Skip to content

Manticore 2.0.0: HyperFrames-only engine, skills at setup, incremental render - #8

Merged
bmadcode merged 8 commits into
mainfrom
drop-remotion
Jul 24, 2026
Merged

Manticore 2.0.0: HyperFrames-only engine, skills at setup, incremental render#8
bmadcode merged 8 commits into
mainfrom
drop-remotion

Conversation

@bmadcode

@bmadcode bmadcode commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Manticore 2.0.0: one motion-graphics engine with the full HyperFrames toolkit behind it, a final render that only re-does what changed, and delivery polish. Upgrading from 1.x is a clean reinstall — brand, voice bible, and format profiles live in the studio folder, not _bmad/, so they survive.

Motion graphics: one engine, the whole HyperFrames toolkit

  • Remotion is retired; HyperFrames is the sole engine. Remotion is free only for companies of up to 3 people — shipping it in a distributed module handed every creator at a 4+ person company a licensing obligation they never opted into. HyperFrames is Apache 2.0 with no commercial-use threshold. And React bought nothing: in a frame-deterministic renderer, state is a function of frame index. Every job Remotion held (dual-render brand stinger, shorts karaoke captions, HTML/SVG comps) is a HyperFrames comp, and the OBS-plus-editor dual alpha target (ProRes 4444 + VP9 alpha WebM) is unchanged.
  • Nothing to migrate. remotion is a permanent alias for hyperframes everywhere an engine is named (beat-table engine value or a profile's engine_overlays/engine_stingers frontmatter), so studios configured before 2.0.0 keep working untouched. No creator file is rewritten.
  • HyperFrames' own Agent Skills are installed at setup and favored, so the agent knows the engine's full current capability surface from the beats/pitch stage — not a hand-written summary that goes stale. That surface is large and mostly new to the pipeline: the 100+ block catalog (code animations, shader transitions, caption styles, lower thirds, social cards, data-viz maps, VFX, 3D device mockups) plus footage-facing effects (color grading with LUTs/grain/vignette, background removal, HTML-in-Canvas WebGL) and HDR10/4K delivery. All local — no HeyGen account or credits, ever.

Faster iteration: incremental final render

  • The final render is content-addressed and incremental. The timeline is cached as sticky segments, so a re-render re-encodes only what actually changed (a tweaked graphic, a re-cut region) and reuses the rest. Boundaries are stable — an edit early in the timeline doesn't invalidate everything after it — so a fix on a long video is a seconds-long render instead of end-to-end. --no-cache forces a full rebuild.
  • Final renders are loudness-normalized to −14 LUFS by default (YouTube reference). The preview is never normalized; [render] loudness-target and loudnorm are the knobs.

Packaging, delivery, docs

  • Version bump to 2.0.0 (README, CHANGELOG, marketplace.json); README carries a 2.0 announcement and the upgrade path.
  • CHANGELOG reworked to be impact-focused: motion graphics, faster iteration, cross-platform, packaging, docs.

Testing

All skill test suites pass via uv run. The render lane gained new coverage for segment planning, content digests, manifest round-trips, cache hits, and --no-cache.

Follow-ups (not in this PR)

  • Tag the release and swap Unreleased for the date in CHANGELOG at release time.
  • Color-grading pipeline step (capability now present; step deferred).
  • Register Manticore in the module registry for stable-channel installs.

Summary by CodeRabbit

  • New Features
    • Version 2.0.0 introduces HyperFrames as the default motion-graphics engine for overlays, stingers, captions, and effects.
    • Final renders now reuse unchanged cached segments, reducing rerender time after edits.
    • Mixed-source previews better normalize video dimensions, audio, and silent inputs.
  • Bug Fixes
    • Legacy Remotion configurations remain compatible through automatic HyperFrames handling.
    • Improved rendering reliability for varied media sources.
  • Documentation
    • Updated setup guides, format profiles, workflows, and engine guidance for the 2.0 pipeline.
    • Clarified packaging outputs, loudness normalization, and cross-platform behavior.

Remotion is dropped and HyperFrames absorbs its jobs (dual-render brand
stinger, shorts karaoke captions, plain HTML/SVG comps). Two reasons: its
license is free only up to 3 people, which shipped a licensing obligation
to every creator at a 4+ person company installing this distributed module;
and its React authoring model bought nothing in a frame-deterministic
renderer, where state is a function of frame index.

- Delete skills/mc-graphics/engines/remotion.md; rationale now lives in
  engines/hyperframes.md ("Why this engine and not Remotion").
- HyperFrames encodes alpha to both ProRes 4444 MOV and VP9 yuva420p WebM,
  so the OBS-plus-editor dual target is unchanged.
- engine_stingers/engine_overlays profile keys read hyperframes everywhere.
- Version policy reversed: install hyperframes@latest at workspace init and
  record the resolved version; never ship a pin from this repo.
- PIPELINE.md tolerance rule maps 0.x beat rows carrying engine: remotion to
  hyperframes, so in-flight projects do not break.
- Sweep README, user-guide, under-the-hood HTML, TODO, module-help.csv,
  check_deps.py, customize.toml, stack-windows.md, and test fixtures.
- Bump to 1.1.0; CHANGELOG heading updated. OGraf unaffected.
@coderabbitai

coderabbitai Bot commented Jul 22, 2026

Copy link
Copy Markdown

Review Change Stack

Walkthrough

The PR makes HyperFrames the documented motion-graphics engine, preserves legacy remotion compatibility, reorders pipeline stages, adds setup/profile updates, and replaces chunk-based final rendering with persistent incremental segment caching.

Changes

HyperFrames migration and render pipeline

Layer / File(s) Summary
Incremental segment rendering
skills/mc-cut/scripts/composite_core.py, skills/mc-cut/scripts/render_final.py
Final rendering now uses stable content-addressed segments, cached video reuse, full audio rebuilding, mixed stream handling, and new cache controls.
Mixed-source preview normalization
skills/mc-cut/scripts/render_preview.py, skills/mc-cut/scripts/tests/test-render_preview.py
Preview rendering normalizes mixed dimensions and audio, synthesizing silence for sources without audio.
Segment and media validation
skills/mc-cut/scripts/tests/test-render_final.py
Tests cover segment planning, cache identity and persistence, incremental rerenders, mixed-source sizing, and audio normalization.
HyperFrames engine contract
skills/mc-graphics/*, skills/mc-agent/references/skills-map.md
Engine guidance now describes HyperFrames setup, deterministic rendering, supported jobs, dual outputs, and lazy version recording.
Pipeline ordering and engine compatibility
skills/mc-pipeline/*, skills/mc-beats/*, skills/mc-new/*, skills/mc-package/*, skills/mc-agent/SKILL.md
Pipeline stages place assets before graphics, and legacy remotion engine values map to HyperFrames without rewriting creator files.
Setup and profile defaults
skills/mc-setup/*, skills/mc-stream-pack/*, skills/mc-ograf/SKILL.md
Format defaults, onboarding, dependency descriptions, and stream-pack instructions use HyperFrames or OGraf.
Release and public documentation
.claude-plugin/marketplace.json, CHANGELOG.md, README.md, docs/*, TODO.md
Release metadata and documentation describe version 2.0.0, HyperFrames adoption, and incremental rendering.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

Poem

A rabbit hops where segments gleam,
HyperFrames trims the render stream.
Old names guide the paths behind,
Fresh cached pieces save some time.
Assets lead, and graphics shine—
Two outputs thump in one design.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 30.99% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly captures the main changes: HyperFrames-only engine, setup-installed skills, and incremental rendering.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch drop-remotion

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.claude-plugin/marketplace.json:
- Line 22: Update the version badge in README.md to display 1.1.0, matching the
version declared by the marketplace manifest. Leave the manifest version
unchanged.

In `@skills/mc-graphics/engines/design-prompting.md`:
- Line 25: Update the HyperFrames guidance to define one deterministic
frame-seeking contract: either require a window.seek(frame) adapter and document
how it delegates to window.__timelines, or make window.__timelines the supported
entry point and document its renderer-seeking behavior. Ensure the examples and
contract use the same entry point, and add a HyperFrames frame-seeking test if
retaining window.__timelines as the public interface.

In `@skills/mc-graphics/SKILL.md`:
- Line 11: Replace floating first-use HyperFrames resolution in
skills/mc-graphics/SKILL.md:11 with exact-version bootstrap guidance, committing
the resolved workspace dependency and lockfile. Update
skills/mc-graphics/engines/hyperframes.md:16-18 to use that same locked version
and invoke hyperframes add through the local locked CLI rather than an
unconstrained registry installation.

In `@skills/mc-ograf/SKILL.md`:
- Line 16: Update the editor compatibility guidance in the skill instructions to
remove the claim that baked HyperFrames alpha works in every editor. State that
mc-graphics should produce a target-compatible baked alpha format instead, and
name the supported formats defined by the project.

In `@skills/mc-pipeline/PIPELINE.md`:
- Around line 107-109: Update the beat-table consumer/parser described by the
pipeline contract to preserve each row’s engine value and normalize legacy
remotion values to hyperframes, while retaining the documented default for
missing engines. In skills/mc-pipeline/PIPELINE.md lines 107-109, ensure the
implementation guidance reflects this consumer-boundary behavior; in
skills/mc-cut/scripts/tests/test-render_final.py line 59, retain a remotion
fixture and assert that parsing produces hyperframes.

In `@TODO.md`:
- Line 10: Remove the completed HyperFrames engine workspace initialization
roadmap item from TODO.md, or split it so only any explicitly unfinished work
remains; do not retain the implemented initialization and version-recording work
as a future 1.0.x task.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1408fe96-d66d-418e-b963-a0927f113eb5

📥 Commits

Reviewing files that changed from the base of the PR and between d274179 and 91197b4.

⛔ Files ignored due to path filters (1)
  • skills/module-help.csv is excluded by !**/*.csv
📒 Files selected for processing (26)
  • .claude-plugin/marketplace.json
  • CHANGELOG.md
  • README.md
  • TODO.md
  • docs/manny-under-the-hood.html
  • docs/user-guide.md
  • skills/mc-agent/references/skills-map.md
  • skills/mc-beats/SKILL.md
  • skills/mc-cut/scripts/tests/test-render_final.py
  • skills/mc-graphics/SKILL.md
  • skills/mc-graphics/engines/design-prompting.md
  • skills/mc-graphics/engines/hyperframes.md
  • skills/mc-graphics/engines/remotion.md
  • skills/mc-ograf/SKILL.md
  • skills/mc-pipeline/PIPELINE.md
  • skills/mc-setup/assets/formats/course-lesson.md
  • skills/mc-setup/assets/formats/livestream-pack.md
  • skills/mc-setup/assets/formats/screen-tutorial.md
  • skills/mc-setup/assets/formats/short.md
  • skills/mc-setup/assets/formats/talking-head.md
  • skills/mc-setup/assets/formats/voiceover-explainer.md
  • skills/mc-setup/customize.toml
  • skills/mc-setup/references/stack-windows.md
  • skills/mc-setup/scripts/check_deps.py
  • skills/mc-setup/scripts/tests/test-merge_profile_frontmatter.py
  • skills/mc-stream-pack/SKILL.md
💤 Files with no reviewable changes (1)
  • skills/mc-graphics/engines/remotion.md

Comment thread .claude-plugin/marketplace.json Outdated
"source": "./",
"description": "AI video production pipeline: brain dump to a rough cut sitting in your editor, in your own words, with approval gates at every taste decision.",
"version": "1.0.1",
"version": "1.1.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Synchronize the README version badge with the manifest.

.claude-plugin/marketplace.json now declares 1.1.0, but README.md line 5 still displays 1.0.1. Update the badge so the published metadata and landing page agree.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.claude-plugin/marketplace.json at line 22, Update the version badge in
README.md to display 1.1.0, matching the version declared by the marketplace
manifest. Leave the manifest version unchanged.

- Signal readiness: resolve `document.fonts.ready` before the first frame is captured.

For Remotion beats the contract is instead: composition with explicit `durationInFrames` and `fps`, all motion derived from `useCurrentFrame()`, no `Math.random` without Remotion's seeded `random()`.
HyperFrames beats satisfy the same contract natively: the comp is plain HTML/CSS plus a GSAP timeline created with `{ paused: true }` and registered on `window.__timelines`, which the renderer seeks per frame. Declare fps and duration in the comp's render config rather than inferring them.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== locate relevant files ==="
fd -a 'design-prompting.md|.*hyperframes|.*timelines|.*renderer' . | sed 's#^\./##' | head -200

echo
echo "=== design-prompting outline/size ==="
wc -l skills/mc-graphics/engines/design-prompting.md
sed -n '1,80p' skills/mc-graphics/engines/design-prompting.md
sed -n '190,235p' skills/mc-graphics/engines/design-prompting.md

echo
echo "=== search window.seek and __timelines ==="
rg -n "window\.(seek|__timelines)|__timelines|render config|fps|duration" skills/mc-graphics/engines/design-prompting.md .

Repository: bmad-code-org/bmad-manticore

Length of output: 50386


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== hyperframes.md relevant docs ==="
wc -l skills/mc-graphics/engines/hyperframes.md
sed -n '1,240p' skills/mc-graphics/engines/hyperframes.md
rg -n "window\.(seek|__timelines)|npx hyperframes|render config|fps|duration|seek" skills/mc-graphics/engines/hyperframes.md

echo
echo "=== find any local HyperFrames package/reference files ==="
git ls-files | rg -i 'hyperframes|__timelines|windowsink|package' | head -200

Repository: bmad-code-org/bmad-manticore

Length of output: 4984


🌐 Web query:

HyperFrames npx hyperframes render window.__timelines window.seek frame

💡 Result:

HyperFrames is an open-source framework designed for turning HTML, CSS, and animation runtimes (like GSAP) into deterministic MP4 videos [1][2]. It is built to be "AI-first," with a non-interactive CLI optimized for use by AI agents [3][4]. In the HyperFrames architecture, window.timelines is a global registry object that holds the animation timelines (typically GSAP timelines) for a composition [5][6]. Regarding your query about "render," "seek," and "frame": 1. Rendering: The HyperFrames CLI (hyperframes command) handles the creation, previewing, and rendering of compositions [1][2]. The framework uses a "seekable page-to-video capture engine" (via Puppeteer and FFmpeg) that allows it to capture video by programmatically seeking through the timeline at specific time intervals [1][2]. 2. Deterministic Seeking: Because HyperFrames is designed for deterministic rendering—where the same input always produces the same output—it does not rely on real-time clock playback [3][7]. Instead, the framework controls the animation state by explicitly setting the time of the timeline to a specific "frame" or timestamp during the capture process [5][8]. 3. Window.timelines Integration: When creating animations (e.g., using GSAP), you define your timelines with { paused: true } and register them on window.timelines using a key that matches your composition's data-composition-id [5][8]. The capture engine synchronously reads this registry and performs the seek operations to generate individual frames for the final video output [8][6]. In summary, you should not manually trigger "seek" or "frame" functions; instead, you define your animation in a timeline registered to window.timelines, and the HyperFrames rendering engine automatically manages the seeking and frame capture based on your composition's duration and configuration [5][8][6].

Citations:


Document the HyperFrames timeline contract exactly.

The determinism contract requires window.seek(frame), but the HyperFrames docs/examples use window.__timelines without describing the adapter. Either require the window.seek(frame) adapter for HyperFrames too, or reword this contract to describe window.__timelines as the actual supported entry point and add a test covering HyperFrames frame seeking.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/mc-graphics/engines/design-prompting.md` at line 25, Update the
HyperFrames guidance to define one deterministic frame-seeking contract: either
require a window.seek(frame) adapter and document how it delegates to
window.__timelines, or make window.__timelines the supported entry point and
document its renderer-seeking behavior. Ensure the examples and contract use the
same entry point, and add a HyperFrames frame-seeking test if retaining
window.__timelines as the public interface.

Comment thread skills/mc-graphics/SKILL.md Outdated

1. Load the studio config (`uv run {project-root}/_bmad/scripts/resolve_config.py --project-root {project-root} --key modules.manticore`; empty means mc-setup has not run: stop and route the creator there) and this skill's own surface (`uv run {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root}`; run `{workflow.activation_steps_prepend}` now, `{workflow.activation_steps_append}` after this step, and hold `{workflow.persistent_facts}` as standing context). Resolve `paths` values against `{project-root}`. Read `project.json` (confirm `approvals.beats` is a date, stage `graphics`), `beats/beats.md`, `beats/STORYBOARD.md`, `{brand-path}/tokens.json`, `{brand-path}/production-bible.md` (the styling contract beyond tokens.json: overlay aesthetic, motion feel, image-type policy, placement rules), the format profile, and `{skill-root}/engines/<engine>.md` for each engine the table names. Beats marked OGraf route through the mc-ograf skill, and ONLY if `[editor] ograf-editable = true`; otherwise build them as baked alpha overlays like everything else (baked alpha works in every editor).
2. Engine workspaces live at `{engines-path}/<engine>/`; initialize on first use per the engine README (pin versions).
2. Engine workspaces live at `{engines-path}/<engine>/`; initialize on first use per the engine README, installing the latest published version at that moment and recording what it resolved.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate files =="
git ls-files | grep -E '(^|/)(\.gitignore|package.json|package-lock.json|pnpm-lock.yaml|yarn.lock|hyperframes\.md|SKILL\.md)$' || true

echo "== relevant markdown excerpts =="
for f in skills/mc-graphics/SKILL.md skills/mc-graphics/engines/hyperframes.md; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    nl -ba "$f" | sed -n '1,80p'
  fi
done

echo "== hyperframes references =="
rg -n "hyperframes|hyperframes@latest|npx hyperframes add|engines-path|package.json|lockfile|lock" skills/mc-graphics skills/mc-graphics/engines -S || true

echo "== changed files/stat =="
git diff --stat || true
git diff --name-only || true

Repository: bmad-code-org/bmad-manticore

Length of output: 766


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== relevant markdown excerpts =="
for f in skills/mc-graphics/SKILL.md skills/mc-graphics/engines/hyperframes.md; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    awk '{printf "%5d\t%s\n", NR, $0}' "$f" | sed -n '1,80p'
  fi
done

echo "== hyperframes references =="
rg -n "hyperframes|hyperframes@latest|npx hyperframes add|engines-path|package.json|lockfile|lock" skills/mc-graphics skills/mc-graphics/engines -S || true

echo "== repo root package metadata =="
for f in package.json package-lock.json npm-shrinkwrap.json deno.lock yarn.lock pnpm-lock.yaml; do
  [ -f "$f" ] && echo "--- $f ---" && head -200 "$f"
done

echo "== package files =="
find . -maxdepth 4 -type f \( -name 'package.json' -o -name 'package-lock.json' -o -name 'npm-shrinkwrap.json' -o -name 'yarn.lock' -o -name 'pnpm-lock.yaml' -o -name 'deno.lock' \) -print | while read -r f; do
  echo "--- $f ---"
  sed -n '1,160p' "$f"
done

echo "== changed files/stat =="
git diff --stat || true
git diff --name-only || true

Repository: bmad-code-org/bmad-manticore

Length of output: 25690


🌐 Web query:

npm install hyperframes@latest package lock file records resolved version

💡 Result:

When you run npm install hyperframes@latest, npm updates your package-lock.json file to record the exact version and location from which the package was resolved [1][2]. The package-lock.json file documents these details in a dependency object for hyperframes using two primary fields [1][3]: 1. version: This field records the specific version number of the package that was installed (e.g., 0.7.68) [1][4]. 2. resolved: This field records the specific location or URL from which the package's contents were fetched [1][5]. For packages from the npm registry, this is typically the URL of the tarball (e.g., https://registry.npmjs.org/hyperframes/-/hyperframes-0.7.68.tgz) [1][6]. These entries ensure that subsequent installations produce a reproducible node_modules tree by using these exact references rather than recalculating dependency versions based on the package.json file [2]. As of July 22, 2026, the latest version of the hyperframes CLI package is 0.7.68 [7][8].

Citations:


🌐 Web query:

npm exec npx package manager installed command package-lock.json resolves version documentation

💡 Result:

The npm exec command (aliased as npx) is used to run commands from local or remote npm packages [1][2][3]. Regarding package resolution and versioning: - Local Context: If a package name is provided without a specific version, npm exec matches it against the dependencies already present in the local project [4]. If the package is installed locally in the project (node_modules), its binaries are available in the PATH of the executed command [5][2][3]. - Versioning: If a specifier (e.g., @latest or @1.2.3) is provided, npm exec treats it as a match only if it aligns with the specified name and version [4]. - Package-lock.json: While npm exec runs in the context of the current project (similar to npm run), its primary mechanism for remote package resolution involves fetching the package as requested (e.g., @latest) [1][3]. It does not explicitly state that it resolves versions from package-lock.json in the same way that npm install does; rather, it uses the provided specifier or defaults to latest when fetching remote packages [1][4]. Key differences between npm exec and npx: - npm exec was introduced in npm v7.0.0, and the legacy npx package was deprecated [4][6]. - npx now acts as an alias to npm exec but includes specific affordances for backwards compatibility [4][6]. - Argument Parsing: The most significant difference is how they handle arguments. When using the npx binary, all flags must be set before positional arguments [6][7]. When using npm exec, it is recommended to use a double-hyphen (--) to explicitly separate npm's own options from the command being executed [1][6][8]. Documentation for npm exec can be found on the official npm documentation site under the command reference [1][5][2].

Citations:


Do not use floating hyperframes@latest in the HyperFrames setup instructions.

The setup path intentionally performs fresh registry resolution on each creator, and npx hyperframes add is not constrained to the locked workspace dependency. Bootstrap the reviewed exact HyperFrames package in the workspace, save/lock the resolved version, and run hyperframes add from that locked local installation.

  • skills/mc-graphics/SKILL.md#L11-L11: replace first-use registry resolution with exact-version bootstrap and committed lockfile guidance.
  • skills/mc-graphics/engines/hyperframes.md#L16-L18: use the same resolved HyperFrames version/version-lock and invoke hyperframes add via the local locked CLI.
🧰 Tools
🪛 SkillSpector (2.3.11)

[warning] 12: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))

📍 Affects 2 files
  • skills/mc-graphics/SKILL.md#L11-L11 (this comment)
  • skills/mc-graphics/engines/hyperframes.md#L16-L18
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/mc-graphics/SKILL.md` at line 11, Replace floating first-use
HyperFrames resolution in skills/mc-graphics/SKILL.md:11 with exact-version
bootstrap guidance, committing the resolved workspace dependency and lockfile.
Update skills/mc-graphics/engines/hyperframes.md:16-18 to use that same locked
version and invoke hyperframes add through the local locked CLI rather than an
unconstrained registry installation.

Source: Linters/SAST tools

Comment thread skills/mc-ograf/SKILL.md
1. Load the studio config (`uv run {project-root}/_bmad/scripts/resolve_config.py --project-root {project-root} --key modules.manticore`; empty means mc-setup has not run: stop and route the creator there) and this skill's own surface (`uv run {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root}`; run `{workflow.activation_steps_prepend}` now, `{workflow.activation_steps_append}` after this step, and hold `{workflow.persistent_facts}` as standing context). Resolve `paths` values against `{project-root}`.
2. OGraf is only the right output when the target supports it:
- Editor lane: `[editor] ograf-editable = true` (DaVinci Resolve 21+). If false, STOP and say so; the same graphic should be built as a baked alpha overlay by mc-graphics instead (HyperFrames/Remotion work in every editor).
- Editor lane: `[editor] ograf-editable = true` (DaVinci Resolve 21+). If false, STOP and say so; the same graphic should be built as a baked alpha overlay by mc-graphics instead (baked HyperFrames alpha works in every editor).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Avoid promising compatibility with “every editor.”

HyperFrames produces different alpha formats for different targets; VP9 alpha WebM is not universally supported by editors. Say “a target-compatible baked alpha format” and name the supported formats instead.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/mc-ograf/SKILL.md` at line 16, Update the editor compatibility
guidance in the skill instructions to remove the claim that baked HyperFrames
alpha works in every editor. State that mc-graphics should produce a
target-compatible baked alpha format instead, and name the supported formats
defined by the project.

Comment thread skills/mc-pipeline/PIPELINE.md Outdated
Comment on lines +107 to +109
- `engine` names the engine that renders the beat, per the Engine policy below (e.g. `hyperframes`, `ograf`, `html`).
- `asset` is `null` or a farmed-asset id from `assets/manifest.json`; mc-assets farms the listed assets, mc-graphics composes with them.
- Tolerance rule: consumers MUST accept rows missing `type`, `engine`, or `asset` (beat tables written by 0.x projects). Treat a missing `type` as the reserved placeholder `overlay` (informational only; rendering keys off `engine` and `composition`), a missing `engine` as the Engine policy default, and a missing `asset` as `null`. A stage that rewrites the table (mc-beats) replaces every `overlay` placeholder with a type from the profile's `beat-types`. An in-flight 0.x project never breaks on the extended contract.
- Tolerance rule: consumers MUST accept rows missing `type`, `engine`, or `asset` (beat tables written by 0.x projects). Treat a missing `type` as the reserved placeholder `overlay` (informational only; rendering keys off `engine` and `composition`), a missing `engine` as the Engine policy default, an `engine` of `remotion` (written by 0.x projects) as `hyperframes`, and a missing `asset` as `null`. A stage that rewrites the table (mc-beats) replaces every `overlay` placeholder with a type from the profile's `beat-types`. An in-flight 0.x project never breaks on the extended contract.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Complete the legacy remotion to hyperframes migration path.

The pipeline documents this normalization, but the shown parser does not preserve or normalize engine, and the updated fixture no longer exercises the legacy value.

  • skills/mc-pipeline/PIPELINE.md#L107-L109: implement engine preservation and remotionhyperframes normalization at the consumer boundary.
  • skills/mc-cut/scripts/tests/test-render_final.py#L59-L59: retain a remotion fixture and assert the normalized result.
📍 Affects 2 files
  • skills/mc-pipeline/PIPELINE.md#L107-L109 (this comment)
  • skills/mc-cut/scripts/tests/test-render_final.py#L59-L59
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/mc-pipeline/PIPELINE.md` around lines 107 - 109, Update the beat-table
consumer/parser described by the pipeline contract to preserve each row’s engine
value and normalize legacy remotion values to hyperframes, while retaining the
documented default for missing engines. In skills/mc-pipeline/PIPELINE.md lines
107-109, ensure the implementation guidance reflects this consumer-boundary
behavior; in skills/mc-cut/scripts/tests/test-render_final.py line 59, retain a
remotion fixture and assert that parsing produces hyperframes.

Comment thread TODO.md Outdated
bmadcode added 6 commits July 22, 2026 22:21
A studio configured before 1.1.0 keeps its own copied format profiles,
which may still name `remotion` in engine_overlays/engine_stingers
frontmatter. Rather than rewrite creator-owned files, treat `remotion`
as an unconditional alias for `hyperframes` wherever an engine is named
(beat-table engine value or profile frontmatter, any vintage). Upgrade
is just re-running the install; no migration, no touched creator files.

- PIPELINE.md: add the compatibility-alias line to the engine policy and
  broaden the beat-table tolerance rule from "0.x only" to any vintage.
- mc-beats step 4: a profile naming remotion is written into the table as
  hyperframes, never remotion.
- CHANGELOG: state the upgrade is re-install + alias, no migration.
Render lane (composite_core.py + render_preview/render_final + tests):
- Multi-source timelines with mismatched frame sizes/aspect ratios (cam +
  screencast) no longer fail concat: build_filter_complex takes a target
  (W,H) and normalizes every segment to one frame (scale fit + pad + setsar).
  The single-source path is unchanged. The renderer decides target once and
  threads the same value to every parallel chunk so the lossless concat stays
  exact.
- Audio-less sources (screen recordings) and mismatched sample rates no longer
  hard-fail: probe_has_audio() drives a shared anullsrc silence input for
  audio-less sources, and every audio chain ends in aresample=48000,
  aformat=channel_layouts=stereo. New e2e tests render the real mixed-dim +
  audio-less case; render tests grow 14->20 and 46->50.

Skill contracts:
- mc-package live-event mode no longer corrupts state on livestream-pack
  projects: it advances stage/stages_done only when `package` is the current
  stage AND in the stages array, mirroring the VOD flow guard. Closes a
  gate-4 bypass and a stream-pack routing brick.
- mc-retro routes stage-behavior fixes to the durable
  {project-root}/_bmad/custom/<skill>.toml layer first (survives module
  updates, loads on activation); editing installed SKILL.md is last resort.
- Default stage order is assets-before-graphics so farmed stills exist before
  graphics composes with them (PIPELINE.md master list + json example + ingest
  variant, talking-head/voiceover-explainer/livestream-vod profiles, mc-agent
  mnemonic, new_project.py hint, and the two stale test fixtures/assertions).
- Final-render delivery height reads [video] delivery-resolution, not a
  nonexistent [render] key, so configured 1080p ships instead of source-native.

Full suite green (26 files).
The final render partitions the timeline into persistent, content-addressed
segments under renders/segments/ and re-encodes only the segments whose inputs
actually changed, reusing the rest from cache. A tweaked graphic or a re-cut
region on a long video re-renders in seconds instead of end to end.

composite_core.py:
- plan_segments() replaces plan_chunks: greedy left-to-right sticky boundaries
  snapped to the next safe cut (~600s target), so an edit cannot move an
  earlier boundary and its cached segment survives.
- Content addressing: segment_id (position-independent slice identity),
  segment_input_hash (EDL slice + source/overlay file digests + render_key),
  content_digest, ffmpeg_version, load/save_manifest.
- build_filter_complex / build_command / encode_args gain a streams param
  (av | video | audio); the av path is byte-for-byte unchanged.

render_final.py:
- plan -> hash -> dirty-skip -> render dirty segments video-only via a bounded
  worker pool (atomic temp->rename) -> rebuild whole-program audio once ->
  concat video (-c copy) -> mux -> whole-file loudnorm -> write manifest -> GC
  orphans. Video-only-persist + audio-rebuilt-whole keeps the timeline exact.
- New flags: --segment-target-seconds (600), --no-cache. Encoder/ffmpeg/
  dimension changes dirty every segment (a mixed-encoder concat is invalid).

Tests: 50 -> 60 (TestPlanSegments incl. the boundary-stability property,
identity/hashing, manifest round-trip, content-digest, and e2e cache-hit +
--no-cache). Docs updated: README, SKILL.md, under-the-hood, CHANGELOG.
…ity map

mc-graphics installs HyperFrames' own Agent Skills on the first graphics run
alongside the engine (npx hyperframes skills update, or
npx skills add heygen-com/hyperframes --all --full-depth for the whole catalog)
and refreshes them on later runs (npx hyperframes init). The agent now authors
from HyperFrames' current, self-refreshing knowledge of the engine instead of a
hand-written summary that goes stale, and sources from the catalog and skills
before authoring anything by hand.

engines/hyperframes.md is rewritten as a durable capability map (categories,
not a transcribed catalog that would rot pre-1.0): the 100+ block catalog plus
footage-facing effects the pipeline did not surface before (color grading with
.cube LUTs/grain/vignette, background removal, HTML-in-Canvas WebGL) and its
delivery reach (HDR10, 4K, MOV/WebM/GIF/PNG), deferring detail to the installed
skills and llms.txt. Local-first is explicit: the hosted conveniences (cloud
render credits, Studio, Claude Design, Figma, Lambda/Cloud Run) stay optional
and are never a dependency; no HeyGen account is required.

check_deps npx descriptor updated; CHANGELOG entry added.
…rom the beats stage

mc-setup gains step 2b: with node and npx present, it installs and favors the
HyperFrames Agent Skills (npx skills add heygen-com/hyperframes --all --full-depth,
or the core set via npx hyperframes skills update), confirm-before-install and
idempotent. Wired into the 0.x migration offer list and the closing runnability
report, and named in the skill description.

Previously the skills installed on the first graphics run; installing them at
setup makes the engine's full capability surface (block catalog, color grading,
background removal, HTML-in-Canvas, delivery reach) known from the beats/pitch
stage onward. mc-graphics now refreshes them each run (npx hyperframes init) and
installs them only if setup was skipped. The engine workspace itself still
initializes lazily on the first graphics run; only the lightweight skill
knowledge lands at setup. Engine reference and CHANGELOG updated to match.
- README gains a "New in 2.0" announcement at the top: HyperFrames
  consolidation and skills integration (the full local toolkit), Remotion
  retired, incremental render, loudnorm, cross-platform lanes, a changelog
  callout, and the clean-reinstall upgrade path (remove _bmad and
  _bmad-output, reinstall, re-onboard; brand/voice/formats survive).
- CHANGELOG 1.1.0-Unreleased reworked into 2.0.0, refocused on the
  big-picture and quality-of-life changes: one engine plus the whole
  HyperFrames toolkit, faster iteration (incremental render, -14 LUFS
  finals), cross-platform, packaging and delivery, docs.
- Version bumped to 2.0.0 (marketplace.json, README badge); the remotion
  alias notes in PIPELINE.md and mc-beats now say "before 2.0.0".

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 15-17: Update the later Status section’s release number and
current-release wording from 1.0.0/1.0 to the README’s announced 2.0 release,
keeping the rest of the status information unchanged so the landing page
presents a consistent release status.

In `@skills/mc-cut/scripts/composite_core.py`:
- Around line 563-569: Update segment_id to include overlay configuration in the
persisted cache and job-deduplication key, preferably by deriving it from the
overlay-aware segment_input_hash or by extending segment_identity with
seg["overlays"]. Preserve stable IDs for identical source spans with identical
overlays, while ensuring differing overlays produce distinct segment IDs.

In `@skills/mc-cut/SKILL.md`:
- Line 35: Update the final sentence describing loudness normalization in the
final-render workflow to state that normalization occurs only when [render]
loudnorm is enabled. Keep the existing behavior and the --no-loudnorm
instruction unchanged.

In `@skills/mc-setup/SKILL.md`:
- Around line 50-56: Update the HyperFrames installation commands in the “2b.
HyperFrames graphics skills” section to use audited, immutable versions or
commit references for both the npx skills launcher and the
heygen-com/hyperframes source. Apply pinned-install options supported by the
skills CLI, while preserving the existing full-catalog and lightweight core-set
alternatives.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ea95d130-2f0c-45ee-84c6-9e056c474713

📥 Commits

Reviewing files that changed from the base of the PR and between 91197b4 and 09ee2ae.

📒 Files selected for processing (25)
  • .claude-plugin/marketplace.json
  • CHANGELOG.md
  • README.md
  • docs/manny-under-the-hood.html
  • skills/mc-agent/SKILL.md
  • skills/mc-beats/SKILL.md
  • skills/mc-cut/SKILL.md
  • skills/mc-cut/scripts/composite_core.py
  • skills/mc-cut/scripts/render_final.py
  • skills/mc-cut/scripts/render_preview.py
  • skills/mc-cut/scripts/tests/test-render_final.py
  • skills/mc-cut/scripts/tests/test-render_preview.py
  • skills/mc-graphics/SKILL.md
  • skills/mc-graphics/engines/hyperframes.md
  • skills/mc-new/scripts/new_project.py
  • skills/mc-new/scripts/tests/test-new_project.py
  • skills/mc-package/SKILL.md
  • skills/mc-pipeline/PIPELINE.md
  • skills/mc-retro/SKILL.md
  • skills/mc-setup/SKILL.md
  • skills/mc-setup/assets/formats/livestream-vod.md
  • skills/mc-setup/assets/formats/talking-head.md
  • skills/mc-setup/assets/formats/voiceover-explainer.md
  • skills/mc-setup/scripts/check_deps.py
  • skills/mc-setup/scripts/tests/test-merge_profile_frontmatter.py
🚧 Files skipped from review as they are similar to previous changes (5)
  • skills/mc-beats/SKILL.md
  • skills/mc-setup/assets/formats/voiceover-explainer.md
  • skills/mc-setup/scripts/check_deps.py
  • skills/mc-setup/scripts/tests/test-merge_profile_frontmatter.py
  • skills/mc-setup/assets/formats/talking-head.md

Comment thread README.md
Comment thread skills/mc-cut/scripts/composite_core.py
Comment thread skills/mc-cut/SKILL.md Outdated
Comment thread skills/mc-setup/SKILL.md
Comment on lines +50 to +56
### 2b. HyperFrames graphics skills

HyperFrames is the graphics engine, and its Agent Skills carry the agent's current, self-refreshing knowledge of everything it can do (the block catalog, WebGL transitions, color grading, background removal, HTML-in-Canvas, the authoring patterns). Install them now, provided node and npx are present (step 2), so that capability knowledge is live from the beats and graphics stages onward instead of only after the first graphics run. Confirm before installing (it writes skill files into the project); the install is idempotent, a re-run refreshes rather than duplicates:

- Install and favor the full catalog: `npx skills add heygen-com/hyperframes --all --full-depth`. A creator who wants a lighter footprint can take just the maintained core set instead: `npx hyperframes skills update`.
- Everything here runs on the local CLI; no HeyGen account or credits. The engine WORKSPACE itself (`{engines-path}/hyperframes/`, a multi-GB npm install) still builds lazily on the first graphics run; this step installs only the lightweight skill knowledge so the whole capability surface is known from the start.
- If node or npx is missing, say HyperFrames graphics need them and defer the skills to the first graphics run rather than blocking setup.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== candidate files =="
git ls-files | rg '(^skills/mc-sets?up/SKILL\.md$|SKILL\.md$|package\.json$|pnpm-lock\.yaml$|package-lock\.json$|yarn\.lock$|README\.md$)' | sed -n '1,200p'

echo
echo "== relevant skill setup lines =="
if [ -f skills/mc-setup/SKILL.md ]; then
  nl -ba skills/mc-setup/SKILL.md | sed -n '1,90p'
fi

echo
echo "== package/tool references =="
rg -n "npx skills add|npx hyperframes skills|hyperframes|heygen-com|skills-cli|skills add|skills update" . --glob '!node_modules' --glob '!dist' --glob '!build' --glob '!*.lock' | sed -n '1,200p'

Repository: bmad-code-org/bmad-manticore

Length of output: 691


🌐 Web query:

HeyGen HyperFrames npx skills add npx hyperframes skills update --all --full-depth

💡 Result:

The command npx skills add heygen-com/hyperframes --all --full-depth is used to install the full suite of HyperFrames skills into your project at once [1][2]. HyperFrames is a toolset designed for AI agents to create, edit, and render videos using plain HTML, CSS, and JavaScript [3][4]. The skills system allows AI agents (such as those in Claude Code, Cursor, or similar environments) to access specific workflows, composition contracts, animation runtimes, and authoring tools via slash commands [5][2]. Key details regarding the command and the skills system include: --all: This flag skips the interactive picker and installs every available skill (core and all workflows) in a single operation [5][2]. --full-depth: This ensures you receive the current version from the repository's main branch rather than a potentially lagged registry blob [1][2]. Management: Once installed, you can keep your skills up to date using npx hyperframes skills update, which refreshes the core set and installed skills without expanding them [2]. Agent usage: In standard scenarios, you do not need to install every skill upfront. The router typically installs workflows on demand the first time they are needed [2]. Installing everything at once is primarily recommended when you explicitly want the complete set available immediately [2]. For day-to-day operations after setup, the hyperframes CLI is the primary interface for tasks like init, preview, lint, and render [6][7].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== relevant setup section =="
sed -n '40,70p' skills/mc-setup/SKILL.md

echo
echo "== HyperFrames / skills CLI references =="
rg -n "npx skills add|npx hyperframes skills|hyperframes skills|heygen-com/hyperframes|skills add|skills update|full-depth" . --glob '!node_modules' --glob '!dist' --glob '!build' --glob '!*.lock' --glob '!*.png' | sed -n '1,220p'

echo
echo "== package manifests and lock files =="
for f in package.json skills/*/package.json skills/mc-*/package.json; do
  [ -f "$f" ] || continue
  echo "--- $f ---"
  sed -n '1,220p' "$f"
done
git ls-files '*lock*' '*-lock*' | sed -n '1,80p'

Repository: bmad-code-org/bmad-manticore

Length of output: 7255


🌐 Web query:

npm publish skills cli skills add heygen-com/hyperframes source code npx skills

💡 Result:

The commands mentioned are part of the agent skills ecosystem, which provides a standardized way to install, manage, and use "skills" (capability sets or instructions) for AI coding agents like Claude Code, Cursor, and others [1][2]. npx skills add heygen-com/hyperframes This command installs the HyperFrames suite of agent skills [3]. HyperFrames allows AI agents to compose and render videos by writing HTML, CSS, and JavaScript [4]. Running this command typically triggers an interactive picker allowing you to select which specific skills (e.g., core composition rules, animation adapters, or specific video workflows) to add to your project [3][5]. npx skills This is the base command for the skills CLI, an open-source tool used to manage these agent capabilities [1][6]. It acts as a registry manager and installer that bridges the gap between skill repositories (usually on GitHub) and your local agent configuration [1]. Key commands for the skills CLI include: npx skills add : Installs skills from a specified source (e.g., a GitHub repo) into your project or global agent directory [1][7]. npx skills list (or ls): Shows which skills are currently installed [2][7]. npx skills update: Refreshes installed skills [1][8]. npx skills use : Generates a prompt for a skill without permanently installing it, or starts a supported coding agent interactively with that skill enabled [1][6]. Regarding npm publish: There is no single authoritative way to "npm publish" a skill; different tools have emerged to handle the publishing of agent skills [9][10]: - publish-skills: A dedicated CLI tool that automates the publishing of skills to Git repositories via Pull Requests [11][12]. - skillpm: An alternative approach that treats Agent Skills like standard npm packages (using package.json and the npm registry) [9]. - Boilerplate templates: Some developers use standard npm publishing workflows (e.g., npm publish --access public) after configuring a repository based on specific boilerplate templates [10]. If you are using HyperFrames, the recommended way to keep skills updated is often via npx hyperframes skills update, which ensures you have the latest core set directly from the repository's main branch [13][14].

Citations:


Pin the HyperFrames skills installation to reviewed versions or immutable refs.

Both setup commands resolve through floating npx packages, and npx skills add heygen-com/hyperframes --all --full-depth also installs from the current heygen-com/hyperframes source. A compromised registry package, tag, or branch could modify agent skill content for every new project. Pin the skills launcher and HyperFrames source to an audited version/commit, and use pinned installs where the skills CLI supports them.

🧰 Tools
🪛 SkillSpector (2.3.11)

[warning] 16: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 18: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 19: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 21: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 21: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 52: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 54: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 54: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))


[warning] 56: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Remediation: Pin the version: npx @scope/server@1.2.3

(MCP Rug Pull (RP1))

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/mc-setup/SKILL.md` around lines 50 - 56, Update the HyperFrames
installation commands in the “2b. HyperFrames graphics skills” section to use
audited, immutable versions or commit references for both the npx skills
launcher and the heygen-com/hyperframes source. Apply pinned-install options
supported by the skills CLI, while preserving the existing full-catalog and
lightweight core-set alternatives.

Source: Linters/SAST tools

@bmadcode bmadcode changed the title Remove Remotion; HyperFrames is the sole motion-graphics engine (1.1.0) Manticore 2.0.0: HyperFrames-only engine, skills at setup, incremental render Jul 23, 2026
The persisted segment id derived only from the EDL-slice identity, excluding
overlays. Two content-identical slices carrying different overlays collided on
one segments/<id>.ts and deduped to a single render job, baking the wrong
graphics onto one of them. segment_id now folds in overlay placement (id,
chunk-local start, dur, image) while still excluding the overlay file digest,
so re-rendering a graphic keeps the filename stable (input_hash catches it) and
position-independence is preserved. New test covers distinct/shared ids.

Also: README Status section brought current to 2.0.0; mc-cut loudnorm note made
conditional on [render] loudnorm; removed the landed HyperFrames workspace-init
item from TODO.
@bmadcode

Copy link
Copy Markdown
Contributor Author

Triage of the CodeRabbit findings, addressed in 894e82e.

Fixed

  • Overlay-blind segment cache key (composite_core.py) — the real one. segment_id derived only from the EDL-slice identity, so two content-identical slices with different overlays collided on one segments/<id>.ts and deduped to a single job, baking the wrong graphics onto one. segment_id now folds in overlay placement (id, chunk-local start, dur, image), still excluding the overlay file digest so re-rendering a graphic keeps the filename stable and input_hash catches the change. New test test_id_distinguishes_overlays_on_identical_slices.
  • README Status section — brought current from 1.0.0 to 2.0.0.
  • mc-cut loudnorm wording — made conditional on [render] loudnorm.
  • TODO.md — removed the landed HyperFrames workspace-init item.

Intentional, not changing

  • hyperframes@latest / npx skills add pin warnings (SkillSpector RP1) — deliberate design: install latest at init, record the resolved version. Accepted tradeoff for a distributed authoring module.

Dismissed (misfire / stale)

  • marketplace.json badge 1.1.0 vs manifest — stale; both are 2.0.0 now.
  • mc-ograf "works in every editor" — refers to editor-lane ProRes 4444 alpha (near-universal), not the OBS-lane VP9 WebM the finding assumed.
  • PIPELINE.md remotion→hyperframes test at test-render_final.py:59 — misdirected; render_final composites alpha MOVs regardless of engine label, so the alias is exercised in the beats/graphics/resolve path, not there.
  • design-prompting window.seek vs window.__timelines — engine-neutral design-lane contract; optional doc nuance.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
README.md (2)

15-17: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Document the retained remotion compatibility alias.

“Remotion is retired” plus the reinstall guidance can imply that existing profiles must be edited. Clarify that remotion remains accepted as a permanent alias for hyperframes, so copied studio configurations continue to work unchanged.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 15 - 17, Update the README upgrade and compatibility
guidance to state that “remotion” remains a permanent accepted alias for
“hyperframes.” Clarify that existing or copied studio configurations using the
remotion name continue to work unchanged, without suggesting profiles must be
edited.

29-29: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Qualify the incremental-rendering claim.

Final rendering reuses changed/unchanged cached video segments but rebuilds audio. “Touches only what changed” overstates the behavior; describe the video-segment reuse while noting that the audio output is rebuilt.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` at line 29, Update the README rendering description to qualify the
incremental final-render claim: state that unchanged video segments are reused
and only changed video segments are rerendered, while explicitly noting that the
audio output is rebuilt. Remove the broader “touches only what changed” wording
without altering the surrounding export or workflow details.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@README.md`:
- Around line 15-17: Update the README upgrade and compatibility guidance to
state that “remotion” remains a permanent accepted alias for “hyperframes.”
Clarify that existing or copied studio configurations using the remotion name
continue to work unchanged, without suggesting profiles must be edited.
- Line 29: Update the README rendering description to qualify the incremental
final-render claim: state that unchanged video segments are reused and only
changed video segments are rerendered, while explicitly noting that the audio
output is rebuilt. Remove the broader “touches only what changed” wording
without altering the surrounding export or workflow details.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39217853-ef95-41a0-8a4e-33a225542053

📥 Commits

Reviewing files that changed from the base of the PR and between 09ee2ae and 894e82e.

📒 Files selected for processing (5)
  • README.md
  • TODO.md
  • skills/mc-cut/SKILL.md
  • skills/mc-cut/scripts/composite_core.py
  • skills/mc-cut/scripts/tests/test-render_final.py
💤 Files with no reviewable changes (1)
  • TODO.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • skills/mc-cut/SKILL.md
  • skills/mc-cut/scripts/tests/test-render_final.py

@bmadcode
bmadcode merged commit 97ce6f1 into main Jul 24, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant