mulmoclaude 0.6.0 → 0.6.2

package/server/api/routes/wiki.ts

@@ -15,7 +15,14 @@ import { previewSnippet } from "../../utils/logPreview.js";
 // different name avoids the no-shadow clash without renaming the
 // long-standing local.
 import { errorMessage as formatError } from "../../utils/errors.js";
-import { BULLET_LINK_PATTERN, BULLET_WIKI_LINK_PATTERN } from "../../utils/regex.js";
+// All wiki-text helpers (slug rules, index parsing, lint rules)
+// live in `src/lib/wiki-page/` as pure modules so the frontend can
+// share them without pulling in server-only deps. This route is
+// just the HTTP shell on top of those.
+import { parseWikiLink } from "../../../src/lib/wiki-page/link.js";
+import { wikiSlugify } from "../../../src/lib/wiki-page/slug.js";
+import { type WikiPageEntry, parseIndexEntries } from "../../../src/lib/wiki-page/index-parse.js";
+import { findBrokenLinksInPage, findMissingFiles, findOrphanPages, findTagDrift, formatLintReport } from "../../../src/lib/wiki-page/lint.js";
 
 const router = Router();
 
@@ -27,222 +34,47 @@ function readFileOrEmpty(absPath: string): string {
   return readTextSafeSync(absPath) ?? "";
 }
 
-export interface WikiPageEntry {
-  title: string;
-  slug: string;
-  description: string;
-  tags: string[];
-}
-
-// Slug rules: lowercase, spaces to hyphens, strip everything that
-// isn't a-z / 0-9 / hyphen. Used for both index parsing and page
-// lookup so the two stay consistent.
-export function wikiSlugify(text: string): string {
-  return text
-    .toLowerCase()
-    .replace(/\s+/g, "-")
-    .replace(/[^a-z0-9-]/g, "");
-}
-
-const TABLE_SEPARATOR_PATTERN = /^\|[\s|:-]+\|$/;
-// Bullet-link patterns (BULLET_LINK_PATTERN, BULLET_WIKI_LINK_PATTERN)
-// live in `server/utils/regex.ts` alongside other server regex audit
-// notes. Capture the href (group 2) alongside the title (group 1) so
-// we can derive the slug from the file name instead of re-slugifying
-// the title — important for non-ASCII titles like "さくらインターネット"
-// where `wikiSlugify` returns "" and the slug would otherwise be lost.
-// Unicode-aware tag body: any letter or number in any script
-// (so Japanese / Chinese / Korean tags like `#クラウド` or `#可視化`
-// work), plus `-` and `_` as internal joiners. First char is a
-// letter or number only — no leading punctuation.
-const HASHTAG_PATTERN = /(?:^|\s)#([\p{L}\p{N}][\p{L}\p{N}_-]*)/gu;
-
-// Extract `#tag` tokens from a bullet description, returning the
-// stripped description and a sorted, deduped, lowercased tag list.
-// Only matches at word boundaries so mid-word `#` (e.g. anchor URLs)
-// is left alone.
-export function extractHashTags(text: string): { description: string; tags: string[] } {
-  const tags: string[] = [];
-  HASHTAG_PATTERN.lastIndex = 0;
-  let match: RegExpExecArray | null;
-  while ((match = HASHTAG_PATTERN.exec(text)) !== null) {
-    tags.push(match[1].toLowerCase());
-  }
-  const description = text.replace(HASHTAG_PATTERN, "").replace(/\s+/g, " ").trim();
-  const deduped = [...new Set(tags)].sort();
-  return { description, tags: deduped };
-}
-
-// Split a table Tags cell — tolerates comma, whitespace, or `#`
-// prefixes. Empty cell yields an empty list.
-export function parseTagsCell(cell: string): string[] {
-  const tokens = cell
-    .split(/[,\s]+/)
-    .map((token) => token.trim().replace(/^#/, "").toLowerCase())
-    .filter((token) => token.length > 0);
-  return [...new Set(tokens)].sort();
-}
-
-// Map header cell names → column indices, case- and whitespace-
-// tolerant. Used by `parseTableRow` to locate the Tags column (and
-// any other named column) without assuming a fixed position, so
-// older 3- and 4-column tables keep working.
-export function buildTableColumnMap(headerRow: string): Map<string, number> {
-  const cells = headerRow
-    .split("|")
-    .slice(1, -1)
-    // Mirror `parseTableRow`'s cell-normalising: strip the surrounding
-    // backticks that commonly wrap cell values in wiki tables. Without
-    // this, a `| \`tags\` |` header maps to the key "`tags`" and the
-    // subsequent `columnMap.get("tags")` lookup silently misses the
-    // column, falling back to `tags: []`.
-    .map((cell) => cell.trim().replace(/^`|`$/g, "").toLowerCase());
-  const map = new Map<string, number>();
-  cells.forEach((cell, i) => {
-    if (cell) map.set(cell, i);
-  });
-  return map;
-}
-
-interface TableColumnIndices {
-  slug: number;
-  title: number;
-  summary: number;
-  /** Undefined when the table has no `tags` column — caller skips
-   *  the tags lookup entirely and the row gets `tags: []`. */
-  tags: number | undefined;
-}
-
-/** Resolve the per-column indices the row parser needs. Falls back
- *  to positional defaults (0/1/2) when the table has no header map.
- *  "summary" is the canonical column name; "description" is accepted
- *  as a legacy alias used by older fixtures. */
-function resolveTableColumnIndices(columnMap: Map<string, number> | null): TableColumnIndices {
-  return {
-    slug: columnMap?.get("slug") ?? 0,
-    title: columnMap?.get("title") ?? 1,
-    summary: columnMap?.get("summary") ?? columnMap?.get("description") ?? 2,
-    tags: columnMap?.get("tags"),
-  };
-}
-
-// Each parser returns the entry it produced (if any). The parent
-// loop tries them in order; the first non-null result wins.
-function parseTableRow(trimmed: string, columnMap: Map<string, number> | null): WikiPageEntry | null {
-  const cols = trimmed
-    .split("|")
-    .slice(1, -1)
-    .map((column) => column.trim().replace(/^`|`$/g, ""));
-  if (cols.length < 2) return null;
-
-  const idx = resolveTableColumnIndices(columnMap);
-  const slug = cols[idx.slug] ?? "";
-  const title = cols[idx.title] || slug;
-  if (!slug || !title) return null;
-
-  const description = cols[idx.summary] ?? "";
-  const tags = idx.tags !== undefined ? parseTagsCell(cols[idx.tags] ?? "") : [];
-  return { title, slug, description, tags };
-}
-
-// Extract the slug segment from a bullet link's href. Accepts the
-// canonical `pages/<slug>.md`, a bare `<slug>.md`, or just `<slug>`
-// — the three forms produced by different historical writers of
-// index.md. Returns "" for hrefs that don't look like a wiki page
-// reference (e.g. `https://example.com`) so the caller can fall
-// back to title-based slugification.
-export function extractSlugFromBulletHref(rawHref: string): string {
-  const href = rawHref.trim();
-  if (!href) return "";
-  if (/^[a-z]+:\/\//i.test(href)) return "";
-  const lastSegment = href.split("/").pop() ?? href;
-  return lastSegment.replace(/\.md$/i, "");
-}
-
-function parseBulletLinkRow(trimmed: string): WikiPageEntry | null {
-  const match = BULLET_LINK_PATTERN.exec(trimmed);
-  if (!match) return null;
-  const title = match[1].trim();
-  const href = match[2] ?? "";
-  const raw = match[3]?.trim() ?? "";
-  const { description, tags } = extractHashTags(raw);
-  // Prefer the slug embedded in the href so non-ASCII titles keep
-  // a navigable slug. Fall back to slugifying the title only when
-  // the href has no recognisable slug (rare — usually means the
-  // author put an external URL here).
-  const slug = extractSlugFromBulletHref(href) || wikiSlugify(title);
-  return { title, slug, description, tags };
-}
-
-function parseBulletWikiLinkRow(trimmed: string): WikiPageEntry | null {
-  const match = BULLET_WIKI_LINK_PATTERN.exec(trimmed);
-  if (!match) return null;
-  const title = match[1].trim();
-  const raw = match[2]?.trim() ?? "";
-  const { description, tags } = extractHashTags(raw);
-  return { title, slug: wikiSlugify(title), description, tags };
-}
-
-// Parse entries from index.md — supports three formats:
-// 1. Table: | `slug` | Title | Summary | Date |
-// 2. Bullet link: - [Title](pages/slug.md) — description
-// 3. Wiki link: - [[Title]] — description
-export function parseIndexEntries(content: string): WikiPageEntry[] {
-  const entries: WikiPageEntry[] = [];
-  let inTable = false;
-  let columnMap: Map<string, number> | null = null;
-
-  for (const line of content.split("\n")) {
-    const trimmed = line.trim();
-
-    if (trimmed.startsWith("|")) {
-      if (TABLE_SEPARATOR_PATTERN.test(trimmed)) {
-        inTable = true;
-        continue;
-      }
-      if (!inTable) {
-        // First `|`-line before the separator is the header. Capture
-        // the column map so parseTableRow can locate the Tags
-        // column (if any) by name rather than position.
-        columnMap = buildTableColumnMap(trimmed);
-        inTable = true;
-        continue;
-      }
-      const entry = parseTableRow(trimmed, columnMap);
-      if (entry) entries.push(entry);
-      continue;
-    }
-
-    inTable = false;
-    columnMap = null;
-
-    const bullet = parseBulletLinkRow(trimmed) ?? parseBulletWikiLinkRow(trimmed);
-    if (bullet) entries.push(bullet);
-  }
-  return entries;
-}
+// Wiki-text helpers (slugify, index parsing, lint rules) now live
+// under `src/lib/wiki-page/` as pure modules — see imports above.
+// Re-exports kept here for legacy callers that import via this
+// route module (e.g. tests in `test/routes/test_wikiHelpers.ts`).
+export { wikiSlugify } from "../../../src/lib/wiki-page/slug.js";
+export type { WikiPageEntry } from "../../../src/lib/wiki-page/index-parse.js";
+export { buildTableColumnMap, extractHashTags, extractSlugFromBulletHref, parseIndexEntries, parseTagsCell } from "../../../src/lib/wiki-page/index-parse.js";
+export { findBrokenLinksInPage, findMissingFiles, findOrphanPages, findTagDrift, formatLintReport } from "../../../src/lib/wiki-page/lint.js";
 
 // Resolve a page name to an absolute `.md` path using the in-memory
 // page index (see ./wiki/pageIndex.ts). Index is kept fresh via
 // pagesDir mtime, so zero readdir cost on cache hit.
+//
+// `pageName` may carry the `[[target|display]]` form on legacy
+// codepaths (e.g. an old chat-history entry that pre-dates the
+// renderer fix). `parseWikiLink` strips the display half so the
+// lookup uses just the target — same parser the renderer + lint
+// agree on, which is the whole point of the #1297 refactor.
+// Below this length the fuzzy `includes` step skips altogether.
+// CJK / emoji-only / very-short page names get slugified down to a
+// short noise tail (e.g. "日本語タイトル-chromium-{nonce}" →
+// "-chromium-{nonce}"), and that noise will partial-match almost
+// any page that happens to share the suffix. Skipping fuzzy for
+// these slugs avoids silent miss-resolves; the index.md title-match
+// fallback below still handles the legitimate non-ASCII case (#1194).
+const MIN_FUZZY_SLUG_LEN = 6;
+
 async function resolvePagePath(pageName: string): Promise<string | null> {
   const dir = pagesDir();
   const { slugs } = await getPageIndex(dir);
   if (slugs.size === 0) return null;
 
-  const slug = wikiSlugify(pageName);
+  const { target } = parseWikiLink(pageName);
+  const slug = wikiSlugify(target);
 
   if (slug.length > 0) {
     const exact = slugs.get(slug);
     if (exact) return path.join(dir, exact);
 
-    // Fuzzy: same `includes` semantics as the old sync path — iterate
-    // the index's keys, no filesystem access.
-    for (const [key, file] of slugs) {
-      if (slug.includes(key) || key.includes(slug)) {
-        return path.join(dir, file);
-      }
-    }
+    const fuzzy = pickFuzzyMatch(slug, slugs);
+    if (fuzzy) return path.join(dir, fuzzy);
   }
 
   // Non-ASCII page names (e.g. Japanese [[wiki links]]) produce empty
@@ -250,7 +82,7 @@ async function resolvePagePath(pageName: string): Promise<string | null> {
   // wiki index so the link resolves to its page file.
   const indexContent = readFileOrEmpty(indexFile());
   const entries = parseIndexEntries(indexContent);
-  const titleMatch = entries.find((entry) => entry.title === pageName);
+  const titleMatch = entries.find((entry) => entry.title === target);
   if (titleMatch) {
     const file = slugs.get(titleMatch.slug);
     if (file) return path.join(dir, file);
@@ -259,6 +91,39 @@ async function resolvePagePath(pageName: string): Promise<string | null> {
   return null;
 }
 
+// Walk every indexed slug looking for an `includes`-style match.
+// Returns the single best candidate, or null when the slug is too
+// short to be meaningful OR multiple candidates tie at the top score
+// (ambiguous — leave the resolution to the caller's title-match
+// fallback rather than silently picking iteration-order-first).
+//
+// Score = min(slug.length, key.length) / max(slug.length, key.length).
+// A perfect match where both strings are identical scores 1.0 (but
+// that path is taken by the exact `slugs.get` above, never reaches
+// here). Otherwise the highest-scoring partial match wins, and the
+// score is decoupled from Map iteration order (= filesystem readdir
+// order) so the resolver is deterministic across hosts.
+export function pickFuzzyMatch(slug: string, slugs: ReadonlyMap<string, string>): string | null {
+  if (slug.length < MIN_FUZZY_SLUG_LEN) return null;
+  let bestFile: string | null = null;
+  let bestScore = 0;
+  let bestIsTied = false;
+  for (const [key, file] of slugs) {
+    if (!slug.includes(key) && !key.includes(slug)) continue;
+    const shorter = Math.min(slug.length, key.length);
+    const longer = Math.max(slug.length, key.length);
+    const score = shorter / longer;
+    if (score > bestScore) {
+      bestScore = score;
+      bestFile = file;
+      bestIsTied = false;
+    } else if (score === bestScore) {
+      bestIsTied = true;
+    }
+  }
+  return bestIsTied ? null : bestFile;
+}
+
 router.get(API_ROUTES.wiki.base, async (req: Request, res: Response<WikiResponse | ErrorResponse>) => {
   const slug = getOptionalStringQuery(req, "slug");
   if (slug) {
@@ -410,78 +275,10 @@ function buildLogResponse(action: string): WikiResponse {
   };
 }
 
-const WIKI_LINK_PATTERN = /\[\[([^\][\r\n]{1,200})\]\]/g;
-
-// Pure helpers extracted from the lint pass — they take what they
-// need as plain inputs so each rule can be unit-tested without
-// touching the filesystem.
-
-export function findOrphanPages(fileSlugs: ReadonlySet<string>, indexedSlugs: ReadonlySet<string>): string[] {
-  const issues: string[] = [];
-  for (const slug of fileSlugs) {
-    if (!indexedSlugs.has(slug)) {
-      issues.push(`- **Orphan page**: \`${slug}.md\` exists but is missing from index.md`);
-    }
-  }
-  return issues;
-}
-
-export function findMissingFiles(pageEntries: readonly WikiPageEntry[], fileSlugs: ReadonlySet<string>): string[] {
-  const issues: string[] = [];
-  for (const entry of pageEntries) {
-    if (!fileSlugs.has(entry.slug)) {
-      issues.push(`- **Missing file**: index.md references \`${entry.slug}\` but the file does not exist`);
-    }
-  }
-  return issues;
-}
-
-export function findBrokenLinksInPage(fileName: string, content: string, fileSlugs: ReadonlySet<string>): string[] {
-  const issues: string[] = [];
-  const wikiLinks = [...content.matchAll(WIKI_LINK_PATTERN)].map((match) => match[1]);
-  for (const link of wikiLinks) {
-    const linkSlug = wikiSlugify(link);
-    if (!fileSlugs.has(linkSlug)) {
-      issues.push(`- **Broken link** in \`${fileName}\`: [[${link}]] → \`${linkSlug}.md\` not found`);
-    }
-  }
-  return issues;
-}
-
-function formatTagList(tags: readonly string[]): string {
-  return `[${[...tags].sort().join(", ")}]`;
-}
-
-// Flag any slug whose index.md tags differ from the page's own
-// frontmatter `tags:` field. Comparison is set-based and order-
-// insensitive; both sides are lowercased at parse time. Slugs
-// missing from `frontmatterTagsBySlug` are ignored here — the
-// missing file itself is already reported by `findMissingFiles`.
-export function findTagDrift(pageEntries: readonly WikiPageEntry[], frontmatterTagsBySlug: ReadonlyMap<string, readonly string[]>): string[] {
-  const issues: string[] = [];
-  for (const entry of pageEntries) {
-    // Lowercase on lookup — `collectLintIssues` keys the map with
-    // lowercased slugs, so a `MyPage.md` filename still matches an
-    // `entry.slug` of `mypage` produced by `wikiSlugify` on the
-    // wiki-link parser path.
-    const pageTags = frontmatterTagsBySlug.get(entry.slug.toLowerCase());
-    if (pageTags === undefined) continue;
-    const pageSet = new Set(pageTags);
-    const indexSet = new Set(entry.tags);
-    if (pageSet.size !== indexSet.size || [...pageSet].some((tag) => !indexSet.has(tag))) {
-      issues.push(`- **Tag drift**: \`${entry.slug}.md\` frontmatter has ${formatTagList(pageTags)} but index.md has ${formatTagList(entry.tags)}`);
-    }
-  }
-  return issues;
-}
-
-export function formatLintReport(issues: readonly string[]): string {
-  if (issues.length === 0) {
-    return "# Wiki Lint Report\n\n✓ No issues found. Wiki is healthy.";
-  }
-  const noun = `issue${issues.length !== 1 ? "s" : ""}`;
-  return `# Wiki Lint Report\n\n${issues.length} ${noun} found:\n\n${issues.join("\n")}`;
-}
+// Pure lint helpers (findOrphanPages, findMissingFiles,
+// findBrokenLinksInPage, findTagDrift, formatLintReport) now live
+// in `src/lib/wiki-page/lint.ts` and are re-exported above. The
+// route below is the thin filesystem shell around them.
 
 async function collectLintIssues(): Promise<string[]> {
   const dir = pagesDir();

package/server/events/file-change.ts

@@ -17,6 +17,7 @@ import { fileChannel, toPosixWorkspacePath, type FileChannelPayload } from "../.
 import { workspacePath } from "../workspace/workspace.js";
 import { maybeRegenerateTopicIndex, TOPIC_INDEX_RELATIVE_PATH } from "../workspace/memory/topic-index-hook.js";
 import { log } from "../system/logger/index.js";
+import { errorMessage } from "../utils/errors.js";
 
 let pubsub: IPubSub | null = null;
 
@@ -42,7 +43,7 @@ export async function publishFileChange(relativePath: string): Promise<void> {
   } catch (err) {
     log.warn("file-change", "stat failed; falling back to Date.now()", {
       pathPreview: relativePath,
-      error: err instanceof Error ? err.message : String(err),
+      error: errorMessage(err),
     });
     mtimeMs = Date.now();
   }
@@ -59,7 +60,7 @@ export async function publishFileChange(relativePath: string): Promise<void> {
   } catch (err) {
     log.warn("file-change", "publish failed; subscribers will miss this event", {
       pathPreview: posixPath,
-      error: err instanceof Error ? err.message : String(err),
+      error: errorMessage(err),
     });
   }
   // Side-effect hook: keep the topic-format MEMORY.md index in sync

package/server/events/session-store/index.ts

@@ -12,6 +12,7 @@ import { env } from "../../system/env.js";
 import { updateHasUnread } from "../../utils/files/session-io.js";
 import { EVENT_TYPES, GENERATION_KINDS, type GenerationKind, type PendingGeneration, generationKey } from "../../../src/types/events.js";
 import { ONE_HOUR_MS, ONE_MINUTE_MS } from "../../utils/time.js";
+import { errorMessage } from "../../utils/errors.js";
 
 // ── Types ──────────────────────────────────────────────────────
 
@@ -394,7 +395,7 @@ function applyEventToSession(session: ServerSession, type: string, event: Record
       enqueueJsonlAppend(session, buildToolCallLine(event)).catch((err: unknown) => {
         log.warn("session-store", "persist tool_call failed (non-fatal)", {
           chatSessionId: session.chatSessionId,
-          error: err instanceof Error ? err.message : String(err),
+          error: errorMessage(err),
         });
       });
     }

package/server/index.ts

@@ -4,6 +4,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import agentRoutes, { startChat } from "./api/routes/agent.js";
 import accountingRoutes from "./api/routes/accounting.js";
+import photoLocationsRoutes from "./api/routes/photo-locations.js";
 import schedulerRoutes from "./api/routes/scheduler.js";
 import sessionsRoutes, { loadAllSessions } from "./api/routes/sessions.js";
 import chatIndexRoutes from "./api/routes/chat-index.js";
@@ -13,16 +14,19 @@ import pluginsRoutes from "./api/routes/plugins.js";
 import imageRoutes from "./api/routes/image.js";
 import attachmentRoutes from "./api/routes/attachment.js";
 import presentHtmlRoutes from "./api/routes/presentHtml.js";
+import presentSvgRoutes from "./api/routes/presentSvg.js";
 import chartRoutes from "./api/routes/chart.js";
 import rolesRoutes from "./api/routes/roles.js";
 import { DEFAULT_ROLE_ID } from "../src/config/roles.js";
 import mulmoScriptRoutes from "./api/routes/mulmo-script.js";
 import wikiRoutes from "./api/routes/wiki.js";
 import wikiHistoryRoutes from "./api/routes/wiki/history.js";
-import { provisionWikiHistoryHook } from "./workspace/wiki-history/provision.js";
+import { provisionDispatcherHook } from "./workspace/hooks/provision.js";
 import pdfRoutes from "./api/routes/pdf.js";
 import filesRoutes from "./api/routes/files.js";
 import configRoutes from "./api/routes/config.js";
+import configRefreshRoutes from "./api/routes/config-refresh.js";
+import hookLogRoutes from "./api/routes/hookLog.js";
 import skillsRoutes from "./api/routes/skills.js";
 import runtimePluginRoutes from "./api/routes/runtime-plugin.js";
 import { loadRuntimePlugins } from "./plugins/runtime-loader.js";
@@ -36,6 +40,8 @@ import { createNotificationsRouter } from "./api/routes/notifications.js";
 import { startLegacyAdapters } from "./notifier/legacy-adapters.js";
 import notifierRoutes from "./api/routes/notifier.js";
 import { initNotifier } from "./notifier/engine.js";
+import { registerSaveAttachmentHook } from "./utils/files/attachment-store.js";
+import { capturePhotoLocation } from "./workspace/photo-locations/index.js";
 import { createJournalRouter } from "./api/routes/journal.js";
 import { createTranslationRouter } from "./api/routes/translation.js";
 import { announcePluginMetaDiagnostics } from "./plugins/diagnostics.js";
@@ -53,6 +59,7 @@ import { mcpToolsRouter, mcpTools, isMcpToolEnabled } from "./agent/mcp-tools/in
 import { initWorkspace, workspacePath } from "./workspace/workspace.js";
 import { runMemoryMigrationOnce } from "./workspace/memory/run.js";
 import { runTopicMigrationOnce } from "./workspace/memory/topic-run.js";
+import { migrateCookingRecipesFromPlugin } from "./workspace/cooking-recipes/migrate.js";
 import { env, isGeminiAvailable } from "./system/env.js";
 import { buildSandboxStatus } from "./api/sandboxStatus.js";
 import { existsSync, readFileSync } from "fs";
@@ -76,6 +83,7 @@ import { bearerAuth } from "./api/auth/bearerAuth.js";
 import { deleteTokenFile, generateAndWriteToken, getCurrentToken } from "./api/auth/token.js";
 import { log } from "./system/logger/index.js";
 import { logBackgroundError } from "./utils/logBackgroundError.js";
+import { errorMessage } from "./utils/errors.js";
 import { registerScheduledSkills } from "./workspace/skills/scheduler.js";
 import { registerUserTasks } from "./workspace/skills/user-tasks.js";
 import { API_ROUTES } from "../src/config/apiRoutes.js";
@@ -127,8 +135,28 @@ runMemoryMigrationOnce(workspacePath)
   .then(() => runTopicMigrationOnce(workspacePath))
   .then(noop, noop);
 
+// Recipe-book plugin → `mc-cooking-coach` skill migration (#1286).
+// Boot-time idempotent copy from the plugin's `files.data` scope
+// (`data/plugins/<sanitised-pkg>/recipes/`) to the canonical
+// `data/cooking/recipes/` path the skill drives. Sentinel-gated so
+// every boot after the first is a no-op.
+migrateCookingRecipesFromPlugin().catch((err) => {
+  log.warn("cooking-recipes", "migration from plugin failed; falling back to original plugin path", {
+    error: errorMessage(err),
+  });
+});
+
 let sandboxEnabled = false;
 
+// --- Photo-EXIF capture hook (#1222 PR-A) ---
+// Registered at module load (NOT inside `startRuntimeServices`)
+// because uploads can land in the gap between `app.listen` accepting
+// connections and the runtime-services bootstrap finishing. The hook
+// itself short-circuits on non-image MIME / auto-capture opt-out, so
+// registering early is free for non-photo flows. (CodeRabbit review
+// on PR #1247.)
+registerSaveAttachmentHook(capturePhotoLocation);
+
 const app = express();
 
 app.disable("x-powered-by");
@@ -182,7 +210,16 @@ app.use("/api", (req, res, next) => {
     next();
     return;
   }
-  if (req.method === "GET" && RUNTIME_PLUGIN_ASSET_PATH_RE.test(req.path)) {
+  if ((req.method === "GET" || req.method === "HEAD") && RUNTIME_PLUGIN_ASSET_PATH_RE.test(req.path)) {
+    // HEAD is bypassed for the same reason as GET: the frontend
+    // runtime-plugin loader HEAD-probes `dist/vue.js` to distinguish
+    // "no Vue bundle (404, server-only plugin)" from real load
+    // failures before `import()`-ing the asset (#1273 follow-up).
+    // That probe is a raw `fetch`, not the bearer-attaching `apiGet`,
+    // and the actual `import()` itself can't attach Authorization
+    // either — so the auth-bypass must cover both verbs or every
+    // runtime plugin's Vue View silently downgrades to a
+    // definition-only entry (401 → "unexpected status" → no view).
     next();
     return;
   }
@@ -399,6 +436,81 @@ app.use(
   express.static(WORKSPACE_PATHS.htmls, { dotfiles: "deny", fallthrough: false }),
 );
 
+// Static mount for SVG artifacts. SVG files are loaded into the View
+// and Preview as `<img src="/artifacts/svg/<name>.svg">`. Browsers
+// refuse to execute `<script>` inside an SVG loaded via `<img>`, so
+// the `<img>` tag itself is the sandbox for that consumer path.
+//
+// BUT `/artifacts/svg/<file>.svg` is also a directly addressable URL on
+// the SPA's origin (loopback-only, bearer-auth bypassed for `<img src>`
+// access), so a user who navigates straight to that URL — or is tricked
+// into clicking a markdown link — would otherwise get the SVG rendered
+// as a TOP-LEVEL document with full script execution in the app's
+// origin (localStorage, /api/* with the user's session, etc.). Since
+// the SVG body is LLM-generated and writable via the update route, a
+// prompt-injected SVG becomes a stored-XSS vector.
+//
+// Mitigation: send a strict response CSP. The `sandbox` directive gives
+// the response an opaque origin and disables script execution for the
+// top-level navigation case; the other directives starve subresource
+// loads (block external script/font/connect, only allow `<image>` refs
+// to self / data URIs). CSP on a subresource response is mostly
+// informational — `<img>` rendering ignores the bytes' CSP — so this
+// header doesn't interfere with the normal View / Preview path.
+const SVG_RESPONSE_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; sandbox";
+
+// Strict three-layer guard mirroring the `/artifacts/images` mount:
+// extension allowlist, realpath traversal check, dotfiles deny +
+// fallthrough false on `express.static`. Bearer auth bypassed for the
+// same reason as `/artifacts/images` / `/artifacts/html`: an
+// `<img src>` request can't carry an Authorization header. Loopback-
+// only listener + `requireSameOrigin` remain the trust boundary.
+const SVG_EXT_RE = /\.svg$/i;
+let svgsDirReal: string | null = null;
+async function getSvgsDirReal(): Promise<string | null> {
+  if (svgsDirReal) return svgsDirReal;
+  try {
+    svgsDirReal = await fsRealpath(WORKSPACE_PATHS.svgs);
+    return svgsDirReal;
+  } catch {
+    return null;
+  }
+}
+app.use(
+  "/artifacts/svg",
+  async (req, res, next) => {
+    if (!SVG_EXT_RE.test(req.path)) {
+      res.status(404).end();
+      return;
+    }
+    const root = await getSvgsDirReal();
+    if (!root) {
+      res.status(404).end();
+      return;
+    }
+    let relPath: string;
+    try {
+      relPath = decodeURIComponent(req.path.replace(/^\//, ""));
+    } catch {
+      res.status(404).end();
+      return;
+    }
+    if (!resolveWithinRoot(root, relPath)) {
+      res.status(404).end();
+      return;
+    }
+    if (containsDotfileSegment(relPath)) {
+      res.status(404).end();
+      return;
+    }
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Content-Type", "image/svg+xml; charset=utf-8");
+    res.setHeader("Content-Security-Policy", SVG_RESPONSE_CSP);
+    next();
+  },
+  express.static(WORKSPACE_PATHS.svgs, { dotfiles: "deny", fallthrough: false }),
+);
+
 app.get(API_ROUTES.health, (_req: Request, res: Response) => {
   // `os.loadavg()[0]` is the kernel 1-minute load average. On Linux /
   // macOS it's the primary "is this machine busy" signal; on Windows
@@ -437,6 +549,7 @@ app.get(API_ROUTES.sandbox, (_req: Request, res: Response) => {
 // the `/api` literal into each `router.post(API_ROUTES.…)` call.
 app.use(agentRoutes);
 app.use(accountingRoutes);
+app.use(photoLocationsRoutes);
 // todosRoutes removed (#1145) — todo is now a runtime plugin
 // (`@mulmoclaude/todo-plugin`); the dispatch route is generated by
 // `runtime-plugin.ts` at `/api/plugins/runtime/<pkg>/dispatch`.
@@ -449,6 +562,7 @@ app.use(pluginsRoutes);
 app.use(imageRoutes);
 app.use(attachmentRoutes);
 app.use(presentHtmlRoutes);
+app.use(presentSvgRoutes);
 app.use(chartRoutes);
 app.use(rolesRoutes);
 app.use(mulmoScriptRoutes);
@@ -460,6 +574,8 @@ app.use("/api/wiki", wikiHistoryRoutes);
 app.use(pdfRoutes);
 app.use(filesRoutes);
 app.use(configRoutes);
+app.use(configRefreshRoutes);
+app.use(hookLogRoutes);
 app.use(skillsRoutes);
 app.use(runtimePluginRoutes);
 async function listSessionsForBridge(opts: { limit: number; offset: number }) {
@@ -965,12 +1081,18 @@ process.on("SIGTERM", () => {
   sandboxEnabled = await setupSandbox();
   logMcpStatus();
 
-  // Provision the LLM-write hook in the workspace's
-  // `.claude/settings.json` (#763 PR 2). Idempotent — safe on every
-  // startup. Done BEFORE the agent ever spawns a claude CLI subprocess
-  // so the hook is in place from the first turn.
-  await provisionWikiHistoryHook().catch((err) => {
-    log.warn("wiki-history", "hook provisioning failed; LLM wiki edits will not be snapshotted this session", {
+  // Unified PostToolUse dispatcher (#763 PR 2, #1283, #1295). One
+  // entry in `<workspace>/.claude/settings.json` that fans out to:
+  //   - wiki-snapshot (page Writes → snapshot pipeline)
+  //   - config-refresh (SKILL.md / scheduler tasks.json / data/skills/*.md → POST /api/config/refresh)
+  //   - skill-bridge (data/skills/*.md ↔ .claude/skills/<slug>/SKILL.md)
+  //
+  // Done BEFORE the agent ever spawns a claude CLI subprocess so the
+  // hook is in place from the first turn. The provisioner also strips
+  // pre-unification entries (wikiHistory / configRefresh owner markers)
+  // so existing workspaces upgrade cleanly without double-firing.
+  await provisionDispatcherHook().catch((err) => {
+    log.warn("hooks", "dispatcher provisioning failed; PostToolUse side-effects (snapshots, refresh, skill bridge) will not run this session", {
       error: String(err),
     });
   });