storyboard-bridge 0.3.3 → 0.3.5

package/higgsfield_client.py

@@ -280,8 +280,10 @@ class BrowserSession:
 
 MIME_BY_EXT = {".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png",
                ".webp": "image/webp"}
-# Statuses that mean the image is blocked / unusable as an input.
-BLOCKED_STATUSES = {"nsfw", "rejected", "failed", "blocked"}
+# A FINAL verdict in this set means the image is blocked. It is only valid once the NSFW/IP check has
+# FINISHED (ip_check_finished=True) — reading `status` mid-check returns a not-yet-settled value, which is
+# what falsely flagged images Higgsfield ultimately verifies as clean. See the verify loop below.
+BLOCK_STATUSES = {"nsfw", "rejected", "failed", "blocked"}
 
 
 VERIFY_TIMEOUT_S = 90  # per-attempt ceiling on the NSFW/IP check before retrying
@@ -336,9 +338,13 @@ def upload_image(session, path, surface="seedance_2", verify_timeout=VERIFY_TIME
     while True:
         media = session.request("GET", f"{GEN_BASE}/media/{mid}").json()
         status = media.get("status")
-        if status in BLOCKED_STATUSES:
-            raise ImageBlocked(status)
+        # ONLY judge the verdict once the check has FINISHED. A mid-check `status` is not the result —
+        # judging it early is exactly what flagged images Higgsfield then verifies as clean. So wait for
+        # ip_check_finished, THEN read the final status: block if it's a real block verdict, else proceed.
         if media.get("ip_check_finished"):
+            if status in BLOCK_STATUSES:
+                print(f"⛔ id={mid} FINAL verdict={status} | media={json.dumps(media)}")  # dump for diagnosis
+                raise ImageBlocked(status)
             media["url"] = url
             print(f"✅ Verified: id={mid} status={status} "
                   f"face={media.get('is_face_detected')}")
@@ -437,16 +443,34 @@ def generate(session, prompt, medias, duration=8, resolution="720p", aspect="16:
     return job_id
 
 
-def poll_and_download(session, job_id, download=True):
+def poll_and_download(session, job_id, download=True, own_rights=False):
     """Poll the job to completion. Returns (video_url, local_path|None).
     Emits a 'done' event (with the cloudfront url) for --emit-json consumers."""
     status_url = f"{GEN_BASE}/jobs/{job_id}/status"
     details_url = f"{GEN_BASE}/jobs/{job_id}"
+    confirm_url = f"{GEN_BASE}/jobs/{job_id}/seedance/confirm-rights"
+    rights_confirmed = False
     print("⏳ Rendering…")
     while True:
         r = session.request("GET", status_url)
         status = r.json().get("status")
         print(f"   status: {status}")
+        # Rights gate: the clip RENDERED, but Higgsfield flagged copyright/likeness content and holds it behind
+        # "I own rights to this content" — status stays 'ip_detected' (it NEVER becomes 'completed' on its own,
+        # so without this we'd just poll until timeout). With explicit opt-in we fire the same PUT the UI button
+        # does, which flips the job to 'completed'; otherwise we fail clearly so the user knows why.
+        if status == "ip_detected":
+            if not own_rights:
+                print("⛔ rights verification required — output flagged copyright/likeness. Pass --own-rights to auto-confirm.")
+                event(event="error", reason="rights-required", jobId=job_id, fatal=True)
+                return None, None
+            if not rights_confirmed:
+                print("⚖️  asserting content rights (I own rights to this content)…")
+                session.request("PUT", confirm_url)  # exact call the UI button fires → flips status to completed
+                rights_confirmed = True
+                event(event="progress", phase="rights-confirmed")
+            time.sleep(2)
+            continue
         if status == "completed":
             details = session.request("GET", details_url).json()
             video_url = details["results"]["raw"]["url"]
@@ -462,6 +486,22 @@ def poll_and_download(session, job_id, download=True):
             event(event="done", jobId=job_id, videoUrl=video_url, file=path)
             return video_url, path
         if status in ("failed", "error", "cancelled", "nsfw", "moderated", "rejected"):
+            # a moderation flag can land even though the render PRODUCED a clip — grab it if so rather than
+            # discarding a finished video over a soft flag. Only fail when there's genuinely no output.
+            details = session.request("GET", details_url).json()
+            video_url = (((details.get("results") or {}).get("raw")) or {}).get("url")
+            if video_url:
+                print(f"🎬 (flagged {status}, but a clip rendered) {video_url}")
+                path = None
+                if download:
+                    os.makedirs(OUTPUT_DIR, exist_ok=True)
+                    path = os.path.join(OUTPUT_DIR, f"higgsfield_{job_id}.mp4")
+                    data = cffi_requests.get(video_url, impersonate=IMPERSONATE).content
+                    with open(path, "wb") as f:
+                        f.write(data)
+                    print(f"🎉 Saved: {path}")
+                event(event="done", jobId=job_id, videoUrl=video_url, file=path)
+                return video_url, path
             print(f"❌ Generation {status}")
             event(event="error", reason=f"render-{status}", jobId=job_id, fatal=True)
             return None, None
@@ -489,6 +529,9 @@ def main():
                     help="JSON list of already-verified media objects; skip upload, go to generate.")
     ap.add_argument("--no-download", action="store_true",
                     help="Don't save the mp4 locally; just report the video URL.")
+    ap.add_argument("--own-rights", action="store_true",
+                    help="Auto-confirm Higgsfield's copyright/likeness rights gate on a rendered output "
+                         "(asserts you own the rights to the content). Without it, a gated output fails.")
     ap.add_argument("--emit-json", action="store_true",
                     help="Emit NDJSON progress on stdout (human logs go to stderr).")
     ap.add_argument("--capture-only", action="store_true",
@@ -518,7 +561,7 @@ def main():
     if args.resume_job:
         print(f"↩️  Resuming job {args.resume_job}")
         event(event="progress", phase="rendering", jobId=args.resume_job)
-        poll_and_download(session, args.resume_job, download=not args.no_download)
+        poll_and_download(session, args.resume_job, download=not args.no_download, own_rights=args.own_rights)
         return
 
     if args.media_json:
@@ -546,7 +589,7 @@ def main():
 
     job_id = generate(session, args.prompt, medias, duration=args.duration,
                       resolution=args.resolution, aspect=args.aspect, gen_wait=args.gen_wait)
-    poll_and_download(session, job_id, download=not args.no_download)
+    poll_and_download(session, job_id, download=not args.no_download, own_rights=args.own_rights)
 
 
 if __name__ == "__main__":

package/index.mjs

@@ -32,7 +32,11 @@ import { fileURLToPath } from 'node:url';
 import { tmpdir } from 'node:os';
 import { WebSocket } from 'ws';
 
-const VERSION = '0.3.3';
+const VERSION = '0.3.5';
+
+// in-flight Higgsfield render children, keyed by job id — so a `higgsfield-cancel` can kill the right one
+// (the backend sends it when the user cancels, freeing the single render slot instead of leaving it running).
+const hfChildren = new Map();
 
 // ---- config ----
 const arg = (name, fallback) => {
@@ -51,6 +55,9 @@ const IS_WIN = process.platform === 'win32';
 // debug tab + python + the Higgsfield login). Opt in with --higgsfield; the backend routes everyone's
 // Higgsfield jobs to a bridge that advertises this.
 const HIGGSFIELD = process.argv.includes('--higgsfield') || process.env.STORYBOARD_HIGGSFIELD === '1';
+// Auto-confirm Higgsfield's copyright/likeness "rights verification" gate on a rendered clip (a gated clip
+// otherwise stalls until timeout). Asserts you own the rights — explicit opt-in only.
+const OWN_RIGHTS = process.argv.includes('--own-rights') || process.env.STORYBOARD_OWN_RIGHTS === '1';
 const PYTHON_BIN = arg('python-bin', process.env.PYTHON_BIN || (IS_WIN ? 'python.exe' : 'python3'));
 const CDP_HTTP = arg('cdp', process.env.CDP_HTTP || 'http://localhost:9222'); // the debug Chrome endpoint
 const HF_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'higgsfield_client.py');
@@ -62,6 +69,18 @@ const JOB_TIMEOUT_MS = 300_000;
 
 const log = (m) => console.log(`[bridge ${new Date().toISOString().slice(11, 19)}] ${m}`);
 
+// Is version `a` strictly older than `b`? (numeric x.y.z compare; missing parts = 0.) Used so the
+// update nag fires ONLY when this bridge is behind the backend's advertised latest, never when ahead.
+function isOlderVersion(a, b) {
+  const pa = String(a).split('.').map((n) => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return true;
+    if ((pa[i] || 0) > (pb[i] || 0)) return false;
+  }
+  return false;
+}
+
 function wsUrl(httpUrl) {
   const u = new URL(httpUrl);
   u.protocol = u.protocol === 'https:' ? 'wss:' : 'ws:';
@@ -180,6 +199,7 @@ async function handleHiggsfield(msg, ws) {
       tmp.push(f);
     }
     const args = ['-u', HF_SCRIPT, '--emit-json', '--no-download'];
+    if (OWN_RIGHTS) args.push('--own-rights'); // auto-confirm the copyright/likeness rights gate
     if (p.resumeJobId) {
       args.push('--resume-job', String(p.resumeJobId)); // poll an existing job, no upload
     } else {
@@ -191,6 +211,7 @@ async function handleHiggsfield(msg, ws) {
       else for (const f of tmp) args.push('--image-file', f);
     }
     const child = spawn(PYTHON_BIN, args, { env: { ...process.env, CDP_HTTP }, stdio: ['ignore', 'pipe', 'pipe'] });
+    hfChildren.set(id, child);
     let buf = '', sawDone = false, stderrTail = '';
     child.stdout.on('data', (d) => {
       buf += d.toString();
@@ -205,8 +226,9 @@ async function handleHiggsfield(msg, ws) {
       }
     });
     child.stderr.on('data', (d) => { stderrTail = (stderrTail + d.toString()).slice(-2000); });
-    child.on('error', (e) => { cleanup(); ws.send(JSON.stringify({ type: 'hfEvent', id, event: 'error', reason: 'spawn', detail: `${PYTHON_BIN}: ${e.message}` })); });
+    child.on('error', (e) => { hfChildren.delete(id); cleanup(); ws.send(JSON.stringify({ type: 'hfEvent', id, event: 'error', reason: 'spawn', detail: `${PYTHON_BIN}: ${e.message}` })); });
     child.on('close', (code) => {
+      hfChildren.delete(id);
       cleanup();
       if (!sawDone && code !== 0) ws.send(JSON.stringify({ type: 'hfEvent', id, event: 'error', reason: 'exit', detail: `python exited ${code}: ${stderrTail.slice(-300)}` }));
     });
@@ -243,7 +265,10 @@ function connect() {
       return;
     }
     if (msg.type === 'welcome') {
-      if (msg.latest && msg.latest !== VERSION) {
+      // Only nag when we're genuinely OLDER than what the backend advertises — a plain `!==` also fired
+      // when this bridge was NEWER than the backend's advertised version (e.g. mid-rollout, before the
+      // backend redeploys), wrongly telling the user to "update" to an older build.
+      if (msg.latest && isOlderVersion(VERSION, msg.latest)) {
         log(`UPDATE AVAILABLE: bridge v${msg.latest} (you have v${VERSION}). Update with:  npm i -g storyboard-bridge   (or just re-run via npx).`);
       }
     } else if (msg.type === 'job' && msg.id) {
@@ -267,6 +292,10 @@ function connect() {
     } else if (msg.type === 'higgsfield' && msg.id) {
       if (!HIGGSFIELD) ws.send(JSON.stringify({ type: 'hfEvent', id: msg.id, event: 'error', reason: 'disabled', detail: 'this bridge was not started with --higgsfield' }));
       else { log(`higgsfield ${msg.id} → running`); handleHiggsfield(msg, ws); }
+    } else if (msg.type === 'higgsfield-cancel' && msg.id) {
+      // user cancelled → stop this render so the single account slot frees (the python client honours SIGTERM)
+      const child = hfChildren.get(msg.id);
+      if (child) { log(`higgsfield ${msg.id} → cancel`); try { child.kill('SIGTERM'); } catch { /* already gone */ } hfChildren.delete(msg.id); }
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "storyboard-bridge",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Desktop bridge that powers a hosted Storyboard AI webapp with your own local Claude Code / Gemini CLI login (no API key).",
   "type": "module",
   "bin": {