oh-my-agent-commandcode 0.0.0-stage → 20.38.3

package/skills/oma-video/resources/prompt-tips.md

@@ -0,0 +1,75 @@
+# Prompt Tips
+
+A good video brief specifies the **mode**, the **topic/source**, and the
+**arc** (what the viewer should feel/learn). The brief drives the script; the
+script's per-scene `visual.prompt` then drives oma-image (English prompts —
+image models are trained predominantly on English captions).
+
+## Brief structure
+
+```
+Mode + audience → Topic/source → Arc (hook → body → payoff) → Tone/pacing
+```
+
+Example (shorts): `30s vertical short for a dev audience: how oma-video turns a topic into a finished clip; hook with the pain, show the 3-step flow, end on the one-command CTA; upbeat, fast cuts`
+
+## Per-mode guidance
+
+### shorts (9:16)
+- **Hook in the first 1.5s** — the first scene's on-screen text must earn the swipe.
+- Keep scenes 2–4s; favor 6–10 scenes for a 30s clip (≤ `max_scenes` 40).
+- oma-image stills stay static (no Ken Burns) — write prompts that frame one clear subject.
+- TikTok captions are centered, static windowed cues (one SRT cue on screen at a time, CSS-wrapped — no per-word animation); keep narration lines short (≤ ~8 words/segment) so cues switch cleanly.
+
+### explainer (16:9 / 9:16)
+- Source is a README / code / data — point the brief at the file and the *one* thing to teach.
+- Mix oma-slide frames (structure, bullet beats) with oma-image diagrams (concepts) and code frames.
+- Code frames use one fixed deterministic theme (v1). Keep snippets short and legible at 1920×1080.
+- Narration should explain *why*, not read the code line-by-line.
+- One diagram per scene, about 15–20s each; see `motion-principles.md` for the scene cast and diagram steps.
+
+### demo (16:9)
+- The visual is a human-recorded capture (`--capture`). The brief drives the zoom/callout beats and outro.
+- Call out *where to look* on screen — HyperFrames adds zoom + callouts over the capture.
+- Open on the product; add a title card only when the user asks for one.
+
+## Per-scene image prompts (oma-image)
+
+The script's `scenes[].visual.prompt` is forwarded to oma-image. Write them with
+the same structure oma-image expects:
+
+```
+Scene/backdrop → Subject → Details → Constraints
+```
+
+| Mode | Example per-scene prompt |
+|------|--------------------------|
+| shorts | `Aerial drone shot of Jeju coastline, turquoise water meeting volcanic rock, golden hour, vertical composition with headroom for a slow zoom` |
+| shorts | `Close-up of a hand pouring espresso into a glass over ice, warm cafe light, shallow depth of field` |
+| explainer | `Clean isometric diagram of a 3-stage pipeline (script → assets → render), flat vector, labeled boxes, neutral background` |
+| demo | `Minimal title card: product name centered, dark UI background, subtle accent gradient, 16:9` |
+
+## Do's
+
+- Anchor the **arc**: hook → body → payoff. A short without a hook gets swiped past.
+- Match **aspect to mode** (9:16 shorts, 16:9 explainer/demo) or use `auto`.
+- Keep narration **per-scene and short** so caption pages and scene boundaries align.
+- Pick **music** that matches pacing (`upbeat` for shorts, `calm` for explainer) — Strudel renders the bed offline and mixes it at −18 dB under narration. Needs a one-time `oma video doctor --install-strudel`; without it the run still succeeds, just silent.
+
+## Don'ts
+
+- Don't write a brief with no mode and no topic — the agent will have to clarify.
+- Don't request paid stock/AIGC visuals without the key — the chain silently falls back to oma-image stills (annotated in `warnings`), which may surprise you.
+- Don't exceed `max_duration_sec` (180) or `max_scenes` (40).
+- Don't put secrets in the brief unless `--no-brief-in-manifest` is set.
+
+## Localization
+
+- Narration + on-screen text are authored in `--locale`. For a non-source locale, oma-translation translates the script text before TTS/captions (key-free). If the translator is absent, the source text is kept and a warning is recorded.
+- oma-image prompts are sent in **English** regardless of `--locale`; translate the user's subject and show the translated prompt during amplification.
+
+## Determinism
+
+- `--seed <n>` makes the render reproducible. The same `render-spec.json` + assets + seed + embedded Pretendard font produce a byte-stable render. The font is fetched once by `oma video doctor --install`; if it is missing (e.g. the fetch ran offline), the render gracefully falls back to system fonts and byte-identical output is only guaranteed once the font is present.
+- Re-render an existing run with `oma video render <runDir>` — it consumes `render-spec.json` only, so script/voice/visual generation is not re-run.
+- `OMA_VIDEO_MOCK=1` replays golden fixtures for deterministic tests.

package/skills/oma-video/resources/script-schema.md

@@ -0,0 +1,81 @@
+# script.json Schema — agent-as-key authoring reference
+
+`oma video generate --script <path>` hard-validates the file against this
+schema (mirrors `cli/commands/video/types.ts` `ScriptSchema`). A mismatch is
+exit 4 (invalid-input) with the offending field named. **`schemaVersion` is
+required** — omitting it is the most common authoring failure.
+
+## Fields
+
+| Field | Type | Required | Notes |
+|-------|------|:---:|-------|
+| `schemaVersion` | `"1.0"` (literal) | ✅ | exactly the string `"1.0"` |
+| `mode` | `shorts` \| `explainer` \| `demo` | ✅ | must match the run's `--mode` |
+| `aspect` | `9:16` \| `16:9` \| `1:1` | ✅ | concrete value — `auto` is a CLI flag, not a script value |
+| `locale` | string (min 1) | ✅ | narration/caption language tag, e.g. `en`, `ko` |
+| `title` | string (min 1) | ✅ | also drives the output filename slug: `<mode>-<slug>.mp4` |
+| `scenes` | array (min 1, ≤ 40) | ✅ | see per-scene fields below |
+| `music` | `upbeat` \| `calm` \| `cinematic` \| `lofi` \| `piano` \| `none` | ✅ | drives the Strudel BGM bed; mixed at −18 dB under narration |
+| `brand` | object | — | free-form; defaults to `{}` |
+
+### Per-scene fields (`scenes[]`)
+
+| Field | Type | Required | Notes |
+|-------|------|:---:|-------|
+| `id` | string (min 1) | ✅ | convention: `scene-01`, `scene-02`, … |
+| `durationSec` | number > 0 | ✅ | sum ≤ 180 (`limits.max_duration_sec`); also anchors estimated caption timing |
+| `narration` | string | ✅ | may be `""` for a silent scene; keep ≤ ~8 words/segment for clean caption cues |
+| `onScreenText` | string[] | — | overlay lines; defaults to `[]` |
+| `visual` | object | ✅ | see below |
+| `visual.kind` | `still` \| `clip` \| `mixed` \| `slide` \| `capture` | ✅ | `still` (oma-image), `slide` (oma-slide, explainer), `capture` (demo footage), `clip`/`mixed` (stock/AIGC) |
+| `visual.prompt` | string | — | English image prompt forwarded to oma-image (see `prompt-tips.md`) |
+| `visual.ref` | string | — | reference to an existing asset (e.g. capture segment) |
+| `visual.source` | string | — | provenance marker (e.g. `agent-authored`) |
+| `transition` | string | — | transition-out hint |
+
+## Minimal valid example
+
+```json
+{
+  "schemaVersion": "1.0",
+  "mode": "shorts",
+  "aspect": "9:16",
+  "locale": "en",
+  "title": "Jeju coffee in 30 seconds",
+  "music": "none",
+  "brand": {},
+  "scenes": [
+    {
+      "id": "scene-01",
+      "durationSec": 3,
+      "narration": "Jeju's coffee scene is exploding.",
+      "onScreenText": ["JEJU ☕"],
+      "visual": {
+        "kind": "still",
+        "prompt": "Aerial drone shot of Jeju coastline at golden hour, vertical composition with headroom",
+        "source": "agent-authored"
+      }
+    },
+    {
+      "id": "scene-02",
+      "durationSec": 4,
+      "narration": "Volcanic soil, ocean air, and a cafe on every corner.",
+      "onScreenText": [],
+      "visual": {
+        "kind": "still",
+        "prompt": "Close-up of a hand pouring espresso over ice in a seaside cafe, warm light, shallow depth of field",
+        "source": "agent-authored"
+      }
+    }
+  ]
+}
+```
+
+## Authoring checklist
+
+- [ ] `schemaVersion: "1.0"` present (required literal).
+- [ ] `aspect` is concrete (`9:16` / `16:9` / `1:1`) — never `auto`.
+- [ ] Scene count ≤ 40, total `durationSec` ≤ 180.
+- [ ] Every scene has a `visual.kind` from the enum; `still` scenes carry an English `visual.prompt`.
+- [ ] `music` is set (use `"none"` unless the user asked for a bed).
+- [ ] Validate cheaply before rendering: pass the file via `--script` with `--dry-run` first.

package/skills/oma-video/resources/sound-design.md

@@ -0,0 +1,127 @@
+# Sound Effects and Soundtrack Listening
+
+Use this branch when a video needs sound effects, foley, ambience or a
+sound-designed soundtrack, or when the audio of a rendered or supplied video
+must be judged: sync to picture, loudness, mix, or a choice between candidate
+sounds. Narration, transcription and TTS stay with `oma-voice`; the Strudel
+music bed stays with the creation pipeline. Sound effects are off unless the
+brief asks for them or the user accepts a proposal.
+
+## Route to the upstream skill
+
+`Leonxlnx/earshot` ships two skills. Route each request to the one that
+supports it:
+
+| Request | Upstream skill | Upstream section |
+|---|---|---|
+| Effects for a generated video (ticks, pops, whooshes, hits, typing, a lockup) | `earshot` | Loop 5: `sfx` / `kit` |
+| Choose, trim or compare candidate sound files | `earshot` | Loop 1, Loop 3 |
+| Review a video's audio: events, sync, loudness, launch-film scorecard | `earshot` | Loop 2 |
+| Make a new sound in code, only when explicitly requested | `earshot` | Loop 4: `forge` |
+| A soundtrack from real licensed recordings (foley, ambience, a licensed music track) | `real-sound` | its full process |
+
+The shipped bank is made in code, not recorded. When the brief asks for
+recorded or real sound, route to `real-sound`; never present a bank take as a
+recording.
+
+1. Check the runtime skill catalog for `earshot` or `real-sound` from
+   `https://github.com/Leonxlnx/earshot`. Reuse its advertised installed
+   location and read its complete `SKILL.md` when available.
+2. If it is absent, load it without a persistent installation or another agent:
+
+   ```bash
+   bunx skills use Leonxlnx/earshot@earshot
+   bunx skills use Leonxlnx/earshot@real-sound
+   ```
+
+   Omit `--agent`. Read the emitted instructions and use the actual
+   supporting-files directory from the result for every relative path.
+   `real-sound` needs its complete `scripts/`, `templates/` and `references/`.
+3. A loaded skill is instructions, not the runtime. Resolve earshot in this
+   order: an already-connected earshot MCP server (discover its actual tools
+   before calling them), `EARSHOT_PYTHON`, `earshot` on PATH, then a Python
+   where `import earshot` succeeds. FFmpeg/FFprobe must be on PATH. Record the
+   resolved interpreter, the earshot version and the bank version from
+   `kit.lock.json`.
+4. If no runtime resolves, report the missing capability with the upstream
+   setup steps and stop this branch. Do not clone the repository, create a
+   virtual environment, install torch or fetch models without the user's
+   consent. The video can still render without effects; say so in the report.
+5. Follow the loaded upstream instructions for commands, flags, kit schema,
+   presets, roles, alignment, levels and QA thresholds. Do not copy its cookbook
+   into OMA resources.
+
+`sfx`, `kit` and `measure` load no models. `describe`, `match`, `rank`, `find`,
+`realness`, `timeline`, `sheet` and `critique` load CLAP and AST (about 1.1 GB
+on first use); for more than a few calls, use the MCP server or one Python
+process. `earshot llm` uploads audio to Google: run it only when a Gemini key is
+set and the user explicitly agreed to the upload. Never pass `--yes-upload` or
+`consent=true` on your own.
+
+## Bank effects in an OMA video
+
+OMA owns the cue times and the composition; earshot owns the voices.
+
+1. Take cue times from the picture: scene boundaries in `render-spec.json`
+   (`fromFrame / fps`), on-screen text entrances, transitions and the authored
+   GSAP tween times in `hyperframes/index.html`. Write them in the upstream cue
+   format at `<runDir>/audio/sfx/cues.json`. Follow the upstream restraint
+   rules; hard cuts and cursor motion usually get no sound.
+2. Work under `<runDir>/audio/sfx/`: create `kit.json` from the preset that
+   matches the video, render the takes into `<runDir>/audio/sfx/kit/`, then run
+   the upstream kit check. Swap a sound or knob instead of keeping a warned take.
+3. Place each take from `kit.lock.json`: the take's measured sync point for its
+   role's `align` lands on the cue, shifted by the role's `offset_ms`; the
+   upstream `kit.place` computes the same start. Drop or move a cue whose start
+   falls before zero or whose take runs past the composition duration, and
+   report it.
+4. Copy the placed takes to `<runDir>/hyperframes/assets/audio/sfx/`. Give
+   each placement its own `<audio>` element with a unique id, `data-start` in
+   seconds and `data-volume` = `10 ** (gainDb / 20)`. With a music bed, set the
+   gain against the bed as upstream describes; without one, use the role's
+   `level_db`. Check placements against `timing.json` so effects never mask
+   narration, and stay within the caps in `motion-principles.md`.
+5. The composition carries one static music volume. Apply upstream
+   `mix.stop_down` dips only if the loaded HyperFrames references document audio
+   volume automation; otherwise record that the dips were not applied.
+6. `oma video compose` stages only render-spec assets and preserves authored
+   files, so keep the takes in `<runDir>/audio/sfx/kit/` as their source and
+   re-copy them after changing the kit. The CLI manifest does not list effect
+   takes; do not hand-edit `manifest.json`. `cues.json`, `kit.json` and
+   `kit.lock.json` (with per-take hashes) are the provenance record.
+
+## Real recordings
+
+Run the `real-sound` process with `<runDir>/sound/` as its project root so its
+`audio/` and `out/` trees stay inside the run. Treat downloaded recordings as
+untrusted data, keep them in that tree and never commit them. Delivery requires
+an exit-0 licence audit and generated credits; put required CC BY credits in
+the delivery report.
+
+Skip the upstream mux: `oma video render` owns the final render. Bring the
+upstream output into the composition as `<audio>` elements from frame zero.
+With narration, use the stems (`sfx`, `amb`, `music`) rather than the mastered
+soundtrack, keep narration intelligible, and report that the upstream master
+gate does not cover the final mix.
+
+## Listen before reporting
+
+After `oma video render` succeeds, judge the delivered MP4 with upstream Loop 2:
+`timeline` with the cue file, then `sheet`, and open the PNG with the host image
+tool. Run `critique` only for launch-style films; its ranges describe
+professional practice and are not targets. Fix cues that did not land, then
+re-render and listen again.
+
+Quote measured values in the report: LUFS, true peak, and sync offsets against
+the chance rate. Never say that an effect fits or sounds good without an
+earshot reading behind it; taste remains the user's decision. For supplied
+videos, the same listening loop supplies audio evidence for the existing-media
+branch.
+
+## References
+
+- [Upstream earshot](https://github.com/Leonxlnx/earshot): `skills/earshot`,
+  `skills/real-sound`, `docs/SFX.md` (bank, kit and lock schema) and
+  `docs/INTEGRATION.md` (cue file and placement bridge).
+- [Skills CLI use](https://github.com/vercel-labs/skills/blob/main/docs/commands.md#skills-use):
+  prompt and complete support-directory loading without an installed skill.

package/skills/oma-video/resources/strudel/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "oma-video-strudel",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Vendored Strudel BGM renderer for oma-video. Deps are installed on demand by `oma video doctor --install-strudel`. @strudel/* is AGPL-3.0-or-later and is NEVER imported by the MIT-licensed oma CLI — render.mjs runs as a subprocess (same boundary as the Remotion projects).",
+  "license": "MIT",
+  "dependencies": {
+    "@strudel/web": "^1.3.0"
+  }
+}

package/skills/oma-video/resources/strudel/page.html

@@ -0,0 +1,87 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>oma-video strudel offline render</title>
+  </head>
+  <body>
+    <!-- Served by render.mjs from the resolved @strudel/web dist. The IIFE
+         bundle exposes everything on `window.strudel` + `window.initStrudel`. -->
+    <script src="/strudel.js"></script>
+    <script>
+      window.__omaLog = [];
+      window.addEventListener('error', (e) =>
+        window.__omaLog.push('error: ' + e.message),
+      );
+      window.addEventListener('unhandledrejection', (e) =>
+        window.__omaLog.push('rejection: ' + (e.reason?.message ?? e.reason)),
+      );
+
+      /**
+       * Render `code` to a WAV and stash it on window as base64.
+       *
+       * `strudel.renderPatternAudio()` is a real OfflineAudioContext render
+       * (faster than realtime, no audio device involved) but it delivers the
+       * finished wav as a browser DOWNLOAD. Rather than plumb a download
+       * directory through CDP, we intercept URL.createObjectURL to capture the
+       * Blob in-page and hand the bytes back over the debugger protocol.
+       *
+       * Returns the base64 length; the driver pulls window.__omaWav in chunks.
+       */
+      window.__omaRender = async function (code, seconds, cps, sampleRate) {
+        await window.initStrudel();
+
+        // repl.evaluate(code, autostart=false) transpiles + evaluates without
+        // starting the realtime scheduler, and returns the Pattern itself.
+        const evaluated = await window.strudel.evaluate(code, false);
+        const pattern = evaluated?.pattern ?? evaluated;
+        if (!pattern || typeof pattern.queryArc !== 'function') {
+          throw new Error(
+            'strudel: pattern code did not evaluate to a Pattern (got ' +
+              typeof pattern +
+              ')',
+          );
+        }
+
+        let captured = null;
+        const realCreate = URL.createObjectURL.bind(URL);
+        const realRevoke = URL.revokeObjectURL.bind(URL);
+        URL.createObjectURL = (blob) => {
+          captured = blob;
+          return 'blob:oma-captured';
+        };
+        URL.revokeObjectURL = () => {};
+        try {
+          await window.strudel.renderPatternAudio(
+            pattern,
+            cps,
+            0,
+            seconds * cps,
+            sampleRate,
+            128,
+            false,
+            'oma-bgm',
+          );
+        } finally {
+          URL.createObjectURL = realCreate;
+          URL.revokeObjectURL = realRevoke;
+        }
+        if (!captured) {
+          throw new Error('strudel: renderPatternAudio produced no audio blob');
+        }
+
+        const bytes = new Uint8Array(await captured.arrayBuffer());
+        let binary = '';
+        const CHUNK = 0x8000; // stay under the String.fromCharCode arg limit
+        for (let i = 0; i < bytes.length; i += CHUNK) {
+          binary += String.fromCharCode.apply(
+            null,
+            bytes.subarray(i, i + CHUNK),
+          );
+        }
+        window.__omaWav = btoa(binary);
+        return window.__omaWav.length;
+      };
+    </script>
+  </body>
+</html>

package/skills/oma-video/resources/strudel/render.mjs

@@ -0,0 +1,295 @@
+#!/usr/bin/env node
+// Strudel BGM renderer — boundary-safe subprocess entrypoint.
+//
+// oma-video NEVER imports Strudel. @strudel/* is AGPL-3.0-or-later while the
+// oma CLI is MIT, so the TypeScript provider (`providers/music-strudel.ts` +
+// `internal/strudel-project.ts`) only ever LOCATES this project on disk and
+// spawns *this* script. Same boundary the Remotion projects use.
+//
+// MECHANISM: `@strudel/webaudio.renderPatternAudio()` renders a pattern through
+// an OfflineAudioContext — faster than realtime, no audio device, no autoplay
+// gesture. A 30s bed renders in well under a second. The bundle only runs in a
+// browser, so we drive a headless Chrome over raw CDP (Node's global WebSocket;
+// zero npm deps here beyond @strudel/web itself) and serve the bundle from a
+// loopback-only HTTP server.
+//
+// DETERMINISM: oscillator sounds (sine/triangle/square/sawtooth) render
+// byte-identically across runs. Noise-based sounds (white/pink/brown) do NOT —
+// superdough fills those buffers from Math.random(). Patterns that must be
+// reproducible should stay oscillator-only.
+//
+// Contract — flags in, ONE JSON result line out (stdout's LAST line):
+//   IN  --pattern-file <path>  file holding the strudel pattern code (required)
+//       --out <abs wav path>   output wav, inside a run dir (required)
+//       --chrome <path>        Chrome/Chromium executable (required)
+//       --seconds <float>      bed length in seconds (required)
+//       --cps <float>          cycles per second (default 0.5)
+//       --sample-rate <int>    default 44100
+//       --timeout <ms>         hard ceiling for the whole render (default 120000)
+//   OUT {"ok":true,"output":"<abs wav>","seconds":<f>,"bytes":<n>,"sha256":"<hex>"}
+//    |  {"ok":false,"error":"<message>","code":"<reason>"}
+//
+// Exit code is 0 on success, 1 on failure; the JSON result line is authoritative.
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const DIST = path.join(HERE, "node_modules", "@strudel", "web", "dist");
+
+const MIME = {
+  ".js": "text/javascript",
+  ".mjs": "text/javascript",
+  ".html": "text/html",
+  ".json": "application/json",
+  ".wasm": "application/wasm",
+};
+
+let server;
+let chrome;
+let userDataDir;
+let hardTimer;
+
+function fail(message, code = "render_failed") {
+  process.stdout.write(`${JSON.stringify({ ok: false, error: message, code })}\n`);
+  cleanup().finally(() => process.exit(1));
+}
+
+async function cleanup() {
+  if (hardTimer) clearTimeout(hardTimer);
+  try {
+    chrome?.kill("SIGTERM");
+  } catch {}
+  try {
+    server?.close();
+  } catch {}
+  if (userDataDir) {
+    await rm(userDataDir, { recursive: true, force: true }).catch(() => {});
+  }
+}
+
+function parseArgs(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (!token.startsWith("--")) continue;
+    const eq = token.indexOf("=");
+    if (eq !== -1) {
+      out[token.slice(2, eq)] = token.slice(eq + 1);
+    } else {
+      out[token.slice(2)] = argv[i + 1]?.startsWith("--") ? "" : argv[++i];
+    }
+  }
+  return out;
+}
+
+const args = parseArgs(process.argv.slice(2));
+const patternFile = args["pattern-file"];
+const outPath = args.out;
+const chromePath = args.chrome;
+const seconds = Number(args.seconds);
+const cps = Number(args.cps ?? 0.5);
+const sampleRate = Number(args["sample-rate"] ?? 44100);
+const timeoutMs = Number(args.timeout ?? 120000);
+
+if (!patternFile || !outPath || !chromePath) {
+  fail("missing required flag: --pattern-file / --out / --chrome", "bad_args");
+} else if (!Number.isFinite(seconds) || seconds <= 0) {
+  fail(`--seconds must be a positive number (got ${args.seconds})`, "bad_args");
+} else if (!existsSync(DIST)) {
+  fail(
+    `@strudel/web is not installed in ${HERE} — run \`oma video doctor --install-strudel\``,
+    "not_installed",
+  );
+} else if (!existsSync(chromePath)) {
+  fail(`chrome executable not found: ${chromePath}`, "no_chrome");
+} else {
+  main().catch((err) => fail(err?.message ?? String(err)));
+}
+
+async function main() {
+  hardTimer = setTimeout(
+    () => fail(`render exceeded ${timeoutMs}ms`, "timeout"),
+    timeoutMs,
+  );
+  hardTimer.unref?.();
+
+  const code = await readFile(patternFile, "utf8");
+
+  // 1. Loopback-only static server for the page + the strudel bundle. Paths are
+  //    confined to this dir and the resolved dist (no traversal).
+  server = createServer(async (req, res) => {
+    const pathname = new URL(req.url, "http://127.0.0.1").pathname;
+    let file;
+    if (pathname === "/" || pathname === "/page.html") {
+      file = path.join(HERE, "page.html");
+    } else if (pathname === "/strudel.js") {
+      file = path.join(DIST, "index.js");
+    } else {
+      const resolved = path.resolve(DIST, `.${pathname}`);
+      file = resolved.startsWith(DIST) ? resolved : null;
+    }
+    if (!file) {
+      res.writeHead(403).end("forbidden");
+      return;
+    }
+    try {
+      const body = await readFile(file);
+      res.writeHead(200, {
+        "content-type": MIME[path.extname(file)] ?? "application/octet-stream",
+        "cross-origin-opener-policy": "same-origin",
+        "cross-origin-embedder-policy": "require-corp",
+        "cross-origin-resource-policy": "cross-origin",
+      });
+      res.end(body);
+    } catch {
+      res.writeHead(404).end("not found");
+    }
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const httpPort = server.address().port;
+
+  // 2. Headless Chrome. No audio device is needed — OfflineAudioContext renders
+  //    into a buffer, so this works on a bare CI box.
+  userDataDir = await mkdtemp(path.join(tmpdir(), "oma-strudel-"));
+  chrome = spawn(
+    chromePath,
+    [
+      "--headless=new",
+      "--disable-gpu",
+      "--no-first-run",
+      "--no-default-browser-check",
+      "--disable-dev-shm-usage",
+      `--user-data-dir=${userDataDir}`,
+      "--remote-debugging-port=0",
+      "about:blank",
+    ],
+    { stdio: ["ignore", "ignore", "pipe"] },
+  );
+  chrome.on("error", (err) => fail(`chrome failed to start: ${err.message}`, "no_chrome"));
+
+  const devtoolsPort = await waitForDevtoolsPort(
+    path.join(userDataDir, "DevToolsActivePort"),
+  );
+
+  // 3. Drive it over raw CDP.
+  const targets = await (
+    await fetch(`http://127.0.0.1:${devtoolsPort}/json/list`)
+  ).json();
+  const page = targets.find((t) => t.type === "page");
+  if (!page) throw new Error("chrome exposed no page target");
+
+  const cdp = await connect(page.webSocketDebuggerUrl);
+  await cdp.send("Runtime.enable");
+  await cdp.send("Page.enable");
+  await cdp.send("Page.navigate", {
+    url: `http://127.0.0.1:${httpPort}/page.html`,
+  });
+  await cdp.waitForLoad();
+
+  const base64Length = await cdp.evaluate(
+    `window.__omaRender(${JSON.stringify(code)}, ${seconds}, ${cps}, ${sampleRate})`,
+  );
+  if (!base64Length || base64Length <= 0) {
+    throw new Error("strudel produced an empty buffer");
+  }
+
+  // 4. Pull the wav back in slices so no single CDP message gets huge.
+  const CHUNK = 4 * 1024 * 1024;
+  let b64 = "";
+  for (let offset = 0; offset < base64Length; offset += CHUNK) {
+    b64 += await cdp.evaluate(
+      `window.__omaWav.slice(${offset}, ${offset + CHUNK})`,
+    );
+  }
+  const wav = Buffer.from(b64, "base64");
+  await writeFile(outPath, wav);
+
+  process.stdout.write(
+    `${JSON.stringify({
+      ok: true,
+      output: outPath,
+      seconds,
+      bytes: wav.length,
+      sha256: createHash("sha256").update(wav).digest("hex"),
+    })}\n`,
+  );
+  await cleanup();
+  process.exit(0);
+}
+
+/** Chrome writes its chosen debugger port here once it is listening. */
+async function waitForDevtoolsPort(portFile) {
+  for (let i = 0; i < 200; i++) {
+    if (existsSync(portFile)) {
+      const [line] = readFileSync(portFile, "utf8").split("\n");
+      const port = Number(line);
+      if (Number.isFinite(port) && port > 0) return port;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  throw new Error("chrome never reported a devtools port");
+}
+
+/** Minimal CDP client over Node's global WebSocket. */
+async function connect(wsUrl) {
+  const ws = new WebSocket(wsUrl);
+  await new Promise((resolve, reject) => {
+    ws.onopen = resolve;
+    ws.onerror = () => reject(new Error("cdp websocket failed to open"));
+  });
+
+  let nextId = 0;
+  const pending = new Map();
+  let loaded = false;
+  const loadWaiters = [];
+
+  ws.onmessage = (event) => {
+    const msg = JSON.parse(event.data);
+    if (msg.id && pending.has(msg.id)) {
+      const { resolve, reject } = pending.get(msg.id);
+      pending.delete(msg.id);
+      if (msg.error) reject(new Error(JSON.stringify(msg.error)));
+      else resolve(msg.result);
+      return;
+    }
+    if (msg.method === "Page.loadEventFired") {
+      loaded = true;
+      while (loadWaiters.length) loadWaiters.shift()();
+    }
+  };
+
+  const send = (method, params = {}) =>
+    new Promise((resolve, reject) => {
+      const id = ++nextId;
+      pending.set(id, { resolve, reject });
+      ws.send(JSON.stringify({ id, method, params }));
+    });
+
+  return {
+    send,
+    waitForLoad: () =>
+      loaded ? Promise.resolve() : new Promise((resolve) => loadWaiters.push(resolve)),
+    async evaluate(expression) {
+      const res = await send("Runtime.evaluate", {
+        expression,
+        awaitPromise: true,
+        returnByValue: true,
+      });
+      if (res.exceptionDetails) {
+        const detail =
+          res.exceptionDetails.exception?.description ??
+          res.exceptionDetails.text ??
+          "unknown page error";
+        throw new Error(detail.split("\n")[0]);
+      }
+      return res.result.value;
+    },
+  };
+}