mulmoclaude 0.5.2 → 0.6.0

package/server/api/routes/plugins.ts

@@ -12,8 +12,11 @@ import { fillMarkdownImagePlaceholders } from "../../utils/files/markdown-image-
 import { saveMarkdown, overwriteMarkdown, isMarkdownPath } from "../../utils/files/markdown-store.js";
 import { saveSpreadsheet, overwriteSpreadsheet, isSpreadsheetPath } from "../../utils/files/spreadsheet-store.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { bindRoute } from "../../utils/router.js";
+import { collectPluginMetaDiagnostics } from "../../plugins/diagnostics.js";
 import { log } from "../../system/logger/index.js";
 import { previewSnippet } from "../../utils/logPreview.js";
+import { publishFileChange } from "../../events/file-change.js";
 
 const router = Router();
 
@@ -66,6 +69,7 @@ interface PresentDocumentBody {
 
 interface PresentDocumentSuccess {
   message: string;
+  instructions: string;
   title: string;
   data: { markdown: string; filenamePrefix: string };
 }
@@ -74,8 +78,9 @@ interface PresentDocumentError {
   error: string;
 }
 
-router.post(
-  API_ROUTES.plugins.presentDocument,
+bindRoute(
+  router,
+  API_ROUTES.markdown.create,
   async (req: Request<object, unknown, PresentDocumentBody>, res: Response<PresentDocumentSuccess | PresentDocumentError>) => {
     const { title, markdown, filenamePrefix } = req.body;
     log.info("plugins", "presentDocument: start", {
@@ -92,7 +97,8 @@ router.post(
     const markdownPath = await saveMarkdown(filledMarkdown, filenamePrefix);
     log.info("plugins", "presentDocument: ok", { markdownPath, bytes: filledMarkdown.length });
     res.json({
-      message: `Document "${title}" is ready.`,
+      message: `Saved markdown to ${markdownPath}`,
+      instructions: "Acknowledge that the document has been presented to the user.",
       title,
       data: { markdown: markdownPath, filenamePrefix },
     });
@@ -117,8 +123,9 @@ interface UpdateMarkdownError {
   error: string;
 }
 
-router.put(
-  API_ROUTES.plugins.updateMarkdown,
+bindRoute(
+  router,
+  API_ROUTES.markdown.update,
   async (req: Request<object, unknown, UpdateMarkdownBody>, res: Response<UpdateMarkdownResponse | UpdateMarkdownError>) => {
     const { relativePath, markdown } = req.body;
     log.info("plugins", "updateMarkdown: start", {
@@ -140,6 +147,7 @@ router.put(
     try {
       await overwriteMarkdown(relativePath, markdown);
       log.info("plugins", "updateMarkdown: ok", { pathPreview: previewSnippet(relativePath), bytes: markdown.length });
+      void publishFileChange(relativePath);
       res.json({ path: relativePath });
     } catch (err) {
       log.error("plugins", "updateMarkdown: threw", { pathPreview: previewSnippet(relativePath), error: errorMessage(err) });
@@ -156,8 +164,9 @@ router.put(
 // than fabricating a fake context.
 
 // presentSpreadsheet — validate, then save sheets to disk
-router.post(
-  API_ROUTES.plugins.presentSpreadsheet,
+bindRoute(
+  router,
+  API_ROUTES.spreadsheet.create,
   wrapPluginExecute<SpreadsheetArgs, unknown>(async (req) => {
     const result = await executeSpreadsheet(req.body);
     if (!Array.isArray(result.data.sheets)) {
@@ -184,8 +193,9 @@ interface UpdateSpreadsheetError {
   error: string;
 }
 
-router.put(
-  API_ROUTES.plugins.updateSpreadsheet,
+bindRoute(
+  router,
+  API_ROUTES.spreadsheet.update,
   async (req: Request<object, unknown, UpdateSpreadsheetBody>, res: Response<UpdateSpreadsheetResponse | UpdateSpreadsheetError>) => {
     const { relativePath, sheets } = req.body;
     log.info("plugins", "updateSpreadsheet: start", {
@@ -228,8 +238,9 @@ router.post(
 );
 
 // presentForm — form
-router.post(
-  API_ROUTES.plugins.form,
+bindRoute(
+  router,
+  API_ROUTES.form.dispatch,
   wrapPluginExecute((req) => executeForm(null as never, req.body)),
 );
 
@@ -240,11 +251,12 @@ router.post(
 const BLANK_PNG_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkAAIAAAoAAv/lxKUAAAAASUVORK5CYII=";
 
 // openCanvas — drawing canvas
-router.post(
-  API_ROUTES.plugins.canvas,
+bindRoute(
+  router,
+  API_ROUTES.canvas.dispatch,
   wrapPluginExecute(async () => {
     const imagePath = await saveImage(BLANK_PNG_BASE64);
-    const base = await executeOpenCanvas();
+    const base = await executeOpenCanvas(imagePath);
     return { ...base, data: { imageData: imagePath, prompt: "" } };
   }),
 );
@@ -255,4 +267,12 @@ router.post(
   wrapPluginExecute((req) => executePresent3D(null as never, req.body)),
 );
 
+// META aggregator diagnostics — boot-time host/plugin or plugin/plugin
+// key collisions. The frontend fetches this once at mount so a tab
+// that opens after the boot-time `publishNotification` fired still
+// gets the warning. Empty array when clean.
+router.get(API_ROUTES.plugins.diagnostics, (_req, res) => {
+  res.json({ diagnostics: collectPluginMetaDiagnostics() });
+});
+
 export default router;

package/server/api/routes/presentHtml.ts

@@ -2,11 +2,14 @@ import { Router, Request, Response } from "express";
 import { WORKSPACE_DIRS } from "../../workspace/paths.js";
 import { writeWorkspaceText } from "../../utils/files/workspace-io.js";
 import { buildArtifactPath } from "../../utils/files/naming.js";
+import { overwriteHtml, isHtmlPath } from "../../utils/files/html-store.js";
 import { errorMessage } from "../../utils/errors.js";
 import { badRequest, serverError } from "../../utils/httpError.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { bindRoute } from "../../utils/router.js";
 import { log } from "../../system/logger/index.js";
 import { previewSnippet } from "../../utils/logPreview.js";
+import { publishFileChange } from "../../events/file-change.js";
 
 const router = Router();
 
@@ -18,7 +21,7 @@ interface PresentHtmlBody {
 interface PresentHtmlSuccessResponse {
   message: string;
   instructions: string;
-  data: { html: string; title?: string; filePath: string };
+  data: { title?: string; filePath: string };
 }
 
 interface PresentHtmlErrorResponse {
@@ -27,7 +30,7 @@ interface PresentHtmlErrorResponse {
 
 type PresentHtmlResponse = PresentHtmlSuccessResponse | PresentHtmlErrorResponse;
 
-router.post(API_ROUTES.html.present, async (req: Request<object, unknown, PresentHtmlBody>, res: Response<PresentHtmlResponse>) => {
+bindRoute(router, API_ROUTES.html.create, async (req: Request<object, unknown, PresentHtmlBody>, res: Response<PresentHtmlResponse>) => {
   const { html, title } = req.body;
   log.info("html", "present: start", {
     titlePreview: typeof title === "string" ? previewSnippet(title) : undefined,
@@ -43,10 +46,12 @@ router.post(API_ROUTES.html.present, async (req: Request<object, unknown, Presen
     const filePath = buildArtifactPath(WORKSPACE_DIRS.htmls, title, ".html", "page");
     await writeWorkspaceText(filePath, html);
     log.info("html", "present: ok", { filePath, bytes: html.length });
+    // Fire-and-forget: any subscribed View tab refetches via cache-bust.
+    void publishFileChange(filePath);
     res.json({
       message: `Saved HTML to ${filePath}`,
       instructions: "Acknowledge that the HTML page has been presented to the user.",
-      data: { html, title, filePath },
+      data: { title, filePath },
     });
   } catch (err) {
     log.error("html", "present: threw", { error: errorMessage(err) });
@@ -54,4 +59,54 @@ router.post(API_ROUTES.html.present, async (req: Request<object, unknown, Presen
   }
 });
 
+// Update html file on disk (user edits in View). Body carries the
+// workspace-relative path verbatim (e.g.
+// `artifacts/html/2026/04/page-abc.html`) so the route doesn't have to
+// reconstruct one from a basename — same shape as presentDocument.updateMarkdown.
+interface UpdateHtmlBody {
+  relativePath: string;
+  html: string;
+}
+
+interface UpdateHtmlSuccessResponse {
+  path: string;
+}
+
+interface UpdateHtmlErrorResponse {
+  error: string;
+}
+
+bindRoute(
+  router,
+  API_ROUTES.html.update,
+  async (req: Request<object, unknown, UpdateHtmlBody>, res: Response<UpdateHtmlSuccessResponse | UpdateHtmlErrorResponse>) => {
+    const { relativePath, html } = req.body;
+    log.info("html", "update: start", {
+      pathPreview: typeof relativePath === "string" ? previewSnippet(relativePath) : undefined,
+      bytes: typeof html === "string" ? html.length : undefined,
+    });
+    if (!html) {
+      log.warn("html", "update: missing html");
+      badRequest(res, "html is required");
+      return;
+    }
+    if (!relativePath || !isHtmlPath(relativePath)) {
+      log.warn("html", "update: invalid relativePath", {
+        pathPreview: typeof relativePath === "string" ? previewSnippet(relativePath) : undefined,
+      });
+      badRequest(res, "invalid html relativePath");
+      return;
+    }
+    try {
+      await overwriteHtml(relativePath, html);
+      log.info("html", "update: ok", { pathPreview: previewSnippet(relativePath), bytes: html.length });
+      void publishFileChange(relativePath);
+      res.json({ path: relativePath });
+    } catch (err) {
+      log.error("html", "update: threw", { pathPreview: previewSnippet(relativePath), error: errorMessage(err) });
+      serverError(res, errorMessage(err));
+    }
+  },
+);
+
 export default router;

package/server/api/routes/roles.ts

@@ -104,14 +104,7 @@ function saveRoleResult(input: ManageRolesInput, sessionId: string): Record<stri
   const { role, isRename } = validated;
   const { action, oldRoleId } = input;
 
-  // Strip switchRole before saving — it is injected at load time by server/roles.ts
-  const pluginsToSave = role.availablePlugins ?? [];
-  const roleToSave = {
-    ...role,
-    availablePlugins: pluginsToSave.filter((plugin) => plugin !== "switchRole"),
-  };
-
-  saveRole(role.id, roleToSave);
+  saveRole(role.id, role);
   // On rename, remove the old file even if its id matches a built-in —
   // a file at `config/roles/<builtin>.json` is a user-created override,
   // not the built-in itself (which lives in BUILTIN_ROLES). Leaving it

package/server/api/routes/runtime-plugin.ts

@@ -0,0 +1,224 @@
+// HTTP routes for runtime-loaded plugins (#1043 C-2).
+//
+//   GET  /api/plugins/runtime/list
+//        → { plugins: [{ name, version, toolName, description }, …] }
+//
+//   POST /api/plugins/runtime/:pkg/dispatch
+//        body: <args> directly — same convention as static plugin
+//              endpoints (see server/api/routes/plugins.ts), so
+//              mcp-server's generic `postJson(endpoint, args)` works
+//              unchanged for runtime plugins.
+//        → whatever the plugin's `execute()` returns (forwarded as JSON)
+//
+//   GET  /api/plugins/runtime/:pkg/oauth/callback?code=&state=&error=
+//        Generic OAuth redirect receiver (#1162). Spotify (and any
+//        future OAuth-using runtime plugin) registers this URL with
+//        its provider's developer dashboard; the browser comes back
+//        here after consent. Host extracts `:pkg`, registry-looks-up
+//        the plugin, forwards as `kind: "oauthCallback"` dispatch
+//        args, and renders the plugin's returned `html` (or a fallback)
+//        back to the browser. Bearer-auth-EXEMPT (no Authorization
+//        header on a redirect); CSRF defended by the plugin's
+//        single-use `state`.
+//
+//   GET  /api/plugins/runtime/:pkg/:version/*
+//        Static-mount of the extracted cache directory; the frontend
+//        loader uses this for `import("/api/plugins/runtime/<pkg>/<ver>/dist/vue.js")`.
+//
+// The registry is owned by `server/plugins/runtime-registry.ts` and
+// populated at boot from the install ledger. A 404 from any of these
+// routes means the plugin isn't installed (or failed to load — see
+// boot logs).
+
+import { realpathSync } from "node:fs";
+import { Router, type Request, type Response } from "express";
+import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { getRuntimePluginByOauthAlias, getRuntimePlugins } from "../../plugins/runtime-registry.js";
+import { notFound, serverError } from "../../utils/httpError.js";
+import { errorMessage } from "../../utils/errors.js";
+import { isRecord } from "../../utils/types.js";
+import { resolveWithinRoot } from "../../utils/files/safe.js";
+import { readPluginAsset } from "../../utils/files/plugins-io.js";
+import { log } from "../../system/logger/index.js";
+
+const LOG_PREFIX = "api/plugins/runtime";
+
+const router = Router();
+
+interface ListedPlugin {
+  name: string;
+  version: string;
+  toolName: string;
+  description: string;
+  /** Absolute URL prefix the frontend uses for static-mount fetches. */
+  assetBase: string;
+}
+
+router.get(API_ROUTES.plugins.runtimeList, (_req: Request, res: Response<{ plugins: ListedPlugin[] }>) => {
+  const plugins = getRuntimePlugins().map<ListedPlugin>((entry) => ({
+    name: entry.name,
+    version: entry.version,
+    toolName: entry.definition.name,
+    description: entry.definition.description,
+    assetBase: `/api/plugins/runtime/${encodeURIComponent(entry.name)}/${encodeURIComponent(entry.version)}`,
+  }));
+  res.json({ plugins });
+});
+
+router.post(API_ROUTES.plugins.runtimeDispatch, async (req: Request<{ pkg: string }>, res: Response) => {
+  const pkg = decodeURIComponent(req.params.pkg);
+  const plugin = getRuntimePlugins().find((entry) => entry.name === pkg);
+  if (!plugin) {
+    notFound(res, `runtime plugin "${pkg}" not registered`);
+    return;
+  }
+  if (!plugin.execute) {
+    serverError(res, `runtime plugin "${pkg}" has no execute() — the package's dist/index.js must export a function under "${plugin.definition.name}"`);
+    return;
+  }
+  const args = isRecord(req.body) ? req.body : {};
+  try {
+    // gui-chat-protocol's ToolPluginCore.execute is
+    // `(context: ToolContext, args) => Promise<ToolResult>`. The
+    // server has no UI-side state to share, so context is an empty
+    // object — but it MUST be the first arg, otherwise the plugin
+    // destructures its args from `undefined` and the call fails with
+    // "Cannot destructure property '<field>' of '<arg>' as it is
+    // undefined".
+    const context = {};
+    const result = await plugin.execute(context, args);
+    // Forward whatever the plugin returns as the response body
+    // (mirrors static plugin routes — see plugins.ts). MCP server
+    // spreads this into the toolResult event downstream.
+    res.json(result);
+  } catch (err) {
+    log.error(LOG_PREFIX, "execute failed", { pkg, error: errorMessage(err) });
+    serverError(res, `plugin execute failed: ${errorMessage(err)}`);
+  }
+});
+
+// Generic OAuth callback receiver (#1162). The plugin owns state
+// validation + token exchange — the host's role is just URL routing
+// + HTML response rendering. The plugin returns
+// `{ html?: string; message?: string }` from its `oauthCallback`
+// kind handler; the host renders `html` verbatim if present, else
+// falls back to a minimal default.
+function buildOauthCallbackArgs(query: Request["query"]) {
+  const { code, state, error: providerError } = query;
+  return {
+    kind: "oauthCallback" as const,
+    code: typeof code === "string" ? code : undefined,
+    state: typeof state === "string" ? state : undefined,
+    error: typeof providerError === "string" ? providerError : undefined,
+  };
+}
+
+function sendOauthCallbackResult(res: Response, result: unknown): void {
+  const html = isRecord(result) && typeof result.html === "string" ? result.html : null;
+  const message = isRecord(result) && typeof result.message === "string" ? result.message : "";
+  const ok = isRecord(result) && result.ok === true;
+  res
+    .status(ok ? 200 : 400)
+    .type("text/html")
+    .send(html ?? renderFallbackCallbackHtml(ok ? "OAuth complete" : "OAuth failed", message || "(no message)"));
+}
+
+router.get(API_ROUTES.plugins.runtimeOauthCallback, async (req: Request<{ alias: string }>, res: Response) => {
+  const { alias } = req.params;
+  const plugin = getRuntimePluginByOauthAlias(alias);
+  if (!plugin) {
+    notFound(res, `no runtime plugin registered for OAuth callback alias "${alias}"`);
+    return;
+  }
+  if (!plugin.execute) {
+    serverError(res, `runtime plugin "${plugin.name}" has no execute()`);
+    return;
+  }
+  try {
+    const result = await plugin.execute({}, buildOauthCallbackArgs(req.query));
+    sendOauthCallbackResult(res, result);
+  } catch (err) {
+    log.error(LOG_PREFIX, "oauth callback dispatch threw", { alias, plugin: plugin.name, error: errorMessage(err) });
+    res
+      .status(500)
+      .type("text/html")
+      .send(renderFallbackCallbackHtml("Plugin error", errorMessage(err)));
+  }
+});
+
+function renderFallbackCallbackHtml(title: string, body: string): string {
+  // Minimal fallback when the plugin doesn't return its own HTML.
+  // Plugins are encouraged to return a richer page; this is just a
+  // safety net so the browser always gets something readable.
+  const escape = (value: string) =>
+    value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+  return `<!doctype html><html lang="en"><meta charset="utf-8"><title>${escape(title)}</title>
+<style>body{font-family:system-ui,sans-serif;max-width:40rem;margin:4rem auto;padding:0 1rem;color:#111}h1{margin-bottom:1rem}pre{white-space:pre-wrap;background:#f5f5f5;padding:1rem;border-radius:.5rem}</style>
+<h1>${escape(title)}</h1>
+<pre>${escape(body)}</pre>
+</html>`;
+}
+
+// Static-mount of an installed plugin's directory. Resolution flow:
+//
+//   1. Look up `(pkg, version)` in the runtime registry. Presets and
+//      user-installed plugins are both registered server-side, with
+//      cachePath set from a trusted source (preset list or workspace
+//      ledger). If the URL doesn't match any registered entry, 404 —
+//      this is the trust boundary that prevents arbitrary-file reads
+//      via percent-encoded `../` in `pkg` / `version` (the bearer-
+//      auth exemption makes this an unauthenticated path).
+//   2. realpath the registered cachePath. Symlinks inside the
+//      extracted tree (e.g. dist/foo.js → /etc/passwd) cannot escape
+//      because `resolveWithinRoot(rootReal, subPath)` rejects any
+//      target that resolves outside the plugin's own root.
+//
+// The earlier "must be inside WORKSPACE_PATHS.pluginCache" anchor is
+// gone — presets live under `node_modules/<pkg>/`, not in the
+// workspace cache. The registry-membership check replaces that
+// anchor: the registry is server-set, so its cachePath values are
+// already trusted regardless of where on disk they point.
+/** Look up a registered plugin and return the realpath of its root.
+ *  Returns null when the (pkg, version) pair is not registered, when
+ *  the cachePath does not exist on disk, or when realpath fails.
+ *  Exported for tests. */
+export function resolvePluginRoot(pkg: string, version: string): string | null {
+  const plugin = getRuntimePlugins().find((entry) => entry.name === pkg && entry.version === version);
+  if (!plugin) return null;
+  try {
+    return realpathSync(plugin.cachePath);
+  } catch {
+    return null;
+  }
+}
+
+router.get(API_ROUTES.plugins.runtimeAsset, async (req: Request<{ pkg: string; version: string; splat?: string | string[] }>, res: Response) => {
+  const pkg = decodeURIComponent(req.params.pkg);
+  const version = decodeURIComponent(req.params.version);
+  // Express 5 returns `splat` as `string[]` when the wildcard
+  // matched multiple segments, `string` for a single segment, and
+  // empty/undefined for an empty wildcard. Normalise to the joined
+  // path so downstream `path.join` works on every shape.
+  const rawSplat = req.params.splat;
+  const subPath = Array.isArray(rawSplat) ? rawSplat.join("/") : (rawSplat ?? "");
+  const rootReal = resolvePluginRoot(pkg, version);
+  if (!rootReal) {
+    notFound(res, "asset not found");
+    return;
+  }
+  const resolved = resolveWithinRoot(rootReal, subPath);
+  if (!resolved) {
+    notFound(res, "asset not found");
+    return;
+  }
+  try {
+    const { data, contentType } = await readPluginAsset(resolved);
+    res.setHeader("Content-Type", contentType);
+    res.send(data);
+  } catch (err) {
+    log.error(LOG_PREFIX, "asset read failed", { pkg, version, subPath, error: errorMessage(err) });
+    serverError(res, "asset read failed");
+  }
+});
+
+export default router;

package/server/api/routes/scheduler.ts

@@ -3,12 +3,13 @@ import { loadSchedulerItems, saveSchedulerItems } from "../../utils/files/schedu
 import { dispatchScheduler, type SchedulerActionInput } from "./schedulerHandlers.js";
 import { respondWithDispatchResult, type DispatchSuccessResponse, type DispatchErrorResponse } from "./dispatchResponse.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { bindRoute } from "../../utils/router.js";
 import { SESSION_ORIGINS } from "../../../src/types/session.js";
 import { loadUserTasks, validateAndCreate, refreshUserTasks } from "../../workspace/skills/user-tasks.js";
 import { saveUserTasks } from "../../utils/files/user-tasks-io.js";
 import { startChat } from "./agent.js";
 import { log } from "../../system/logger/index.js";
-import { SCHEDULER_ACTIONS, TASK_ACTIONS } from "../../../src/config/schedulerActions.js";
+import { SCHEDULER_ACTIONS, TASK_ACTIONS } from "../../../src/plugins/scheduler/actions.js";
 import { badRequest, notFound, serverError } from "../../utils/httpError.js";
 import { errorMessage } from "../../utils/errors.js";
 import { makeUuid } from "../../utils/id.js";
@@ -30,7 +31,7 @@ function saveItems(items: ScheduledItem[]): void {
   saveSchedulerItems(items);
 }
 
-router.get(API_ROUTES.scheduler.base, (_req: Request, res: Response<{ data: { items: ScheduledItem[] } }>) => {
+bindRoute(router, API_ROUTES.scheduler.list, (_req: Request, res: Response<{ data: { items: ScheduledItem[] } }>) => {
   res.json({ data: { items: loadItems() } });
 });
 
@@ -43,8 +44,9 @@ interface SchedulerBody extends SchedulerActionInput {
   roleId?: string;
 }
 
-router.post(
-  API_ROUTES.scheduler.base,
+bindRoute(
+  router,
+  API_ROUTES.scheduler.dispatch,
   async (req: Request<object, unknown, SchedulerBody>, res: Response<DispatchSuccessResponse<ScheduledItem> | DispatchErrorResponse | unknown>) => {
     const { action, ...input } = req.body;
 
@@ -108,7 +110,7 @@ async function handleTaskAction(action: string, input: Record<string, unknown>,
         notFound(res, `task not found: ${taskId}`);
         return;
       }
-      const name = tasks[idx].name;
+      const { name } = tasks[idx];
       tasks.splice(idx, 1);
       await saveUserTasks(tasks);
       await refreshUserTasks();

package/server/api/routes/schedulerHandlers.ts

@@ -86,7 +86,7 @@ function applyPropPatch(current: ScheduledItem["props"], patch: Record<string, s
   const next: ScheduledItem["props"] = { ...current };
   for (const [key, value] of Object.entries(patch)) {
     if (value === null) {
-      delete next[key];
+      Reflect.deleteProperty(next, key);
     } else {
       next[key] = value;
     }

package/server/api/routes/schedulerTasks.ts

@@ -11,6 +11,7 @@ import { Router, type Request, type Response } from "express";
 import { getSchedulerTasks, getSchedulerLogs } from "../../events/scheduler-adapter.js";
 import type { TaskLogEntry } from "@receptron/task-scheduler";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { bindRoute } from "../../utils/router.js";
 import { SESSION_ORIGINS } from "../../../src/types/session.js";
 import { loadUserTasks, validateAndCreate, applyUpdate, withUserTaskLock } from "../../workspace/skills/user-tasks.js";
 import { badRequest, notFound, serverError } from "../../utils/httpError.js";
@@ -24,7 +25,7 @@ const router = Router();
 
 // ── List all tasks ──────────────────────────────────────────────
 
-router.get(API_ROUTES.scheduler.tasks, (_req: Request, res: Response) => {
+bindRoute(router, API_ROUTES.scheduler.tasksList, (_req: Request, res: Response) => {
   log.info("scheduler-tasks", "list: start");
   try {
     // getSchedulerTasks() returns system-only tasks (registered via
@@ -49,7 +50,7 @@ router.get(API_ROUTES.scheduler.tasks, (_req: Request, res: Response) => {
 
 // ── Create user task ────────────────────────────────────────────
 
-router.post(API_ROUTES.scheduler.tasks, async (req: Request, res: Response) => {
+bindRoute(router, API_ROUTES.scheduler.tasksCreate, async (req: Request, res: Response) => {
   log.info("scheduler-tasks", "create: start");
   const validated = validateAndCreate(req.body);
   if (validated.kind === "error") {
@@ -74,7 +75,7 @@ router.post(API_ROUTES.scheduler.tasks, async (req: Request, res: Response) => {
 
 // ── Update user task ────────────────────────────────────────────
 
-router.put(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, res: Response) => {
+bindRoute(router, API_ROUTES.scheduler.taskUpdate, async (req: Request<{ id: string }>, res: Response) => {
   const { id: taskId } = req.params;
   log.info("scheduler-tasks", "update: start", { taskId });
   try {
@@ -102,7 +103,7 @@ router.put(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, res:
 
 // ── Delete user task ────────────────────────────────────────────
 
-router.delete(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, res: Response) => {
+bindRoute(router, API_ROUTES.scheduler.taskDelete, async (req: Request<{ id: string }>, res: Response) => {
   const { id: taskId } = req.params;
   log.info("scheduler-tasks", "delete: start", { taskId });
   try {
@@ -128,7 +129,7 @@ router.delete(API_ROUTES.scheduler.task, async (req: Request<{ id: string }>, re
 
 // ── Manual trigger ──────────────────────────────────────────────
 
-router.post(API_ROUTES.scheduler.taskRun, async (req: Request<{ id: string }>, res: Response) => {
+bindRoute(router, API_ROUTES.scheduler.taskRun, async (req: Request<{ id: string }>, res: Response) => {
   const { id: taskId } = req.params;
   log.info("scheduler-tasks", "run: start", { taskId });
   // Check user tasks first
@@ -176,11 +177,11 @@ interface LogQuery {
   limit?: string;
 }
 
-router.get(API_ROUTES.scheduler.logs, async (req: Request<object, unknown, object, LogQuery>, res: Response<{ logs: TaskLogEntry[] }>) => {
+bindRoute(router, API_ROUTES.scheduler.logs, async (req: Request<object, unknown, object, LogQuery>, res: Response<{ logs: TaskLogEntry[] }>) => {
   const MAX_LIMIT = 500;
   const rawLimitStr = getOptionalStringQuery(req, "limit");
   const rawLimit = rawLimitStr ? parseInt(rawLimitStr, 10) : undefined;
-  const limit = Number.isFinite(rawLimit) && rawLimit! > 0 ? Math.min(rawLimit!, MAX_LIMIT) : undefined;
+  const limit = rawLimit !== undefined && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, MAX_LIMIT) : undefined;
   const taskId = getOptionalStringQuery(req, "taskId");
   log.info("scheduler-tasks", "logs: start", { taskId, limit });
   try {