v1.4 — experience overhaul, finished + hardened + CI-validated

.gitattributes

@@ -1,4 +1,10 @@
 * text=auto eol=lf
+# Shell scripts executed under WSL MUST stay LF: a CRLF `set -euo pipefail\r`
+# makes WSL bash abort with "set: pipefail: invalid option name", which silently
+# broke the verthor vertical-reframe path in v1.4 (shorts never generated).
+# `* text=auto eol=lf` already implies this; this explicit rule documents the
+# hard requirement and survives edits to the wildcard line.
+*.sh text eol=lf
 *.png binary
 *.jpg binary
 *.jpeg binary

.github/workflows/e2e.yml

@@ -31,6 +31,11 @@ name: e2e
 
 on:
   workflow_dispatch:
+    inputs:
+      update_visual_baselines:
+        description: "Regenerate the Windows (*-win32.png) visual baselines instead of diffing (uploads them as the 'updated-visual-baselines' artifact; does NOT commit)"
+        type: boolean
+        default: false
   schedule:
     # Nightly at 04:17 UTC (off the hour to avoid GitHub's scheduler congestion).
     - cron: "17 4 * * *"
@@ -62,14 +67,23 @@ jobs:
       - name: Install sidecar + E2E runtime deps (CPU)
         run: |
           python -m pip install --upgrade pip
-          pip install pytest pytest-cov
+          # hypothesis is imported by sidecar/tests/conftest.py at collection time
+          # (it registers the deterministic "ci" profile), so EVERY pytest run —
+          # including `pytest -m e2e` — needs it. `sidecar[dev]` declares it, but the
+          # `--no-deps` install below skips the extra's transitives, so install the
+          # test tools explicitly here.
+          pip install pytest pytest-cov hypothesis
           # Package itself (pure-logic modules) + dev extras, no heavy transitives.
           pip install -e "sidecar[dev]" --no-deps
           # The CPU runtime deps the opt-in E2E flows actually exercise. Unlike the
           # standard gate, the E2E suite IS allowed the heavier (still CPU-only)
           # stack: real tiny faster-whisper, scenedetect, av, onnxruntime, cv2.
+          # opencv is PINNED to the version the reframe engine is validated against
+          # (pyproject reframe-gpu extra, A6 lesson 5). Unpinned resolves to OpenCV
+          # 5.x, whose cv2.FaceDetectorYN/YuNet path is a major-version break and
+          # fails the claudeshorts reframe.
           pip install \
-            httpx numpy opencv-python-headless \
+            httpx numpy opencv-python-headless==4.13.0.92 \
             faster-whisper scenedetect av onnxruntime \
             huggingface_hub tokenizers
 
@@ -146,6 +160,27 @@ jobs:
           python -m pip install --upgrade pip
           pip install -e "sidecar[dev]" --no-deps
 
+      - name: Install the reframe + asset-provisioning runtime deps for the real Make-Shorts pipeline
+        # golden-journey.spec.ts drives the REAL reframe→export pipeline against the
+        # dev-build sidecar (RF_PY = this system python on EVERY leg, incl. Windows —
+        # only packaged.spec drives the shipped .exe). Two runtime needs the
+        # `sidecar[dev] --no-deps` install above deliberately omits:
+        #  * cv2 — the final vertical-reframe stage (reframe_claudeshorts) HARD-requires
+        #    it and fails LOUD when missing (no silent center-crop — the WU-3 contract).
+        #    PINNED to the reframe-validated version (pyproject reframe-gpu extra, A6
+        #    lesson 5); unpinned resolves to OpenCV 5.x, a FaceDetectorYN/YuNet
+        #    major-version break. opencv-python-headless bundles FaceDetectorYN + the
+        #    ONNX runtime YuNet uses (no GUI libs); numpy rides along.
+        #  * httpx — the asset downloader (manager._default_http_client) lazily imports
+        #    it. golden-journey provisions the YuNet model via a live sidecar
+        #    (fixtures.provisionAssets → assets.ensure); WITHOUT httpx that download
+        #    throws, assets.ensure GRACEFULLY SKIPS the item but still emits job.done,
+        #    so YuNet never lands and the reframe reports "not provisioned". huggingface_hub
+        #    covers the HF-snapshot install path for completeness.
+        # In production the packaged app installs these on first-run bootstrap. Mirrors
+        # the e2e-sidecar job's install.
+        run: pip install "opencv-python-headless==4.13.0.92" numpy httpx huggingface_hub
+
       - name: Install app deps
         working-directory: app
         run: npm ci
@@ -176,7 +211,13 @@ jobs:
       - name: Package the Windows app (electron-builder → dist/)
         if: runner.os == 'Windows'
         working-directory: app
-        run: npx electron-builder --config ../electron-builder.yml --win
+        # `--publish never`: this is an E2E BUILD, not a release. Without it,
+        # electron-builder detects CI and implicitly tries to publish, which
+        # fails with "GitHub Personal Access Token is not set" (no GH_TOKEN) —
+        # AFTER it has already built + signed dist/. We only need dist/ to exist
+        # for packaged.spec.ts to drive the shipped .exe; publishing is the
+        # release workflow's job, not this gate's.
+        run: npx electron-builder --config ../electron-builder.yml --win --publish never
 
       - name: E2E GUI — vitest DOM caption + nasty-caption proofs
         working-directory: app
@@ -225,13 +266,41 @@ jobs:
       # Windows leg to reuse the already-built dev app. Runs against the dev build
       # (RF_E2E_DEV=1) — the same target the baselines were captured against.
       - name: E2E GUI — VISUAL screenshot-diff + A11Y (axe) [Windows only]
-        if: runner.os == 'Windows'
+        # Normal (blocking) path: diff against the committed `*-win32.png` baselines.
+        # Unchanged for the nightly schedule and any dispatch that leaves the
+        # `update_visual_baselines` box unchecked (input is '' on schedule, 'false'
+        # when unchecked — either way not 'true', so this diff run fires as before).
+        if: runner.os == 'Windows' && github.event.inputs.update_visual_baselines != 'true'
         working-directory: app
         env:
           RF_PY: ${{ steps.setup-python.outputs.python-path }}
           RF_E2E_DEV: "1"
         run: npm run test:e2e:visual
 
+      # On-demand baseline REGEN: only when the workflow_dispatch box is checked.
+      # `--update-snapshots` REWRITES the `*-win32.png` baselines in-place (Playwright
+      # exits 0 after writing), so this run is non-blocking by design; the regenerated
+      # PNGs are uploaded below for the maintainer to download + commit. Never runs on
+      # the schedule (input is '' there), so the nightly gate stays a real diff.
+      - name: E2E GUI — VISUAL baseline REGEN (--update-snapshots) [Windows only, on demand]
+        if: runner.os == 'Windows' && github.event.inputs.update_visual_baselines == 'true'
+        working-directory: app
+        env:
+          RF_PY: ${{ steps.setup-python.outputs.python-path }}
+          RF_E2E_DEV: "1"
+        run: npm run test:e2e:visual:update
+
+      - name: Upload regenerated visual baselines
+        if: always() && runner.os == 'Windows' && github.event.inputs.update_visual_baselines == 'true'
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: updated-visual-baselines
+          # Playwright stores baselines next to each spec (playwright.visual.config.ts
+          # testDir: ./e2e/visual) as `<spec>.spec.ts-snapshots/<name>-win32.png`.
+          path: app/e2e/visual/**/*-win32.png
+          if-no-files-found: warn
+          retention-days: 7
+
       - name: Upload Playwright report
         if: always()
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0

.gitignore

@@ -9,6 +9,9 @@ app/.vite/
 # never commit. Screenshot BASELINES under e2e/**/-snapshots/ ARE tracked.
 app/playwright-report/
 app/test-results/
+# Ad-hoc end-to-end scratch outputs (probe scripts + runner datadirs/library.db
+# written under e2e_artifacts/ during manual E2E drives) — regenerable, never commit.
+e2e_artifacts/
 
 # Python
 __pycache__/
@@ -87,6 +90,10 @@ build/ffmpeg/
 # regenerable by the same prep script — never commit it (mirrors build/ffmpeg/).
 # NOTE: build/python-embed/ (py3.12) IS tracked historically; this only covers 3.14.
 build/python-embed-314/
+# Stray duplicate icon dir — the REAL app icons live in build/icons/ (plural,
+# committed by WU A2). build/icon/ (singular) is a regenerable leftover dup an
+# icon step emits; never commit it (the tracked build/icons/ is the source of truth).
+build/icon/
 
 # Runtime data root (models/exports/envs — relocatable via MEDIA_STUDIO_CONFIG_DIR)
 /data/

CHANGELOG.md

@@ -3,7 +3,192 @@
 All notable changes to Reframe — Media Studio are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
-## [Unreleased]
+## [1.4.1] — 2026-07-08
+
+**Reframe v1.4.1 — post-v1.4 hardening.** A focused patch over 1.4.0: it fixes a real
+cloud-vision egress bug, hardens the renderer against a white-screen, corrects the
+Workspace tab-strip accessibility, and re-pairs the GPU/reframe runtime pins — all
+surfaced by driving the (never-before-CI'd) v1.4 line through the full `quality` +
+`e2e` gauntlet. Ships **in place** over the GitHub-Releases auto-update feed. Both
+coverage gates stay at **strict 100% line + branch** (renderer vitest **and** sidecar
+pytest), and the golden-journey end-to-end acceptance test now passes on CI (Windows +
+Linux), proving Make-Shorts produces a real vertical short.
+
+### Fixed
+
+- **Cloud vision in Make-Shorts jobs no longer crashes/degrades.** The per-request key
+  overlay closed before a job's worker thread resolved the cloud provider, so tier≥2
+  vision in `thumbnail.select` / `phase8.select` read redacted key markers off-thread.
+  Keys are now captured synchronously in the handler and snapshotted onto the worker
+  thread (mirroring `index.build`).
+- **No more white screen on a renderer/RPC hiccup.** An `ErrorBoundary` now wraps the
+  whole app and every eager-RPC mount site guards the synchronous preload-bridge throw,
+  so a transient failure renders an inline error instead of a blank window; the main
+  process gains render-process-gone / uncaught-exception recovery.
+- **Workspace tab-strip accessibility (WCAG).** The grouped tab strip exposed its
+  `role="tab"` buttons under `region` wrappers with non-tab controls inside the
+  `role="tablist"` (critical `aria-required-parent` / `aria-required-children`), and a
+  cluster caption sat at 3.85:1 contrast. The tablist now owns only tabs, and the
+  caption meets AA.
+- **Reframe/GPU runtime pins re-paired.** `torch`/`torchaudio` are re-pinned to the
+  paired `+cu128` build and `opencv` to the reframe-validated `4.13.0.92`, so the
+  first-run reframe stack installs a consistent, validated set (the claudeshorts
+  vertical-reframe engine now fails LOUD with an actionable message if its YuNet model
+  is not provisioned, instead of degrading silently).
+
+## [1.4.0] — 2026-07-07
+
+**Reframe v1.4 — the experience overhaul.** One big release that turns the raw
+first-run into a plug-and-play experience: it kills the three errors that greeted
+new installs, makes setup visible and choosable, surfaces where every clip came
+from, and re-skins the whole app in a calm cool blue-gray. Almost all of it is
+wiring + making existing machinery visible, not new capability. Ships **in place**
+over the existing GitHub-Releases auto-update feed (the bump to **1.4.0** is what
+lets that feed report an update at all — 1.3.0 reports "no update" to itself).
+Both coverage gates stay at **strict 100% line + branch** (renderer vitest **and**
+sidecar pytest) under the single `quality` CI gate.
+
+### Fixed — the three first-launch errors are gone
+
+- **"Sidecar is not running" on first launch** — the app no longer drops you into
+  a dead Library while Python and the models are still installing. A full-screen
+  **"Setting up Reframe"** first-run screen now stands in for the tabbed shell
+  while provisioning, driven by the real `bootstrap.progress` stream (phase +
+  progress bar), and auto-transitions into the app the moment the sidecar reports
+  **running**. Setup failures / offline / partial states are first-class in that
+  view with a **Retry** (no dead-end, no raw crash banner).
+- **Player preview "code 4" / clipped-at-the-top** — the preview is now
+  sidecar-state-aware: while the playback proxy is still building it shows
+  **"Building preview…"** (not a raw exit-code), reloads when `proxy.state` goes
+  ready, and reports a real error loudly with its actual reason. The
+  fixed-height/overflow CSS that cut the frame "in half at the top" is fixed.
+- **Settings / first-run confusion** — the local-vs-cloud **FirstRunChooser** that
+  was buried in Settings is surfaced into the first-run flow, so the choice is made
+  up front instead of failing later.
+
+### Added — in-app install profiles (Min / Default / Full / Custom)
+
+- **Choose what gets installed, in the app, on first run.** A first-run profile
+  picker (**Minimum · Default · Full · Custom**) shows what each level includes,
+  why, and its approximate download size, then routes the choice into first-run
+  bootstrap (which previously spawned with no arguments and always fetched the same
+  set). The profile→asset map is a **single source of truth** with a conformance
+  test asserting it stays a superset of the CORE model floor (YuNet / S3FD / LR-ASD)
+  and matches the sidecar — every level keeps that floor so the app never silently
+  falls back to a plain center crop.
+
+### Added — Library provenance, relink & keep-a-copy
+
+- **See where every clip came from.** Each library item now shows its **source
+  path**, an **on-disk / MISSING** badge, and **open-in-folder**; a moved or
+  renamed source can be **relinked** with a content-hash verify so you re-point to
+  the right file, not just any file. Existing videos get their `content_hash`
+  back-filled lazily (pin-on-view) so relink works for the clips you already have,
+  not only new adds; a source that is already gone surfaces "relink unavailable"
+  honestly.
+- **Keep a managed copy of originals (opt-in).** An opt-in keep-a-copy imports a
+  managed duplicate of source files with a **free-space preflight**, content-hash
+  dedup, a cumulative size cap + meter, and an **atomic** copy (temp + replace with
+  rollback) so it never half-writes or silently doubles your disk use.
+
+### Added — API keys: reveal & live usage
+
+- **Providers & Keys** lets you **reveal** a stored key on demand and shows
+  **per-key live usage**, so you can confirm the right key is set and watch spend —
+  while the key stays redacted over the RPC/IPC bridge by default and is never
+  logged.
+
+### Changed — cool blue-gray visual overhaul
+
+- **A calm, cool blue-gray re-skin, token-first.** Design tokens v2 lift the base
+  off near-black toward a faint cool blue-gray and **widen the surface ladder** so
+  cards, panels, and wells stratify with real elevation and a top-lit atmosphere;
+  every component inherits it. A humanized header replaces the QUALITY/ROUTING
+  jargon with plain-language iconed toggles ("Runs on: This computer / Cloud",
+  "Where jobs run: …") plus an egress dot and a Jobs status pill (same values and
+  handlers — relabel only, **local stays default, cloud strictly opt-in**). A
+  designed state system lands skeleton-shimmer loading, ghost-poster empties, a
+  calm-amber **"Reconnecting…"** (hard-red reserved for true failure), and a framed
+  player error card; cards, buttons, tabs, and inputs get signature hover / focus /
+  active states. **AA contrast is re-verified and the `tokens.conformance` test
+  stays green.**
+
+### Added — in-place auto-update (safe by construction)
+
+- **Updates land in place over GitHub Releases** — a packaged build checks the feed
+  on launch and drives an in-app update banner (electron-updater;
+  download-then-quit-and-install). Because a working install can be bricked by a bad
+  update, v1.4 lands its safety net **first**: a **single-instance lock** (plus a
+  data-root-scoped lock so two distinct copies pointed at one relocatable data
+  folder also mutually exclude) prevents two bootstraps racing into the same env /
+  `library.db`, and a **version-aware re-bootstrap** gates first-run on a persisted
+  shipped-requirements **fingerprint** (not just marker existence) so an update that
+  adds Python deps re-provisions the env instead of starting the sidecar against a
+  stale one ("No module X"). A version-triggered re-bootstrap is **silent** and
+  reuses the saved profile — it never re-prompts.
+
+### Changed — display name & icon unified to "Reframe"
+
+- **One user-facing name and a real app icon.** The window title, in-app header,
+  Electron About panel, and installer / Start-menu shortcut all read **"Reframe"**,
+  and the app ships its production multi-size icon. The About panel reads the
+  version **dynamically** via `app.getVersion()`, so it tracks the package version
+  with no hardcoded string. The internal id **`media-studio`** is deliberately
+  unchanged — the package `name`, the `local.media-studio` appId, the `${name}`
+  installer-artifact filename, and every appData/path literal keep it so **first-run
+  state, the data root, proxy/peak/dub caches, and the sidecar-env sentinel survive
+  the upgrade untouched**. A brand guard test asserts no user-facing surface leaks
+  "media-studio" / "Media Studio".
+
+### Legal — NON-COMMERCIAL while ViNet-S is bundled
+
+- **Reframe v1.4 still bundles the ViNet-S saliency model under CC-BY-NC-SA-4.0.**
+  ViNet-S (the no-face crop-tracking video-saliency network, ICASSP 2025,
+  arXiv:2502.00397) is licensed **Attribution-NonCommercial-ShareAlike 4.0**, so
+  **the app as shipped is NON-COMMERCIAL while that model is bundled**. A future
+  paid tier MUST remove or replace ViNet-S. Its required attribution — © 2025
+  Rohit Girmaji, Siddharth Jain, Bhav Beri, Sarthak Bansal, Vineet Gandhi (IIIT
+  Hyderabad) — plus the other bundled model licenses (YuNet MIT, EdgeTAM
+  Apache-2.0, TransNetV2 MIT, LR-ASD MIT) are surfaced **in-app** at
+  **Settings → Licenses** and in the repo-root **`NOTICE`** file; the vendored
+  full CC-BY-NC-SA-4.0 text ships at
+  `sidecar/media_studio/features/_vinet_s/LICENSE`.
+
+### Rolling back to 1.3.0
+
+- **If a 1.4 update ever misbehaves, you can go back.** Download and re-run the
+  **1.3.0** installer from the
+  [Releases page](https://github.com/Prekzursil/Reframe/releases) — it installs
+  over the top and, because the internal id, appId, and every appData/path literal
+  are unchanged across the upgrade, your **userData and the data root (library,
+  keys, proxies, caches, installed models) are preserved**. Nothing is migrated
+  destructively, so a downgrade re-uses the same data folder.
+
+### Roadmap
+
+- **A dedicated Reframe Director panel is a v1.5 item.** v1.4 promotes
+  reframe-to-vertical to a first-class action and wires the existing override
+  controls; the fuller prompt-driven Reframe Director surface is planned for **1.5**.
+
+## [1.3.0] — 2026-07-06
+
+**Reframe v1.3.0 — branding, encrypted keys, re-hosted models, auto-update.**
+Personal / non-commercial build; unsigned (SmartScreen click-through on first launch).
+
+### Added
+
+- Unified **"Reframe"** branding + new app icon (fixed the window title still reading
+  "media-studio").
+- **API keys encrypted at rest** (Windows DPAPI) with reveal + validate in
+  **Settings → Providers & Keys**.
+- **Third-party licenses** screen (**Settings → Licenses**).
+- **AI Director onboarding** + a "what works right now" capability matrix.
+- **In-place auto-update** via GitHub Releases (`electron-updater`).
+
+### Fixed
+
+- **Re-hosted the AI models** (ViNet-S saliency, TransNetV2 scene-cut) — the "unknown
+  asset" first-launch errors are gone.
 
 ## [1.2.0] — 2026-07-03