---

victorylap Devlog #4

victorylap Devlog #4 (it’s a real command now)

TL;DR

• victorylap is npx-able. one command, any repo, out comes an mp4
• added –out and –theme flags, friendly errors for bad input, and it runs the render itself now
• you can paste a github url. it clones to a temp folder, makes the video, cleans up after itself
• tested on three repos i did not write: slugify, requests, is-odd. all three rendered

---

What I Did

a bin field in package.json and a shebang line. that’s the whole trick behind every cli tool i’ve ever npx’d, and now mine is one of them.

the flags are not magic either. process.argv is just an array of what the user typed, and parsing –out is an if statement in a loop.

most of the session was making it fail nicely. bad folder, fake theme, empty repo, missing api key, broken llm reply. each one now gets one plain sentence instead of a stack trace.

my own typos fought back the whole way. i typed the new code and kept the old line twice, wrote studio instead of stdio, THEMS instead of THEMES. when a snippet replaces a line, the delete is half the edit.

---

What I Learned

the github url feature had a security lesson in it. my first instinct was to glue the url into a shell command string. bad idea. If someone passes a “url” with && and a delete command in it, the shell runs it. that’s command injection. the fix is execFileSync, which hands git the arguments as an array so no shell ever reads them. user input never gets glued into a command string.

three repos i have never read, three videos.

next up: multiple scenes, so the video stops being one card.