@mulmoclaude/core 4.7.0 → 4.9.0

package/assets/helps/custom-view.md

@@ -64,7 +64,7 @@ would run ahead of it and see no `__MC_VIEW`; there is no reason to write one.)
 window.__MC_VIEW = {
   slug: "annual-plan", // this collection
   token: "<scoped capability token>", // Authorization bearer
-  dataUrl: "http://localhost:3001/api/collections/annual-plan/view-data",
+  dataUrl: "http://127.0.0.1:<port>/api/collections/annual-plan/view-data", // absolute, filled in by the host
   onChange: (cb) => unsubscribe, // live refresh — see "Staying live" below
   searchQuery: "", // live text in the app's own search box — see "One search box"
   onSearchQueryChange: (cb) => unsubscribe, // fires when the user types there

package/assets/helps/error-recovery.md

@@ -1296,3 +1296,127 @@ Deleting a shared collection is refused outright: the delete can neither archive
 nor remove documents that other members also read, and removing its records
 first does not unlock it. Retiring the whole app is a Firestore project
 administrator's recursive delete, not something this app does.
+
+## A messaging bridge's bot does not reply, and nothing errors
+
+### Symptoms
+
+The user talks to the bot on Telegram / Slack / LINE / Discord / …, and nothing
+comes back. No error in the server log, none from the bridge. Sending again does
+nothing either.
+
+### First, do NOT say "restart the bridge"
+
+That advice is out of date. Since #3078 the shared client re-reads the token and
+the port after **every failed connection** and rebuilds its socket when the
+server has come back as a different generation. A server restart — new token,
+new port, or both — is handled without touching the bridge.
+
+### The bridge tells you where it went — start there
+
+Every bridge prints its target as it starts — the shared client emits it, so
+this holds for all of them, not only the ones with a banner:
+
+```text
+Connecting to http://127.0.0.1:3099
+```
+
+It prints again each time the bridge follows the server to a new address, so a
+bridge that has outlived a restart has several. **Compare the last one** — the
+earlier lines are where it used to be. Against what the server published:
+
+```bash
+cat "${MULMOCLAUDE_WORKSPACE_PATH:-$HOME/mulmoclaude}/.server-port"
+```
+
+- **They agree** → the address is right; the problem is further in (see below).
+- **They disagree**, and the bridge says `http://localhost:3001` → that bridge
+  is an npm build from before the port-following fix. Reinstall it
+  (`npm i -g @mulmobridge/<platform>@latest`, or `npx @mulmobridge/<platform>@latest`).
+  Check the banner rather than a version number: the banner is the behaviour,
+  and a version is one more thing to keep current.
+
+### `The server has not published a port yet` is waiting, not failing
+
+```text
+The server has not published a port yet — waiting for it rather than guessing.
+```
+
+The server writes `.session-token` before it binds its port, and sandbox setup
+sits in between — a cold start that builds the Docker image can hold there for
+minutes. The bridge deliberately refuses to guess `localhost:3001` while holding
+a freshly minted token, and joins on its own once the port appears. Wait, or
+check that the server is actually starting.
+
+### A bridge that cannot see the workspace needs both variables
+
+Running on another machine, or in a container without the workspace mounted,
+means no `.server-port` and no `.session-token`. Such a bridge needs BOTH:
+
+```bash
+MULMOCLAUDE_API_URL=http://127.0.0.1:<port> \
+MULMOCLAUDE_AUTH_TOKEN=<the same value the server was given> \
+  npx @mulmobridge/<platform>
+```
+
+Two things make this narrower than it looks:
+
+- **The server binds the IPv4 loopback only** (`app.listen(port, "127.0.0.1")`),
+  so a bridge on another machine cannot reach it by naming the host. It needs a
+  tunnel — an SSH port-forward is the usual one — and then
+  `MULMOCLAUDE_API_URL` points at the LOCAL end of that tunnel, which is why the
+  recipe above still says `127.0.0.1`. Do not "fix" this by making the server
+  listen on `0.0.0.0`: there is no TLS on that port, and the bearer token would
+  cross the network in the clear.
+- **`MULMOCLAUDE_AUTH_TOKEN` must be set on the SERVER too**, or it regenerates a
+  new token on every start and the pinned one stops matching.
+
+In a container on the same host, `MULMOCLAUDE_HOST=host.docker.internal` is how
+the sandbox's own hooks reach the parent server; a bridge there needs the same
+treatment, and the workspace mounted if you want it to follow the port.
+
+### Only then, the platform side
+
+- The chat ID is not on the bridge's allowlist — the bot answers
+  `"Access denied"` to a stranger, but an allowlist typo simply drops the
+  message.
+- The platform token (bot token, app token) was revoked or regenerated.
+- The bridge process is not running at all. Check before assuming anything above.
+
+### What to collect if none of it explains the silence
+
+The bridge's first three lines (they name the transport and the resolved URL),
+the server's `[server] listening port=…` line, and whether
+`<workspace>/.server-port` exists. Those three answer "which server, on which
+port, and did the bridge agree" — which is what every one of these turns out to
+be.
+
+## `renderShapeScript` says Chromium is not installed
+
+`renderShapeScript` rasterises a ShapeScript model by driving Puppeteer's
+headless Chromium — the same browser the PDF export uses. Puppeteer downloads
+it at install time, so this normally just works; a host that set
+`PUPPETEER_SKIP_DOWNLOAD`, or a sandbox that cannot spawn a browser, has none.
+The tool then returns, instead of an image path:
+
+```
+renderShapeScript needs Puppeteer's headless Chromium, which this host does
+not have. Run `npx puppeteer browsers install chrome`, then retry.
+```
+
+What to do:
+
+1. Tell the user the one command above.
+2. Do NOT retry the call — nothing about the model changed, so the
+   second attempt fails identically.
+3. Carry on with `presentShapeScript`, which needs no browser: it
+   validates the geometry headlessly and shows the model to the user
+   in the chat canvas. The only thing you lose is your own ability to
+   LOOK at the render before presenting it, so be more conservative
+   about complex geometry and describe what you built rather than
+   claiming you verified its appearance.
+
+The same message with `(launch failed: …)` appended means the browser is
+installed but would not start — usually a sandbox with no permission to
+spawn it. Report the parenthesised reason to the user rather than the
+install hint alone.

package/assets/helps/index.md

@@ -67,7 +67,7 @@ See [Wiki](config/helps/wiki.md) for details on how it works.
 - [Spreadsheet](config/helps/spreadsheet.md) — cell format, formulas, date handling, and format codes for the presentSpreadsheet plugin
 - [presentHtml](config/helps/presenthtml.md) — self-contained HTML rules and the three-`../` relative-path convention used by the presentHtml plugin to keep generated files portable under `file://`
 - [Sandbox](config/helps/sandbox.md) — how the Docker sandbox isolates the agent, what it can access, and how to disable it
-- [Error recovery](config/helps/error-recovery.md) — the lookup the agent reads on tool failures (gh/git/SSH in the sandbox, Marp PDF, registry import, build/workspace, plugin runtime), plus the four-step triage for when a user reports something broken
+- [Error recovery](config/helps/error-recovery.md) — the lookup the agent reads on tool failures (sandbox gh/git/SSH, Marp PDF, registry import, build/workspace, plugin runtime, a bridge gone quiet), plus the triage for a “broken” report
 - [Bug-report FAQ](config/helps/bug-report-faq.md) — symptoms that turn out to be configuration or by design (voice input, push, chat titles, journal, connector tools, preset skills, custom views); says where to read the live value, never what it is
 - [Telegram Bridge](config/helps/telegram.md) — how to talk to MulmoClaude from the Telegram app: creating a bot, starting the bridge, allowlisting chat IDs, commands, and troubleshooting
 - [Remote host](config/helps/remote-host.md) — drive MulmoClaude from a phone at mulmoserver.web.app: Google sign-in connect, host online vs. offline (queued chats, 7-day expiry), photo attachments, and the security model

package/assets/helps/telegram.md

@@ -7,7 +7,7 @@ This is useful when you want to reach your MulmoClaude away from your computer
 ## How It Works
 
 - You create a **bot** with Telegram's BotFather; it gives you a token.
-- You run a **bridge process** (`yarn telegram`) on the same machine as the MulmoClaude server. The bridge uses your bot token to receive messages from Telegram, forwards them to MulmoClaude over `localhost:3001`, and sends the replies back to the Telegram user.
+- You run a **bridge process** (`yarn telegram`) on the same machine as the MulmoClaude server. The bridge uses your bot token to receive messages from Telegram, forwards them to MulmoClaude over the loopback port the server actually bound, and sends the replies back to the Telegram user. It finds that port itself, and follows it when the server restarts.
 - A short **allowlist** of Telegram chat IDs controls who can talk to the bot. Everyone else gets `"Access denied"`.
 
 Your computer has to be on and connected to the internet for the bot to respond. Close the laptop → the bot goes silent.
@@ -41,7 +41,7 @@ In terminal A, start MulmoClaude:
 yarn dev
 ```
 
-Wait until you see `[server] listening port=3001`.
+Wait until you see `[server] listening port=…`. The number is whatever the server bound: it honours `PORT`, and an implicit default that is already busy walks forward. You do not need to note it — the bridge reads it from the workspace.
 
 In terminal B, start the bridge. Leave the allowlist **empty on purpose** for the first run — you will need to discover your own chat ID before you can add it.
 
@@ -56,9 +56,15 @@ Expected output:
 ```
 MulmoClaude Telegram bridge
 Allowlist: (empty — all chats will be denied)
+Connecting to http://127.0.0.1:<port>
 Connected (<socket id>).
 ```
 
+That third line is the bridge telling you which server it found. If it ever says
+`http://localhost:3001` while `.server-port` says something else, that bridge is
+an old build — see "a messaging bridge's bot does not reply" in the error
+recovery help.
+
 ## Step 3 — Find Your Chat ID and Allowlist It
 
 1. In Telegram, open your new bot (search the username you picked) and send it any message — `hi` works.
@@ -114,7 +120,7 @@ Any other text is treated as a message to the assistant.
 
 ## Troubleshooting
 
-**`Connect error: bearer token rejected`** — MulmoClaude was restarted, so its bearer token changed. Restart `yarn telegram` to pick up the new one. To avoid this, pin `MULMOCLAUDE_AUTH_TOKEN` to the same value on both sides (see `docs/developer.md` §Auth).
+**`Connect error: bearer token rejected`** — MulmoClaude restarted and its bearer token changed. **Do not restart the bridge**: it re-reads the token and the port after a failed connection and reconnects on its own, usually within a second or two. If it is still saying this after that, the server has not finished starting (it writes the token before it binds its port, and a cold start builds the sandbox image in between) — wait for `[server] listening port=…`. Pinning `MULMOCLAUDE_AUTH_TOKEN` on both sides is for a bridge that cannot read the workspace at all, not for this.
 
 **`TELEGRAM_ALLOWED_CHAT_IDS: "foo" is not an integer chat id`** — typo in the allowlist. Chat IDs are plain integers only — no spaces, quotes, or `#` prefix. Negative integers (for group chats) are allowed.
 
@@ -129,7 +135,7 @@ Any other text is treated as a message to the assistant.
 - The bot token is a password. If it leaks, regenerate it via BotFather's `/revoke`.
 - The allowlist is the only thing standing between "my friends" and "every Telegram user on Earth". Keep it current — remove chat IDs when you no longer want that person to have access, and restart the bridge.
 - The bridge logs chat IDs, usernames, and message lengths, but **not** message contents or the bot token. If you need a full audit trail, record it separately.
-- The MulmoClaude bearer token never leaves your machine. The bridge only talks to `localhost:3001`; your friends talk to Telegram's servers, which then talk to your bridge.
+- The MulmoClaude bearer token never leaves your machine. The bridge only ever talks to the IPv4 loopback (`127.0.0.1`), whatever port the server bound; your friends talk to Telegram's servers, which then talk to your bridge.
 
 ## Full Operator Guide
 

package/dist/artifacts/paths.cjs

@@ -30,14 +30,20 @@ function yearMonthUtc(now = /* @__PURE__ */ new Date()) {
 	return `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
 }
 /**
-* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs><ext>`. The
-* `<epochMs>` suffix keeps freshly-built filenames collision-free without a
-* random component. This is what `files.artifacts.write` takes; prefix it with
+* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
+* This is what `files.artifacts.write` takes; prefix it with
 * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
+*
+* `<epochMs>` alone separates paths built at different times, but NOT two calls
+* with the same title inside one millisecond — those produce the same name, and
+* the second write silently replaces the first artifact. Pass `suffix` (a short
+* random token, as `shapeArtifactPath` does) wherever concurrent callers can
+* share a title.
 */
 function buildArtifactRelPath(params) {
-	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true } = params;
-	const fileName = `${slugifyArtifact(title, fallback)}-${now.getTime()}${ext}`;
+	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true, suffix } = params;
+	const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;
+	const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;
 	return (partitioned ? [
 		dir,
 		yearMonthUtc(now),
@@ -49,13 +55,19 @@ function toWorkspaceArtifactPath(relPath) {
 	return `${ARTIFACTS_ROOT}/${relPath}`;
 }
 /**
-* True when any `/`-segment of `value` is empty (`//`, leading/trailing slash),
-* `.`, or `..`. The lexical traversal / non-canonical guard every artifact path
-* check shares — equivalent to `path.posix.normalize(v) === v && !v.includes("..")`
-* — so a workspace-escape judgement can't drift between plugins.
+* True when any `/` or `\`-separated segment of `value` is empty (`//`,
+* leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
+* guard every artifact path check shares — so a workspace-escape judgement
+* can't drift between plugins.
+*
+* Both separators, matching `classifyFilePath`: an artifact path is minted from
+* a slug and so never contains a backslash, while `node:path` on Windows treats
+* one as a separator. Splitting on `/` alone accepted
+* `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
+* to `path.join` (codex on #3056).
 */
 function hasUnsafePathSegment(value) {
-	return value.split("/").some((seg) => seg === "" || seg === "." || seg === "..");
+	return value.split(/[/\\]/).some((seg) => seg === "" || seg === "." || seg === "..");
 }
 var WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
 /** True when `value` names a location that does not depend on a base directory.

package/dist/artifacts/paths.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"paths.cjs","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs><ext>`. The\n * `<epochMs>` suffix keeps freshly-built filenames collision-free without a\n * random component. This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true } = params;\n  const fileName = `${slugifyArtifact(title, fallback)}-${now.getTime()}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/`-segment of `value` is empty (`//`, leading/trailing slash),\n * `.`, or `..`. The lexical traversal / non-canonical guard every artifact path\n * check shares — equivalent to `path.posix.normalize(v) === v && !v.includes(\"..\")`\n * — so a workspace-escape judgement can't drift between plugins.\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(\"/\").some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;AAsBA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,SAAS;CAC5E,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,IAAI,QAAQ,IAAI;CAExE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACjF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}
+{"version":3,"file":"paths.cjs","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n  /** Extra token appended after the timestamp, for callers that cannot accept a\n   *  same-millisecond collision (see the note on `buildArtifactRelPath`). */\n  suffix?: string;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.\n * This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n *\n * `<epochMs>` alone separates paths built at different times, but NOT two calls\n * with the same title inside one millisecond — those produce the same name, and\n * the second write silently replaces the first artifact. Pass `suffix` (a short\n * random token, as `shapeArtifactPath` does) wherever concurrent callers can\n * share a title.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true, suffix } = params;\n  const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;\n  const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/` or `\\`-separated segment of `value` is empty (`//`,\n * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical\n * guard every artifact path check shares — so a workspace-escape judgement\n * can't drift between plugins.\n *\n * Both separators, matching `classifyFilePath`: an artifact path is minted from\n * a slug and so never contains a backslash, while `node:path` on Windows treats\n * one as a separator. Splitting on `/` alone accepted\n * `artifacts/shapes/..\\..\\secrets.shape` — canonical to this check, traversal\n * to `path.join` (codex on #3056).\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;;;;;;AA8BA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,MAAM,WAAW;CACpF,MAAM,QAAQ,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,QAAQ;CACrE,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,QAAQ;CAEhE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACrF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}

package/dist/artifacts/paths.d.ts

@@ -26,21 +26,35 @@ export interface ArtifactRelPathParams {
     now?: Date;
     /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */
     partitioned?: boolean;
+    /** Extra token appended after the timestamp, for callers that cannot accept a
+     *  same-millisecond collision (see the note on `buildArtifactRelPath`). */
+    suffix?: string;
 }
 /**
- * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs><ext>`. The
- * `<epochMs>` suffix keeps freshly-built filenames collision-free without a
- * random component. This is what `files.artifacts.write` takes; prefix it with
+ * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
+ * This is what `files.artifacts.write` takes; prefix it with
  * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
+ *
+ * `<epochMs>` alone separates paths built at different times, but NOT two calls
+ * with the same title inside one millisecond — those produce the same name, and
+ * the second write silently replaces the first artifact. Pass `suffix` (a short
+ * random token, as `shapeArtifactPath` does) wherever concurrent callers can
+ * share a title.
  */
 export declare function buildArtifactRelPath(params: ArtifactRelPathParams): string;
 /** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
 export declare function toWorkspaceArtifactPath(relPath: string): string;
 /**
- * True when any `/`-segment of `value` is empty (`//`, leading/trailing slash),
- * `.`, or `..`. The lexical traversal / non-canonical guard every artifact path
- * check shares — equivalent to `path.posix.normalize(v) === v && !v.includes("..")`
- * — so a workspace-escape judgement can't drift between plugins.
+ * True when any `/` or `\`-separated segment of `value` is empty (`//`,
+ * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
+ * guard every artifact path check shares — so a workspace-escape judgement
+ * can't drift between plugins.
+ *
+ * Both separators, matching `classifyFilePath`: an artifact path is minted from
+ * a slug and so never contains a backslash, while `node:path` on Windows treats
+ * one as a separator. Splitting on `/` alone accepted
+ * `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
+ * to `path.join` (codex on #3056).
  */
 export declare function hasUnsafePathSegment(value: string): boolean;
 /** How a caller-supplied file path must be resolved. `null` = not a usable path. */

package/dist/artifacts/paths.js

@@ -29,14 +29,20 @@ function yearMonthUtc(now = /* @__PURE__ */ new Date()) {
 	return `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
 }
 /**
-* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs><ext>`. The
-* `<epochMs>` suffix keeps freshly-built filenames collision-free without a
-* random component. This is what `files.artifacts.write` takes; prefix it with
+* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
+* This is what `files.artifacts.write` takes; prefix it with
 * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
+*
+* `<epochMs>` alone separates paths built at different times, but NOT two calls
+* with the same title inside one millisecond — those produce the same name, and
+* the second write silently replaces the first artifact. Pass `suffix` (a short
+* random token, as `shapeArtifactPath` does) wherever concurrent callers can
+* share a title.
 */
 function buildArtifactRelPath(params) {
-	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true } = params;
-	const fileName = `${slugifyArtifact(title, fallback)}-${now.getTime()}${ext}`;
+	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true, suffix } = params;
+	const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;
+	const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;
 	return (partitioned ? [
 		dir,
 		yearMonthUtc(now),
@@ -48,13 +54,19 @@ function toWorkspaceArtifactPath(relPath) {
 	return `${ARTIFACTS_ROOT}/${relPath}`;
 }
 /**
-* True when any `/`-segment of `value` is empty (`//`, leading/trailing slash),
-* `.`, or `..`. The lexical traversal / non-canonical guard every artifact path
-* check shares — equivalent to `path.posix.normalize(v) === v && !v.includes("..")`
-* — so a workspace-escape judgement can't drift between plugins.
+* True when any `/` or `\`-separated segment of `value` is empty (`//`,
+* leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
+* guard every artifact path check shares — so a workspace-escape judgement
+* can't drift between plugins.
+*
+* Both separators, matching `classifyFilePath`: an artifact path is minted from
+* a slug and so never contains a backslash, while `node:path` on Windows treats
+* one as a separator. Splitting on `/` alone accepted
+* `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
+* to `path.join` (codex on #3056).
 */
 function hasUnsafePathSegment(value) {
-	return value.split("/").some((seg) => seg === "" || seg === "." || seg === "..");
+	return value.split(/[/\\]/).some((seg) => seg === "" || seg === "." || seg === "..");
 }
 var WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
 /** True when `value` names a location that does not depend on a base directory.

package/dist/artifacts/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs><ext>`. The\n * `<epochMs>` suffix keeps freshly-built filenames collision-free without a\n * random component. This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true } = params;\n  const fileName = `${slugifyArtifact(title, fallback)}-${now.getTime()}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/`-segment of `value` is empty (`//`, leading/trailing slash),\n * `.`, or `..`. The lexical traversal / non-canonical guard every artifact path\n * check shares — equivalent to `path.posix.normalize(v) === v && !v.includes(\"..\")`\n * — so a workspace-escape judgement can't drift between plugins.\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(\"/\").some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;AAsBA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,SAAS;CAC5E,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,IAAI,QAAQ,IAAI;CAExE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;AAQA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACjF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}
+{"version":3,"file":"paths.js","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n  /** Extra token appended after the timestamp, for callers that cannot accept a\n   *  same-millisecond collision (see the note on `buildArtifactRelPath`). */\n  suffix?: string;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.\n * This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n *\n * `<epochMs>` alone separates paths built at different times, but NOT two calls\n * with the same title inside one millisecond — those produce the same name, and\n * the second write silently replaces the first artifact. Pass `suffix` (a short\n * random token, as `shapeArtifactPath` does) wherever concurrent callers can\n * share a title.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true, suffix } = params;\n  const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;\n  const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/` or `\\`-separated segment of `value` is empty (`//`,\n * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical\n * guard every artifact path check shares — so a workspace-escape judgement\n * can't drift between plugins.\n *\n * Both separators, matching `classifyFilePath`: an artifact path is minted from\n * a slug and so never contains a backslash, while `node:path` on Windows treats\n * one as a separator. Splitting on `/` alone accepted\n * `artifacts/shapes/..\\..\\secrets.shape` — canonical to this check, traversal\n * to `path.join` (codex on #3056).\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;;;;;;AA8BA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,MAAM,WAAW;CACpF,MAAM,QAAQ,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,QAAQ;CACrE,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,QAAQ;CAEhE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACrF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}

package/dist/plugin-vue/index.cjs

@@ -138,7 +138,7 @@ IconGlyph.props = {
 };
 //#endregion
 //#region ../../node_modules/dompurify/dist/purify.es.mjs
-/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */
+/*! @license DOMPurify 3.4.15 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.15/LICENSE */
 function _arrayLikeToArray(r, a) {
 	(null == a || a > r.length) && (a = r.length);
 	for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
@@ -1133,7 +1133,7 @@ var _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallback)
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.14";
+	DOMPurify.version = "3.4.15";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -1150,6 +1150,7 @@ function createDOMPurify() {
 	const ElementPrototype = Element.prototype;
 	const cloneNode = lookupGetter(ElementPrototype, "cloneNode");
 	const remove = lookupGetter(ElementPrototype, "remove");
+	const removeAttributeNode = lookupGetter(ElementPrototype, "removeAttributeNode");
 	const getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
 	const getChildNodes = lookupGetter(ElementPrototype, "childNodes");
 	const getParentNode = lookupGetter(ElementPrototype, "parentNode");
@@ -1604,7 +1605,7 @@ function createDOMPurify() {
 	*/
 	const _stripAttributeNode = function _stripAttributeNode(element, attribute, name) {
 		try {
-			element.removeAttributeNode(attribute);
+			removeAttributeNode(element, attribute);
 		} catch (_) {
 			try {
 				element.removeAttribute(name);
@@ -1677,7 +1678,7 @@ function createDOMPurify() {
 			from: element
 		});
 		try {
-			if (attr) element.removeAttributeNode(attr);
+			if (attr) removeAttributeNode(element, attr);
 			else element.removeAttribute(name);
 		} catch (_) {
 			try {
@@ -1923,7 +1924,7 @@ function createDOMPurify() {
 		const realTagName = getNodeName ? getNodeName(element) : null;
 		if (typeof realTagName !== "string") return false;
 		if (transformCaseFunc(realTagName) !== "form") return false;
-		return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || element.nodeType !== getNodeType(element) || element.childNodes !== getChildNodes(element);
+		return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.removeAttributeNode !== "function" || typeof element.getAttributeNode !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || element.nodeType !== getNodeType(element) || element.childNodes !== getChildNodes(element);
 	};
 	/**
 	* Checks whether the given value is a DocumentFragment from any realm.
@@ -2208,24 +2209,38 @@ function createDOMPurify() {
 	/**
 	* Write a modified attribute value back onto the element. On
 	* success, re-probe for clobbering introduced by the new value and
-	* remove the element when found; otherwise pop the removal entry
-	* recorded by the earlier _removeAttribute (long-standing pairing
-	* with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+	* remove the element when found; otherwise, when this writeback is the
+	* recreate half of the SANITIZE_NAMED_PROPS remove-and-recreate, pop the
+	* removal entry that path recorded so it does not show as removed. On
 	* failure, remove the attribute instead.
 	*
+	* Returns true only on a clean write (the value was set and the new value
+	* introduced no clobbering). The caller uses that, together with its own
+	* knowledge of whether this attribute pushed a DOMPurify.removed record, to
+	* decide whether to pop that record. The pop must happen ONLY for the
+	* named-prop remove-and-recreate; popping on any other value change (trim,
+	* template scrubbing, Trusted Types) would consume an unrelated _forceRemove
+	* subtree-cleanup record and let that detached subtree keep a live event
+	* handler through the IN_PLACE neutralization pass (SO-001).
+	*
 	* @param currentNode the element carrying the attribute
 	* @param name the attribute name as present on the element
 	* @param namespaceURI the attribute's namespace, if any
 	* @param value the new attribute value
+	* @return true if the value was written without introducing clobbering
 	*/
 	const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
 		try {
 			if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
 			else currentNode.setAttribute(name, value);
-			if (_isClobbered(currentNode)) _forceRemove(currentNode);
-			else arrayPop(DOMPurify.removed);
+			if (_isClobbered(currentNode)) {
+				_forceRemove(currentNode);
+				return false;
+			}
+			return true;
 		} catch (_) {
 			_removeAttribute(name, currentNode);
+			return false;
 		}
 	};
 	/**
@@ -2258,6 +2273,7 @@ function createDOMPurify() {
 			const lcName = transformCaseFunc(name);
 			const initValue = attrValue;
 			let value = name === "value" ? initValue : stringTrim(initValue);
+			let recreatedNamedProp = false;
 			hookEvent.attrName = lcName;
 			hookEvent.attrValue = value;
 			hookEvent.keepAttr = true;
@@ -2267,6 +2283,7 @@ function createDOMPurify() {
 			if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
 				_removeAttribute(name, currentNode, attr);
 				value = SANITIZE_NAMED_PROPS_PREFIX + value;
+				recreatedNamedProp = true;
 			}
 			if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
 				_removeAttribute(name, currentNode, attr);
@@ -2291,7 +2308,9 @@ function createDOMPurify() {
 				continue;
 			}
 			value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
-			if (value !== initValue) _setAttributeValue(currentNode, name, namespaceURI, value);
+			if (value !== initValue) {
+				if (_setAttributeValue(currentNode, name, namespaceURI, value) && recreatedNamedProp) arrayPop(DOMPurify.removed);
+			}
 		}
 		_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
 	};
@@ -2425,7 +2444,7 @@ function createDOMPurify() {
 			if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") body = importedNode;
 			else if (importedNode.nodeName === "HTML") body = importedNode;
 			else body.appendChild(importedNode);
-			_sanitizeAttachedShadowRoots(importedNode);
+			_sanitizeAttachedShadowRoots(body);
 		} else {
 			if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && dirty.indexOf("<") === -1) return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty;
 			body = _initDocument(dirty);