wizards 0.2.19 → 0.2.21

package/apps/runtime/dist/film/sounds.js

@@ -0,0 +1,122 @@
+import { existsSync } from "node:fs";
+import { cp, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { env } from "../env.js";
+import { platformSkills } from "./skills.js";
+/**
+ * The sounds a film may use: nothing is generated, synthesized or downloaded by the client.
+ * soundcn (soundcn.xyz, MIT; the sounds by Kenney, CC0) for clicks, pops, impacts, jingles,
+ * switches, pages and paper; the effects HyperFrames ships with (whooshes, typing, risers).
+ * Fetched once into the data folder; `catalog.json` lists every file with tags and licence.
+ */
+const REGISTRY = "https://soundcn.xyz/r";
+/** soundcn categories that suit motion design; game noises (warcraft, laser, combat …) stay out. */
+const KEEP = new Set([
+    "ui",
+    "click",
+    "switch",
+    "select",
+    "maximize",
+    "minimize",
+    "book",
+    "card",
+    "cloth",
+    "scratch",
+    "scroll",
+    "drop",
+    "glass",
+    "jingles",
+    "pep",
+    "power",
+    "impact",
+    "chips",
+    "dice",
+    "error",
+    "round",
+    "zap",
+    "phase",
+    "low",
+    "metal",
+    "crafting",
+]);
+const CATALOG_VERSION = 1;
+const dir = join(env.dataDir, "catalogs", `sounds-v${CATALOG_VERSION}`);
+let building = null;
+/** The catalog folder (catalog.json + sfx/); built on first use. */
+export function soundCatalog() {
+    if (existsSync(join(dir, "catalog.json"))) {
+        return Promise.resolve(dir);
+    }
+    building ??= build().finally(() => {
+        building = null;
+    });
+    return building;
+}
+async function build() {
+    const tmp = `${dir}.part`;
+    await rm(tmp, { recursive: true, force: true });
+    await mkdir(join(tmp, "sfx"), { recursive: true });
+    const sounds = [];
+    const index = (await (await fetch(`${REGISTRY}/registry.json`)).json());
+    const picked = index.items.filter((i) => i.categories?.some((c) => KEEP.has(c)));
+    let next = 0;
+    const worker = async () => {
+        while (next < picked.length) {
+            const item = picked[next++];
+            try {
+                const res = await fetch(`${REGISTRY}/${item.name}.json`);
+                const json = (await res.json());
+                const m = json.files?.[0]?.content?.match(/data:audio\/(\w+);base64,([A-Za-z0-9+/=]+)/);
+                if (!m) {
+                    continue;
+                }
+                const ext = m[1] === "mpeg" ? "mp3" : m[1];
+                await writeFile(join(tmp, "sfx", `${item.name}.${ext}`), Buffer.from(m[2], "base64"));
+                sounds.push({
+                    file: `sfx/${item.name}.${ext}`,
+                    source: "soundcn",
+                    author: json.author ?? "Kenney",
+                    licence: item.meta?.license ?? "CC0",
+                    duration: item.meta?.duration,
+                    description: json.description,
+                    tags: item.categories?.concat(item.meta?.tags ?? []),
+                    keywords: item.meta?.keywords,
+                });
+            }
+            catch {
+                // one sound less
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: 8 }, worker));
+    // The effects HyperFrames ships with its media skill.
+    const hf = join(await platformSkills("hyperframes"), "media-use", "audio", "assets", "sfx");
+    if (existsSync(hf)) {
+        for (const f of await readdir(hf)) {
+            if (f.endsWith(".mp3")) {
+                await cp(join(hf, f), join(tmp, "sfx", `hf-${f}`));
+                sounds.push({
+                    file: `sfx/hf-${f}`,
+                    source: "hyperframes",
+                    licence: "see CREDITS-hyperframes.md",
+                    description: f.replace(/\.mp3$/, "").replace(/-/g, " "),
+                });
+            }
+        }
+        if (existsSync(join(hf, "CREDITS.md"))) {
+            await writeFile(join(tmp, "CREDITS-hyperframes.md"), await readFile(join(hf, "CREDITS.md")));
+        }
+    }
+    if (!sounds.length) {
+        throw new Error("Die Geräusche für Filme konnten nicht geladen werden.");
+    }
+    sounds.sort((a, b) => a.file.localeCompare(b.file));
+    await writeFile(join(tmp, "catalog.json"), JSON.stringify({
+        note: "The only sounds this film may use. Never generate, synthesize or download audio.",
+        music: [],
+        sounds,
+    }, null, 1));
+    await rm(dir, { recursive: true, force: true });
+    await rename(tmp, dir);
+    return dir;
+}

package/apps/runtime/dist/film/step.js

@@ -0,0 +1,286 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile, rm, stat } from "node:fs/promises";
+import { isAbsolute, join, normalize } from "node:path";
+import { StepError } from "../engine/types.js";
+import { CLAUDE_BIN, claudeEnv } from "../harness/claude.js";
+import { failureOf } from "../harness/model.js";
+import { openBridge } from "../mcp/bridge.js";
+import { filmClient } from "../models.js";
+import { prepareFilmFolder, savedSession, saveSession } from "./project.js";
+import { runHyperframes } from "./tools.js";
+/**
+ * A film step: the installed client (Claude Code) works in the film's folder with the skills,
+ * the style kit, the brand and the run's material, and writes the film as code. Its shell runs
+ * in the client's sandbox — writes only inside the folder, no network; HyperFrames (render,
+ * snapshots, checks) runs outside it, through the `hyperframes` tool of this step, limited to
+ * the folder. The final render is the runtime's, not the client's. A run that stops (a limit,
+ * a crash) keeps the folder and the client's session: the next attempt picks up from there.
+ */
+/** What the client may run through the tool; everything that reaches the network stays out. */
+const ALLOWED = new Set([
+    "lint",
+    "check",
+    "validate",
+    "inspect",
+    "snapshot",
+    "render",
+    "compositions",
+    "timeline",
+    "info",
+    "keyframes",
+    "compare",
+    "grade-compare",
+    "beats",
+    "normalize-audio",
+    "media-treatment",
+    "transcribe",
+    "docs",
+]);
+/** The longest a film may take the client before the step gives up. */
+const LIMIT_MS = 3 * 60 * 60_000;
+function hyperframesTool(root, signal) {
+    return {
+        name: "hyperframes",
+        description: "Runs the HyperFrames CLI in the film folder: lint, check, snapshot, render, inspect, timeline, transcribe, keyframes, compare, docs and the like. Paths are relative to the folder. Returns what it printed.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                args: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: 'The arguments, e.g. ["snapshot", "film", "--at", "1,4,8"].',
+                },
+            },
+            required: ["args"],
+        },
+        async execute(input) {
+            const args = (input.args ?? []);
+            if (!args.length || !args.every((a) => typeof a === "string")) {
+                return "args: a list of strings, the subcommand first.";
+            }
+            const [cmd] = args;
+            if (!ALLOWED.has(cmd)) {
+                return `"${cmd}" is not available here. Available: ${[...ALLOWED].join(", ")}.`;
+            }
+            // Every path stays inside the folder.
+            for (const a of args) {
+                const value = a.includes("=") && a.startsWith("-") ? a.slice(a.indexOf("=") + 1) : a;
+                if (isAbsolute(value) || normalize(value).startsWith("..")) {
+                    return `"${a}" leaves the film folder.`;
+                }
+            }
+            const extra = cmd === "transcribe" ? ["--no-runtime-install"] : [];
+            const { code, out } = await runHyperframes([...args, ...extra], {
+                cwd: root,
+                signal,
+                timeoutMs: 20 * 60_000,
+            });
+            return `exit ${code}\n${out.slice(-6000)}`;
+        },
+    };
+}
+/** Lines of a failed render worth reading: what failed and why, not the progress bars. */
+function renderProblem(out) {
+    const lines = out
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => /✗|fail|error|blocked|warning|cannot|undefined/i.test(l) && l.length < 600);
+    return (lines.join("\n") || out.slice(-800)).slice(0, 2500);
+}
+/** How many times a failed final render goes back to the client to be fixed. */
+const RENDER_FIXES = 2;
+export async function runFilmStep(step, ctx) {
+    const found = await filmClient(step.model ?? "standard");
+    if ("problem" in found) {
+        throw new StepError(found.problem);
+    }
+    const { client, alias } = found;
+    await ctx.emit("info", { code: "filmSetup" });
+    const { root, brief } = await prepareFilmFolder(step, ctx);
+    const resume = await savedSession(root);
+    await ctx.emit("info", resume ? { code: "filmResume" } : { code: "filmClient", params: { client: client.name } });
+    const limit = AbortSignal.any([ctx.signal, AbortSignal.timeout(LIMIT_MS)]);
+    const bridge = openBridge([hyperframesTool(root, limit)]);
+    /** One turn of the client in the folder; returns its final event. */
+    const turn = async (prompt, session) => {
+        const args = [
+            "-p",
+            "--output-format",
+            "stream-json",
+            "--verbose",
+            "--model",
+            alias,
+            "--setting-sources",
+            "project",
+            "--strict-mcp-config",
+            "--mcp-config",
+            JSON.stringify({ mcpServers: { film: { type: "http", url: bridge.url } } }),
+            // The shell writes only inside the folder and has no network.
+            "--settings",
+            JSON.stringify({
+                sandbox: { enabled: true, autoAllowBashIfSandboxed: true, allowUnsandboxedCommands: false },
+            }),
+            "--allowedTools",
+            [
+                "Bash",
+                "Read(./**)",
+                "Edit(./**)",
+                "Write(./**)",
+                "Glob",
+                "Grep",
+                "Task",
+                "TodoWrite",
+                "TaskCreate",
+                "TaskUpdate",
+                "TaskList",
+                "TaskGet",
+                "Skill",
+                "mcp__film",
+            ].join(","),
+            "--disallowedTools",
+            "WebFetch,WebSearch",
+        ];
+        if (step.effort) {
+            args.push("--effort", step.effort);
+        }
+        if (session) {
+            args.push("--resume", session);
+        }
+        let last = null;
+        let stderr = "";
+        await new Promise((resolve, reject) => {
+            void (async () => {
+                const child = spawn(CLAUDE_BIN, args, {
+                    cwd: root,
+                    env: await claudeEnv(),
+                    stdio: ["pipe", "pipe", "pipe"],
+                    signal: limit,
+                });
+                let buffer = "";
+                let lastLook = 0;
+                let lastTask = "";
+                const subjects = [];
+                const task = async (now) => {
+                    if (now && now !== lastTask) {
+                        lastTask = now;
+                        await ctx.emit("tool", { code: "filmTask", params: { task: now.slice(0, 90) } });
+                    }
+                };
+                const onEvent = async (event) => {
+                    if (event.session_id && event.type === "system") {
+                        await saveSession(root, event.session_id);
+                    }
+                    if (event.type === "result") {
+                        last = event;
+                    }
+                    for (const part of event.message?.content ?? []) {
+                        if (part.type !== "tool_use") {
+                            continue;
+                        }
+                        const input = part.input ?? {};
+                        // What the client is on, as its own task list says; else a look at its frames.
+                        if (part.name === "TodoWrite") {
+                            const todos = (input.todos ?? []);
+                            await task(todos.find((t) => t.status === "in_progress")?.content);
+                        }
+                        else if (part.name === "TaskCreate") {
+                            subjects.push(String(input.subject ?? ""));
+                        }
+                        else if (part.name === "TaskUpdate" && input.status === "in_progress") {
+                            const id = Number(input.taskId);
+                            await task(typeof input.subject === "string" ? input.subject : subjects[id - 1] || undefined);
+                        }
+                        else if (part.name === "mcp__film__hyperframes" &&
+                            input.args?.[0] === "snapshot" &&
+                            Date.now() - lastLook > 60_000) {
+                            lastLook = Date.now();
+                            await ctx.emit("tool", { code: "filmLooks" });
+                        }
+                    }
+                };
+                child.stdout.on("data", (chunk) => {
+                    buffer += String(chunk);
+                    let nl = buffer.indexOf("\n");
+                    while (nl >= 0) {
+                        const line = buffer.slice(0, nl).trim();
+                        buffer = buffer.slice(nl + 1);
+                        nl = buffer.indexOf("\n");
+                        if (line.startsWith("{")) {
+                            try {
+                                void onEvent(JSON.parse(line)).catch(() => { });
+                            }
+                            catch {
+                                // not a line of the stream
+                            }
+                        }
+                    }
+                });
+                child.stderr.on("data", (chunk) => {
+                    stderr = (stderr + String(chunk)).slice(-4000);
+                });
+                child.on("error", reject);
+                child.on("close", () => resolve());
+                child.stdin.end(prompt);
+            })().catch(reject);
+        }).catch((err) => {
+            if (ctx.signal.aborted) {
+                throw err;
+            }
+            throw new StepError(`${client.name} hat beim Film aufgehört: ${err.message}. Die Arbeit ist gespeichert; ein neuer Versuch macht dort weiter.`);
+        });
+        const result = last;
+        if (!result || result.is_error) {
+            const detail = String(result?.result ?? (stderr.trim() || "kein Ergebnis")).slice(0, 400);
+            throw new StepError(`${failureOf(client, detail).message} Die Arbeit ist gespeichert; ein neuer Versuch macht dort weiter.`);
+        }
+        return result;
+    };
+    const out = join(root, "film", "renders", "film.mp4");
+    let summary = "";
+    try {
+        // A review's note asks for a change: the film's code is there, so it is edited, not redone.
+        const note = ctx.state.notes[step.id]?.trim();
+        const prompt = resume && note
+            ? `The person watched the film and asks for this change:\n\n${note}\n\nChange the film in film/ accordingly — keep what they did not mention — check the frames again, and end with a short summary of what you changed.`
+            : resume
+                ? "Carry on with the film where you stopped. Read PROGRESS.md and the folder to see where that was, then finish it."
+                : `Make the film BRIEF.md asks for, following CLAUDE.md.\n\n${brief}`;
+        const first = await turn(prompt, resume);
+        summary = typeof first.result === "string" ? first.result.trim() : "";
+        // The final render is ours: it does not depend on the client still running. What fails
+        // goes back to the client, which fixes its code.
+        for (let attempt = 0;; attempt++) {
+            if (!existsSync(join(root, "film", "index.html"))) {
+                throw new StepError(`${client.name} hat keinen Film hinterlassen.`);
+            }
+            await ctx.emit("info", { code: "videoRendering" });
+            await rm(out, { force: true });
+            const render = await runHyperframes(["render", "film", "-o", "film/renders/film.mp4", "--crf", "23", "--quiet"], { cwd: root, signal: ctx.signal, timeoutMs: 30 * 60_000 });
+            if (render.code === 0 && existsSync(out) && (await stat(out)).size > 0) {
+                break;
+            }
+            const problem = renderProblem(render.out);
+            if (attempt >= RENDER_FIXES) {
+                throw new StepError(`Der Film ließ sich nicht rendern: ${problem.slice(0, 400)}`);
+            }
+            await ctx.emit("tool", { code: "filmFix" });
+            const fixed = await turn(`The final render of film/ failed:\n\n${problem}\n\nFind the cause in the composition's code, fix it, run \`check\` and a draft render through the hyperframes tool until both pass, and end with one line on what you fixed.`, await savedSession(root));
+            if (typeof fixed.result === "string" && fixed.result.trim()) {
+                summary = `${summary}\n\n${fixed.result.trim()}`.trim();
+            }
+        }
+    }
+    finally {
+        bridge.close();
+    }
+    const ref = await ctx.saveAsset({
+        stepId: step.id,
+        kind: "video",
+        mime: "video/mp4",
+        name: `${step.id}.mp4`,
+        data: new Uint8Array(await readFile(out)),
+        ai: "generated",
+    });
+    return { text: summary.slice(0, 3000), assets: [ref], at: new Date().toISOString() };
+}

package/apps/runtime/dist/film/tools.js

@@ -0,0 +1,99 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { env } from "../env.js";
+/**
+ * The HyperFrames CLI (github.com/heygen-com/hyperframes, Apache 2.0): renders a composition of
+ * HTML, CSS and JS to MP4 frame by frame in headless Chrome. Installed once into the data folder
+ * on the first film, pinned to a version; Chrome comes with it on its first render.
+ */
+export const HYPERFRAMES_VERSION = "0.8.137";
+const home = join(env.dataDir, "tools", `hyperframes-${HYPERFRAMES_VERSION}`);
+const entry = join(home, "node_modules", "hyperframes", "bin", "hyperframes.mjs");
+let installing = null;
+/** Terminal colour codes. */
+const ANSI = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
+/** The CLI's entry script; installs it on first use. */
+export function hyperframesEntry() {
+    if (existsSync(entry)) {
+        return Promise.resolve(entry);
+    }
+    installing ??= install().finally(() => {
+        installing = null;
+    });
+    return installing;
+}
+async function install() {
+    await mkdir(home, { recursive: true });
+    // npm sits next to the node that runs us; else the one on PATH.
+    const local = join(dirname(process.execPath), "npm");
+    const npm = existsSync(local) ? local : "npm";
+    const { code, out } = await spawnText(npm, [
+        "install",
+        "--prefix",
+        home,
+        "--no-audit",
+        "--no-fund",
+        "--loglevel",
+        "error",
+        `hyperframes@${HYPERFRAMES_VERSION}`,
+    ], { cwd: home, timeoutMs: 10 * 60_000 });
+    if (code !== 0 || !existsSync(entry)) {
+        throw new Error(`HyperFrames konnte nicht installiert werden: ${out.slice(-400)}`);
+    }
+    return entry;
+}
+/** What the CLI and the renderer see: no keys of ours, no telemetry. */
+function cliEnv() {
+    const pass = ["PATH", "HOME", "USER", "LOGNAME", "LANG", "TMPDIR", "SHELL"];
+    const out = {};
+    for (const k of pass) {
+        if (process.env[k]) {
+            out[k] = process.env[k];
+        }
+    }
+    // ffmpeg as the runtime finds it, first on the PATH.
+    if (env.ffmpegPath.includes("/")) {
+        out.PATH = `${dirname(env.ffmpegPath)}:${out.PATH ?? ""}`;
+    }
+    out.HYPERFRAMES_NO_TELEMETRY = "1";
+    out.HYPERFRAMES_SKIP_SKILLS = "1";
+    return out;
+}
+/** Runs `hyperframes <args>` in a project folder and returns what it printed (the tail). */
+export async function runHyperframes(args, opts) {
+    const cli = await hyperframesEntry();
+    return spawnText(process.execPath, [cli, ...args], {
+        cwd: opts.cwd,
+        signal: opts.signal,
+        timeoutMs: opts.timeoutMs ?? 20 * 60_000,
+        env: cliEnv(),
+    });
+}
+function spawnText(bin, args, opts) {
+    return new Promise((resolve) => {
+        let out = "";
+        const child = spawn(bin, args, {
+            cwd: opts.cwd,
+            env: opts.env ?? cliEnv(),
+            stdio: ["ignore", "pipe", "pipe"],
+            signal: opts.signal,
+        });
+        const keep = (d) => {
+            out = (out + String(d)).slice(-30_000);
+        };
+        child.stdout.on("data", keep);
+        child.stderr.on("data", keep);
+        const timer = setTimeout(() => child.kill("SIGTERM"), opts.timeoutMs);
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolve({ code: 1, out: `${out}\n${err.message}` });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            // Colours and progress bars mean nothing to a model reading this.
+            resolve({ code: code ?? 1, out: out.replace(ANSI, "") });
+        });
+    });
+}

package/apps/runtime/dist/manage.js

@@ -100,6 +100,10 @@ async function call(method, path, body) {
     }
     return data;
 }
+/** The people of a tenant, as the Manage-App keeps them; they are managed there. */
+export function tenantMembers(id) {
+    return call("GET", `/v1/tenants/${encodeURIComponent(id)}/members`);
+}
 const tenants = new Map();
 /** Plan, limits and balance of a tenant, cached for a minute. */
 export async function tenantInfo(id, fresh = false) {

package/apps/runtime/dist/mcp/auth.js

@@ -47,6 +47,7 @@ async function apiKeyAuth(key) {
         const who = {
             userId: "local",
             tenantId: LOCAL_TENANT,
+            role: "owner",
             client: found.name || "MCP",
             scopes: [...SCOPES],
         };
@@ -64,6 +65,7 @@ async function apiKeyAuth(key) {
     const who = {
         userId: result.userId,
         tenantId: result.tenantId,
+        role: result.role ?? "member",
         client: result.name || "MCP",
         scopes: [...SCOPES],
     };
@@ -83,6 +85,7 @@ async function tokenAuth(token) {
     const who = {
         userId: claims.userId,
         tenantId: claims.tenantId,
+        role: claims.role,
         client: claims.clientId || "MCP",
         scopes: SCOPES.filter((s) => granted.has(s)),
     };
@@ -104,6 +107,7 @@ function localAuth(request, ticket) {
     const who = {
         userId: "local",
         tenantId: LOCAL_TENANT,
+        role: "owner",
         client,
         scopes: [...SCOPES],
     };

package/apps/runtime/dist/mcp/handler.js

@@ -1,6 +1,7 @@
 import { createMcpHandler, McpServer, originValidationResponse, } from "@modelcontextprotocol/server";
 import { withTenant } from "../db/client.js";
 import { env } from "../env.js";
+import { asRole } from "../services/access.js";
 import { tenantStatus } from "../tenants/control.js";
 import { authenticate, principalOf } from "./auth.js";
 import { registerFlowApp } from "./flow-app.js";
@@ -47,6 +48,6 @@ export function mcpHandler() {
                 .catch(() => null);
             noteRequest(who.tenantId, authInfo.clientId, who.client, body);
         }
-        return withTenant(who.tenantId, () => handler.fetch(request, { authInfo }));
+        return withTenant(who.tenantId, () => asRole(who.role, () => handler.fetch(request, { authInfo })));
     };
 }