@mulmoclaude/core 4.8.0 → 4.9.0

package/assets/helps/custom-view.md

@@ -64,7 +64,7 @@ would run ahead of it and see no `__MC_VIEW`; there is no reason to write one.)
 window.__MC_VIEW = {
   slug: "annual-plan", // this collection
   token: "<scoped capability token>", // Authorization bearer
-  dataUrl: "http://localhost:3001/api/collections/annual-plan/view-data",
+  dataUrl: "http://127.0.0.1:<port>/api/collections/annual-plan/view-data", // absolute, filled in by the host
   onChange: (cb) => unsubscribe, // live refresh — see "Staying live" below
   searchQuery: "", // live text in the app's own search box — see "One search box"
   onSearchQueryChange: (cb) => unsubscribe, // fires when the user types there

package/assets/helps/error-recovery.md

@@ -1297,6 +1297,100 @@ nor remove documents that other members also read, and removing its records
 first does not unlock it. Retiring the whole app is a Firestore project
 administrator's recursive delete, not something this app does.
 
+## A messaging bridge's bot does not reply, and nothing errors
+
+### Symptoms
+
+The user talks to the bot on Telegram / Slack / LINE / Discord / …, and nothing
+comes back. No error in the server log, none from the bridge. Sending again does
+nothing either.
+
+### First, do NOT say "restart the bridge"
+
+That advice is out of date. Since #3078 the shared client re-reads the token and
+the port after **every failed connection** and rebuilds its socket when the
+server has come back as a different generation. A server restart — new token,
+new port, or both — is handled without touching the bridge.
+
+### The bridge tells you where it went — start there
+
+Every bridge prints its target as it starts — the shared client emits it, so
+this holds for all of them, not only the ones with a banner:
+
+```text
+Connecting to http://127.0.0.1:3099
+```
+
+It prints again each time the bridge follows the server to a new address, so a
+bridge that has outlived a restart has several. **Compare the last one** — the
+earlier lines are where it used to be. Against what the server published:
+
+```bash
+cat "${MULMOCLAUDE_WORKSPACE_PATH:-$HOME/mulmoclaude}/.server-port"
+```
+
+- **They agree** → the address is right; the problem is further in (see below).
+- **They disagree**, and the bridge says `http://localhost:3001` → that bridge
+  is an npm build from before the port-following fix. Reinstall it
+  (`npm i -g @mulmobridge/<platform>@latest`, or `npx @mulmobridge/<platform>@latest`).
+  Check the banner rather than a version number: the banner is the behaviour,
+  and a version is one more thing to keep current.
+
+### `The server has not published a port yet` is waiting, not failing
+
+```text
+The server has not published a port yet — waiting for it rather than guessing.
+```
+
+The server writes `.session-token` before it binds its port, and sandbox setup
+sits in between — a cold start that builds the Docker image can hold there for
+minutes. The bridge deliberately refuses to guess `localhost:3001` while holding
+a freshly minted token, and joins on its own once the port appears. Wait, or
+check that the server is actually starting.
+
+### A bridge that cannot see the workspace needs both variables
+
+Running on another machine, or in a container without the workspace mounted,
+means no `.server-port` and no `.session-token`. Such a bridge needs BOTH:
+
+```bash
+MULMOCLAUDE_API_URL=http://127.0.0.1:<port> \
+MULMOCLAUDE_AUTH_TOKEN=<the same value the server was given> \
+  npx @mulmobridge/<platform>
+```
+
+Two things make this narrower than it looks:
+
+- **The server binds the IPv4 loopback only** (`app.listen(port, "127.0.0.1")`),
+  so a bridge on another machine cannot reach it by naming the host. It needs a
+  tunnel — an SSH port-forward is the usual one — and then
+  `MULMOCLAUDE_API_URL` points at the LOCAL end of that tunnel, which is why the
+  recipe above still says `127.0.0.1`. Do not "fix" this by making the server
+  listen on `0.0.0.0`: there is no TLS on that port, and the bearer token would
+  cross the network in the clear.
+- **`MULMOCLAUDE_AUTH_TOKEN` must be set on the SERVER too**, or it regenerates a
+  new token on every start and the pinned one stops matching.
+
+In a container on the same host, `MULMOCLAUDE_HOST=host.docker.internal` is how
+the sandbox's own hooks reach the parent server; a bridge there needs the same
+treatment, and the workspace mounted if you want it to follow the port.
+
+### Only then, the platform side
+
+- The chat ID is not on the bridge's allowlist — the bot answers
+  `"Access denied"` to a stranger, but an allowlist typo simply drops the
+  message.
+- The platform token (bot token, app token) was revoked or regenerated.
+- The bridge process is not running at all. Check before assuming anything above.
+
+### What to collect if none of it explains the silence
+
+The bridge's first three lines (they name the transport and the resolved URL),
+the server's `[server] listening port=…` line, and whether
+`<workspace>/.server-port` exists. Those three answer "which server, on which
+port, and did the bridge agree" — which is what every one of these turns out to
+be.
+
 ## `renderShapeScript` says Chromium is not installed
 
 `renderShapeScript` rasterises a ShapeScript model by driving Puppeteer's

package/assets/helps/index.md

@@ -67,7 +67,7 @@ See [Wiki](config/helps/wiki.md) for details on how it works.
 - [Spreadsheet](config/helps/spreadsheet.md) — cell format, formulas, date handling, and format codes for the presentSpreadsheet plugin
 - [presentHtml](config/helps/presenthtml.md) — self-contained HTML rules and the three-`../` relative-path convention used by the presentHtml plugin to keep generated files portable under `file://`
 - [Sandbox](config/helps/sandbox.md) — how the Docker sandbox isolates the agent, what it can access, and how to disable it
-- [Error recovery](config/helps/error-recovery.md) — the lookup the agent reads on tool failures (gh/git/SSH in the sandbox, Marp PDF, registry import, build/workspace, plugin runtime), plus the four-step triage for when a user reports something broken
+- [Error recovery](config/helps/error-recovery.md) — the lookup the agent reads on tool failures (sandbox gh/git/SSH, Marp PDF, registry import, build/workspace, plugin runtime, a bridge gone quiet), plus the triage for a “broken” report
 - [Bug-report FAQ](config/helps/bug-report-faq.md) — symptoms that turn out to be configuration or by design (voice input, push, chat titles, journal, connector tools, preset skills, custom views); says where to read the live value, never what it is
 - [Telegram Bridge](config/helps/telegram.md) — how to talk to MulmoClaude from the Telegram app: creating a bot, starting the bridge, allowlisting chat IDs, commands, and troubleshooting
 - [Remote host](config/helps/remote-host.md) — drive MulmoClaude from a phone at mulmoserver.web.app: Google sign-in connect, host online vs. offline (queued chats, 7-day expiry), photo attachments, and the security model

package/assets/helps/telegram.md

@@ -7,7 +7,7 @@ This is useful when you want to reach your MulmoClaude away from your computer
 ## How It Works
 
 - You create a **bot** with Telegram's BotFather; it gives you a token.
-- You run a **bridge process** (`yarn telegram`) on the same machine as the MulmoClaude server. The bridge uses your bot token to receive messages from Telegram, forwards them to MulmoClaude over `localhost:3001`, and sends the replies back to the Telegram user.
+- You run a **bridge process** (`yarn telegram`) on the same machine as the MulmoClaude server. The bridge uses your bot token to receive messages from Telegram, forwards them to MulmoClaude over the loopback port the server actually bound, and sends the replies back to the Telegram user. It finds that port itself, and follows it when the server restarts.
 - A short **allowlist** of Telegram chat IDs controls who can talk to the bot. Everyone else gets `"Access denied"`.
 
 Your computer has to be on and connected to the internet for the bot to respond. Close the laptop → the bot goes silent.
@@ -41,7 +41,7 @@ In terminal A, start MulmoClaude:
 yarn dev
 ```
 
-Wait until you see `[server] listening port=3001`.
+Wait until you see `[server] listening port=…`. The number is whatever the server bound: it honours `PORT`, and an implicit default that is already busy walks forward. You do not need to note it — the bridge reads it from the workspace.
 
 In terminal B, start the bridge. Leave the allowlist **empty on purpose** for the first run — you will need to discover your own chat ID before you can add it.
 
@@ -56,9 +56,15 @@ Expected output:
 ```
 MulmoClaude Telegram bridge
 Allowlist: (empty — all chats will be denied)
+Connecting to http://127.0.0.1:<port>
 Connected (<socket id>).
 ```
 
+That third line is the bridge telling you which server it found. If it ever says
+`http://localhost:3001` while `.server-port` says something else, that bridge is
+an old build — see "a messaging bridge's bot does not reply" in the error
+recovery help.
+
 ## Step 3 — Find Your Chat ID and Allowlist It
 
 1. In Telegram, open your new bot (search the username you picked) and send it any message — `hi` works.
@@ -114,7 +120,7 @@ Any other text is treated as a message to the assistant.
 
 ## Troubleshooting
 
-**`Connect error: bearer token rejected`** — MulmoClaude was restarted, so its bearer token changed. Restart `yarn telegram` to pick up the new one. To avoid this, pin `MULMOCLAUDE_AUTH_TOKEN` to the same value on both sides (see `docs/developer.md` §Auth).
+**`Connect error: bearer token rejected`** — MulmoClaude restarted and its bearer token changed. **Do not restart the bridge**: it re-reads the token and the port after a failed connection and reconnects on its own, usually within a second or two. If it is still saying this after that, the server has not finished starting (it writes the token before it binds its port, and a cold start builds the sandbox image in between) — wait for `[server] listening port=…`. Pinning `MULMOCLAUDE_AUTH_TOKEN` on both sides is for a bridge that cannot read the workspace at all, not for this.
 
 **`TELEGRAM_ALLOWED_CHAT_IDS: "foo" is not an integer chat id`** — typo in the allowlist. Chat IDs are plain integers only — no spaces, quotes, or `#` prefix. Negative integers (for group chats) are allowed.
 
@@ -129,7 +135,7 @@ Any other text is treated as a message to the assistant.
 - The bot token is a password. If it leaks, regenerate it via BotFather's `/revoke`.
 - The allowlist is the only thing standing between "my friends" and "every Telegram user on Earth". Keep it current — remove chat IDs when you no longer want that person to have access, and restart the bridge.
 - The bridge logs chat IDs, usernames, and message lengths, but **not** message contents or the bot token. If you need a full audit trail, record it separately.
-- The MulmoClaude bearer token never leaves your machine. The bridge only talks to `localhost:3001`; your friends talk to Telegram's servers, which then talk to your bridge.
+- The MulmoClaude bearer token never leaves your machine. The bridge only ever talks to the IPv4 loopback (`127.0.0.1`), whatever port the server bound; your friends talk to Telegram's servers, which then talk to your bridge.
 
 ## Full Operator Guide
 

package/dist/plugin-vue/index.cjs

@@ -138,7 +138,7 @@ IconGlyph.props = {
 };
 //#endregion
 //#region ../../node_modules/dompurify/dist/purify.es.mjs
-/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */
+/*! @license DOMPurify 3.4.15 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.15/LICENSE */
 function _arrayLikeToArray(r, a) {
 	(null == a || a > r.length) && (a = r.length);
 	for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e];
@@ -1133,7 +1133,7 @@ var _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallback)
 function createDOMPurify() {
 	let window = arguments.length > 0 && arguments[0] !== void 0 ? arguments[0] : getGlobal();
 	const DOMPurify = (root) => createDOMPurify(root);
-	DOMPurify.version = "3.4.14";
+	DOMPurify.version = "3.4.15";
 	DOMPurify.removed = [];
 	if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
 		DOMPurify.isSupported = false;
@@ -1150,6 +1150,7 @@ function createDOMPurify() {
 	const ElementPrototype = Element.prototype;
 	const cloneNode = lookupGetter(ElementPrototype, "cloneNode");
 	const remove = lookupGetter(ElementPrototype, "remove");
+	const removeAttributeNode = lookupGetter(ElementPrototype, "removeAttributeNode");
 	const getNextSibling = lookupGetter(ElementPrototype, "nextSibling");
 	const getChildNodes = lookupGetter(ElementPrototype, "childNodes");
 	const getParentNode = lookupGetter(ElementPrototype, "parentNode");
@@ -1604,7 +1605,7 @@ function createDOMPurify() {
 	*/
 	const _stripAttributeNode = function _stripAttributeNode(element, attribute, name) {
 		try {
-			element.removeAttributeNode(attribute);
+			removeAttributeNode(element, attribute);
 		} catch (_) {
 			try {
 				element.removeAttribute(name);
@@ -1677,7 +1678,7 @@ function createDOMPurify() {
 			from: element
 		});
 		try {
-			if (attr) element.removeAttributeNode(attr);
+			if (attr) removeAttributeNode(element, attr);
 			else element.removeAttribute(name);
 		} catch (_) {
 			try {
@@ -1923,7 +1924,7 @@ function createDOMPurify() {
 		const realTagName = getNodeName ? getNodeName(element) : null;
 		if (typeof realTagName !== "string") return false;
 		if (transformCaseFunc(realTagName) !== "form") return false;
-		return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || element.nodeType !== getNodeType(element) || element.childNodes !== getChildNodes(element);
+		return typeof element.nodeName !== "string" || typeof element.textContent !== "string" || typeof element.removeChild !== "function" || element.attributes !== getAttributes(element) || typeof element.removeAttribute !== "function" || typeof element.removeAttributeNode !== "function" || typeof element.getAttributeNode !== "function" || typeof element.setAttribute !== "function" || typeof element.namespaceURI !== "string" || typeof element.insertBefore !== "function" || typeof element.hasChildNodes !== "function" || element.nodeType !== getNodeType(element) || element.childNodes !== getChildNodes(element);
 	};
 	/**
 	* Checks whether the given value is a DocumentFragment from any realm.
@@ -2208,24 +2209,38 @@ function createDOMPurify() {
 	/**
 	* Write a modified attribute value back onto the element. On
 	* success, re-probe for clobbering introduced by the new value and
-	* remove the element when found; otherwise pop the removal entry
-	* recorded by the earlier _removeAttribute (long-standing pairing
-	* with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+	* remove the element when found; otherwise, when this writeback is the
+	* recreate half of the SANITIZE_NAMED_PROPS remove-and-recreate, pop the
+	* removal entry that path recorded so it does not show as removed. On
 	* failure, remove the attribute instead.
 	*
+	* Returns true only on a clean write (the value was set and the new value
+	* introduced no clobbering). The caller uses that, together with its own
+	* knowledge of whether this attribute pushed a DOMPurify.removed record, to
+	* decide whether to pop that record. The pop must happen ONLY for the
+	* named-prop remove-and-recreate; popping on any other value change (trim,
+	* template scrubbing, Trusted Types) would consume an unrelated _forceRemove
+	* subtree-cleanup record and let that detached subtree keep a live event
+	* handler through the IN_PLACE neutralization pass (SO-001).
+	*
 	* @param currentNode the element carrying the attribute
 	* @param name the attribute name as present on the element
 	* @param namespaceURI the attribute's namespace, if any
 	* @param value the new attribute value
+	* @return true if the value was written without introducing clobbering
 	*/
 	const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
 		try {
 			if (namespaceURI) currentNode.setAttributeNS(namespaceURI, name, value);
 			else currentNode.setAttribute(name, value);
-			if (_isClobbered(currentNode)) _forceRemove(currentNode);
-			else arrayPop(DOMPurify.removed);
+			if (_isClobbered(currentNode)) {
+				_forceRemove(currentNode);
+				return false;
+			}
+			return true;
 		} catch (_) {
 			_removeAttribute(name, currentNode);
+			return false;
 		}
 	};
 	/**
@@ -2258,6 +2273,7 @@ function createDOMPurify() {
 			const lcName = transformCaseFunc(name);
 			const initValue = attrValue;
 			let value = name === "value" ? initValue : stringTrim(initValue);
+			let recreatedNamedProp = false;
 			hookEvent.attrName = lcName;
 			hookEvent.attrValue = value;
 			hookEvent.keepAttr = true;
@@ -2267,6 +2283,7 @@ function createDOMPurify() {
 			if (SANITIZE_NAMED_PROPS && (lcName === "id" || lcName === "name") && stringIndexOf(value, SANITIZE_NAMED_PROPS_PREFIX) !== 0) {
 				_removeAttribute(name, currentNode, attr);
 				value = SANITIZE_NAMED_PROPS_PREFIX + value;
+				recreatedNamedProp = true;
 			}
 			if (SAFE_FOR_XML && regExpTest(/((--!?|])>)|<\/(style|script|title|xmp|textarea|noscript|iframe|noembed|noframes)/i, value)) {
 				_removeAttribute(name, currentNode, attr);
@@ -2291,7 +2308,9 @@ function createDOMPurify() {
 				continue;
 			}
 			value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
-			if (value !== initValue) _setAttributeValue(currentNode, name, namespaceURI, value);
+			if (value !== initValue) {
+				if (_setAttributeValue(currentNode, name, namespaceURI, value) && recreatedNamedProp) arrayPop(DOMPurify.removed);
+			}
 		}
 		_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
 	};
@@ -2425,7 +2444,7 @@ function createDOMPurify() {
 			if (importedNode.nodeType === NODE_TYPE.element && importedNode.nodeName === "BODY") body = importedNode;
 			else if (importedNode.nodeName === "HTML") body = importedNode;
 			else body.appendChild(importedNode);
-			_sanitizeAttachedShadowRoots(importedNode);
+			_sanitizeAttachedShadowRoots(body);
 		} else {
 			if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT && dirty.indexOf("<") === -1) return trustedTypesPolicy && RETURN_TRUSTED_TYPE ? _createTrustedHTML(dirty) : dirty;
 			body = _initDocument(dirty);