mulmoclaude 0.5.2 → 0.6.0

package/server/api/routes/sources.ts

@@ -35,6 +35,7 @@ import { normalizeCategories, type CategorySlug } from "../../workspace/sources/
 import { badRequest, conflict, sendError, serverError } from "../../utils/httpError.js";
 import { errorMessage } from "../../utils/errors.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { bindRoute } from "../../utils/router.js";
 import { isNonEmptyString, isRecord } from "../../utils/types.js";
 
 const router = Router();
@@ -55,7 +56,7 @@ interface ErrorResponse {
   error: string;
 }
 
-router.get(API_ROUTES.sources.list, async (_req: Request, res: Response<ListSourcesResponse | ErrorResponse>) => {
+bindRoute(router, API_ROUTES.sources.list, async (_req: Request, res: Response<ListSourcesResponse | ErrorResponse>) => {
   try {
     const sources = await listSources(workspacePath);
     res.json({ sources });
@@ -88,45 +89,49 @@ interface RegisterSourceResponse {
   classifyRationale?: string;
 }
 
-router.post(API_ROUTES.sources.create, async (req: Request<object, unknown, RegisterSourceBody>, res: Response<RegisterSourceResponse | ErrorResponse>) => {
-  const parsed = parseRegisterBody(req.body ?? {});
-  if ("error" in parsed) {
-    sendError(res, parsed.status, parsed.error);
-    return;
-  }
-  const existing = await readSource(workspacePath, parsed.slug);
-  if (existing) {
-    conflict(res, `source "${parsed.slug}" already exists`);
-    return;
-  }
-  const { categories, rationale } = await resolveCategories(parsed);
-  const source: Source = {
-    slug: parsed.slug,
-    title: parsed.title,
-    url: parsed.url,
-    fetcherKind: parsed.fetcherKind,
-    fetcherParams: parsed.fetcherParams,
-    schedule: parsed.schedule,
-    categories,
-    maxItemsPerFetch: parsed.maxItemsPerFetch,
-    addedAt: new Date().toISOString(),
-    notes: parsed.notes,
-  };
-  try {
-    await writeSource(workspacePath, source);
-  } catch (err) {
-    serverError(res, errorMessage(err, "failed to write source"));
-    return;
-  }
-  log.info("sources", "source registered", {
-    slug: parsed.slug,
-    fetcherKind: parsed.fetcherKind,
-  });
-  res.status(201).json({
-    source,
-    ...(rationale !== undefined && { classifyRationale: rationale }),
-  });
-});
+bindRoute(
+  router,
+  API_ROUTES.sources.create,
+  async (req: Request<object, unknown, RegisterSourceBody>, res: Response<RegisterSourceResponse | ErrorResponse>) => {
+    const parsed = parseRegisterBody(req.body ?? {});
+    if ("error" in parsed) {
+      sendError(res, parsed.status, parsed.error);
+      return;
+    }
+    const existing = await readSource(workspacePath, parsed.slug);
+    if (existing) {
+      conflict(res, `source "${parsed.slug}" already exists`);
+      return;
+    }
+    const { categories, rationale } = await resolveCategories(parsed);
+    const source: Source = {
+      slug: parsed.slug,
+      title: parsed.title,
+      url: parsed.url,
+      fetcherKind: parsed.fetcherKind,
+      fetcherParams: parsed.fetcherParams,
+      schedule: parsed.schedule,
+      categories,
+      maxItemsPerFetch: parsed.maxItemsPerFetch,
+      addedAt: new Date().toISOString(),
+      notes: parsed.notes,
+    };
+    try {
+      await writeSource(workspacePath, source);
+    } catch (err) {
+      serverError(res, errorMessage(err, "failed to write source"));
+      return;
+    }
+    log.info("sources", "source registered", {
+      slug: parsed.slug,
+      fetcherKind: parsed.fetcherKind,
+    });
+    res.status(201).json({
+      source,
+      ...(rationale !== undefined && { classifyRationale: rationale }),
+    });
+  },
+);
 
 // --- DELETE /api/sources/:slug ------------------------------------------
 
@@ -139,7 +144,7 @@ interface DeleteSourceResponse {
   stateRemoved: boolean;
 }
 
-router.delete(API_ROUTES.sources.remove, async (req: Request<DeleteSourceParams>, res: Response<DeleteSourceResponse | ErrorResponse>) => {
+bindRoute(router, API_ROUTES.sources.remove, async (req: Request<DeleteSourceParams>, res: Response<DeleteSourceResponse | ErrorResponse>) => {
   const { slug } = req.params;
   if (!isValidSlug(slug)) {
     badRequest(res, "invalid slug");
@@ -159,7 +164,7 @@ interface RebuildBody {
   scheduleType?: unknown;
 }
 
-router.post(API_ROUTES.sources.rebuild, async (req: Request<object, unknown, RebuildBody>, res: Response<ErrorResponse | Record<string, unknown>>) => {
+bindRoute(router, API_ROUTES.sources.rebuild, async (req: Request<object, unknown, RebuildBody>, res: Response<ErrorResponse | Record<string, unknown>>) => {
   const scheduleType = validateSchedule(req.body?.scheduleType, "daily");
   if (!scheduleType) {
     badRequest(res, `scheduleType must be one of: ${[...SOURCE_SCHEDULES].join(", ")}`);
@@ -239,7 +244,7 @@ interface ManageSourceSuccess {
 
 const MANAGE_ACTIONS = new Set(["list", "register", "remove", "rebuild"]);
 
-router.post(API_ROUTES.sources.manage, async (req: Request<object, unknown, ManageSourceBody>, res: Response<ManageSourceSuccess | ErrorResponse>) => {
+bindRoute(router, API_ROUTES.sources.manage, async (req: Request<object, unknown, ManageSourceBody>, res: Response<ManageSourceSuccess | ErrorResponse>) => {
   const action = req.body?.action;
   if (typeof action !== "string" || !MANAGE_ACTIONS.has(action)) {
     badRequest(res, `action must be one of: ${[...MANAGE_ACTIONS].join(", ")}`);
@@ -258,7 +263,6 @@ router.post(API_ROUTES.sources.manage, async (req: Request<object, unknown, Mana
         return;
       case "rebuild":
         await handleRebuild(res);
-        return;
     }
   } catch (err) {
     log.warn("sources", "manage failed", { action, error: String(err) });
@@ -433,7 +437,10 @@ interface ParsedRegisterBody {
   skipClassify: boolean;
 }
 
-type ParseError = { status: number; error: string };
+interface ParseError {
+  status: number;
+  error: string;
+}
 
 function parseRegisterBody(body: RegisterSourceBody): ParsedRegisterBody | ParseError {
   const title = typeof body.title === "string" ? body.title.trim() : "";

package/server/api/routes/translation.ts

@@ -0,0 +1,44 @@
+// Translation HTTP route — POST /api/translation. Thin handler that
+// delegates to the translation service; validation lives there.
+
+import { Router, type Request, type Response } from "express";
+import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { createTranslationService, TranslationInputError } from "../../services/translation/index.js";
+import { defaultTranslateBatch } from "../../services/translation/llm.js";
+import { log } from "../../system/logger/index.js";
+import type { TranslateBatchFn, TranslateRequest, TranslateResponse } from "../../services/translation/types.js";
+
+export interface TranslationRouteDeps {
+  /** Override for tests — defaults to the live workspace root. */
+  workspaceRoot?: string;
+  /** Override for tests — defaults to the production claude-CLI backend. */
+  translateBatch?: TranslateBatchFn;
+}
+
+interface TranslateErrorBody {
+  error: string;
+}
+
+export function createTranslationRouter(deps: TranslationRouteDeps = {}): Router {
+  const router = Router();
+  const service = createTranslationService({
+    translateBatch: deps.translateBatch ?? defaultTranslateBatch,
+    workspaceRoot: deps.workspaceRoot,
+  });
+
+  router.post(API_ROUTES.translation.translate, async (req: Request, res: Response<TranslateResponse | TranslateErrorBody>) => {
+    try {
+      const result = await service.translate(req.body as TranslateRequest);
+      res.json(result);
+    } catch (err) {
+      if (err instanceof TranslationInputError) {
+        res.status(400).json({ error: err.message });
+        return;
+      }
+      log.error("translation-route", "translate failed", { error: String(err) });
+      res.status(500).json({ error: "translation failed" });
+    }
+  });
+
+  return router;
+}

package/server/api/routes/wiki/frontmatter.ts

@@ -1,47 +1,18 @@
-// Narrow YAML frontmatter reader for wiki page files. We only need
-// the `tags:` field, so a tiny regex-based parser beats pulling in a
-// full YAML dependency. Supports both flow style (`tags: [a, b, c]`)
-// and block-list style:
+// Narrow `tags:` field reader for wiki page files. Built on the
+// shared `parseFrontmatter` util (#895 PR C) — js-yaml handles
+// both flow style (`tags: [a, b, c]`) and block-list style:
 //
 //   tags:
 //     - a
 //     - b
 //
+// out of the box, so we just normalise the resulting strings.
+//
 // Anything unparseable returns `[]` — callers use this for a
 // best-effort comparison against index.md, so a noisy file should
 // degrade silently, not throw.
 
-// Match `- value` with any leading indentation. Keeps to linear
-// matching (no lazy quantifier) so sonarjs/slow-regex stays happy.
-const BLOCK_LIST_ITEM_PATTERN = /^\s*-\s+(\S.*)$/;
-
-// Pull the inner list from a line that starts with `tags:` and
-// contains a `[...]` flow list. Returns null when the line isn't a
-// flow-style tags line. Bracket matching is done with `indexOf` so
-// we don't need a lazy-quantified regex.
-function extractFlowTagsCell(line: string): string | null {
-  const trimmed = line.trimStart();
-  if (!trimmed.startsWith("tags:")) return null;
-  const open = trimmed.indexOf("[");
-  if (open === -1) return null;
-  const close = trimmed.indexOf("]", open + 1);
-  if (close === -1) return null;
-  return trimmed.slice(open + 1, close);
-}
-
-// Extract the YAML frontmatter body with plain string scanning so
-// we don't rely on a lazy-quantified regex (which ESLint's slow-regex
-// rule flags for super-linear backtracking when the closing fence is
-// missing). Returns null when no well-formed `---\n…\n---` block is
-// present at the top of the file.
-function extractFrontmatterBody(content: string): string | null {
-  if (!content.startsWith("---")) return null;
-  const after = content.indexOf("\n");
-  if (after === -1) return null;
-  const close = content.indexOf("\n---", after);
-  if (close === -1) return null;
-  return content.slice(after + 1, close);
-}
+import { parseFrontmatter } from "../../../utils/markdown/frontmatter.js";
 
 function cleanTagToken(token: string): string {
   return token
@@ -51,36 +22,13 @@ function cleanTagToken(token: string): string {
     .toLowerCase();
 }
 
-function parseFlowList(cell: string): string[] {
-  return cell
-    .split(",")
+export function parseFrontmatterTags(content: string): string[] {
+  const parsed = parseFrontmatter(content);
+  if (!parsed.hasHeader) return [];
+  const tagsValue = parsed.meta.tags;
+  if (!Array.isArray(tagsValue)) return [];
+  return tagsValue
+    .filter((item): item is string => typeof item === "string")
     .map(cleanTagToken)
     .filter((token) => token.length > 0);
 }
-
-function parseBlockList(lines: string[], startIndex: number): string[] {
-  const tags: string[] = [];
-  for (let i = startIndex + 1; i < lines.length; i++) {
-    const line = lines[i];
-    // Block list ends at the first line that isn't a list item —
-    // blank line, next key, or unindented text.
-    if (/^\S/.test(line) || line.trim() === "") break;
-    const match = BLOCK_LIST_ITEM_PATTERN.exec(line);
-    if (!match) break;
-    const token = cleanTagToken(match[1].trimEnd());
-    if (token.length > 0) tags.push(token);
-  }
-  return tags;
-}
-
-export function parseFrontmatterTags(content: string): string[] {
-  const body = extractFrontmatterBody(content);
-  if (body === null) return [];
-  const lines = body.split(/\r?\n/);
-  for (let i = 0; i < lines.length; i++) {
-    const flow = extractFlowTagsCell(lines[i]);
-    if (flow !== null) return parseFlowList(flow);
-    if (/^tags:\s*$/.test(lines[i])) return parseBlockList(lines, i);
-  }
-  return [];
-}

package/server/api/routes/wiki/history.ts

@@ -0,0 +1,261 @@
+// Wiki page edit-history routes (#763 PR 2). Three endpoints:
+//
+//   GET  /api/wiki/pages/:slug/history             — list snapshots (meta-only)
+//   GET  /api/wiki/pages/:slug/history/:stamp      — read one snapshot
+//   POST /api/wiki/pages/:slug/history/:stamp/restore — round-trip the
+//     snapshot through `writeWikiPage` (which snapshots the restore
+//     itself, so undo stays cheap).
+//
+// Path safety: both `:slug` and `:stamp` are validated *before*
+// they are joined with the workspace root. The slug check matches
+// `wiki-pages/io.ts`'s `isSafeSlug`; the stamp check is the
+// `FILENAME_RE` shape exposed via `isSafeStamp`.
+
+import { Router, type Request, type Response } from "express";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { TOOL_NAMES } from "../../../../src/config/toolNames.js";
+import { hasMeaningfulChange, writeWikiPage } from "../../../workspace/wiki-pages/io.js";
+import { WORKSPACE_DIRS } from "../../../workspace/paths.js";
+import { isSafeStamp, listSnapshots, readSnapshot, stripSnapshotMeta } from "../../../workspace/wiki-pages/snapshot.js";
+import { mergeFrontmatter, serializeWithFrontmatter } from "../../../utils/markdown/frontmatter.js";
+import { badRequest, notFound } from "../../../utils/httpError.js";
+import { readTextOrNull } from "../../../utils/files/safe.js";
+import { workspacePath } from "../../../workspace/workspace.js";
+import { pushToolResult } from "../../../events/session-store/index.js";
+import { log } from "../../../system/logger/index.js";
+
+const router = Router();
+
+// Mirrors `isSafeSlug` from wiki-pages/io.ts (kept independent so
+// the route layer doesn't import the helper through a circular
+// dependency — io.ts already imports snapshot.ts).
+function isSafeSlug(slug: string): boolean {
+  if (slug.length === 0) return false;
+  if (slug === "." || slug === "..") return false;
+  if (slug.includes("/") || slug.includes("\\")) return false;
+  if (slug.includes("\0")) return false;
+  return true;
+}
+
+// Restore is a write under the user's workspace; record a short
+// reason on the new snapshot so the history reads "Restored from
+// 2026-04-28T01-23-45-789Z" rather than an empty cell. Editor stays
+// `user` because the human triggered the restore — same shape as
+// every other UI-driven save today.
+function restoreReason(stamp: string): string {
+  return `Restored from ${stamp}`;
+}
+
+// Re-build the previous snapshot's content as a single
+// frontmatter+body string for `hasMeaningfulChange` to compare
+// against. `_snapshot_*` keys are stripped first — those are
+// snapshot-event metadata, not part of the page itself, and
+// keeping them in the diff would always flag a difference.
+async function loadPreviousSnapshotContent(slug: string): Promise<string | null> {
+  const recent = await listSnapshots(slug, { workspaceRoot: workspacePath });
+  if (recent.length === 0) return null;
+  const latest = await readSnapshot(slug, recent[0].stamp, { workspaceRoot: workspacePath });
+  if (latest === null) return null;
+  return serializeWithFrontmatter(stripSnapshotMeta(latest.meta), latest.body);
+}
+
+router.get("/pages/:slug/history", async (req: Request<{ slug: string }>, res: Response) => {
+  const { slug } = req.params;
+  if (!isSafeSlug(slug)) {
+    badRequest(res, "Unsafe slug");
+    return;
+  }
+  // Don't gate on the live page existing. Snapshots are non-destructive
+  // and outlive their page — gating here would make history disappear
+  // exactly when the user needs it (deleted/renamed page → can't see
+  // history → can't restore). An empty list still answers "no history"
+  // unambiguously (codex review iter-2 #917).
+  const snapshots = await listSnapshots(slug);
+  res.json({ slug, snapshots });
+});
+
+router.get("/pages/:slug/history/:stamp", async (req: Request<{ slug: string; stamp: string }>, res: Response) => {
+  const { slug, stamp } = req.params;
+  if (!isSafeSlug(slug)) {
+    badRequest(res, "Unsafe slug");
+    return;
+  }
+  if (!isSafeStamp(stamp)) {
+    badRequest(res, "Unsafe stamp");
+    return;
+  }
+  const snapshot = await readSnapshot(slug, stamp);
+  if (snapshot === null) {
+    notFound(res, `snapshot not found: ${slug}/${stamp}`);
+    return;
+  }
+  res.json({ slug, snapshot });
+});
+
+router.post("/pages/:slug/history/:stamp/restore", async (req: Request<{ slug: string; stamp: string }>, res: Response) => {
+  const { slug, stamp } = req.params;
+  if (!isSafeSlug(slug)) {
+    badRequest(res, "Unsafe slug");
+    return;
+  }
+  if (!isSafeStamp(stamp)) {
+    badRequest(res, "Unsafe stamp");
+    return;
+  }
+  const snapshot = await readSnapshot(slug, stamp);
+  if (snapshot === null) {
+    notFound(res, `snapshot not found: ${slug}/${stamp}`);
+    return;
+  }
+
+  // Strip `_snapshot_*` keys before writing — they describe the
+  // *original* save event and would be misleading on the restored
+  // page. `writeWikiPage` will re-stamp `updated` and the new
+  // snapshot will get a fresh `_snapshot_ts` for the restore event.
+  const liveMeta = stripSnapshotMeta(snapshot.meta);
+  const restoredContent = serializeWithFrontmatter(mergeFrontmatter({}, liveMeta), snapshot.body);
+
+  // forceSnapshot=true so a "restore to identical content" still
+  // produces an audit entry — without it the no-op gate in
+  // writeWikiPage would swallow the restore silently.
+  await writeWikiPage(slug, restoredContent, {
+    editor: "user",
+    reason: restoreReason(stamp),
+    forceSnapshot: true,
+  });
+  log.info("wiki", "history restore", { slug, stamp });
+  res.json({ slug, restored: { fromStamp: stamp } });
+});
+
+// ── Internal endpoint (LLM write hook callback) ────────────────
+//
+// Hit by `<workspace>/.claude/hooks/wiki-snapshot.mjs` after the
+// claude CLI completes a `Write` / `Edit` tool call. The hook
+// computes the slug from the file path it just touched and
+// passes it here; the server resolves the slug to its OWN
+// `data/wiki/pages/` filesystem location, reads disk state, and
+// drops a snapshot through the same `appendSnapshot` path the
+// in-process writers use. Always tagged `editor: "llm"` —
+// user-driven writes go through the regular `writeWikiPage`
+// path with their own editor identity.
+//
+// Why slug-not-absPath: in Docker mode the hook runs inside the
+// container where the workspace lives at `/home/node/mulmoclaude/`
+// while the server (running on the host) sees the same files at
+// `/Users/<user>/mulmoclaude/`. Sending the absolute path forces
+// either side to translate; sending the slug lets each side keep
+// its own filesystem view.
+//
+// `sessionId` lets the snapshot carry the chat-session identifier
+// that drove the write, surfaced from Claude CLI's `session_id`
+// hook payload field. There is no `reason` — the LLM doesn't
+// supply one, and in-process callers (writeWikiPage) attach
+// their own reasons through `WikiWriteMeta` directly.
+//
+// Bearer auth applies via the global `app.use("/api", bearerAuth)`
+// in server/index.ts; no extra check needed here.
+
+interface InternalSnapshotBody {
+  slug?: string;
+  sessionId?: string;
+}
+
+router.post("/internal/snapshot", async (req: Request<object, unknown, InternalSnapshotBody>, res: Response) => {
+  const { slug, sessionId } = req.body ?? {};
+  if (typeof slug !== "string" || slug.length === 0) {
+    badRequest(res, "slug required");
+    return;
+  }
+  if (!isSafeSlug(slug)) {
+    badRequest(res, "slug is not safe");
+    return;
+  }
+
+  const pagePath = path.join(workspacePath, WORKSPACE_DIRS.wikiPages, `${slug}.md`);
+  const content = await readTextOrNull(pagePath);
+  if (content === null) {
+    notFound(res, "wiki page not found on disk");
+    return;
+  }
+
+  // Dedupe against the most recent snapshot — Write/Edit hooks
+  // fire for every tool call, including ones that only re-stamp
+  // `updated` / `editor` without touching the body. Without this
+  // guard the history page accumulates duplicate entries (user
+  // report 2026-04-30: two identical bodies snapped 2.6s apart).
+  // `hasMeaningfulChange` already drives the in-process
+  // `writeWikiPage` path; reusing it keeps both paths aligned.
+  const previousContent = await loadPreviousSnapshotContent(slug);
+  if (previousContent !== null && !hasMeaningfulChange(previousContent, content)) {
+    log.info("wiki", "internal snapshot skipped — no meaningful change since previous snapshot", { slug });
+    res.json({ slug, ok: true, skipped: "no-meaningful-change" });
+    return;
+  }
+
+  // The hook only fires for claude-CLI-driven writes — by
+  // construction the agent is the actor. User-driven manual saves
+  // go through writeWikiPage in-process and never reach here.
+  const { appendSnapshot } = await import("../../../workspace/wiki-pages/snapshot.js");
+  const stamp = await appendSnapshot(
+    slug,
+    null,
+    content,
+    {
+      editor: "llm",
+      ...(typeof sessionId === "string" && sessionId.length > 0 && { sessionId }),
+    },
+    { workspaceRoot: workspacePath },
+  );
+  log.info("wiki", "internal snapshot recorded", { slug });
+
+  // Stage 3a (#963): publish a synthetic `manageWiki` toolResult
+  // into the session timeline so the canvas shows what the LLM
+  // just wrote. The View dispatch (existing manageWiki plugin)
+  // picks up the new `page-edit` action and fetches the snapshot
+  // body via /api/wiki/pages/:slug/history/:stamp on render —
+  // JSONL stays small (~150 bytes per write) because we store
+  // the snapshot reference, not the body. `pagePath` is a GC
+  // fallback: if the snapshot is gc'd before render, the View
+  // falls back to reading the live page file.
+  // Wrapped in try/catch so a publish failure (e.g. JSONL append
+  // throws) doesn't fail the whole route — the snapshot was
+  // already written, and the hook is fire-and-forget. Without
+  // this guard the route would 500 even though the wiki write
+  // itself succeeded; the next save would still snapshot fine,
+  // but the canvas would silently lose this one preview
+  // (CodeRabbit review).
+  if (typeof sessionId === "string" && sessionId.length > 0) {
+    try {
+      const outcome = await pushToolResult(sessionId, {
+        uuid: randomUUID(),
+        toolName: TOOL_NAMES.manageWiki,
+        data: {
+          // `"page-edit"` is the action discriminator the wiki
+          // plugin's `View.vue` switches on. It's repeated in the
+          // plugin and in `src/plugins/wiki/pageEditLoader.ts`; a
+          // shared `WIKI_ACTIONS` const would be the cleaner home
+          // but that's a multi-file refactor — out of scope for
+          // this CR follow-up.
+          action: "page-edit",
+          title: slug,
+          slug,
+          stamp,
+          pagePath: path.posix.join(WORKSPACE_DIRS.wikiPages, `${slug}.md`),
+        },
+      });
+      if (outcome.kind === "skipped") {
+        log.warn("wiki", "page-edit toolResult publish skipped", { slug, reason: outcome.reason });
+      }
+    } catch (err) {
+      log.warn("wiki", "page-edit toolResult publish failed", {
+        slug,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  res.json({ slug, ok: true });
+});
+
+export default router;

package/server/api/routes/wiki/pageIndex.ts

@@ -39,7 +39,7 @@ export async function getPageIndex(pagesDir: string): Promise<PageIndex> {
   const slugs = new Map<string, string>();
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    const name = entry.name;
+    const { name } = entry;
     if (!name.endsWith(".md")) continue;
     slugs.set(name.slice(0, -".md".length), name);
   }