chore: release v0.8.30

[miguel-heygen]

HyperFrames v0.8.30

Site capture now keeps every icon a page declares and fetches assets as the same browser that loaded the page. The rest of this release hardens file handling and bounds slow scans across core, engine, studio and producer.

Features

• CLI: Keep every icon a site declares and headline the bare mark (feat(cli): keep every icon a site declares and headline the bare mark #3727)

Fixes

• CLI: Clarify publish visibility and claim links (fix(cli): clarify publish visibility and claim links #3730)
• CLI: Pin Studio bundle, signature and runtime file reads (fix(cli): pin Studio bundle, signature and runtime file reads #3728)
• CLI: Fetch a page's assets as the same agent that loaded the page (fix(cli): fetch a page's assets as the same agent that loaded the page #3726)
• Render: Serve engine and producer files through checked descriptors (fix(render): serve engine and producer files through checked descriptors #3725)
• CLI: Read caption images through checked file descriptors (fix(cli): read caption images through checked file descriptors #3724)
• CLI: Publish cached synthesis script exclusively (fix(cli): publish cached synthesis script exclusively #3722)
• CLI: Preserve concurrent scaffold config creation (fix(cli): preserve concurrent scaffold config creation #3721)
• CLI: Publish capture metadata without overwriting files (fix(cli): publish capture metadata without overwriting files #3720)
• Core: Bound timing compiler opening tag scans (fix(core): bound timing compiler opening tag scans #3719)
• Producer: Bound existing font-face recognition scans (fix(producer): bound existing font-face recognition scans #3718)
• Core: Bound inert region scans in timing compiler (fix(core): bound inert region scans in timing compiler #3717)
• Studio Server: Bound preview variable insertion scans (fix(studio-server): bound preview variable insertion scans #3715)
• Studio: Match style attributes with explicit quote boundaries (fix(studio): match style attributes with explicit quote boundaries #3712)
• Studio Server: Simplify normalized group ID trimming (fix(studio-server): simplify normalized group ID trimming #3711)
• Engine: Isolate WAV staging in a private directory (fix(engine): isolate WAV staging in a private directory #3709)
• Studio: Avoid inline style regex backtracking (fix(studio): avoid inline style regex backtracking #3708)
• Core: Avoid grade stats regex backtracking (fix(core): avoid grade stats regex backtracking #3706)
• Engine: Avoid transform regex backtracking (fix(engine): avoid transform regex backtracking #3704)
• Engine: Isolate chunked encode temporary files (fix(engine): isolate chunked encode temporary files #3680)

Full changelog

v0.8.29...v0.8.30

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟡 Building	–	Sep 6, 2026, 3:13 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[jerrai-bot-heygen]

Looked at 3f08acc as a release-consistency check (Miguel admin-merges):

• All 16 version fields move 0.8.29 → 0.8.30 (13 package.json + the three plugin.json), no stragglers, no other content changes.
• docs/changelog.mdx + releases/v0.8.30.md credit every PR merged into main since the v0.8.29 tag (#3704–#3730 range, 19 PRs); the one commit in that range not listed, #3680, is already credited in the previous changelog entry, so nothing is missing or double-counted.
• Range link points at v0.8.29...v0.8.30, which resolves once the tag exists.
• CI was still pending at look time.

Not release-blocking, carrying from #3730's post-merge notes: the new publish tests write into the real ~/.hyperframes/projects.json via ensureProjectId; worth a mock in a follow-up.

— Jerrai

[jrusso1020]

Post-merge look, as invited. Verified independently at 3f08acc8 (merged as 38749904); everything below is a check I ran myself rather than a reading of the PR body.

Version sweep — 16 fields, no stragglers, and one deliberate exclusion. Rather than count the changed files, I enumerated every package directory at the merge commit and read each version. All 13 published packages are at 0.8.30: aws-lambda, cli, core, engine, gcp-cloud-run, lint, parsers, player, producer, sdk, shader-transitions, studio-server, studio. The 3 plugin manifests (.claude-plugin, .codex-plugin, .cursor-plugin) are also at 0.8.30. That is the 16.

packages/sdk-playground sits at 0.6.106 and is untouched. That is correct rather than a miss — it is "private": true, and it read 0.6.106 / private at the v0.8.29 tag as well, so its exclusion is established precedent and not a lapse in this release.

Changelog completeness — proved by set difference, not by reading. Extracted every (#NNNN) from the 20 commits in compare/v0.8.29...3f08acc8, extracted every pull/NNNN from releases/v0.8.30.md, and diffed both directions: 20 merged, 20 credited, nothing missing and nothing spurious.

On #3680 specifically, since it is the one entry whose placement is not obvious: it is credited in this release and that is the right home for it. Its commit f13037ecd is the first commit after the v0.8.29 tag, so it shipped in 0.8.30. It appears exactly once across the whole of docs/changelog.mdx — inside the newly prepended v0.8.30 block — and it does not appear in releases/v0.8.29.md at all. No double credit, and nothing was carried over.

File arithmetic closes to the digit. 16 version lines (+16/-16), docs/changelog.mdx +36, new releases/v0.8.30.md +35. 16 + 36 + 35 = +87, and -16. That is exactly the PR's +87/-16 across 18 files, so there is no unaccounted hunk riding along.

The publish path is the reviewed one, and it is firing. publish.yml gates stable releases on github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/v') — the tag trigger is v*-*, hyphenated, so it is prerelease-only and a stable tag push publishes nothing. This PR's head ref is release/v0.8.30, which satisfies the gate; run 34008487842 started on the merge and is in flight. Every other PR merged tonight shows skipped on that workflow, which is the gate behaving correctly.

Two notes for whoever watches this land, both about instrumentation rather than the release:

• npm latest still reads 0.8.29 until that run finishes, so an EF pin bump to hyperframes@0.8.30 should wait on the registry rather than on this merge.
• Listing runs with ?branch=main will not show the publish. A pull_request-event run is keyed to the head branch, so it files under release/v0.8.30. I went looking for it on main first and briefly concluded it had not fired.

Nothing blocking. Clean release.

-- Rames