mulmoclaude 0.1.2 → 0.4.0

package/server/api/routes/html.ts

@@ -7,8 +7,8 @@ import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 const router = Router();
 
 async function callGemini(prompt: string): Promise<string> {
-  const ai = getGeminiClient();
-  const response = await ai.models.generateContent({
+  const client = getGeminiClient();
+  const response = await client.models.generateContent({
     model: "gemini-2.0-flash",
     contents: [{ text: prompt }],
   });

package/server/api/routes/image.ts

@@ -4,7 +4,7 @@ import { getSessionImageData } from "../../events/session-store/index.js";
 import { generateGeminiImageContent, generateGeminiImageFromPrompt } from "../../utils/gemini.js";
 import { errorMessage } from "../../utils/errors.js";
 import { badRequest, serverError } from "../../utils/httpError.js";
-import { saveImage, overwriteImage, loadImageBase64, stripDataUri, isImagePath } from "../../utils/files/image-store.js";
+import { saveImage, overwriteImage, loadImageBase64, stripDataUri, isImagePath, imagePathFromFilename } from "../../utils/files/image-store.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 
 const router = Router();
@@ -148,14 +148,14 @@ router.post(API_ROUTES.image.upload, async (req: Request<object, unknown, Canvas
 router.put(
   API_ROUTES.image.update,
   async (req: Request<{ filename: string }, unknown, CanvasImageBody>, res: Response<CanvasImageResponse | CanvasImageError>) => {
-    const relativePath = `images/${req.params.filename}`;
-    const { imageData } = req.body;
-    if (!imageData || !relativePath) {
-      badRequest(res, "imageData and path are required");
+    const relativePath = imagePathFromFilename(req.params.filename);
+    if (!relativePath) {
+      badRequest(res, "invalid image filename");
       return;
     }
-    if (!isImagePath(relativePath)) {
-      badRequest(res, "invalid image path");
+    const { imageData } = req.body;
+    if (!imageData) {
+      badRequest(res, "imageData is required");
       return;
     }
     const base64 = stripDataUri(imageData);

package/server/api/routes/mulmo-script.ts

@@ -1,8 +1,9 @@
 import { Router, Request, Response } from "express";
-import fs from "fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "fs";
 import path from "path";
 import { WORKSPACE_PATHS } from "../../workspace/paths.js";
 import { stripDataUri } from "../../utils/files/image-store.js";
+import { writeJsonAtomic } from "../../utils/files/json.js";
 import {
   getFileObject,
   initializeContextFromFiles,
@@ -26,6 +27,7 @@ import { slugify } from "../../utils/slug.js";
 import { resolveWithinRoot } from "../../utils/files/safe.js";
 import { errorMessage } from "../../utils/errors.js";
 import { badRequest, notFound, serverError } from "../../utils/httpError.js";
+import { getOptionalStringQuery } from "../../utils/request.js";
 import { log } from "../../system/logger/index.js";
 import { validateUpdateBeatBody, validateUpdateScriptBody } from "./mulmoScriptValidate.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
@@ -54,8 +56,8 @@ let storiesRealCache: string | null = null;
 function ensureStoriesReal(): string | null {
   if (storiesRealCache) return storiesRealCache;
   try {
-    fs.mkdirSync(storiesDir, { recursive: true });
-    storiesRealCache = fs.realpathSync(storiesDir);
+    mkdirSync(storiesDir, { recursive: true });
+    storiesRealCache = realpathSync(storiesDir);
     return storiesRealCache;
   } catch {
     return null;
@@ -96,7 +98,7 @@ interface FilePathQuery {
   filePath?: string;
 }
 
-router.post(API_ROUTES.mulmoScript.save, (req: Request<object, object, SaveMulmoScriptBody>, res: Response) => {
+router.post(API_ROUTES.mulmoScript.save, async (req: Request<object, object, SaveMulmoScriptBody>, res: Response) => {
   const { script, filename } = req.body;
 
   if (!script || !Array.isArray(script.beats)) {
@@ -104,14 +106,14 @@ router.post(API_ROUTES.mulmoScript.save, (req: Request<object, object, SaveMulmo
     return;
   }
 
-  fs.mkdirSync(storiesDir, { recursive: true });
+  mkdirSync(storiesDir, { recursive: true });
 
   const title = script.title || "untitled";
   const slug = filename ? filename.replace(/\.json$/, "") : slugify(title);
   const fname = `${slug}-${Date.now()}.json`;
   const filePath = path.join(storiesDir, fname);
 
-  fs.writeFileSync(filePath, JSON.stringify(script, null, 2));
+  await writeJsonAtomic(filePath, script);
 
   res.json({
     data: { script, filePath: `stories/${fname}` },
@@ -120,7 +122,7 @@ router.post(API_ROUTES.mulmoScript.save, (req: Request<object, object, SaveMulmo
   });
 });
 
-router.post(API_ROUTES.mulmoScript.updateBeat, (req: Request<object, object, unknown>, res: Response) => {
+router.post(API_ROUTES.mulmoScript.updateBeat, async (req: Request<object, object, unknown>, res: Response) => {
   const validation = validateUpdateBeatBody(req.body);
   if (!validation.ok) {
     badRequest(res, validation.error);
@@ -131,7 +133,7 @@ router.post(API_ROUTES.mulmoScript.updateBeat, (req: Request<object, object, unk
   const absoluteFilePath = resolveStoryPath(filePath, res);
   if (!absoluteFilePath) return;
 
-  const script: MulmoScript = JSON.parse(fs.readFileSync(absoluteFilePath, "utf-8"));
+  const script: MulmoScript = JSON.parse(readFileSync(absoluteFilePath, "utf-8"));
 
   if (!Array.isArray(script.beats) || beatIndex >= script.beats.length) {
     badRequest(res, "Invalid beatIndex");
@@ -139,12 +141,12 @@ router.post(API_ROUTES.mulmoScript.updateBeat, (req: Request<object, object, unk
   }
 
   script.beats[beatIndex] = beat as MulmoBeat;
-  fs.writeFileSync(absoluteFilePath, JSON.stringify(script, null, 2));
+  await writeJsonAtomic(absoluteFilePath, script);
 
   res.json({ ok: true });
 });
 
-router.post(API_ROUTES.mulmoScript.updateScript, (req: Request<object, object, unknown>, res: Response) => {
+router.post(API_ROUTES.mulmoScript.updateScript, async (req: Request<object, object, unknown>, res: Response) => {
   const validation = validateUpdateScriptBody(req.body);
   if (!validation.ok) {
     badRequest(res, validation.error);
@@ -155,7 +157,7 @@ router.post(API_ROUTES.mulmoScript.updateScript, (req: Request<object, object, u
   const absoluteFilePath = resolveStoryPath(filePath, res);
   if (!absoluteFilePath) return;
 
-  fs.writeFileSync(absoluteFilePath, JSON.stringify(updatedScript, null, 2));
+  await writeJsonAtomic(absoluteFilePath, updatedScript);
   res.json({ ok: true });
 });
 
@@ -170,7 +172,7 @@ router.get(API_ROUTES.mulmoScript.beatImage, async (req: Request<object, BeatIma
 
   await withStoryContext(res, filePath, {}, async ({ context }) => {
     const { imagePath } = getBeatPngImagePath(context, beatIndex);
-    if (!fs.existsSync(imagePath)) {
+    if (!existsSync(imagePath)) {
       res.json({ image: null });
       return;
     }
@@ -197,13 +199,13 @@ router.get(API_ROUTES.mulmoScript.movieStatus, async (req: Request<object, Movie
     }
 
     const outputPath = movieFilePath(context);
-    if (!fs.existsSync(outputPath)) {
+    if (!existsSync(outputPath)) {
       res.json({ moviePath: null });
       return;
     }
 
-    const movieMtime = fs.statSync(outputPath).mtimeMs;
-    const sourceMtime = fs.statSync(absoluteFilePath).mtimeMs;
+    const movieMtime = statSync(outputPath).mtimeMs;
+    const sourceMtime = statSync(absoluteFilePath).mtimeMs;
     if (movieMtime < sourceMtime) {
       res.json({ moviePath: null });
       return;
@@ -216,7 +218,7 @@ router.get(API_ROUTES.mulmoScript.movieStatus, async (req: Request<object, Movie
 });
 
 function fileToDataUri(filePath: string, mimeType: string): string {
-  const data = fs.readFileSync(filePath);
+  const data = readFileSync(filePath);
   return `data:${mimeType};base64,${data.toString("base64")}`;
 }
 
@@ -257,7 +259,7 @@ function resolveStoryPath(filePath: string, res: Response): string | null {
   const resolved = resolveWithinRoot(storiesReal, relFromStories);
   if (!resolved) {
     const candidate = path.resolve(storiesReal, relFromStories);
-    if (!fs.existsSync(candidate)) {
+    if (!existsSync(candidate)) {
       notFound(res, `File not found: ${filePath}`);
     } else {
       badRequest(res, "Invalid filePath");
@@ -373,12 +375,12 @@ router.get(API_ROUTES.mulmoScript.beatAudio, async (req: Request<object, BeatAud
     filePath,
     {
       operation: "beat-audio",
-      onContextMissing: (r) => r.json({ audio: null }),
+      onContextMissing: (response) => response.json({ audio: null }),
     },
     async ({ context }) => {
       const beat = context.studio.script.beats[beatIndex];
       const audioPath = getBeatAudioPathOrUrl(beat.text ?? "", context, beat, context.lang);
-      if (!audioPath || !fs.existsSync(audioPath)) {
+      if (!audioPath || !existsSync(audioPath)) {
         res.json({ audio: null });
         return;
       }
@@ -422,7 +424,7 @@ router.post(
           const beat = context.studio.script.beats[beatIndex];
           const audioPath = context.studio.beats[beatIndex]?.audioFile ?? getBeatAudioPathOrUrl(beat.text ?? "", context, beat, context.lang);
 
-          if (!audioPath || !fs.existsSync(audioPath)) {
+          if (!audioPath || !existsSync(audioPath)) {
             // Logic-flow failure (not an exception) — emit a targeted
             // log. Don't write raw `beat.text` into persistent logs —
             // it's free-form user content and can contain sensitive
@@ -430,7 +432,7 @@ router.post(
             log.error("generate-beat-audio", "audio was not generated", {
               beatIndex,
               audioPath,
-              exists: audioPath ? fs.existsSync(audioPath) : false,
+              exists: audioPath ? existsSync(audioPath) : false,
               beatTextLength: typeof beat?.text === "string" ? beat.text.length : 0,
               audioFilePresent: Boolean(context.studio.beats[beatIndex]?.audioFile),
             });
@@ -475,7 +477,7 @@ router.post(API_ROUTES.mulmoScript.renderBeat, async (req: Request<object, objec
         });
 
         const { imagePath } = getBeatPngImagePath(context, beatIndex);
-        if (!fs.existsSync(imagePath)) {
+        if (!existsSync(imagePath)) {
           genError = "Image was not generated";
           serverError(res, genError);
           return;
@@ -542,7 +544,7 @@ router.post(API_ROUTES.mulmoScript.generateMovie, async (req: Request<object, ob
       await movie(audioContext);
 
       const outputPath = movieFilePath(audioContext);
-      if (!fs.existsSync(outputPath)) {
+      if (!existsSync(outputPath)) {
         genError = "Movie was not generated";
         send({ type: "error", message: genError });
         res.end();
@@ -594,7 +596,7 @@ router.get(
 
     await withStoryContext(res, filePath, {}, async ({ context }) => {
       const imagePath = getReferenceImagePath(context, key, "png");
-      if (!fs.existsSync(imagePath)) {
+      if (!existsSync(imagePath)) {
         res.json({ image: null });
         return;
       }
@@ -613,10 +615,10 @@ router.post(API_ROUTES.mulmoScript.uploadBeatImage, async (req: Request<object,
 
   await withStoryContext(res, filePath, {}, async ({ context }) => {
     const { imagePath } = getBeatPngImagePath(context, beatIndex);
-    fs.mkdirSync(path.dirname(imagePath), { recursive: true });
+    mkdirSync(path.dirname(imagePath), { recursive: true });
 
     const base64 = stripDataUri(imageData);
-    fs.writeFileSync(imagePath, Buffer.from(base64, "base64"));
+    writeFileSync(imagePath, Buffer.from(base64, "base64"));
 
     res.json({ image: fileToDataUri(imagePath, "image/png") });
   });
@@ -647,7 +649,7 @@ router.post(
 
           const index = Object.keys(images).indexOf(key);
           const imagePath = getReferenceImagePath(context, key, "png");
-          fs.mkdirSync(path.dirname(imagePath), { recursive: true });
+          mkdirSync(path.dirname(imagePath), { recursive: true });
 
           await generateReferenceImage({
             context,
@@ -656,7 +658,7 @@ router.post(
             image: imageEntry as MulmoImagePromptMedia,
             force,
           });
-          if (!fs.existsSync(imagePath)) {
+          if (!existsSync(imagePath)) {
             genError = "Character image was not generated";
             serverError(res, genError);
             return;
@@ -685,10 +687,10 @@ router.post(
 
     await withStoryContext(res, filePath, {}, async ({ context }) => {
       const imagePath = getReferenceImagePath(context, key, "png");
-      fs.mkdirSync(path.dirname(imagePath), { recursive: true });
+      mkdirSync(path.dirname(imagePath), { recursive: true });
 
       const base64 = stripDataUri(imageData);
-      fs.writeFileSync(imagePath, Buffer.from(base64, "base64"));
+      writeFileSync(imagePath, Buffer.from(base64, "base64"));
 
       res.json({ image: fileToDataUri(imagePath, "image/png") });
     });
@@ -696,7 +698,7 @@ router.post(
 );
 
 router.get(API_ROUTES.mulmoScript.downloadMovie, (req: Request, res: Response) => {
-  const moviePath = typeof req.query.moviePath === "string" ? req.query.moviePath : undefined;
+  const moviePath = getOptionalStringQuery(req, "moviePath");
 
   if (!moviePath) {
     badRequest(res, "moviePath is required");

package/server/api/routes/pdf.ts

@@ -1,4 +1,4 @@
-import fs from "fs";
+import { realpathSync } from "fs";
 import path from "path";
 import { Router, Request, Response } from "express";
 import { marked } from "marked";
@@ -56,7 +56,7 @@ const MIME_BY_EXT: Record<string, string> = {
 // Realpath of the workspace, resolved once at module load. Used to
 // validate that image paths resolved relative to markdowns/ stay
 // inside the workspace after symlink resolution.
-const workspaceReal = fs.realpathSync(resolveWorkspacePath(""));
+const workspaceReal = realpathSync(resolveWorkspacePath(""));
 
 /**
  * Inline local images as base64 data URIs so Puppeteer can render them.

package/server/api/routes/plugins.ts

@@ -80,10 +80,10 @@ async function fillImagePlaceholders(markdown: string): Promise<string> {
   }
 
   const results = await Promise.all(
-    matches.map(async (m) => ({
-      full: m[0],
-      prompt: m[1],
-      url: geminiOk ? await generateImageFile(m[1]) : null,
+    matches.map(async (match) => ({
+      full: match[0],
+      prompt: match[1],
+      url: geminiOk ? await generateImageFile(match[1]) : null,
     })),
   );
 
@@ -91,7 +91,7 @@ async function fillImagePlaceholders(markdown: string): Promise<string> {
   // success rate even when most calls go through. The per-call
   // error already lands at warn from generateImageFile's catch.
   if (geminiOk) {
-    const failed = results.filter((r) => !r.url).length;
+    const failed = results.filter((result) => !result.url).length;
     if (failed > 0) {
       log.warn("present-document", "image generation had failures", {
         failed,
@@ -261,10 +261,20 @@ router.post(
   wrapPluginExecute((req) => executeForm(null as never, req.body)),
 );
 
+// 1×1 transparent PNG. Used as a placeholder so the canvas tool
+// result can carry a stable file path from the moment the canvas
+// is opened — client autosaves PUT-overwrite this same file, so the
+// drawing survives page reload with zero client→server sync.
+const BLANK_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkAAIAAAoAAv/lxKUAAAAASUVORK5CYII=";
+
 // openCanvas — drawing canvas
 router.post(
   API_ROUTES.plugins.canvas,
-  wrapPluginExecute(() => executeOpenCanvas()),
+  wrapPluginExecute(async () => {
+    const imagePath = await saveImage(BLANK_PNG_BASE64);
+    const base = await executeOpenCanvas();
+    return { ...base, data: { imageData: imagePath, prompt: "" } };
+  }),
 );
 
 // present3d — 3D visualization

package/server/api/routes/roles.ts

@@ -7,7 +7,7 @@ import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { EVENT_TYPES } from "../../../src/types/events.js";
 import { roleExists, deleteRole, saveRole } from "../../utils/files/roles-io.js";
 
-const BUILTIN_IDS = new Set(BUILTIN_ROLES.map((r) => r.id));
+const BUILTIN_IDS = new Set(BUILTIN_ROLES.map((role) => role.id));
 
 const router = Router();
 
@@ -98,7 +98,7 @@ function saveRoleResult(input: ManageRolesInput, sessionId: string): Record<stri
   const pluginsToSave = role.availablePlugins ?? [];
   const roleToSave = {
     ...role,
-    availablePlugins: pluginsToSave.filter((p) => p !== "switchRole"),
+    availablePlugins: pluginsToSave.filter((plugin) => plugin !== "switchRole"),
   };
 
   saveRole(role.id, roleToSave);

package/server/api/routes/scheduler.ts

@@ -9,6 +9,8 @@ import { saveUserTasks } from "../../utils/files/user-tasks-io.js";
 import { startChat } from "./agent.js";
 import { log } from "../../system/logger/index.js";
 import { SCHEDULER_ACTIONS, TASK_ACTIONS } from "../../../src/config/schedulerActions.js";
+import { badRequest, notFound, serverError } from "../../utils/httpError.js";
+import { errorMessage } from "../../utils/errors.js";
 
 const router = Router();
 
@@ -77,7 +79,7 @@ async function handleTaskAction(action: string, input: Record<string, unknown>,
     if (action === SCHEDULER_ACTIONS.createTask) {
       const result = validateAndCreate(input);
       if (result.kind === "error") {
-        res.status(400).json({ error: result.error });
+        badRequest(res, result.error);
         return;
       }
       const tasks = loadUserTasks();
@@ -93,11 +95,11 @@ async function handleTaskAction(action: string, input: Record<string, unknown>,
     }
 
     if (action === SCHEDULER_ACTIONS.deleteTask) {
-      const id = typeof input.id === "string" ? input.id : "";
+      const taskId = typeof input.id === "string" ? input.id : "";
       const tasks = loadUserTasks();
-      const idx = tasks.findIndex((t) => t.id === id);
+      const idx = tasks.findIndex((task) => task.id === taskId);
       if (idx === -1) {
-        res.status(404).json({ error: `task not found: ${id}` });
+        notFound(res, `task not found: ${taskId}`);
         return;
       }
       const name = tasks[idx].name;
@@ -107,17 +109,17 @@ async function handleTaskAction(action: string, input: Record<string, unknown>,
       res.json({
         uuid: crypto.randomUUID(),
         message: `Task "${name}" deleted.`,
-        data: { deleted: id },
+        data: { deleted: taskId },
       });
       return;
     }
 
     if (action === SCHEDULER_ACTIONS.runTask) {
-      const id = typeof input.id === "string" ? input.id : "";
+      const taskId = typeof input.id === "string" ? input.id : "";
       const tasks = loadUserTasks();
-      const task = tasks.find((t) => t.id === id);
+      const task = tasks.find((candidate) => candidate.id === taskId);
       if (!task) {
-        res.status(404).json({ error: `task not found: ${id}` });
+        notFound(res, `task not found: ${taskId}`);
         return;
       }
       const chatSessionId = crypto.randomUUID();
@@ -138,15 +140,15 @@ async function handleTaskAction(action: string, input: Record<string, unknown>,
       res.json({
         uuid: crypto.randomUUID(),
         message: `Task "${task.name}" triggered.`,
-        data: { triggered: id, chatSessionId },
+        data: { triggered: taskId, chatSessionId },
       });
       return;
     }
 
-    res.status(400).json({ error: `unknown task action: ${action}` });
+    badRequest(res, `unknown task action: ${action}`);
   } catch (err) {
-    log.error("scheduler", "task action failed", { error: String(err) });
-    res.status(500).json({ error: "Internal server error" });
+    log.error("scheduler", "task action failed", { error: errorMessage(err) });
+    serverError(res, "Internal server error");
   }
 }
 

package/server/api/routes/schedulerHandlers.ts

@@ -29,14 +29,14 @@ export type SchedulerActionResult =
     };
 
 export function sortItems(items: ScheduledItem[]): ScheduledItem[] {
-  return [...items].sort((a, b) => {
-    const aDate = typeof a.props.date === "string" ? a.props.date : null;
-    const bDate = typeof b.props.date === "string" ? b.props.date : null;
-    const aTime = typeof a.props.time === "string" ? a.props.time : "00:00";
-    const bTime = typeof b.props.time === "string" ? b.props.time : "00:00";
-    const aKey = aDate ? `0_${aDate}_${aTime}` : `1_${a.createdAt}`;
-    const bKey = bDate ? `0_${bDate}_${bTime}` : `1_${b.createdAt}`;
-    return aKey < bKey ? -1 : aKey > bKey ? 1 : 0;
+  return [...items].sort((left, right) => {
+    const leftDate = typeof left.props.date === "string" ? left.props.date : null;
+    const rightDate = typeof right.props.date === "string" ? right.props.date : null;
+    const leftTime = typeof left.props.time === "string" ? left.props.time : "00:00";
+    const rightTime = typeof right.props.time === "string" ? right.props.time : "00:00";
+    const leftKey = leftDate ? `0_${leftDate}_${leftTime}` : `1_${left.createdAt}`;
+    const rightKey = rightDate ? `0_${rightDate}_${rightTime}` : `1_${right.createdAt}`;
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
   });
 }
 
@@ -84,11 +84,11 @@ export function handleDelete(items: ScheduledItem[], input: SchedulerActionInput
 
 function applyPropPatch(current: ScheduledItem["props"], patch: Record<string, string | number | boolean | null>): ScheduledItem["props"] {
   const next: ScheduledItem["props"] = { ...current };
-  for (const [k, v] of Object.entries(patch)) {
-    if (v === null) {
-      delete next[k];
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === null) {
+      delete next[key];
     } else {
-      next[k] = v;
+      next[key] = value;
     }
   }
   return next;

package/server/api/routes/schedulerTasks.ts

@@ -15,6 +15,7 @@ import { SESSION_ORIGINS } from "../../../src/types/session.js";
 import { loadUserTasks, validateAndCreate, applyUpdate, withUserTaskLock } from "../../workspace/skills/user-tasks.js";
 import { badRequest, notFound, serverError } from "../../utils/httpError.js";
 import { errorMessage } from "../../utils/errors.js";
+import { getOptionalStringQuery } from "../../utils/request.js";
 import { log } from "../../system/logger/index.js";
 import { startChat } from "./agent.js";
 
@@ -29,7 +30,7 @@ router.get(API_ROUTES.scheduler.tasks, (_req: Request, res: Response) => {
   // have no origin field of their own.
   const systemTasks = getSchedulerTasks();
   const userTasks = loadUserTasks();
-  const all = [...systemTasks.map((t) => ({ ...t, origin: "system" as const })), ...userTasks.map((t) => ({ ...t, origin: "user" as const }))];
+  const all = [...systemTasks.map((task) => ({ ...task, origin: "system" as const })), ...userTasks.map((task) => ({ ...task, origin: "user" as const }))];
   res.json({ tasks: all });
 });
 
@@ -58,14 +59,14 @@ router.post(API_ROUTES.scheduler.tasks, async (req: Request, res: Response) => {
 // ── Update user task ────────────────────────────────────────────
 
 router.put(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, res: Response) => {
-  const { id } = req.params;
+  const { id: taskId } = req.params;
   try {
     const updated = await withUserTaskLock(async (tasks) => {
-      const result = applyUpdate(tasks, id, req.body);
+      const result = applyUpdate(tasks, taskId, req.body);
       if (result.kind === "error") {
         throw new Error(result.error);
       }
-      const task = result.tasks.find((t) => t.id === id);
+      const task = result.tasks.find((taskItem) => taskItem.id === taskId);
       return { tasks: result.tasks, result: task };
     });
     res.json({ task: updated });
@@ -83,15 +84,15 @@ router.put(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, res:
 // ── Delete user task ────────────────────────────────────────────
 
 router.delete(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, res: Response) => {
-  const { id } = req.params;
+  const { id: taskId } = req.params;
   try {
     await withUserTaskLock(async (tasks) => {
-      const idx = tasks.findIndex((t) => t.id === id);
-      if (idx === -1) throw new Error(`task not found: ${id}`);
-      const next = tasks.filter((t) => t.id !== id);
+      const index = tasks.findIndex((task) => task.id === taskId);
+      if (index === -1) throw new Error(`task not found: ${taskId}`);
+      const next = tasks.filter((task) => task.id !== taskId);
       return { tasks: next, result: undefined };
     });
-    res.json({ deleted: id });
+    res.json({ deleted: taskId });
   } catch (err) {
     const msg = errorMessage(err);
     if (msg.startsWith("task not found")) {
@@ -106,10 +107,10 @@ router.delete(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, re
 // ── Manual trigger ──────────────────────────────────────────────
 
 router.post(API_ROUTES.scheduler.taskRun, async (req: Request<{ id: string }>, res: Response) => {
-  const { id } = req.params;
+  const { id: taskId } = req.params;
   // Check user tasks first
   const userTasks = loadUserTasks();
-  const userTask = userTasks.find((t) => t.id === id);
+  const userTask = userTasks.find((task) => task.id === taskId);
   if (userTask) {
     const chatSessionId = crypto.randomUUID();
     log.info("scheduler-tasks", "manual run (user task)", {
@@ -126,14 +127,14 @@ router.post(API_ROUTES.scheduler.taskRun, async (req: Request<{ id: string }>, r
         error: String(err),
       });
     });
-    res.json({ triggered: id, chatSessionId });
+    res.json({ triggered: taskId, chatSessionId });
     return;
   }
   // Not a user task — check system/skill tasks
   const systemTasks = getSchedulerTasks();
-  const found = systemTasks.find((t) => t.id === id);
+  const found = systemTasks.find((task) => task.id === taskId);
   if (!found) {
-    notFound(res, `task not found: ${id}`);
+    notFound(res, `task not found: ${taskId}`);
     return;
   }
   // System tasks don't have a prompt to startChat with — return 400
@@ -150,11 +151,12 @@ interface LogQuery {
 
 router.get(API_ROUTES.scheduler.logs, async (req: Request<object, unknown, object, LogQuery>, res: Response<{ logs: TaskLogEntry[] }>) => {
   const MAX_LIMIT = 500;
-  const rawLimit = typeof req.query.limit === "string" ? parseInt(req.query.limit, 10) : undefined;
+  const rawLimitStr = getOptionalStringQuery(req, "limit");
+  const rawLimit = rawLimitStr ? parseInt(rawLimitStr, 10) : undefined;
   const limit = Number.isFinite(rawLimit) && rawLimit! > 0 ? Math.min(rawLimit!, MAX_LIMIT) : undefined;
   const logs = await getSchedulerLogs({
-    since: typeof req.query.since === "string" ? req.query.since : undefined,
-    taskId: typeof req.query.taskId === "string" ? req.query.taskId : undefined,
+    since: getOptionalStringQuery(req, "since"),
+    taskId: getOptionalStringQuery(req, "taskId"),
     limit,
   });
   res.json({ logs });