@mulmoclaude/core 5.7.1 → 5.8.0

package/dist/artifacts/paths.cjs

@@ -1,74 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let gui_chat_protocol = require("gui-chat-protocol");
+let _gui_chat_plugin_common = require("@gui-chat-plugin/common");
 //#region src/artifacts/paths.ts
-var MAX_SLUG_LEN = 120;
-/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */
-var ARTIFACTS_ROOT = "artifacts";
-/**
-* Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,
-* whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at
-* 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.
-*
-* Leading/trailing hyphens are stripped with a linear scan rather than a regex
-* like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial
-* backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →
-* strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.
-*/
-function slugifyArtifact(title, fallback) {
-	if (!title) return fallback;
-	const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, "-");
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start += 1;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	return collapsed.slice(start, end) || fallback;
-}
-/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —
-*  not local — so a workspace synced across timezones stays in one bucket. */
-function yearMonthUtc(now = /* @__PURE__ */ new Date()) {
-	return `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-}
-/**
-* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
-* This is what `files.artifacts.write` takes; prefix it with
-* `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
-*
-* `<epochMs>` alone separates paths built at different times, but NOT two calls
-* with the same title inside one millisecond — those produce the same name, and
-* the second write silently replaces the first artifact. Pass `suffix` (a short
-* random token, as `shapeArtifactPath` does) wherever concurrent callers can
-* share a title.
-*/
-function buildArtifactRelPath(params) {
-	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true, suffix } = params;
-	const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;
-	const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;
-	return (partitioned ? [
-		dir,
-		yearMonthUtc(now),
-		fileName
-	] : [dir, fileName]).join("/");
-}
-/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
-function toWorkspaceArtifactPath(relPath) {
-	return `${ARTIFACTS_ROOT}/${relPath}`;
-}
-/**
-* True when any `/` or `\`-separated segment of `value` is empty (`//`,
-* leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
-* guard every artifact path check shares — so a workspace-escape judgement
-* can't drift between plugins.
-*
-* Both separators, matching `classifyFilePath`: an artifact path is minted from
-* a slug and so never contains a backslash, while `node:path` on Windows treats
-* one as a separator. Splitting on `/` alone accepted
-* `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
-* to `path.join` (codex on #3056).
-*/
-function hasUnsafePathSegment(value) {
-	return value.split(/[/\\]/).some((seg) => seg === "" || seg === "." || seg === "..");
-}
 var WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
 /** True when `value` names a location that does not depend on a base directory.
 *  Exported so a URL builder and a path resolver cannot disagree about which
@@ -110,14 +43,44 @@ function hasDotfileSegment(value) {
 	return value.split(/[/\\]/).some((segment) => segment.startsWith("."));
 }
 //#endregion
-exports.ARTIFACTS_ROOT = ARTIFACTS_ROOT;
-exports.buildArtifactRelPath = buildArtifactRelPath;
+Object.defineProperty(exports, "ARTIFACTS_ROOT", {
+	enumerable: true,
+	get: function() {
+		return gui_chat_protocol.ARTIFACTS_ROOT;
+	}
+});
+Object.defineProperty(exports, "buildArtifactRelPath", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.buildArtifactRelPath;
+	}
+});
 exports.classifyFilePath = classifyFilePath;
 exports.hasDotfileSegment = hasDotfileSegment;
-exports.hasUnsafePathSegment = hasUnsafePathSegment;
+Object.defineProperty(exports, "hasUnsafePathSegment", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.hasUnsafePathSegment;
+	}
+});
 exports.isAbsoluteFilePathValue = isAbsoluteFilePathValue;
-exports.slugifyArtifact = slugifyArtifact;
-exports.toWorkspaceArtifactPath = toWorkspaceArtifactPath;
-exports.yearMonthUtc = yearMonthUtc;
+Object.defineProperty(exports, "slugifyArtifact", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.slugifyArtifact;
+	}
+});
+Object.defineProperty(exports, "toWorkspaceArtifactPath", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.toWorkspaceArtifactPath;
+	}
+});
+Object.defineProperty(exports, "yearMonthUtc", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.yearMonthUtc;
+	}
+});
 
 //# sourceMappingURL=paths.cjs.map

package/dist/artifacts/paths.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"paths.cjs","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n  /** Extra token appended after the timestamp, for callers that cannot accept a\n   *  same-millisecond collision (see the note on `buildArtifactRelPath`). */\n  suffix?: string;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.\n * This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n *\n * `<epochMs>` alone separates paths built at different times, but NOT two calls\n * with the same title inside one millisecond — those produce the same name, and\n * the second write silently replaces the first artifact. Pass `suffix` (a short\n * random token, as `shapeArtifactPath` does) wherever concurrent callers can\n * share a title.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true, suffix } = params;\n  const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;\n  const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/` or `\\`-separated segment of `value` is empty (`//`,\n * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical\n * guard every artifact path check shares — so a workspace-escape judgement\n * can't drift between plugins.\n *\n * Both separators, matching `classifyFilePath`: an artifact path is minted from\n * a slug and so never contains a backslash, while `node:path` on Windows treats\n * one as a separator. Splitting on `/` alone accepted\n * `artifacts/shapes/..\\..\\secrets.shape` — canonical to this check, traversal\n * to `path.join` (codex on #3056).\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;;;;;;AA8BA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,MAAM,WAAW;CACpF,MAAM,QAAQ,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,QAAQ;CACrE,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,QAAQ;CAEhE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACrF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}
+{"version":3,"file":"paths.cjs","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript / markdown) and the host's file stores. Browser-safe by design:\n// no node:path / no node:crypto, so it bundles into both the server core and\n// the browser (`./vue`) plugin entries.\n//\n// The artifact-path half lives upstream so plugins outside this repo share it\n// without importing MulmoClaude: the directory's name is gui-chat-protocol's\n// (`ARTIFACTS_ROOT`, 2.3), and the slug / partition / path builder / traversal\n// guard are `@gui-chat-plugin/common`'s. They are re-exported here so every\n// existing `@mulmoclaude/core/artifacts` import keeps working unchanged.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS.\n\nexport { ARTIFACTS_ROOT } from \"gui-chat-protocol\";\nexport {\n  buildArtifactRelPath,\n  hasUnsafePathSegment,\n  slugifyArtifact,\n  toWorkspaceArtifactPath,\n  yearMonthUtc,\n  type ArtifactRelPathParams,\n} from \"@gui-chat-plugin/common\";\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;;;AA+CA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}

package/dist/artifacts/paths.d.ts

@@ -1,62 +1,5 @@
-/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */
-export declare const ARTIFACTS_ROOT = "artifacts";
-/**
- * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,
- * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at
- * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.
- *
- * Leading/trailing hyphens are stripped with a linear scan rather than a regex
- * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial
- * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →
- * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.
- */
-export declare function slugifyArtifact(title: string | undefined, fallback: string): string;
-/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —
- *  not local — so a workspace synced across timezones stays in one bucket. */
-export declare function yearMonthUtc(now?: Date): string;
-export interface ArtifactRelPathParams {
-    /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */
-    dir: string;
-    /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */
-    title: string | undefined;
-    /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */
-    ext: string;
-    /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */
-    fallback: string;
-    now?: Date;
-    /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */
-    partitioned?: boolean;
-    /** Extra token appended after the timestamp, for callers that cannot accept a
-     *  same-millisecond collision (see the note on `buildArtifactRelPath`). */
-    suffix?: string;
-}
-/**
- * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
- * This is what `files.artifacts.write` takes; prefix it with
- * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
- *
- * `<epochMs>` alone separates paths built at different times, but NOT two calls
- * with the same title inside one millisecond — those produce the same name, and
- * the second write silently replaces the first artifact. Pass `suffix` (a short
- * random token, as `shapeArtifactPath` does) wherever concurrent callers can
- * share a title.
- */
-export declare function buildArtifactRelPath(params: ArtifactRelPathParams): string;
-/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
-export declare function toWorkspaceArtifactPath(relPath: string): string;
-/**
- * True when any `/` or `\`-separated segment of `value` is empty (`//`,
- * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
- * guard every artifact path check shares — so a workspace-escape judgement
- * can't drift between plugins.
- *
- * Both separators, matching `classifyFilePath`: an artifact path is minted from
- * a slug and so never contains a backslash, while `node:path` on Windows treats
- * one as a separator. Splitting on `/` alone accepted
- * `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
- * to `path.join` (codex on #3056).
- */
-export declare function hasUnsafePathSegment(value: string): boolean;
+export { ARTIFACTS_ROOT } from 'gui-chat-protocol';
+export { buildArtifactRelPath, hasUnsafePathSegment, slugifyArtifact, toWorkspaceArtifactPath, yearMonthUtc, type ArtifactRelPathParams, } from '@gui-chat-plugin/common';
 /** How a caller-supplied file path must be resolved. `null` = not a usable path. */
 export type FilePathKind = "absolute" | "relative";
 /** True when `value` names a location that does not depend on a base directory.

package/dist/artifacts/paths.js

@@ -1,73 +1,6 @@
+import { ARTIFACTS_ROOT } from "gui-chat-protocol";
+import { buildArtifactRelPath, hasUnsafePathSegment, slugifyArtifact, toWorkspaceArtifactPath, yearMonthUtc } from "@gui-chat-plugin/common";
 //#region src/artifacts/paths.ts
-var MAX_SLUG_LEN = 120;
-/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */
-var ARTIFACTS_ROOT = "artifacts";
-/**
-* Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,
-* whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at
-* 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.
-*
-* Leading/trailing hyphens are stripped with a linear scan rather than a regex
-* like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial
-* backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →
-* strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.
-*/
-function slugifyArtifact(title, fallback) {
-	if (!title) return fallback;
-	const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, "-");
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start += 1;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	return collapsed.slice(start, end) || fallback;
-}
-/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —
-*  not local — so a workspace synced across timezones stays in one bucket. */
-function yearMonthUtc(now = /* @__PURE__ */ new Date()) {
-	return `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-}
-/**
-* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
-* This is what `files.artifacts.write` takes; prefix it with
-* `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
-*
-* `<epochMs>` alone separates paths built at different times, but NOT two calls
-* with the same title inside one millisecond — those produce the same name, and
-* the second write silently replaces the first artifact. Pass `suffix` (a short
-* random token, as `shapeArtifactPath` does) wherever concurrent callers can
-* share a title.
-*/
-function buildArtifactRelPath(params) {
-	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true, suffix } = params;
-	const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;
-	const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;
-	return (partitioned ? [
-		dir,
-		yearMonthUtc(now),
-		fileName
-	] : [dir, fileName]).join("/");
-}
-/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
-function toWorkspaceArtifactPath(relPath) {
-	return `${ARTIFACTS_ROOT}/${relPath}`;
-}
-/**
-* True when any `/` or `\`-separated segment of `value` is empty (`//`,
-* leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
-* guard every artifact path check shares — so a workspace-escape judgement
-* can't drift between plugins.
-*
-* Both separators, matching `classifyFilePath`: an artifact path is minted from
-* a slug and so never contains a backslash, while `node:path` on Windows treats
-* one as a separator. Splitting on `/` alone accepted
-* `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
-* to `path.join` (codex on #3056).
-*/
-function hasUnsafePathSegment(value) {
-	return value.split(/[/\\]/).some((seg) => seg === "" || seg === "." || seg === "..");
-}
 var WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
 /** True when `value` names a location that does not depend on a base directory.
 *  Exported so a URL builder and a path resolver cannot disagree about which

package/dist/artifacts/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n  /** Extra token appended after the timestamp, for callers that cannot accept a\n   *  same-millisecond collision (see the note on `buildArtifactRelPath`). */\n  suffix?: string;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.\n * This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n *\n * `<epochMs>` alone separates paths built at different times, but NOT two calls\n * with the same title inside one millisecond — those produce the same name, and\n * the second write silently replaces the first artifact. Pass `suffix` (a short\n * random token, as `shapeArtifactPath` does) wherever concurrent callers can\n * share a title.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true, suffix } = params;\n  const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;\n  const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/` or `\\`-separated segment of `value` is empty (`//`,\n * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical\n * guard every artifact path check shares — so a workspace-escape judgement\n * can't drift between plugins.\n *\n * Both separators, matching `classifyFilePath`: an artifact path is minted from\n * a slug and so never contains a backslash, while `node:path` on Windows treats\n * one as a separator. Splitting on `/` alone accepted\n * `artifacts/shapes/..\\..\\secrets.shape` — canonical to this check, traversal\n * to `path.join` (codex on #3056).\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;;;;;;AA8BA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,MAAM,WAAW;CACpF,MAAM,QAAQ,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,QAAQ;CACrE,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,QAAQ;CAEhE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACrF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}
+{"version":3,"file":"paths.js","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript / markdown) and the host's file stores. Browser-safe by design:\n// no node:path / no node:crypto, so it bundles into both the server core and\n// the browser (`./vue`) plugin entries.\n//\n// The artifact-path half lives upstream so plugins outside this repo share it\n// without importing MulmoClaude: the directory's name is gui-chat-protocol's\n// (`ARTIFACTS_ROOT`, 2.3), and the slug / partition / path builder / traversal\n// guard are `@gui-chat-plugin/common`'s. They are re-exported here so every\n// existing `@mulmoclaude/core/artifacts` import keeps working unchanged.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS.\n\nexport { ARTIFACTS_ROOT } from \"gui-chat-protocol\";\nexport {\n  buildArtifactRelPath,\n  hasUnsafePathSegment,\n  slugifyArtifact,\n  toWorkspaceArtifactPath,\n  yearMonthUtc,\n  type ArtifactRelPathParams,\n} from \"@gui-chat-plugin/common\";\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;;AA+CA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmoclaude/core",
-  "version": "5.7.1",
+  "version": "5.8.0",
   "description": "Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug, ./translation/client, ./remote-view, ./remote-host and ./plugin-vue entries. All host specifics are injected.",
   "repository": {
     "type": "git",
@@ -225,6 +225,7 @@
   },
   "dependencies": {
     "@duckdb/node-api": "^1.5.5-r.5",
+    "@gui-chat-plugin/common": "^0.1.0",
     "@mulmoclaude/common": "^1.3.0",
     "@mulmoclaude/markdown-utils": "^3.0.1",
     "dompurify": "^3.4.15",
@@ -237,7 +238,7 @@
   "peerDependencies": {
     "@receptron/task-scheduler": "^1.0.3",
     "firebase": "^12.0.0",
-    "gui-chat-protocol": "^2.0.0",
+    "gui-chat-protocol": "^2.3.0",
     "vue": "^3.5.0",
     "vue-i18n": "^11.4.4"
   },
@@ -255,7 +256,7 @@
   "devDependencies": {
     "@receptron/task-scheduler": "^1.0.3",
     "@types/node": "^26.6.3",
-    "gui-chat-protocol": "^2.0.0",
+    "gui-chat-protocol": "^2.3.0",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",