mulmoclaude 0.1.0

package/server/workspace/skills/user-tasks.ts

@@ -0,0 +1,257 @@
+// User-created scheduled tasks (#357 Phase 3).
+//
+// Users can create tasks via the API or MCP tool. Each task fires
+// `startChat()` with its prompt when the schedule triggers.
+//
+// Tasks are persisted in `config/scheduler/tasks.json` and
+// registered with the task-manager at startup. CRUD operations
+// trigger a refresh that unregisters old tasks and registers new ones.
+
+import { loadUserTasks as loadRaw, saveUserTasks } from "../../utils/files/user-tasks-io.js";
+import type { MissedRunPolicy } from "@receptron/task-scheduler";
+import { SCHEDULE_TYPES, MISSED_RUN_POLICIES } from "@receptron/task-scheduler";
+import type { TaskSchedule as LocalTaskSchedule } from "../../events/task-manager/index.js";
+import { DEFAULT_ROLE_ID } from "../../../src/config/roles.js";
+import { SESSION_ORIGINS, type SessionOrigin } from "../../../src/types/session.js";
+import { log } from "../../system/logger/index.js";
+import type { ITaskManager } from "../../events/task-manager/index.js";
+import { isRecord } from "../../utils/types.js";
+
+// ── Types ───────────────────────────────────────────────────────
+
+export interface PersistedUserTask {
+  id: string;
+  name: string;
+  description: string;
+  schedule: LocalTaskSchedule;
+  missedRunPolicy: MissedRunPolicy;
+  enabled: boolean;
+  roleId: string;
+  prompt: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export function loadUserTasks(r?: string): PersistedUserTask[] {
+  return loadRaw<PersistedUserTask>(r);
+}
+
+// ── Validation ──────────────────────────────────────────────────
+
+function isValidDailyTime(value: string): boolean {
+  return /^([01]\d|2[0-3]):([0-5]\d)$/.test(value);
+}
+
+function isValidSchedule(s: unknown): s is LocalTaskSchedule {
+  if (!isRecord(s)) return false;
+  const obj = s as Record<string, unknown>;
+  if (obj.type === SCHEDULE_TYPES.interval) {
+    return typeof obj.intervalMs === "number" && obj.intervalMs > 0;
+  }
+  if (obj.type === SCHEDULE_TYPES.daily) {
+    return typeof obj.time === "string" && isValidDailyTime(obj.time);
+  }
+  return false;
+}
+
+function isValidMissedRunPolicy(p: unknown): p is MissedRunPolicy {
+  return p === MISSED_RUN_POLICIES.skip || p === MISSED_RUN_POLICIES.runOnce || p === MISSED_RUN_POLICIES.runAll;
+}
+
+export type ValidateResult = { kind: "ok"; task: PersistedUserTask } | { kind: "error"; error: string };
+
+export function validateAndCreate(input: unknown): ValidateResult {
+  if (!isRecord(input)) {
+    return { kind: "error", error: "request body required" };
+  }
+  const obj = input as Record<string, unknown>;
+
+  if (typeof obj.name !== "string" || obj.name.trim().length === 0) {
+    return { kind: "error", error: "name required" };
+  }
+  if (typeof obj.prompt !== "string" || obj.prompt.trim().length === 0) {
+    return { kind: "error", error: "prompt required" };
+  }
+  if (!isValidSchedule(obj.schedule)) {
+    return { kind: "error", error: "valid schedule required" };
+  }
+  const missedRunPolicy = isValidMissedRunPolicy(obj.missedRunPolicy) ? obj.missedRunPolicy : MISSED_RUN_POLICIES.runOnce;
+  const roleId = typeof obj.roleId === "string" ? obj.roleId : DEFAULT_ROLE_ID;
+
+  const now = new Date().toISOString();
+  const task: PersistedUserTask = {
+    id: crypto.randomUUID(),
+    name: obj.name.trim(),
+    description: typeof obj.description === "string" ? obj.description.trim() : "",
+    schedule: obj.schedule,
+    missedRunPolicy,
+    enabled: true,
+    roleId,
+    prompt: obj.prompt.trim(),
+    createdAt: now,
+    updatedAt: now,
+  };
+  return { kind: "ok", task };
+}
+
+export type UpdateResult = { kind: "ok"; tasks: PersistedUserTask[] } | { kind: "error"; error: string };
+
+export function applyUpdate(tasks: PersistedUserTask[], id: string, patch: unknown): UpdateResult {
+  if (!isRecord(patch)) {
+    return { kind: "error", error: "request body required" };
+  }
+  const idx = tasks.findIndex((t) => t.id === id);
+  if (idx === -1) {
+    return { kind: "error", error: `task not found: ${id}` };
+  }
+  const existing = tasks[idx];
+  const updated: PersistedUserTask = { ...existing };
+  // patch is validated as non-null object above; spread into Record
+  const p: Record<string, unknown> = { ...patch };
+
+  if (typeof p.name === "string" && p.name.trim().length > 0) {
+    updated.name = p.name.trim();
+  }
+  if (typeof p.description === "string") {
+    updated.description = p.description.trim();
+  }
+  if (isValidSchedule(p.schedule)) {
+    updated.schedule = p.schedule;
+  }
+  if (isValidMissedRunPolicy(p.missedRunPolicy)) {
+    updated.missedRunPolicy = p.missedRunPolicy;
+  }
+  if (typeof p.enabled === "boolean") {
+    updated.enabled = p.enabled;
+  }
+  if (typeof p.roleId === "string") {
+    updated.roleId = p.roleId;
+  }
+  if (typeof p.prompt === "string" && p.prompt.trim().length > 0) {
+    updated.prompt = p.prompt.trim();
+  }
+  updated.updatedAt = new Date().toISOString();
+
+  const next = [...tasks];
+  next[idx] = updated;
+  return { kind: "ok", tasks: next };
+}
+
+// ── Mutexed CRUD ────────────────────────────────────────────────
+// Serialize read-modify-write sequences so concurrent API calls
+// don't clobber each other's changes.
+
+let crudMutex: Promise<void> = Promise.resolve();
+
+export async function withUserTaskLock<T>(
+  fn: (tasks: PersistedUserTask[]) => Promise<{
+    tasks: PersistedUserTask[];
+    result: T;
+  }>,
+): Promise<T> {
+  const prev = crudMutex;
+  let release: () => void = () => {};
+  crudMutex = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  try {
+    await prev;
+    const current = loadUserTasks();
+    const { tasks: next, result } = await fn(current);
+    await saveUserTasks(next);
+    await refreshUserTasks();
+    return result;
+  } finally {
+    release();
+  }
+}
+
+// ── Task registration ───────────────────────────────────────────
+
+const USER_TASK_PREFIX = "user.";
+let registeredUserTaskIds = new Set<string>();
+let cachedUserTaskDeps: UserTaskDeps | null = null;
+let userTaskMutex: Promise<number> = Promise.resolve(0);
+
+export interface UserTaskDeps {
+  taskManager: ITaskManager;
+  startChat: (params: { message: string; roleId: string; chatSessionId: string; origin?: SessionOrigin }) => Promise<{ kind: string; error?: string }>;
+}
+
+export async function registerUserTasks(deps: UserTaskDeps): Promise<number> {
+  cachedUserTaskDeps = deps;
+  return serializedRefreshUserTasks(deps);
+}
+
+export async function refreshUserTasks(): Promise<number> {
+  if (!cachedUserTaskDeps) {
+    log.warn("user-tasks", "refreshUserTasks called before initial register");
+    return 0;
+  }
+  return serializedRefreshUserTasks(cachedUserTaskDeps);
+}
+
+function serializedRefreshUserTasks(deps: UserTaskDeps): Promise<number> {
+  userTaskMutex = userTaskMutex.then(
+    () => doRegisterUserTasks(deps),
+    () => doRegisterUserTasks(deps),
+  );
+  return userTaskMutex;
+}
+
+async function doRegisterUserTasks(deps: UserTaskDeps): Promise<number> {
+  const { taskManager, startChat } = deps;
+
+  for (const taskId of registeredUserTaskIds) {
+    taskManager.removeTask(taskId);
+  }
+  const previousCount = registeredUserTaskIds.size;
+  registeredUserTaskIds = new Set<string>();
+
+  const tasks = loadUserTasks();
+  let registered = 0;
+
+  for (const task of tasks) {
+    if (!task.enabled) continue;
+
+    const taskId = `${USER_TASK_PREFIX}${task.id}`;
+    taskManager.registerTask({
+      id: taskId,
+      description: `User task: ${task.name}`,
+      schedule: task.schedule,
+      run: async () => {
+        const chatSessionId = crypto.randomUUID();
+        log.info("user-tasks", "running user task", {
+          name: task.name,
+          roleId: task.roleId,
+          chatSessionId,
+        });
+        const result = await startChat({
+          message: task.prompt,
+          roleId: task.roleId,
+          chatSessionId,
+          origin: SESSION_ORIGINS.scheduler,
+        });
+        if (result.kind === "error") {
+          throw new Error(`user task failed: ${result.error ?? "unknown"}`);
+        }
+        log.info("user-tasks", "user task completed", {
+          name: task.name,
+          kind: result.kind,
+        });
+      },
+    });
+
+    registeredUserTaskIds.add(taskId);
+    registered++;
+  }
+
+  if (previousCount > 0 || registered > 0) {
+    log.info("user-tasks", "user tasks refreshed", {
+      previous: previousCount,
+      current: registered,
+    });
+  }
+
+  return registered;
+}

package/server/workspace/skills/writer.ts

@@ -0,0 +1,189 @@
+// Project-scope skill writer. Phase 1 of #139.
+//
+// Writes are confined to <workspaceRoot>/.claude/skills/<slug>/SKILL.md.
+// User-scope skills (~/.claude/skills/) are never touched — the
+// safety boundary is enforced by always going through
+// `projectSkillPath` and never accepting an arbitrary destination.
+//
+// `saveProjectSkill` is non-overwriting: if the slug already has a
+// SKILL.md (in either scope), the call returns a `kind: "exists"`
+// result and the file is left alone. The caller (REST handler /
+// MCP bridge) maps this to a 409 Conflict so Claude can ask the
+// user for a different name.
+
+import { unlink, rmdir } from "node:fs/promises";
+import { discoverSkills } from "./discovery.js";
+import { projectSkillDir, projectSkillPath } from "./paths.js";
+import { isValidSlug } from "../../utils/slug.js";
+import { log } from "../../system/logger/index.js";
+import { writeFileAtomic } from "../../utils/files/index.js";
+
+export interface SaveSkillInput {
+  /** Workspace root (typically `~/mulmoclaude`). */
+  workspaceRoot: string;
+  /** Slug — also the dir name and the slash-command name. */
+  name: string;
+  /** YAML frontmatter `description:` value. One-line summary. */
+  description: string;
+  /** Markdown body following the frontmatter. May be empty. */
+  body: string;
+}
+
+export type SaveResult =
+  | { kind: "saved"; path: string }
+  | { kind: "invalid-slug"; slug: string }
+  | { kind: "missing-field"; field: "description" | "body" }
+  | { kind: "exists"; name: string };
+
+/**
+ * Write a new SKILL.md atomically. Refuses to overwrite — if the
+ * skill already exists at either scope, returns `kind: "exists"`.
+ */
+export async function saveProjectSkill(input: SaveSkillInput): Promise<SaveResult> {
+  const { workspaceRoot, name, description, body } = input;
+
+  if (!isValidSlug(name)) return { kind: "invalid-slug", slug: name };
+  if (typeof description !== "string" || description.trim().length === 0) {
+    return { kind: "missing-field", field: "description" };
+  }
+  if (typeof body !== "string") {
+    return { kind: "missing-field", field: "body" };
+  }
+
+  // Conflict check across BOTH scopes — we don't want to shadow a
+  // user-scope skill with the same name (project would silently
+  // override it via the precedence rule).
+  const existing = await discoverSkills({ workspaceRoot });
+  if (existing.some((s) => s.name === name)) {
+    return { kind: "exists", name };
+  }
+
+  const finalPath = projectSkillPath(workspaceRoot, name);
+  const contents = formatSkillFile(description, body);
+
+  // Atomic + uniqueTmp: same-FS rename is atomic on POSIX so a
+  // partial write can never leave a half-baked SKILL.md visible to a
+  // concurrent reader. The uniqueTmp flag guards against leftover
+  // `.tmp` from a previous crashed run colliding with a new write.
+  try {
+    await writeFileAtomic(finalPath, contents, { uniqueTmp: true });
+  } catch (err) {
+    log.error("skills", "save failed", { name, error: String(err) });
+    throw err;
+  }
+
+  return { kind: "saved", path: finalPath };
+}
+
+export type UpdateResult =
+  | { kind: "updated"; path: string }
+  | { kind: "invalid-slug"; slug: string }
+  | { kind: "missing-field"; field: "description" | "body" }
+  | { kind: "not-found"; name: string }
+  | { kind: "user-scope"; name: string };
+
+/**
+ * Overwrite an existing project-scope SKILL.md. Refuses to touch
+ * user-scope skills and rejects names that don't exist.
+ */
+export async function updateProjectSkill(input: SaveSkillInput): Promise<UpdateResult> {
+  const { workspaceRoot, name, description, body } = input;
+
+  if (!isValidSlug(name)) return { kind: "invalid-slug", slug: name };
+  if (typeof description !== "string" || description.trim().length === 0) {
+    return { kind: "missing-field", field: "description" };
+  }
+  if (typeof body !== "string") {
+    return { kind: "missing-field", field: "body" };
+  }
+
+  const existing = await discoverSkills({ workspaceRoot });
+  const skill = existing.find((s) => s.name === name);
+  if (!skill) return { kind: "not-found", name };
+  if (skill.source === "user") return { kind: "user-scope", name };
+
+  const finalPath = projectSkillPath(workspaceRoot, name);
+  const contents = formatSkillFile(description, body);
+
+  try {
+    await writeFileAtomic(finalPath, contents, { uniqueTmp: true });
+  } catch (err) {
+    log.error("skills", "update failed", { name, error: String(err) });
+    throw err;
+  }
+
+  return { kind: "updated", path: finalPath };
+}
+
+export interface DeleteSkillInput {
+  workspaceRoot: string;
+  name: string;
+}
+
+export type DeleteResult =
+  | { kind: "deleted"; name: string }
+  | { kind: "invalid-slug"; slug: string }
+  | { kind: "not-found"; name: string }
+  | { kind: "user-scope"; name: string };
+
+/**
+ * Remove a project-scope skill (SKILL.md + its containing folder).
+ * Refuses to touch the user scope even if a user skill with this
+ * name exists — protects against accidental ~/.claude mutation.
+ */
+export async function deleteProjectSkill(input: DeleteSkillInput): Promise<DeleteResult> {
+  const { workspaceRoot, name } = input;
+
+  if (!isValidSlug(name)) return { kind: "invalid-slug", slug: name };
+
+  // Look up the skill's effective source via discovery — if the
+  // matching name is user-scope, we refuse.
+  const all = await discoverSkills({ workspaceRoot });
+  const skill = all.find((s) => s.name === name);
+  if (!skill) return { kind: "not-found", name };
+  if (skill.source === "user") return { kind: "user-scope", name };
+
+  const dir = projectSkillDir(workspaceRoot, name);
+  // Remove SKILL.md, then try to remove the directory if it's empty.
+  // If the user has dropped extra files alongside SKILL.md (e.g. a
+  // README, assets), rmdir() fails and we leave the directory in
+  // place — the skill itself (the SKILL.md) is gone either way.
+  try {
+    await unlink(projectSkillPath(workspaceRoot, name));
+  } catch (err) {
+    // ENOENT is fine — discovery may be stale. Anything else is
+    // surfaced so the caller knows the delete didn't fully work.
+    const error = err as { code?: string };
+    if (error.code !== "ENOENT") throw err;
+  }
+  await rmdir(dir).catch(() => {
+    // Dir may contain user-added files (e.g. the user dropped a
+    // README.md alongside SKILL.md). Don't fail in that case —
+    // the skill itself is gone.
+  });
+
+  return { kind: "deleted", name };
+}
+
+/** Compose the final SKILL.md content. Body is trimmed of trailing
+ *  whitespace; a final newline is always added. */
+function formatSkillFile(description: string, body: string): string {
+  const escaped = escapeYamlScalar(description);
+  return `---\ndescription: ${escaped}\n---\n\n${body.trimEnd()}\n`;
+}
+
+/**
+ * Escape a one-line string for use as a YAML scalar value. We
+ * stay defensive: if the value contains any character that could
+ * confuse the parser (`:`, `#`, `'`, `"`, leading whitespace), wrap
+ * it in double quotes and JSON-escape the inner content. Plain
+ * ASCII text passes through unchanged so the file stays readable.
+ */
+function escapeYamlScalar(value: string): string {
+  const oneLine = value.replace(/\r?\n/g, " ").trim();
+  const needsQuoting = /[:#'"\\[\]{}>|`*&!%@?]/.test(oneLine) || /^\s|\s$/.test(oneLine) || /^(true|false|null|~|yes|no|on|off)$/i.test(oneLine);
+  if (!needsQuoting) return oneLine;
+  // JSON.stringify gives us escapes for `\`, `"`, control chars in
+  // one shot — the result is also valid YAML when wrapped in `"..."`.
+  return JSON.stringify(oneLine);
+}

package/server/workspace/sources/arxivDiscovery.ts

@@ -0,0 +1,182 @@
+// arXiv auto-discovery (#469).
+//
+// Reads user interests from config/interests.json and automatically
+// registers arXiv sources for keywords that don't already have one.
+// Called from the pipeline's startup or on interest profile change.
+//
+// For each keyword (or group of related keywords), generates an
+// arXiv query and registers it as a daily source. Existing arXiv
+// sources are not duplicated.
+
+import crypto from "crypto";
+import { loadInterests } from "./interests.js";
+import { listSources, writeSource } from "./registry.js";
+import { sourcesRoot } from "./paths.js";
+import { workspacePath } from "../paths.js";
+import { log } from "../../system/logger/index.js";
+import { slugify } from "../../utils/slug.js";
+import type { Source } from "./types.js";
+import fs from "fs";
+
+// ── Constants ───────────────────────────────────────────────────
+
+const ARXIV_SLUG_PREFIX = "arxiv-auto-";
+const MAX_AUTO_SOURCES = 10;
+const DEFAULT_MAX_ITEMS = 20;
+
+// ── Query building ──────────────────────────────────────────────
+
+/**
+ * Build an arXiv query string from a list of keywords.
+ * Searches in title and abstract fields. Double quotes in keywords
+ * are stripped (not escaped) so the arXiv query stays valid.
+ * Example: ["transformer", "attention"] → 'ti:"transformer" OR abs:"transformer" OR ti:"attention" OR abs:"attention"'
+ */
+export function buildArxivQuery(keywords: readonly string[]): string {
+  const terms = keywords.flatMap((kw) => {
+    const stripped = kw.replace(/"/g, "");
+    return [`ti:"${stripped}"`, `abs:"${stripped}"`];
+  });
+  return terms.join(" OR ");
+}
+
+/**
+ * Generate a slug from keywords. Uses a short hash of all keywords
+ * to avoid collisions when chunks share the same leading words or
+ * when keywords are non-ASCII (CJK, etc.).
+ * Example: ["WebAssembly", "WASM"] → "arxiv-auto-webassembly-wasm-a1b2"
+ */
+export function keywordsToSlug(keywords: readonly string[]): string {
+  const latin = keywords
+    .map((kw) => slugify(kw, ""))
+    .filter((s) => s.length > 0)
+    .slice(0, 3)
+    .join("-");
+  // Short hash of ALL keywords ensures uniqueness even when the
+  // Latin portion is empty (non-ASCII) or identical across chunks.
+  const hash = crypto.createHash("sha256").update(keywords.join("|")).digest("hex").slice(0, 6);
+  const base = latin ? `${latin}-${hash}` : hash;
+  return `${ARXIV_SLUG_PREFIX}${base}`;
+}
+
+/**
+ * Generate a human-readable title from keywords.
+ */
+function keywordsToTitle(keywords: readonly string[]): string {
+  return `arXiv: ${keywords.join(", ")}`;
+}
+
+// ── Discovery ───────────────────────────────────────────────────
+
+export interface DiscoveryResult {
+  registered: string[];
+  skipped: string[];
+  reason: string | null;
+}
+
+/**
+ * Discover and register arXiv sources based on user interests.
+ * Groups all keywords into a single arXiv query source.
+ * Skips if the source already exists.
+ */
+export async function discoverAndRegister(root?: string): Promise<DiscoveryResult> {
+  const base = root ?? workspacePath;
+  const profile = loadInterests(base);
+  if (!profile || profile.keywords.length === 0) {
+    return { registered: [], skipped: [], reason: "no keywords in interests" };
+  }
+
+  // Ensure sources directory exists
+  const dir = sourcesRoot(base);
+  fs.mkdirSync(dir, { recursive: true });
+
+  const existing = await listSources(base);
+  const existingSlugs = new Set(existing.map((s) => s.slug));
+
+  const registered: string[] = [];
+  const skipped: string[] = [];
+
+  // Strategy: group keywords into chunks of ~5 for separate sources,
+  // or put them all in one if few enough
+  const chunks = chunkKeywords(profile.keywords, 5);
+
+  for (const chunk of chunks.slice(0, MAX_AUTO_SOURCES)) {
+    const slug = keywordsToSlug(chunk);
+
+    if (existingSlugs.has(slug)) {
+      skipped.push(slug);
+      continue;
+    }
+
+    const query = buildArxivQuery(chunk);
+    const source: Source = {
+      slug,
+      title: keywordsToTitle(chunk),
+      url: `https://arxiv.org/search/?query=${encodeURIComponent(chunk.join(" "))}`,
+      fetcherKind: "arxiv",
+      fetcherParams: {
+        arxiv_query: query,
+        arxiv_sort: "submittedDate",
+        arxiv_order: "descending",
+      },
+      schedule: "daily",
+      categories: profile.categories.length > 0 ? profile.categories : ["papers"],
+      maxItemsPerFetch: DEFAULT_MAX_ITEMS,
+      addedAt: new Date().toISOString(),
+      notes: `Auto-registered from interests.json keywords: ${chunk.join(", ")}`,
+    };
+
+    try {
+      await writeSource(base, source);
+      registered.push(slug);
+      existingSlugs.add(slug);
+      log.info("arxiv-discovery", "registered arXiv source", { slug, query });
+    } catch (err) {
+      log.warn("arxiv-discovery", "failed to register source", {
+        slug,
+        error: String(err),
+      });
+    }
+  }
+
+  return { registered, skipped, reason: null };
+}
+
+function chunkKeywords(keywords: readonly string[], size: number): string[][] {
+  const chunks: string[][] = [];
+  for (let i = 0; i < keywords.length; i += size) {
+    chunks.push(keywords.slice(i, i + size) as string[]);
+  }
+  return chunks;
+}
+
+/**
+ * Remove auto-registered arXiv sources that no longer match
+ * any keyword in the current interests profile.
+ */
+export async function pruneStaleAutoSources(root?: string): Promise<string[]> {
+  const base = root ?? workspacePath;
+  const profile = loadInterests(base);
+  const existing = await listSources(base);
+  const autoSources = existing.filter((s) => s.slug.startsWith(ARXIV_SLUG_PREFIX));
+
+  if (autoSources.length === 0) return [];
+
+  // If no profile at all, prune everything auto-registered
+  const currentKeywords = profile ? new Set(profile.keywords.map((k) => k.toLowerCase())) : new Set<string>();
+
+  const pruned: string[] = [];
+  for (const source of autoSources) {
+    const notes = (source.notes ?? "").toLowerCase();
+    const hasMatch = [...currentKeywords].some((kw) => notes.includes(kw));
+    if (!hasMatch && currentKeywords.size > 0) {
+      // Keywords changed — this source is stale but don't delete,
+      // just log. User can manually remove via manageSource.
+      log.info("arxiv-discovery", "stale auto-source detected", {
+        slug: source.slug,
+      });
+      pruned.push(source.slug);
+    }
+  }
+  return pruned;
+}