`packages status <name>@<version>` read the machine package home and nothing
else, while the loader finds an external package in two places: the
node_modules chain above whoever requires it, and the machine home addressed by
the version that requirer declares. A package installed where the first half
looks — a pnpm workspace's own node_modules, or the global node_modules a
`npm i -g @hypit/hypit` shares with a `npm i -g @hyperframes/engine` — was
reported `Ready false` and exited 1, and `hypit doctor` then loaded the provider
from it on the next line.
Measured on a global install with an empty machine home, before and after:
@hyperframes/engine@0.7.101 Ready false, exit 1
@hyperframes/engine@0.7.101 Ready true, exit 0
Required by .../packages/provider-hyperframes-local
Installation .../lib/node_modules/@hyperframes/engine
Status now locates the Distribution package that declares the specifier and
asks `locateNodePackage` once, from there — one call covering both places
rather than a second opinion beside the loader, which is how the two came to
disagree. The version is still exact: `distributionPackageDeclaring` matches the
declared range byte for byte, so the requirer is found only at the version asked
for, and the resolved manifest's version is compared again afterwards.
A specifier no Distribution package declares now says so, rather than reporting
a bare `Ready false`, and `install` keeps its own path untouched.
Reading only the machine home remains the answer when there is no Distribution
on disk, because then there is no requirer to resolve from.
Preserve forwarded Result values without eager materialization, advance live Builds from disposable indexes, and bound HyperFrames resource, source-frame, and output work.
The hosted callback page fetches the loopback from a public page, and
Chrome preflights that with OPTIONS under Private Network Access. Without
the CORS and PNA headers the auto-forward breaks once Chrome sends the
preflight. Answer OPTIONS and add the allow-origin header to the GET and
error responses.
Co-Authored-By: Claude Code <noreply@anthropic.com>
runtime-selection.test.ts pinned the earlier wording, which named the missing
Profile without saying how to select one. The assertion now reads the sentence
this command shares with build, pricing, auth and the execution commands, which
is what the test's own name describes.
hypit help omitted prepare even though hypit help programs and the
Skill document it. programs/runtime errors named the missing Profile
without the recovery sentence auth already uses.
cmd /c start splits on `&` unless the URL is a quoted token after an
explicit window title. PKCE authorize URLs always contain `&`, so the
browser never received client_id, redirect_uri or the challenge.
Use ComSpec the way host package install already does, pass
windowsVerbatimArguments, and ignore a missing opener so the printed
URL remains usable.
path.relative of a workspace file named ..keep.svml is the string
..keep.svml. Treating any relative result that starts with .. as an
escape rejected that file as SOURCE_OUTSIDE_ROOT, and the same
predicate was copied into source discovery, Build Result project
paths, Studio writes and CLI short paths.
Use the repository's existing check: only `..` and `..${sep}` are
parent traversal. A Source still cannot import ../outside.svs.
Keep reused media as explicit references, publish Result changes only when needed, and replace Windows files without timed retries. Clarify environment selection and CLI output.
Refine Studio task and media browsing, editable display names, inline media previews, single-row track overlap, semantic ruler pinning, and Companion-owned Ranking selection.
Group requests by endpoint and rate material, summarize explicit no-charge work, and preserve every priced request in JSON. Providers may supply a concise summary alongside their original rate documents; the CLI does not infer prices or walk upstream media dependencies.
`server.close()` stops new connections and then waits for the open ones to end.
After the callback is read the browser is usually still holding that connection,
and commonly opens a second one for /favicon.ico, so the wait outlives the token
exchange and `hypit auth login` keeps running with the credential already stored.
A caller that watches for the command to finish sees it hang until its own timeout.
Drop those connections from the completion callback of `response.end`, once the
page has actually been written, and unref the listener so it cannot hold the loop
open on its own. `e3e91d04` made this change in `packages/cli/src/main.ts`; moving
the flow into this module left it behind.
Login now returns in about 7 seconds where it previously ran until the caller
gave up.
Let HyperFrames render explicit frame intervals with independent browser workers, and make Runtime account for request-dependent resource units across Builds. Preserve external Operations while stopped executions settle so capacity is released only after real work ends.
plan now lists every external request the Build will make, one entry per
request, and runs the plan's Producers that need nothing from outside so
each request's exact constraints exist before submission. Parameters are
read off the request itself (scalars by their own names, prose as a word
count, referenced media counted by kind); no model-specific field table
lives in the CLI. A request whose references are still to be generated
reads the author's request draft upstream and says the references are
pending. Requests with the same shape are grouped and counted, word counts
shown as a range.
Core scheduling becomes incremental: a ready Producer no longer waits for
an unrelated external request that shared its scheduling turn, which is
what let plan-time evaluation reach every request and also stops Builds
serializing cheap steps behind long paid ones.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Providers declare everything they can do and never hide a capability:
HypiHub's audio:false flag is gone. When several selected Endpoints offer
the same capability, the Profile's bindings name the one that serves it,
keyed by name@version#capability. plan, creation-time invoke and the Build
resolve through the same EndpointRegistry with the same bindings; doctor
reports a contested capability without a binding (error when a Run demands
it, warning otherwise) and a binding to an Endpoint that does not offer the
capability. Unknown Profile keys are listed together, and the retired
nested-runtime Profile shape gets a migration message.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add the one-shot boundary the creation-time tools were missing: the
Runtime host's `invoke(need, resources)`, implemented by runtime-local as
the same Endpoint activation, capability resolution and credential
resolution a Build uses, with no Build id, Worker, Result or stored state.
Unresolved, ambiguous and asynchronous capabilities are refused with the
exact command that fixes them; the caller owns the ResourceStore.
The reference-video tools now observe and transcribe through it. Gemini
observation seals a real GeminiRequest against the Profile's Gemini
Endpoint instead of picking HypiHub or Vertex from HYPIT_GEMINI_PROVIDER
and reading credential stores itself; the transcript asks the Profile's
whisperx-alignment Endpoint instead of instantiating the local Provider
and probing 127.0.0.1:8765. `--runtime <profile>` names the Profile on
prepare_reference, observe_reference and compare_reconstruction; without
it the project's `hypit runtime use` selection is read, the way `hypit`
reads it. A missing selection, Endpoint or credential leaves the
transcript unavailable with that exact reason and prepares everything
else. The observation retry loop is unchanged but now reports each failed
attempt; its limits wait for real-video measurements.
The Gemini default model comes from @hypit/gemini's declaration rather
than a string, and the Skill's four passages about the environment switch
now describe the Profile binding.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A Provider declares only where it publishes prices: `pricing` on
defineEndpointPackage is either { kind: "page", url } for a paid remote
service or { kind: "local" } for work that runs on this machine. Hypit
never copies or interprets the prices.
The Runtime host gains `providers(capabilities)`, implemented by
runtime-local from the Profile and Endpoint declarations alone; it never
resolves a credential or contacts a service, and reports an unresolved or
ambiguous selection as such. `hypit plan --runtime <profile>` prints a
"Providers and price pages" section so the Agent has exactly one place to
learn which Endpoint serves each external request and where to read its
price; without --runtime it says to pass one.
HypiHub, KIE, Vertex, Xiaomi MiMo and AWS Lambda declare their public
pricing pages; the media, WhisperX, HyperFrames and OpenCV local Providers
declare local. The Provider guide documents the declaration in place of
the removed quote paragraph.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
kashorin