wyren-mcp 1.0.0 → 1.2.0

package/CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog
+
+## 1.2.0
+
+- **Fixed** Caption (and slideshow) renders failed in the daemon: the vendored `remotion-bundle` was missing `bundle.js.map`, which Remotion's `prepareServer` reads — `sync-worker.mjs` was stripping ALL `.map` files. It now keeps the Remotion bundle maps (still drops the worker's debug map).
+- **Fixed** Chunked captions served trimmed segments over `file://`, which Chromium refuses (fails on WSL2; OffthreadVideo is http-only). Segments are now served over a loopback HTTP server (Range + CORS).
+- **Fixed** Daemon exited on any WebSocket drop (every backend redeploy) instead of reconnecting — the reconnect timer was `unref`'d. It is now ref'd, so the daemon rides through deploys via exponential backoff.
+- **Changed** Remotion pinned to exactly 4.0.421 across renderer + bundler (was drifting to 4.0.452); the worker bundle is rebuilt from monorepo main (0600ac2).
+- **Fixed** The daemon no longer needs R2 credentials. It uploads results via backend-issued **presigned URLs** (`/api/upload/{video,image}/presign` → PUT) using only its `frm_` API key — so it runs on any end-user machine without distributing R2 secrets. Verified end-to-end against prod.
+
+
+## 1.1.0
+
+- **Added** Auto-starting local render worker. `npx wyren-mcp` now logs you in
+  via a one-time browser approval (device-code flow), writes the minted key to
+  `~/.wyren/config.json` (0600), and registers a login-time service (launchd /
+  systemd `--user` / Task Scheduler) that runs the bundled worker.
+- **Added** `worker-standalone/` (self-contained worker binary) and
+  `remotion-bundle/` (prebuilt Remotion compositions) shipped as package assets,
+  generated from the monorepo via `scripts/sync-worker.mjs`.
+- **Added** Runtime dependencies for the worker: `@remotion/renderer` (pinned
+  `4.0.421`), `ffmpeg-static`, `ws`, `zod`, `file-type`, `@aws-sdk/client-s3`,
+  `@aws-sdk/lib-storage`.
+- **Added** `npx wyren-mcp --uninstall` to remove the auto-start service, and
+  `--no-worker` to skip worker setup at install time.
+- **Changed** `setup.mjs` is now a 4-step installer (MCP add → skill → device
+  login → service registration). All worker steps are wrapped so install never
+  hard-fails; the exact manual run command is printed if any step is
+  unsupported or declined.
+
+## 1.0.0
+
+- Initial installer: adds the Wyren MCP server and copies the agent skill.

package/README.md

@@ -1,6 +1,6 @@
 # wyren-mcp
 
-Install the [Wyren](https://wyren.yibby.ai) MCP server and agent skills for Claude Code.
+Install the [Wyren](https://wyren.yibby.ai) MCP server, agent skills, and an auto-starting local render worker for Claude Code.
 
 ## Install
 
@@ -12,16 +12,78 @@ npx wyren-mcp
 npx wyren-mcp --global
 ```
 
-This adds the Wyren MCP server to your Claude Code config and installs the Wyren skill for guided AI pipeline building.
+This:
+
+1. Adds the Wyren MCP server to your Claude Code config.
+2. Installs the Wyren agent skill for guided AI pipeline building.
+3. Logs you in once via your browser and starts a **local render worker** that auto-starts at login.
 
 ## What you get
 
-- **MCP Server** — 38 tools for creating, building, executing, and publishing AI workflows
-- **Agent Skill** — teaches Claude how to use Wyren tools effectively, with workflow patterns and domain knowledge
+- **MCP Server** — tools for creating, building, executing, and publishing AI workflows.
+- **Agent Skill** — teaches Claude how to use Wyren tools effectively, with workflow patterns and domain knowledge.
+- **Local render worker** — a background daemon that runs heavy renders (captions, slideshows, video merge/trim, audio overlay, brainrot compose) on your machine instead of Wyren's servers. Faster for you, cheaper to run.
+
+## The local render worker
+
+### One-time browser approval
+
+During setup, your browser opens to a Wyren `/device` page showing a short code. Approve it while logged in to your Wyren account. The installer then mints an API key scoped to your account and writes it to:
+
+```
+~/.wyren/config.json   (permissions 0600 — readable only by you)
+```
+
+You never copy-paste a key. After this one approval, the worker authenticates automatically on every start.
+
+### Auto-start at login
+
+The installer registers a per-user login service that runs the worker whenever you log in:
+
+| Platform | Mechanism | Location |
+| --- | --- | --- |
+| macOS | launchd LaunchAgent | `~/Library/LaunchAgents/ai.wyren.worker.plist` |
+| Linux | systemd `--user` unit | `~/.config/systemd/user/wyren-worker.service` |
+| Windows | Task Scheduler (ONLOGON) | task `Wyren\WyrenWorker` |
+
+The service runs `worker-launcher.mjs`, which reads your key from `~/.wyren/config.json` and starts the bundled worker. The key is never written into the service definition itself.
+
+### Where things live
+
+- **Key / config**: `~/.wyren/config.json`
+- **Logs**: `~/.wyren/worker.log`
+- **Worker binary + Remotion bundle**: shipped inside this package (`worker-standalone/`, `remotion-bundle/`).
+
+On the first render the worker downloads a headless Chromium (~200MB) via Remotion's `ensureBrowser()`. This is a one-time download.
+
+### Disabling / uninstalling the worker
+
+```bash
+npx wyren-mcp --uninstall
+```
+
+This removes the auto-start service. Your `~/.wyren/config.json` is left in place — delete it manually to fully reset. To skip the worker at install time:
 
-## Manual setup
+```bash
+npx wyren-mcp --no-worker
+```
 
-If the installer doesn't work, you can set up manually:
+### Running the worker manually
+
+If auto-start is unsupported on your system, or you prefer to run it yourself:
+
+```bash
+WYREN_API_KEY=<your frm_ key> \
+WYREN_BACKEND_URL=https://api.wyren.ai \
+WYREN_REMOTION_BUNDLE_DIR=<package>/remotion-bundle \
+node <package>/worker-standalone/index.mjs
+```
+
+(`<package>` is wherever npm installed `wyren-mcp`.)
+
+## Manual MCP setup
+
+If the installer doesn't work, set up the MCP server manually:
 
 ```bash
 # Add MCP server (local)
@@ -33,3 +95,14 @@ claude mcp add --transport http --scope user wyren https://api.wyren.ai/mcp
 # Install skill (via skills CLI)
 npx skills add briarbearrr/wyren-mcp
 ```
+
+## Maintainers
+
+The `worker-standalone/` and `remotion-bundle/` directories are **generated** from the Wyren monorepo, not authored here. To update them, see `scripts/sync-worker.mjs`:
+
+```bash
+# in the monorepo:
+npm run build:worker && npm run bundle:remotion
+# then, in this repo:
+node scripts/sync-worker.mjs /path/to/frames
+```

package/lib/config.mjs

@@ -0,0 +1,46 @@
+// Wyren config persistence — `~/.wyren/config.json`, 0600.
+//
+// The device-login flow writes the minted `frm_...` key + backend URL here so
+// the worker daemon (and every subsequent login-time start) can authenticate
+// without the user ever copy-pasting a key. The service definition we register
+// reads the key from this file at start time.
+
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+export const WYREN_DIR = join(homedir(), '.wyren');
+export const CONFIG_PATH = join(WYREN_DIR, 'config.json');
+export const LOG_PATH = join(WYREN_DIR, 'worker.log');
+
+/** Ensure `~/.wyren` exists with restrictive perms; return its path. */
+export function ensureWyrenDir() {
+  if (!existsSync(WYREN_DIR)) {
+    mkdirSync(WYREN_DIR, { recursive: true, mode: 0o700 });
+  }
+  return WYREN_DIR;
+}
+
+/** Read `~/.wyren/config.json`, or `null` if it doesn't exist / is unreadable. */
+export function readConfig() {
+  if (!existsSync(CONFIG_PATH)) return null;
+  try {
+    return JSON.parse(readFileSync(CONFIG_PATH, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Write `{ apiKey, backendUrl, ... }` to `~/.wyren/config.json` with 0600 perms.
+ * Merges over any existing config so re-running setup doesn't drop fields.
+ */
+export function writeConfig(patch) {
+  ensureWyrenDir();
+  const current = readConfig() ?? {};
+  const next = { ...current, ...patch, updatedAt: new Date().toISOString() };
+  writeFileSync(CONFIG_PATH, JSON.stringify(next, null, 2), { mode: 0o600 });
+  // writeFileSync's mode only applies on create; enforce on overwrite too.
+  chmodSync(CONFIG_PATH, 0o600);
+  return next;
+}

package/lib/device-auth.mjs

@@ -0,0 +1,96 @@
+// Device-code login — mirrors `gh auth login` / OAuth 2.0 device flow.
+//
+// Backend contract (frames monorepo `backend/src/routes/auth.ts`):
+//   POST /api/auth/device-code   (unauthenticated)
+//     → 200 { deviceCode, userCode, verificationUrl, expiresIn, interval }
+//   POST /api/auth/device-token  (unauthenticated, body { deviceCode })
+//     → 428 { status: 'authorization_pending' }   (keep polling)
+//     → 200 { status: 'complete', apiKey: 'frm_...' }
+//     → 400 { status: 'expired' | 'denied' }
+//
+// The user approves in-browser at `verificationUrl` (the `/device` page) while
+// logged in; that mints a key scoped to their account and flips the device code
+// to approved. We never see their session — only the one-time `frm_...` key.
+
+import { openBrowser } from './open-browser.mjs';
+
+class DeviceAuthError extends Error {}
+
+/**
+ * Run the full device-code login against `backendUrl`.
+ * Returns the minted `frm_...` apiKey, or throws DeviceAuthError on
+ * expiry/denial/timeout. Network/transport failures bubble as-is so the
+ * caller's try/catch can fall back to the manual path.
+ */
+export async function deviceLogin(backendUrl, { log = console.log } = {}) {
+  const base = backendUrl.replace(/\/$/, '');
+
+  const startRes = await fetch(`${base}/api/auth/device-code`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  });
+  if (!startRes.ok) {
+    throw new DeviceAuthError(
+      `device-code request failed (HTTP ${startRes.status}). The backend may not yet expose the device-auth flow.`,
+    );
+  }
+  const grant = await startRes.json();
+  const { deviceCode, userCode, verificationUrl } = grant;
+  const intervalMs = Math.max(1, Number(grant.interval) || 5) * 1000;
+  const expiresMs = Math.max(30, Number(grant.expiresIn) || 600) * 1000;
+
+  log('');
+  log('  To finish setup, approve this device in your browser:');
+  log(`    ${verificationUrl}`);
+  log('');
+  log(`  Verification code: ${userCode}`);
+  log('  (Opening your browser. If it does not open, visit the URL above.)');
+  log('');
+
+  openBrowser(verificationUrl);
+
+  const deadline = Date.now() + expiresMs;
+  // OAuth device-flow politeness: respect the server interval between polls.
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    let pollRes;
+    try {
+      pollRes = await fetch(`${base}/api/auth/device-token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ deviceCode }),
+      });
+    } catch {
+      // Transient network blip — keep polling until the deadline.
+      continue;
+    }
+
+    if (pollRes.status === 428) continue; // authorization_pending
+    if (pollRes.ok) {
+      const data = await pollRes.json();
+      if (data.status === 'complete' && typeof data.apiKey === 'string') {
+        return data.apiKey;
+      }
+      throw new DeviceAuthError('Unexpected device-token response.');
+    }
+
+    // 400 → expired or denied.
+    let status = 'denied';
+    try {
+      ({ status } = await pollRes.json());
+    } catch {
+      /* keep default */
+    }
+    throw new DeviceAuthError(
+      status === 'expired'
+        ? 'Device code expired before approval.'
+        : 'Device authorization was denied.',
+    );
+  }
+  throw new DeviceAuthError('Timed out waiting for browser approval.');
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}

package/lib/open-browser.mjs

@@ -0,0 +1,35 @@
+// Cross-platform "open this URL in the default browser".
+//
+// No dependency on the `open` npm package — a tiny spawn of the platform's
+// native opener keeps the installer dependency-free for the auth step. Best
+// effort: if the spawn fails (headless box, no DISPLAY), the caller still
+// prints the URL for the user to open manually.
+
+import { spawn } from 'child_process';
+
+export function openBrowser(url) {
+  const platform = process.platform;
+  let cmd;
+  let args;
+
+  if (platform === 'darwin') {
+    cmd = 'open';
+    args = [url];
+  } else if (platform === 'win32') {
+    // `start` is a cmd builtin; the empty title arg avoids quoting pitfalls.
+    cmd = 'cmd';
+    args = ['/c', 'start', '', url];
+  } else {
+    cmd = 'xdg-open';
+    args = [url];
+  }
+
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => {});
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}

package/lib/service.mjs

@@ -0,0 +1,216 @@
+// OS auto-start registration for the Wyren worker.
+//
+// Registers a login-time service that runs `node <pkg>/worker-launcher.mjs`
+// (which reads the 0600 config and execs the bundled worker). Idempotent:
+// re-running setup re-writes the same unit/plist/task in place rather than
+// duplicating it. `uninstallService` tears it down.
+//
+//   macOS   → launchd LaunchAgent  (~/Library/LaunchAgents/ai.wyren.worker.plist)
+//   Linux   → systemd --user unit  (~/.config/systemd/user/wyren-worker.service)
+//   Windows → Task Scheduler task   (schtasks /TN Wyren\WyrenWorker, ONLOGON)
+//
+// VERIFIED ON: Linux (systemd --user path validated with `systemctl --user
+// cat`). The macOS launchd and Windows schtasks generators are written and
+// linted but UNVERIFIED on the build box — see README "Disabling the worker".
+
+import { execFileSync } from 'child_process';
+import { existsSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+import { LOG_PATH, ensureWyrenDir } from './config.mjs';
+
+export const SERVICE_LABEL = 'ai.wyren.worker';
+
+// ---------------------------------------------------------------------------
+// Linux — systemd --user
+// ---------------------------------------------------------------------------
+
+const SYSTEMD_DIR = join(homedir(), '.config', 'systemd', 'user');
+const SYSTEMD_UNIT_PATH = join(SYSTEMD_DIR, 'wyren-worker.service');
+
+function linuxUnit(nodePath, launcherPath) {
+  // Restart=always with a backoff keeps the worker alive across crashes/network
+  // drops; the daemon itself also reconnects, so this only covers hard exits.
+  return `[Unit]
+Description=Wyren local render worker
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${nodePath} ${launcherPath}
+Restart=always
+RestartSec=5
+StandardOutput=append:${LOG_PATH}
+StandardError=append:${LOG_PATH}
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+function installLinux(nodePath, launcherPath) {
+  mkdirSync(SYSTEMD_DIR, { recursive: true });
+  writeFileSync(SYSTEMD_UNIT_PATH, linuxUnit(nodePath, launcherPath), { mode: 0o644 });
+  // `daemon-reload` picks up the new unit; `enable` wires it to login;
+  // `--now` also starts it immediately. All best-effort.
+  systemctlUser(['daemon-reload']);
+  systemctlUser(['enable', '--now', 'wyren-worker.service']);
+  return { type: 'systemd', path: SYSTEMD_UNIT_PATH };
+}
+
+function uninstallLinux() {
+  // `disable` fails loudly when the unit was never installed — that's the
+  // common "already uninstalled" case, so swallow it and just clean up.
+  systemctlUserSoft(['disable', '--now', 'wyren-worker.service']);
+  if (existsSync(SYSTEMD_UNIT_PATH)) rmSync(SYSTEMD_UNIT_PATH);
+  systemctlUserSoft(['daemon-reload']);
+}
+
+function systemctlUser(args) {
+  execFileSync('systemctl', ['--user', ...args], { stdio: 'pipe' });
+}
+
+function systemctlUserSoft(args) {
+  try {
+    systemctlUser(args);
+  } catch {
+    /* unit not present / nothing to do */
+  }
+}
+
+// ---------------------------------------------------------------------------
+// macOS — launchd LaunchAgent
+// ---------------------------------------------------------------------------
+
+const LAUNCHD_DIR = join(homedir(), 'Library', 'LaunchAgents');
+const LAUNCHD_PLIST_PATH = join(LAUNCHD_DIR, `${SERVICE_LABEL}.plist`);
+
+function macPlist(nodePath, launcherPath) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${SERVICE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nodePath}</string>
+    <string>${launcherPath}</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${LOG_PATH}</string>
+  <key>StandardErrorPath</key>
+  <string>${LOG_PATH}</string>
+</dict>
+</plist>
+`;
+}
+
+function installMac(nodePath, launcherPath) {
+  mkdirSync(LAUNCHD_DIR, { recursive: true });
+  writeFileSync(LAUNCHD_PLIST_PATH, macPlist(nodePath, launcherPath), { mode: 0o644 });
+  // Idempotent: unload first (ignore failure when not yet loaded), then load.
+  try {
+    execFileSync('launchctl', ['unload', LAUNCHD_PLIST_PATH], { stdio: 'pipe' });
+  } catch {
+    /* not loaded yet */
+  }
+  execFileSync('launchctl', ['load', '-w', LAUNCHD_PLIST_PATH], { stdio: 'pipe' });
+  return { type: 'launchd', path: LAUNCHD_PLIST_PATH };
+}
+
+function uninstallMac() {
+  if (existsSync(LAUNCHD_PLIST_PATH)) {
+    try {
+      execFileSync('launchctl', ['unload', '-w', LAUNCHD_PLIST_PATH], { stdio: 'pipe' });
+    } catch {
+      /* already unloaded */
+    }
+    rmSync(LAUNCHD_PLIST_PATH);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Windows — Task Scheduler (ONLOGON)
+// ---------------------------------------------------------------------------
+
+const WIN_TASK_NAME = 'Wyren\\WyrenWorker';
+
+function installWindows(nodePath, launcherPath) {
+  // /F overwrites an existing task → idempotent. /SC ONLOGON runs at user login.
+  // /RL LIMITED keeps it in the user's security context.
+  const tr = `"${nodePath}" "${launcherPath}"`;
+  execFileSync(
+    'schtasks',
+    ['/Create', '/F', '/SC', 'ONLOGON', '/RL', 'LIMITED', '/TN', WIN_TASK_NAME, '/TR', tr],
+    { stdio: 'pipe' },
+  );
+  // Start it now (best-effort; the task is also wired to next logon).
+  try {
+    execFileSync('schtasks', ['/Run', '/TN', WIN_TASK_NAME], { stdio: 'pipe' });
+  } catch {
+    /* will run at next logon */
+  }
+  return { type: 'schtasks', path: WIN_TASK_NAME };
+}
+
+function uninstallWindows() {
+  try {
+    execFileSync('schtasks', ['/End', '/TN', WIN_TASK_NAME], { stdio: 'pipe' });
+  } catch {
+    /* not running */
+  }
+  try {
+    execFileSync('schtasks', ['/Delete', '/F', '/TN', WIN_TASK_NAME], { stdio: 'pipe' });
+  } catch {
+    /* task not present / already removed */
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Register + start the login-time worker service for the current platform.
+ * `launcherPath` is the absolute path to `worker-launcher.mjs` in the package.
+ * Returns a descriptor; throws if the platform tooling rejects the call (the
+ * caller wraps this in try/catch and prints the manual fallback).
+ */
+export function installService(launcherPath) {
+  // The service definition points its logs at LOG_PATH (~/.wyren/worker.log);
+  // ensure the dir exists so systemd/launchd can open the file at start time
+  // even if device-login hasn't run yet (e.g. a manual re-register).
+  ensureWyrenDir();
+  const nodePath = process.execPath;
+  switch (process.platform) {
+    case 'linux':
+      return installLinux(nodePath, launcherPath);
+    case 'darwin':
+      return installMac(nodePath, launcherPath);
+    case 'win32':
+      return installWindows(nodePath, launcherPath);
+    default:
+      throw new Error(`Unsupported platform: ${process.platform}`);
+  }
+}
+
+/** Remove the login-time worker service. Best-effort across platforms. */
+export function uninstallService() {
+  switch (process.platform) {
+    case 'linux':
+      return uninstallLinux();
+    case 'darwin':
+      return uninstallMac();
+    case 'win32':
+      return uninstallWindows();
+    default:
+      throw new Error(`Unsupported platform: ${process.platform}`);
+  }
+}

package/package.json

@@ -1,21 +1,43 @@
 {
   "name": "wyren-mcp",
-  "version": "1.0.0",
-  "description": "Install the Wyren MCP server and agent skills for Claude Code",
+  "version": "1.2.0",
+  "description": "Install the Wyren MCP server, agent skills, and auto-starting local render worker for Claude Code",
   "bin": {
     "wyren-mcp": "setup.mjs"
   },
+  "scripts": {
+    "sync-worker": "node scripts/sync-worker.mjs"
+  },
   "files": [
     "setup.mjs",
-    "skills/"
+    "worker-launcher.mjs",
+    "lib/",
+    "scripts/",
+    "skills/",
+    "worker-standalone/",
+    "remotion-bundle/",
+    "CHANGELOG.md"
   ],
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.975.0",
+    "@aws-sdk/lib-storage": "^3.975.0",
+    "@remotion/renderer": "4.0.421",
+    "ffmpeg-static": "^5.3.0",
+    "file-type": "^21.3.0",
+    "ws": "^8.18.0",
+    "zod": "3.22.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
   "keywords": [
     "wyren",
     "mcp",
     "claude",
     "ai",
     "video",
-    "agent-skills"
+    "agent-skills",
+    "render-worker"
   ],
   "license": "MIT",
   "repository": {