nexu-io/html-video

While reading the codebase I noticed the notes already discuss calling hyperframes render via child_process.spawn as the intended render path, but it hasn't been implemented yet. Raising this as a feature request. Benefits HTML generation via HF skills — hyperframes-animation / hyperframes-creative encode the full authoring contract (data-* attributes, single paused timeline, seek-safe constraints) and 24+ validated animation recipes. Using them directly produces output that passes hyperframes lint by construction, which a hand-rolled prompt cannot guarantee. No need to reimplement or maintain the render pipeline — the current adapter reimplements font loading, GSAP pause/seek/resume, multi-composition inlining, duration probing, and ffmpeg transcoding. Calling hyperframes render returns all of that to upstream. Is this on the roadmap? Would a PR be welcome?

Summary The current BYOK mode only supports the Anthropic Messages API (anthropic-api). I'd like to add an openai-api HTTP agent that speaks the OpenAI Chat Completions protocol (POST /v1/chat/completions), using the same kind: 'http' extension point already established by anthropic-api. This single addition covers a large surface of providers without any further changes, since most modern LLM APIs implement the OpenAI-compatible interface: OpenAI, Azure OpenAI, Groq, Together AI, Fireworks, Ollama, LM Studio, and any other OpenAI-shim provider. Motivation Many users already have an OpenAI API key and no Anthropic key. Self-hosted / local inference stacks (Ollama, LM Studio, vLLM) expose /v1/chat/completions — this would make html-video usable fully offline without a CLI agent installed. The runtime already has a clean AgentDef.httpHandler + httpProbe interface (packages/runtime/src/types.ts), so this is a contained addition with no interface changes. I'm happy to submit a PR for t

On Windows, the background music preview in Studio uses the native element. I noticed several playback issues: Total duration is not shown immediately after the audio loads. The progress bar jumps backward after pausing. The progress bar reaches the end before the music actually finishes. These make it hard to preview the soundtrack accurately.I’m willing to submit a PR to fix this by replacing the native player with a custom playback component, so we can manage currentTime, duration, and play state consistently across browsers. Environment OS: Windows 11 22H2

Running on Windows, I hit two issues with the Soundtrack feature: Audio preview fails to load (HTTP 403) — The /asset endpoint's path validation only matches forward slashes, but path.resolve() returns backslash paths on Windows, so the check always fails. Both AI-generated and manually registered audio assets can't play. Audio preview placement is hard to notice — The preview player sits at the very bottom of the Soundtrack panel, far from the "Generate music" button. It should appear directly below each generate button instead. I have fixes ready for both and would be happy to submit a PR.

Code Audit Report All findings are reviewed for confidence before posting. Please verify each finding before acting on it. Repository: nexu-io/html-video Findings: 26 issue(s) found — 🟠 6 high · 🟡 9 medium · 🔵 11 low 1. 🔒 SSRF protection bypass via IPv6 addresses Field Details Severity 🟠 High Type Security File packages/cli/src/fetch-source.ts Location assertPublicHttpUrl Confidence 92% Problem: The assertPublicHttpUrl function validates that a URL is public by checking the hostname against a list of disallowed hostnames and IPv4 private ranges. However, it does not inspect IPv6 addresses (e.g., "[::1]", "[fe80::1]") or IPv4‑mapped IPv6 addresses (e.g., "::ffff:127.0.0.1"). An attacker could supply a malicious IPv6 address that resolves to a private or loopback interface, bypassing the SSRF guard and allowing the server to fetch internal resources. Suggested Fix: Extend the validation to parse and reject IPv6 addresses that fall within loopback