relic-mcp 0.15.0 → 0.16.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "relic",
       "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "source": "./",
       "author": {
         "name": "The Bushido Collective",
@@ -21,6 +21,6 @@
     }
   ],
   "metadata": {
-    "version": "0.15.0"
+    "version": "0.16.0"
   }
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "relic",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Publish a file from your machine as an encrypted, shareable link. The agent encrypts locally, uploads only ciphertext, and hands back a URL whose fragment holds the key, so the service stores something it cannot read.",
   "mcpServers": "./mcp-servers.json",
   "author": {

package/README.md

@@ -100,7 +100,10 @@ created `0600` inside a `0700` directory, and redirectable with
   Copying the state file to another machine moves the ability with it.
 - **The file holds the key and the token.** They are never printed, logged,
   or returned by any tool result. The service stores only a SHA-256 of the
-  token, so it cannot reconstruct either one.
+  token, so it cannot reconstruct either one. On this machine the version keys
+  are plaintext in the file. Other users cannot read it (`0600`), but any
+  process running as this user can, so the file is protected only from other
+  users and from the service.
 - **Losing the file changes nothing for existing links**; it only ends that
   machine's ability to update those relics.
 - **A takedown is permanent.** A removed relic answers `relic_removed`
@@ -210,6 +213,66 @@ flags (`--host-resolver-rules=MAP * ~NOTFOUND`,
 `--webrtc-ip-handling-policy=disable_non_proxied_udp`, `--disable-quic`) so no
 relic plaintext leaves the machine during rendering.
 
+### OTIO programs
+
+Publishing or republishing an `.otioz` archive, or a `.otiod` directory packaged
+into one, also renders each OpenTimelineIO timeline to an H.264/AAC MP4 in the
+same local headless browser shell. The render runs in memory: the browser context is
+off-the-record, the HTTP cache is disabled, and the page can reach only the
+archive's own media through the virtual origin
+(`https://program.relic.invalid`). The MP4s and a `relic/program.json` manifest
+go into the archive before encryption, so the program is encrypted like the
+source. `content.otio` and every media entry keep their bytes.
+
+A timeline that cannot be rendered is published focus-only, and the publish
+result says why for each one: no browser, no H.264/AAC encoder, an unsupported
+effect, codec, transition, schema, or timing, missing media, or the size cap.
+The result's `program` field reports the status and every timeline. A bare
+`.otio` file has no archive to carry a program and publishes as given. No
+browser or encoder is installed or downloaded, and nothing is sent to a remote
+renderer.
+
+Programs render only on macOS in this version. On Linux no browser starts, and
+every OTIO timeline is published focus-only with the reason "program rendering is
+confined only on macOS in this version, so this timeline has no program".
+
+On macOS each publish creates a private RAM volume and runs the headless shell
+under one deny-default macOS sandbox profile that the kernel applies to every
+process the shell starts. Chromium's own sandbox is off, since it cannot start
+inside that profile, so the profile is the containment. The profile allows
+writes only to the RAM volume; reads only of the system libraries, fonts, and
+the shell's own directory; no network; no home directory; and executing only the
+shell. GPU and hardware video decoding are disabled. Before every launch a probe
+runs unconfined,
+which must succeed, and then confined, where each outside write, read, exec and
+connection must be refused and the inside write must succeed. Any deviation, or
+a volume that cannot be created, means no browser starts and every timeline is
+focus-only with that reason. The browser gets a minimal environment: `HOME`,
+temporary and cache directories inside the volume, and a fixed `PATH`. Nothing
+else is inherited.
+
+After rendering, the process unmounts and detaches its volume and removes only
+the device and directory it created. SIGINT and SIGTERM abort active renders and
+wait for browser and volume cleanup before exit. SIGKILL, power loss, and other
+forced termination cannot run cleanup; the RAM mount may persist until system
+cleanup or reboot. If storage this process made cannot be released, the publish
+is refused. Reasons in the archive are fixed sentences,
+never local paths or environment values. The archive always carries its
+manifest, so a reader never falls back to a full composite the publisher did not
+select. An archive that already contains `relic/` entries, a bad
+`RELIC_PROGRAM_MAX_BYTES`, an unsafe entry name, or a manifest that cannot fit
+the cap is refused with an exact reason rather than published without one.
+
+What the sandbox does not cover: with Chromium's sandbox off, one profile covers
+every process the shell starts, so an exploit in a media decoder reaches
+everything that profile allows, though nothing beyond it. Seatbelt does not filter
+every system call, and its profile language is private and deprecated, so a
+future macOS release may change it; the per-launch probe then fails closed. The
+macOS crash reporter sits outside the profile and can write crash details,
+including strings a compromised process chose, to `~/Library/Logs/DiagnosticReports`.
+No claim is made about swap. Anything readable inside the volume, such as the
+host name, can appear in the published MP4.
+
 ## Tools
 
 | Tool | Input | Notes |
@@ -238,6 +301,9 @@ relic plaintext leaves the machine during rendering.
 | `RELIC_MCP_PORT`, `RELIC_MCP_HOST` | HTTP bind. Defaults to `127.0.0.1:7333`. |
 | `RELIC_MCP_ALLOWED_ORIGINS` | Comma-separated `Origin` allowlist for HTTP. |
 | `RELIC_CHROME_PATH` | Explicit path to Chrome, Chromium, or Edge binary for cover rendering. Set to `none` or `disabled` to skip covers. |
+| `RELIC_OTIO_CHROME_PATH` | Path to a `chrome-headless-shell` build whose file layout matches the r1228 headless shell, for OTIO program rendering on macOS. Unset, the newest one under `~/.omp/owned-shells` is used. Any other file or layout is refused. Full Chrome is never used for programs. Set to `none` or `disabled` to publish OTIO without programs. |
+| `RELIC_PROGRAM_MAX_BYTES` | Lowers the program budget for the whole archive, never raises it. Must be a positive integer. A timeline that does not fit is focus-only with the reason `size-cap-exceeded`. |
+| `RELIC_PROGRAM_ENCODER_OFF` | `1` makes the page report its H.264/AAC encoder as absent. Used by proofs, to exercise the focus-only path. |
 | `RELIC_FFMPEG_PATH` | Path to ffmpeg binary for generating video frame and audio waveform/artwork cover images. |
 
 ## Protocol

package/dist/cover/cover.js

@@ -1302,7 +1302,7 @@ function inline(source) {
   });
   return out.split(SENTINEL).join("");
 }
-function renderMarkdown(source) {
+function parseMarkdown(source) {
   const lines = source.replace(/\r\n?/g, `
 `).split(`
 `);
@@ -1312,7 +1312,7 @@ function renderMarkdown(source) {
   const flushParagraph = () => {
     if (paragraph.length === 0)
       return;
-    out.push(`<p>${inline(paragraph.join(" "))}</p>`);
+    out.push({ kind: "paragraph", text: paragraph.join(" ") });
     paragraph = [];
   };
   while (index < lines.length) {
@@ -1328,22 +1328,24 @@ function renderMarkdown(source) {
         index++;
       }
       index++;
-      const attribute = language.length > 0 ? ` data-language="${escapeHtml(language)}"` : "";
-      out.push(`<pre${attribute}><code>${escapeHtml(body.join(`
-`))}</code></pre>`);
+      out.push({ kind: "code", language, text: body.join(`
+`) });
       continue;
     }
     const heading = /^(#{1,6})\s+(.*)$/.exec(line);
     if (heading !== null) {
       flushParagraph();
-      const level = heading[1].length;
-      out.push(`<h${level}>${inline(heading[2])}</h${level}>`);
+      out.push({
+        kind: "heading",
+        level: heading[1].length,
+        text: heading[2]
+      });
       index++;
       continue;
     }
     if (/^\s*(-\s*-\s*-|\*\s*\*\s*\*|_\s*_\s*_)[-*_\s]*$/.test(line)) {
       flushParagraph();
-      out.push("<hr>");
+      out.push({ kind: "rule" });
       index++;
       continue;
     }
@@ -1354,8 +1356,8 @@ function renderMarkdown(source) {
         quoted.push(lines[index].replace(/^\s*>\s?/, ""));
         index++;
       }
-      out.push(`<blockquote>${renderMarkdown(quoted.join(`
-`))}</blockquote>`);
+      out.push({ kind: "quote", blocks: parseMarkdown(quoted.join(`
+`)) });
       continue;
     }
     if (/^\s*([-*+]|\d+\.)\s+/.test(line)) {
@@ -1373,9 +1375,7 @@ function renderMarkdown(source) {
         }
         index++;
       }
-      const tag = ordered ? "ol" : "ul";
-      const body = items.map((item) => `<li>${inline(item)}</li>`).join("");
-      out.push(`<${tag}>${body}</${tag}>`);
+      out.push({ kind: "list", ordered, items });
       continue;
     }
     if (line.includes("|") && isTableSeparator(lines[index + 1])) {
@@ -1387,7 +1387,7 @@ function renderMarkdown(source) {
         rows.push(splitRow(lines[index]));
         index++;
       }
-      out.push('<div class="md-scroll"><table><thead><tr>' + header.map((cell) => `<th>${inline(cell)}</th>`).join("") + "</tr></thead><tbody>" + rows.map((row) => `<tr>${row.map((cell) => `<td>${inline(cell)}</td>`).join("")}</tr>`).join("") + "</tbody></table></div>");
+      out.push({ kind: "table", header, rows });
       continue;
     }
     if (line.trim().length === 0) {
@@ -1399,7 +1399,34 @@ function renderMarkdown(source) {
     index++;
   }
   flushParagraph();
-  return out.join(`
+  return out;
+}
+function renderBlock(block) {
+  switch (block.kind) {
+    case "heading":
+      return `<h${block.level}>${inline(block.text)}</h${block.level}>`;
+    case "paragraph":
+      return `<p>${inline(block.text)}</p>`;
+    case "code": {
+      const attribute = block.language.length > 0 ? ` data-language="${escapeHtml(block.language)}"` : "";
+      return `<pre${attribute}><code>${escapeHtml(block.text)}</code></pre>`;
+    }
+    case "rule":
+      return "<hr>";
+    case "quote":
+      return `<blockquote>${block.blocks.map(renderBlock).join(`
+`)}</blockquote>`;
+    case "list": {
+      const tag = block.ordered ? "ol" : "ul";
+      const body = block.items.map((item) => `<li>${inline(item)}</li>`);
+      return `<${tag}>${body.join("")}</${tag}>`;
+    }
+    case "table":
+      return '<div class="md-scroll"><table><thead><tr>' + block.header.map((cell) => `<th>${inline(cell)}</th>`).join("") + "</tr></thead><tbody>" + block.rows.map((row) => `<tr>${row.map((cell) => `<td>${inline(cell)}</td>`).join("")}</tr>`).join("") + "</tbody></table></div>";
+  }
+}
+function renderMarkdown(source) {
+  return parseMarkdown(source).map(renderBlock).join(`
 `);
 }
 function isTableSeparator(line) {

package/dist/cover/frame.html

@@ -11532,6 +11532,12 @@ var documentSequences = new WeakMap;
 
 // ../relic-format/src/otio-identity.ts
 var mediaWitnessCache = new WeakMap;
+// ../relic-format/src/otio-program.ts
+var MAX_OTIO_PROGRAM_MANIFEST_BYTES = 16 * 1024 * 1024;
+var OTIO_PROGRAM_MAX_BYTES = 100 * 1024 * 1024;
+var UTF8 = new TextEncoder;
+var MAX_FRAMES = Number.MAX_SAFE_INTEGER;
+var MAX_AUDIO_SAMPLES = Number.MAX_SAFE_INTEGER;
 // ../relic-format/src/share.ts
 var SHARE_PROOF_INFO = new TextEncoder().encode("relic/share-proof/v1");
 // ../relic-viewer/src/sandbox.ts
@@ -11881,12 +11887,25 @@ function createScrollportWatch(onChange) {
 }
 function concealMarks(marks, watch, live = true) {
   watch.sync(marks.map((mark) => mark.node));
-  const merged = new Map;
+  if (live) {
+    for (const { node, subject } of marks) {
+      if (subject === node && node.getAttribute(CONCEALED_ATTRIBUTE) === "hidden")
+        node.removeAttribute(CONCEALED_ATTRIBUTE);
+    }
+  }
+  const measured = [];
   for (const { node, subject } of marks) {
     const id = node.getAttribute("data-comment-id");
     if (id === null || id === "")
       continue;
-    const concealment = !live || !isRendered(subject) ? "hidden" : !watch.inView(node) ? "offscreen" : "shown";
+    measured.push({
+      node,
+      id,
+      concealment: !live || !isRendered(subject) ? "hidden" : !watch.inView(node) ? "offscreen" : "shown"
+    });
+  }
+  const merged = new Map;
+  for (const { node, id, concealment } of measured) {
     setConcealed(node, concealment === "shown" ? undefined : concealment);
     const previous = merged.get(id);
     merged.set(id, mergeReason(previous, concealment));