Conversation
- New variants: orbit-in, venn-reveal, stem-grow, pulse-beat, word-rise - New brand assets for opendating/ and prepai/ - 08-glitch-resolve now uses the fps prop instead of a hardcoded 30 Co-Authored-By: Claude <noreply@anthropic.com>
Launch blockers: - add missing "main" entry point (packaged builds crashed at launch) - asarUnpack bin/scripts/src/etc. and point packaged paths at app.asar.unpacked so spawned node CLI children can read their files - convert preload to CommonJS so it loads under sandbox:true (ESM preloads cannot run sandboxed) — the renderer bridge never initialized in packaged builds before Security: - deny renderer navigation and window.open (the IPC bridge is privileged); sender-frame validation on every ipcMain handler - raw commands restricted to the CLI catalog allowlist - cca:set-secret now enforces validateSecretKey (arbitrary env keys could previously reach every spawned child process) - strict CSP injected into the built renderer; log redaction extended - secrets vault merged into each spawn env (no restart needed) Correctness and hygiene: - macOS window-all-closed/activate lifecycle; single-instance guard - preferences.json written 0600; entitlements gain network.client and user-selected file access; notarize.cjs afterSign hook - delete unwired worker layer and dead IPC channels; protocol.mjs is now the single wired source of truth - desktop/src gets strict tsconfig (7 silent type errors fixed); typed window.cca bridge incl. new cca:probe-video (ffprobe) - untrack desktop/dist-renderer/ build artifacts - .npmignore no longer contradicts the files field (ebay/logo ship) Co-Authored-By: Claude <noreply@anthropic.com>
…ning - transcribe-openai: remove process.exit(0) that skipped the temp-audio cleanup finally (multi-hundred-MB leak per successful run); catch errors with a clean non-zero exit - smart-clips: validate selection plans (disk + model output) against a zod schema and regenerate invalid ones instead of crashing downstream - ai-provider: 180s default client timeout; structuredChatCompletion retries once on invalid JSON with a repair prompt; resolveModel returns null when no provider is configured (no OpenAI-specific leak); delete dead exports (runStructuredCompletion, providerSupports, resolveTranscriptionProvider); transcribe + smart-clips now use the shared structured path - dedup slugify/timestampSlug/tokenize: single implementations in lib.mjs/clipkit-lib.mjs, all 19 local copies now delegate - lib.run() reports exit code/signal and distinguishes missing binaries; emitJsonResult helper for --json stdout (video, compress-video use it) - unhandledRejection guards in caption/chapter/enhance/smart-clips - remove personal paths: process-links uses $CCA_LINKS_PATH, clipkit frame default uses $CCA_FRAME_PATH; delete dead lib.d.mts - ebay/: require EBAY_MCP_TOKEN (Bearer auth) for all MCP calls; top-level error containment in all 23 scripts Co-Authored-By: Claude <noreply@anthropic.com>
- src/fonts.ts: caption font contract + render-time warning when a machine lacks the caption fonts (renders are machine-dependent until fonts are bundled — warn loudly instead of silent visual drift) - root.tsx: zod-validate CaptionedClip props in calculateMetadata — malformed captions now fail with a readable error instead of NaN frames - captioned-clip: memoize containerPositionStyle (was recreated per frame, defeating the layout memo); split page segmentation from the per-frame lookup; name the linger windows (PAGE_OVERLAP_MS, TOKEN_OVERLAP_MS) - prompt-video: progress bar uses shots.length (was hardcoded 6) and map index (was O(n^2) indexOf) - showcase-root: drop type-unsafe casts - tsconfig: drop dead "scripts" include Co-Authored-By: Claude <noreply@anthropic.com>
- ai-provider suite rewritten (26 tests): mock-client coverage for chatCompletion request shaping, fence stripping, structured JSON retry/repair, and error pass-through; env restore hardened with finally - smoke suite: silent early-returns replaced with loud t.skip() so missing-binary machines can't ship green vacuously Co-Authored-By: Claude <noreply@anthropic.com>
- flat ESLint config: eslint:recommended for scripts/desktop/tests JS, typescript-eslint recommended for desktop/src, browser globals for the legacy renderer, require allowed in .cjs (preload/notarize) - prettierrc + lint/format/format:check npm scripts; check gate extended - ~70 violations fixed across 36 files: dead imports and assignments removed, empty catches annotated, regex escapes corrected Co-Authored-By: Claude <noreply@anthropic.com>
- README 1850 -> 300 lines: quickstart + command reference; all walkthroughs consolidated in docs/WORKFLOWS.md with no duplication - stale claims corrected (menu tables, flag defaults, test counts); all personal machine paths removed from docs - CHANGELOG.md added (0.1.0 + 0.1.1); CLAUDE.md refreshed: current test counts, ai-provider pattern, desktop IPC conventions, lint commands, updated known-issues Co-Authored-By: Claude <noreply@anthropic.com>
- install ffmpeg/imagemagick so smoke tests render real MP4s - new jobs: package-check (dry-run tarball must ship ebay/logo/bin/docs) and desktop-build (renderer build + electron-builder --dir) to catch main-entry/preload/asar regressions before release Co-Authored-By: Claude <noreply@anthropic.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Keep frozen CI installs aligned with the reconciled desktop and tooling dependencies.
Keep chapter generation useful without a transcription provider and place the notarization hook in the valid builder scope.
Prevent provider errors from exposing credentials through terminal or job logs.
Keep the reconciled production diff free of formatting defects before merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation