feat: add reviewable talking-head cleanup

.cargo/config.toml

@@ -9,3 +9,18 @@
 # tauri.conf.json. Keep the two in sync.
 [env]
 MACOSX_DEPLOYMENT_TARGET = { value = "11.0", force = true }
+
+# whisper.cpp is compiled as a static library, but CMake otherwise selects the
+# dynamic MSVC C/C++ runtime on Windows. That leaves the installed application
+# dependent on whichever MSVCP140/VCRUNTIME140 version happens to be present on
+# the machine and can fail before Rust's main() with STATUS_ENTRYPOINT_NOT_FOUND.
+# CMP0091 makes CMAKE_MSVC_RUNTIME_LIBRARY authoritative for the older
+# whisper.cpp CMake project; non-MSVC generators ignore both values.
+CMAKE_POLICY_DEFAULT_CMP0091 = { value = "NEW", force = false }
+CMAKE_MSVC_RUNTIME_LIBRARY = { value = "MultiThreaded", force = false }
+
+# Rust's MSVC target otherwise links VCRUNTIME/UCRT dynamically even when the
+# C++ libraries above use /MT. Keep the Windows executable self-contained and
+# make every cc-rs consumer observe the same crt-static target feature.
+[target.x86_64-pc-windows-msvc]
+rustflags = ["-C", "target-feature=+crt-static"]

.github/workflows/ci.yml

@@ -35,6 +35,33 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  motion-canvas:
+    name: Motion Canvas (locked build / audit / license)
+    if: github.event_name != 'workflow_dispatch' || inputs.red_task == 'none'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: plugins/motion-canvas-studio/package-lock.json
+
+      - name: Install locked Motion Canvas dependencies
+        run: npm --prefix plugins/motion-canvas-studio ci --ignore-scripts
+
+      - name: Audit dependencies and licenses
+        run: |
+          npm --prefix plugins/motion-canvas-studio audit --audit-level=moderate
+          npm --prefix plugins/motion-canvas-studio run licenses
+
+      - name: Test and reproduce embedded runner
+        run: |
+          npm --prefix plugins/motion-canvas-studio test
+          npm --prefix plugins/motion-canvas-studio run build
+          git diff --exit-code -- plugins/motion-canvas-studio/bundle/runner.html plugins/motion-canvas-studio/package-lock.json
+
   rust:
     name: Rust (fmt / clippy / test)
     if: github.event_name != 'workflow_dispatch' || inputs.red_task == 'none'
@@ -78,7 +105,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.toml') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.toml', 'Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-
 
       - name: Validate Windows product gate contract
@@ -98,6 +125,8 @@ jobs:
         run: cargo clippy --workspace --all-targets -- -D warnings
 
       - name: cargo test
+        env:
+          OPENTAKE_MOTION_TRACE: '1'
         run: cargo test --workspace
 
       - name: live playback transport integration (fail closed)
@@ -160,8 +189,16 @@ jobs:
           cache: pnpm
           cache-dependency-path: web/pnpm-lock.yaml
 
-      - name: Install FFmpeg
-        run: choco install ffmpeg --no-progress -y
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+
+      - name: Provision checksum-pinned packaged FFmpeg sidecars
+        run: python scripts/provision_ffmpeg_sidecars.py --target x86_64-pc-windows-msvc
+
+      - name: Verify sidecar supply and probe/decode/encode boundary without PATH
+        shell: bash
+        run: ruby scripts/tests/packaged-sidecars-test.rb --name packaged_macos_windows_sidecars_resolve_and_execute
 
       - name: Cache cargo
         uses: actions/cache@v4
@@ -181,10 +218,27 @@ jobs:
       - name: Rust workspace clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
 
+      - name: Windows Chromium motion capture regression
+        shell: bash
+        env:
+          OPENTAKE_MOTION_TRACE: '1'
+        run: |
+          cargo test -p opentake-motion --features chromium --lib \
+            renderer::tests::chromium_skeleton_reports_unavailable_not_panic \
+            -- --exact --nocapture --test-threads=1
+          cargo test -p opentake-motion --features chromium --test chromium \
+            virtual_time_network_csp_timeout_cleanup_and_frame_identity \
+            -- --exact --nocapture --test-threads=1
+          cargo test -p opentake-tauri --test motion_command \
+            sandbox_progress_cancel_validated_mp4_result \
+            -- --exact --nocapture --test-threads=1
+
       - name: Web editor behavior suite
         run: pnpm -C web test
 
       - name: Rust workspace tests
+        env:
+          OPENTAKE_MOTION_TRACE: '1'
         run: cargo test --workspace -- --test-threads=1
 
       - name: Minimal-feature Tauri clippy
@@ -200,6 +254,40 @@ jobs:
           Remove-Item 'target/release/bundle/nsis' -Recurse -Force -ErrorAction SilentlyContinue
           & .\web\node_modules\.bin\tauri.cmd build --ci --bundles msi,nsis
 
+      - name: Install NSIS package and execute installed product without PATH
+        shell: pwsh
+        run: |
+          $installer = @(Get-ChildItem 'target/release/bundle/nsis/*.exe' -File)
+          if ($installer.Count -ne 1) { throw 'expected exactly one NSIS installer' }
+          $process = Start-Process -FilePath $installer[0].FullName -ArgumentList '/S' -Wait -PassThru
+          if ($process.ExitCode -ne 0) { throw "silent NSIS install failed: $($process.ExitCode)" }
+          $candidates = @(
+            (Join-Path $env:LOCALAPPDATA 'OpenTake/opentake.exe'),
+            (Join-Path $env:LOCALAPPDATA 'Programs/OpenTake/opentake.exe'),
+            (Join-Path $env:ProgramFiles 'OpenTake/opentake.exe')
+          )
+          $application = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
+          if (-not $application) {
+            $uninstall = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' `
+              -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -eq 'OpenTake' } | Select-Object -First 1
+            if ($uninstall.InstallLocation) {
+              $application = Get-ChildItem $uninstall.InstallLocation -Filter 'opentake.exe' -File `
+                -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName -First 1
+            }
+          }
+          if (-not $application) { throw "installed OpenTake executable not found: $($candidates -join ', ')" }
+          $installDirectory = Split-Path -Parent $application
+          ruby scripts/tests/packaged-sidecars-test.rb `
+            --name packaged_macos_windows_sidecars_resolve_and_execute `
+            --package $installDirectory
+          $app = Start-Process -FilePath $application -PassThru
+          Start-Sleep -Seconds 5
+          if ($app.HasExited) {
+            throw "installed OpenTake exited during launch smoke test: $($app.ExitCode)"
+          }
+          Stop-Process -Id $app.Id -Force
+          Wait-Process -Id $app.Id -ErrorAction SilentlyContinue
+
       - name: Bind installers to the exact source SHA
         shell: pwsh
         env:
@@ -249,32 +337,135 @@ jobs:
       - name: Install Rust toolchain
         run: rustup component add rustfmt
 
-      - name: Install FFmpeg
-        run: choco install ffmpeg --no-progress -y
+      - name: Provision checksum-pinned packaged FFmpeg sidecars
+        run: python scripts/provision_ffmpeg_sidecars.py --target x86_64-pc-windows-msvc
 
       - name: Cache cargo
         uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            target
-          key: ${{ runner.os }}-security-cargo-${{ hashFiles('**/Cargo.toml') }}
+          key: ${{ runner.os }}-security-cargo-${{ hashFiles('**/Cargo.toml', 'Cargo.lock') }}
           restore-keys: ${{ runner.os }}-security-cargo-
 
       - name: Portable FFmpeg cancellation lifecycle
         shell: pwsh
+        env:
+          OPENTAKE_FFMPEG: ${{ github.workspace }}\src-tauri\binaries\ffmpeg-x86_64-pc-windows-msvc.exe
         run: |
+          & $env:OPENTAKE_FFMPEG -version
+          if ($LASTEXITCODE -ne 0) { throw 'checksum-pinned packaged FFmpeg is not runnable' }
           cargo test -p opentake-media --lib windows_cancelling_running_pcm_child_reaps_both_pipe_readers
           cargo test -p opentake-media --lib windows_cancelling_mux_wait_reaps_child
 
+      - name: Verify portable Tauri test image imports
+        shell: pwsh
+        run: |
+          cargo test -p opentake-tauri --lib --no-run
+          $testImage = Get-ChildItem 'target/debug/deps/opentake_tauri_lib-*.exe' -File |
+            Sort-Object LastWriteTime -Descending |
+            Select-Object -First 1
+          if (-not $testImage) { throw 'compiled Tauri test image not found' }
+          $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio/Installer/vswhere.exe'
+          $dumpbin = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 `
+            -find 'VC/Tools/MSVC/**/bin/Hostx64/x64/dumpbin.exe' |
+            Select-Object -First 1
+          if (-not $dumpbin) { throw 'dumpbin.exe not found' }
+          & $dumpbin /DEPENDENTS $testImage.FullName | Set-Content windows-tauri-test-imports.txt
+          & $dumpbin /IMPORTS $testImage.FullName | Add-Content windows-tauri-test-imports.txt
+          $imports = Get-Content windows-tauri-test-imports.txt -Raw
+          if ($imports -match '(?im)^\s*(MSVCP140|VCRUNTIME140(?:_1)?|api-ms-win-crt-[^\s]+|onnxruntime|DirectML)\.dll\s*$') {
+            throw 'Tauri test image retains a non-portable native runtime dependency'
+          }
+
+          $mt = Get-ChildItem (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits/10/bin') `
+            -Filter mt.exe -File -Recurse |
+            Where-Object { $_.FullName -match '\\x64\\mt\.exe$' } |
+            Sort-Object FullName -Descending |
+            Select-Object -First 1
+          if (-not $mt) { throw 'mt.exe not found' }
+          $manifestLog = & $mt.FullName "-inputresource:$($testImage.FullName);#1" `
+            '-out:windows-tauri-test.manifest' 2>&1
+          $manifestLog | Set-Content windows-tauri-test-manifest.txt
+          if ($LASTEXITCODE -ne 0) { throw 'Tauri test image has no readable RT_MANIFEST resource #1' }
+          Get-Content windows-tauri-test.manifest | Add-Content windows-tauri-test-manifest.txt
+          if ((Get-Content windows-tauri-test.manifest -Raw) -notmatch 'Microsoft\.Windows\.Common-Controls') {
+            throw 'Tauri test image manifest does not activate Common Controls v6'
+          }
+
+          Add-Type @'
+          using System;
+          using System.Runtime.InteropServices;
+          public static class OpenTakeNativeExportProbe {
+            [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+            public static extern IntPtr LoadLibraryExW(string path, IntPtr file, uint flags);
+            [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true, ExactSpelling = true)]
+            public static extern IntPtr GetProcAddress(IntPtr module, string name);
+          }
+          '@
+          $modules = @{}
+          $currentDll = $null
+          $inImportSection = $false
+          $missingExports = @()
+          foreach ($line in (Get-Content windows-tauri-test-imports.txt)) {
+            if ($line -match '^\s*Section contains the following imports:\s*$') {
+              $inImportSection = $true
+              $currentDll = $null
+              continue
+            }
+            if ($line -match '^\s*Summary\s*$') {
+              $inImportSection = $false
+              $currentDll = $null
+              continue
+            }
+            if (-not $inImportSection) { continue }
+            if ($line -match '^\s{4}([A-Za-z0-9_.-]+\.dll)\s*$') {
+              $currentDll = $Matches[1]
+              if (-not $modules.ContainsKey($currentDll)) {
+                $modules[$currentDll] = [OpenTakeNativeExportProbe]::LoadLibraryExW(
+                  $currentDll, [IntPtr]::Zero, 0x00000800
+                )
+              }
+            } elseif ($currentDll -and $line -match '^\s+[0-9A-F]+\s+(\S+)\s*$') {
+              $name = $Matches[1]
+              $module = $modules[$currentDll]
+              $activationContextExport =
+                $currentDll -ieq 'comctl32.dll' -and $name -eq 'TaskDialogIndirect'
+              if (-not $activationContextExport -and ($module -eq [IntPtr]::Zero -or
+                  [OpenTakeNativeExportProbe]::GetProcAddress($module, $name) -eq [IntPtr]::Zero)) {
+                $missingExports += "$currentDll!$name"
+              }
+            }
+          }
+          $modules.GetEnumerator() | Sort-Object Name | ForEach-Object {
+            "LOAD $($_.Name)=$($_.Value)"
+          } | Set-Content windows-tauri-export-probe.txt
+          $missingExports | ForEach-Object { "MISSING $_" } | Add-Content windows-tauri-export-probe.txt
+          if ($missingExports.Count -ne 0) {
+            throw "Tauri test image imports unavailable system exports: $($missingExports -join ', ')"
+          }
+
       - name: Reserved output identity and reparse safety
         shell: pwsh
         run: |
           cargo test -p opentake-tauri --lib windows_project_media_junction_is_rejected_without_writing_target
           cargo test -p opentake-tauri --lib windows_directory_handoff_blocks_junction_replacement_before_child_create
           cargo test -p opentake-tauri --lib windows_retained_output_handle_blocks_final_name_replacement
 
+      - name: Upload Tauri test image imports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-tauri-test-imports-${{ github.sha }}
+          path: |
+            windows-tauri-test-imports.txt
+            windows-tauri-test-manifest.txt
+            windows-tauri-test.manifest
+            windows-tauri-export-probe.txt
+          if-no-files-found: error
+          retention-days: 7
+
   web:
     name: Web (install / build)
     if: github.event_name != 'workflow_dispatch' || inputs.red_task == 'none'
@@ -311,14 +502,16 @@ jobs:
       - name: Install Rust toolchain
         run: rustup component add rustfmt clippy
 
+      - name: Provision checksum-pinned packaged FFmpeg sidecars
+        run: python scripts/provision_ffmpeg_sidecars.py --target x86_64-pc-windows-msvc
+
       - name: Cache cargo
         uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
-            target
-          key: ${{ runner.os }}-library-security-${{ hashFiles('**/Cargo.toml') }}
+          key: ${{ runner.os }}-library-security-${{ hashFiles('**/Cargo.toml', 'Cargo.lock') }}
           restore-keys: ${{ runner.os }}-library-security-
 
       - name: Test retained-handle and junction defenses

.gitignore

@@ -11,6 +11,8 @@ dist/
 # Tauri
 src-tauri/target/
 src-tauri/gen/
+src-tauri/binaries/ffmpeg-*
+src-tauri/binaries/ffprobe-*
 
 # Env / secrets (never commit API keys)
 .env

CHANGELOG.md

@@ -2,6 +2,40 @@
 
 本文件记录 OpenTake 的重要改动。格式参考 [Keep a Changelog](https://keepachangelog.com/zh-CN/)。
 
+## [1.0.0-beta.1] — 2026-08-01
+
+OpenTake 的第一个可安装 Beta。核心闭环为：创建/打开工程 → 导入与管理素材 →
+多轨剪辑、字幕、关键帧、特效/蒙版/调色/转场 → 本地 AI 与生成式 AI 审阅工作流 →
+预览、保存重开、H.264/H.265/ProRes 与字幕/交换格式导出。
+
+### 新增（Added）
+
+- 可恢复的工程持久化、全局素材库、缩略图/波形/代理媒体、缺失素材重链接。
+- Rust/WGPU 预览与导出共享合成路径，支持文本、调色、绿幕、蒙版、LUT、HSL、
+  Lift/Gamma/Gain、通用特效、交叉溶解、嵌套时间线、补帧与防抖。
+- Agent/MCP 编辑、内置聊天、官方 Codex CLI / ChatGPT 登录、BYOK 生成作业、Motion Canvas
+  动效与原生 Chromium fallback。Codex 登录态完全由官方 CLI 管理，OpenTake 不读取或保存令牌。
+- 本地口播清理、响度统一、降噪、声部分离、RVM 抠像、智能擦除、参考色彩匹配和
+  可视化运动追踪；字幕翻译、图文成片、数字人与音色克隆提供审阅/同意/成本边界。
+- 完整键盘、焦点、菜单、拖拽、撤销/重做与辅助功能回归门禁。
+
+### 安全与可靠性（Security / Reliability）
+
+- 生产 CSP、最小 asset scope、凭据 keychain 边界、URL/重定向/大小限制、下载校验与
+  项目修订原子提交。
+- macOS/Linux/Windows 安全文件系统契约、打包 FFmpeg sidecar 供应链校验、取消与失败
+  清理、生成/导出恢复与防陈旧结果提交。
+
+### Beta 已知边界
+
+- 本地 macOS Beta 包未使用 Developer ID 签名或 Apple 公证；首次打开需要用户明确允许。
+- 数字人、音色克隆和通用云生成需要用户自己的 provider key，并可能产生第三方费用；
+  Agent 可选择 provider key，也可复用官方 Codex CLI 的 ChatGPT 登录。无可用登录或 key 时
+  功能会显式不可用或拒绝，不会静默调用。
+- Windows 安装包由精确 SHA CI 构建和验证；原生 Windows WebView 的最终人工交互烟测仍是
+  平台发布门槛，不影响本次 Apple Silicon macOS 本地 Beta。
+- 任意 Motion Canvas TSX、透明动效、神经语义级任意人声分离等属于后续 Beta 范围。
+
 ## [未发布] — 2026-06-23 第三轮（自动 PR 审核：全局素材库 + 文本工具 + 字幕/视频导出 + list_models）
 
 本轮为**自动 PR 审核流程**:逐 PR 专家审核 + 对抗验证 + 对照开发文档,审核通过且 CI 双绿的纯新增项合并,其余 @作者 rebase/修改。