scenri 0.19.0 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.19.1](https://github.com/tonygorb/Scenri/compare/v0.19.0...v0.19.1) (2026-09-26)
+
+
+### Bug Fixes
+
+* Codex keeps no picture copies, and the library download is pinned ([e29537f](https://github.com/tonygorb/Scenri/commit/e29537f93860ecc095dad448bfb742c67c49388c))
+* **codex:** keep no copies of a picture, and switch off codex's plugins ([d81d6c2](https://github.com/tonygorb/Scenri/commit/d81d6c21f4ee82990cb26e2f5263bb43b0e4e563))
+* **content:** install only the library archive this version was tested against ([40f7659](https://github.com/tonygorb/Scenri/commit/40f765955475db6b5f51fb8d6bb286b40c7dddc4))
+* **studio:** tell the bell at once when the scene studio starts work ([53ba5e4](https://github.com/tonygorb/Scenri/commit/53ba5e4f46c272d939c1ebaa41b839eb3513843e))
+* **studio:** tell the bell at once when the scene studio starts work ([a3689b7](https://github.com/tonygorb/Scenri/commit/a3689b7b42480b14e702df94a7001d08f5bb6ca5))
+
 ## [0.19.0](https://github.com/tonygorb/Scenri/compare/v0.18.2...v0.19.0) (2026-09-26)
 
 

package/README.md

@@ -21,7 +21,7 @@ npx scenri
 
 <sub>Needs [Node.js](https://nodejs.org) 22 or newer. New to any of this? The [install guide](https://github.com/tonygorb/scenri/blob/main/docs/INSTALL.md) walks through every step.</sub>
 
-<img src="https://raw.githubusercontent.com/tonygorb/scenri/main/docs/media/demo.gif" alt="The Scenri composer: a dollar sign opens a product picker and Selvedge Trucker is chosen, an at sign picks the presenter Maren, a slash picks the Editorial Walk scene, a line of written direction is typed after the three chips, the shot renders as a card in the wall, and it opens to show the picture beside the brief that made it" width="820">
+<img src="https://raw.githubusercontent.com/tonygorb/scenri/main/docs/media/demo.gif" alt="The Scenri composer: a dollar sign opens a product picker and Ridgeline Trail is chosen, an at sign picks the presenter Paloma, a slash picks the Chalk Steps scene, a line of written direction is typed after the three chips, the shot renders as a card in the wall, and it opens to show the picture beside the brief that made it" width="820">
 
 <sub>Pick a product, pick a presenter, pick a scene, then write the direction. That is the brief.</sub>
 
@@ -39,7 +39,7 @@ It runs as a local server on your own computer. Your brands, your images, and yo
 
 ## What a brief produces
 
-The film above ends on the shot its brief made: the Selvedge Trucker product, the presenter Maren, the Editorial Walk scene, and a paragraph of written direction. The chips carry the identity; the prose does the art direction. Here are eight more shots from the home wall, each built exactly that way:
+The film above ends on the shot its brief made: the Ridgeline Trail product, the presenter Paloma, the Chalk Steps scene, and a paragraph of written direction. The chips carry the identity; the prose does the art direction. Here are eight more shots from the home wall, each built exactly that way:
 
 <!-- One paragraph, no whitespace between the tags: a newline here renders as
 a fixed word-space, and 4 x 24.5% plus three spaces overflows a phone screen

package/dist/serve.js

@@ -10,7 +10,7 @@ import { dirname, join, normalize, basename } from 'path';
 import { fileURLToPath } from 'url';
 import fs, { existsSync, readFileSync, mkdirSync, createReadStream, rmSync, readdirSync, statSync, renameSync, lstatSync, unlinkSync } from 'fs';
 import { homedir, tmpdir, networkInterfaces } from 'os';
-import { readFile, stat, copyFile, lstat, readdir, mkdtemp, rm, access, rename, unlink, writeFile } from 'fs/promises';
+import { readFile, stat, copyFile, lstat, readdir, mkdtemp, rm, access, rmdir, rename, unlink, writeFile } from 'fs/promises';
 import { spawn, execFile } from 'child_process';
 import sharp22 from 'sharp';
 import Fastify from 'fastify';
@@ -829,12 +829,15 @@ function execArgs(dir, effort = "low") {
     CODEX_MODEL,
     "-c",
     `model_reasoning_effort="${effort}"`,
+    // No session files: codex would otherwise keep every run's transcript, the
+    // pictures in it as base64, long after Scenri has let the work go.
+    "--ephemeral",
     "-C",
     dir,
     "-"
   ];
 }
-function mcpOffArgs(env) {
+function extensionsOffArgs(env) {
   const user = env.HOME || env.USERPROFILE;
   const home = env.CODEX_HOME || (user ? join(user, ".codex") : "");
   if (!home) return [];
@@ -844,12 +847,12 @@ function mcpOffArgs(env) {
   } catch {
     return [];
   }
-  const names = /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
   for (const line of text.split(/\r?\n/)) {
-    const m = /^\s*\[\s*mcp_servers\.(?:"([A-Za-z0-9_-]+)"|([A-Za-z0-9_-]+))\s*\]\s*(?:#.*)?$/.exec(line);
-    if (m) names.add(m[1] ?? m[2]);
+    const m = /^\s*\[\s*(mcp_servers|plugins)\.(?:"([A-Za-z0-9_@-]+)"|([A-Za-z0-9_@-]+))\s*\]\s*(?:#.*)?$/.exec(line);
+    if (m) keys.add(`${m[1]}.${m[2] ?? m[3]}`);
   }
-  return [...names].flatMap((name) => ["-c", `mcp_servers.${name}.enabled=false`]);
+  return [...keys].flatMap((key) => ["-c", `${key}.enabled=false`]);
 }
 var TAIL_BYTES = 4096;
 var DETAIL_CHARS = 800;
@@ -939,7 +942,7 @@ function createRunner(opts = {}) {
   const spawnCodex = (exe, args, stdinOpen) => {
     const stdio = [stdinOpen ? "pipe" : "ignore", "pipe", "pipe"];
     const env = buildChildEnv(parentEnv, [...ignoreEnvKeys(), ...SIBLING_PROVIDER_KEYS]);
-    if (args[0] === "exec") args = ["exec", ...mcpOffArgs(parentEnv), ...args.slice(1)];
+    if (args[0] === "exec") args = ["exec", ...extensionsOffArgs(parentEnv), ...args.slice(1)];
     return exe.direct ? spawnImpl(exe.command, args, { stdio, env, ...platform !== "win32" ? { detached: true } : {} }) : spawnImpl([exe.command, ...args.map(winArg)].join(" "), [], { stdio, env, shell: true });
   };
   async function run4(args, signal, io) {
@@ -1716,9 +1719,43 @@ function createCodexEngine(opts) {
       const buf = await readLeftFile(join(dir, name), name);
       if (buf.length === 0) throw new Error(`codex: ${name} is empty`);
       hashes.push(saveImage(buf));
+      await forgetGenerated(buf);
     }
     return hashes;
   }
+  async function forgetGenerated(buf) {
+    const home = generatedImagesDir();
+    const recent = Date.now() - 30 * 6e4;
+    let names;
+    try {
+      names = await readdir(home);
+    } catch {
+      return;
+    }
+    const dropIfSame = async (path) => {
+      const st = await lstat(path);
+      if (!st.isFile() || st.size !== buf.length) return false;
+      if (!(await readFile(path)).equals(buf)) return false;
+      await unlink(path);
+      return true;
+    };
+    for (const name of names) {
+      const at = join(home, name);
+      try {
+        const st = await lstat(at);
+        if (st.mtimeMs < recent) continue;
+        if (st.isFile()) {
+          await dropIfSame(at);
+          continue;
+        }
+        if (!st.isDirectory()) continue;
+        let dropped = false;
+        for (const file of await readdir(at)) dropped = await dropIfSame(join(at, file)) || dropped;
+        if (dropped && (await readdir(at)).length === 0) await rmdir(at);
+      } catch {
+      }
+    }
+  }
   async function recoverFromGenerated(before, claimed) {
     const home = generatedImagesDir();
     let names;
@@ -6034,6 +6071,10 @@ function shotWordsFor(core, brandId) {
 }
 var CONTENT_VERSION = 3;
 var CONTENT_TAG = "content-v3";
+var CONTENT_SHA256 = "c736f1f9142bc428e19bb80bc139c2d9e60a9dce7449b322760ffe8df333b734";
+function archiveMatches(bytes, expected = CONTENT_SHA256) {
+  return createHash("sha256").update(bytes).digest("hex") === expected;
+}
 var DEFAULT_CONTENT_URL = `https://github.com/tonygorb/scenri/releases/download/${CONTENT_TAG}/scenri-content.zip`;
 var TIMEOUT_MS = 30 * 60 * 1e3;
 function resolveContentUrl(env = process.env, override) {
@@ -6085,6 +6126,7 @@ function createContentFetcher(deps) {
   const doFetch = deps.fetchImpl ?? fetch;
   const url = resolveContentUrl(env, deps.url);
   const custom = Boolean(deps.url ?? env.SCENRI_CONTENT_URL);
+  const expected = deps.sha256 !== void 0 ? deps.sha256 : custom ? null : CONTENT_SHA256;
   const enabled = () => env.SCENRI_NO_CONTENT_FETCH !== "1" && deps.store.getSetting("content.enabled") !== "false";
   let inflight = null;
   async function download() {
@@ -6105,6 +6147,13 @@ function createContentFetcher(deps) {
       } finally {
         clearTimeout(timer);
       }
+      if (expected && !archiveMatches(bytes, expected)) {
+        return {
+          ok: false,
+          updated: false,
+          error: "the library download does not match the archive this version expects"
+        };
+      }
       const refused = await installContentArchive(bytes, root);
       if (refused) return { ok: false, updated: false, error: refused };
       try {
@@ -14843,6 +14892,24 @@ function registerImageRoutes(app, deps) {
 
 // src/release/notes.data.ts
 var RELEASES = [
+  {
+    version: "0.19.1",
+    date: "2026-09-26",
+    sections: [
+      {
+        heading: "Codex",
+        body: "Codex keeps no copy of a picture once Scenri has it, neither a saved conversation nor a second file, and its plugins stay off while Scenri runs it."
+      },
+      {
+        heading: "Library",
+        body: "The library download is checked against the exact archive this version was released with, and nothing is installed unless it matches."
+      },
+      {
+        heading: "Fixes",
+        body: "A scene draw shows in the bell as soon as it starts, and the Scenes wall no longer calls it not drawn yet while it is drawing."
+      }
+    ]
+  },
   {
     version: "0.19.0",
     date: "2026-09-26",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scenri",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "author": "Tony Gorb <hello@scenri.co>",
   "license": "AGPL-3.0-only",
   "type": "module",