mulmoclaude 0.3.0 → 0.4.0

package/src/plugins/wiki/View.vue

@@ -3,48 +3,53 @@
     <!-- Header -->
     <div class="flex items-center justify-between px-6 py-4 border-b border-gray-100 shrink-0">
       <div class="flex items-center gap-3">
-        <button v-if="action !== 'index'" class="text-gray-400 hover:text-gray-700" title="Back to index" @click="navigate('index')">
+        <button v-if="action !== 'index'" class="text-gray-400 hover:text-gray-700" :title="t('pluginWiki.backToIndex')" @click="router.back()">
           <span class="material-icons text-base">arrow_back</span>
         </button>
         <h2 class="text-lg font-semibold text-gray-800">{{ title }}</h2>
       </div>
       <div class="flex gap-1 items-center">
         <template v-if="action === 'page' && content">
+          <div class="button-group">
+            <button class="download-btn download-btn-green" :disabled="pdfDownloading" @click="downloadPdf">
+              <span class="material-icons">{{ pdfDownloading ? "hourglass_empty" : "download" }}</span>
+              {{ t("pluginWiki.pdf") }}
+            </button>
+          </div>
+          <span v-if="pdfError" class="text-xs text-red-500 self-center ml-2" :title="pdfError">{{ t("pluginWiki.pdfFailed") }}</span>
+        </template>
+        <div class="flex border border-gray-300 rounded overflow-hidden text-xs">
           <button
-            class="px-3 py-1 text-xs rounded-full border transition-colors border-gray-200 text-gray-500 hover:bg-gray-50 disabled:opacity-40 w-16 flex items-center justify-center gap-1"
-            :disabled="pdfDownloading"
-            @click="downloadPdf"
+            :class="[
+              'px-2.5 py-1 flex items-center gap-1 border-r border-gray-200 last:border-r-0 transition-colors',
+              action === 'index' ? 'bg-blue-50 text-blue-600 font-medium' : 'bg-white text-gray-600 hover:bg-gray-50',
+            ]"
+            @click="navigate('index')"
           >
-            <svg v-if="pdfDownloading" class="animate-spin w-3 h-3 shrink-0" viewBox="0 0 24 24" fill="none">
-              <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
-              <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8v8H4z" />
-            </svg>
-            <span v-else>↓ PDF</span>
-            <span v-if="pdfDownloading">PDF</span>
+            <span class="material-icons text-sm">list</span>
+            <span>{{ t("pluginWiki.tabIndex") }}</span>
           </button>
-          <span v-if="pdfError" class="text-xs text-red-500" :title="pdfError">⚠ PDF failed</span>
-        </template>
-        <button
-          class="px-3 py-1 text-xs rounded-full border transition-colors"
-          :class="action === 'index' ? 'border-blue-400 bg-blue-50 text-blue-700' : 'border-gray-200 text-gray-500 hover:bg-gray-50'"
-          @click="navigate('index')"
-        >
-          Index
-        </button>
-        <button
-          class="px-3 py-1 text-xs rounded-full border transition-colors"
-          :class="action === 'log' ? 'border-blue-400 bg-blue-50 text-blue-700' : 'border-gray-200 text-gray-500 hover:bg-gray-50'"
-          @click="navigate('log')"
-        >
-          Log
-        </button>
-        <button
-          class="px-3 py-1 text-xs rounded-full border transition-colors"
-          :class="action === 'lint_report' ? 'border-blue-400 bg-blue-50 text-blue-700' : 'border-gray-200 text-gray-500 hover:bg-gray-50'"
-          @click="navigate('lint_report')"
-        >
-          Lint
-        </button>
+          <button
+            :class="[
+              'px-2.5 py-1 flex items-center gap-1 border-r border-gray-200 last:border-r-0 transition-colors',
+              action === 'log' ? 'bg-blue-50 text-blue-600 font-medium' : 'bg-white text-gray-600 hover:bg-gray-50',
+            ]"
+            @click="navigate('log')"
+          >
+            <span class="material-icons text-sm">history</span>
+            <span>{{ t("pluginWiki.tabLog") }}</span>
+          </button>
+          <button
+            :class="[
+              'px-2.5 py-1 flex items-center gap-1 border-r border-gray-200 last:border-r-0 transition-colors',
+              action === 'lint_report' ? 'bg-blue-50 text-blue-600 font-medium' : 'bg-white text-gray-600 hover:bg-gray-50',
+            ]"
+            @click="navigate('lint_report')"
+          >
+            <span class="material-icons text-sm">rule</span>
+            <span>{{ t("pluginWiki.tabLint") }}</span>
+          </button>
+        </div>
       </div>
     </div>
 
@@ -57,42 +62,86 @@
     <div v-if="!content && !navError" class="flex-1 flex items-center justify-center text-gray-400 text-sm">
       <div class="text-center space-y-2">
         <span class="material-icons text-4xl text-gray-300">menu_book</span>
-        <p>Wiki is empty. Ask the Wiki Manager to ingest a source.</p>
+        <p>{{ t("pluginWiki.empty") }}</p>
       </div>
     </div>
 
     <!-- Index: page card list -->
-    <div v-else-if="action === 'index' && pageEntries && pageEntries.length > 0" class="flex-1 overflow-y-auto p-4 space-y-2">
+    <div v-else-if="action === 'index' && pageEntries && pageEntries.length > 0" class="flex-1 overflow-y-auto">
       <div
         v-for="entry in pageEntries"
         :key="entry.slug"
-        class="rounded-lg border border-gray-200 p-3 cursor-pointer hover:border-blue-300 hover:bg-blue-50 transition-colors"
+        class="flex items-baseline gap-2 px-4 py-1 cursor-pointer hover:bg-blue-50 transition-colors"
+        :data-testid="`wiki-page-entry-${entry.slug || entry.title}`"
         @click="navigatePage(entry.slug || entry.title)"
       >
-        <div class="font-medium text-sm text-gray-800">{{ entry.title }}</div>
-        <div v-if="entry.description" class="text-xs text-gray-500 mt-0.5">
+        <span class="font-medium text-sm text-gray-800 shrink-0">{{ entry.title }}</span>
+        <span v-if="entry.description" class="text-xs text-gray-500 truncate">
           {{ entry.description }}
-        </div>
+        </span>
       </div>
     </div>
 
     <!-- Markdown content -->
     <div v-else class="flex-1 overflow-y-auto px-6 py-4 prose prose-sm max-w-none wiki-content" @click="handleContentClick" v-html="renderedContent" />
+
+    <!-- Per-page chat composer (standalone /wiki route only). Sending
+         spawns a fresh chat session with a prepended "read this page
+         first" instruction — see AppApi.startNewChat. Hidden when
+         WikiView is mounted as a manageWiki tool result inside /chat:
+         the enclosing chat already has its own composer, and spawning
+         a nested new session from there is confusing. -->
+    <div v-if="action === 'page' && content && isStandaloneWikiRoute" class="border-t border-gray-200 px-4 py-3 shrink-0 bg-gray-50">
+      <div class="flex gap-2">
+        <textarea
+          v-model="chatDraft"
+          data-testid="wiki-page-chat-input"
+          :placeholder="t('pluginWiki.chatPlaceholder')"
+          rows="2"
+          class="flex-1 bg-white border border-gray-300 rounded px-3 py-2 text-sm text-gray-900 placeholder-gray-400 resize-none"
+          @compositionstart="imeEnter.onCompositionStart"
+          @compositionend="imeEnter.onCompositionEnd"
+          @keydown="imeEnter.onKeydown"
+          @blur="imeEnter.onBlur"
+        />
+        <button
+          data-testid="wiki-page-chat-send"
+          class="bg-blue-600 hover:bg-blue-700 text-white rounded w-8 h-8 flex items-center justify-center shrink-0 disabled:opacity-50 disabled:cursor-not-allowed self-start"
+          :title="t('pluginWiki.chatSend')"
+          :disabled="!canSendChat"
+          @click="submitChat"
+        >
+          <span class="material-icons text-base leading-none">send</span>
+        </button>
+      </div>
+    </div>
   </div>
 </template>
 
 <script setup lang="ts">
-import { computed, ref, watch } from "vue";
+import { computed, onMounted, ref, watch } from "vue";
+import { useRoute, useRouter, isNavigationFailure } from "vue-router";
+import { useI18n } from "vue-i18n";
 import { marked } from "marked";
 import type { ToolResultComplete } from "gui-chat-protocol/vue";
 import type { WikiData, WikiPageEntry } from "./index";
 import { handleExternalLinkClick } from "../../utils/dom/externalLink";
 import { useFreshPluginData } from "../../composables/useFreshPluginData";
+import { useImeAwareEnter } from "../../composables/useImeAwareEnter";
+import { usePdfDownload } from "../../composables/usePdfDownload";
+import { useAppApi } from "../../composables/useAppApi";
 import { renderWikiLinks } from "./helpers";
 import { rewriteMarkdownImageRefs } from "../../utils/image/rewriteMarkdownImageRefs";
-import { apiPost, apiFetchRaw } from "../../utils/api";
+import { apiPost } from "../../utils/api";
 import { API_ROUTES } from "../../config/apiRoutes";
-import { errorMessage } from "../../utils/errors";
+import { PAGE_ROUTES } from "../../router";
+import { WIKI_ACTION, WIKI_ROUTE_SECTION, buildWikiRouteParams, isSafeWikiSlug, readWikiRouteTarget, wikiActionFor, type WikiTarget } from "./route";
+
+type WikiTabView = typeof WIKI_ACTION.log | typeof WIKI_ACTION.lintReport;
+
+const route = useRoute();
+const router = useRouter();
+const { t } = useI18n();
 
 const props = defineProps<{
   selectedResult?: ToolResultComplete<WikiData>;
@@ -104,8 +153,14 @@ const action = ref(props.selectedResult?.data?.action ?? "index");
 const title = ref(props.selectedResult?.data?.title ?? "Wiki");
 const content = ref(props.selectedResult?.data?.content ?? "");
 const pageEntries = ref<WikiPageEntry[]>(props.selectedResult?.data?.pageEntries ?? []);
+// Declared up here — not next to callApi — because the URL watcher
+// below fires with `immediate: true`, which invokes callApi
+// synchronously during setup. If this ref were declared after the
+// watcher, callApi's `navError.value = null` would hit the TDZ on
+// direct loads of /wiki and the fetch would never run.
+const navError = ref<string | null>(null);
 
-const { refresh } = useFreshPluginData<WikiData>({
+const { refresh, abort: abortFreshFetch } = useFreshPluginData<WikiData>({
   // Slug-aware: when the view is currently showing a specific page,
   // fetch that page by slug; otherwise fetch the index.
   endpoint: () => {
@@ -121,6 +176,15 @@ const { refresh } = useFreshPluginData<WikiData>({
   },
 });
 
+onMounted(() => {
+  // On /wiki, the route watcher below fires with `immediate: true` and
+  // is the source of truth for the initial fetch (via POST callApi).
+  // useFreshPluginData's mount fetch is GET-only and always returns
+  // the index payload — if it resolves last, it clobbers log / lint /
+  // page state. Cancel it here so the two can't race.
+  if (route.name === PAGE_ROUTES.wiki) abortFreshFetch();
+});
+
 watch(
   () => props.selectedResult?.uuid,
   () => {
@@ -135,6 +199,30 @@ watch(
   },
 );
 
+// URL is the single source of truth for wiki navigation. Button
+// handlers push to the router; this watcher drives callApi(). Only
+// runs when WikiView is mounted as the /wiki page — when mounted as
+// a manageWiki tool-result inside /chat, the tool-result watcher
+// above seeds state and this watcher does nothing. Unsafe params
+// (e.g. `/wiki/pages/..%2Fsecrets` decoded to `slug === "../secrets"`)
+// are already intercepted by the router guard in `router/guards.ts`
+// and redirected to `/wiki`; by the time the watcher fires, the
+// params are known-safe. `readWikiRouteTarget` returning `null` here
+// therefore means an unexpected shape — fall back to the index view.
+watch(
+  () => (route.name === PAGE_ROUTES.wiki ? [route.params.section, route.params.slug] : null),
+  (params) => {
+    if (!params) return;
+    const target = readWikiRouteTarget({ section: params[0], slug: params[1] }) ?? { kind: "index" };
+    if (target.kind === "page") {
+      callApi({ action: WIKI_ACTION.page, pageName: target.slug });
+    } else {
+      callApi({ action: wikiActionFor(target) });
+    }
+  },
+  { immediate: true },
+);
+
 const renderedContent = computed(() => {
   if (!content.value) return "";
   // Rewrite workspace-relative image refs (`![alt](images/foo.png)`)
@@ -147,9 +235,11 @@ const renderedContent = computed(() => {
   return marked.parse(renderWikiLinks(withImages)) as string;
 });
 
-const navError = ref<string | null>(null);
-const pdfDownloading = ref(false);
-const pdfError = ref<string | null>(null);
+const { pdfDownloading, pdfError, downloadPdf: rawDownloadPdf } = usePdfDownload();
+
+async function downloadPdf() {
+  await rawDownloadPdf(content.value, `${title.value}.pdf`);
+}
 
 async function callApi(body: Record<string, unknown>) {
   navError.value = null;
@@ -180,48 +270,54 @@ async function callApi(body: Record<string, unknown>) {
   }
 }
 
-function navigate(newAction: string) {
-  callApi({ action: newAction });
+function pushWiki(target: WikiTarget) {
+  router.push({ name: PAGE_ROUTES.wiki, params: buildWikiRouteParams(target) }).catch((err: unknown) => {
+    if (!isNavigationFailure(err)) {
+      console.error("[wiki] navigation failed:", err);
+    }
+  });
+}
+
+function navigate(newAction: typeof WIKI_ACTION.index | WikiTabView) {
+  pushWiki(newAction === WIKI_ACTION.index ? { kind: "index" } : { kind: newAction });
 }
 
 function navigatePage(pageName: string) {
-  callApi({ action: "page", pageName });
+  pushWiki({ kind: "page", slug: pageName });
 }
 
-async function downloadPdf() {
-  pdfError.value = null;
-  pdfDownloading.value = true;
-  let response: Response;
-  try {
-    response = await apiFetchRaw(API_ROUTES.pdf.markdown, {
-      method: "POST",
-      body: JSON.stringify({
-        markdown: content.value,
-        filename: `${title.value}.pdf`,
-      }),
-      headers: { "Content-Type": "application/json" },
-    });
-  } catch (err) {
-    pdfError.value = errorMessage(err);
-    pdfDownloading.value = false;
-    return;
-  }
-  if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    pdfError.value = `PDF error ${response.status}: ${text}`;
-    pdfDownloading.value = false;
-    return;
-  }
-  const blob = await response.blob();
-  const url = URL.createObjectURL(blob);
-  const anchor = document.createElement("a");
-  anchor.href = url;
-  anchor.download = `${title.value}.pdf`;
-  anchor.click();
-  URL.revokeObjectURL(url);
-  pdfDownloading.value = false;
+// --- Per-page chat composer ---
+const appApi = useAppApi();
+const chatDraft = ref("");
+
+const isStandaloneWikiRoute = computed(() => route.name === PAGE_ROUTES.wiki);
+const canSendChat = computed(() => chatDraft.value.trim().length > 0 && currentSlug() !== null);
+
+function currentSlug(): string | null {
+  // Prefer the URL on /wiki (source of truth for that route); fall
+  // back to the tool-result payload when WikiView is mounted as a
+  // manageWiki result inside /chat. `isSafeWikiSlug` guards against
+  // traversal tokens — the router guard already strips these from
+  // standalone /wiki URLs, but the tool-result payload arrives from
+  // the server/agent and can't assume that upstream filter.
+  const raw =
+    route.name === PAGE_ROUTES.wiki && route.params.section === WIKI_ROUTE_SECTION.pages && typeof route.params.slug === "string"
+      ? route.params.slug
+      : (props.selectedResult?.data?.pageName ?? null);
+  return isSafeWikiSlug(raw) ? raw : null;
+}
+
+function submitChat() {
+  const text = chatDraft.value.trim();
+  const slug = currentSlug();
+  if (!text || !slug) return;
+  const prompt = `Before answering, read the wiki page at data/wiki/pages/${slug}.md.\n\n${text}`;
+  chatDraft.value = "";
+  appApi.startNewChat(prompt);
 }
 
+const imeEnter = useImeAwareEnter(submitChat);
+
 function handleContentClick(event: MouseEvent) {
   // 1. Internal wiki links: `[[Page Name]]` was rewritten to a
   //    `<span class="wiki-link">` during markdown pre-processing,
@@ -241,6 +337,31 @@ function handleContentClick(event: MouseEvent) {
 </script>
 
 <style scoped>
+.button-group {
+  display: flex;
+  gap: 0.5em;
+}
+.download-btn {
+  padding: 0.5em 1em;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 0.9em;
+  display: flex;
+  align-items: center;
+  gap: 0.5em;
+}
+.download-btn-green {
+  background-color: #4caf50;
+}
+.download-btn .material-icons {
+  font-size: 1.2em;
+}
+.download-btn:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
 .wiki-content :deep(.wiki-link) {
   color: #2563eb;
   cursor: pointer;

package/src/plugins/wiki/route.ts

@@ -0,0 +1,112 @@
+// Pure helpers for reading, building, and validating wiki route
+// params. Kept free of Vue / vue-router imports so it can be used
+// from:
+//
+//  - `src/router/guards.ts` (synchronous validation at navigation time)
+//  - `src/plugins/wiki/View.vue` (watcher + push helpers)
+//  - `src/App.vue` (workspace-link click handler)
+//  - unit tests
+//
+// Mirrors the pattern established by `src/composables/useFileSelection.ts`
+// (#633): one file owns the URL ↔ domain mapping, so the literals don't
+// drift across the router definition, guards, views, and tests.
+
+// URL segment used in `/wiki/:section/...`. Closed enum — the router
+// regex `(pages|log|lint-report)` rejects anything else.
+export const WIKI_ROUTE_SECTION = {
+  pages: "pages",
+  log: "log",
+  lintReport: "lint-report",
+} as const;
+
+export type WikiRouteSection = (typeof WIKI_ROUTE_SECTION)[keyof typeof WIKI_ROUTE_SECTION];
+
+// Internal action name sent to the server / shown in the View. Diverges
+// from the URL segment in one place only: `lint-report` (URL) vs
+// `lint_report` (action), because the server API still speaks the
+// underscore form.
+export const WIKI_ACTION = {
+  index: "index",
+  page: "page",
+  log: "log",
+  lintReport: "lint_report",
+} as const;
+
+export type WikiAction = (typeof WIKI_ACTION)[keyof typeof WIKI_ACTION];
+
+// Route-level representation. `pushWiki(target)` and
+// `readWikiRouteTarget(params)` both speak this so the watcher, the
+// button handlers, and the router guard agree on the same shape.
+export type WikiTarget = { kind: "index" } | { kind: "page"; slug: string } | { kind: "log" } | { kind: "lint_report" };
+
+// Reject anything that could escape `data/wiki/pages/` or collide
+// with a different page. Vue Router decodes `%2F` back to `/` in
+// `route.params.slug`, so `/wiki/pages/..%2Fsecrets` lands here as
+// `slug === "../secrets"` — this check is the last line of defence
+// before the slug is passed to the server's page resolver
+// (`wikiSlugify` strips `..` but would still match a page literally
+// named `secrets` via its fuzzy fallback). Non-ASCII characters
+// (e.g. Japanese page titles) are allowed; only separators and `..`
+// are blocked.
+export function isSafeWikiSlug(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  if (value.length === 0) return false;
+  if (value.includes("/")) return false;
+  if (value.includes("\\")) return false;
+  if (value.includes("..")) return false;
+  return true;
+}
+
+// Read `route.params` from the wiki route and normalise to a
+// `WikiTarget`. Returns `null` when the params describe an invalid
+// state (unknown section, missing slug for a page view, unsafe slug)
+// so the caller can decide what to do — the router guard redirects to
+// `/wiki`, the view watcher treats it as "render the index".
+export function readWikiRouteTarget(params: unknown): WikiTarget | null {
+  if (!params || typeof params !== "object") return null;
+  const { section, slug } = params as { section?: unknown; slug?: unknown };
+
+  if (section === undefined || section === "") return { kind: "index" };
+
+  if (section === WIKI_ROUTE_SECTION.pages) {
+    if (!isSafeWikiSlug(slug)) return null;
+    return { kind: "page", slug };
+  }
+  if (section === WIKI_ROUTE_SECTION.log) return { kind: "log" };
+  if (section === WIKI_ROUTE_SECTION.lintReport) return { kind: "lint_report" };
+
+  return null;
+}
+
+// Inverse of `readWikiRouteTarget`: given a target, produce the
+// `{ section, slug }` params object that `router.push({ name: "wiki",
+// params })` needs. Index returns `{}` so the router strips the
+// optional segments and lands on `/wiki`.
+export function buildWikiRouteParams(target: WikiTarget): Record<string, string> {
+  switch (target.kind) {
+    case "index":
+      return {};
+    case "page":
+      return { section: WIKI_ROUTE_SECTION.pages, slug: target.slug };
+    case "log":
+      return { section: WIKI_ROUTE_SECTION.log };
+    case "lint_report":
+      return { section: WIKI_ROUTE_SECTION.lintReport };
+  }
+}
+
+// Resolve a target to the action name the server expects. Centralises
+// the one place URL-shape and action-shape diverge (`lint-report` ↔
+// `lint_report`).
+export function wikiActionFor(target: WikiTarget): WikiAction {
+  switch (target.kind) {
+    case "index":
+      return WIKI_ACTION.index;
+    case "page":
+      return WIKI_ACTION.page;
+    case "log":
+      return WIKI_ACTION.log;
+    case "lint_report":
+      return WIKI_ACTION.lintReport;
+  }
+}

package/src/router/guards.ts

@@ -7,7 +7,8 @@
 // doesn't push a history entry).
 
 import type { Router } from "vue-router";
-import { VALID_VIEW_MODES } from "../utils/canvas/viewMode";
+import { readPathMatch } from "../composables/useFileSelection";
+import { readWikiRouteTarget } from "../plugins/wiki/route";
 
 // Basic sanity check for a session ID. Real existence verification
 // happens in App.vue's onMounted / loadSession — we can't do async
@@ -24,37 +25,54 @@ function isValidSessionId(value: unknown): boolean {
 
 export function installGuards(router: Router): void {
   router.beforeEach((dest) => {
-    // Only run guards on the chat route — other routes (redirect, etc.)
-    // don't carry parameters that need sanitizing.
-    if (dest.name !== "chat") return;
-
-    // ── sessionId format check ───────────────────────────────────
-    const sessionId = dest.params.sessionId;
-    if (typeof sessionId === "string" && sessionId.length > 0 && !isValidSessionId(sessionId)) {
-      // Garbage sessionId → strip it and go to /chat (new session).
-      return { name: "chat", params: {}, query: {}, replace: true };
+    if (dest.name === "chat") {
+      const sessionId = dest.params.sessionId;
+      if (typeof sessionId === "string" && sessionId.length > 0 && !isValidSessionId(sessionId)) {
+        return { name: "chat", params: {}, query: {}, replace: true };
+      }
     }
 
-    // ── view mode whitelist ──────────────────────────────────────
-    const view = dest.query.view;
-    if (typeof view === "string" && !VALID_VIEW_MODES.has(view)) {
-      const cleaned = { ...dest.query };
-      delete cleaned.view;
-      return { ...dest, query: cleaned, replace: true };
+    if (dest.name === "wiki") {
+      // Vue Router decodes `%2F` back to `/` in `route.params.slug`,
+      // so `/wiki/pages/..%2Fsecrets` arrives here as
+      // `{ section: "pages", slug: "../secrets" }`. `readWikiRouteTarget`
+      // returns `null` for unsafe slugs, a missing slug on the `pages`
+      // section, or an unknown section. In any of those cases, bounce
+      // to `/wiki` with `replace: true` so no broken URL lands in
+      // history. Legal targets fall through to the view, where the
+      // route watcher drives the fetch.
+      if (readWikiRouteTarget(dest.params) === null) {
+        return { name: "wiki", params: {}, query: dest.query, replace: true };
+      }
     }
 
-    // ── file path traversal check ────────────────────────────────
-    const filePath = dest.query.path;
-    if (typeof filePath === "string") {
-      if (filePath.includes("..") || filePath.startsWith("/")) {
+    if (dest.name === "files") {
+      // Back-compat: old query-string form `/files?path=foo.md` →
+      // rewrite to the new path form `/files/foo.md`. Silent
+      // replace so bookmarks / log links keep working. Do this
+      // before the traversal check so `?path=../bad` also lands in
+      // the `..` rejection below.
+      const legacyPath = dest.query.path;
+      if (typeof legacyPath === "string" && legacyPath.length > 0) {
         const cleaned = { ...dest.query };
         delete cleaned.path;
-        return { ...dest, query: cleaned, replace: true };
+        return {
+          name: "files",
+          params: { pathMatch: legacyPath.split("/") },
+          query: cleaned,
+          replace: true,
+        };
       }
 
-      // ?path= without ?view=files → auto-add view=files so FilesView mounts.
-      if (view !== "files") {
-        return { ...dest, query: { ...dest.query, view: "files" }, replace: true };
+      // Traversal / absolute-path rejection against the new param.
+      const filePath = readPathMatch(dest.params.pathMatch);
+      if (typeof filePath === "string" && (filePath.includes("..") || filePath.startsWith("/"))) {
+        return {
+          name: "files",
+          params: { pathMatch: [] },
+          query: dest.query,
+          replace: true,
+        };
       }
     }
   });