mulmoclaude 0.5.2 → 0.6.0

package/src/utils/image/imageRepairInlineScript.ts

@@ -0,0 +1,115 @@
+// Inline-script flavour of the image-self-repair behaviour the app
+// shell already runs via `useGlobalImageErrorRepair` (see
+// `src/composables/useImageErrorRepair.ts`).
+//
+// Iframe surfaces (presentHtml result, Files HTML preview) live in
+// their own Document, so the parent's document-level error handler
+// can't see their `<img>` 404s. Server-side `inlineImages` (PDF) and
+// the markdown rewriter (browser) cover the deterministic-resolution
+// half of the routing strategy, but iframes that load HTML files
+// directly off `/artifacts/html/...` need a third leg: an in-iframe
+// `error` listener that does the same one-shot repair.
+//
+// This module is the **pure** form (no Vue, no DOM access at module
+// load) so:
+//   - server/index.ts can import it for splicing into HTML responses
+//   - the composable in `useImageErrorRepair.ts` re-exports it for
+//     back-compat with existing test imports
+//
+// Stage 3 of the image-path-routing redesign — see
+// plans/done/feat-image-path-routing.md and #1025.
+
+// All Gemini / canvas / image-edit output lives at
+// `artifacts/images/YYYY/MM/<id>.png` (server/utils/files/image-store.ts).
+// If a rendered URL embeds that segment somewhere, trim everything
+// before the pattern and retry as `/artifacts/images/<rest>` — the
+// static mount will then serve the file directly.
+export const IMAGE_REPAIR_PATTERN = /artifacts\/images\/.+/;
+
+// Inline script intended for iframe surfaces. Same decision tree as
+// `useGlobalImageErrorRepair`; kept as a string so it can be embedded
+// into the rendered HTML and run inside the iframe. The regex literal
+// is interpolated from `IMAGE_REPAIR_PATTERN` so the two stay in
+// lockstep automatically.
+export const IMAGE_REPAIR_INLINE_SCRIPT = `
+document.addEventListener("error", function (event) {
+  const target = event.target;
+  if (!target) return;
+  const pattern = ${IMAGE_REPAIR_PATTERN.toString()};
+  function fixImg(img) {
+    if (img.dataset.imageRepairTried) return;
+    const m = String(img.src).match(pattern);
+    if (!m) return;
+    img.dataset.imageRepairTried = "1";
+    img.src = "/" + m[0];
+  }
+  function fixSource(src) {
+    if (src.dataset.imageRepairTried) return;
+    let changed = false;
+    const srcAttr = src.getAttribute("src");
+    if (srcAttr) {
+      const m = srcAttr.match(pattern);
+      if (m) { src.setAttribute("src", "/" + m[0]); changed = true; }
+    }
+    if (src.srcset) {
+      const orig = src.srcset;
+      const next = orig.replace(/[^\\s,]+/g, function (tok) {
+        const mm = tok.match(pattern);
+        return mm ? "/" + mm[0] : tok;
+      });
+      if (next !== orig) { src.srcset = next; changed = true; }
+    }
+    if (changed) src.dataset.imageRepairTried = "1";
+  }
+  if (target.tagName === "IMG") {
+    fixImg(target);
+    const pic = target.closest && target.closest("picture");
+    if (pic) for (const s of pic.querySelectorAll("source")) fixSource(s);
+  } else if (target.tagName === "SOURCE") {
+    fixSource(target);
+  } else if (target.tagName === "AUDIO" || target.tagName === "VIDEO") {
+    for (const s of target.querySelectorAll(":scope > source")) fixSource(s);
+  }
+}, true);
+`.trim();
+
+// Wrap the script body in a `<script>` tag once at module load; the
+// splicer below uses this directly so each splice is a single string
+// concatenation, not a per-request `<script>...</script>` rebuild.
+const IMAGE_REPAIR_SCRIPT_TAG = `<script>${IMAGE_REPAIR_INLINE_SCRIPT}</script>`;
+
+// `</body>` (case-insensitive, whitespace-tolerant). The previous
+// implementation paired this with a `(?![\s\S]*<\/body\s*>)` negative
+// lookahead to anchor at the LAST occurrence — but that lookahead is
+// O(N²) on inputs with many `</body>` tokens (an adversarial / unusual
+// input shape, but cheap to defang). The current implementation runs
+// `matchAll` once over the input (linear) and takes the last hit, so
+// the splice point selection is O(N) regardless of input shape.
+const BODY_CLOSE_RE = /<\/body\s*>/gi;
+
+/** Splice `<script>${IMAGE_REPAIR_INLINE_SCRIPT}</script>` into an
+ *  HTML document just before its **last** closing `</body>`.
+ *  Anchoring at the last close means nested `</body>` inside e.g.
+ *  literal example text inside `<pre>` doesn't fool us into splicing
+ *  too early. If the document has no `</body>` (fragments, hand-
+ *  written HTML), append the tag at the end so the script still
+ *  loads.
+ *
+ *  Pure string operation — safe to call on any HTML payload, no
+ *  DOM parsing, no allocation beyond the result string. Linear time
+ *  in input length even on adversarial inputs (verified by the
+ *  `processes 100K </body> tokens in linear time` test). Idempotent:
+ *  calling on already-spliced output appends a second copy (the
+ *  script is one-shot per element so duplicates are harmless), so
+ *  callers should splice exactly once per response. */
+export function injectImageRepairScript(html: string): string {
+  if (!html) return html;
+  // matchAll → spread into an array → take the last entry. One linear
+  // pass over the input regardless of how many `</body>` tokens it
+  // contains.
+  const matches = [...html.matchAll(BODY_CLOSE_RE)];
+  if (matches.length === 0) return html + IMAGE_REPAIR_SCRIPT_TAG;
+  const idx = matches[matches.length - 1].index;
+  if (idx === undefined) return html + IMAGE_REPAIR_SCRIPT_TAG;
+  return `${html.slice(0, idx)}${IMAGE_REPAIR_SCRIPT_TAG}${html.slice(idx)}`;
+}

package/src/utils/image/resolve.ts

@@ -1,10 +1,20 @@
 import { API_ROUTES } from "../../config/apiRoutes";
 import { getImageBump } from "./cacheBust";
 
+// Files saved by `saveImage()` (Gemini, canvas, image edit) all live
+// under this prefix — see server/utils/files/image-store.ts and
+// server/workspace/paths.ts (WORKSPACE_DIRS.images). Express mounts a
+// static handler for the corresponding URL so these paths route
+// directly to the file without going through /api/files/raw.
+const IMAGES_DIR_PREFIX = "artifacts/images/";
+
 /** Convert an imageData value to a displayable URL.
- *  Handles both legacy data URIs and workspace-relative file paths. */
+ *  Handles data URIs, paths under `artifacts/images/` (resolved via
+ *  the static mount), and everything else (resolved via the workspace
+ *  file server). */
 export function resolveImageSrc(imageData: string): string {
   if (imageData.startsWith("data:")) return imageData;
+  if (imageData.startsWith(IMAGES_DIR_PREFIX)) return `/${imageData}`;
   return `${API_ROUTES.files.raw}?path=${encodeURIComponent(imageData)}`;
 }
 
@@ -18,7 +28,11 @@ export function resolveImageSrc(imageData: string): string {
  *  redraw, which races with stroke painting and blanks the canvas. */
 export function resolveImageSrcFresh(imageData: string): string {
   if (imageData.startsWith("data:")) return imageData;
-  const base = `${API_ROUTES.files.raw}?path=${encodeURIComponent(imageData)}`;
+  const base = resolveImageSrc(imageData);
   const bump = getImageBump(imageData);
-  return bump > 0 ? `${base}&v=${bump}` : base;
+  if (bump <= 0) return base;
+  // Both URL forms append a cache-bust param. The static mount form
+  // uses `?v=`, the API form already has `?path=` so we use `&v=`.
+  const sep = base.includes("?") ? "&" : "?";
+  return `${base}${sep}v=${bump}`;
 }

package/src/utils/image/rewriteMarkdownImageRefs.ts

@@ -1,6 +1,7 @@
 import { marked } from "marked";
 import type { Token, Tokens } from "marked";
 import { resolveImageSrc } from "./resolve";
+import { transformResolvableUrlsInHtml } from "./htmlSrcAttrs";
 
 // Pre-`marked` pass that rewrites workspace-relative image references
 // in markdown source so they render through the backend file server.
@@ -102,8 +103,43 @@ function rewriteImageToken(token: Tokens.Image, basePath: string): string | null
   return `![${alt}](${newHref})`;
 }
 
+// Rewrite URL-bearing attributes of every recognised tag inside an
+// HTML fragment, applying the same basePath / shouldSkip /
+// resolveImageSrc pipeline used for `![alt](url)` markdown images.
+// Other attributes (alt, class, style, id, …) are preserved verbatim.
+//
+// Tags + attributes covered (single source of truth at
+// `htmlSrcAttrs.ts:RESOLVABLE_TAG_ATTRS`): `<img src>`, `<source src>`,
+// `<video poster|src>`, `<audio src>`. Add a row there to extend
+// coverage; both this rewriter and the server-side PDF rewriter pick
+// it up automatically (#1011 Stage B).
+//
+// Output URLs come from `resolveImageSrc`, which either returns a
+// mount-rooted path (`/artifacts/images/<file>`) or runs the input
+// through `encodeURIComponent`. `"` becomes `%22`, `'` becomes `%27`,
+// `<` / `>` are encoded — the rewritten attribute can't break out of
+// its own quotes or close the tag.
+//
+// Limitations:
+//   - `srcset` (comma-separated descriptor list) is deferred —
+//     tracked under #1011 Stage B follow-up.
+//   - SVG `<image href>` and CSS `url()` are deferred per plan
+//     §修正提案 P3-A.
+//   - A regex can't perfectly distinguish a real tag from one
+//     embedded in another attribute's value; embedded matches get
+//     rewritten too. Harmless because the rewritten URL is encoded
+//     safely.
+export function rewriteImgSrcAttrsInHtml(html: string, basePath: string): string {
+  return transformResolvableUrlsInHtml(html, (url) => {
+    if (shouldSkip(url)) return null;
+    const resolved = resolveWorkspacePath(basePath, url);
+    if (resolved === null) return null;
+    return resolveImageSrc(resolved);
+  });
+}
+
 function isSkippable(token: Token): boolean {
-  return token.type === "code" || token.type === "codespan" || token.type === "html";
+  return token.type === "code" || token.type === "codespan";
 }
 
 function getContainerChildren(token: Token): Token[] | null {
@@ -135,11 +171,14 @@ function renderContainerChildren(raw: string, children: Token[], basePath: strin
 }
 
 // Recursively render a token back to markdown, rewriting image refs
-// in-place. Code / codespan / html tokens are emitted verbatim so
-// image-ref syntax inside them stays literal. Token-tree recursion
-// uses the lexer's structural knowledge and never crosses a skip
-// boundary — unlike the earlier `indexOf` splice which could rewrite
-// a code-block literal when the same ref appeared in real markdown.
+// in-place. Code / codespan tokens are emitted verbatim so image-ref
+// syntax inside them stays literal. HTML tokens get a separate pass
+// (`rewriteImgSrcAttrsInHtml`) so raw `<img>` tags route through the
+// same basePath + shouldSkip pipeline as the markdown image syntax.
+// Token-tree recursion uses the lexer's structural knowledge and never
+// crosses a skip boundary — unlike the earlier `indexOf` splice which
+// could rewrite a code-block literal when the same ref appeared in
+// real markdown.
 function renderToken(token: Token, basePath: string, out: string[]): void {
   if (isSkippable(token)) {
     out.push(token.raw);
@@ -150,6 +189,16 @@ function renderToken(token: Token, basePath: string, out: string[]): void {
     out.push(replacement ?? token.raw);
     return;
   }
+  if (token.type === "html") {
+    // Block / inline HTML — rewrite raw <img> tags inside before
+    // emitting. Markdown image syntax (![alt](url)) is handled by the
+    // image-token branch above; this branch covers the HTML-fallback
+    // path (#1011 Stage A). Fall back to verbatim raw if `raw` is
+    // unexpectedly missing — defensive against future marked changes.
+    const raw = (token as { raw?: string }).raw ?? "";
+    out.push(rewriteImgSrcAttrsInHtml(raw, basePath));
+    return;
+  }
   const raw = (token as { raw?: string }).raw ?? "";
   const children = getContainerChildren(token);
   if (children && renderContainerChildren(raw, children, basePath, out)) {
@@ -167,14 +216,18 @@ function renderToken(token: Token, basePath: string, out: string[]): void {
  *   file (e.g. `"wiki/pages"` for `wiki/pages/foo.md`). Omit or pass
  *   `""` when resolving refs against the workspace root.
  *
+ * Also rewrites the `src` attribute of raw `<img>` tags inside HTML
+ * blocks / inline HTML so a page mixing both syntaxes resolves the
+ * same way. Markdown image syntax inside code blocks / inline code
+ * spans is left alone.
+ *
  * Absolute URLs, data URIs, and existing API paths pass through
  * untouched. Refs that would escape the workspace root (more `..`
  * than `basePath` depth) also pass through untouched — they would
  * 404 regardless, and passing through lets the user see the broken
- * ref instead of silently re-pointing it. Image-ref syntax inside
- * code blocks / inline code spans is left alone.
+ * ref instead of silently re-pointing it.
  */
-export function rewriteMarkdownImageRefs(markdown: string, basePath: string = ""): string {
+export function rewriteMarkdownImageRefs(markdown: string, basePath = ""): string {
   const tokens = marked.lexer(markdown);
   const parts: string[] = [];
   for (const token of tokens) renderToken(token, basePath, parts);

package/src/utils/markdown/frontmatter.ts

@@ -0,0 +1,125 @@
+// Canonical YAML-frontmatter parser / serializer / merger for the
+// `---\nkey: value\n---\nbody` markdown convention. Used on the Vue
+// side; the server side has a mirror at
+// `server/utils/markdown/frontmatter.ts` (#895 PR B). The two share
+// the same shape but live in separate files because the build
+// targets are different (browser vs Node) and a shared package is
+// overkill for ~10 lines of glue.
+//
+// Implementation uses `js-yaml` so we get full YAML coverage (block
+// lists, multi-line strings, escaping) instead of the regex
+// approximation in the legacy `src/utils/format/frontmatter.ts`.
+
+import yaml from "js-yaml";
+
+export interface ParsedMarkdown {
+  /** Parsed YAML object. Empty `{}` when the document has no
+   *  frontmatter or the YAML failed to parse. Insertion order
+   *  matches the source — `Object.entries(meta)` is the right way
+   *  to iterate for an ordered properties panel. */
+  meta: Record<string, unknown>;
+  /** Body after stripping the frontmatter envelope. Trailing
+   *  newline at the end of the closing `---` line is consumed; a
+   *  no-frontmatter document returns the raw input verbatim. */
+  body: string;
+  /** True iff a well-formed `---\n...\n---\n` envelope was
+   *  detected and parsed. False for documents without an envelope
+   *  or where the envelope is malformed (in which case the body
+   *  is returned verbatim and `meta` is `{}`). */
+  hasHeader: boolean;
+}
+
+const FRONTMATTER_OPEN = /^---\r?\n/;
+// `(?:^|\r?\n)` lets the closing fence sit at the very start of
+// `afterOpen` — needed for the empty-envelope case `---\n---\n`
+// where the closing `---` is the first thing after the open is
+// stripped. Without the alternation the regex required a preceding
+// newline and silently treated empty headers as malformed.
+const FRONTMATTER_CLOSE = /(?:^|\r?\n)---\s*(?:\r?\n|$)/;
+
+/** Parse a markdown document, splitting frontmatter from body.
+ *  Always returns an object — never throws. Malformed YAML inside
+ *  a well-formed envelope falls back to `{ meta: {}, hasHeader: false }`
+ *  so a typo in the header doesn't break rendering. */
+export function parseFrontmatter(raw: string): ParsedMarkdown {
+  if (!FRONTMATTER_OPEN.test(raw)) {
+    return { meta: {}, body: raw, hasHeader: false };
+  }
+  const afterOpen = raw.replace(FRONTMATTER_OPEN, "");
+  const closeMatch = FRONTMATTER_CLOSE.exec(afterOpen);
+  if (!closeMatch || closeMatch.index === undefined) {
+    return { meta: {}, body: raw, hasHeader: false };
+  }
+  const yamlText = afterOpen.slice(0, closeMatch.index);
+  const body = afterOpen.slice(closeMatch.index + closeMatch[0].length);
+  const meta = safeYamlLoad(yamlText);
+  if (meta === null) {
+    return { meta: {}, body: raw, hasHeader: false };
+  }
+  return { meta, body, hasHeader: true };
+}
+
+/** Serialize a meta object + body back into the canonical
+ *  `---\n...\n---\n\nbody` shape. An empty `meta` returns the body
+ *  alone (no envelope) — the lazy-on-write contract: don't add
+ *  ceremony to documents that don't have anything to record.
+ *
+ *  Round-trip semantics: VALUE-preserving, NOT byte-preserving.
+ *  `js-yaml` adds quotes to ambiguous scalars (`'1.20'`, `'true'`)
+ *  so they parse back as the same string under FAILSAFE_SCHEMA.
+ *  Source-text formatting (unquoted vs quoted) may change on save
+ *  but the parsed value is stable across rounds (codex review
+ *  iter-2 #902). */
+export function serializeWithFrontmatter(meta: Record<string, unknown>, body: string): string {
+  if (Object.keys(meta).length === 0) return body;
+  // `lineWidth: -1` disables auto-wrap so long URLs / titles stay on
+  // one line. `noRefs: true` avoids YAML anchor syntax (`&id001`)
+  // which is technically valid but visually noisy in plain-text
+  // markdown. js-yaml's default already trims a trailing newline.
+  const yamlText = yaml.dump(meta, { lineWidth: -1, noRefs: true }).trimEnd();
+  return `---\n${yamlText}\n---\n\n${body}`;
+}
+
+/** Merge a patch into an existing meta object. Unknown keys in
+ *  `existing` are preserved verbatim; keys present in `patch`
+ *  overwrite. A `null` or `undefined` patch value DELETES the key
+ *  (pattern borrowed from REST PATCH semantics) — callers that
+ *  want "leave alone" should omit the key entirely. */
+export function mergeFrontmatter(existing: Record<string, unknown>, patch: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...existing };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === null || value === undefined) {
+      Reflect.deleteProperty(out, key);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+function safeYamlLoad(text: string): Record<string, unknown> | null {
+  try {
+    // `FAILSAFE_SCHEMA` keeps every scalar as a string and skips
+    // type coercion. Two motivating cases:
+    //
+    //   - YAML 1.1 dates: `created: 2026-04-27` would become a
+    //     `Date` object under DEFAULT_SCHEMA, breaking round-trip.
+    //   - Numeric-looking strings: `version: 1.20` → number 1.2
+    //     under JSON_SCHEMA, dropping the trailing zero on save
+    //     (codex review iter-1 #902).
+    //
+    // For our domain — title / created / updated / tags / editor —
+    // everything that should be a string IS one, and the rare
+    // caller that wants a number can coerce explicitly. Mappings
+    // and sequences still parse normally (FAILSAFE keeps those).
+    const loaded = yaml.load(text, { schema: yaml.FAILSAFE_SCHEMA });
+    // `yaml.load` returns `undefined` for empty input, a primitive
+    // for scalar-only YAML, or an object for the normal case. Only
+    // accept plain objects — anything else is a malformed header.
+    if (loaded === null || loaded === undefined) return {};
+    if (typeof loaded !== "object" || Array.isArray(loaded)) return null;
+    return loaded as Record<string, unknown>;
+  } catch {
+    return null;
+  }
+}

package/src/utils/markdown/taskList.ts

@@ -28,6 +28,10 @@
 // so they need to be counted (and writable) by the index walker.
 //
 // Captures: prefix (indent + any `>` chains), bullet, separator, mark.
+// `\s*` and `>\s*` operate on disjoint character classes from the
+// surrounding bullet / separator / mark, so the nested quantifiers
+// can't overlap to produce ReDoS — each pass is linear in line length.
+// eslint-disable-next-line security/detect-unsafe-regex -- markdown task-line parser, bounded captures with hard delimiters
 const TASK_LINE = /^(\s*(?:>\s*)*)([-*+]|\d+[.)])(\s+)\[([ xX])\]/;
 
 // Fenced code block opener/closer. CommonMark allows fences to be
@@ -43,6 +47,7 @@ const TASK_LINE = /^(\s*(?:>\s*)*)([-*+]|\d+[.)])(\s+)\[([ xX])\]/;
 // be miscounted as a task — making the View's count-cross-check
 // refuse all toggles in the whole document.
 const FENCE_LINE = /^( {0,3})(`{3,}|~{3,})/;
+// eslint-disable-next-line security/detect-unsafe-regex -- bounded blockquote-prefix parser; `\s*` / `>\s?` / outer `+` operate on disjoint character classes (no overlap)
 const BLOCKQUOTE_PREFIX = /^(\s*(?:>\s?)+)/;
 
 // Mutable state for the line walker. Pulled out so the main toggle
@@ -66,7 +71,7 @@ function stepFence(line: string, state: FenceState): boolean {
   const content = quoteMatch ? line.slice(quoteMatch[0].length) : line;
   const fenceMatch = content.match(FENCE_LINE);
   if (fenceMatch) {
-    const marker = fenceMatch[2];
+    const [, , marker] = fenceMatch;
     if (!state.inFence) {
       // Openers may carry an info string after the marker
       // (e.g. "```ts"). We don't need to keep it — just enter
@@ -103,7 +108,7 @@ function stepFence(line: string, state: FenceState): boolean {
 function flipMark(line: string, match: RegExpMatchArray): string {
   const [whole, prefix, bullet, sep, mark] = match;
   const flipped = mark === " " ? "x" : " ";
-  return `${prefix}${bullet}${sep}[${flipped}]` + line.slice(whole.length);
+  return `${prefix}${bullet}${sep}[${flipped}]${line.slice(whole.length)}`;
 }
 
 /** Find the source-line index of every task-list item, in document

package/src/utils/plugin/runtime.ts

@@ -0,0 +1,132 @@
+// Browser-side plugin runtime construction (#1110). The host's runtime
+// plugin loader provides one of these per plugin via Vue's
+// `provide(PLUGIN_RUNTIME_KEY, ...)`; the plugin's components fetch
+// it via `useRuntime()` from `gui-chat-protocol/vue`.
+//
+// Every helper closes over `pkgName` so the plugin's pubsub channel
+// and notify call cannot leak into another plugin's namespace.
+
+import { computed, type Ref } from "vue";
+import { useI18n } from "vue-i18n";
+import type { BrowserPluginRuntime } from "gui-chat-protocol/vue";
+import { usePubSub } from "../../composables/usePubSub";
+import { apiPost } from "../api";
+import { API_ROUTES } from "../../config/apiRoutes";
+
+/** Build the channel name for a plugin's event. Must stay in lockstep
+ *  with `server/plugins/runtime.ts:pluginChannelName`. */
+export function pluginChannelName(pkgName: string, eventName: string): string {
+  return `plugin:${pkgName}:${eventName}`;
+}
+
+function makeScopedPubSub(pkgName: string): BrowserPluginRuntime["pubsub"] {
+  const { subscribe } = usePubSub();
+  return {
+    subscribe(eventName, handler) {
+      // The host pubsub fans payloads as `unknown`; the plugin
+      // declares the expected shape via the generic at the call
+      // site. Validation is the plugin's responsibility (Zod or
+      // hand-written guard).
+      return subscribe(pluginChannelName(pkgName, eventName), handler as (data: unknown) => void);
+    },
+  };
+}
+
+function makeScopedLogger(pkgName: string): BrowserPluginRuntime["log"] {
+  // Frontend logger maps to `console.*` in v1. The host's central
+  // logger lives server-side; routing browser logs there is a future
+  // enhancement that doesn't change this surface.
+  const tag = `[plugin/${pkgName}]`;
+  return {
+    debug: (msg, data) => console.debug(tag, msg, data),
+    info: (msg, data) => console.info(tag, msg, data),
+    warn: (msg, data) => console.warn(tag, msg, data),
+    error: (msg, data) => console.error(tag, msg, data),
+  };
+}
+
+/** Allowlisted URL schemes for `runtime.openUrl`. The two http schemes
+ *  cover the legitimate "open this external page" use case; everything
+ *  else (`javascript:`, `data:`, `vbscript:`, `file:`, custom schemes)
+ *  is rejected. The `noopener,noreferrer` flags on `window.open`
+ *  prevent the opened tab from snooping the opener but do NOT stop
+ *  `javascript:` execution — that's why scheme filtering is the actual
+ *  XSS guard. CodeRabbit review caught this on PR #1124. */
+const OPEN_URL_ALLOWED_SCHEMES: ReadonlySet<string> = new Set(["http:", "https:"]);
+
+function makeOpenUrl(pkgName: string): BrowserPluginRuntime["openUrl"] {
+  return (url: string) => {
+    let parsed: URL;
+    try {
+      parsed = new URL(url);
+    } catch {
+      console.warn(`[plugin/${pkgName}] openUrl rejected unparseable URL`, { url });
+      return;
+    }
+    if (!OPEN_URL_ALLOWED_SCHEMES.has(parsed.protocol)) {
+      console.warn(`[plugin/${pkgName}] openUrl rejected non-http(s) scheme`, { scheme: parsed.protocol });
+      return;
+    }
+    // `noopener` prevents the opened tab from accessing `window.opener`
+    // and snooping; `noreferrer` strips the Referer header so the
+    // destination can't see what page sent the user. Forced at the
+    // platform level so individual plugin links can't drop them.
+    const opened = window.open(url, "_blank", "noopener,noreferrer");
+    if (!opened) {
+      // Popup blocker engaged.
+      console.warn(`[plugin/${pkgName}] window.open returned null`, { url });
+    }
+  };
+}
+
+function makeDispatch(pkgName: string): BrowserPluginRuntime["dispatch"] {
+  // Substitute `:pkg` in the contracted dispatch route. encodeURIComponent
+  // collapses scoped names (`@org/pkg`) into one URL path segment;
+  // the parameter pattern `:pkg` matches any segment.
+  const url = API_ROUTES.plugins.runtimeDispatch.replace(":pkg", encodeURIComponent(pkgName));
+  return async <T = unknown>(args: object): Promise<T> => {
+    const result = await apiPost<T>(url, args);
+    if (!result.ok) {
+      throw new Error(`plugin/${pkgName} dispatch failed (${result.status}): ${result.error}`);
+    }
+    return result.data;
+  };
+}
+
+export interface MakeBrowserPluginRuntimeDeps {
+  /** npm package name. Used both as the namespace prefix for
+   *  pubsub channels and as the log prefix. */
+  pkgName: string;
+  /** Optional URL map exposed via `runtime.endpoints` for multi-URL
+   *  built-in plugins. Runtime-loaded plugins (the common
+   *  single-dispatch shape) leave this undefined. Built-in plugins
+   *  (#1141) hand `{ method, url }` records; host-shared scopes hand
+   *  plain string URLs — kept opaque here, narrowed at the consumer
+   *  via `pluginEndpoints<E>(scope)`. See `BrowserPluginRuntime.endpoints`
+   *  in `gui-chat-protocol@>=0.3.1` for the contract. */
+  endpoints?: Readonly<Record<string, unknown>>;
+}
+
+export function makeBrowserPluginRuntime(deps: MakeBrowserPluginRuntimeDeps): BrowserPluginRuntime {
+  const { pkgName, endpoints } = deps;
+  // `useI18n()` exposes `locale` as `WritableComputedRef<Locales>`.
+  // Wrapping in a fresh `computed` widens it to `Ref<string>` for
+  // plugin authors (so they don't need to import the host's locale
+  // union) while preserving reactivity.
+  const { locale: hostLocale } = useI18n();
+  const locale = computed(() => String(hostLocale.value)) as Ref<string>;
+  return {
+    pubsub: makeScopedPubSub(pkgName),
+    locale,
+    log: makeScopedLogger(pkgName),
+    openUrl: makeOpenUrl(pkgName),
+    dispatch: makeDispatch(pkgName),
+    // `BrowserPluginRuntime.endpoints` is now typed as the runtime's
+    // `E` type parameter (gui-chat-protocol@>=0.3.2, default
+    // `Readonly<Record<string, unknown>>`). Plugin authors pin the
+    // shape via `useRuntime<TheirShape>()` and read `runtime.endpoints!`
+    // without a cast. No coercion needed at this construction site —
+    // the host populates the field opaquely; each consumer narrows.
+    endpoints,
+  };
+}

package/src/utils/session/mergeSessions.ts

@@ -11,6 +11,43 @@
 import { isUserTextResponse } from "../tools/result";
 import type { SessionSummary, ActiveSession } from "../../types/session";
 
+// Server-side fields the sidebar inherits when present. `summary` /
+// `keywords` are AI-generated; `origin` distinguishes scheduler /
+// skill / bridge / human sessions; `isBookmarked` / `hasUnread` /
+// `statusMessage` are server-tracked flags. None of these have a
+// local fallback — copy them only when the server has actually set
+// them, otherwise they'd surface as explicit `undefined` in shallow
+// copies downstream.
+const SERVER_OVERRIDE_KEYS = ["summary", "keywords", "origin", "isBookmarked", "hasUnread", "statusMessage"] as const;
+
+export function pickServerOverrides(serverEntry: SessionSummary | undefined): Partial<SessionSummary> {
+  if (!serverEntry) return {};
+  const overrides: Partial<SessionSummary> = {};
+  for (const key of SERVER_OVERRIDE_KEYS) {
+    const value = serverEntry[key];
+    if (value !== undefined) {
+      Object.assign(overrides, { [key]: value });
+    }
+  }
+  return overrides;
+}
+
+// Fold every in-memory signal into isRunning so the sidebar spinner
+// reacts as fast as the fastest source:
+//   - serverEntry.isRunning: authoritative but arrives on a /api/sessions
+//     refetch
+//   - live.isRunning: mirrored from the server via refreshSessionStates;
+//     may be ahead during the refetch window, and covers live-only
+//     sessions with no serverEntry yet
+//   - live.pendingGenerations: updates on the socket round-trip of a
+//     generationStarted event, before any REST refetch
+// OR them so any one is enough. `live.isRunning` is always defined on
+// an ActiveSession, so the summary always carries a boolean here.
+export function computeLiveIsRunning(serverEntry: SessionSummary | undefined, live: Pick<ActiveSession, "isRunning" | "pendingGenerations">): boolean {
+  const pendingCount = Object.keys(live.pendingGenerations ?? {}).length;
+  return Boolean(serverEntry?.isRunning) || live.isRunning || pendingCount > 0;
+}
+
 // Build the summary shape the sidebar expects for a single live
 // session. Server-side data (AI-generated title, summary,
 // keywords) takes precedence over the local first-user-message
@@ -19,48 +56,14 @@ import type { SessionSummary, ActiveSession } from "../../types/session";
 function buildLiveSummary(live: ActiveSession, serverEntry: SessionSummary | undefined): SessionSummary {
   const firstUserMsg = live.toolResults.find(isUserTextResponse);
   const preview = serverEntry?.preview || (firstUserMsg?.message ?? "");
-  const base: SessionSummary = {
+  return {
     id: live.id,
     roleId: live.roleId,
     startedAt: live.startedAt,
     updatedAt: live.updatedAt,
     preview,
-  };
-  // Fold every in-memory signal into isRunning so the sidebar spinner
-  // reacts as fast as the fastest source:
-  //   - serverEntry.isRunning: authoritative but arrives on a /api/sessions
-  //     refetch
-  //   - live.isRunning: mirrored from the server via refreshSessionStates;
-  //     may be ahead during the refetch window, and covers live-only
-  //     sessions with no serverEntry yet
-  //   - live.pendingGenerations: updates on the socket round-trip of a
-  //     generationStarted event, before any REST refetch
-  // OR them so any one is enough. `live.isRunning` is always defined on
-  // an ActiveSession, so the summary always carries a boolean here.
-  const pending = live.pendingGenerations ?? {};
-  const isRunning = !!serverEntry?.isRunning || live.isRunning || Object.keys(pending).length > 0;
-  // Carry summary / keywords ONLY if the server already has them.
-  // Object-spread with a conditional object keeps us from adding
-  // `undefined` values that would otherwise show up as explicit
-  // `summary: undefined` in a later shallow-copy.
-  return {
-    ...base,
-    ...(serverEntry?.summary !== undefined && { summary: serverEntry.summary }),
-    ...(serverEntry?.keywords !== undefined && {
-      keywords: serverEntry.keywords,
-    }),
-    // `origin` is set once by the server when the session is created
-    // (scheduler / skill / bridge / human). A live session promoted
-    // from the server list must keep it — the tab bar renders the
-    // non-human glyph off this field.
-    ...(serverEntry?.origin !== undefined && { origin: serverEntry.origin }),
-    isRunning,
-    ...(serverEntry?.hasUnread !== undefined && {
-      hasUnread: serverEntry.hasUnread,
-    }),
-    ...(serverEntry?.statusMessage !== undefined && {
-      statusMessage: serverEntry.statusMessage,
-    }),
+    ...pickServerOverrides(serverEntry),
+    isRunning: computeLiveIsRunning(serverEntry, live),
   };
 }