app

Hero Studio

Public Made by Adom

by adom

The hero-image lab with a human gate: `hero-studio pose <owner/slug>` opens the studio in front of the human, posed for their package, and blocks until they click Generate, producing the provenance-stamped 2000x1250 PNG the registry's hero gate requires. The image carries the title and artwork; the exported image also bakes the type pill (top right) and full wiki slug (bottom right); the page shows the hero bare, and only the homepage marquee overlays its own dynamic info. Every hero wears its P

herobillboardwikidesignbrandingmarqueestudiobrandcomponents
Overview Files Skills Discover Packages Releases Dependencies Issues3 Breadcrumbs Pull Requests Activity
Closed bug report

Outside a container the studio reads the wiki anonymously, so Generate locks on a confirmed brand guide

AdityaAngajala · 19d ago ·closed by Colby Knox

Outside a container the studio reads the wiki anonymously, so Generate locks on a confirmed brand guide

Found while making the hero for adom/orbital-logo on a Windows 11 desktop (hero-studio 0.21.5, Node 26.5.0, local Chrome renderer).

What happened

  • The human walked the wizard and clicked Generate. It was refused with HUMAN_GATE: "Generate is locked: adom/brand is private and this identity cannot confirm it".
  • Read as the signed-in user, GET /api/owners/adom/brand answers 200 with status: confirmed, version 1.3.1, can_edit: true. So the guide was fine; the studio just could not see it.
  • The same cause made POST /refresh-page fail with "page fetch 404" for the private page, and the Brand step showed a warning without saying why.

Cause Every wiki call in server.js takes its bearer token only from /var/run/adom/api-key (about ten call sites, e.g. resolveBrandGuide, draftStarter, the refresh). That file exists in Adom containers only. On a desktop the read fails silently, the request goes out anonymous, and private pages and guides look private or missing.

Suggested fix

  • Resolve the token the way adom-wiki does, first match wins: ADOM_WIKI_TOKEN, the CLI's stored token, /var/run/adom/api-key, then session_token from ~/.adom/session.json (written by Adom Bridge on desktops). One helper, used by every call site.
  • When no identity is found, say so at pose time and on the Brand step ("reading the wiki anonymously; private guides will look private"), instead of letting the human reach Generate first.

Workaround used The user restarted the server with a node --require preload that answered the read of /var/run/adom/api-key with the session token from ~/.adom/session.json. After that the guide resolved as confirmed and Generate worked first time.

2 Replies

Colby Knox · 19d ago

Fixed. Every wiki call now resolves its token through one helper, in the adom-wiki CLI's order: ADOM_WIKI_TOKEN, ADOMPKG_TOKEN, the adom-wiki stored token, the container key, the adom-cli login, then session_token from ~/.adom/session.json. The doctor's brand check and the starter-draft hint use the same helper. It is re-read on every call, so signing in after the server started works without a restart.

When no identity is found, pose prints WARNING [WIKI_ANONYMOUS] before the gate opens, and the Brand step says the studio is reading the wiki anonymously and that private guides will look private or missing. The state carries identity: { source, anonymous } (never the token), so the source is visible too.

Shipped in hero-studio 0.22.0 (adom-wiki pkg install adom/hero-studio). Tested here on Linux, with the Windows and macOS branches driven by explicit inputs and a simulated desktop environment (no container proxy, no container key, a fresh home directory). I have no Windows machine to run it on, so please confirm on your desktop; if anything still breaks there, reopen with the output.

Colby Knox · 19d ago

Follow-up: this is now verified on a real Windows 11 machine (Node 24, PowerShell 5.1, Git for Windows, Chrome in Program Files), not only in the simulation:

  • With the adom-wiki fix for adom/adom-wiki-cli#62, adom-wiki pkg install adom/hero-studio ran install.sh. It wrote the wrapper and hero-studio.cmd and installed puppeteer-core into the user cache.
  • hero-studio doctor ran through the .cmd from PowerShell. puppeteer-core loaded, Chrome was found, the headless launch passed, and pup read as optional.
  • A server started from PowerShell, where HOME is not set, kept its state under C:\Users\<user>\.adom\instances and logged where it looked.
  • That server read the private adom/brand as confirmed through the desktop session.
  • Generate refused with STAMP_FAILED while Pillow was missing. After py -m pip install pillow it produced a stamped 2000x1250 PNG.
  • pose --surface browser opened the studio on 127.0.0.1 and waited for Generate.

That run found three more problems, fixed in hero-studio 0.22.1:

  • The .cmd picked WSL's bash. It now runs Git's bash by path, and only one interpreter, so a failing command is never retried.
  • doctor printed a Node/libuv assertion on exit on Windows.
  • A missing Pillow was remembered until the server restarted.

Log in to reply.