Merge remote-tracking branch 'origin/main' into HEAD

# Conflicts:
#	skills-manifest.json

Author: miguel-heygen

.agents/skills/README.md

@@ -49,7 +49,9 @@ Claude Code users get the same auto-discover behaviour — keep the two
 in sync when editing. A `scripts/check-skill-mirror.mjs` check enforces
 this at CI time.
 
-Each repo-native skill declares `metadata.internal: true`, so `npx skills add`
-skips it during normal installs (including `--all`). This does not change local
-agent discovery. To explicitly install these skills elsewhere, set
-`INSTALL_INTERNAL_SKILLS=1` when running the installer.
+Each repo-native skill declares `metadata.internal: true`. That excludes it from
+normal `npx skills add` discovery and from `npx skills add ... --all`. A named
+`npx skills add ... --skill <name>` still installs a matching skill regardless of
+`metadata.internal`; no environment variable is needed. `INSTALL_INTERNAL_SKILLS=1`
+opts internal skills into normal discovery and bulk installation. This does not
+change local agent discovery.

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "hyperframes",
   "description": "HyperFrames by HeyGen. Write HTML, render video. Compositions, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.8.106",
+  "version": "0.8.111",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com",

.claude/skills/README.md

@@ -11,6 +11,8 @@ manifested by `.claude-plugin/`). Two separate namespaces, on purpose:
 - `skills/` — **marketplace-distributable**, installed into other projects
   via `npx hyperframes skills` or `npx skills add heygen-com/hyperframes`.
 
+> **Warning:** Never run `npx skills add ... --all` from inside a HyperFrames checkout: it selects the OpenClaw target, whose `skills/` directory is the repo's own `skills/`, and removes each existing `skills/<name>` destination before linking. A fresh clone restores tracked source, but uncommitted work under `skills/` does not recover. Run it from an empty directory or from your own project root. This happens regardless of `metadata.internal`.
+
 ## Weekly changelog video
 
 The `changelog-video` skill turns a weekly changelog markdown into a
@@ -47,7 +49,9 @@ CLI users get the same auto-discover behaviour — keep the two in sync
 when editing. A `scripts/check-skill-mirror.mjs` check enforces this at
 CI time.
 
-Each repo-native skill declares `metadata.internal: true`, so `npx skills add`
-skips it during normal installs (including `--all`). This does not change local
-agent discovery. To explicitly install these skills elsewhere, set
-`INSTALL_INTERNAL_SKILLS=1` when running the installer.
+Each repo-native skill declares `metadata.internal: true`. That excludes it from
+normal `npx skills add` discovery and from `npx skills add ... --all`. A named
+`npx skills add ... --skill <name>` still installs a matching skill regardless of
+`metadata.internal`; no environment variable is needed. `INSTALL_INTERNAL_SKILLS=1`
+opts internal skills into normal discovery and bulk installation. This does not
+change local agent discovery.

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "hyperframes",
   "description": "Write HTML, render video. Compositions, Tailwind v4 styles, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.8.106",
+  "version": "0.8.111",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com",

.cursor-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "hyperframes",
   "displayName": "HyperFrames by HeyGen",
   "description": "Write HTML, render video. Compositions, Tailwind v4 styles, GSAP and runtime adapter animations, captions, voiceovers, audio-reactive visuals, and website capture for HyperFrames.",
-  "version": "0.8.106",
+  "version": "0.8.111",
   "author": {
     "name": "HeyGen",
     "email": "hyperframes@heygen.com"

.fallowrc.jsonc

@@ -507,6 +507,11 @@
       "packages/studio-server/src/routes/files.test.ts",
       "packages/studio-server/src/routes/render.test.ts",
       "packages/studio-server/src/routes/lint.test.ts",
+      // Studio gesture tests: pre-existing parallel overlay-option setups and arrange/assert blocks.
+      "packages/studio/src/components/editor/domEditOverlayStartGesture.test.ts",
+      "packages/studio/src/components/editor/anchoredResizeCommitFeedsOffset.test.ts",
+      "packages/studio/src/components/editor/rotateInlineSave.test.ts",
+      "packages/studio/src/hooks/useDomGeometryCommits.test.tsx",
       // extractionCache.test.ts: pre-existing parallel describe setup and publish-case arrange/assert blocks.
       "packages/engine/src/services/extractionCache.test.ts",
       "packages/studio-server/src/routes/preview.test.ts",

.github/renovate.json

@@ -15,6 +15,10 @@
     "labels": ["security"]
   },
   "packageRules": [
+    {
+      "matchDepTypes": ["engines", "peerDependencies"],
+      "rangeStrategy": "widen"
+    },
     {
       "matchUpdateTypes": ["minor", "patch"],
       "matchDepTypes": ["devDependencies"],

.github/workflows/canary-sunset.yml

@@ -23,7 +23,7 @@ jobs:
   sunset:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest

.github/workflows/catalog-previews.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - uses: ./.github/actions/preflight
 
   render-previews:
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 

.github/workflows/catalog-publish.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
           fetch-depth: 0