mulmoclaude 0.9.3 → 0.9.4

package/server/remoteHost/handlers/startChat.ts

@@ -1,78 +1,142 @@
 // startChat command handler (remote-host — start a chat from the mobile remote).
 //
-// Fire-and-forget: composes the collection's slash command as a prefix on the
-// user's message (`/<slug> <message>` for a collection, `/<slug> id=<itemId>
-// <message>` for one record), then spawns a VISIBLE host chat session (origin
-// `skill`, openable from history) via spawnSystemWorker, and returns the new
-// chatId. No streaming back — starting the chat on the host is enough.
+// The remote sends text; the host starts a new VISIBLE chat session (origin
+// `skill`, openable from desktop history) seeded with it, and returns the new
+// chatId. Fire-and-forget: no streaming back — starting the chat on the host is
+// enough.
 //
-// Mirrors the desktop's two entry points over the command channel: the
-// collection-level `__MC_VIEW.startChat` and the per-record chat box in
-// CollectionRecordPanel.vue (`/<slug> id=<itemId> <message>`).
+// ┌─────────────────────────────────────────────────────────────────────────┐
+// │ THE CONTRACT — read this before touching the params.                      │
+// │                                                                           │
+// │ CURRENT clients send ONLY `{ message }`. The message is seeded VERBATIM   │
+// │ as the first user turn. The host does NOT interpret it, so the client is  │
+// │ free to put a slash command (`/<slug> …`), a plain question, or anything  │
+// │ else in the text. This is the ONLY form new code should emit.             │
+// │                                                                           │
+// │ `slug` (and its optional companion `itemId`) is LEGACY-ONLY. Older        │
+// │ clients still send `{ slug, itemId?, message }` to target a collection    │
+// │ or one record; we keep composing `/<slug> [id=<itemId>] <message>` for    │
+// │ them so they don't break. DO NOT add new features to this branch, and DO  │
+// │ NOT teach new clients to send `slug` — put the slash command in           │
+// │ `message` instead. The whole legacy path can be deleted once no deployed  │
+// │ client sends `slug` anymore.                                              │
+// └─────────────────────────────────────────────────────────────────────────┘
 //
-// Role is intentionally NOT part of the remote API — the caller passes only
-// message + slug + optional itemId. The host runs the chat in its default role
-// (spawnSystemWorker → startChat requires a concrete roleId; empty is rejected).
+// Optional `role` — the id of the role the chat should run in (built-in or
+// custom). Absent / null / "" ⇒ the host default role. A provided id MUST match
+// an existing role: spawnSystemWorker requires a concrete roleId and the
+// downstream getRole silently falls back to `general` on a miss, so we validate
+// here and reject an unknown role rather than seed the wrong assistant.
 //
-// Feeds are refused: a feed (`source === "feed"`) has no `/<slug>` skill
-// command, so a slash-command seed would invoke nothing (see desktop
-// `CollectionView.buildChatSeed`). The mobile remote doesn't offer chat for
-// feeds; this is the host-side backstop so a stray feed slug can't produce a
-// broken chat.
+// Optional `attachments` — full-res files (photos, videos, PDFs) the remote
+// staged to Storage, carried as `[{ storage_id }]`. The host ingests them into
+// the workspace (ingestAttachments) and hands the resulting path-only
+// Attachments to the spawned chat. Absent / empty ⇒ byte-for-byte the prior
+// text-only behaviour.
 //
 // Factory (createStartChat) keeps composition/wiring unit-testable with the
 // engine + spawner stubbed; the default export wires the real ones.
 import { spawnSystemWorker } from "../../api/routes/agent.js";
 import { loadCollection } from "../../workspace/collections/index.js";
+import { loadAllRoles } from "../../workspace/roles.js";
 import { DEFAULT_ROLE_ID } from "../../../src/config/roles.js";
 import type { CommandHandler, JsonObject, JsonValue } from "../commandChannel.js";
+import { ingestAttachments } from "./ingestAttachments.js";
 
 export interface StartChatDeps {
   spawn: typeof spawnSystemWorker;
   loadCollection: typeof loadCollection;
+  ingest: typeof ingestAttachments;
+  loadRoles: typeof loadAllRoles;
 }
 
-// Prefix the message with the collection's slash command. `itemId` scopes the
-// chat to one record; empty ⇒ the whole collection. Matches the desktop
-// item-chat format documented in CollectionRecordPanel.vue.
+// Parse the optional `attachments` param into a list of storage_ids. Absent ⇒ no
+// attachments. A malformed shape (not an array, or an element without a string
+// `storage_id`) rejects the whole command: the remote already uploaded the
+// bytes and is waiting, so a surfaced error beats a chat with a missing file.
+const readStorageIds = (attachments: JsonValue | undefined): string[] => {
+  if (attachments == null) return [];
+  if (!Array.isArray(attachments)) throw new Error("attachments must be an array of { storage_id }");
+  return attachments.map((entry) => {
+    const storageId = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.storage_id : undefined;
+    if (typeof storageId !== "string" || storageId.length === 0) throw new Error("each attachments entry must be { storage_id: string }");
+    return storageId;
+  });
+};
+
+// LEGACY. Prefix the message with the collection's slash command. `itemId`
+// scopes the chat to one record; empty ⇒ the whole collection. Matches the
+// desktop item-chat format documented in CollectionRecordPanel.vue. Only the
+// legacy `slug` path calls this — new clients put the slash command in
+// `message` themselves.
 export const composeMessage = (slug: string, itemId: string, message: string): string => {
   const prefix = itemId ? `/${slug} id=${itemId}` : `/${slug}`;
   return `${prefix} ${message}`;
 };
 
-// slug and itemId become single tokens in the slash command (`/<slug>`,
-// `id=<itemId>`), so a whitespace-containing or non-string value would break
-// the command parse (e.g. `/   hello`). Accept only a trimmed, whitespace-free
-// string; anything else ⇒ "" so the caller rejects it.
+// LEGACY. slug and itemId become single tokens in the slash command
+// (`/<slug>`, `id=<itemId>`), so a whitespace-containing or non-string value
+// would break the command parse (e.g. `/   hello`). Accept only a trimmed,
+// whitespace-free string; anything else ⇒ "" so the caller rejects it.
 const asToken = (value: JsonValue): string => {
   if (typeof value !== "string") return "";
   const trimmed = value.trim();
   return /\s/.test(trimmed) ? "" : trimmed;
 };
 
+// LEGACY collection/record targeting for older clients that still send `slug`.
+// Compose the `/<slug> [id=<itemId>] <message>` seed the desktop uses; reject a
+// malformed or unknown slug and refuse feeds, so we never seed a `/<slug>`
+// command that resolves to nothing. New clients skip all of this by sending the
+// slash command (or plain text) in `message`.
+const composeCollectionSeed = async (deps: StartChatDeps, params: JsonObject, message: string): Promise<string> => {
+  const slug = asToken(params.slug);
+  const itemId = asToken(params.itemId);
+  if (!slug) throw new Error("slug must be a non-empty, whitespace-free string");
+  if (params.itemId != null && !itemId) throw new Error("itemId must be a non-empty, whitespace-free string when provided");
+  const target = await deps.loadCollection(slug);
+  if (!target) throw new Error(`collection '${slug}' not found`);
+  if (target.source === "feed") throw new Error("chat is not available for feeds");
+  return composeMessage(slug, itemId, message);
+};
+
+// A `slug` is "provided" (⇒ LEGACY targeting) only when it is a non-empty
+// value. Omitted / null / "" ⇒ the current free-text form. New clients never
+// set it, so they always take the verbatim branch below.
+const hasSlug = (value: JsonValue | undefined): boolean => value != null && value !== "";
+
+// Resolve the optional `role` param to a concrete roleId. Absent / null / "" ⇒
+// the host default. A provided id must be a string that matches an existing
+// role (built-in or custom) — reject an unknown one so we never seed the chat
+// with the wrong (default-fallback) assistant. `isDebugRole` roles are excluded:
+// the desktop picker hides them from new sessions outside dev mode
+// (RoleSelector.vue), and the remote channel is a production-facing entry point,
+// so a debug role id is treated as not selectable here (rejected as unknown).
+const resolveRoleId = (deps: StartChatDeps, role: JsonValue | undefined): string => {
+  if (role == null || role === "") return DEFAULT_ROLE_ID;
+  if (typeof role !== "string") throw new Error("role must be a string");
+  if (!deps.loadRoles().some((candidate) => candidate.id === role && !candidate.isDebugRole)) throw new Error(`role '${role}' not found`);
+  return role;
+};
+
 export const createStartChat =
   (deps: StartChatDeps): CommandHandler =>
   async (params: JsonObject) => {
     // Params arrive as JSON over the channel — coerce/validate defensively.
-    const slug = asToken(params.slug);
-    const itemId = asToken(params.itemId);
     const message = (typeof params.message === "string" ? params.message : "").trim();
-    if (!slug) throw new Error("slug must be a non-empty, whitespace-free string");
-    if (params.itemId != null && !itemId) throw new Error("itemId must be a non-empty, whitespace-free string when provided");
     if (!message) throw new Error("message is required");
-    // Resolve the target so we never seed a `/<slug>` command that resolves to
-    // nothing: an unknown/stale slug (`null`) is rejected, and a feed
-    // (`source === "feed"`, no skill command) is refused.
-    const target = await deps.loadCollection(slug);
-    if (!target) throw new Error(`collection '${slug}' not found`);
-    if (target.source === "feed") throw new Error("chat is not available for feeds");
-    const result = await deps.spawn({
-      message: composeMessage(slug, itemId, message),
-      roleId: DEFAULT_ROLE_ID,
-      hidden: false,
-    });
+    // Current clients: `message` only ⇒ seed it verbatim. Legacy clients that
+    // still send `slug` ⇒ compose the old `/<slug> [id=<itemId>] <message>` seed.
+    const seed = hasSlug(params.slug) ? await composeCollectionSeed(deps, params, message) : message;
+    // Resolve the role BEFORE ingest/spawn so an unknown role rejects the
+    // command without staging work or launching a chat.
+    const roleId = resolveRoleId(deps, params.role);
+    // Ingest any staged files BEFORE spawning so a download/validation failure
+    // rejects the command instead of starting a chat missing its attachments.
+    const attachments = await deps.ingest(readStorageIds(params.attachments));
+    const result = await deps.spawn({ message: seed, roleId, hidden: false, attachments });
     if (!result.ok) throw new Error(result.error);
     return { started: true, chatId: result.chatId };
   };
 
-export const startChat = createStartChat({ spawn: spawnSystemWorker, loadCollection });
+export const startChat = createStartChat({ spawn: spawnSystemWorker, loadCollection, ingest: ingestAttachments, loadRoles: loadAllRoles });

package/server/system/config.ts

@@ -23,6 +23,27 @@ import { isRecord, isStringArray, isStringRecord } from "../utils/types.js";
 export const EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"] as const;
 export type EffortLevel = (typeof EFFORT_LEVELS)[number];
 
+// Chat-index summarizer setting (#1944). "off" disables the whole
+// AI-title / summary / keywords background indexer; "haiku" / "sonnet"
+// select the Claude model the summarizer spawns. Default (undefined)
+// is treated as "off" — indexing is opt-in from Settings → Chat index
+// so a fresh workspace doesn't burn CLI budget on scheduler/system
+// automation sessions the user may never look at (see #1929 / #1944
+// for the cost analysis). The origin filter (system + scheduler
+// sessions always skipped) is enforced separately and does NOT
+// depend on this setting.
+export const CHAT_INDEX_MODES = ["off", "haiku", "sonnet"] as const;
+export type ChatIndexMode = (typeof CHAT_INDEX_MODES)[number];
+
+// Journal daily-pass setting (follow-up to #1944). Same three states as
+// chat-index: "off" disables both the turn-end hook and the hourly
+// scheduled pass; "haiku" / "sonnet" pick the Claude model the archivist
+// CLI spawns for its summary calls. Default (undefined) is "off" so a
+// fresh workspace doesn't burn CLI budget until the user opts in from
+// Settings → Journal.
+export const JOURNAL_MODES = ["off", "haiku", "sonnet"] as const;
+export type JournalMode = (typeof JOURNAL_MODES)[number];
+
 export interface AppSettings {
   // Extra tool names appended to BASE_ALLOWED_TOOLS in
   // server/agent/config.ts#buildCliArgs. Typical entries are
@@ -63,6 +84,24 @@ export interface AppSettings {
     enabled: boolean;
     model?: string;
   };
+
+  // Chat-index summarizer mode (#1944). Ships "off" by default: the
+  // background AI-title / summary / keywords indexer stays disabled
+  // until the user opts in from Settings → Chat index. Flipping to
+  // "haiku" or "sonnet" selects the model the summarizer spawns per
+  // session. Non-user origins (`system`, `scheduler`) are always
+  // skipped regardless of this value — see `indexer.ts`.
+  chatIndex?: ChatIndexMode;
+
+  // Journal daily-pass mode (follow-up to #1944). Ships "off" by
+  // default: the archivist that summarizes chat sessions into
+  // journal/*.md stays disabled until the user opts in from Settings →
+  // Journal. Flipping to "haiku" / "sonnet" enables the run and picks
+  // the Claude model the archivist CLI spawns. The turn-end hook
+  // (`maybeRunJournal` in the agent finally block) and the hourly
+  // `system:journal` scheduled task both honour this — off short-
+  // circuits before the interval gate is even consulted.
+  journal?: JournalMode;
 }
 
 const DEFAULT_SETTINGS: AppSettings = { extraAllowedTools: [] };
@@ -94,6 +133,14 @@ function isEffortLevel(value: unknown): value is EffortLevel {
   return typeof value === "string" && (EFFORT_LEVELS as readonly string[]).includes(value);
 }
 
+function isChatIndexMode(value: unknown): value is ChatIndexMode {
+  return typeof value === "string" && (CHAT_INDEX_MODES as readonly string[]).includes(value);
+}
+
+function isJournalMode(value: unknown): value is JournalMode {
+  return typeof value === "string" && (JOURNAL_MODES as readonly string[]).includes(value);
+}
+
 function isVoiceInputSettings(value: unknown): value is { enabled: boolean; model?: string } {
   if (!isRecord(value)) return false;
   if (typeof value.enabled !== "boolean") return false;
@@ -108,9 +155,13 @@ export function isAppSettings(value: unknown): value is AppSettings {
   if (value.photoExif !== undefined && !isPhotoExifSettings(value.photoExif)) return false;
   if (value.effortLevel !== undefined && !isEffortLevel(value.effortLevel)) return false;
   if (value.voiceInput !== undefined && !isVoiceInputSettings(value.voiceInput)) return false;
+  if (value.chatIndex !== undefined && !isChatIndexMode(value.chatIndex)) return false;
+  if (value.journal !== undefined && !isJournalMode(value.journal)) return false;
   return true;
 }
 
+// isAppSettingsPatch adds a null sentinel to `chatIndex` / `journal` (see below).
+
 /** A PUT-payload validator: every field optional, but if present
  *  it must match the AppSettings shape. Distinct from
  *  `isAppSettings` (which insists on the full storage shape) so a
@@ -127,28 +178,46 @@ export function isAppSettings(value: unknown): value is AppSettings {
  *  but lets nullable fields carry `null` as a "clear me" sentinel —
  *  callers normalise via `normaliseAppSettingsPatch` before merging
  *  into the storage shape (#1323). */
-export type AppSettingsPatch = Partial<Omit<AppSettings, "effortLevel">> & {
+export type AppSettingsPatch = Partial<Omit<AppSettings, "effortLevel" | "chatIndex" | "journal">> & {
   effortLevel?: EffortLevel | null;
+  chatIndex?: ChatIndexMode | null;
+  journal?: JournalMode | null;
 };
 
 /** Convert a wire patch to the storage-shape patch by dropping any
  *  `null` sentinels (which mean "clear" for the corresponding field). */
 export function normaliseAppSettingsPatch(patch: AppSettingsPatch): Partial<AppSettings> {
-  const { effortLevel, ...rest } = patch;
+  const { effortLevel, chatIndex, journal, ...rest } = patch;
   const out: Partial<AppSettings> = { ...rest };
   if (effortLevel !== null && effortLevel !== undefined) {
     out.effortLevel = effortLevel;
   }
+  if (chatIndex !== null && chatIndex !== undefined) {
+    out.chatIndex = chatIndex;
+  }
+  if (journal !== null && journal !== undefined) {
+    out.journal = journal;
+  }
   return out;
 }
 
+// Split each field's optional-with-null-sentinel validation into its own
+// mini-helper so `isAppSettingsPatch` stays under the cognitive-complexity
+// ceiling as new nullable fields land.
+const isOptionalString = (value: unknown): boolean => value === undefined || typeof value === "string";
+const isOptionalNullableEffortLevel = (value: unknown): boolean => value === undefined || value === null || isEffortLevel(value);
+const isOptionalNullableChatIndexMode = (value: unknown): boolean => value === undefined || value === null || isChatIndexMode(value);
+const isOptionalNullableJournalMode = (value: unknown): boolean => value === undefined || value === null || isJournalMode(value);
+
 export function isAppSettingsPatch(value: unknown): value is AppSettingsPatch {
   if (!isRecord(value)) return false;
   if (value.extraAllowedTools !== undefined && !isStringArray(value.extraAllowedTools)) return false;
-  if (value.googleMapsApiKey !== undefined && typeof value.googleMapsApiKey !== "string") return false;
+  if (!isOptionalString(value.googleMapsApiKey)) return false;
   if (value.photoExif !== undefined && !isPhotoExifSettings(value.photoExif)) return false;
-  if (value.effortLevel !== undefined && value.effortLevel !== null && !isEffortLevel(value.effortLevel)) return false;
+  if (!isOptionalNullableEffortLevel(value.effortLevel)) return false;
   if (value.voiceInput !== undefined && !isVoiceInputSettings(value.voiceInput)) return false;
+  if (!isOptionalNullableChatIndexMode(value.chatIndex)) return false;
+  if (!isOptionalNullableJournalMode(value.journal)) return false;
   return true;
 }
 
@@ -182,9 +251,31 @@ function cloneAppSettings(settings: AppSettings): AppSettings {
       copy.voiceInput.model = settings.voiceInput.model;
     }
   }
+  if (settings.chatIndex !== undefined) {
+    copy.chatIndex = settings.chatIndex;
+  }
+  if (settings.journal !== undefined) {
+    copy.journal = settings.journal;
+  }
   return copy;
 }
 
+/** Chat-index mode with the documented "undefined → off" default, so
+ *  every reader (indexer, backfill scheduler, force-startup switch,
+ *  Settings tab) resolves the same way. Callers switch on the
+ *  returned literal string to decide skip vs pick a model. */
+export function chatIndexMode(settings: AppSettings): ChatIndexMode {
+  return settings.chatIndex ?? "off";
+}
+
+/** Journal mode with the documented "undefined → off" default, so
+ *  every reader (turn-end hook, hourly scheduler, force-startup
+ *  switch, Settings tab) resolves the same way. Callers switch on
+ *  the returned literal string to decide skip vs pick a model. */
+export function journalMode(settings: AppSettings): JournalMode {
+  return settings.journal ?? "off";
+}
+
 /** Read the photo-exif auto-capture flag with the documented
  *  default of `true`. Centralises the "missing block ⇒ on" rule so
  *  the post-save hook + future Settings UI stay aligned. */
@@ -234,6 +325,12 @@ export function saveSettings(settings: AppSettings): void {
       payload.voiceInput.model = settings.voiceInput.model;
     }
   }
+  if (settings.chatIndex !== undefined) {
+    payload.chatIndex = settings.chatIndex;
+  }
+  if (settings.journal !== undefined) {
+    payload.journal = settings.journal;
+  }
   const serialised = JSON.stringify(payload, null, 2);
   writeFileAtomicSync(settingsPath(), `${serialised}\n`, { mode: 0o600 });
 }