mulmocast 2.16.0 → 2.18.0

package/lib/utils/render_network_policy.js

@@ -0,0 +1,85 @@
+import nodePath from "node:path";
+import { fileURLToPath } from "node:url";
+// What an HTML renderer's page may reach in strict network mode: files under the allowed roots, in-memory
+// URLs, and the CDNs our own templates load from. Kept free of I/O so the rules can be tested without a browser.
+export const RENDER_CDN_HOSTS = ["cdn.tailwindcss.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "fonts.gstatic.com"];
+// jsDelivr serves any file of any package and publishes per-version and per-file hit counts, so a page free to
+// choose the path could signal through them; only the exact files our templates load are allowed.
+export const RENDER_JSDELIVR_PATHS = [
+    "/npm/mermaid/dist/mermaid.min.js",
+    "/npm/mermaid@10/dist/mermaid.min.js",
+    "/npm/chart.js",
+    "/npm/chart.js@4",
+    "/npm/chartjs-chart-sankey",
+    "/npm/chartjs-chart-treemap@3",
+];
+const JSDELIVR_HOST = "cdn.jsdelivr.net";
+const IN_MEMORY_SCHEMES = ["data:", "blob:", "about:"];
+export const STRICT_NETWORK_ENV = "MULMO_STRICT_NETWORK";
+export const strictNetworkFromEnv = (env) => ["1", "true"].includes(env[STRICT_NETWORK_ENV] ?? "");
+const parseUrl = (url) => {
+    try {
+        return new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+};
+const filePathOf = (parsed) => {
+    try {
+        return fileURLToPath(parsed);
+    }
+    catch {
+        return undefined;
+    }
+};
+const isWithin = (root, filePath) => {
+    const relative = nodePath.relative(root, filePath);
+    return relative === "" || (!relative.startsWith("..") && !nodePath.isAbsolute(relative));
+};
+// The URL parser has already collapsed dot segments (encoded or not); the roots must already be real paths.
+const isInsideFileRoots = (parsed, realRoots, realPath) => {
+    const filePath = filePathOf(parsed);
+    const realFilePath = filePath === undefined ? undefined : realPath(filePath);
+    return realFilePath !== undefined && realRoots.some((root) => isWithin(root, realFilePath));
+};
+const identityRealPath = (filePath) => nodePath.resolve(filePath);
+const isAllowedCdnUrl = (parsed) => {
+    if (parsed.protocol !== "https:" || parsed.port !== "" || !RENDER_CDN_HOSTS.includes(parsed.hostname))
+        return false;
+    return parsed.hostname !== JSDELIVR_HOST || (parsed.search === "" && RENDER_JSDELIVR_PATHS.includes(parsed.pathname));
+};
+export const isAllowedRenderRequest = (url, realRoots = [], realPath = identityRealPath) => {
+    const parsed = parseUrl(url);
+    if (!parsed)
+        return false;
+    if (IN_MEMORY_SCHEMES.includes(parsed.protocol))
+        return true;
+    if (parsed.protocol === "file:")
+        return isInsideFileRoots(parsed, realRoots, realPath);
+    return isAllowedCdnUrl(parsed);
+};
+// A root that does not exist yet (the temp page before it is written) is its real parent plus its name.
+export const realRoot = (root, realPath) => {
+    const resolved = nodePath.resolve(root);
+    const parent = nodePath.dirname(resolved);
+    return realPath(resolved) ?? nodePath.join(realPath(parent) ?? parent, nodePath.basename(resolved));
+};
+// Popups and preconnect hints open connections outside the page's request interception, so the whole browser
+// talks through a proxy that does not exist, except for the CDNs (loopback included, which Chromium bypasses by default).
+const UNREACHABLE_PROXY = "http://127.0.0.1:1";
+export const strictNetworkLaunchArgs = () => [`--proxy-server=${UNREACHABLE_PROXY}`, `--proxy-bypass-list=${RENDER_CDN_HOSTS.join(";")};<-loopback>`];
+// A popup the page writes into gets no evaluateOnNewDocument script, so it would still have WebRTC.
+export const POPUP_BLOCK_SCRIPT = 'Object.defineProperty(globalThis, "open", { value: () => null, writable: false, configurable: false });';
+// Request interception does not see WebSocket or EventSource connections; this does.
+export const RENDER_CONTENT_SECURITY_POLICY = "connect-src 'self' data: blob:";
+const CSP_META = `<meta http-equiv="Content-Security-Policy" content="${RENDER_CONTENT_SECURITY_POLICY}">`;
+// The meta must come before anything a script could hide in, so it is never placed by searching for <head>
+// (a comment or script text can contain one): right after a leading doctype, else first. Before a doctype it
+// would switch the page to quirks mode; first otherwise, the parser still puts it in the head.
+const LEADING_DOCTYPE = /^(\uFEFF?)(\s*<!doctype[^>]*>)?/i;
+export const withRenderContentSecurityPolicy = (html) => {
+    const [prefix = "", bom = "", doctype] = LEADING_DOCTYPE.exec(html) ?? [];
+    const insertAt = doctype ? prefix.length : bom.length;
+    return [html.slice(0, insertAt), CSP_META, html.slice(insertAt)].join("");
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mulmocast",
-  "version": "2.16.0",
+  "version": "2.18.0",
   "description": "",
   "type": "module",
   "main": "lib/index.node.js",
@@ -99,7 +99,7 @@
   "homepage": "https://github.com/receptron/mulmocast-cli#readme",
   "dependencies": {
     "@google-cloud/text-to-speech": "^6.4.1",
-    "@google/genai": "^2.17.1",
+    "@google/genai": "^2.24.0",
     "@graphai/anthropic_agent": "^2.1.0",
     "@graphai/browserless_agent": "^2.0.4",
     "@graphai/gemini_agent": "^2.1.0",

package/scripts/test/test_genai.json

@@ -55,24 +55,25 @@
       "moviePrompt": "a woman takes a selfie with her phone"
     },
     {
-      "id": "genai_veo3",
-      "text": "movie generated by veo3",
+      "id": "genai_omni",
+      "text": "movie generated by gemini omni",
       "moviePrompt": "a woman is walking through a busy Tokyo street at night, she is wearing dark sunglasses",
       "movieParams": {
-        "model": "veo-3.1-lite-generate-preview"
+        "model": "gemini-omni-1.1-flash"
       }
     },
     {
-      "id": "genai_veo3_1",
-      "text": "movie generated by veo3_1",
+      "id": "genai_omni_long",
+      "text": "a twelve-second movie generated by gemini omni, extended once",
+      "duration": 12,
       "moviePrompt": "a woman is walking through a busy Tokyo street at night, she is wearing dark sunglasses",
       "movieParams": {
-        "model": "veo-3.1-generate-preview"
+        "model": "gemini-omni-1.1-flash"
       }
     },
     {
-      "id": "genai_veo3_image",
-      "text": "movie generated by veo3",
+      "id": "genai_omni_image",
+      "text": "movie generated by gemini omni from a first frame",
       "duration": 5,
       "imagePrompt": "a woman is walking through a busy Tokyo street at night, she is wearing dark sunglasses",
       "imageParams": {
@@ -80,7 +81,7 @@
       },
       "moviePrompt": "a woman is walking through a busy Tokyo street at night, she is wearing dark sunglasses",
       "movieParams": {
-        "model": "veo-3.1-lite-generate-preview"
+        "model": "gemini-omni-1.1-flash"
       }
     }
   ]

package/scripts/test/test_genai_movie.json

@@ -11,7 +11,7 @@
   "lang": "en",
   "movieParams": {
     "provider": "google",
-    "model": "veo-3.1-generate-preview"
+    "model": "gemini-omni-1.1-flash"
   },
   "beats": [
     {

package/scripts/test/test_image_references.json

@@ -15,7 +15,8 @@
   },
   "movieParams": {
     "provider": "google",
-    "model": "veo-3.1-generate-preview"
+    "model": "veo-3.1-generate-001",
+    "vertexai_project": "YOUR_PROJECT_ID"
   },
   "lang": "en",
   "beats": [
@@ -24,7 +25,7 @@
       "text": "veo-3.1 with both ASSET and STYLE reference images",
       "moviePrompt": "the woman runs through narrow alleyways, neon signs blurring in the rain",
       "movieParams": {
-        "model": "veo-3.1-generate-preview",
+        "model": "veo-3.1-generate-001",
         "referenceImages": [
           { "imageName": "character", "referenceType": "ASSET" },
           { "imageName": "black_cat", "referenceType": "ASSET" }

package/scripts/test/test_movie_references.json

@@ -5,7 +5,8 @@
   "canvasSize": { "width": 1280, "height": 720 },
   "movieParams": {
     "provider": "google",
-    "model": "veo-3.1-generate-preview"
+    "model": "veo-3.1-generate-001",
+    "vertexai_project": "YOUR_PROJECT_ID"
   },
   "imageParams": {
     "images": {

package/scripts/test/test_veo31_lite.json

@@ -5,13 +5,13 @@
   "canvasSize": { "width": 1280, "height": 720 },
   "beats": [
     {
-      "id": "google_genai_lite",
-      "text": "Google GenAI veo-3.1-lite-generate-preview text-to-video",
+      "id": "google_genai_omni",
+      "text": "Google GenAI gemini-omni-1.1-flash text-to-video",
       "duration": 4,
       "moviePrompt": "A calm ocean wave rolling onto a sandy beach at golden hour",
       "movieParams": {
         "provider": "google",
-        "model": "veo-3.1-lite-generate-preview"
+        "model": "gemini-omni-1.1-flash"
       }
     },
     {