mulmoclaude 0.9.2 → 0.9.4

package/server/workspace/collections/remoteView.ts

@@ -0,0 +1,290 @@
+// Assemble one mobile (`target: "mobile"`) custom view for the remote client:
+// find the view entry, read its HTML (source-aware staging read), pick its
+// i18n dict for the requested locale, wrap it into the sandboxed srcdoc
+// (CSP + postMessage bootstrap — @mulmoclaude/core/remote-view), and enforce
+// the 1 MiB command-document budget. Shared by the `getRemoteView` channel
+// handler and the desktop preview's HTTP route so both serve the IDENTICAL
+// artifact (plans/feat-remote-custom-view.md, decision 2).
+//
+// Discriminated result (not throw) so the HTTP route can map each failure to
+// its status; the channel handler converts non-ok to a thrown error via
+// `remoteViewFailureMessage`. Factory keeps the mapping unit-testable with the
+// engine stubbed.
+import {
+  buildRemoteViewSrcdoc,
+  clampImageMaxEdge,
+  pageFromItems,
+  REMOTE_VIEW_ITEMS_MAX_BYTES,
+  REMOTE_VIEW_MAX_BYTES,
+  type RemoteViewItem,
+  type RemoteViewMutateRequest,
+  type RemoteViewPage,
+  type RemoteViewPageRequest,
+} from "@mulmoclaude/core/remote-view";
+import { deriveAll } from "@mulmoclaude/core/collection";
+import {
+  deleteItem,
+  listItems,
+  readCustomViewHtml,
+  readCustomViewI18n,
+  readItem,
+  safeRecordId,
+  writeItem,
+  type CollectionCustomView,
+  type CollectionItem,
+  type CollectionSchema,
+  type LoadedCollection,
+} from "./index.js";
+import { resolveThumbnail } from "../../utils/files/thumbnail-store.js";
+
+export interface RemoteViewInfo {
+  id: string;
+  label: string;
+  icon?: string;
+  target: "mobile";
+}
+
+export type RemoteViewBuildResult =
+  | { kind: "ok"; view: RemoteViewInfo; srcdoc: string; bytes: number }
+  | { kind: "view-not-found"; viewId: string }
+  | { kind: "not-mobile"; viewId: string }
+  | { kind: "file-missing"; file: string }
+  | { kind: "too-large"; bytes: number };
+
+export interface BuildRemoteViewDeps {
+  readCustomViewHtml: typeof readCustomViewHtml;
+  readCustomViewI18n: typeof readCustomViewI18n;
+}
+
+export const createBuildRemoteView =
+  (deps: BuildRemoteViewDeps) =>
+  async (collection: LoadedCollection, viewId: string, locale: string): Promise<RemoteViewBuildResult> => {
+    const view = (collection.schema.views ?? []).find((entry) => entry.id === viewId);
+    if (!view) return { kind: "view-not-found", viewId };
+    // A desktop view's HTML assumes the token/dataUrl contract and would just
+    // break on the phone — refuse it instead of serving a broken page.
+    if (view.target !== "mobile") return { kind: "not-mobile", viewId };
+    const html = await deps.readCustomViewHtml(collection, view.file);
+    if (html === null) return { kind: "file-missing", file: view.file };
+    const i18n = view.i18n ? await deps.readCustomViewI18n(collection, view.i18n, locale) : { locale: "", dict: {} };
+    // `writable` gates the client-side updateItem/deleteItem install; the host
+    // re-derives + enforces the actual policy on every mutate (createMutateRemoteView).
+    const writable = isWritableView(view);
+    const srcdoc = buildRemoteViewSrcdoc(html, { slug: collection.slug, locale: i18n.locale, dict: i18n.dict, writable });
+    const bytes = Buffer.byteLength(srcdoc, "utf8");
+    if (bytes > REMOTE_VIEW_MAX_BYTES) return { kind: "too-large", bytes };
+    return { kind: "ok", view: { id: view.id, label: view.label, ...(view.icon ? { icon: view.icon } : {}), target: "mobile" }, srcdoc, bytes };
+  };
+
+export const buildRemoteView = createBuildRemoteView({ readCustomViewHtml, readCustomViewI18n });
+
+/** One message per failure kind, shared by the channel handler (throws it) and
+ *  the HTTP route (sends it with the matching status). */
+export function remoteViewFailureMessage(result: Exclude<RemoteViewBuildResult, { kind: "ok" }>, slug: string): string {
+  if (result.kind === "view-not-found") return `custom view '${result.viewId}' not found on collection '${slug}'`;
+  if (result.kind === "not-mobile") return `custom view '${result.viewId}' is not a mobile view — declare target: "mobile" in its views[] entry`;
+  if (result.kind === "file-missing") return `view file '${result.file}' not found — author it at data/skills/${slug}/${result.file}`;
+  return `mobile view srcdoc is ${result.bytes} bytes — over the ${REMOTE_VIEW_MAX_BYTES}-byte command-channel budget; slim the HTML`;
+}
+
+// ── Mutate (phase 4 — plans/feat-remote-writable-view.md) ──
+// A `target: "mobile"` view's update/delete, authorized by its OWN declared
+// surface (editableFields / allowDelete) and enforced HOST-side — the client is
+// never trusted. Shared by the `mutateRemoteViewItem` channel handler (phone)
+// and the `…/remote-view/:viewId/mutate` HTTP route (desktop preview), so both
+// transports apply identical policy. Discriminated result (not throw) mirrors
+// the build result above.
+
+/** True when a mobile view declared ANY write surface. Also gates the srcdoc's
+ *  `writable` boot flag so the client only exposes methods the host will honor. */
+function isWritableView(view: CollectionCustomView): boolean {
+  return (view.editableFields?.length ?? 0) > 0 || view.allowDelete === true;
+}
+
+export type MutateRemoteViewResult =
+  | { kind: "ok"; op: "update"; item: CollectionItem }
+  | { kind: "ok"; op: "delete"; id: string }
+  | { kind: "view-not-found"; viewId: string }
+  | { kind: "not-mobile"; viewId: string }
+  | { kind: "not-writable"; viewId: string }
+  | { kind: "field-not-editable"; field: string }
+  | { kind: "delete-not-allowed" }
+  | { kind: "invalid-patch" }
+  | { kind: "item-not-found"; id: string }
+  | { kind: "invalid-id"; id: string }
+  | { kind: "path-escape" };
+
+export interface MutateRemoteViewDeps {
+  readItem: typeof readItem;
+  writeItem: typeof writeItem;
+  deleteItem: typeof deleteItem;
+  resolveThumbnail: typeof resolveThumbnail;
+}
+
+export const createMutateRemoteView =
+  (deps: MutateRemoteViewDeps) =>
+  async (collection: LoadedCollection, viewId: string, request: RemoteViewMutateRequest): Promise<MutateRemoteViewResult> => {
+    const view = (collection.schema.views ?? []).find((entry) => entry.id === viewId);
+    if (!view) return { kind: "view-not-found", viewId };
+    if (view.target !== "mobile") return { kind: "not-mobile", viewId };
+    if (!isWritableView(view)) return { kind: "not-writable", viewId };
+    return request.op === "delete" ? deleteViaView(deps, collection, view.allowDelete === true, request.id) : updateViaView(deps, collection, view, request);
+  };
+
+async function deleteViaView(deps: MutateRemoteViewDeps, collection: LoadedCollection, allowDelete: boolean, itemId: string): Promise<MutateRemoteViewResult> {
+  if (!allowDelete) return { kind: "delete-not-allowed" };
+  const result = await deps.deleteItem(collection.dataDir, itemId, { slug: collection.slug });
+  if (result.kind === "invalid-id") return { kind: "invalid-id", id: result.itemId };
+  if (result.kind === "path-escape") return { kind: "path-escape" };
+  if (result.kind === "not-found") return { kind: "item-not-found", id: result.itemId };
+  return { kind: "ok", op: "delete", id: result.itemId };
+}
+
+async function updateViaView(
+  deps: MutateRemoteViewDeps,
+  collection: LoadedCollection,
+  view: CollectionCustomView,
+  request: Extract<RemoteViewMutateRequest, { op: "update" }>,
+): Promise<MutateRemoteViewResult> {
+  const { primaryKey } = collection.schema;
+  const patchKeys = Object.keys(request.patch);
+  if (patchKeys.length === 0) return { kind: "invalid-patch" };
+  const allowed = new Set(view.editableFields ?? []);
+  // The primary key is never patchable (it is the record id — renaming it would
+  // desync the file name from the record) even if an author listed it.
+  const offending = patchKeys.find((key) => key === primaryKey || !allowed.has(key));
+  if (offending) return { kind: "field-not-editable", field: offending };
+  // Classify a bad id BEFORE readItem — which returns null for an unsafe id, a
+  // path-escape, AND a genuinely-missing record alike — so update reports the
+  // same explicit `invalid-id` the delete path does (via deleteItem) instead of
+  // masking it as a 404. (A valid id whose dataDir escapes the workspace can
+  // hold no record, so it still resolves to item-not-found; a real write is
+  // additionally refused by writeItem's own containment guard below.)
+  if (safeRecordId(request.id) === null) return { kind: "invalid-id", id: request.id };
+  const existing = await deps.readItem(collection.dataDir, request.id, { slug: collection.slug });
+  if (!existing) return { kind: "item-not-found", id: request.id };
+  const merged: CollectionItem = { ...existing, ...request.patch, [primaryKey]: request.id };
+  const result = await deps.writeItem(collection.dataDir, request.id, merged, { slug: collection.slug });
+  if (result.kind === "invalid-id") return { kind: "invalid-id", id: result.itemId };
+  if (result.kind === "path-escape") return { kind: "path-escape" };
+  if (result.kind === "conflict") return { kind: "item-not-found", id: result.itemId }; // unreachable: refuseOverwrite is false
+  // The returned item must be shaped like a `getItems` item — with the view's
+  // declared image fields inlined as `data:` URLs — so a view that merges the
+  // result (as the help file recommends) doesn't clobber a good thumbnail with a
+  // bare path. No projection here (the whole record is returned), so inline every
+  // declared image-type field. Budget the thumbnail against the serialized item
+  // (same as the page builder) so a record with large text/markdown fields can't
+  // push the mutate result over the command-document cap — over budget, the field
+  // stays a path (placeholder), never a doc-write failure.
+  const item = result.item as RemoteViewItem;
+  const imageFields = inlineFields(view, collection.schema, undefined);
+  if (imageFields.length > 0) {
+    const budget = REMOTE_VIEW_ITEMS_MAX_BYTES - Buffer.byteLength(JSON.stringify(item), "utf8");
+    await inlineImages([item], imageFields, clampImageMaxEdge(view.imageMaxEdge), deps.resolveThumbnail, Math.max(0, budget));
+  }
+  return { kind: "ok", op: "update", item: item as CollectionItem };
+}
+
+export const mutateRemoteView = createMutateRemoteView({ readItem, writeItem, deleteItem, resolveThumbnail });
+
+// ── Item pages with inlined image thumbnails (phase 5 — plans/feat-remote-view-images.md) ──
+// A mobile view's `getItems`, view-aware so it can inline the `imageFields` its
+// declaration whitelists: derive computed fields → slice/project (the phase-2
+// page semantics) → replace each declared image-type field's workspace path with
+// a downscaled `data:` URL thumbnail, within a per-page byte budget so the 1 MiB
+// command doc is never risked. Shared by the `getRemoteViewItems` channel handler
+// (phone) and the `…/remote-view/:viewId/items` HTTP route (desktop preview).
+
+export type RemoteViewItemsResult =
+  { kind: "ok"; page: RemoteViewPage; inlined: number; omitted: number } | { kind: "view-not-found"; viewId: string } | { kind: "not-mobile"; viewId: string };
+
+export interface RemoteViewItemsDeps {
+  listItems: typeof listItems;
+  resolveThumbnail: typeof resolveThumbnail;
+}
+
+/** The declared image fields that are actually inlineable this page: image-type
+ *  in the schema AND kept by the request's `fields` projection (a projection
+ *  that dropped the column ships no image bytes). A declared non-image field is
+ *  ignored, not an error. */
+function inlineFields(view: CollectionCustomView, schema: CollectionSchema, requested: string[] | undefined): string[] {
+  const declared = view.imageFields ?? [];
+  if (declared.length === 0) return [];
+  const kept = requested ? new Set([schema.primaryKey, ...requested]) : null;
+  return declared.filter((name) => schema.fields[name]?.type === "image" && (kept === null || kept.has(name)));
+}
+
+/** Replace declared image paths with thumbnail `data:` URLs in place, stopping
+ *  once the accumulated thumbnail bytes would exceed `budget` — a field left as
+ *  its path (over budget, unresolvable, or already inlined) counts as `omitted`
+ *  and the view renders it as a placeholder. */
+async function inlineImages(
+  items: RemoteViewItem[],
+  fields: string[],
+  maxEdge: number,
+  resolve: typeof resolveThumbnail,
+  budget: number,
+): Promise<{ inlined: number; omitted: number }> {
+  let used = 0;
+  let inlined = 0;
+  let omitted = 0;
+  for (const item of items) {
+    for (const field of fields) {
+      const value = item[field];
+      if (typeof value !== "string" || value.length === 0 || value.startsWith("data:")) continue;
+      const dataUrl = used < budget ? await resolve(value, maxEdge) : null;
+      if (dataUrl && used + dataUrl.length <= budget) {
+        item[field] = dataUrl;
+        used += dataUrl.length;
+        inlined += 1;
+      } else {
+        omitted += 1;
+      }
+    }
+  }
+  return { inlined, omitted };
+}
+
+export const createRemoteViewItems =
+  (deps: RemoteViewItemsDeps) =>
+  async (collection: LoadedCollection, viewId: string, request: RemoteViewPageRequest): Promise<RemoteViewItemsResult> => {
+    const view = (collection.schema.views ?? []).find((entry) => entry.id === viewId);
+    if (!view) return { kind: "view-not-found", viewId };
+    if (view.target !== "mobile") return { kind: "not-mobile", viewId };
+    // Derive record-local formulas with an empty ref cache — same as the phase-2
+    // channel handlers and the preview, so `getItems` numbers match the desktop.
+    const derived = (await deps.listItems(collection.dataDir)).map((item) => deriveAll(collection.schema, item, {}) as RemoteViewItem);
+    const page = pageFromItems(derived, request, collection.schema.primaryKey);
+    const fields = inlineFields(view, collection.schema, request.fields);
+    if (fields.length === 0) return { kind: "ok", page, inlined: 0, omitted: 0 };
+    // Budget the thumbnails against what's left of the doc after the (tiny,
+    // path-only) base JSON, so the serialized page stays under the cap.
+    const budget = REMOTE_VIEW_ITEMS_MAX_BYTES - Buffer.byteLength(JSON.stringify(page), "utf8");
+    const { inlined, omitted } = await inlineImages(page.items, fields, clampImageMaxEdge(view.imageMaxEdge), deps.resolveThumbnail, Math.max(0, budget));
+    return { kind: "ok", page, inlined, omitted };
+  };
+
+export const remoteViewItems = createRemoteViewItems({ listItems, resolveThumbnail });
+
+/** Message per non-ok item-page kind — shared by the channel handler (throws)
+ *  and the HTTP route (sends with the matching status). */
+export function remoteViewItemsFailureMessage(result: Exclude<RemoteViewItemsResult, { kind: "ok" }>, slug: string): string {
+  if (result.kind === "not-mobile") return `custom view '${result.viewId}' is not a mobile view — declare target: "mobile" in its views[] entry`;
+  return `custom view '${result.viewId}' not found on collection '${slug}'`;
+}
+
+/** Message per non-ok mutate kind — shared by the channel handler (throws) and
+ *  the HTTP route (sends with the matching status). */
+export function mutateRemoteViewFailureMessage(result: Exclude<MutateRemoteViewResult, { kind: "ok" }>, slug: string): string {
+  if (result.kind === "view-not-found") return `custom view '${result.viewId}' not found on collection '${slug}'`;
+  if (result.kind === "not-mobile") return `custom view '${result.viewId}' is not a mobile view — declare target: "mobile" in its views[] entry`;
+  if (result.kind === "not-writable")
+    return `mobile view '${result.viewId}' is read-only — declare editableFields and/or allowDelete in its views[] entry to allow writes`;
+  if (result.kind === "field-not-editable")
+    return `field '${result.field}' is not editable from this view — add it to the view's editableFields (the primary key is never editable)`;
+  if (result.kind === "delete-not-allowed") return `this view may not delete records — set allowDelete: true in its views[] entry`;
+  if (result.kind === "invalid-patch") return `update patch must be a non-empty object of field changes`;
+  if (result.kind === "item-not-found") return `item '${result.id}' not found in collection '${slug}'`;
+  if (result.kind === "invalid-id") return `invalid item id: ${result.id}`;
+  return `data directory for collection '${slug}' escapes the workspace`;
+}

package/server/workspace/journal/archivist-cli.ts

@@ -4,7 +4,12 @@ import { spawn } from "node:child_process";
 import { CLI_SUBPROCESS_TIMEOUT_MS } from "../../utils/time.js";
 import { claudeBinPath, ClaudeCliNotFoundError } from "../../utils/claudeBin.js";
 
-export type Summarize = (systemPrompt: string, userPrompt: string) => Promise<string>;
+// User-selectable model for the archivist CLI call. `journalMode`
+// widens to `"off"` too; the entry-point (`maybeRunJournal`) filters
+// that out before we get here — this union is intentionally narrow so
+// a bad string can't reach `--model`.
+export type JournalSummaryModel = "haiku" | "sonnet";
+export type Summarize = (systemPrompt: string, userPrompt: string, opts?: { model?: JournalSummaryModel }) => Promise<string>;
 
 const CLI_TIMEOUT_MS = CLI_SUBPROCESS_TIMEOUT_MS;
 
@@ -28,9 +33,18 @@ export class ClaudeCliFailedError extends Error {
 }
 
 // Pipe the combined prompt via stdin to dodge shell-argv limits for large day excerpts.
-export const runClaudeCli: Summarize = async (systemPrompt, userPrompt) =>
+export const runClaudeCli: Summarize = async (systemPrompt, userPrompt, opts) =>
   new Promise((resolve, reject) => {
-    const child = spawn(claudeBinPath(), ["-p", "--output-format", "text"], {
+    // `opts?.model` is threaded from `Settings → Journal` via
+    // maybeRunJournal so the user's model choice reaches the CLI.
+    // When undefined we omit the flag entirely and let the CLI use
+    // its own default — preserves the pre-#1944 archivist behaviour
+    // for direct-CLI callers that don't specify a model.
+    const args = ["-p", "--output-format", "text"];
+    if (opts?.model) {
+      args.push("--model", opts.model);
+    }
+    const child = spawn(claudeBinPath(), args, {
       stdio: ["pipe", "pipe", "pipe"],
     });
 

package/server/workspace/journal/dailyPass.ts

@@ -74,17 +74,24 @@ export async function buildDailyPassPlan(state: JournalState, deps: DailyPassDep
   const { dirty } = findDirtySessions(eligible, state.processedSessions);
   if (dirty.length === 0) return null;
 
-  const perSessionExcerpts = await loadDirtySessionExcerpts(chatDir, dirty, workspaceRoot);
+  const dirtyMetaById = new Map(eligible.map((sessionMeta) => [sessionMeta.id, sessionMeta]));
+  const { journalDirty, silentlyProcessed } = await partitionDirtyByOrigin(dirty, dirtyMetaById, workspaceRoot);
+
+  const perSessionExcerpts = await loadDirtySessionExcerpts(chatDir, journalDirty, workspaceRoot);
   const { dayBuckets, sessionToDays } = buildDayBuckets(perSessionExcerpts);
 
   const existingTopics = await readAllTopics(workspaceRoot);
   const newTopicsSeen = new Set<string>(state.knownTopics);
   // Do NOT bump lastDailyRunAt here — outer runner does it after optimization, so partial progress isn't a complete pass.
+  // Silently mark origin-filtered dirty sessions as processed at their current
+  // mtime so they don't reappear as dirty on every pass. Without this, a
+  // workspace with many automation sessions pays an O(N) meta re-read on
+  // every hourly run.
   const initialNextState: JournalState = {
     ...state,
+    processedSessions: applyProcessed(state.processedSessions, silentlyProcessed),
     knownTopics: [...newTopicsSeen].sort(),
   };
-  const dirtyMetaById = new Map(eligible.map((sessionMeta) => [sessionMeta.id, sessionMeta]));
   const orderedDays = [...dayBuckets.keys()].sort();
 
   return {
@@ -422,6 +429,49 @@ export function advanceJournalState(prev: JournalState, justCompleted: readonly
 }
 
 // Malformed sessions are logged and skipped so one bad jsonl can't crash the pass.
+// Origins the journal pass intentionally skips (mirror of the chat-index
+// filter added in #1944). `system` sessions are hidden host workers
+// (thumbnail generation, background exports); `scheduler` sessions are
+// automation-driven with prompts the user did not author. Neither
+// surfaces content worth summarising into a personal daily journal.
+const NON_INDEXED_ORIGINS: ReadonlySet<string> = new Set(["system", "scheduler"]);
+
+async function isEligibleForJournalByOrigin(sessionId: string, workspaceRoot: string): Promise<boolean> {
+  try {
+    const meta = await readSessionMetaIO(sessionId, workspaceRoot);
+    if (meta && typeof meta.origin === "string" && NON_INDEXED_ORIGINS.has(meta.origin)) return false;
+  } catch {
+    // meta unreadable → treat as eligible; the excerpt loader will
+    // still bail if the jsonl itself is malformed.
+  }
+  return true;
+}
+
+interface DirtyPartition {
+  journalDirty: string[];
+  // origin-filtered dirty sessions — marked processed at their current mtime
+  // so the next pass doesn't re-inspect them.
+  silentlyProcessed: SessionFileMeta[];
+}
+
+async function partitionDirtyByOrigin(
+  dirty: readonly string[],
+  dirtyMetaById: ReadonlyMap<string, SessionFileMeta>,
+  workspaceRoot: string,
+): Promise<DirtyPartition> {
+  const journalDirty: string[] = [];
+  const silentlyProcessed: SessionFileMeta[] = [];
+  for (const sessionId of dirty) {
+    if (await isEligibleForJournalByOrigin(sessionId, workspaceRoot)) {
+      journalDirty.push(sessionId);
+      continue;
+    }
+    const meta = dirtyMetaById.get(sessionId);
+    if (meta) silentlyProcessed.push(meta);
+  }
+  return { journalDirty, silentlyProcessed };
+}
+
 async function loadDirtySessionExcerpts(chatDir: string, dirty: readonly string[], workspaceRoot: string): Promise<Map<string, Map<string, SessionExcerpt>>> {
   const perSession = new Map<string, Map<string, SessionExcerpt>>();
   for (const sessionId of dirty) {

package/server/workspace/journal/index.ts

@@ -15,9 +15,10 @@ import { readState, writeState, isDailyDue, isOptimizationDue } from "./state.js
 import { runDailyPass } from "./dailyPass.js";
 import { runOptimizationPass } from "./optimizationPass.js";
 import { buildIndexMarkdown, type IndexTopicEntry, type IndexDailyEntry } from "./indexFile.js";
-import { runClaudeCli, ClaudeCliNotFoundError, type Summarize } from "./archivist-cli.js";
+import { runClaudeCli, ClaudeCliNotFoundError, type Summarize, type JournalSummaryModel } from "./archivist-cli.js";
 import { extractFirstH1 } from "../../../src/utils/markdown/extractFirstH1.js";
 import { log } from "../../system/logger/index.js";
+import { journalMode as resolveJournalMode, loadSettings, type JournalMode } from "../../system/config.js";
 
 export { extractFirstH1 };
 
@@ -39,14 +40,24 @@ export interface MaybeRunJournalOptions {
   activeSessionIds?: ReadonlySet<string>;
   // Bypass the interval gate; the disable flags (CLI missing, in-process lock) still apply.
   force?: boolean;
+  // Injectable journal mode — defaults to `journalMode(loadSettings())`
+  // when omitted. "off" short-circuits before any lock / state read;
+  // "haiku" / "sonnet" pick the model the archivist CLI spawns. Tests
+  // and the force-run switch inject this directly; production callers
+  // (turn-end hook, scheduled task) let the resolver pick it up.
+  mode?: JournalMode;
 }
 
 export async function maybeRunJournal(opts: MaybeRunJournalOptions = {}): Promise<void> {
   if (disabled) return;
   if (running) return;
+  // Config-driven kill switch. Resolve at entry time so a settings edit
+  // takes effect on the very next turn without a server restart.
+  const mode = opts.mode ?? resolveJournalMode(loadSettings());
+  if (mode === "off") return;
   running = true;
   try {
-    await runJournalPass(opts);
+    await runJournalPass(opts, mode);
   } catch (err) {
     if (err instanceof ClaudeCliNotFoundError) {
       disabled = true;
@@ -61,9 +72,14 @@ export async function maybeRunJournal(opts: MaybeRunJournalOptions = {}): Promis
   }
 }
 
-async function runJournalPass(opts: MaybeRunJournalOptions): Promise<void> {
+async function runJournalPass(opts: MaybeRunJournalOptions, model: JournalSummaryModel): Promise<void> {
   const workspaceRoot = opts.workspaceRoot ?? defaultWorkspacePath;
-  const summarize = opts.summarize ?? runClaudeCli;
+  // Pre-bind the model into the summarize callable so every layer
+  // downstream (dailyPass / optimizationPass / memoryExtractor) picks
+  // the user-selected model without threading the parameter through
+  // half a dozen call sites.
+  const rawSummarize = opts.summarize ?? runClaudeCli;
+  const summarize: Summarize = (sys, user) => rawSummarize(sys, user, { model });
   const activeSessionIds = opts.activeSessionIds ?? new Set<string>();
 
   const state = await readState(workspaceRoot);

package/src/App.vue

@@ -320,7 +320,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, watch, nextTick, onMounted, reactive } from "vue";
+import { ref, computed, watch, nextTick, onMounted, onScopeDispose, reactive } from "vue";
 import { useI18n } from "vue-i18n";
 import { v4 as uuidv4 } from "uuid";
 import { getPlugin } from "./tools";
@@ -386,6 +386,7 @@ import ConfirmModal from "./components/ConfirmModal.vue";
 import { useNotifications } from "./composables/useNotifications";
 import { collectionNotifiedSeverities } from "./utils/collections/notifiedItems";
 import { installCollectionAppBindings } from "./composables/collections/uiHost";
+import { useDynamicShortcutIcons } from "./composables/collections/useDynamicShortcutIcons";
 import type { CollectionsListResponse } from "@mulmoclaude/core/collection";
 import { useHealth } from "./composables/useHealth";
 import { useSessionHistory } from "./composables/useSessionHistory";
@@ -425,7 +426,7 @@ const currentSessionId = ref("");
 // --- Debug beat (pub/sub) ---
 const { debugTitleStyle } = useDebugBeat();
 
-const { subscribe: pubsubSubscribe } = usePubSub();
+const { subscribe: pubsubSubscribe, onReconnect: pubsubOnReconnect } = usePubSub();
 
 // --- Routing ---
 const route = useRoute();
@@ -482,7 +483,7 @@ const pastedFiles = ref<PastedFile[]>([]);
 const activePane = ref<"sidebar" | "main">("sidebar");
 
 const { sessions, historyError, fetchSessions, setBookmark, deleteSession: deleteSessionFromHistory } = useSessionHistory();
-const { markSessionRead } = useSessionSync({
+const { markSessionRead, refreshSessionStates } = useSessionSync({
   sessionMap,
   currentSessionId,
   fetchSessions,
@@ -991,6 +992,16 @@ function hasPendingGenerations(sessionId: string): boolean {
 }
 
 function handleSessionFinished(sessionId: string): void {
+  // Trust the definitive server signal and flip the local indicator
+  // immediately (#1915 Fix A). Without this, the "thinking" spinner stays
+  // stuck until the `sessions` channel notification arrives via a separate
+  // socket.io frame — which can go missing on a network hiccup or on
+  // Safari's tab-throttling flow while the sessionChannel frame did land.
+  const session = sessionMap.get(sessionId);
+  if (session) {
+    session.isRunning = false;
+    session.statusMessage = "";
+  }
   refreshSessionTranscript(sessionId).catch((err) => {
     console.error("[handleSessionFinished] refresh failed:", err);
   });
@@ -1001,6 +1012,50 @@ function handleSessionFinished(sessionId: string): void {
   }
 }
 
+// After the client silently loses events, this pulls fresh state from the
+// server so the UI recovers without a page reload (#1915). Two trigger
+// surfaces:
+//   - socket.io reconnect (network hiccup, WS bounce)
+//   - document visibility flips to `visible` (Safari's silent tab
+//     throttling — WS keeps `connected` on the server but delivery stops
+//     while the tab is backgrounded, and there's no `disconnect` event to
+//     hook on reconnect)
+// refreshSessionStates() carries its own sequence guard inside
+// useSessionSync so concurrent catch-ups can't overwrite newer live state
+// with an older-but-slower response. refreshSessionTranscript() only
+// upgrades toolResults when the server view is strictly larger, so it's
+// already idempotent against interleaving.
+function catchUpMissedEvents(reason: "reconnect" | "visibility"): void {
+  console.info(`[chat-ui] catching up after ${reason}`);
+  refreshSessionStates().catch((err) => {
+    console.warn("[chat-ui] refreshSessionStates failed:", err);
+  });
+  const currentId = currentSessionId.value;
+  if (currentId) {
+    refreshSessionTranscript(currentId).catch((err) => {
+      console.warn("[chat-ui] refreshSessionTranscript failed:", err);
+    });
+  }
+}
+
+// Capture the unsubscribe so remount / HMR doesn't accumulate stale
+// module-level reconnect handlers (Codex review).
+const unsubReconnect = pubsubOnReconnect(() => catchUpMissedEvents("reconnect"));
+
+function handleVisibilityChange(): void {
+  if (document.visibilityState === "visible") {
+    catchUpMissedEvents("visibility");
+  }
+}
+
+onMounted(() => {
+  document.addEventListener("visibilitychange", handleVisibilityChange);
+});
+onScopeDispose(() => {
+  document.removeEventListener("visibilitychange", handleVisibilityChange);
+  unsubReconnect();
+});
+
 function createSessionEventHandler(session: ActiveSession, ctx: AgentEventContext): (data: unknown) => void {
   return (data: unknown) => {
     const event = data as SseEvent;
@@ -1207,6 +1262,10 @@ installCollectionAppBindings({
   startNewChatDraft: (prompt: string, role?: string) => startNewChatDraft(prompt, role),
   notifiedSeverities: (slug: string) => collectionNotifiedSeverities(notifierEntries.value, slug),
 });
+// Keep pinned collection-launcher icons that declare `dynamicIcon` live —
+// mounted here (not inside CollectionsIndexView) so it runs regardless of
+// which page is open.
+useDynamicShortcutIcons();
 // Plugin Views that need to tag background work with the current
 // session (e.g. MulmoScript generations) inject this.
 provideActiveSession(activeSession);

package/src/components/FileTree.vue

@@ -51,13 +51,14 @@
            not as a global overlay. -->
       <div v-if="loadingChildren" class="px-2 py-1 text-xs text-gray-400">{{ t("common.loading") }}</div>
       <FileTree
-        v-for="child in loadedChildren"
+        v-for="child in visibleChildren"
         :key="child.path"
         :node="child"
         :selected-path="selectedPath"
         :recent-paths="recentPaths"
         :children-by-path="childrenByPath"
         :sort-mode="sortMode"
+        :show-hidden-system="showHiddenSystem"
         @select="(p) => emit('select', p)"
         @load-children="(p) => emit('loadChildren', p)"
         @create-file="(args) => emit('createFile', args)"
@@ -95,6 +96,7 @@ import { useI18n } from "vue-i18n";
 import { useExpandedDirs } from "../composables/useExpandedDirs";
 import { sortChildren } from "../utils/files/sortChildren";
 import { descriptorForPath, EDIT_POLICY_ICON_COLOR } from "../config/systemFileDescriptors";
+import { isVisibleTopLevel } from "../config/visibleWorkspaceDirs";
 import { normaliseNewFileSlug, policyForFolder } from "../config/createFilePolicy";
 import type { FileSortMode } from "../composables/useFileSortMode";
 import type { TreeNode } from "../types/fileTree";
@@ -118,6 +120,14 @@ const props = defineProps<{
   // show spinner. Array = loaded.
   childrenByPath: Map<string, TreeNode[] | null>;
   sortMode: FileSortMode;
+  // When false, top-level "system" dirs (`conversations/`, `feeds/`,
+  // `.git/`, ad-hoc automation buckets) are filtered out — only
+  // recognised user-content buckets (data / artifacts / config) stay
+  // visible at the workspace root. Filter only fires when this
+  // component IS the root (`node.path === ""`); nested instances
+  // still receive the prop so the recursion carries it, but they
+  // don't apply the filter themselves.
+  showHiddenSystem: boolean;
 }>();
 
 const emit = defineEmits<{
@@ -143,6 +153,16 @@ const cached = computed(() => props.childrenByPath.get(props.node.path));
 const loadingChildren = computed(() => cached.value === null);
 const loadedChildren = computed(() => (Array.isArray(cached.value) ? sortChildren(cached.value, props.sortMode) : []));
 
+// Root-only filter: hide non-whitelisted top-level dirs unless the
+// user has toggled "show system files" on. Any depth other than
+// the workspace root is a pass-through.
+const isWorkspaceRoot = computed(() => props.node.path === "");
+const visibleChildren = computed(() => {
+  if (!isWorkspaceRoot.value) return loadedChildren.value;
+  if (props.showHiddenSystem) return loadedChildren.value;
+  return loadedChildren.value.filter((child) => child.type === "dir" && isVisibleTopLevel(child.name));
+});
+
 // Kick off a fetch if the dir is expanded but its children haven't
 // been requested yet. Covers two scenarios:
 //   1. User just toggled open → onToggle already emits, but watching