Import and adapt source

Bring JSON, ZIP, raw source, or a pinned GitHub revision into the reviewed import flow.

JSON and ZIP packages enter a review screen before account installation. ZIP imports accept one build, prefer stillmade.block.json plus edited src/run.js or src/recipe.json or src/comfyui.json, and tests/fixtures.json, and reject unsafe/duplicate paths, ambiguous builds and excessive expanded source. Included development dependencies are not installed or executed by the app.

scanPackage(package) parses standalone JavaScript and screens unsupported ambient APIs/modules and dynamic constructor access. admitPackage(package, {test, run}) adds fixture tests and a sample through supplied sandbox runners. A passing scan is not proof of safety; the sandbox remains mandatory. Import confirmation repeats admission on the server and creates an owner-scoped account copy. It does not create a public release. The original license and provenance remain intact.

Raw-code adaptation accepts a purpose description, source name, source code and license/permission terms. AI creates a new SDK package; it never executes the original code. manifest.provenance.adaptedFrom records its digest, name and license and the original source text (retaining its attribution). Unsupported capabilities return an explanation or a failed editable draft, not a working-runtime claim. GitHub JSON imports retain the selected branch/tag/commit and verified Git blob identity.

GitHub repositories

Adapt a GitHub repository resolves a public branch/tag/ref to a full commit SHA. The in-app adapter selects up to six implementation, README, test, or dependency-metadata files and then retains every applicable ancestor LICENSE/COPYING/NOTICE file, up to sixteen regular UTF-8 files and 45 KB combined. Inspectable source includes JavaScript/TypeScript, Svelte/Vue, HTML/CSS, SVG, GLSL/WGSL, Python, Rust, Go, shell, and common C/C++/Qt text files. These files remain untrusted evidence: StillMade does not install dependencies or execute the repository. A recognized native application may instead produce an independently authored desktop-only Block using a versioned, allowlisted host adapter. The Block still has no shell, arbitrary executable, unrestricted filesystem, Qt/OpenFX plugin, or dependency-install authority. Unrecognized native repositories remain source evidence only and do not become Blocks merely because they are public. The app reads a complete bounded Git tree, excludes symlinks, submodules and unsupported/secret paths, and verifies each blob against its Git SHA-1 identity. Review the original code and applicable license before requesting adaptation. No repository dependencies, hooks, scripts, or original source are executed.

The adaptation request refetches the same commit and selected blobs. An LLM rewrites the relevant behavior into supported SDK recipes/isolated JavaScript; unavailable capabilities remain unsupported. manifest.provenance.adaptedFrom retains the original selected source, license, source digest, and origin with repository, commit and per-file blob digests. This metadata records origin, not verification of legal rights or authorship. The final package still requires normal import admission and user confirmation. Importing does not publish third-party source.

The approved Natron route pins the requested GitHub commit without copying or executing its GPL application source, generates an MIT SDK integration Block, and declares one video input and output for Project Type composition. Its desktop adapter can import/open a .ntp project and render an authorized local video through fixed Reader/Writer node names and a bounded frame range. It does not expose Natron's Python/interpreter flags. Private repositories, arbitrary large native codebases, dependency installation and Python/ComfyUI execution remain outside this adaptation runtime. Public GitHub API rate limits apply; downloaded SDK packages and pasted-source adaptation remain available alternatives.