, writing a
+// new whole file and reading a page this run downloaded read nothing of the computer; anything else counts as a local read.
+export function noteAllowed(f: Folders, p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>, v: Verdict, mem: RunMemory): void {
+  if (v.kind === "allow" && v.download) {
+    if (v.download.file) mem.downloaded.add(v.download.file);
+    return;
+  }
+  // A web request's answer comes from the web, except one that followed redirects (it may have reached a local address).
+  if (v.kind === "ask" && v.grant && !v.grant.includes("+L")) return;
+  const raw = p.toolCall.rawInput ?? calls.get(p.toolCall.toolCallId)?.rawInput;
+  const kind = p.toolCall.kind;
+  if (kind === "think") return;
+  if (kind === "edit" && typeof field(raw, "content") === "string" && field(raw, "old_string") === undefined) return;
+  if (kind === "read") {
+    const paths = toolPaths(raw);
+    const at = paths.length === 1 ? resolved(f, paths[0]!) : null;
+    if (at !== null && mem.downloaded.has(at)) return;
+  }
+  mem.readLocal = true;
+}
+
 // A card shows the whole request, not a summary: every input field the tool was given (a command's own text is already
 // the detail). With fits(), a request too large to show in full is refused instead of approved unseen.
 function withInput(v: Verdict, p: acp.RequestPermissionRequest, calls: ReadonlyMap<string, SeenCall>, f: Folders): Verdict {
@@ -235,6 +302,8 @@ function mentionsOtherWorkspace(f: Folders, text: string): boolean {
   return false;
 }
 
+const PLAIN_EXEC_KEYS = new Set(["command", "description", "timeout"]);
+
 // The only inputs a planning step may carry and still run without a card.
 const SUBAGENT_KEYS = new Set(["description", "prompt", "subagent_type", "model", "run_in_background"]);
 function thinkOnly(raw: unknown): boolean {
@@ -258,12 +327,19 @@ function judgeRequest(f: Folders, p: acp.RequestPermissionRequest, calls: Readon
     case "switch_mode":
       // Leaving plan mode could apply a mode Claude Code suggests (auto-accept or bypass). Computer mode never switches.
       return { kind: "deny", reason: "Computer mode does not change how steps are approved." };
-    case "fetch":
-      // A web address or search can carry data out, so the owner sees it first.
-      return { kind: "ask", category: "send", detail: `Open on the web: ${str(field(raw, "url")) ?? str(field(raw, "query")) ?? title}` };
+    case "fetch": {
+      // A web address or search can carry data out, so the owner sees it first. A public address or a search can be
+      // allowed for the task; a local address never is.
+      const url = str(field(raw, "url"));
+      const query = str(field(raw, "query"));
+      const host = url ? publicHost(url) : null;
+      const grant = host ? { grant: `fetch:${host}` } : !url && query !== null ? { grant: "search" } : {};
+      return { kind: "ask", category: "send", detail: `Open on the web: ${url ?? query ?? title}`, ...grant };
+    }
     case "execute": {
       const command = str(field(raw, "command"));
-      return command ? judgeCommand(f, command) : { kind: "ask", category: "other", detail: title };
+      const plainInput = typeof raw === "object" && raw !== null && Object.keys(raw as object).every((k) => PLAIN_EXEC_KEYS.has(k));
+      return command ? judgeCommand(f, command, plainInput) : { kind: "ask", category: "other", detail: title };
     }
     case "read":
     case "search": {
@@ -319,6 +395,9 @@ export function computerPrompt(f: Folders, slug: string): string {
     "Never open, read or copy another workspace's folder under ~/CrewCortex, and never put another workspace's information in your reply.",
     "Before deleting anything, git push, sending email or messages outside CrewCortex, buying or paying, or changing files outside the",
     "allowed folders, the runner asks your owner on CrewCortex and waits. If the answer is no, stop that step and say so.",
+    `To read a public web page, use one plain command with no pipes: curl -s "<https address>" or curl -s "<https address>" -o ${f.workspaceRoot}/<file>.`,
+    "That runs without asking until you have read files on this computer; download what you need first. Following redirects (-L),",
+    "sending data, logins, uploads or saving elsewhere asks first.",
     "Your final reply is posted in the channel you were tagged in. Keep it short, and never include passwords, keys or tokens.",
   ].join("\n");
 }

package/src/studio-audio-admission.ts

@@ -1,11 +1,14 @@
+import { SOURCE_SECONDS } from "./studio-source.ts";
 // V2 only. Decode clocks, not NET duration/sample counts: overlaps must never
 // cancel a positive gap. AAC-LC has bounded decoded frames; other codecs need
 // their own reviewed frame contract before using timestamp-fill resampling.
 const RATES = [8000, 11025, 12000, 16000, 22050, 24000, 32000, 44100, 48000, 64000, 88200, 96000];
 export const AUDIO_CLOCK_HZ = 28_224_000; // LCM of admitted rates; exact sample durations.
 const MAX_SILENCE_SECONDS = 2;
-const MAX_FRAMES = 600_000; // >90min at 96kHz/1024, including priming/edit-list edges.
-export const AUDIO_SCAN_BYTES = 192 * 1024 ** 2;
+// Three hours at 96kHz/1024 is 1,012,500 frames; the rest is priming/edit-list edges.
+const MAX_FRAMES = 1_100_000;
+// Streamed per line, never held: a byte counter on the decoder log (about 300 bytes a frame), not memory.
+export const AUDIO_SCAN_BYTES = 384 * 1024 ** 2;
 type AudioStream = { codec_name?: string; profile?: string; sample_rate?: string; channels?: number };
 
 export function sourceAudioAdmission(streams: AudioStream[]) {
@@ -29,7 +32,7 @@ export function sourceAudioAdmission(streams: AudioStream[]) {
       if (records.length !== markers.length) throw new Error("Unsupported V2 source audio: invalid decoded clock");
       for (const m of records) {
         const n = Number(m[1]), pts = Number(m[2]), actualChannels = Number(m[4]), actualRate = Number(m[5]), samples = Number(m[6]);
-        if (n !== count || !Number.isSafeInteger(pts) || Math.abs(pts) > 5401 * AUDIO_CLOCK_HZ || m[3] !== "fltp" || actualChannels !== channels || actualRate !== rate || !Number.isInteger(samples) || samples < 1 || samples > 1024 || ++count > MAX_FRAMES) {
+        if (n !== count || !Number.isSafeInteger(pts) || Math.abs(pts) > (SOURCE_SECONDS + 1) * AUDIO_CLOCK_HZ || m[3] !== "fltp" || actualChannels !== channels || actualRate !== rate || !Number.isInteger(samples) || samples < 1 || samples > 1024 || ++count > MAX_FRAMES) {
           throw new Error(`Unsupported V2 source audio: decoded frame/rate/channel/count limit (frame ${n}/${count}, PTS ${pts}, ${m[3]}, ${actualRate}Hz/${actualChannels}ch, ${samples} samples)`);
         }
         // Adjacent decoded frames, not max(end) or NET coverage. A backwards

package/src/studio-source.ts

@@ -10,11 +10,21 @@ export type SourcePlan = {
 };
 export type SourceSegment = SourceSpan & { outputStart: number; mute: boolean; frame?: number };
 export const SOURCE_FPS = 30;
-export const SOURCE_SECONDS = 5400;
-export const SOURCE_BYTES = 2 * 1024 ** 3;
+// A recording of up to three hours and 6 GiB (a raw 1080p webinar is about 1 to 3 GB an hour). Only a hosted job's own
+// deadline can afford that much work; the local limits stop long before.
+export const SOURCE_SECONDS = 10_800;
+export const SOURCE_BYTES = 6 * 1024 ** 3;
 // Every other media file the engine reads (an intro, a supporting asset).
 export const MEDIA_BYTES = 100 * 1024 * 1024;
 export const EXPORT_BYTES = 512 * 1024 ** 2;
+// A hosted export of a long programme: under one object PUT (5 GiB), and the encoder's peak rate is sized to fit it.
+export const HOSTED_EXPORT_BYTES = 4 * 1024 ** 3;
+// A hosted job's clock and scratch budget (studio.ts checks hosted limits against them; the worker passes them).
+export const HOSTED_MAX_JOB_MS = 4 * 3_600_000;
+export const HOSTED_INTERMEDIATE_BYTES = 16 * 1024 ** 3;
+// Every 30-second unit of a three-hour programme (360), one more for each of up to 193 kept intervals between edit
+// boundaries (32 cuts, mutes and holds each), and an intro's units.
+export const SEGMENT_BUDGET = 576;
 function fields(v: unknown, keys: string[], required = keys): Record<string, unknown> {
   if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("Invalid source plan object");
   const o = v as Record<string, unknown>;
@@ -22,7 +32,7 @@ function fields(v: unknown, keys: string[], required = keys): Record<string, unk
   return o;
 }
 function time(v: unknown): number {
-  if (typeof v !== "number" || !Number.isFinite(v) || v < 0 || v > SOURCE_SECONDS || Math.abs(v * SOURCE_FPS - Math.round(v * SOURCE_FPS)) > 0.000001) throw new Error("Source times must lie on the 30fps output grid within 90 minutes");
+  if (typeof v !== "number" || !Number.isFinite(v) || v < 0 || v > SOURCE_SECONDS || Math.abs(v * SOURCE_FPS - Math.round(v * SOURCE_FPS)) > 0.000001) throw new Error("Source times must lie on the 30fps output grid within 3 hours");
   return v;
 }
 export function validateSourcePlan(value: unknown, mediaName: (v: unknown) => string): SourcePlan {
@@ -72,6 +82,6 @@ export function compileSourcePlan(p: SourcePlan, introFrames = 0): SourceSegment
       outputFrames += Math.round((to-from)*30);
     }
   }
-  if (result.length > 384) throw new Error("Source plan segment budget exceeded");
+  if (result.length > SEGMENT_BUDGET) throw new Error("Source plan segment budget exceeded");
   return result;
 }

package/src/studio.ts

@@ -5,18 +5,21 @@ import { isAbsolute, join, resolve, relative } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { killTree } from "./spawn.ts";
 import { sourceAudioAdmission, AUDIO_CLOCK_HZ, AUDIO_SCAN_BYTES } from "./studio-audio-admission.ts";
-import { validateSourcePlan, compileSourcePlan, SOURCE_SECONDS, SOURCE_BYTES, EXPORT_BYTES, MEDIA_BYTES, type SourcePlan } from "./studio-source.ts";
+import { validateSourcePlan, compileSourcePlan, SOURCE_SECONDS, SOURCE_BYTES, EXPORT_BYTES, HOSTED_EXPORT_BYTES, HOSTED_INTERMEDIATE_BYTES, HOSTED_MAX_JOB_MS, MEDIA_BYTES, SEGMENT_BUDGET, type SourcePlan } from "./studio-source.ts";
 
 export type StudioGrant = Readonly<{ root: string; enabled: boolean; expiresAt: number }>;
 // The local CLI and MCP bridge always use LOCAL_LIMITS. A hosted edit runs alone on a disposable machine that is
-// destroyed after the job, so it may pass larger limits, never beyond HOSTED_MAX_JOB_MS or the 512 MiB export cap.
+// destroyed after the job, so it may pass larger limits, never beyond HOSTED_MAX_JOB_MS, HOSTED_EXPORT_BYTES or
+// HOSTED_INTERMEDIATE_BYTES.
 export type StudioLimits = Readonly<{ jobMs: number; unitMs: number; threads: number; height: 720 | 1080; intermediateBytes: number; exportBytes: number }>;
 export const LOCAL_LIMITS: StudioLimits = Object.freeze({ jobMs: 900_000, unitMs: 90_000, threads: 2, height: 720, intermediateBytes: EXPORT_BYTES, exportBytes: EXPORT_BYTES });
-export const HOSTED_MAX_JOB_MS = 2 * 3_600_000;
+// Sized from a measured hosted render (75 minutes of 1080p30 took 37 minutes, about half real time, on 4 dedicated CPUs): a
+// three-hour recording plus its download fits with room for slower footage.
+export { HOSTED_MAX_JOB_MS, HOSTED_INTERMEDIATE_BYTES };
 const int = (v: unknown, min: number, max: number) => typeof v === "number" && Number.isSafeInteger(v) && v >= min && v <= max;
 function checkLimits(l: StudioLimits): StudioLimits {
   if (!int(l.jobMs, 60_000, HOSTED_MAX_JOB_MS) || !int(l.unitMs, 10_000, 600_000) || !int(l.threads, 1, 8) || (l.height !== 720 && l.height !== 1080)
-    || !int(l.intermediateBytes, 1, 4 * 1024 ** 3) || !int(l.exportBytes, 1, EXPORT_BYTES)) throw new Error("Invalid studio limits");
+    || !int(l.intermediateBytes, 1, HOSTED_INTERMEDIATE_BYTES) || !int(l.exportBytes, 1, HOSTED_EXPORT_BYTES)) throw new Error("Invalid studio limits");
   return Object.freeze({ jobMs: l.jobMs, unitMs: l.unitMs, threads: l.threads, height: l.height, intermediateBytes: l.intermediateBytes, exportBytes: l.exportBytes });
 }
 type Span = { start: number; end: number };
@@ -164,7 +167,7 @@ export async function openStudio(input: StudioGrant, limitsInput: StudioLimits =
     return safe(BASE, true);
   };
   const probeFile = async (path: string, signal?: AbortSignal, expected?: number, long = false, grant = g, expectedAudio = true): Promise<Media> => {
-    const maxBytes = long ? (expected === undefined ? SOURCE_BYTES : EXPORT_BYTES) : MAX_BYTES;
+    const maxBytes = long ? (expected === undefined ? SOURCE_BYTES : Math.max(EXPORT_BYTES, limits.exportBytes)) : MAX_BYTES;
     const maxSeconds = long ? SOURCE_SECONDS : MAX_SECONDS;
     const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
     try {
@@ -259,7 +262,7 @@ export async function openStudio(input: StudioGrant, limitsInput: StudioLimits =
         const media = await probeFile(join(dir, "intro.mp4"), options.signal, undefined, true, jobGrant);
         const frames = Math.floor(media.videoDuration * 30 + 1e-6);
         if (!frames) throw new Error("Intro has no whole output frame");
-        if (mapping!.reduce((n, s) => n + s.end - s.start, 0) + frames / 30 > SOURCE_SECONDS) throw new Error("Edited programme plus intro exceeds 90 minutes");
+        if (mapping!.reduce((n, s) => n + s.end - s.start, 0) + frames / 30 > SOURCE_SECONDS) throw new Error("Edited programme plus intro exceeds 3 hours");
         intro = { path: sourcePlan.intro, sha256: sha(bytes), frames, media };
       }
       // Snapshot in bounded chunks, hash exactly the bytes the encoder will read.
@@ -309,7 +312,7 @@ export async function openStudio(input: StudioGrant, limitsInput: StudioLimits =
       }
       const introUnits = intro ? Array.from({ length: Math.ceil(intro.frames / 900) }, (_, i) => ({ start: i * 30, end: Math.min(intro!.frames, (i + 1) * 900) / 30, mute: false, frame: undefined, file: "intro.mp4", media: intro!.media, intro: true })) : [];
       const segments = [...introUnits, ...p.cuts.map((cut, i) => ({ ...cut, mute: mapping?.[i]?.mute ?? false, frame: mapping?.[i]?.frame, file: "source.mp4", media: sourceMedia, intro: false }))];
-      if (segments.length > 384) throw new Error("Source plan segment budget exceeded");
+      if (segments.length > SEGMENT_BUDGET) throw new Error("Source plan segment budget exceeded");
       if (p.supportingAsset) segments.push({ start: p.supportingAsset.start, end: p.supportingAsset.end, mute: false, frame: undefined, file: "asset.mp4", media: await probeFile(join(dir, "asset.mp4"), options.signal), intro: false });
       const height = options.preview ? 360 : limits.height, width = height * 16 / 9;
       let intermediateBytes = 0;
@@ -375,7 +378,13 @@ export async function openStudio(input: StudioGrant, limitsInput: StudioLimits =
         audioInput.push(...(intro.media.hasAudio ? ["-threads", t, "-protocol_whitelist", "file", "-format_whitelist", "mov", "-i", "intro.mp4"] : ["-f", "lavfi", "-i", "anullsrc=r=48000:cl=stereo"]));
         graph = ["-filter_complex_threads", t, "-filter_complex", `[0:v]${filters.join(",")}[v];[2:a]aresample=48000:async=1:min_hard_comp=0.001:first_pts=0,${stereo},apad=whole_len=${samples},atrim=end_sample=${samples},asetpts=N/SR/TB[i];[1:a]${audioFilter},${stereo}[s];[i][s]concat=n=2:v=0:a=1[a]`, "-map", "[v]", "-map", "[a]"];
       }
-      await command("ffmpeg", ["-hide_banner", "-loglevel", "error", "-nostdin", "-n", "-threads", t, "-filter_threads", t, "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-reinit_filter", "0", "-i", "concat.txt", ...audioInput, ...(sourcePlan ? [] : ["-t", String(timeline)]), ...graph, "-r", "30", "-fps_mode", "cfr", "-c:v", "libx264", "-threads", t, "-preset", "veryfast", "-crf", "20", "-pix_fmt", "yuv420p", "-c:a", "aac", "-ar", "48000", "-ac", "2", "-b:a", "128k", "-movflags", "+faststart", "-fs", String(exportBudget), "export.mp4"], dir, jobGrant, options.signal, sourcePlan ? longMs : TIMEOUT);
+      // A long v2 programme gets a peak video rate that keeps the whole export inside its budget (128k audio and container
+      // overhead set aside), so a dense hour cannot run into -fs and be refused at the end. Where the budget cannot bind at
+      // any rate CRF 20 reaches (short and local exports) the argv is unchanged.
+      const peak = sourcePlan ? Math.floor(exportBudget * 8 * 0.9 / timeline) - 200_000 : Infinity;
+      if (peak < 600_000) throw new Error("The export budget is too small for this programme length");
+      const peakRate = peak < 12_000_000 ? ["-maxrate", String(peak), "-bufsize", String(2 * peak)] : [];
+      await command("ffmpeg", ["-hide_banner", "-loglevel", "error", "-nostdin", "-n", "-threads", t, "-filter_threads", t, "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-reinit_filter", "0", "-i", "concat.txt", ...audioInput, ...(sourcePlan ? [] : ["-t", String(timeline)]), ...graph, "-r", "30", "-fps_mode", "cfr", "-c:v", "libx264", "-threads", t, "-preset", "veryfast", "-crf", "20", ...peakRate, "-pix_fmt", "yuv420p", "-c:a", "aac", "-ar", "48000", "-ac", "2", "-b:a", "128k", "-movflags", "+faststart", "-fs", String(exportBudget), "export.mp4"], dir, jobGrant, options.signal, sourcePlan ? longMs : TIMEOUT);
       const output = await probeFile(join(dir, "export.mp4"), options.signal, timeline, !!sourcePlan, jobGrant);
       const outputFile = await open(join(dir, "export.mp4"), constants.O_RDONLY | constants.O_NOFOLLOW);
       const outputHash = createHash("sha256");