feat(cli): skill install targets + remove custom install in favor of vercel-labs/skills by vanceingalls · Pull Request #177 · heygen-com/hyperframes

vanceingalls · 2026-04-01T04:20:52Z

Summary

Skill install targets (original):

Add project-level skill install targets: Windsurf, Cline, Roo Code, Trae (opt-in via flag)
Split install logic into global vs project-level
Fix lint false positive: timed tags with data-composition-id no longer flagged by media rule

Skill system cleanup (folded from #189):

Delete install-skills.ts (~485 lines) — remove custom installation wrapper entirely
Strip skill logic from init — no more project-level .claude/skills/ copies, no --skip-skills flag; replaced with post-scaffold message: npx skills add heygen-com/hyperframes
Front-load SKILL.md trigger words — all 5 skill descriptions rewritten so activation language comes first (~150 chars)
Update CLAUDE.md — install instructions now point to vercel-labs/skills
Fix .claude/settings.json — pre-commit hook changed from pnpm to bun

Test plan

npx hyperframes skills → "Unknown command skills"
npx hyperframes init test --template blank --non-interactive --skip-transcribe → prints npx skills add heygen-com/hyperframes
grep -r "install-skills" packages/cli/src/ → no results
All 5 skills/*/SKILL.md have front-loaded descriptions

🤖 Generated with Claude Code

vanceingalls · 2026-04-01T04:21:05Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

Remove custom skill installation from the CLI in favor of vercel-labs/skills. Fixes staleness, deduplication, listing budget, and completeness issues identified by agentic harness pattern review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

6 tasks: delete install-skills, strip skills from init, front-load SKILL.md descriptions, update CLAUDE.md, clean up my-video copies. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove installSkills(), getBundledSkillsDir(), project-level skill copying, and the --skip-skills flag. Replace post-scaffold messaging with directions to run `npx skills add heygen-com/hyperframes`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…skills

Also fix .claude/settings.json pre-commit hook to use bun instead of pnpm. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…vercel-labs/skills (heygen-com#177) ## Summary **Skill install targets (original):** - Add project-level skill install targets: Windsurf, Cline, Roo Code, Trae (opt-in via flag) - Split install logic into global vs project-level - Fix lint false positive: timed tags with `data-composition-id` no longer flagged by media rule **Skill system cleanup (folded from heygen-com#189):** - Delete `install-skills.ts` (~485 lines) — remove custom installation wrapper entirely - Strip skill logic from `init` — no more project-level `.claude/skills/` copies, no `--skip-skills` flag; replaced with post-scaffold message: `npx skills add heygen-com/hyperframes` - Front-load SKILL.md trigger words — all 5 skill descriptions rewritten so activation language comes first (~150 chars) - Update CLAUDE.md — install instructions now point to [vercel-labs/skills](https://github.com/vercel-labs/skills) - Fix `.claude/settings.json` — pre-commit hook changed from `pnpm` to `bun` ## Test plan - [ ] `npx hyperframes skills` → "Unknown command skills" - [ ] `npx hyperframes init test --template blank --non-interactive --skip-transcribe` → prints `npx skills add heygen-com/hyperframes` - [ ] `grep -r "install-skills" packages/cli/src/` → no results - [ ] All 5 `skills/*/SKILL.md` have front-loaded descriptions 🤖 Generated with [Claude Code](https://claude.com/claude-code)

The default root is a predictable name under the shared tmpdir, so a local user could pre-create it to plant cached frames or a symlinked .hf-last-gc (CodeQL js/insecure-temporary-file heygen-com#177). assertPrivateCacheRoot creates the root 0700 and requires a real directory, owned by the caller and closed to group/other on POSIX. The extractor disables caching with its existing warning when the check fails, clean skips the sweep, and the sweep marker is written via exclusive temp file plus rename so it never follows a symlink. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* chore(upstream): adopt upstream/main d94708e as a whole tree Adopt all pending upstream work (about 837 commits) on top of the fork. The fork history is squashed with no shared ancestry, so this was merged through a bridge on v0.8.35 (63574a7) and squashed onto fork main. 400 generated catalog pages come from upstream; 39 other conflicts were resolved by hand, keeping fork overlay files and the fork's CodeQL hardening where it could coexist with upstream's rewrites. Conflict table, kept fork deltas, dropped hardening, and verification are in docs/DECISIONS.md (2026-10-07). Baseline reviewed_through moves to d94708e. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(security): validate remote media magic bytes before freezing Restore the fork's assertRemoteMediaBytes in the adopted upstream freezeUrl: downloaded bytes must match the destination extension (SVG still goes through sanitizeSvg, .cube through cube-validate, unknown extensions fail closed). Replace the invalid streaming fixture with valid ISO base media bytes, add HTML-as-.png and #EXTM3U-as-.mp4 rejection tests, and delete the now callerless freeze-publisher module and its test. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore(capture): drop callerless frameworkMarkup Nothing imports stripFrameworkMarkup after the upstream adoption; upstream's DOM-based filterExtractedScripts covers the same threat. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * chore(github): remove upstream CODEOWNERS The file names an upstream maintainer as owner of the capture-check files; on this fork it would request reviews from a person who does not maintain it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * ci(fork): gate pr-captures to the upstream repository The Before/After capture requirement is upstream's contributor process and fails on every fork PR. Gate the job like the other upstream-process workflows, list catalog-publish, canary-sunset and pr-captures in FORK.md, and add a maintenance test that keeps the gates and the table in sync. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(security): install media vectors from the package and contain row.file Upstream's fetchMediaVectors downloaded media-vectors.* from a mutable raw.githubusercontent.com path with no timeout, size cap or pair validation, then trusted row.file via resolve(row.file), so a tampered catalog could make any local file the SFX result that freeze copies into the project. - build-copy ships media-vectors.json/.bin in dist/catalog-artifact - installMediaVectors installs from the bundled directory with the same pair and row validation as vectorPairAgrees, refuses absolute or .. row files, writes 0o600 via temp file and rename, and never fetches - resolveBundledMediaFile accepts only relative paths that stay inside the bundled root; the cwd-relative candidate is gone - resolve.mjs uses searchLocalSfxIndex; fetchMediaVectors and the HYPERFRAMES_REGISTRY path are removed - tests: absolute and .. row files rejected, ranking works with fetch forbidden Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * docs(studio-server): fix stale collision-suffix comment on upload The comment claimed the suffixed path was validated at that point; the check runs on the requested destination and suffixed names are chosen later in the exclusive-create loop. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * docs(fork): record the post-merge review of the upstream adoption Append the findings, fixes and the two judged-covered items (upload mode, frameworkMarkup) to the 2026-10-07 entry. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(media-use): drop unused fs imports from the vendored heygen helper The fork's downloadTo rewrite moved writes into normalizeCloudAudio, so existsSync, mkdirSync and writeFileSync were left unused and failed the Preflight lint. Record the lint result and the two pre-existing CI failures that come from upstream in DECISIONS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(core): match scoped scripts after the fork's JSON-literal wrapping The upstream render-order test looked for push("n") as raw text, but the fork wraps scoped composition scripts as JSON string literals, so the marker was not found in one mode and sorted first. Unescape quotes before matching and require every marker to be present in both modes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(fork): correct why the drag-frames check fails before merge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(core): bound the url(#id) scan so hostile render input cannot stall the event loop Exclude '(' from the fragment id class so a long run of 'url(#!' with no closing paren no longer backtracks quadratically (CodeQL js/polynomial-redos heygen-com#156). Adds linear-time regression tests and keeps url(#a), url('#a') and url( "#a" ) rewriting unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(engine): refuse an extract cache root another user could control The default root is a predictable name under the shared tmpdir, so a local user could pre-create it to plant cached frames or a symlinked .hf-last-gc (CodeQL js/insecure-temporary-file heygen-com#177). assertPrivateCacheRoot creates the root 0700 and requires a real directory, owned by the caller and closed to group/other on POSIX. The extractor disables caching with its existing warning when the check fails, clean skips the sweep, and the sweep marker is written via exclusive temp file plus rename so it never follows a symlink. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(media-use): re-encode Gemini TTS audio through ffmpeg before writing it Gemini response bytes were written to disk after only a RIFF header check (CodeQL js/http-to-file-access heygen-com#180). Route them through normalizeCloudAudio like the HeyGen path, injectable for tests, and report a transcode failure as ok:false without leaving a raw file behind. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * refactor(cli): delete the callerless fetchLocalVectors download path Nothing but its own tests called it; the catalog cache is filled by installLocalVectors from the bundled package (CodeQL js/http-to-file-access heygen-com#183). Removes it with its options type and timeout constant, ports the media-vector validation tests onto installLocalVectors, and adds a test that installLocalVectors does not touch fetch. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * docs(fork): record the PR #2 CodeQL fixes and dispositions Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * fix(engine): tighten an own 0755 extract cache root instead of disabling it A root left at 0755 by an older umask belongs to this user and nobody else can write to it, so chmod it to 0700 and keep caching. Roots that group or others can write to are still refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(producer): check the extract cache root before using the GIF cache The animated-GIF cache sits under the same extract cache root and is used during compile, before the frame cache's ownership check, so a root another local user controlled could still poison or redirect it. Route it through assertPrivateCacheRoot and disable only the GIF cache on failure. Also format the Gemini TTS test and correct DECISIONS (heygen-com#182 is fixed; media vectors install via installMediaVectors). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): validate adoption comments and test the exact PR candidate * fix(security): restore capture and media guards and harden Frost assets --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

This was referenced Apr 1, 2026

feat(whisper+captions): language detection, audio-reactive captions, multilingual defaults #175

Merged

feat(skills): add dynamic caption techniques and split captions skill into references #173

Merged

vanceingalls mentioned this pull request Apr 1, 2026

feat(captions): energy-based technique selection and mandatory quality checks #176

Merged

3 tasks

vanceingalls marked this pull request as ready for review April 1, 2026 04:22

vanceingalls force-pushed the vance/skills-agent-support branch from e6fd024 to e762823 Compare April 1, 2026 05:26

This was referenced Apr 1, 2026

fix(studio): serve runtime locally instead of from CDN #178

Closed

feat(cli): add hyperframes validate command #179

Merged

vanceingalls force-pushed the vance/captions-skill-updates branch from 1cbe901 to fe9a3a2 Compare April 1, 2026 05:38

vanceingalls force-pushed the vance/skills-agent-support branch 2 times, most recently from b6d1cf7 to 2c4bd09 Compare April 1, 2026 06:00

vanceingalls mentioned this pull request Apr 1, 2026

feat(studio): caption designer #180

Closed

8 tasks

miguel-heygen approved these changes Apr 1, 2026

View reviewed changes

vanceingalls force-pushed the vance/skills-agent-support branch from 2c4bd09 to 9b15f7b Compare April 1, 2026 22:05

vanceingalls force-pushed the vance/captions-skill-updates branch from 44abb54 to 847ba6e Compare April 1, 2026 22:05

vanceingalls mentioned this pull request Apr 1, 2026

fix(skills): default to non-.en whisper models to prevent silent translation #186

Closed

2 tasks

vanceingalls force-pushed the vance/captions-skill-updates branch from 847ba6e to efb09e3 Compare April 2, 2026 05:30

vanceingalls force-pushed the vance/skills-agent-support branch from 9b15f7b to 6956531 Compare April 2, 2026 05:30

vanceingalls mentioned this pull request Apr 2, 2026

refactor(cli): remove custom skill install, delegate to vercel-labs/skills #189

Closed

4 tasks

vanceingalls changed the base branch from vance/captions-skill-updates to graphite-base/177 April 2, 2026 05:57

vanceingalls force-pushed the vance/skills-agent-support branch from 6956531 to 57a3d78 Compare April 2, 2026 07:00

vanceingalls changed the title ~~feat(cli): add Windsurf, Cline, Roo, Trae skill install targets~~ feat(cli): skill install targets + remove custom install in favor of vercel-labs/skills Apr 2, 2026

vanceingalls force-pushed the vance/skills-agent-support branch from 57a3d78 to c25c92f Compare April 2, 2026 07:11

vanceingalls force-pushed the graphite-base/177 branch from efb09e3 to 159a2e7 Compare April 2, 2026 07:11

vanceingalls changed the base branch from graphite-base/177 to main April 2, 2026 07:12

vanceingalls and others added 5 commits April 2, 2026 00:12

docs: add skill system cleanup implementation plan

1a3fbe9

6 tasks: delete install-skills, strip skills from init, front-load SKILL.md descriptions, update CLAUDE.md, clean up my-video copies. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

refactor(cli): remove skills subcommand and install-skills module

813ae07

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: update CLAUDE.md skill install instructions to use vercel-labs/…

9859693

…skills

vanceingalls and others added 2 commits April 2, 2026 00:13

docs: update CLAUDE.md skill install to use vercel-labs/skills

1ba503f

Also fix .claude/settings.json pre-commit hook to use bun instead of pnpm. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: remove planning and spec docs from branch

fc99b40

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

vanceingalls force-pushed the vance/skills-agent-support branch from c25c92f to fc99b40 Compare April 2, 2026 07:13

vanceingalls merged commit ad2d63d into main Apr 2, 2026
25 of 27 checks passed

miguel-heygen mentioned this pull request Apr 2, 2026

feat(cli): add skills command that installs all without selection #192

Merged

3 tasks done

Navigation Menu

Repository navigation

feat(cli): skill install targets + remove custom install in favor of vercel-labs/skills - #177

feat(cli): skill install targets + remove custom install in favor of vercel-labs/skills#177
vanceingalls merged 7 commits into
mainfrom
vance/skills-agent-support

vanceingalls commented Apr 1, 2026 •

edited

Loading

Uh oh!

vanceingalls commented Apr 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

vanceingalls commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

vanceingalls commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vanceingalls commented Apr 1, 2026 •

edited

Loading

vanceingalls commented Apr 1, 2026 •

edited

Loading