chore: release v0.8.164

[miguel-heygen]

What

Release v0.8.164: version bump and changelog.

Changes in this release

• Website capture connects only to public addresses, also after a redirect (fix(cli): pin website capture connections to public peers #5668).
• Audio tracks keep the authored mix order (fix(engine): preserve authored audio mix order #5672).
• An ffmpeg failure names how ffmpeg ended and keeps the line that explains it (fix(producer): an ffmpeg failure names how ffmpeg ended and keeps its last line #5678).

No visible change

Version bump and changelog only; each change was captured in its own PR.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Oct 16, 2026, 4:25 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[github-actions]

Edit accuracy: accurate 271 (base branch 271), smooth 210 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)

Unstable (2)

• textedit-none-px-r0-nested-z100: tracking 0, pressJump -, drop 0, reload 0, render 0.03, renderKey -, undo true, teleport true / tracking 0, pressJump -, drop 0, reload 0, render 0.03, renderKey -, undo true, teleport true / tracking 0, pressJump -, drop 0, reload 0, render 0.03, renderKey -, undo true, teleport true
• seqfastkeys-none-px-r0-root-z100: tracking 7.76, pressJump 0.05, drop 0, reload 0, render 0.02, renderKey -, undo true, teleport true / tracking 0.06, pressJump 0.05, drop 0, reload 0, render 0.02, renderKey -, undo true, teleport true / tracking 0.07, pressJump 0.05, drop 0, reload 0, render 0.02, renderKey -, undo true, teleport true

[terencecho]

Reviewed 1d6f1fb29bb596c2828e4b2e1eca31509ced2cb2 against effective/API base 490ecafbc4d1fba3dd9246d516390d4a1a188089. No introduced reachable blocker found in this release delta.

• All fourteen package manifests and five plugin manifests change only 0.8.163 → 0.8.164; their paths match the actual release targets in scripts/set-version.ts:23–46. Dependencies, exports and scripts are unchanged.
• The stable publish path checks out the merged PR's immutable commit, rather than moving main (.github/workflows/publish.yml), and the source release-channel validator agrees with release/v0.8.164 / latest (scripts/validate-release-channel.mjs:36–48). This is source inspection, not a publication-success claim.

Nonblocking release-note clarification: releases/v0.8.164.md:9–10 and docs/changelog.mdx:20–21 describe #5678/#5672 as this release's fixes, but the current v0.8.163 Git tag already points to base 490ecafb, whose ancestry contains both commits. The actual previous-source-tag → this head range is release metadata only. Consider describing this as a re-release/carry-forward; this does not establish what was present in any published npm artifact, and is not a runtime blocker.

Audited: Complete recursive BASE/HEAD tree reconstruction and all 41 existing changed-version blob hashes; all 21 changed leaves; exact single-field manifest replacements; new release notes; new/prior changelog sections; release/version/channel/plugin packaging consumers. Two independent source passes also traced the carried mix-order and FFmpeg diagnostic changes into their real consumers, including ordering × concurrent preparation × failure propagation. Prior tai coverage on #5672 and Rames coverage on #5678 were reconciled, not transferred as this head's verdict.

Trusting / limits: Historical changelog prose was byte-verified unchanged, not fully semantically reread: parent semantic coverage BASE/HEAD lines 1–100; the added release section is included. Inherited CLI/render integration was scoped, not a whole-repository audit. No install, runtime/test/build, native FFmpeg, CI/log, live-service or credential execution was performed. No merge or release was triggered by this review session.

Verdict: APPROVE
Reasoning: The verified delta is a coordinated version bump plus release documentation, with no introduced correctness defect found in the audited source and integration scope. The previous-tag wording clarification is informational, not a reason to hold this release metadata PR.
— tai

[terencecho]

Source-only re-review of release v0.8.164 at 76bdd2b5b80de17793ff913e5ae4cfb87e629e7a against API/effective base 8be76fc86cda5b2a77d0ee23b65f582e85376042. This is fresh current-head review, not a transfer of the earlier 1d6f1fb2 approval.

• packages/cli/src/capture/publicNetwork.ts:39–135 pins Node connections to the checked numeric IPv4 while retaining Host/TLS identity; assetDownloader.ts:670–690 revalidates redirects and cancels their bodies. Explicit caller deadlines survive, and capture-session cleanup is joined by the shared signal owner.
• packages/engine/src/services/audioMixer.ts:1390–1447 assembles prepared tracks and first-seen buses by input index after parallel preparation. Existing failure bail remains; the retained order regressions assert actual mixer input arrays under reversed completion.
• packages/engine/src/utils/runFfmpeg.ts:142–159 preserves numeric-exit/deadline behavior while identifying null-exit termination. packages/producer/src/services/render/audioPadTrim.ts:276–285 retains the redaction calls while removing the short display cap so the final cause survives. Machine failure classification is unchanged.

Audited: Complete BASE/HEAD tree and changed-leaf census; all 19 manifest changes are version-only (0.8.163 → 0.8.164); release note and inserted changelog section; immutable source ancestry and stable publish workflow. Two independent source passes plus parent integration checks examined the current capture transport/session/bootstrap paths, mixer/producer ordering, FFmpeg/pad-trim error paths, meaningful regression sources, and each of the three bundled-fix pairs. Current predicates/tests were reconciled with the earlier #5668 deadline, leading-option dotenv, and signal/profile-cleanup concerns. Related historical reviews—including @jrusso1020 on #5678—are corroboration, not replacement for current source review or separate verdicts here.

Trusting / limits: Historical changelog prose is unchanged-byte-verified but only partially reread (primary BASE 1–100, HEAD 1–116). Context/caller coverage is bounded, not whole-repository closure. Exact intermediate fixing patches, Citty/Puppeteer/Chromium internals, deeper watchdog/media helpers, telemetry-redactor internals and farther distributed/job/CLI/wire error consumers were not comprehensively audited. The capture policy is deliberately IPv4-only and conservatively excludes all 192.0.0.0/16; no universal browser/network isolation certification is implied. Regression sources were inspected, not executed; no runtime/native/provider tests, CI queries, builds or publication were performed.

Nonblocking source-history note: releases/v0.8.164.md:9–10 / docs/changelog.mdx:21–22 carry forward the audio-order and FFmpeg changes already ancestral to the current v0.8.163 source tag (490ecafbc4d1fba3dd9246d516390d4a1a188089). Website hardening (#5668) is new since that tag. This distinguishes source history only; it does not establish which artifacts were previously published. The inspected publish workflow uses the immutable merged SHA, but successful artifact publication is not verified.

Verdict: APPROVE
Reasoning: No concrete introduced reachable blocker was established in the bounded release and current-integration audit. The version-only delta preserves package contracts, and the examined transport, ordering and diagnostic mechanisms retain their checked failure/cleanup behavior without an adverse bundled interaction.

— tai