[cristinamadureira353-svg]

Add OpenFilm MiniApp

What and why

OpenFilm is an open-source video editor with an agent chat — original repository: https://github.com/openfilm/openfilm. This package puts the OpenFilm desktop interface inside MiniMax Code as a MiniApp: the Studio editor with the desktop chat column and local agents, not only the plain web Studio.

The desktop app is Electron, and a MiniApp can only be a page + a Node process, so the Electron window itself cannot be embedded. What this package does instead is serve the desktop app's own page and replace the Electron native bridge (window.openfilmNative) with an HTTP one:

• apps/desktop/shell/bridge.ts never imports electron — it only consumes window.openfilmNative, so the built shell/dist can be served as-is with a small injected bridge (miniapp/client/bridge-web.js).
• The desktop main-process handlers are plain Node (chat-ipc.mjs, local-agents-ipc.mjs, skills-ipc.mjs, agent-roster.mjs, agents.mjs, agent-usage.mjs, app-report.mjs — none of them imports electron). They are registered against an HTTP ipcMain shim, so chat, local agents, skills and Settings → Agents run the desktop app's real code.
• Agent events go over SSE; the fake webContents.send() forwards to it. Studio's /api/* and its WebSocket event stream are proxied same-origin, with the key attached on the server side only.

@openfilm/desktop is not published to npm, so desktop mode needs a local clone of openfilm/openfilm and one pnpm --filter @openfilm/desktop build:shell. Without it the panel falls back to the plain web Studio (no chat column). This is documented in the README.

Also included: opens the most recent project on launch (project switching then happens inside OpenFilm itself — no extra chrome of our own), an agent-callable endpoint that launches/activates the installed desktop app, a concurrent-boot lock (two panels start one Studio), and a dispose that closes local agent sessions, ends SSE streams, and quits only the Studio this instance spawned.

Security

• Loopback authentication is left to the Host (MiniMax Code 3.1.2+): no token logic in this package, and no secrets in HTML, client JavaScript, logs, or error responses.
• Durable state lives under context.dataDir (openfilm-studio/). The user's own desktop Studio home is never taken over.
• BYOK keys are sealed with AES-256-GCM using a local 0600 master key in that state directory (the desktop app uses the OS keychain; they are not shared).
• The user's real OpenFilm studio.json and .film/id files are only read, never written by the panel itself.

Testing

Environment: MiniMax Code desktop on macOS (Apple Silicon), Node 22, OpenFilm 0.2.5, an openfilm/openfilm clone with build:shell run.

• npm run check — this package: OK, 0 errors, 0 warnings (other warnings in the output belong to existing packages).
• Acceptance script (44 checks, all passing): Studio boot, project tree (5 groups, no stale entries), desktop page served, desktop IPC (hello, local-agents:list, prefs), real chat:load sessions, agent roster (11 agents), skills/MCP channels, SSE, web fallback, missing-shell error, two instances racing (one spawned, one reused, a single Studio process), and dispose with an open SSE stream (does not hang; no Studio left behind).
• Manual in MiniMax Code: the desktop page renders with the chat column and real conversation history; project switching works; the preview actually draws frames (it used to sit on "drawing the first frame" because the film bridge only talks to the editor origin); Settings → Agents shows Codex (connected, ChatGPT account), Claude Code (not installed), BYOK and MiniMax Code.
• desktop:local-agents:probe for Codex starts a real ACP session (@agentclientprotocol/codex-acp 1.13.1); Claude Code correctly reports not-installed.

Not exercised: a full agent turn end to end (it would spend the user's agent quota and modify a real project) — only the ACP probe was run. Windows/Linux are untested (some paths use open, pbcopy, ps). Native file pickers and screen capture return null by design.

Notes for the reviewer

• OpenFilm is open source (https://github.com/openfilm/openfilm). This package does not copy or vendor any of that code; it drives OpenFilm at runtime (the desktop handlers are imported from the user's clone). The original author has authorized this packaging and public sharing (see NOTICE.md).
• miniapp.config.local.json is gitignored: machine-specific overrides (repo path, which desktop app to launch, legacy state home) stay out of the package.
• Root README rows were added in both languages.

Update after the maintainer's review

The Must fix items are addressed: no Studio key reaches any page (web mode is proxied same-origin too), API/proxy and WebSocket routes are allowlisted with only the needed headers, IPC channels are an explicit allowlist with payload validation (installer/sign-in/automatic removed), process launches are fixed to auto-detected OpenFilm apps with npx -y openfilm@0.2.5 and a minimal environment, and every external read plus the npx download is documented in ## Data & access. The two items relaxed by the reviewer (local clone loading, the legacy studioHome override) are documented there as well. Optional items are mostly handled too (English description/SKILL, trimmed health endpoint, derived version, upstream LICENSE link, project-limited reveal, no MCP-endpoint claim, free test ports, lsof-optional checks, BYOK plaintext caveat). Acceptance is now 44 checks, all passing, including the new security assertions.

[MyPrototypeWhat]

Reviewed at 7527d86.

Thanks for the careful write-up and the acceptance script. The items below are mostly about the trust boundary between this package and code or data that lives outside it.

Must fix

1. Code is loaded and run from a local path outside the package. plugins/cristinamadureira353-svg/openfilm/miniapp/node/desktop-host.mjs:86-91 and :193-199 import() modules from <openfilmRepo>/apps/desktop/src. server.mjs:83 and server.mjs:206 default that path to ~/Developer/openfilm (or OPENFILM_REPO), and miniapp.config.json turns desktop mode on by default. Whatever happens to sit in that folder runs inside the MiniApp process. Nothing pins it to a version or checks its integrity, and none of it is reviewed as part of this PR. docs/package-contract.md asks for third-party runtime code to be vendored inside a payload root. Please vendor the handlers you need, under their license, into miniapp/node/, or make the web mode the default and drop the import from the local clone.

2. The page receives the Studio key. server.mjs:871-876 returns key from /miniapp/studio, and miniapp/client/index.html:84-88 puts it into the iframe URL (/open?key=…). docs/security.md ("Secrets stay in the Node process. Never place credentials in HTML, Client JavaScript…") does not allow this, and it contradicts README.md:66. Please keep the key server-side, for example by serving the web mode through the same proxy, and remove key from the /miniapp/studio response.

3. The proxies forward everything. server.mjs:927-930 sends every /api/* method and path to Studio with the key attached (:778). server.mjs:921-924 forwards every /p/* path. server.mjs:957-972 forwards any WebSocket upgrade path and copies all incoming headers. docs/security.md says "do not proxy arbitrary URLs". It also says not to forward authentication headers, and :962-966 passes every request header through except host and origin. Please limit each proxy to the routes and methods the UI actually uses, and forward only the headers you need, such as content-type and accept.

4. Every desktop IPC handler is reachable with trusted: () => true. desktop-host.mjs:118, :127 and :140 mark every caller as trusted. server.mjs:695-735 then exposes all registered channels to any page request. That includes starting and steering local agents (miniapp/client/bridge-web.js:140-149) and desktop:agents:install / connect / own-model (desktop-host.mjs:219-228). Most notably, answerPermission (bridge-web.js:147) lets the page answer the local agent's permission requests directly, and desktop:agents:automatic (desktop-host.mjs:223) turns on automatic mode. docs/security.md asks you to treat the page as untrusted input and validate every parameter. Please register an explicit allowlist of channels with validated payloads, and leave out installer and sign-in flows.

5. Process launches use paths taken from config. server.mjs:541-549 accepts any desktopApp path and args from config, and :611 runs open -n <path> --args …. server.mjs:327 runs openfilmBin / openfilmArgs from config with the full process.env (:330). The calls use argument arrays, which is good. Even so, POST /miniapp/open-desktop (server.mjs:891) can launch whatever the config names. Please restrict open-desktop to a fixed list of OpenFilm app bundle locations and drop the free-form desktopApp and args. Also pin openfilmBin to the bundled default and pass a minimal environment.

6. Writes can land outside context.dataDir. server.mjs:56 and :177-178 fall back to ~/.minimax/openfilm-studio, and config.studioHome can point anywhere. State must stay under context.dataDir. Please remove the home-directory fallback and the studioHome override.

7. Reads outside the package are undeclared or misstated. server.mjs:60-63 and :401-402 read the real ~/.openfilm/studio.json (or ~/.openfilm-dev). server.mjs:477-479 reads .film/id from every path listed there. server.mjs:554-558 lists <repo>/apps/desktop/.dev/runtime. desktop-host.mjs:236-248 reads /api/doctor and an app report and copies them to the clipboard with pbcopy. Please document every one of these, along with the open, ps, pbcopy and npx commands and the npm registry as an outbound host, in README.md ## Data & access (README.md:55-61), as docs/security.md requires.

8. npx -y openfilm@0.2.5 is downloaded and run on first start. server.mjs:79-80 and :327 do this. Runtime code then comes from the registry instead of from the reviewed package. Please disclose it prominently (see item 7). Bundling or vendoring would be preferable.

Optional

1. forwardToFilm rewrites upstream JavaScript to remove the same-origin guard in bridge.js (server.mjs:835-838). This is fragile across OpenFilm versions and weakens a check upstream relies on. Consider a separate origin or port for the film pages instead.
2. server.mjs:842 has a leftover "temporary troubleshooting" comment. desktop-host.mjs:155 hard-codes version 0.2.5, which can drift from openfilmArgs.
3. /miniapp/health (server.mjs:895-911) returns the boot log and local paths. Consider trimming it.
4. plugin.json description, exampleQueries, skills/openfilm/SKILL.md, the _说明 key in miniapp.config.json:7, and most code comments are in Chinese. An English description and skill text would help English-language agents and reviewers.
5. The BYOK master key sits next to the ciphertext in the same directory (desktop-host.mjs:274-280), so the AES-256-GCM layer protects against little beyond casual reads. Please say so in README.md:68. unsealKey also accepts a plaintext raw: prefix (desktop-host.mjs:291).
6. test/accept-miniapp.mjs:107 hard-codes port 52987, and the process-count check calls lsof. On a Linux machine without lsof that check fails. Picking a free port and skipping the check when lsof is missing would make the script portable.
7. NOTICE.md:10 states that the author gave permission. Linking the upstream license (and its SPDX id) directly in NOTICE.md would make attribution clear, especially once any upstream code is vendored (see Must fix 1).
8. desktop:reveal accepts an arbitrary path (desktop-host.mjs:167). Consider limiting it to project directories.
9. skills/openfilm/SKILL.md:24 says the agent can call /miniapp/* through the host's MCP, but miniapp/miniapp.json:19 has an empty mcpEndpoints. Please align the two: either declare the endpoints or drop the claim.
10. desktop-host.mjs:198-199 loads the upstream agent-usage and app-report modules. Could you state which paths on disk these read?

Verified

• npm run check on Node 22.23.4: validate reports plugins/cristinamadureira353-svg/openfilm: OK, and 69/69 repository tests pass.
• The root README changes are a single catalog row each in README.md:60 and README.zh-CN.md:60. No CI, root test/, or script changes.
• Tests are inside the plugin (test/accept-miniapp.mjs), outside the miniapp/ payload. The payload is about 100 KB with no build output or node_modules.
• The server binds only context.listen with node:http (server.mjs:1014) and logs through context.logger. Nothing under /__mavis/.
• Child processes are spawned with argument arrays and no shell (server.mjs:327, :578, :611; desktop-host.mjs:108, :244).
• dispose closes SSE streams, local agent sessions, and the Studio it spawned (server.mjs:1030-1069).
• test/accept-miniapp.mjs on Linux (Node 22, SKIP_PROBE=1, no local OpenFilm clone): web mode, the fallback for an unbuilt shell, dual-panel locking, and dispose pass. The desktop-mode checks fail as expected without a clone, and the lsof check fails because lsof is not installed.
• The package LICENSE is MIT. No OpenFilm source is vendored in this PR.

[MyPrototypeWhat]

Update to the review above: items 1 (loading code from ~/Developer/openfilm) and 6 (writes outside context.dataDir) no longer block merge. Please document both clearly in ## Data & access instead. The other Must fix items still apply.

[cristinamadureira353-svg]

Thanks again for the thorough review. I have addressed the Must fix items and most of the Optional ones, and re-run the acceptance (all checks pass) plus npm run check (this package: OK).

Must fix

1. Code loaded from a local clone. Kept per your follow-up, and now documented explicitly in README.md ## Data & access (<openfilmRepo>/apps/desktop/src/*.mjs is imported and run, as the documented desktop-mode requirement).
2. Studio key reaching the page. /miniapp/studio no longer returns key, and no iframe URL contains /open?key=. Web mode is now served through the same-origin editor proxy too, so the key only ever lives in the Node process.
3. Unbounded proxies. /api/* now has a route-prefix allowlist (/api/health, /api/projects, /api/files, /api/doctor, /api/library, /api/saved, /api/skills, /api/prefs, /api/examples, /api/fonts, /api/page-links, /api/exports, /api/look) and forwards only accept, content-type, range. /p/* is read-only GET/HEAD. WebSocket upgrades are limited to /api/events and /api/projects/<id>/events, forwarding only the handshake headers plus the Studio key. No cookies or third-party auth headers are forwarded.
4. trusted: () => true IPC. Replaced with an explicit IPC_RULES allowlist and per-channel payload validation. Installer, sign-in and automatic flows are not registered at all (403). desktop:reveal is limited to project folders.
5. Process launches from config. desktopApp/desktopAppArgs are gone: open-desktop only opens the auto-detected OpenFilm app bundles (repo dev runtimes, /Applications/OpenFilm.app). openfilmBin/openfilmArgs are pinned to npx -y openfilm@0.2.5, started with a minimal environment (PATH, HOME, LANG, TMPDIR, OPENFILM_*).
6. Writes outside context.dataDir. Kept per your follow-up, and the legacy studioHome override is now documented as an explicit exception for an existing state directory, not a general writable path.
7. Undeclared reads. ## Data & access now lists every one: ~/.openfilm(-dev)/studio.json, per-project .film/id, <repo>/apps/desktop/src/*.mjs, <repo>/apps/desktop/.dev/runtime, <repo>/apps/desktop/shell/dist, agents' own records under ~/.claude and ~/.codex (agent-records.mjs), plus open, ps, pbcopy, npx, and registry.npmjs.org.
8. npx download on first start. Disclosed prominently in ## Data & access (pinned npx -y openfilm@0.2.5, first run downloads from registry.npmjs.org).

Optional

• Removed the leftover temporary-troubleshooting comment; hello.version is derived from openfilmArgs instead of being hard-coded.
• /miniapp/health no longer returns the boot log, pid or timestamps.
• plugin.json description, exampleQueries and skills/openfilm/SKILL.md are now in English.
• NOTICE.md links the upstream LICENSE directly and names SPDX MIT.
• desktop:reveal is limited to project directories.
• skills/openfilm/SKILL.md no longer claims MCP endpoints (it says none are declared).
• The acceptance script picks free ports instead of hard-coding them, and skips the process-count check when lsof is missing.
• ## Security now says explicitly that the BYOK master key sits next to the ciphertext (obfuscation, not keychain-grade protection) and that legacy raw: plaintext is accepted for compatibility.
• agent-usage/app-report disk reads are documented in ## Data & access (agent-records.mjs under ~/.claude and ~/.codex).

Re-verified

• Acceptance suite: all checks pass, including the new assertions for /miniapp/studio not returning key, /api/quit and /api/open returning 403, automatic returning 403, bad payload types returning 400, reveal outside a project being rejected, and web mode serving the editor same-origin without /open?key=.
• npm run check: plugins/cristinamadureira353-svg/openfilm: OK (0 errors, 0 warnings), 69/69 repository tests pass.
• The preview still draws frames (the film-origin/EDITOR proxying is unchanged and covered by the suite).

[MyPrototypeWhat]

Thanks for the quick, thorough turnaround. I re-reviewed a7e48fe, and seven of the eight items are resolved. One disclosure gap remains, so I'm keeping this at request changes. It only needs a README update, no code changes.

Must fix

1. ## Data & access still leaves out several files the desktop handlers read. The README says agent records are read "under ~/.claude and ~/.codex (agent-records.mjs)". The upstream modules this package imports from <openfilmRepo>/apps/desktop/src read more than that, and the plugin reaches them through allowlisted channels (desktop:agents:mcp, desktop:agents:skills, desktop:skills:*, desktop:chat:*, desktop:local-agents:*). Checked against current openfilm/openfilm main:

   • agent-skills.mjs ownMcpServers: ~/.claude.json (a file in the home directory, not inside ~/.claude; the code takes only the mcpServers entries) and project .mcp.json; ~/.codex/config.toml (only [mcp_servers.*] command/url); ~/.config/opencode/opencode.json(c), ~/.qwen/settings.json, ~/.copilot/mcp-config.json.
   • agent-skills.mjs ownSkills: ~/.claude/skills, ~/.codex/skills, ~/.agents/skills, ~/.copilot/skills, plus the project-level .claude/skills, .agents/skills, .codex/skills, .github/skills and .opencode/skill(s).
   • agent-records.mjs: ~/.claude/projects/**/<session>.jsonl (including subagents/), ~/.codex/sessions/** and ~/.codex/archived_sessions, ~/.kimi-code/session_index.jsonl and its session folders, ~/.copilot/session-state/<id>/events.jsonl. CLAUDE_CONFIG_DIR, CODEX_HOME and COPILOT_HOME are honored.
   • environment.mjs loginShellVariables: runs the user's login shell ($SHELL -l -i -c 'env -0') to collect environment variables, which are then passed to the local agents it starts.

   None of these are credentials. Nothing touches ~/.claude/.credentials.json, ~/.codex/auth.json, the keychain or MiniMax Code's login data. They still need to be disclosed:

   • List the files, globs and the login-shell step above in ## Data & access, in both README.md and README.zh-CN.md.
   • Say that only MCP server names and commands or URLs are read from those config files, and only session transcripts from the record folders.
   • Note that the exact set follows the upstream version in openfilmRepo, since it depends on the user's checkout.

Optional

1. desktop:reveal compares the raw string with root + '/' (desktop-host.mjs). A path like <project>/../../somewhere passes the check. It only reveals the path in Finder, so the impact is small. Running path.resolve (or realpath) before the prefix check would make the restriction do what the README says. desktop:skills:reveal and desktop:chat:reveal go to the upstream reveal without the same check.
2. desktop:local-agents:permission is still allowlisted, so the page can answer a local agent's permission prompts. This is how the desktop UI works and the page is the user's own UI, so I'm not blocking on it. A short note in ## Security would help users understand it.
3. The Configuration table still lists openfilmBin / openfilmArgs and desktopApp as keys, although none of them can be configured anymore. Removing those rows, or marking them as fixed values, would avoid confusion. The desktopCandidates() doc comment in server.mjs still says the candidates come from desktopApp in the config.
4. DEFAULT_STUDIO_HOME (~/.minimax/openfilm-studio) is still the fallback when context.dataDir is missing. The same path is mentioned in the masterKey comment in desktop-host.mjs. Consider dropping the fallback, or at least updating the comment.
5. The Dev candidates in open-desktop depend on openfilmRepo / OPENFILM_REPO. That is reasonable, since the user already trusts that checkout for desktop mode. Please mention it in the open -n bullet of ## Data & access.

Verified

• npm run check on Node 22: validate reports plugins/cristinamadureira353-svg/openfilm: OK, and 69/69 repository tests pass.
• Item 1: loading <openfilmRepo>/apps/desktop/src/*.mjs is disclosed in ## Data & access.
• Item 2: /miniapp/studio no longer returns key. Web mode is served through the same-origin editor proxy, and the key is added only server-side (studioHeaders, WebSocket handshake).
• Item 3: /api/* goes through the STUDIO_API_ALLOW prefix list (other paths get 403), and only accept, content-type and range are forwarded. /p/* is GET/HEAD only. WebSocket upgrades are limited to /api/events and /api/projects/<id>/events and forward only the handshake headers. No cookies or incoming auth headers are forwarded.
• Item 4: /ipc/<channel> answers 403 for any channel not in IPC_RULES, and each allowed channel has a payload check. desktop:agents:install, connect and automatic (and the sign-in flow) are not in the allowlist. desktop:reveal is limited to project folders (see Optional 1).
• Item 5: desktopApp / desktopAppArgs are gone. open-desktop takes no input from the request and opens only <openfilmRepo>/apps/desktop/.dev/runtime/*/OpenFilm Dev.app, /Applications/OpenFilm.app or ~/Applications/OpenFilm.app, with fixed arguments and a PATH/HOME-only environment. The Studio is started as the pinned npx -y openfilm@0.2.5 open with PATH, HOME, LANG, TMPDIR and the OPENFILM_* values set by the plugin, so nothing else from process.env is passed through. Neither the page nor the config can choose the executable or its arguments. All spawns use argument arrays without a shell.
• Item 6: writes outside context.dataDir (the studioHome override) are disclosed.
• Item 8: the first-run download from registry.npmjs.org is disclosed.
• The plugin name, id and skill do not use "MiniMax". Tests stay in the plugin's test/ folder. The only changes outside the plugin are one catalog row each in README.md and README.zh-CN.md. No CI, .github, root script or root test changes.
• test/accept-miniapp.mjs on Linux (Node 22, SKIP_PROBE=1, no OpenFilm clone): the new boundary checks for /miniapp/studio without key and for /api/quit and /api/open returning 403 pass, as do web mode, the unbuilt-shell fallback, the two-panel lock and dispose. The free-port and lsof skip changes work. The desktop-mode checks fail as expected without a clone. These include the IPC 403/400 and reveal assertions, so I verified those parts by reading the code.

[cristinamadureira353-svg]

The disclosure gap is filled in both README.md and README.zh-CN.md (## Data & access):

• MCP config: ~/.claude.json (only mcpServers), project .mcp.json, ~/.codex/config.toml (only [mcp_servers.*] command/url), ~/.config/opencode/opencode.json(c), ~/.qwen/settings.json, ~/.copilot/mcp-config.json.
• Skill dirs: ~/.claude/skills, ~/.codex/skills, ~/.agents/skills, ~/.copilot/skills, and project-level .claude/skills, .agents/skills, .codex/skills, .github/skills, .opencode/skill(s).
• Session records: ~/.claude/projects/**/<session>.jsonl (incl. subagents/), ~/.codex/sessions/**, ~/.codex/archived_sessions, ~/.kimi-code/session_index.jsonl and its session folders, ~/.copilot/session-state/<id>/events.jsonl; CLAUDE_CONFIG_DIR, CODEX_HOME, COPILOT_HOME honored.
• environment.mjs loginShellVariables (/bin/zsh -l -i -c 'env -0') is listed too.

The section also says explicitly what is read from them (only MCP names and command/url, only session transcripts), what is never read (no ~/.claude/.credentials.json, no ~/.codex/auth.json, no keychain, no MiniMax Code login data), and that the exact set follows the upstream version in openfilmRepo. The open -n bullet now notes the dev candidates depend on openfilmRepo/OPENFILM_REPO, and ## Security explains the permission-prompt channel in one sentence.

Re-ran npm run check: this package OK (0 errors, 0 warnings), 69/69 repository tests pass.

[MyPrototypeWhat]

Thanks for the update. Approving. I re-reviewed ae12684. Since a7e48fe, only the plugin's README.md and README.zh-CN.md changed, so the code I reviewed last time is unchanged.

Previous must-fix: resolved

## Data & access now covers the MCP config files, skill directories, session records and the login-shell environment capture in both languages, and says what is taken from each. I checked it against the upstream handlers (agent-skills.mjs, agent-records.mjs, environment.mjs) and it matches. The $SHELL wording is right, since the code spawns the user's login shell rather than a fixed /bin/zsh. The credentials statement holds too: none of these handlers read ~/.claude/.credentials.json, ~/.codex/auth.json or the keychain.

The open -n note on openfilmRepo / OPENFILM_REPO and the Security note on desktop:local-agents:permission are in place as well.

Optional

1. The upstream handlers read a few more locations than the list names: the opencode and Qwen skill folders (~/.config/opencode/skill(s), ~/.qwen/skills, project .qwen/skills), project-level opencode.json(c) and .qwen/settings.json, the per-project mcpServers inside ~/.claude.json, Codex plugin skills in its plugin cache, and QWEN_HOME / XDG_CONFIG_HOME. The README already says the set follows the upstream version, so this doesn't block merge.
2. Still open from the last review:
   • desktop:reveal checks the raw string before resolving it, and desktop:skills:reveal / desktop:chat:reveal skip that check.
   • DEFAULT_STUDIO_HOME is still the fallback when context.dataDir is missing.
   • The desktopCandidates() doc comment in server.mjs still refers to desktopApp in the config.

Verified

• git diff a7e48fe ae12684 touches only the two plugin READMEs (+20/-6). No code, tests, package files, .github/, scripts/ or root tests changed.
• npm run check at the repo root on ae12684: validation passes and 69/69 tests pass.