mulmoclaude 0.3.0 → 0.5.0

package/server/agent/resumeFailover.ts

@@ -77,12 +77,12 @@ function parseTranscriptEntries(jsonlContent: string): TranscriptEntry[] {
       continue;
     }
     if (!isRecord(entry)) continue;
-    const o = entry;
-    if (o.type !== EVENT_TYPES.text) continue;
-    if (o.source !== "user" && o.source !== "assistant") continue;
-    const message = o.message;
+    const record = entry;
+    if (record.type !== EVENT_TYPES.text) continue;
+    if (record.source !== "user" && record.source !== "assistant") continue;
+    const message = record.message;
     if (typeof message !== "string" || message.length === 0) continue;
-    out.push({ source: o.source, text: message });
+    out.push({ source: record.source, text: message });
   }
   return out;
 }

package/server/agent/sandboxMounts.ts

@@ -15,7 +15,7 @@
 // See docs/sandbox-credentials.md for the user-facing contract.
 
 import path from "node:path";
-import fs from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { log } from "../system/logger/index.js";
@@ -105,7 +105,7 @@ export function resolveMountNames(names: readonly string[], allowed: Record<stri
 
 function hostPathExists(spec: SandboxMountSpec): boolean {
   try {
-    const stat = fs.statSync(spec.hostPath);
+    const stat = statSync(spec.hostPath);
     return spec.kind === "dir" ? stat.isDirectory() : stat.isFile();
   } catch {
     return false;
@@ -181,7 +181,7 @@ export function sshAgentForwardArgs(
       skippedReason: "SSH_AUTH_SOCK not set on host",
     };
   }
-  if (!fs.existsSync(sshAuthSock)) {
+  if (!existsSync(sshAuthSock)) {
     return {
       args: [],
       skippedReason: `SSH_AUTH_SOCK=${sshAuthSock} not found on host`,

package/server/api/auth/bearerAuth.ts

@@ -1,8 +1,8 @@
 import { timingSafeEqual } from "crypto";
 
-function safeEqual(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+function safeEqual(left: string, right: string): boolean {
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(Buffer.from(left), Buffer.from(right));
 }
 
 // Bearer token middleware (#272). Reject any `/api/*` request whose

package/server/api/auth/token.ts

@@ -21,7 +21,7 @@
 // setting it once on both sides survives restarts.
 
 import { randomBytes } from "crypto";
-import fs from "fs";
+import { promises } from "fs";
 import { writeFileAtomic } from "../../utils/files/index.js";
 import { log } from "../../system/logger/index.js";
 import { isNonEmptyString } from "../../utils/types.js";
@@ -83,7 +83,7 @@ function resolveToken(override: string | undefined): string {
  */
 export async function deleteTokenFile(tokenPath: string = WORKSPACE_PATHS.sessionToken): Promise<void> {
   try {
-    await fs.promises.unlink(tokenPath);
+    await promises.unlink(tokenPath);
   } catch {
     /* already gone — nothing to do */
   }

package/server/api/routes/agent.ts

@@ -27,7 +27,18 @@ import { logBackgroundError } from "../../utils/logBackgroundError.js";
 import { createArgsCache, recordToolEvent } from "../../workspace/tool-trace/index.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { EVENT_TYPES } from "../../../src/types/events.js";
-import { isSessionOrigin } from "../../../src/types/session.js";
+import { isSessionOrigin, type SessionOrigin } from "../../../src/types/session.js";
+// Imports kept commented (instead of deleted) alongside the
+// publishNotification call below — see the duplicate-notification
+// comment near `endRun()` in `runAgentInBackground` for context.
+// `SESSION_ORIGINS` is dragged into this same commented block
+// because every remaining live reference to it lived inside the
+// commented helper / call site; once those went, leaving the value
+// import un-commented would trip the unused-import lint rule.
+// (by snakajima)
+// import { SESSION_ORIGINS } from "../../../src/types/session.js";
+// import { NOTIFICATION_KINDS } from "../../../src/types/notification.js";
+// import { publishNotification } from "../../events/notifications.js";
 import { env } from "../../system/env.js";
 import type { Attachment } from "@mulmobridge/protocol";
 import { parseDataUrl } from "@mulmobridge/client";
@@ -105,12 +116,23 @@ export interface StartChatParams {
   /** Where this session originates (#486). Accepts string for
    *  cross-package compatibility (chat-service passes string). */
   origin?: string;
+  /** IANA timezone the user's browser resolved (e.g. "Asia/Tokyo").
+   *  Validated server-side before it reaches the system prompt — an
+   *  invalid or missing value falls back to server-local time. */
+  userTimezone?: string;
+  /** Flat primitive bag forwarded from the bridge handshake, string
+   *  / number / boolean values only (see plans/feat-bridge-options-
+   *  passthrough.md). The session-level `defaultRole` override is
+   *  already applied upstream in chat-service; MulmoClaude doesn't
+   *  read any other keys today. Accepted here so the typing matches
+   *  `StartChatFn` exported by chat-service. */
+  bridgeOptions?: Readonly<Record<string, string | number | boolean>>;
 }
 
 export type StartChatResult = { kind: "started"; chatSessionId: string } | { kind: "error"; error: string; status?: number };
 
 export async function startChat(params: StartChatParams): Promise<StartChatResult> {
-  const { message, roleId, chatSessionId, selectedImageData, attachments } = params;
+  const { message, roleId, chatSessionId, selectedImageData, attachments, userTimezone } = params;
 
   if (!message || !roleId || !chatSessionId) {
     return {
@@ -203,6 +225,8 @@ export async function startChat(params: StartChatParams): Promise<StartChatResul
     requestStartedAt,
     toolArgsCache: createArgsCache(),
     attachments: mergeAttachments(selectedImageData, attachments),
+    userTimezone,
+    origin: validOrigin,
   });
 
   return { kind: "started", chatSessionId };
@@ -239,6 +263,7 @@ interface AgentBody {
   roleId: string;
   chatSessionId: string;
   selectedImageData?: string;
+  userTimezone?: string;
 }
 
 interface ErrorResponse {
@@ -271,6 +296,12 @@ interface BackgroundRunParams {
   requestStartedAt: number;
   toolArgsCache: ReturnType<typeof createArgsCache>;
   attachments: Attachment[] | undefined;
+  userTimezone: string | undefined;
+  // Where this run was triggered from. Used to decide whether to
+  // fire a completion notification: human-initiated runs don't (the
+  // user is right there in the UI), but scheduler / bridge / skill
+  // runs do (the user is probably away from the keyboard).
+  origin: SessionOrigin | undefined;
 }
 
 // Per-event side-effect context passed to `handleAgentEvent`.
@@ -357,8 +388,30 @@ async function flushTextAccumulator(ctx: EventContext): Promise<void> {
   );
 }
 
+// Helper kept commented (instead of deleted) alongside the
+// publishNotification call below — see the duplicate-notification
+// comment near `endRun()` in `runAgentInBackground` for context.
+// (by snakajima)
+//
+// // Build the title used for the agent-completion notification on
+// // non-human runs. Surfaces both the role name and the trigger so
+// // the user can read it in passing on a phone lock screen.
+// function completionNotificationTitle(roleName: string, origin: SessionOrigin): string {
+//   switch (origin) {
+//     case SESSION_ORIGINS.scheduler:
+//       return `✅ ${roleName} (scheduler) finished`;
+//     case SESSION_ORIGINS.skill:
+//       return `✅ ${roleName} (skill) finished`;
+//     case SESSION_ORIGINS.bridge:
+//       return `✅ ${roleName} reply ready`;
+//     default:
+//       return `✅ ${roleName} finished`;
+//   }
+// }
+
 async function runAgentInBackground(params: BackgroundRunParams): Promise<void> {
-  const { decoratedMessage, role, chatSessionId, claudeSessionId, abortSignal, resultsFilePath, requestStartedAt, toolArgsCache, attachments } = params;
+  const { decoratedMessage, role, chatSessionId, claudeSessionId, abortSignal, resultsFilePath, requestStartedAt, toolArgsCache, attachments, userTimezone } =
+    params;
 
   const eventCtx: EventContext = {
     chatSessionId,
@@ -378,7 +431,17 @@ async function runAgentInBackground(params: BackgroundRunParams): Promise<void>
   try {
     while (true) {
       let staleSessionDetected = false;
-      for await (const event of runAgent(currentMessage, role, workspacePath, chatSessionId, PORT, currentClaudeSessionId, abortSignal, attachments)) {
+      for await (const event of runAgent(
+        currentMessage,
+        role,
+        workspacePath,
+        chatSessionId,
+        PORT,
+        currentClaudeSessionId,
+        abortSignal,
+        attachments,
+        userTimezone,
+      )) {
         if (failoverAttemptsRemaining > 0 && event.type === EVENT_TYPES.error && typeof event.message === "string" && isStaleSessionError(event.message)) {
           // Swallow the error — we're about to recover. `break`
           // abandons the current generator; since the event is only
@@ -431,6 +494,38 @@ async function runAgentInBackground(params: BackgroundRunParams): Promise<void>
     });
   } finally {
     endRun(chatSessionId);
+    // Commented out: this would create a duplicate notification.
+    //
+    // `endRun(chatSessionId)` above flips `session.hasUnread = true`
+    // for every chat-session turn completion regardless of origin,
+    // which already lights up the red unread-count badge on the
+    // Session History Panel toggle button (driven by `hasUnread` →
+    // `useSessionDerived.unreadCount` →
+    // `SessionHistoryToggleButton.vue`). Firing
+    // `publishNotification` here adds a *second* red badge — on the
+    // notification bell — for the exact same event, in the same
+    // chrome row. Two indicators, one event = noise.
+    //
+    // The duplicate occurs whenever a chat session receives a new
+    // message, which is exactly what every code path through this
+    // `finally` represents. The initiator of the turn (human, bridge
+    // user, scheduled job, skill chain, another agent) does not
+    // change this — both badges flip together.
+    //
+    // Other `publishNotification` call sites (news pipeline, `notify`
+    // MCP tool, scheduled-test endpoint) do not post a chat-session
+    // message at the same time, so they are not duplicates and
+    // remain enabled.
+    //
+    // (by snakajima)
+    //
+    // if (params.origin && params.origin !== SESSION_ORIGINS.human) {
+    //   publishNotification({
+    //     kind: NOTIFICATION_KINDS.agent,
+    //     title: completionNotificationTitle(params.role.name, params.origin),
+    //     sessionId: chatSessionId,
+    //   });
+    // }
     // Fire-and-forget: journal + chat-index post-processing
     maybeRunJournal({ activeSessionIds: getActiveSessionIds() }).catch(logBackgroundError("journal"));
     maybeIndexSession({

package/server/api/routes/chart.ts

@@ -4,6 +4,8 @@ import { writeWorkspaceText } from "../../utils/files/workspace-io.js";
 import { buildArtifactPath } from "../../utils/files/naming.js";
 import { errorMessage } from "../../utils/errors.js";
 import { badRequest, serverError } from "../../utils/httpError.js";
+import { log } from "../../system/logger/index.js";
+import { previewSnippet } from "../../utils/logPreview.js";
 import { isRecord } from "../../utils/types.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 
@@ -68,13 +70,22 @@ function isValidChartEntry(value: unknown): value is ChartEntry {
 
 router.post(API_ROUTES.chart.present, async (req: Request<object, unknown, PresentChartBody>, res: Response<PresentChartResponse>) => {
   const { document, title } = req.body;
+  log.info("chart", "present: start", {
+    titlePreview: typeof title === "string" ? previewSnippet(title) : undefined,
+    chartCount:
+      typeof document === "object" && document !== null && Array.isArray((document as { charts?: unknown[] }).charts)
+        ? (document as { charts: unknown[] }).charts.length
+        : undefined,
+  });
 
   if (!isValidChartDocument(document)) {
+    log.warn("chart", "present: invalid document shape");
     badRequest(res, "document must be { charts: [{ option: {...}, title?, type? }, ...] } with at least one entry");
     return;
   }
 
   if (title !== undefined && typeof title !== "string") {
+    log.warn("chart", "present: title must be string");
     badRequest(res, "title must be a string when provided");
     return;
   }
@@ -83,6 +94,7 @@ router.post(API_ROUTES.chart.present, async (req: Request<object, unknown, Prese
     const baseLabel = title ?? document.title ?? "chart";
     const filePath = buildArtifactPath(WORKSPACE_DIRS.charts, baseLabel, ".chart.json", "chart");
     await writeWorkspaceText(filePath, `${JSON.stringify(document, null, 2)}\n`);
+    log.info("chart", "present: ok", { filePath, chartCount: document.charts.length });
     res.json({
       message: `Saved chart document to ${filePath}`,
       instructions:
@@ -91,6 +103,7 @@ router.post(API_ROUTES.chart.present, async (req: Request<object, unknown, Prese
       data: { document, title, filePath },
     });
   } catch (err) {
+    log.error("chart", "present: threw", { error: errorMessage(err) });
     serverError(res, errorMessage(err));
   }
 });

package/server/api/routes/chat-index.ts

@@ -13,6 +13,7 @@ import { Router, Request, Response } from "express";
 import { backfillAllSessions } from "../../workspace/chat-index/index.js";
 import { log } from "../../system/logger/index.js";
 import { serverError } from "../../utils/httpError.js";
+import { errorMessage } from "../../utils/errors.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 
 interface RebuildResponse {
@@ -39,7 +40,7 @@ router.post(API_ROUTES.chatIndex.rebuild, async (_req: Request, res: Response<Re
     res.json(result);
   } catch (err) {
     log.warn("chat-index", "rebuild failed", { error: String(err) });
-    serverError(res, err instanceof Error ? err.message : "unknown error");
+    serverError(res, errorMessage(err, "unknown error"));
   }
 });
 

package/server/api/routes/config.ts

@@ -12,8 +12,10 @@ import {
   type McpServerEntry,
 } from "../../system/config.js";
 import { badRequest, serverError } from "../../utils/httpError.js";
+import { errorMessage } from "../../utils/errors.js";
 import { isRecord } from "../../utils/types.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { log } from "../../system/logger/index.js";
 import { loadCustomDirs, saveCustomDirs, ensureCustomDirs, validateCustomDirs, type CustomDirEntry } from "../../workspace/custom-dirs.js";
 import { loadReferenceDirs, saveReferenceDirs, validateReferenceDirs, type ReferenceDirEntry } from "../../workspace/reference-dirs.js";
 
@@ -43,7 +45,7 @@ function isMcpPutBody(value: unknown): value is { servers: McpServerEntry[] } {
   if (!Array.isArray(value.servers)) return false;
   // Full shape validation happens inside fromMcpEntries (throws on
   // anything malformed). Here we just confirm the envelope.
-  return value.servers.every((e) => isRecord(e) && "id" in e && "spec" in e);
+  return value.servers.every((entry) => isRecord(entry) && "id" in entry && "spec" in entry);
 }
 
 // Parse an MCP payload through `fromMcpEntries` (which does the full
@@ -53,7 +55,7 @@ function parseMcpPayloadOrFail(res: ConfigRes, servers: McpServerEntry[]): McpCo
   try {
     return fromMcpEntries(servers);
   } catch (err) {
-    badRequest(res, err instanceof Error ? err.message : "invalid mcp entries");
+    badRequest(res, errorMessage(err, "invalid mcp entries"));
     return null;
   }
 }
@@ -66,7 +68,8 @@ function runSaveOrFail(res: ConfigRes, save: () => void, fallback: string): bool
     save();
     return true;
   } catch (err) {
-    serverError(res, err instanceof Error ? err.message : fallback);
+    log.error("config", `save failed: ${fallback}`, { error: errorMessage(err) });
+    serverError(res, errorMessage(err, fallback));
     return false;
   }
 }
@@ -94,7 +97,9 @@ function isPutConfigBody(value: unknown): value is PutConfigBody {
 
 router.put(API_ROUTES.config.base, (req: Request<unknown, unknown, PutConfigBody>, res: ConfigRes) => {
   const body = req.body;
+  log.info("config", "PUT base: start");
   if (!isPutConfigBody(body)) {
+    log.warn("config", "PUT base: invalid payload");
     badRequest(res, "Invalid config payload");
     return;
   }
@@ -113,29 +118,35 @@ router.put(API_ROUTES.config.base, (req: Request<unknown, unknown, PutConfigBody
     // is already on the wire.
     try {
       saveSettings(previousSettings);
-    } catch {
-      /* swallow — original error already sent */
+    } catch (err) {
+      log.error("config", "PUT base: rollback also failed", { error: errorMessage(err) });
     }
     return;
   }
+  log.info("config", "PUT base: ok");
   res.json(buildFullResponse());
 });
 
 router.put(API_ROUTES.config.settings, (req: Request<unknown, unknown, AppSettings>, res: ConfigRes) => {
   const body = req.body;
+  log.info("config", "PUT settings: start");
   if (!isAppSettings(body)) {
+    log.warn("config", "PUT settings: invalid payload");
     badRequest(res, "Invalid AppSettings payload");
     return;
   }
   if (!runSaveOrFail(res, () => saveSettings(body), "saveSettings failed")) {
     return;
   }
+  log.info("config", "PUT settings: ok");
   res.json(buildFullResponse());
 });
 
 router.put(API_ROUTES.config.mcp, (req: Request<unknown, unknown, { servers: McpServerEntry[] }>, res: ConfigRes) => {
   const body = req.body;
+  log.info("config", "PUT mcp: start", { servers: Array.isArray(body?.servers) ? body.servers.length : undefined });
   if (!isMcpPutBody(body)) {
+    log.warn("config", "PUT mcp: invalid envelope");
     badRequest(res, "Invalid mcp payload envelope");
     return;
   }
@@ -146,6 +157,7 @@ router.put(API_ROUTES.config.mcp, (req: Request<unknown, unknown, { servers: Mcp
   if (!runSaveOrFail(res, () => saveMcpConfig(cfg), "saveMcpConfig failed")) {
     return;
   }
+  log.info("config", "PUT mcp: ok", { servers: body.servers.length });
   res.json(buildFullResponse());
 });
 
@@ -159,21 +171,26 @@ router.put(
   API_ROUTES.config.workspaceDirs,
   (req: Request<unknown, unknown, { dirs: unknown }>, res: Response<{ dirs: CustomDirEntry[] } | ConfigErrorResponse>) => {
     const body = req.body;
+    log.info("config", "PUT workspace-dirs: start");
     if (!isRecord(body) || !("dirs" in body)) {
+      log.warn("config", "PUT workspace-dirs: invalid envelope");
       badRequest(res, "expected { dirs: [...] }");
       return;
     }
     const result = validateCustomDirs(body.dirs);
     if ("error" in result) {
+      log.warn("config", "PUT workspace-dirs: validation failed", { error: result.error });
       badRequest(res, result.error);
       return;
     }
     try {
       saveCustomDirs(result.entries);
       ensureCustomDirs(result.entries);
+      log.info("config", "PUT workspace-dirs: ok", { dirs: result.entries.length });
       res.json({ dirs: result.entries });
     } catch (err) {
-      serverError(res, err instanceof Error ? err.message : "save failed");
+      log.error("config", "PUT workspace-dirs: threw", { error: errorMessage(err) });
+      serverError(res, errorMessage(err, "save failed"));
     }
   },
 );
@@ -188,20 +205,25 @@ router.put(
   API_ROUTES.config.referenceDirs,
   (req: Request<unknown, unknown, { dirs: unknown }>, res: Response<{ dirs: ReferenceDirEntry[] } | ConfigErrorResponse>) => {
     const body = req.body;
+    log.info("config", "PUT reference-dirs: start");
     if (!isRecord(body) || !("dirs" in body)) {
+      log.warn("config", "PUT reference-dirs: invalid envelope");
       badRequest(res, "expected { dirs: [...] }");
       return;
     }
     const result = validateReferenceDirs(body.dirs);
     if ("error" in result) {
+      log.warn("config", "PUT reference-dirs: validation failed", { error: result.error });
       badRequest(res, result.error);
       return;
     }
     try {
       saveReferenceDirs(result.entries);
+      log.info("config", "PUT reference-dirs: ok", { dirs: result.entries.length });
       res.json({ dirs: result.entries });
     } catch (err) {
-      serverError(res, err instanceof Error ? err.message : "save failed");
+      log.error("config", "PUT reference-dirs: threw", { error: errorMessage(err) });
+      serverError(res, errorMessage(err, "save failed"));
     }
   },
 );
@@ -220,12 +242,15 @@ router.put(
   API_ROUTES.config.schedulerOverrides,
   async (req: Request<unknown, unknown, { overrides: unknown }>, res: Response<{ overrides: ScheduleOverrides } | ConfigErrorResponse>) => {
     const body = req.body;
+    log.info("config", "PUT scheduler-overrides: start");
     if (!isRecord(body) || !("overrides" in body)) {
+      log.warn("config", "PUT scheduler-overrides: invalid envelope");
       badRequest(res, "expected { overrides: { ... } }");
       return;
     }
     const raw = body.overrides;
     if (!isRecord(raw)) {
+      log.warn("config", "PUT scheduler-overrides: overrides not an object");
       badRequest(res, "overrides must be an object");
       return;
     }
@@ -248,9 +273,11 @@ router.put(
         }
       }
 
+      log.info("config", "PUT scheduler-overrides: ok", { tasks: Object.keys(overrides).length });
       res.json({ overrides: loadSchedulerOverrides() });
     } catch (err) {
-      serverError(res, err instanceof Error ? err.message : "save failed");
+      log.error("config", "PUT scheduler-overrides: threw", { error: errorMessage(err) });
+      serverError(res, errorMessage(err, "save failed"));
     }
   },
 );