Repository navigation
fix(reverse): give agents the sign-in reason to say, and catch stale CLIs that know reverse - #7488
Conversation
…CLIs that know reverse - `reverse start`'s signed-out `next` now carries a sentence the agent can say as is (why HeyGen, and that the HyperFrames account is the HeyGen account), asks for it at the start of the sign-in message, and on remote terminals has the agent send the device link and code before it waits. - references/start.md: same ordering, an example that fits both login routes, and no links to or quotes from the instructions themselves. - An old global install that knows `reverse start` but predates `next` was never caught: agent runs get no update notice and no auto-install, so it stays frozen. The skill now also treats `_meta.updateAvailable: true` from `reverse start` as an old install and runs the rest with `npx -y hyperframes@latest`; every CLI that knows `reverse start` already reports that field.
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at 918e0c4aa72adc160e3456871899ca6692d4df9e.
No new blocker found. The OAuth implementation is unchanged: the device challenge is already printed before polling (src/commands/auth/login.ts, src/auth/oauth.ts). The new instructions change the agent's sequencing so the person receives the link/code before the agent waits.
The metadata contract predates reverse start: published 0.9.6 (the first release containing the command), 0.9.10 and 0.9.28 all expose _meta.updateAvailable. Unsupported commands retain the existing fallback. Missing metadata has no additional fallback, and a cold/offline registry cache can report false; this improves stale-install coverage rather than guaranteeing detection on every first invocation.
Execution-policy tradeoff: skills/reverse-any-video/references/start.md:18-21 broadens the existing npx -y hyperframes@latest fallback to recognized stale CLIs. This downloads/runs the moving npm release without a prompt, rather than applying the background updater's unattended/breaking-version restrictions (npm exec behavior). It does not update the global installation. The mechanism already existed for unsupported CLIs; plugin installs remain explicitly excluded and pinned. Pinning the resolved version for the rest of a run would be a useful reproducibility follow-up, not a blocker here.
Validation: 105 local auth/update-metadata tests passed; the reverse suite could not collect with the available older dependency exports. Exact-head hosted job 129736020616 confirms reverse/start's 23 tests and updateCheck's 75 pass. Skill manifest check passes. Independent adversarial source pass found no additional defect. No claim that every agent follows the revised prose reliably.
Need: yes · Size: ok · Reuse: existing metadata, device flow and standalone fallback · Simpler: already minimal · Structure: fine (checked login/update/plugin consumers; no split)
Risk: low - focused guidance change using existing execution mechanisms, with the broader latest-version policy explicit above.
Verdict: APPROVE
Reasoning: The instructions fix the remote sign-in ordering and use an established metadata contract; remaining cache and agent-compliance limits are understood.
Reviewed by hf-review.
…n in every link message - `reverse start` now knows when no browser can open (the check `auth login` uses, moved to attendedTerminal): `login_command` is `auth login --device` and `next` asks for one message with the reason, the link and the code. The two-step route (a refused browser login, then a bare follow-up with the code) is where the reason got lost. - Every message that gives the sign-in link starts with the reason; agents say they are waiting rather than quoting the skill, and give no file paths. - The out-of-date line for an old global install goes in the next message to the person.
Edit accuracy: accurate 267 (base branch 267), smooth 96 of thoseThe gate passes. Quarantined, measured but not gated (8)
Unstable (2)
|
…the run's release - installerDetection: `shadowingInstall` finds the older global `hyperframes` that a plain `npx hyperframes` runs instead of this npx copy (first on PATH outside the npx cache), with the command that moves it. `detectInstaller` takes the entry to classify. - `reverse start` run through npx opens `next` with that line as words to say, signed in or not. Skill prose alone did not get agents to tell the person. - Skill: a signed-out `reverse start` with no `reverse.next` is also an old install, which covers a cold update cache; the run pins the release `@latest` resolved to.
jrusso1020
left a comment
jrusso1020
left a comment
There was a problem hiding this comment.
Reviewed at 2544597632b306c57f20121280df8abe4c584c71; re-reviewed the delta from 918e0c4a.
The earlier follow-ups are addressed for the legacy no-reverse.next case: it no longer depends on a warm update cache, and the skill resolves the release once before using an exact version for subsequent commands. Published 0.9.8 lacks reverse.next. The shared remote/headless predicate and its helper are byte-identical to the prior login implementation; reverse now selects the device route directly. The new shadow probe reads realpaths/manifests only and does not execute binaries found on PATH. Plugin runs remain excluded.
Nit: packages/cli/src/utils/installerDetection.ts:351-352: a project-local node_modules/.bin/hyperframes also matches this probe, but detectInstaller returns skip, so the fallback recommends npm install -g hyperframes@latest. I reproduced {kind:"skip", shadow:{version:"0.9.8", updateCommand:"npm install -g hyperframes@latest"}} with a real local-package symlink. That global command leaves the shadowing project dependency unchanged. Suppress this notice for non-global/unknown installer kinds, or classify the local install and use the existing project-aware update command. This is nonblocking because the explicit version still carries the run correctly.
Validation: 178 tests passed across installerDetection, attendedTerminal, auth/login, updateCheck and autoUpdate; manifest check passed. The local reverse suite could not collect because the borrowed dependency set lacks recast, so I am not claiming its new cases passed locally. Independent adversarial source pass found no blocker. One-time latest resolution still trusts the npm release initially; pinning removes later version drift, not that trust assumption. No live Claude/Codex replay by me.
Need: yes · Size: ok · Reuse: shared terminal predicate and installer classifier · Simpler: suppress the unknown-installer fallback above · Structure: fine (checked login and update consumers; no split)
Risk: low - preserves auth detection and adds a read-only installation probe.
Verdict: APPROVE
Reasoning: The new auth routing and version pinning hold up; the project-local update suggestion is a small follow-up.
Reviewed by hf-review.
What
How a reverse run opens when the person is signed out, and when an old CLI install is in the way.
1. Agents asked for sign-in without saying why. The signed-out
nextused to tell the agent to "say why HeyGen makes the best remake", and agents mostly skipped it. Now:nextcarries a sentence the agent can say as is: HeyGen re-shoots anyone on screen, and the HyperFrames account is the HeyGen account.2. Remote terminals lost the reason in a two-step sign-in. The agent tried a browser login, which a remote terminal refuses. It then sent the device code as a bare follow-up, so the reason was lost. Now:
reverse startuses the same check asauth login(moved toutils/attendedTerminal.ts) to tell when no browser can open.login_commandisauth login --device, andnextasks for one message with the reason, link and code, sent before the agent waits.3. Old global installs stay frozen under agents. When an agent runs the CLI, it gets no update notice and no auto-install, and a global install wins over plain
npx hyperframes.Skill: treats a CLI as an old install when any of these holds:
reverse start;reverse startreports_meta.updateAvailable: true;reverse.next. This catches the cold-cache case Rames raised.It then resolves
@latestonce and pins the whole run to that release, asnpx -y hyperframes@<version>.CLI: new
installerDetection.shadowingInstall. When this copy runs through npx, it finds the firsthyperframeson PATH outside the npx cache. If that one is older, it returns its version and the command that updates it.reverse startthen opensnextwith a line the agent can say: the install is out of date, and here is how to update it. Skill wording alone didn't get agents to say this. Across six runs with three phrasings, Claude never said it. With the CLI-provided line, it said it word for word.Verified
commands/reverse/,commands/auth/,utils/installerDetection,updateCheckandautoUpdateall pass. New coverage:Known host behavior
Codex sometimes ends its message with a clickable link to the skill file and a quote from it. Its base instructions ask for clickable links whenever it references a local file. The skill and
nextboth say not to, and some Codex runs are clean.