MulmoClaude

v@mulmoclaude/[email protected] Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 9d LLM Frameworks

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Summary

AI summary

First release of the shared presentMulmoScript plugin for MulmoClaude and upcoming MulmoTerminal.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Requires realpath symlink‑containment guard on wire paths for hosts wiring save/update execution. Requires realpath symlink‑containment guard on wire paths for hosts wiring save/update execution. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—
Feature
Feature	Low	Adds shared presentMulmoScript plugin for MulmoClaude and future MulmoTerminal. Adds shared presentMulmoScript plugin for MulmoClaude and future MulmoTerminal. Source: llm_adapter@2026-07-17 Confidence: high	—
Feature	Low	Implements tool definition, body validators, and save/reopen/update-beat/update-script logic using gui-chat-protocol files.artifacts capability. Implements tool definition, body validators, and save/reopen/update-beat/update-script logic using gui-chat-protocol files.artifacts capability. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—
Feature	Low	Introduces storyboard View/Preview with 8‑locale i18n, host‑agnostic via useRuntime().dispatch envelopes. Introduces storyboard View/Preview with 8‑locale i18n, host‑agnostic via useRuntime().dispatch envelopes. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—
Feature	Low	Adds generation progress handling on plugin pubsub 'generation' channel with pendingGenerations snapshot for mid‑mount views. Adds generation progress handling on plugin pubsub 'generation' channel with pendingGenerations snapshot for mid‑mount views. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—
Feature	Low	Supports host‑transport capabilities (chatSessionId, authenticated fetchMediaBlob) through optional MULMOSCRIPT_HOST_ADAPTER_KEY injection. Supports host‑transport capabilities (chatSessionId, authenticated fetchMediaBlob) through optional MULMOSCRIPT_HOST_ADAPTER_KEY injection. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—
Dependency	Low	Adds peer dependencies: @mulmocast/types ^2.8.1, @mulmocast/deck-web ^1.1.1, gui-chat-protocol ^0.4.0, vue ^3.5.0. Adds peer dependencies: @mulmocast/types ^2.8.1, @mulmocast/deck-web ^1.1.1, gui-chat-protocol ^0.4.0, vue ^3.5.0. Source: llm_adapter@2026-07-17 Confidence: high	—
Refactor	Low	Defers heavy render backends (mulmocast/ffmpeg/PDF) to host side until phase 3. Defers heavy render backends (mulmocast/ffmpeg/PDF) to host side until phase 3. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—

Full changelog

First release of the shared presentMulmoScript plugin (PR #2133, phases 1+2 of the extraction plan) — MulmoScript storyboard tool for MulmoClaude and, in phase 3, MulmoTerminal.

. (server core): tool definition, body validators, and save / reopen / update-beat / update-script logic written against the generic gui-chat-protocol files.artifacts capability, with discriminated bad_request/not_found outcomes.
./vue + ./style.css: the full storyboard View / Preview with its own 8-locale i18n. The View is host-agnostic: all backend ops go through useRuntime().dispatch({ kind, … }) envelopes, generation progress arrives on the plugin pubsub generation channel (with a pendingGenerations snapshot dispatch for views mounted mid-generation), and host-transport capabilities (chatSessionId, authenticated fetchMediaBlob) ride the optional MULMOSCRIPT_HOST_ADAPTER_KEY injection.
Heavy render backends (mulmocast / ffmpeg / PDF) stay host-side until phase 3; hosts wiring the save/update executes must apply a realpath symlink-containment guard on wire paths (see plans/feat-mulmoscript-plugin.md).

Peer deps: @mulmocast/types ^2.8.1, @mulmocast/deck-web ^1.1.1, gui-chat-protocol ^0.4.0, vue ^3.5.0.

🤖 Generated with Claude Code

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track MulmoClaude

Get notified when new releases ship.

About MulmoClaude

All releases →

Related context

Related tools

Earlier breaking changes

v1.1.1 Moves Google token store to ~/.config/mulmo/google-token.json
v0.6.4 `General` role split into lean `General` and new `Personal` role; Encore seed role pinned to Personal.