Two engines make generated video the game state
LAST FRAME contains 2 play systems. The shot engine chains discrete 10-second clips, films three possible branches in parallel, and rolls the selected branch into view when the current clip ends. The live horror engine keeps one Director stream moving over WebRTC while text directions alter later segments.
A vision model acts as the Adjudicator for shot mode. It returns structured scene facts, narration, vitality changes, inventory events, and the next choices. Typed actions go through a Referee that labels risk and pairs a d20 threshold with success and failure prompts. The interesting design choice is visible accountability: damage carries an evidence frame, and an acquired object becomes an inventory card drawn from the shot where it appeared.
A 604 MB install produces a build, not a playable proof
Our commit da4987d install pulled 307 npm packages in 20 seconds and occupied 604 MB. The Next.js production build succeeded in 30 seconds. We did not supply a fal.ai key, create generated video, open a WebRTC stream, or judge whether consecutive shots preserve a character and setting.
The checked-out repository had 40 files, about 4,381 source lines, and a size of 13.8 MB. Most of the checkout weight comes from bundled music and screenshots, while most installed weight arrives through npm. Both fal packages use alpha-version lines, which is a practical maintenance warning for a demo built around their behavior.
What happened when we ran it
Our sandbox installed the project in 20 seconds and completed next build in 30 seconds. The install added 307 packages and used 604 MB on disk. npm audit reported 2 known vulnerabilities: 1 high and 1 moderate, with 0 critical and 0 low findings. The supplied measurement does not identify the affected packages, so the finding supports an update review rather than a guess about exploitability.
Tests were skipped because package.json has no test script or target. The commit also had 0 CI workflow files, no Dockerfile, and no tests directory. This was a fresh Node 22 container with 3 CPUs, 8 GB of RAM, no secrets, and an unprivileged user. A passing compile shows that the application can be bundled; it does not exercise billing, moderation, video continuity, or the play loop.
Three prefetched branches make every choice a spending decision
Shot mode films about 3 candidate clips for each choice while one 10-second clip plays. That hides generation delay when the user picks a ready branch, but it also pays for footage that will never be shown. Small vision calls judge the current shot and prepared branches. Typed moves can generate both success and failure possibilities, so a session's bill depends on more than the number of clips the player watches.
Live horror uses a different meter. The README says Director sessions run about 2 minutes and have a 60-second minimum charge, then estimates a couple of dollars per tape. That is the project's estimate, not a price we measured. There is no local model path or mock provider in the quick start. Budget testing therefore needs a real fal.ai account, a hard spending limit, and logs that connect each session to its generated calls.
The key stays server-side, while the proxy accepts unauthenticated calls
The 164-byte proxy route exports GET, POST, and PUT directly from @fal-ai/server-proxy/nextjs. That design keeps FAL_KEY out of browser code. It does not add an application login or specify allowed fal endpoints. In issue 1, the server prints warnings that all endpoints are allowed and requests are unauthenticated before the user's proxy calls return HTTP 403. The reporter asks whether account credit or configuration caused the rejection; the issue has no answer.
A private localhost demo has a different risk from an internet deployment. Once the route is public, a caller who can reach it may send work through the server-held account even without learning the key itself. Add authentication, restrict endpoints, rate-limit requests, and attach spend alerts before sharing a URL. A successful 30-second build cannot validate those controls because the repository does not contain them.
No license makes this source visible, not open for reuse
GitHub's license endpoint returns 404 for the repository, the API reports no detected license, and the 40-file tree contains no license file. GitHub's own licensing guidance says default copyright rules apply when a repository has no license. You may inspect and fork a public GitHub repository through the site's terms, but the code does not grant the normal permission to reproduce, modify, or distribute an open-source project.
That omission outweighs technical fit for anyone building a derivative game. You can study how the engine prefilms branches, adjudicates frames, and moves a prompt through a continuous stream. Do not copy those 4,381 lines into a product on the assumption that public source means reusable source. The author can fix this with an explicit license; until then, the safer alternative is a licensed storytelling project or your own implementation against fal-js.
September activity shows attention without a release history
The repository was created on August 31, 2026, and last pushed on September 4. GitHub showed 250 stars, 36 forks, 2 contributors, and 1 open issue when fetched on September 23. There are no GitHub releases.
LAST FRAME has a specific idea worth stealing conceptually: let generated footage decide the rules instead of treating it as decoration. The repository itself is best read, built, and tested on a private budget-capped account. Its next useful milestones are mundane ones: a license, a locked-down proxy, a clean audit, and tests for the state transitions that turn unpredictable frames into a game.