mulmoclaude 0.5.2 → 0.6.0

package/src/components/SentAttachmentChip.vue

@@ -0,0 +1,102 @@
+<template>
+  <img v-if="isImage" :src="rawUrl" :alt="basename" :title="basename" :class="imgClass" data-testid="sent-attachment-chip" :data-variant="variant" />
+  <div v-else :title="basename" :class="fileChipClass" data-testid="sent-attachment-chip" :data-variant="variant">
+    <span class="material-icons" :class="[iconColor, fileIconSize]">{{ icon }}</span>
+    <span class="truncate">{{ basename }}</span>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { API_ROUTES } from "../config/apiRoutes";
+
+// "thumb" — small, used by the sidebar Preview (single-mode chat list).
+// "block" — fills the canvas content width, used by the in-bubble
+// View on the canvas (stack and single mode).
+type Variant = "thumb" | "block";
+
+const props = withDefaults(
+  defineProps<{
+    /** Workspace-relative path (e.g. `data/attachments/2026/04/<id>.png`). */
+    path: string;
+    variant?: Variant;
+  }>(),
+  { variant: "thumb" },
+);
+
+const IMAGE_EXTS = new Set([".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg"]);
+
+const ext = computed(() => {
+  const dot = props.path.lastIndexOf(".");
+  return dot >= 0 ? props.path.slice(dot).toLowerCase() : "";
+});
+
+const basename = computed(() => {
+  const slash = props.path.lastIndexOf("/");
+  return slash >= 0 ? props.path.slice(slash + 1) : props.path;
+});
+
+const isImage = computed(() => IMAGE_EXTS.has(ext.value));
+
+// `/api/files/raw` is auth-exempt for `<img src>` use (see
+// server/index.ts:114) so the path round-trips without a bearer token.
+const rawUrl = computed(() => `${API_ROUTES.files.raw}?path=${encodeURIComponent(props.path)}`);
+
+const imgClass = computed(() =>
+  props.variant === "block"
+    ? // Canvas: stretch to the bubble's content width, cap height so
+      // tall images don't dominate. `object-contain` preserves aspect
+      // ratio when the natural ratio would push past max-h.
+      "block w-full max-h-[60vh] object-contain rounded-lg border border-gray-200 bg-gray-50"
+    : // Sidebar preview: small thumbnail.
+      "block max-h-16 max-w-24 object-contain rounded border border-gray-300 bg-white",
+);
+
+const fileChipClass = computed(() => {
+  const base = "inline-flex items-center gap-1.5 border border-gray-300 bg-white rounded text-gray-700";
+  return props.variant === "block" ? `${base} px-3 py-2 text-sm max-w-full` : `${base} px-2 py-1 text-xs`;
+});
+
+const fileIconSize = computed(() => (props.variant === "block" ? "text-xl" : "text-base"));
+
+const icon = computed(() => {
+  switch (ext.value) {
+    case ".pdf":
+      return "picture_as_pdf";
+    case ".docx":
+      return "description";
+    case ".xlsx":
+    case ".csv":
+      return "table_chart";
+    case ".pptx":
+      return "slideshow";
+    case ".txt":
+    case ".md":
+      return "article";
+    case ".json":
+    case ".xml":
+    case ".yaml":
+    case ".yml":
+    case ".toml":
+      return "data_object";
+    default:
+      return "insert_drive_file";
+  }
+});
+
+const iconColor = computed(() => {
+  switch (ext.value) {
+    case ".pdf":
+      return "text-red-500";
+    case ".docx":
+      return "text-blue-500";
+    case ".xlsx":
+    case ".csv":
+      return "text-green-600";
+    case ".pptx":
+      return "text-orange-500";
+    default:
+      return "text-gray-500";
+  }
+});
+</script>

package/src/components/SessionHistoryPanel.vue

@@ -14,7 +14,7 @@
           :label="t(`sessionHistoryPanel.filters.${f}`)"
           :count="f === HISTORY_FILTERS.all ? undefined : countByOrigin(f)"
           :data-testid="`session-filter-${f}`"
-          @click="activeFilter = f"
+          @click="toggleFilter(f)"
         />
       </div>
 
@@ -44,13 +44,53 @@
         @keydown.space.prevent.self="(e) => !e.repeat && emit('loadSession', session.id)"
       >
         <!-- Timestamp pill straddling the top border, mirroring the
-             SessionSidebar card design. The running indicator
-             still renders inline in the meta line below (it's a
-             status, not a time); unread is signalled solely through
-             previewClasses (bold text). -->
-        <span class="absolute top-0 right-2 -translate-y-1/2 bg-white px-1 text-[10px] text-gray-400 leading-none pointer-events-none">
-          {{ formatDate(session.updatedAt) }}
-        </span>
+             SessionSidebar card design. The kebab "..." button sits
+             next to it on the same border line — clicking opens a
+             popover with delete + bookmark actions. The running
+             indicator still renders inline in the meta line below
+             (it's a status, not a time); unread is signalled through
+             previewClasses (bold text); bookmark state is signalled
+             via the green role icon. -->
+        <div class="absolute top-0 right-6 -translate-y-1/2 flex items-center gap-1 bg-white px-1 leading-none">
+          <span class="text-[10px] text-gray-400 pointer-events-none">{{ formatDate(session.updatedAt) }}</span>
+          <button
+            type="button"
+            class="flex items-center justify-center px-0.5 border border-gray-300 rounded-md text-gray-400 hover:text-gray-700 hover:border-gray-400 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-blue-400"
+            :aria-label="t('sessionHistoryPanel.rowMenuAria')"
+            :data-testid="`session-row-menu-${session.id}`"
+            @click.stop="toggleMenu(session.id)"
+            @keydown.enter.stop
+            @keydown.space.stop
+          >
+            <span class="material-icons !text-[14px] leading-none" aria-hidden="true">more_horiz</span>
+          </button>
+        </div>
+        <div
+          v-if="openMenuId === session.id"
+          class="absolute top-2 right-2 z-10 min-w-[140px] rounded border border-gray-200 bg-white shadow-md py-1 text-xs"
+          role="menu"
+          :data-testid="`session-row-menu-popover-${session.id}`"
+          @click.stop
+        >
+          <button
+            type="button"
+            role="menuitem"
+            class="block w-full text-left px-3 py-1.5 hover:bg-gray-100"
+            :data-testid="`session-row-bookmark-${session.id}`"
+            @click.stop="onToggleBookmark(session)"
+          >
+            {{ session.isBookmarked ? t("sessionHistoryPanel.unbookmark") : t("sessionHistoryPanel.bookmark") }}
+          </button>
+          <button
+            type="button"
+            role="menuitem"
+            class="block w-full text-left px-3 py-1.5 text-red-600 hover:bg-red-50"
+            :data-testid="`session-row-delete-${session.id}`"
+            @click.stop="onDelete(session)"
+          >
+            {{ t("sessionHistoryPanel.delete") }}
+          </button>
+        </div>
         <div class="flex items-center gap-1.5">
           <SessionRoleIcon :session="session" :roles="roles" size="sm" />
           <p class="truncate flex-1 min-w-0" :class="previewClasses(session)">
@@ -71,7 +111,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed } from "vue";
+import { ref, computed, onMounted, onBeforeUnmount } from "vue";
 import { useI18n } from "vue-i18n";
 import type { Role } from "../config/roles";
 import type { SessionSummary, SessionOrigin } from "../types/session";
@@ -83,10 +123,11 @@ import FilterChip from "./FilterChip.vue";
 
 const { t } = useI18n();
 
-// `unread` is mutually exclusive with origin pills — selecting it
-// shows every unread-flagged session regardless of origin, matching
-// the user expectation that "unread" is the primary question ("what
-// needs my attention?") rather than an origin sub-filter.
+// `unread` and `bookmarked` are mutually exclusive with origin pills —
+// selecting either shows every matching session regardless of origin,
+// matching the user expectation that those are the primary questions
+// ("what needs my attention?", "what did I save?") rather than origin
+// sub-filters.
 
 const props = defineProps<{
   sessions: SessionSummary[];
@@ -98,6 +139,8 @@ const props = defineProps<{
 
 const emit = defineEmits<{
   loadSession: [id: string];
+  toggleBookmark: [id: string, bookmarked: boolean];
+  deleteSession: [id: string];
 }>();
 
 const root = ref<HTMLDivElement | null>(null);
@@ -115,16 +158,25 @@ function originOf(session: SessionSummary): SessionOrigin {
   return session.origin ?? SESSION_ORIGINS.human;
 }
 
-const filteredSessions = computed(() => {
-  if (activeFilter.value === HISTORY_FILTERS.all) return props.sessions;
-  if (activeFilter.value === HISTORY_FILTERS.unread) return props.sessions.filter((session) => session.hasUnread === true);
-  return props.sessions.filter((session) => originOf(session) === activeFilter.value);
-});
+function matchesFilter(session: SessionSummary, filter: HistoryFilter): boolean {
+  if (filter === HISTORY_FILTERS.all) return true;
+  if (filter === HISTORY_FILTERS.unread) return session.hasUnread === true;
+  if (filter === HISTORY_FILTERS.bookmarked) return session.isBookmarked === true;
+  return originOf(session) === filter;
+}
+
+const filteredSessions = computed(() => props.sessions.filter((session) => matchesFilter(session, activeFilter.value)));
+
+// Mirror Wiki's toggleTagFilter (plugins/wiki/View.vue): clicking the
+// already-active chip resets to `all`. The `all` chip itself is a
+// no-op when active — there's nothing to "deselect" back to.
+function toggleFilter(filter: HistoryFilter): void {
+  activeFilter.value = activeFilter.value === filter ? HISTORY_FILTERS.all : filter;
+}
 
 function countByOrigin(filterKey: HistoryFilter): number {
   if (filterKey === HISTORY_FILTERS.all) return props.sessions.length;
-  if (filterKey === HISTORY_FILTERS.unread) return props.sessions.filter((session) => session.hasUnread === true).length;
-  return props.sessions.filter((session) => originOf(session) === filterKey).length;
+  return props.sessions.filter((session) => matchesFilter(session, filterKey)).length;
 }
 
 function isSessionRunning(session: SessionSummary): boolean {
@@ -144,4 +196,41 @@ function previewClasses(session: SessionSummary): string {
   if (isSessionUnread(session)) return "text-gray-900 font-bold";
   return "text-gray-700";
 }
+
+// ── Row action menu ─────────────────────────────────────────
+//
+// Only one popover is open at a time, tracked by session id. A
+// document-level click listener closes it on any outside click; the
+// kebab button and popover stop propagation so clicks inside don't
+// trigger the closer (or the row's load-session handler).
+
+const openMenuId = ref<string | null>(null);
+
+function toggleMenu(sessionId: string): void {
+  openMenuId.value = openMenuId.value === sessionId ? null : sessionId;
+}
+
+function closeMenu(): void {
+  openMenuId.value = null;
+}
+
+function onToggleBookmark(session: SessionSummary): void {
+  emit("toggleBookmark", session.id, !session.isBookmarked);
+  closeMenu();
+}
+
+function onDelete(session: SessionSummary): void {
+  const ok = window.confirm(t("sessionHistoryPanel.deleteConfirm", { preview: session.preview || t("sessionHistoryPanel.noMessages") }));
+  if (!ok) return;
+  emit("deleteSession", session.id);
+  closeMenu();
+}
+
+onMounted(() => {
+  document.addEventListener("click", closeMenu);
+});
+
+onBeforeUnmount(() => {
+  document.removeEventListener("click", closeMenu);
+});
 </script>

package/src/components/SessionRoleIcon.vue

@@ -3,8 +3,10 @@
        SessionHistoryPanel. Visual rules:
        - Running → yellow with a slow spin (the one place we keep
          colour because the state is load-bearing)
-       - Unread (not running) → darker gray so the row reads as
-         "something to look at"
+       - Bookmarked → green (user-set, sits below "running" because
+         status beats user-state)
+       - Unread (not running, not bookmarked) → darker gray so the row
+         reads as "something to look at"
        - Default → light gray
        - Origin (scheduler / skill / bridge) → tiny B&W badge on the
          top-right. Human / unknown origin → no badge. -->
@@ -47,6 +49,7 @@ const iconSizeClass = computed(() => (props.size === "sm" ? "text-sm" : "text-ba
 
 const stateClass = computed(() => {
   if (props.session.isRunning) return "text-yellow-400";
+  if (props.session.isBookmarked) return "text-green-600";
   if (props.session.hasUnread) return "text-gray-900";
   return "text-gray-400";
 });
@@ -56,7 +59,7 @@ const spinClass = computed(() => (props.session.isRunning ? "animate-spin [anima
 const glyph = computed(() => roleIcon(props.roles, props.session.roleId));
 
 const originGlyph = computed(() => {
-  const origin = props.session.origin;
+  const { origin } = props.session;
   if (!origin || origin === SESSION_ORIGINS.human) return "";
   if (origin === SESSION_ORIGINS.scheduler) return "schedule";
   if (origin === SESSION_ORIGINS.skill) return "build";
@@ -65,7 +68,7 @@ const originGlyph = computed(() => {
 });
 
 const originTooltip = computed(() => {
-  const origin = props.session.origin;
+  const { origin } = props.session;
   if (!origin || origin === SESSION_ORIGINS.human) return "";
   return t(`sessionTabBar.origin.${origin}`);
 });

package/src/components/SessionSidebar.vue

@@ -4,6 +4,7 @@
       <span v-if="sessionRoleIcon" class="material-icons text-xs leading-none">{{ sessionRoleIcon }}</span>
       <span v-if="sessionRoleName" class="truncate">{{ sessionRoleName }}</span>
       <div class="ml-auto flex items-center gap-0.5 shrink-0">
+        <CopyChatButton :results="results" :result-timestamps="resultTimestamps" :session-role-name="sessionRoleName" />
         <button
           type="button"
           class="h-8 w-8 flex items-center justify-center rounded text-gray-400 hover:text-gray-700 hover:bg-gray-100 transition-colors"
@@ -55,16 +56,17 @@ import type { ToolResultComplete } from "gui-chat-protocol/vue";
 import { getPlugin } from "../tools";
 import { formatSmartTime } from "../utils/format/date";
 import CanvasViewToggle from "./CanvasViewToggle.vue";
+import CopyChatButton from "./CopyChatButton.vue";
 import type { LayoutMode } from "../utils/canvas/layoutMode";
 
 const { t } = useI18n();
 
-function sourceLabel(result: ToolResultComplete): string {
-  if (result.toolName === "text-response") return result.title ?? "Assistant";
-  return result.toolName;
-}
-
 defineProps<{
+  // Already filtered to "what the user should see" by the parent's
+  // `sidebarResults` computed (see useSessionDerived.ts) — keyboard
+  // navigation, selection, and this render all consume the same
+  // visible-only list so a hidden result can't slip into selected
+  // state and leave the sidebar showing no highlight.
   results: ToolResultComplete[];
   selectedUuid: string | null;
   resultTimestamps: Map<string, number>;
@@ -74,6 +76,18 @@ defineProps<{
   showRightSidebar: boolean;
 }>();
 
+function sourceLabel(result: ToolResultComplete): string {
+  if (result.toolName === "text-response") return result.title ?? "Assistant";
+  // `action` lives on the persisted tool-result (see #670b40a5
+  // `feat(sidebar): use ToolResult.action for multi-feature labels`)
+  // but is not yet declared on `ToolResultComplete` in
+  // `gui-chat-protocol`. Cast to a local view so vue-tsc accepts
+  // the access; runtime is unchanged (it was already returning
+  // `undefined` for results that don't carry one).
+  const { action } = result as { action?: unknown };
+  return typeof action === "string" && action.length > 0 ? `${result.toolName}(${action})` : result.toolName;
+}
+
 const emit = defineEmits<{
   select: [uuid: string];
   activate: [];
@@ -86,8 +100,7 @@ defineExpose({ root });
 </script>
 
 <style scoped>
-/* Prevent rendered markdown links inside preview cards from navigating.
-   Clicking a sidebar card should select the result, not follow links. */
+/* Card click selects the result; rendered markdown links inside the preview must not navigate. */
 :deep(a) {
   pointer-events: none;
   color: inherit;

package/src/components/SessionTabBar.vue

@@ -31,7 +31,7 @@
 <script setup lang="ts">
 import { useI18n } from "vue-i18n";
 import type { Role } from "../config/roles";
-import { type SessionSummary } from "../types/session";
+import type { SessionSummary } from "../types/session";
 import { roleName } from "../utils/role/icon";
 import SessionRoleIcon from "./SessionRoleIcon.vue";
 

package/src/components/SettingsMcpTab.vue

@@ -294,15 +294,15 @@
 import { computed, ref } from "vue";
 import { useI18n } from "vue-i18n";
 
-const { t } = useI18n();
-
 // UI-local representation of a configured server. Matches
 // server/config.ts#McpServerEntry. Re-declared in src/config/mcpTypes.ts
 // to avoid a cross-module type import from the server package.
-import { type HttpSpec, type StdioSpec, type McpServerSpec, type McpServerEntry } from "../config/mcpTypes";
+import type { HttpSpec, StdioSpec, McpServerSpec, McpServerEntry } from "../config/mcpTypes";
 import { MCP_CATALOG, requiredKeysOf, type McpCatalogEntry, type McpConfigField } from "../config/mcpCatalog";
 import { interpolateMcpSpec } from "../utils/mcp/interpolateSpec";
 
+const { t } = useI18n();
+
 // Re-exported for callers that imported these from the SFC before the
 // types moved out (#823 Phase 1).
 export type { HttpSpec, StdioSpec, McpServerSpec, McpServerEntry };
@@ -350,7 +350,7 @@ function isInstalled(serverId: string): boolean {
 }
 
 function onCatalogToggle(entry: McpCatalogEntry, event: Event): void {
-  const checked = (event.target as HTMLInputElement).checked;
+  const { checked } = event.target as HTMLInputElement;
   if (checked) {
     if (entry.configSchema.length > 0) {
       openConfigForm(entry);

package/src/components/SettingsModal.vue

@@ -255,6 +255,7 @@ async function loadConfig(): Promise<void> {
     mcp?: { servers: McpServerEntry[] };
   }>(API_ROUTES.config.base);
   // A newer open() has already started another load — drop this one.
+  // eslint-disable-next-line security/detect-possible-timing-attacks -- in-memory race-token guard, not an auth compare
   if (token !== loadToken) return;
   if (!response.ok) {
     loadError.value = response.status === 0 ? response.error || "Network error" : `Failed to load settings (HTTP ${response.status})`;
@@ -264,6 +265,7 @@ async function loadConfig(): Promise<void> {
     toolsSavedText.value = text;
     mcpServers.value = response.data.mcp?.servers ?? [];
   }
+  // eslint-disable-next-line security/detect-possible-timing-attacks -- same race-token guard as above
   if (token === loadToken) loading.value = false;
 }
 

package/src/components/SidebarHeader.vue

@@ -2,7 +2,7 @@
   <div class="flex items-center gap-2">
     <button
       type="button"
-      class="flex items-center gap-2 -my-1 -ml-1 py-1 pl-1 pr-2 rounded hover:bg-gray-100 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-400"
+      class="flex items-center gap-2 -my-1 -ml-1 py-1 pl-1 pr-1 rounded hover:bg-gray-100 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-400"
       data-testid="app-home-btn"
       :title="t('sidebarHeader.home')"
       :aria-label="t('sidebarHeader.home')"
@@ -11,7 +11,7 @@
       <img :src="logoUrl" alt="" class="h-[50px] w-auto -my-3.5 -ml-3 rounded object-contain shrink-0" />
       <!-- span, not h1: `<h1>` inside `<button>` is invalid HTML, and
            the brand label here is a clickable logo, not a page heading. -->
-      <span data-testid="app-title" class="text-sm font-semibold text-gray-800 mr-1" :style="titleStyle">MulmoClaude</span>
+      <span data-testid="app-title" class="text-sm font-semibold text-gray-800" :style="titleStyle">MulmoClaude</span>
     </button>
     <div class="flex gap-0.5">
       <LockStatusPopup
@@ -21,7 +21,17 @@
         @update:open="lockPopupOpen = $event"
         @test-query="(q) => emit('testQuery', q)"
       />
-      <NotificationBell :force-close="lockPopupOpen" @navigate="(action) => emit('notificationNavigate', action)" @update:open="onNotificationOpen" />
+      <NotificationBell :force-close="lockPopupOpen" @update:open="onNotificationOpen" />
+      <button
+        class="h-8 w-8 flex items-center justify-center rounded text-gray-400 hover:text-gray-700 disabled:opacity-50 disabled:cursor-not-allowed"
+        data-testid="today-journal-btn"
+        :title="t('sidebarHeader.todayJournal')"
+        :aria-label="t('sidebarHeader.todayJournal')"
+        :disabled="todayJournalLoading"
+        @click="openLatestDaily"
+      >
+        <span class="material-icons">today</span>
+      </button>
       <button
         class="relative h-8 w-8 flex items-center justify-center rounded text-gray-400 hover:text-gray-700"
         data-testid="settings-btn"
@@ -47,7 +57,7 @@ import { useI18n } from "vue-i18n";
 import LockStatusPopup from "./LockStatusPopup.vue";
 import NotificationBell from "./NotificationBell.vue";
 import { useClickOutside } from "../composables/useClickOutside";
-import type { NotificationPayload } from "../types/notification";
+import { useLatestDaily } from "../composables/useLatestDaily";
 import logoUrl from "../assets/mulmo_bw.png";
 
 const { t } = useI18n();
@@ -63,7 +73,6 @@ const props = withDefaults(
 
 const emit = defineEmits<{
   testQuery: [query: string];
-  notificationNavigate: [action: NotificationPayload["action"]];
   openSettings: [];
   home: [];
 }>();
@@ -75,6 +84,8 @@ const emit = defineEmits<{
 // attention signal is lost.
 const settingsLabel = computed(() => (props.geminiAvailable ? t("sidebarHeader.settings") : t("sidebarHeader.settingsGeminiMissing")));
 
+const { openLatestDaily, loading: todayJournalLoading } = useLatestDaily();
+
 const lockPopupOpen = ref(false);
 const lockPopup = ref<{
   button: HTMLButtonElement | null;

package/src/components/SourcesManager.vue

@@ -266,7 +266,7 @@
     <PageChatComposer
       v-if="mode === 'page'"
       :placeholder="t('pluginManageSource.chatPlaceholder')"
-      :prepend-text="`Before answering, read config/helps/sources.md for source-management conventions.`"
+      prepend-text="Before answering, read config/helps/sources.md for source-management conventions."
       :suggestions="SOURCE_SUGGESTIONS"
       test-id-prefix="sources-page-chat"
     />
@@ -281,6 +281,7 @@ import DOMPurify from "dompurify";
 import type { ManageSourceData, RebuildSummary, Source } from "../plugins/manageSource/index";
 import { apiGet, apiPost, apiDelete } from "../utils/api";
 import { API_ROUTES } from "../config/apiRoutes";
+import { buildRouteUrl } from "../plugins/meta-types";
 import { SOURCE_FILTER_KEYS, countByFilter, matchesSourceFilter, type SourceFilterKey } from "../utils/sources/filter";
 import FilterChip from "./FilterChip.vue";
 import PageChatComposer from "./PageChatComposer.vue";
@@ -312,6 +313,7 @@ const props = defineProps<{
 }>();
 
 const localSources = ref<Source[] | null>(props.initialData?.sources ?? null);
+const sources = computed<Source[]>(() => localSources.value ?? []);
 const lastRebuild = ref<RebuildSummary | null>(props.initialData?.lastRebuild ?? null);
 const highlightSlugLocal = ref<string | null>(props.initialData?.highlightSlug ?? null);
 const actionMessage = ref("");
@@ -431,7 +433,7 @@ function buildRegisterPayload(input: DraftState): RegisterPayload | BuildError {
       }
       let hostname: string;
       try {
-        hostname = new URL(primary).hostname;
+        ({ hostname } = new URL(primary));
       } catch {
         return { errorKey: "pluginManageSource.errRssUrlInvalid" };
       }
@@ -479,7 +481,7 @@ async function commitAdd(): Promise<void> {
   }
   draftError.value = "";
   busy.value = "add";
-  const response = await apiPost<unknown>(API_ROUTES.sources.create, payload);
+  const response = await apiPost<unknown>(API_ROUTES.sources.create.url, payload);
   if (!response.ok) {
     draftError.value = response.error || t("pluginManageSource.flashRegisterFailed");
     busy.value = null;
@@ -579,7 +581,7 @@ async function installPreset(preset: Preset): Promise<void> {
   }
   const failures: string[] = [];
   for (const entry of toRegister) {
-    const response = await apiPost<unknown>(API_ROUTES.sources.create, {
+    const response = await apiPost<unknown>(API_ROUTES.sources.create.url, {
       slug: entry.slug,
       title: entry.title,
       url: entry.url,
@@ -620,7 +622,7 @@ async function installPreset(preset: Preset): Promise<void> {
 // Rebuild step extracted so commitAdd can chain it without recursing
 // into rebuild()'s own busy-state machine.
 async function rebuildInline(): Promise<void> {
-  const response = await apiPost<RebuildSummary>(API_ROUTES.sources.rebuild);
+  const response = await apiPost<RebuildSummary>(API_ROUTES.sources.rebuild.url);
   if (!response.ok) {
     flash(t("pluginManageSource.flashRegisterSucceededRebuildFailed", { error: response.error }), true);
     return;
@@ -631,7 +633,6 @@ async function rebuildInline(): Promise<void> {
   await loadBrief(summary.isoDate);
 }
 
-const sources = computed<Source[]>(() => localSources.value ?? []);
 const highlightSlug = computed(() => highlightSlugLocal.value);
 
 // Filter chip state (#768). Single-select. `all` is the implicit
@@ -662,6 +663,10 @@ function filterChipLabel(key: SourceFilterKey): string {
       return t("pluginManageSource.filter.scheduleWeekly");
     case "schedule:manual":
       return t("pluginManageSource.filter.scheduleManual");
+    default: {
+      const exhaustive: never = key;
+      throw new Error(`unreachable SourceFilterKey: ${String(exhaustive)}`);
+    }
   }
 }
 
@@ -705,6 +710,10 @@ function kindLabel(kind: Source["fetcherKind"]): string {
       return t("pluginManageSource.kindGithubIss");
     case "arxiv":
       return t("pluginManageSource.kindArxiv");
+    default: {
+      const exhaustive: never = kind;
+      throw new Error(`unreachable fetcherKind: ${String(exhaustive)}`);
+    }
   }
 }
 
@@ -718,6 +727,10 @@ function kindBadgeClass(kind: Source["fetcherKind"]): string {
       return "bg-indigo-100 text-indigo-700";
     case "arxiv":
       return "bg-emerald-100 text-emerald-700";
+    default: {
+      const exhaustive: never = kind;
+      throw new Error(`unreachable fetcherKind: ${String(exhaustive)}`);
+    }
   }
 }
 
@@ -733,7 +746,7 @@ function flash(message: string, isError = false): void {
 // initial page-mode load) can keep that error visible in the UI
 // rather than rely on the transient flash toast.
 async function refreshList(): Promise<string | null> {
-  const response = await apiGet<{ sources: Source[] }>(API_ROUTES.sources.list);
+  const response = await apiGet<{ sources: Source[] }>(API_ROUTES.sources.list.url);
   if (!response.ok) {
     flash(t("pluginManageSource.flashRefreshListFailed", { error: response.error }), true);
     return response.error || t("pluginManageSource.initialLoadFailed");
@@ -745,7 +758,7 @@ async function refreshList(): Promise<string | null> {
 async function remove(slug: string): Promise<void> {
   if (!confirm(t("pluginManageSource.confirmRemove", { slug }))) return;
   busy.value = slug;
-  const response = await apiDelete<unknown>(API_ROUTES.sources.remove.replace(":slug", encodeURIComponent(slug)));
+  const response = await apiDelete<unknown>(buildRouteUrl(API_ROUTES.sources.remove, { slug }));
   busy.value = null;
   if (!response.ok) {
     flash(t("pluginManageSource.flashRemoveFailed", { error: response.error }), true);
@@ -757,7 +770,7 @@ async function remove(slug: string): Promise<void> {
 
 async function rebuild(): Promise<void> {
   busy.value = "rebuild";
-  const response = await apiPost<RebuildSummary>(API_ROUTES.sources.rebuild);
+  const response = await apiPost<RebuildSummary>(API_ROUTES.sources.rebuild.url);
   if (!response.ok) {
     flash(t("pluginManageSource.flashRebuildFailed", { error: response.error }), true);
     busy.value = null;
@@ -811,6 +824,7 @@ async function loadBrief(isoDate: string): Promise<void> {
   const relPath = dailyPathFor(isoDate);
   briefFilePath.value = relPath;
   const response = await apiGet<{ content?: string; kind?: string }>(API_ROUTES.files.content, { path: relPath });
+  // eslint-disable-next-line security/detect-possible-timing-attacks -- in-memory race-token guard, not an auth compare
   if (token !== briefLoadToken) return;
   if (!response.ok) {
     if (response.status === 404) {

package/src/components/SourcesView.vue

@@ -28,7 +28,7 @@ async function focusUrlSlug(slug: string): Promise<void> {
 }
 
 onMounted(() => {
-  const slug = route.params.slug;
+  const { slug } = route.params;
   if (typeof slug === "string" && slug) {
     void focusUrlSlug(slug);
   }