[Feat] feature-demo skill: polished, narrated demo videos

.docker/sandbox/install-browser-agent.sh

@@ -9,7 +9,7 @@ set -euo pipefail
 #   1. Worker image builds (Dockerfiles) to prebake browser automation.
 #   2. Worker setup compatibility fallbacks on older Linux images.
 
-AGENT_BROWSER_VERSION="${AGENT_BROWSER_VERSION:-0.27.0}"
+AGENT_BROWSER_VERSION="${AGENT_BROWSER_VERSION:-0.33.2}"
 AGENT_BROWSER_INSTALL_ROOT="${AGENT_BROWSER_INSTALL_ROOT:-/opt/agent-browser}"
 AGENT_BROWSER_EXECUTABLE_PATH="${AGENT_BROWSER_EXECUTABLE_PATH:-${AGENT_BROWSER_INSTALL_ROOT}/chrome}"
 AGENT_BROWSER_SAVED_CLI_PATH="${AGENT_BROWSER_SAVED_CLI_PATH:-${AGENT_BROWSER_INSTALL_ROOT}/.cli-path}"
@@ -374,21 +374,35 @@ collect_cli_browser_args() {
   local i=0
   AGENT_BROWSER_EXEC_ARGS=()
   AGENT_BROWSER_FORWARD_ARGS=()
+  # Default headless; a caller may opt a single invocation into headed mode
+  # (e.g. the feature-demo capture runner, so GPU-backed canvases present to
+  # the compositor). On displayless Linux agent-browser auto-starts Xvfb.
+  AGENT_BROWSER_WANT_HEADED=0
 
   while [ "$i" -lt "${#args[@]}" ]; do
     local arg="${args[$i]}"
 
     case "$arg" in
       --headed)
+        AGENT_BROWSER_WANT_HEADED=1
+        AGENT_BROWSER_FORWARD_ARGS+=("$arg")
         if [ "$i" -lt $(( ${#args[@]} - 1 )) ]; then
           case "${args[$((i + 1))]}" in
             true|false)
               i=$((i + 1))
+              [ "${args[$i]}" = false ] && AGENT_BROWSER_WANT_HEADED=0
+              AGENT_BROWSER_FORWARD_ARGS+=("${args[$i]}")
               ;;
           esac
         fi
         ;;
+      --headed=false)
+        AGENT_BROWSER_WANT_HEADED=0
+        AGENT_BROWSER_FORWARD_ARGS+=("$arg")
+        ;;
       --headed=*)
+        AGENT_BROWSER_WANT_HEADED=1
+        AGENT_BROWSER_FORWARD_ARGS+=("$arg")
         ;;
       --args)
         AGENT_BROWSER_FORWARD_ARGS+=("$arg")
@@ -512,7 +526,14 @@ if should_clear_seed_cache; then
 fi
 
 resolve_cli_paths
-export AGENT_BROWSER_HEADED=false
+# Preview-cookie seeding above always runs headless (inline env). The task
+# command itself honors an explicit --headed opt-in; everything else stays
+# headless as before.
+if [ "${AGENT_BROWSER_WANT_HEADED:-0}" = 1 ]; then
+  export AGENT_BROWSER_HEADED=true
+else
+  export AGENT_BROWSER_HEADED=false
+fi
 exec "$AGENT_BROWSER_BIN" "${AGENT_BROWSER_FORWARD_ARGS[@]}"
 EOF_WRAPPER
 }

.oxfmtrc.json

@@ -25,6 +25,7 @@
     ".env.*",
     ".qdrant",
     "packages/cloud-agents/src/server/workflows/skills/standard/agent-browser",
+    "packages/cloud-agents/src/server/workflows/skills/standard/feature-demo",
     ".vscode",
     ".git",
     "**/*.{md,mdx,yml,yaml,html,htm,toml,svg,graphql,gql}"

.oxlintrc.json

@@ -19,6 +19,7 @@
     "apps/docs/**",
     "apps/marketing/**",
     "packages/cloud-agents/src/server/workflows/skills/standard/agent-browser/**",
+    "packages/cloud-agents/src/server/workflows/skills/standard/feature-demo/**",
     "apps/codex-acp/target/**",
     "**/next-env.d.ts",
     "deploy/**"

apps/api/src/handlers/index.ts

@@ -26,6 +26,9 @@ export { mcpRouting } from './mcp/routing';
 // inference gateway
 export { inference } from './inference';
 
+// narration tts
+export { tts } from './tts';
+
 // task runs
 export { taskRunsRouter } from './task-runs';
 

apps/api/src/handlers/mcp/index.ts

@@ -4,7 +4,11 @@ import {
   areCuratedIntegrationsDisabled,
   isCustomMcpDisabled,
 } from '@roomote/env';
-import { isNativeMcpIntegration, MCP_INTEGRATIONS } from '@roomote/types';
+import {
+  isCredentialOnlyMcpIntegration,
+  isNativeMcpIntegration,
+  MCP_INTEGRATIONS,
+} from '@roomote/types';
 
 import type { Variables } from '../../types';
 
@@ -66,7 +70,9 @@ mcp.route('/vercel', vercelMcp);
 
 for (const integration of MCP_INTEGRATIONS.filter(
   (candidate) =>
-    !isNativeMcpIntegration(candidate) && candidate.id !== 'linear',
+    !isNativeMcpIntegration(candidate) &&
+    !isCredentialOnlyMcpIntegration(candidate) &&
+    candidate.id !== 'linear',
 )) {
   mcp.route(
     `/${integration.id}`,

apps/api/src/handlers/tts/connection.ts

@@ -0,0 +1,67 @@
+import { areCuratedIntegrationsDisabled, Env } from '@roomote/env';
+import {
+  and,
+  db,
+  deploymentMcpEnablements,
+  eq,
+  isNull,
+  mcpConnections,
+} from '@roomote/db/server';
+import { decrypt } from '@roomote/db/encryption';
+import { isMcpConnectionElevenLabsConfig } from '@roomote/types';
+
+type ElevenLabsCredentials = {
+  apiKey: string;
+  voiceId: string;
+};
+
+/**
+ * Resolves narration TTS credentials for the deployment.
+ *
+ * The admin-configured ElevenLabs integration (Settings → Integrations) is
+ * the primary source; the `R_ELEVENLABS_*` environment variables remain an
+ * operator fallback. Returns undefined when neither is configured — the
+ * feature is off and the endpoint 404s.
+ *
+ * The integration is credential-only: this control-plane resolver is its
+ * single consumer, and the connection is deliberately excluded from agent
+ * MCP config delivery, so the key never travels toward a task sandbox.
+ */
+export async function resolveElevenLabsCredentials(): Promise<
+  ElevenLabsCredentials | undefined
+> {
+  if (!areCuratedIntegrationsDisabled(Env.R_CURATED_INTEGRATIONS_DISABLED)) {
+    const connection = await db.query.mcpConnections.findFirst({
+      where: and(
+        eq(mcpConnections.mcpId, 'elevenlabs'),
+        isNull(mcpConnections.userId),
+        eq(mcpConnections.enabled, true),
+        eq(mcpConnections.authStatus, 'authenticated'),
+      ),
+    });
+
+    if (connection && isMcpConnectionElevenLabsConfig(connection.authConfig)) {
+      const enablement = await db.query.deploymentMcpEnablements.findFirst({
+        where: eq(deploymentMcpEnablements.mcpId, 'elevenlabs'),
+      });
+
+      if (enablement?.enabled !== false) {
+        const apiKey = decrypt(connection.authConfig.encryptedApiKey).trim();
+        const voiceId = connection.authConfig.voiceId.trim();
+
+        if (apiKey && voiceId) {
+          return { apiKey, voiceId };
+        }
+      }
+    }
+  }
+
+  if (Env.R_ELEVENLABS_API_KEY && Env.R_ELEVENLABS_VOICE_ID) {
+    return {
+      apiKey: Env.R_ELEVENLABS_API_KEY,
+      voiceId: Env.R_ELEVENLABS_VOICE_ID,
+    };
+  }
+
+  return undefined;
+}