mulmoclaude 0.6.1 → 0.6.2

package/server/agent/config.ts

@@ -4,7 +4,7 @@ import { createRequire } from "node:module";
 import type { Role } from "../../src/config/roles.js";
 import { mcpTools, isMcpToolEnabled } from "./mcp-tools/index.js";
 import { getActiveToolDescriptors } from "./activeTools.js";
-import type { McpServerSpec } from "../system/config.js";
+import type { EffortLevel, McpServerSpec } from "../system/config.js";
 import { getCurrentToken } from "../api/auth/token.js";
 import type { Attachment } from "@mulmobridge/protocol";
 import { isImageMime, isNativeAttachmentMime } from "@mulmobridge/client";
@@ -79,6 +79,22 @@ export function prepareUserServers(userServers: Record<string, McpServerSpec>, u
     if (spec.type === "http") {
       out[serverId] = prepareUserHttpServer(spec, useDocker);
     } else {
+      // Stay symmetric with `userServerAllowedToolNames`: stdio
+      // servers can't run inside the sandbox image (see
+      // docs/mcp-sandbox.md for the full rationale — #162 / #1334).
+      // Claude CLI 2.1.x silently exits 1 when a stdio MCP fails to
+      // start, so passing the spec through here would mask the
+      // failure as a generic boot error. Drop + log per skipped
+      // entry so an operator scanning the log knows why their MCP
+      // didn't load.
+      if (useDocker) {
+        log.info("mcp", "skipping stdio server in Docker sandbox", {
+          serverId,
+          transport: "stdio",
+          reason: "sandbox image is too minimal to host arbitrary stdio MCP runtimes",
+        });
+        continue;
+      }
       out[serverId] = prepareUserStdioServer(spec, useDocker, hostWorkspacePath);
     }
   }
@@ -211,10 +227,13 @@ export interface CliArgsParams {
   // Web UI-managed extension of the allowed-tools list. Merged with
   // BASE_ALLOWED_TOOLS and the mcp__mulmoclaude__ plugin names.
   extraAllowedTools?: string[];
+  // Reasoning effort (#1323). When undefined, the flag is omitted
+  // and Claude picks its own default.
+  effortLevel?: EffortLevel;
 }
 
 export function buildCliArgs(params: CliArgsParams): string[] {
-  const { systemPrompt, activePlugins, claudeSessionId, mcpConfigPath, extraAllowedTools = [] } = params;
+  const { systemPrompt, activePlugins, claudeSessionId, mcpConfigPath, extraAllowedTools = [], effortLevel } = params;
 
   const mcpToolNames = activePlugins.map((pluginName) => `mcp__mulmoclaude__${pluginName}`);
   // DEBUG: also pass the wildcard form `mcp__mulmoclaude` so Claude
@@ -264,6 +283,10 @@ export function buildCliArgs(params: CliArgsParams): string[] {
     args.push("--strict-mcp-config");
   }
 
+  if (effortLevel) {
+    args.push("--effort", effortLevel);
+  }
+
   return args;
 }
 

package/server/agent/index.ts

@@ -6,6 +6,7 @@ import { refreshCredentials } from "../system/credentials.js";
 import { loadMcpConfig, loadSettings } from "../system/config.js";
 import type { Role } from "../../src/config/roles.js";
 import { buildSystemPrompt } from "./prompt.js";
+import { loadMemorySnapshot } from "../workspace/memory/snapshot.js";
 import { CONTAINER_WORKSPACE_PATH, buildMcpConfig, getActivePlugins, prepareUserServers, resolveMcpConfigPaths, userServerAllowedToolNames } from "./config.js";
 import { validateStdioPackages } from "./mcpHealth.js";
 import type { Attachment } from "@mulmobridge/protocol";
@@ -65,11 +66,15 @@ export async function* runAgent({
     await refreshCredentials();
   }
 
+  // Pre-load memory once (atomic vs topic format chosen inside
+  // `loadMemorySnapshot`) so prompt assembly itself stays sync.
+  const memorySnapshot = await loadMemorySnapshot(workspacePath);
   const fullSystemPrompt = buildSystemPrompt({
     role,
     workspacePath: useDocker ? CONTAINER_WORKSPACE_PATH : workspacePath,
     useDocker,
     userTimezone,
+    memorySnapshot,
   });
 
   // --debug: dump the full system prompt on the first message of each session.
@@ -134,6 +139,7 @@ export async function* runAgent({
       activePlugins,
       mcpConfigPath: hasMcp ? mcpPaths.argPath : undefined,
       extraAllowedTools: [...settings.extraAllowedTools, ...userServerAllowedTools],
+      effortLevel: settings.effortLevel,
       abortSignal,
       userTimezone,
       useDocker,

package/server/agent/prompt.ts

@@ -1,10 +1,8 @@
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
-import { loadAllMemoryEntriesSync } from "../workspace/memory/io.js";
 import type { MemoryEntry } from "../workspace/memory/types.js";
-import { hasTopicFormat } from "../workspace/memory/topic-detect.js";
-import { loadAllTopicFilesSync } from "../workspace/memory/topic-io.js";
 import type { TopicMemoryFile } from "../workspace/memory/topic-types.js";
+import type { MemorySnapshot } from "../workspace/memory/snapshot.js";
 import type { Role } from "../../src/config/roles.js";
 import { getActiveToolDescriptors, MCP_SERVER_ID } from "./activeTools.js";
 import { WORKSPACE_DIRS, WORKSPACE_FILES } from "../workspace/paths.js";
@@ -68,6 +66,18 @@ Treat the markers as the source of truth for **which** files the user means when
 
 When the user wants to transform existing images, call \`editImages\` with \`imagePaths\` set to an array of one or more workspace paths (single image: a one-element array). Pull the paths from the \`[Attached file: …]\` markers, from earlier tool results in this conversation, or from explicit paths the user mentions in plain text. When several markers are present and the request reads as a multi-image instruction ("combine these", "merge", "use both", etc.), include every relevant path in the array, in the order they appeared. \`editImages\` is fully stateless — it has no concept of a "currently selected" image, so the array is the only signal of which images to edit.
 
+## Referring to files in chat replies
+
+When you finish creating, updating, or surfacing a file in your reply (PDF, Markdown, HTML, image, spreadsheet, chart, etc.), present it to the user as a **Markdown link**:
+
+\`[<short label or filename>](<workspace-relative-path>)\`
+
+- ALWAYS use the Markdown link form so the UI renders it as a clickable link. Example: \`[summary.pdf](artifacts/documents/2026/05/summary.pdf)\`, or \`[updated wiki](data/wiki/pages/notes.md)\`.
+- NEVER write the path as inline code (e.g. \`\\\`artifacts/foo.pdf\\\`\`) — that renders as non-clickable code and forces the user to copy / paste.
+- NEVER write the path as plain text (e.g. "Open artifacts/foo.pdf to review") — same problem.
+- The link path is the same **workspace-relative** form used everywhere else: no leading slash, no \`file://\`, no \`/api/files/...\` URL. The host resolves it to the right surface (Files panel preview / wiki page / canvas) when the user clicks.
+- A short follow-up sentence like "Open it to review" or "ご確認ください" is fine, but the path itself MUST be inside the \`[...](...)\` wrapper.
+
 ## Task Scheduling
 
 Skills and tasks can be scheduled via SKILL.md frontmatter (\`schedule: "daily HH:MM"\` or \`schedule: "interval Nh"\`). When the user asks to schedule something, recommend an appropriate frequency:
@@ -154,24 +164,24 @@ export function prependJournalPointer(message: string, workspacePath: string): s
 // `readTypedMemoryEntries` / `readLegacyMemoryFile` /
 // `formatMemoryEntryForPrompt` go with them. See
 // `server/index.ts` for the full cleanup sweep.
-export function buildMemoryContext(workspacePath: string): string {
+export function buildMemoryContext(snapshot: MemorySnapshot, workspacePath: string): string {
   const parts: string[] = [];
 
-  if (hasTopicFormat(workspacePath)) {
+  if (snapshot.format === "topic") {
     // Post-swap (topic format active): each topic file lands in the
     // prompt as a single block — header + section index + body.
     // The atomic / legacy readers are intentionally skipped here:
     // once the topic layout is in place the user has acknowledged
     // the cluster and the atomic entries have been parked under
     // `.atomic-backup/`.
-    const topic = readTopicMemoryEntries(workspacePath);
+    const topic = formatTopicFiles(snapshot.files);
     if (topic) parts.push(topic);
   } else {
     // Pre-swap: union of typed atomic entries (#1029) and the
     // legacy `memory.md` (#1029 PR-A). Same dual-mode behaviour
     // PR-B of #1029 shipped — preserved unchanged here so users
     // without topic format keep seeing their memory.
-    const atomic = readTypedMemoryEntries(workspacePath);
+    const atomic = formatTypedMemoryEntries(snapshot.entries);
     if (atomic) parts.push(atomic);
     const legacy = readLegacyMemoryFile(workspacePath);
     if (legacy) parts.push(legacy);
@@ -283,15 +293,20 @@ Keep entries short — name + description + a few lines of body at most. Bias to
 // the workspace uses the topic layout (post-#1070 swap), emits the
 // topic-format rules (find-or-create `<type>/<topic>.md`, append
 // bullets under H2). Otherwise emits the atomic-format rules from
-// #1029 PR-B (one fact per `<type>_<slug>.md`). The same disk
-// signal that drives `buildMemoryContext` decides which one to
-// emit, so write rules and read context are always consistent.
-export function buildMemoryManagementSection(workspacePath: string): string {
-  return hasTopicFormat(workspacePath) ? TOPIC_MEMORY_MANAGEMENT : ATOMIC_MEMORY_MANAGEMENT;
+// #1029 PR-B (one fact per `<type>_<slug>.md`). Both this section
+// and `buildMemoryContext` derive format from the same `snapshot`
+// so write rules and read context stay consistent — including in
+// Docker runs where `workspacePath="/workspace"` doesn't match the
+// host path the snapshot was loaded from (Codex review on #1280).
+export function buildMemoryManagementSection(snapshot: MemorySnapshot): string {
+  return snapshot.format === "topic" ? TOPIC_MEMORY_MANAGEMENT : ATOMIC_MEMORY_MANAGEMENT;
 }
 
-function readTopicMemoryEntries(workspacePath: string): string | null {
-  const files = loadAllTopicFilesSync(workspacePath);
+// Pure formatters — I/O happens once via `loadMemorySnapshot` before
+// `buildSystemPrompt` is called (see `server/agent/index.ts`). Keeps
+// prompt assembly side-effect-free per section.
+
+function formatTopicFiles(files: readonly TopicMemoryFile[]): string | null {
   if (files.length === 0) return null;
   return files.map(formatTopicFileForPrompt).join("\n\n---\n\n");
 }
@@ -303,13 +318,7 @@ function formatTopicFileForPrompt(file: TopicMemoryFile): string {
   return body ? `${tagLine}\n${body}` : tagLine;
 }
 
-function readTypedMemoryEntries(workspacePath: string): string | null {
-  // Use the validated loader rather than reading raw files directly:
-  // a corrupt frontmatter (mid-edit, malformed YAML) is logged and
-  // skipped by `loadAllMemoryEntriesSync` instead of leaking into the
-  // system prompt. This also keeps the skip rules (MEMORY.md /
-  // dotfiles / non-files) defined in exactly one place.
-  const entries = loadAllMemoryEntriesSync(workspacePath);
+function formatTypedMemoryEntries(entries: readonly MemoryEntry[]): string | null {
   if (entries.length === 0) return null;
   return entries.map(formatMemoryEntryForPrompt).join("\n\n");
 }
@@ -522,6 +531,10 @@ export interface SystemPromptParams {
    *  user every turn. Missing or invalid values fall back to
    *  server-local date only. */
   userTimezone?: string;
+  /** Pre-loaded memory snapshot — caller awaits `loadMemorySnapshot`
+   *  before invoking `buildSystemPrompt` so prompt assembly stays
+   *  synchronous and side-effect-free for the memory section. */
+  memorySnapshot: MemorySnapshot;
 }
 
 // Accept IANA-looking strings only. Anything else (including
@@ -681,15 +694,15 @@ interface NamedSection {
 const SYSTEM_PROMPT_WARN_THRESHOLD_CHARS = 20000;
 
 export function buildSystemPrompt(params: SystemPromptParams): string {
-  const { role, workspacePath, useDocker, userTimezone } = params;
+  const { role, workspacePath, useDocker, userTimezone, memorySnapshot } = params;
 
   const sections: NamedSection[] = [
     { name: "base", content: SYSTEM_PROMPT },
     { name: "role", content: role.prompt },
     { name: "workspace", content: `Workspace directory: ${workspacePath}` },
     { name: "time", content: buildTimeSection(new Date(), userTimezone) },
-    { name: "memory", content: buildMemoryContext(workspacePath) },
-    { name: "memory-management", content: buildMemoryManagementSection(workspacePath) },
+    { name: "memory", content: buildMemoryContext(memorySnapshot, workspacePath) },
+    { name: "memory-management", content: buildMemoryManagementSection(memorySnapshot) },
     { name: "sandbox", content: useDocker ? SANDBOX_TOOLS_HINT : null },
     { name: "wiki", content: buildWikiContext(workspacePath) },
     { name: "sources", content: buildSourcesContext(workspacePath) },

package/server/api/routes/accounting.ts

@@ -36,6 +36,7 @@ import { ACCOUNTING_ACTIONS } from "../../../src/plugins/accounting/actions.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { bindRoute } from "../../utils/router.js";
 import { log } from "../../system/logger/index.js";
+import { asyncHandler } from "../../utils/asyncHandler.js";
 
 const router = Router();
 
@@ -335,32 +336,38 @@ async function dispatch(body: AccountingActionBody): Promise<unknown> {
 bindRoute(
   router,
   API_ROUTES.accounting.dispatch,
-  async (req: Request<object, unknown, AccountingActionBody>, res: Response<unknown | AccountingErrorResponse>) => {
-    // Validate the body shape up front so a missing / non-object body
-    // surfaces as a 400 instead of crashing `dispatch` and bubbling
-    // through to the 500 catch-all.
-    const { body } = req;
-    if (!body || typeof body !== "object" || typeof body.action !== "string") {
-      log.warn("accounting", "POST dispatch: invalid body");
-      res.status(400).json({ error: "request body must be an object with a string `action` field" });
-      return;
-    }
-    const { action } = body;
-    log.info("accounting", "POST dispatch: start", { action });
-    try {
-      const result = await dispatch(body);
-      log.info("accounting", "POST dispatch: ok", { action });
-      res.json(result);
-    } catch (err) {
-      if (err instanceof AccountingError) {
-        log.warn("accounting", "POST dispatch: error", { action, status: err.status, message: err.message });
-        res.status(err.status).json({ error: err.message, details: err.details });
+  asyncHandler<Request<object, unknown, AccountingActionBody>, Response<unknown | AccountingErrorResponse>>(
+    "accounting",
+    "accounting dispatch failed",
+    async (req, res) => {
+      // Validate the body shape up front so a missing / non-object body
+      // surfaces as a 400 instead of crashing `dispatch` and bubbling
+      // through to the 500 catch-all.
+      const { body } = req;
+      if (!body || typeof body !== "object" || typeof body.action !== "string") {
+        log.warn("accounting", "POST dispatch: invalid body");
+        res.status(400).json({ error: "request body must be an object with a string `action` field" });
         return;
       }
-      log.error("accounting", "POST dispatch: unexpected error", { action, error: err instanceof Error ? err.message : String(err) });
-      res.status(500).json({ error: err instanceof Error ? err.message : String(err) });
-    }
-  },
+      const { action } = body;
+      log.info("accounting", "POST dispatch: start", { action });
+      try {
+        const result = await dispatch(body);
+        log.info("accounting", "POST dispatch: ok", { action });
+        res.json(result);
+      } catch (err) {
+        // Domain errors (AccountingError) map to 4xx with `details`.
+        // Anything else rethrows — the asyncHandler wrapper catches
+        // it, logs `unexpected error`, and returns a generic 500.
+        if (err instanceof AccountingError) {
+          log.warn("accounting", "POST dispatch: error", { action, status: err.status, message: err.message });
+          res.status(err.status).json({ error: err.message, details: err.details });
+          return;
+        }
+        throw err;
+      }
+    },
+  ),
 );
 
 export default router;

package/server/api/routes/agent.ts

@@ -27,6 +27,7 @@ import { maybeIndexSession } from "../../workspace/chat-index/index.js";
 import { maybeAppendWikiBacklinks } from "../../workspace/wiki-backlinks/index.js";
 import { log } from "../../system/logger/index.js";
 import { logBackgroundError } from "../../utils/logBackgroundError.js";
+import { errorMessage } from "../../utils/errors.js";
 import { createArgsCache, recordToolEvent } from "../../workspace/tool-trace/index.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { EVENT_TYPES } from "../../../src/types/events.js";
@@ -46,7 +47,6 @@ import { env } from "../../system/env.js";
 import type { Attachment } from "@mulmobridge/protocol";
 import { isImagePath, loadImageBase64 } from "../../utils/files/image-store.js";
 import { isAttachmentPath, loadAttachmentBase64, inferMimeFromExtension, saveAttachment } from "../../utils/files/attachment-store.js";
-import { errorMessage } from "../../utils/errors.js";
 
 const router = Router();
 const PORT = env.port;
@@ -810,7 +810,7 @@ async function resolveSkillMetadata(skillName: string): Promise<SkillMetadata> {
     // can still collapse it; just leave metadata empty.
     log.warn("agent", "skill metadata lookup failed — emitting entry without scope/path/description/body", {
       skillName,
-      error: err instanceof Error ? err.message : String(err),
+      error: errorMessage(err),
     });
     return { scope: "unknown", path: null, description: null, body: null };
   }

package/server/api/routes/config-refresh.ts

@@ -0,0 +1,49 @@
+// POST /api/config/refresh — wraps `refreshScheduledSkills()` +
+// `refreshUserTasks()` into one endpoint so the config-refresh
+// PostToolUse hook (#1283) can fire-and-forget after Write/Edit of
+// the relevant config files without knowing which refreshers exist.
+// Serves the `mc-manage-skills` + `mc-manage-automations` preset
+// skills (split out from the original `mc-settings` in #1295).
+//
+// Best-effort by design: failures from one refresher don't block the
+// other; the response is always 200 with a per-refresher status so the
+// caller (the hook) can log on errors but never has to abort.
+
+import { Router, Request, Response } from "express";
+import { API_ROUTES } from "../../../src/config/apiRoutes.js";
+import { log } from "../../system/logger/index.js";
+import { errorMessage } from "../../utils/errors.js";
+import { refreshScheduledSkills } from "../../workspace/skills/scheduler.js";
+import { refreshUserTasks } from "../../workspace/skills/user-tasks.js";
+
+const router = Router();
+
+interface RefreshOutcome {
+  ok: boolean;
+  count?: number;
+  error?: string;
+}
+
+interface RefreshResponse {
+  skills: RefreshOutcome;
+  userTasks: RefreshOutcome;
+}
+
+async function safeRefresh(label: string, refresher: () => Promise<number>): Promise<RefreshOutcome> {
+  try {
+    const count = await refresher();
+    return { ok: true, count };
+  } catch (err) {
+    const error = errorMessage(err);
+    log.warn("config-refresh", `${label} refresh failed`, { error });
+    return { ok: false, error };
+  }
+}
+
+router.post(API_ROUTES.config.refresh, async (_req: Request, res: Response<RefreshResponse>) => {
+  const [skills, userTasks] = await Promise.all([safeRefresh("skills", refreshScheduledSkills), safeRefresh("userTasks", refreshUserTasks)]);
+  log.debug("config-refresh", "refresh complete", { skills, userTasks });
+  res.json({ skills, userTasks });
+});
+
+export default router;

package/server/api/routes/config.ts

@@ -5,10 +5,12 @@ import {
   isAppSettingsPatch,
   loadMcpConfig,
   loadSettings,
+  normaliseAppSettingsPatch,
   saveMcpConfig,
   saveSettings,
   toMcpEntries,
   type AppSettings,
+  type AppSettingsPatch,
   type McpConfigFile,
   type McpServerEntry,
 } from "../../system/config.js";
@@ -17,6 +19,7 @@ import { errorMessage } from "../../utils/errors.js";
 import { isRecord } from "../../utils/types.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { log } from "../../system/logger/index.js";
+import { asyncHandler } from "../../utils/asyncHandler.js";
 import { loadCustomDirs, saveCustomDirs, ensureCustomDirs, validateCustomDirs, type CustomDirEntry } from "../../workspace/custom-dirs.js";
 import { loadReferenceDirs, saveReferenceDirs, validateReferenceDirs, type ReferenceDirEntry } from "../../workspace/reference-dirs.js";
 
@@ -67,16 +70,18 @@ function parseMcpPayloadOrFail(res: ConfigRes, servers: McpServerEntry[]): McpCo
   }
 }
 
-// Run a filesystem save. On failure, respond 500 with the error's
-// message and return false so the caller can early-return. Returns
-// true on success.
+// Run a filesystem save. On failure, log the raw error server-side
+// (full triage detail kept in logs), respond 500 with the safe
+// `fallback` message, and return false so the caller can early-return.
+// Returns true on success. The raw `err.message` deliberately doesn't
+// reach the client — same threat model as `asyncHandler`.
 function runSaveOrFail(res: ConfigRes, save: () => void, fallback: string): boolean {
   try {
     save();
     return true;
   } catch (err) {
     log.error("config", `save failed: ${fallback}`, { error: errorMessage(err) });
-    serverError(res, errorMessage(err, fallback));
+    serverError(res, fallback);
     return false;
   }
 }
@@ -134,7 +139,7 @@ router.put(API_ROUTES.config.base, (req: Request<unknown, unknown, PutConfigBody
   res.json(buildFullResponse());
 });
 
-router.put(API_ROUTES.config.settings, (req: Request<unknown, unknown, Partial<AppSettings>>, res: ConfigRes) => {
+router.put(API_ROUTES.config.settings, (req: Request<unknown, unknown, AppSettingsPatch>, res: ConfigRes) => {
   const { body } = req;
   log.info("config", "PUT settings: start");
   if (!isAppSettingsPatch(body)) {
@@ -147,8 +152,16 @@ router.put(API_ROUTES.config.settings, (req: Request<unknown, unknown, Partial<A
   // that knows about only some fields (e.g. Tools tab sends only
   // `extraAllowedTools`, Map tab sends only `googleMapsApiKey`)
   // doesn't wipe fields owned by other tabs.
+  //
+  // `null` in the patch is a sentinel for "clear this field":
+  // normaliseAppSettingsPatch drops the entry from the patch, AND we
+  // must also delete it from the merged result so the existing
+  // value doesn't leak through the spread.
   const existing = loadSettings();
-  const merged: AppSettings = { ...existing, ...body };
+  const merged: AppSettings = { ...existing, ...normaliseAppSettingsPatch(body) };
+  if (body.effortLevel === null) {
+    delete merged.effortLevel;
+  }
   if (!runSaveOrFail(res, () => saveSettings(merged), "saveSettings failed")) {
     return;
   }
@@ -183,30 +196,29 @@ router.get(API_ROUTES.config.workspaceDirs, (_req: Request, res: Response<{ dirs
 
 router.put(
   API_ROUTES.config.workspaceDirs,
-  (req: Request<unknown, unknown, { dirs: unknown }>, res: Response<{ dirs: CustomDirEntry[] } | ConfigErrorResponse>) => {
-    const { body } = req;
-    log.info("config", "PUT workspace-dirs: start");
-    if (!isRecord(body) || !("dirs" in body)) {
-      log.warn("config", "PUT workspace-dirs: invalid envelope");
-      badRequest(res, "expected { dirs: [...] }");
-      return;
-    }
-    const result = validateCustomDirs(body.dirs);
-    if ("error" in result) {
-      log.warn("config", "PUT workspace-dirs: validation failed", { error: result.error });
-      badRequest(res, result.error);
-      return;
-    }
-    try {
+  asyncHandler<Request<unknown, unknown, { dirs: unknown }>, Response<{ dirs: CustomDirEntry[] } | ConfigErrorResponse>>(
+    "config",
+    "save failed",
+    async (req, res) => {
+      const { body } = req;
+      log.info("config", "PUT workspace-dirs: start");
+      if (!isRecord(body) || !("dirs" in body)) {
+        log.warn("config", "PUT workspace-dirs: invalid envelope");
+        badRequest(res, "expected { dirs: [...] }");
+        return;
+      }
+      const result = validateCustomDirs(body.dirs);
+      if ("error" in result) {
+        log.warn("config", "PUT workspace-dirs: validation failed", { error: result.error });
+        badRequest(res, result.error);
+        return;
+      }
       saveCustomDirs(result.entries);
       ensureCustomDirs(result.entries);
       log.info("config", "PUT workspace-dirs: ok", { dirs: result.entries.length });
       res.json({ dirs: result.entries });
-    } catch (err) {
-      log.error("config", "PUT workspace-dirs: threw", { error: errorMessage(err) });
-      serverError(res, errorMessage(err, "save failed"));
-    }
-  },
+    },
+  ),
 );
 
 // ── Reference directories (#455) ────────────────────────────────
@@ -217,29 +229,28 @@ router.get(API_ROUTES.config.referenceDirs, (_req: Request, res: Response<{ dirs
 
 router.put(
   API_ROUTES.config.referenceDirs,
-  (req: Request<unknown, unknown, { dirs: unknown }>, res: Response<{ dirs: ReferenceDirEntry[] } | ConfigErrorResponse>) => {
-    const { body } = req;
-    log.info("config", "PUT reference-dirs: start");
-    if (!isRecord(body) || !("dirs" in body)) {
-      log.warn("config", "PUT reference-dirs: invalid envelope");
-      badRequest(res, "expected { dirs: [...] }");
-      return;
-    }
-    const result = validateReferenceDirs(body.dirs);
-    if ("error" in result) {
-      log.warn("config", "PUT reference-dirs: validation failed", { error: result.error });
-      badRequest(res, result.error);
-      return;
-    }
-    try {
+  asyncHandler<Request<unknown, unknown, { dirs: unknown }>, Response<{ dirs: ReferenceDirEntry[] } | ConfigErrorResponse>>(
+    "config",
+    "save failed",
+    async (req, res) => {
+      const { body } = req;
+      log.info("config", "PUT reference-dirs: start");
+      if (!isRecord(body) || !("dirs" in body)) {
+        log.warn("config", "PUT reference-dirs: invalid envelope");
+        badRequest(res, "expected { dirs: [...] }");
+        return;
+      }
+      const result = validateReferenceDirs(body.dirs);
+      if ("error" in result) {
+        log.warn("config", "PUT reference-dirs: validation failed", { error: result.error });
+        badRequest(res, result.error);
+        return;
+      }
       saveReferenceDirs(result.entries);
       log.info("config", "PUT reference-dirs: ok", { dirs: result.entries.length });
       res.json({ dirs: result.entries });
-    } catch (err) {
-      log.error("config", "PUT reference-dirs: threw", { error: errorMessage(err) });
-      serverError(res, errorMessage(err, "save failed"));
-    }
-  },
+    },
+  ),
 );
 
 router.get(API_ROUTES.config.schedulerOverrides, (_req: Request, res: Response<{ overrides: ScheduleOverrides }>) => {
@@ -248,22 +259,24 @@ router.get(API_ROUTES.config.schedulerOverrides, (_req: Request, res: Response<{
 
 router.put(
   API_ROUTES.config.schedulerOverrides,
-  async (req: Request<unknown, unknown, { overrides: unknown }>, res: Response<{ overrides: ScheduleOverrides } | ConfigErrorResponse>) => {
-    const { body } = req;
-    log.info("config", "PUT scheduler-overrides: start");
-    if (!isRecord(body) || !("overrides" in body)) {
-      log.warn("config", "PUT scheduler-overrides: invalid envelope");
-      badRequest(res, "expected { overrides: { ... } }");
-      return;
-    }
-    const raw = body.overrides;
-    if (!isRecord(raw)) {
-      log.warn("config", "PUT scheduler-overrides: overrides not an object");
-      badRequest(res, "overrides must be an object");
-      return;
-    }
-    const overrides = raw as ScheduleOverrides;
-    try {
+  asyncHandler<Request<unknown, unknown, { overrides: unknown }>, Response<{ overrides: ScheduleOverrides } | ConfigErrorResponse>>(
+    "config",
+    "save failed",
+    async (req, res) => {
+      const { body } = req;
+      log.info("config", "PUT scheduler-overrides: start");
+      if (!isRecord(body) || !("overrides" in body)) {
+        log.warn("config", "PUT scheduler-overrides: invalid envelope");
+        badRequest(res, "expected { overrides: { ... } }");
+        return;
+      }
+      const raw = body.overrides;
+      if (!isRecord(raw)) {
+        log.warn("config", "PUT scheduler-overrides: overrides not an object");
+        badRequest(res, "overrides must be an object");
+        return;
+      }
+      const overrides = raw as ScheduleOverrides;
       saveSchedulerOverrides(overrides);
 
       // Apply to running task-manager immediately
@@ -283,11 +296,8 @@ router.put(
 
       log.info("config", "PUT scheduler-overrides: ok", { tasks: Object.keys(overrides).length });
       res.json({ overrides: loadSchedulerOverrides() });
-    } catch (err) {
-      log.error("config", "PUT scheduler-overrides: threw", { error: errorMessage(err) });
-      serverError(res, errorMessage(err, "save failed"));
-    }
-  },
+    },
+  ),
 );
 
 export default router;