mulmoclaude 1.2.0 → 1.4.0

package/server/remoteHost/handlers/googleCalendar.ts

@@ -8,17 +8,22 @@
 import {
   createCalendarEvent,
   DEFAULT_LIST_MAX_RESULTS,
+  getCalendarColors,
   getGoogleAccessToken,
   isIsoDateTimeWithOffset,
   listCalendarEvents,
+  listCalendars,
   MAX_LIST_RESULTS,
+  type CalendarColorEntry,
 } from "@mulmoclaude/core/google";
-import type { CommandHandler, JsonObject } from "../commandChannel.js";
+import type { CommandHandler, JsonObject, JsonValue } from "../commandChannel.js";
 
 export interface GoogleCalendarDeps {
   getAccessToken: typeof getGoogleAccessToken;
   createEvent: typeof createCalendarEvent;
   listEvents: typeof listCalendarEvents;
+  listCalendars: typeof listCalendars;
+  getColors: typeof getCalendarColors;
 }
 
 const requiredString = (params: JsonObject, key: string): string => {
@@ -27,6 +32,15 @@ const requiredString = (params: JsonObject, key: string): string => {
   return value;
 };
 
+const optionalString = (params: JsonObject, key: string): string | undefined => {
+  const value = params[key];
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== "string" || value.trim() === "") throw new Error(`${key} must be a non-empty string`);
+  // Return trimmed so whitespace can't reach the Google API (matches the
+  // plugin's Zod .trim() normalization).
+  return value.trim();
+};
+
 // Calendar's `dateTime`/`timeMin` are RFC3339 and reject date-only,
 // offset-less, or impossible values with an opaque 400, so the strict shared
 // validator runs here where the remote gets an actionable message.
@@ -47,6 +61,14 @@ const clampMaxResults = (value: unknown): number => {
   return Math.min(Math.max(value, 1), MAX_LIST_RESULTS);
 };
 
+// Spread rebuilds an anonymous object type — the named CalendarColorEntry
+// interface (no index signature) can't satisfy the channel's structural
+// JsonValue directly (same constraint as CalendarEventSummary).
+const toColorMapJson = (map: Record<string, CalendarColorEntry>): JsonObject =>
+  Object.fromEntries(
+    Object.entries(map).map(([colorId, entry]): [string, JsonValue] => [colorId, { background: entry.background, foreground: entry.foreground }]),
+  );
+
 export const createGoogleCalendarCreateEvent =
   (deps: GoogleCalendarDeps): CommandHandler =>
   async (params: JsonObject) => {
@@ -55,6 +77,8 @@ export const createGoogleCalendarCreateEvent =
       startDateTime: asDateTime(requiredString(params, "start"), "start"),
       endDateTime: asDateTime(requiredString(params, "end"), "end"),
       description: typeof params.description === "string" ? params.description : undefined,
+      calendarId: optionalString(params, "calendarId"),
+      colorId: optionalString(params, "colorId"),
     };
     const event = await deps.createEvent(await deps.getAccessToken(), input);
     // Spread rebuilds an anonymous object type — the CalendarEventSummary
@@ -68,10 +92,33 @@ export const createGoogleCalendarListEvents =
   async (params: JsonObject) => {
     const timeMin = optionalDateTime(params, "timeMin");
     const maxResults = clampMaxResults(params.maxResults);
-    const events = await deps.listEvents(await deps.getAccessToken(), { timeMin, maxResults });
+    const calendarId = optionalString(params, "calendarId");
+    const events = await deps.listEvents(await deps.getAccessToken(), { timeMin, maxResults, calendarId });
     return { events: events.map((event) => ({ ...event })) };
   };
 
-const deps: GoogleCalendarDeps = { getAccessToken: getGoogleAccessToken, createEvent: createCalendarEvent, listEvents: listCalendarEvents };
+export const createGoogleCalendarListCalendars =
+  (deps: GoogleCalendarDeps): CommandHandler =>
+  async () => {
+    const calendars = await deps.listCalendars(await deps.getAccessToken());
+    return { calendars: calendars.map((calendar) => ({ ...calendar })) };
+  };
+
+export const createGoogleCalendarColors =
+  (deps: GoogleCalendarDeps): CommandHandler =>
+  async () => {
+    const colors = await deps.getColors(await deps.getAccessToken());
+    return { colors: { event: toColorMapJson(colors.event), calendar: toColorMapJson(colors.calendar) } };
+  };
+
+const deps: GoogleCalendarDeps = {
+  getAccessToken: getGoogleAccessToken,
+  createEvent: createCalendarEvent,
+  listEvents: listCalendarEvents,
+  listCalendars,
+  getColors: getCalendarColors,
+};
 export const googleCalendarCreateEvent = createGoogleCalendarCreateEvent(deps);
 export const googleCalendarListEvents = createGoogleCalendarListEvents(deps);
+export const googleCalendarListCalendars = createGoogleCalendarListCalendars(deps);
+export const googleCalendarColors = createGoogleCalendarColors(deps);

package/server/remoteHost/handlers/index.ts

@@ -6,7 +6,7 @@ import { getCollection } from "./getCollection.js";
 import { getFeed } from "./getFeed.js";
 import { getRemoteView } from "./getRemoteView.js";
 import { getRemoteViewItems } from "./getRemoteViewItems.js";
-import { googleCalendarCreateEvent, googleCalendarListEvents } from "./googleCalendar.js";
+import { googleCalendarColors, googleCalendarCreateEvent, googleCalendarListCalendars, googleCalendarListEvents } from "./googleCalendar.js";
 import { listAccountingBooks } from "./listAccountingBooks.js";
 import { listCollections } from "./listCollections.js";
 import { listFeeds } from "./listFeeds.js";
@@ -29,4 +29,6 @@ export const handlers: CommandHandlers = {
   startChat,
   "google.calendar.createEvent": googleCalendarCreateEvent,
   "google.calendar.listEvents": googleCalendarListEvents,
+  "google.calendar.listCalendars": googleCalendarListCalendars,
+  "google.calendar.colors": googleCalendarColors,
 };

package/server/services/translation/index.ts

@@ -88,9 +88,16 @@ export function createTranslationService(deps: TranslationServiceDeps): Translat
     const next = prev.catch(() => undefined).then(runner);
     const tracked = next.catch(() => undefined);
     chains.set(namespace, tracked);
-    tracked.then(() => {
-      if (chains.get(namespace) === tracked) chains.delete(namespace);
-    });
+    // Housekeeping only — the caller waits on `next`, not on this. Still needs
+    // a terminal handler: `tracked` swallowed the runner's rejection, but the
+    // cleanup callback itself is not covered by that. Silent by design: a
+    // failed map-entry cleanup is not worth a log line, and it used to reach
+    // the process-level `unhandledRejection` handler and exit the server.
+    tracked
+      .then(() => {
+        if (chains.get(namespace) === tracked) chains.delete(namespace);
+      })
+      .catch(() => {});
     return next;
   }
 

package/server/utils/errors.ts

@@ -2,24 +2,10 @@
 // `err instanceof Error ? err.message : String(err)` — searching for
 // one canonical helper is easier than grepping for the inline form.
 //
-// Non-Error objects with a `details` (gRPC convention) or `message`
-// string field have that field surfaced — without this, gRPC errors
-// like `{ code, details, metadata }` show up to users as
-// `[object Object]`.
-//
-// The optional `fallback` covers the common route-handler idiom where
-// a throw of a plain non-Error value should surface as a descriptive
-// message ("rebuild failed") rather than `String(err)` noise. Prefer
-// passing a fallback at error-response boundaries — omit it for
-// logging contexts where `String(err)` is fine.
-
-export function errorMessage(err: unknown, fallback?: string): string {
-  if (err instanceof Error) return err.message;
-  if (err !== null && typeof err === "object") {
-    const obj = err as { details?: unknown; message?: unknown };
-    if (typeof obj.details === "string" && obj.details) return obj.details;
-    if (typeof obj.message === "string" && obj.message) return obj.message;
-  }
-  if (fallback !== undefined) return fallback;
-  return String(err);
-}
+// The implementation lives in `@mulmoclaude/core/utils` so the host, the
+// collection engine, the scheduler and the Google engine can't drift apart
+// again: before #2217 this function existed 14 times across 4 behaviours, and
+// gRPC-shaped errors surfaced as "[object Object]" through half of them.
+// Re-exported (rather than repointing 92 files) so host code keeps reaching
+// for `server/utils/errors.js` by name.
+export { errorMessage } from "@mulmoclaude/core/utils";

package/server/utils/files/html-store.ts

@@ -1,20 +1,6 @@
-import path from "path";
-import { workspacePath } from "../../workspace/workspace.js";
 import { WORKSPACE_DIRS } from "../../workspace/paths.js";
-import { writeFileAtomic } from "./atomic.js";
 import { makePathValidator } from "./path-validator.js";
 
-// Strict — overwriteHtml's path.join doesn't normalize traversal, so this gate is the primary defence.
+// The sole guard on html-store paths: `path.join` elsewhere doesn't normalize
+// traversal, so callers must pre-check writes with this validator.
 export const isHtmlPath = makePathValidator({ prefix: WORKSPACE_DIRS.htmls, ext: ".html" });
-
-// Defense in depth (matches `overwriteSvg`): if a caller forgets to
-// pre-check via `isHtmlPath`, `path.join(workspacePath, relativePath)`
-// would silently produce a traversal escape. The re-check inside the
-// write closes that trust chain.
-export async function overwriteHtml(relativePath: string, content: string): Promise<void> {
-  if (!isHtmlPath(relativePath)) {
-    throw new Error(`invalid html path: ${relativePath}`);
-  }
-  const absPath = path.join(workspacePath, relativePath);
-  await writeFileAtomic(absPath, content);
-}

package/server/utils/files/journal-io.ts

@@ -7,20 +7,8 @@ import { isEnoent } from "./safe.js";
 import { log } from "../../system/logger/index.js";
 import { summariesRoot, dailyPathFor, topicPathFor, TOPICS_DIR, INDEX_FILE, STATE_FILE, DAILY_DIR, ARCHIVE_DIR } from "../../workspace/journal/paths.js";
 
-import { statSync } from "node:fs";
-
 const root = (rootOverride?: string) => rootOverride ?? workspacePath;
 
-export function journalStateExists(rootOverride?: string): boolean {
-  const filePath = path.join(summariesRoot(root(rootOverride)), STATE_FILE);
-  try {
-    statSync(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 export async function readJournalState<T>(fallback: T, rootOverride?: string): Promise<T> {
   const filePath = path.join(summariesRoot(root(rootOverride)), STATE_FILE);
   try {

package/server/utils/files/plugins-io.ts

@@ -15,10 +15,9 @@
 // written ledger never bricks server boot. Writes go through the
 // atomic helper, so a crashed install can't leave a corrupt file.
 
-import { existsSync } from "node:fs";
-import { mkdir, readFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { loadJsonFile, writeJsonAtomic } from "./json.js";
+import { loadJsonFile } from "./json.js";
 import { WORKSPACE_PATHS } from "../../workspace/paths.js";
 
 export interface LedgerEntry {
@@ -49,14 +48,6 @@ export function readLedger(): LedgerEntry[] {
   return sanitiseLedger(raw);
 }
 
-export async function writeLedger(entries: readonly LedgerEntry[]): Promise<void> {
-  const dir = path.dirname(WORKSPACE_PATHS.pluginsLedger);
-  if (!existsSync(dir)) {
-    await mkdir(dir, { recursive: true });
-  }
-  await writeJsonAtomic(WORKSPACE_PATHS.pluginsLedger, [...entries]);
-}
-
 /** Read a runtime-plugin asset (extracted under
  *  `plugins/.cache/<name>/<version>/`) and return its bytes plus
  *  the inferred Content-Type. The route handler in

package/server/utils/files/safe.ts

@@ -99,6 +99,45 @@ export function hasTraversalSegment(value: string): boolean {
   return value.split(/[/\\]/).some((segment) => segment === ".." || segment === ".");
 }
 
+// Lazily realpath a directory once and cache the result. Returns null
+// until the directory exists on disk (a fresh workspace hasn't created
+// it yet) and retries on the next call. The /artifacts/* static mounts
+// each need their storage root as a realpath for the traversal check,
+// but the root may not be materialised at boot.
+export function makeCachedRealpath(dir: string): () => Promise<string | null> {
+  let cached: string | null = null;
+  return async () => {
+    if (cached) return cached;
+    try {
+      cached = await promises.realpath(dir);
+      return cached;
+    } catch {
+      return null;
+    }
+  };
+}
+
+// Decode and traversal-guard an `/artifacts/*` request path against an
+// already-realpath'd storage root. Returns the in-root relative path to
+// serve, or null when the URL is malformed, escapes the root, or (when
+// `denyDotfiles`) touches a dotfile segment. The images / html / svg
+// static mounts share this so the decode + traversal + dotfile policy is
+// defined once. `rootReal` MUST be a realpath (see `resolveWithinRoot`).
+export function resolveArtifactRequestPath(rootReal: string, reqPath: string, denyDotfiles: boolean): string | null {
+  let relPath: string;
+  try {
+    // decodeURIComponent throws URIError on malformed escapes (`%ZZ`,
+    // stray `%`). Fail closed so a junk URL 404s instead of bubbling a
+    // 500 out of the express error chain.
+    relPath = decodeURIComponent(reqPath.replace(/^\//, ""));
+  } catch {
+    return null;
+  }
+  if (!resolveWithinRoot(rootReal, relPath)) return null;
+  if (denyDotfiles && containsDotfileSegment(relPath)) return null;
+  return relPath;
+}
+
 // `rootReal` MUST already be a realpath. Returns null on traversal or if either path doesn't exist on disk.
 export function resolveWithinRoot(rootReal: string, relPath: string): string | null {
   const normalized = path.normalize(relPath || "");

package/server/utils/httpError.ts

@@ -50,6 +50,12 @@ export function notFound(res: Response, error: string): Response {
   return sendError(res, 404, error);
 }
 
+/** 405 Method Not Allowed — the resource exists but refuses this verb
+ *  (e.g. a write against a read-only `dataSource` collection). */
+export function methodNotAllowed(res: Response, error: string): Response {
+  return sendError(res, 405, error);
+}
+
 /** 409 Conflict — duplicate, concurrent modification, already running, etc. */
 export function conflict(res: Response, error: string): Response {
   return sendError(res, 409, error);

package/server/utils/text.ts

@@ -1,29 +1,13 @@
 // Shared text helpers. Use these instead of re-implementing the
 // same operation per file (#1306).
 //
+// `truncate` lives in `@mulmoclaude/core/utils` so the host, the collection
+// engine and the Google engine share one implementation — the copies had
+// already drifted on the `ellipsis.length >= max` guard (#2217). Re-exported
+// (rather than repointing ~5 import sites) to keep `server/utils/text.ts` the
+// one place host code looks for general string helpers.
+//
 // Why not in `format/`: these are general string operations, not
 // presentation-layer formatters. Reserve `format/` for locale-aware
 // or unit-aware display helpers.
-
-/** Truncate `text` to at most `max` characters, appending `ellipsis`
- *  when the input is too long.
- *
- *  The ellipsis is part of the budget: `truncate("hello world", 8)`
- *  yields `"hello w…"` (7 chars of the original + the ellipsis = 8
- *  total). This avoids the off-by-one bug where naive
- *  `slice(0, max) + "…"` overshoots `max`.
- *
- *  Edge cases:
- *  - `text.length <= max` → return `text` unchanged.
- *  - `max <= 0` → return the empty string (callers asking for "no
- *    output" should get "no output", not a stray ellipsis).
- *  - If `ellipsis.length > max`, the ellipsis itself is truncated
- *    to fit `max` rather than throwing — keeps callers safe from
- *    surprising errors when they pick a tiny max with a multi-char
- *    ellipsis. */
-export function truncate(text: string, max: number, ellipsis = "…"): string {
-  if (max <= 0) return "";
-  if (text.length <= max) return text;
-  if (ellipsis.length >= max) return ellipsis.slice(0, max);
-  return text.slice(0, max - ellipsis.length) + ellipsis;
-}
+export { truncate } from "@mulmoclaude/core/utils";

package/server/utils/time.ts

@@ -47,6 +47,3 @@ export const SUBPROCESS_WORK_TIMEOUT_MS = ONE_MINUTE_MS;
 
 /** CLI subprocess timeout (claude -p for summarization, etc.) */
 export const CLI_SUBPROCESS_TIMEOUT_MS = 5 * ONE_MINUTE_MS;
-
-/** Maximum one-shot notification delay */
-export const MAX_NOTIFICATION_DELAY_SEC = 3_600; // 1 hour in seconds

package/server/workspace/collections/index.ts

@@ -11,13 +11,15 @@ export { validateCollectionRecords, validateRecordObject, COMPUTED_TYPES, type R
 export { buildWorkspaceOntology, schemaRelations, type CollectionOntologyEntry, type OntologyRelation } from "@mulmoclaude/core/collection/server";
 export { applyMutateAction, firstMutateParamProblem, type MutateActionOutcome } from "@mulmoclaude/core/collection/server";
 export { enrichItems, computeCollectionIcon } from "@mulmoclaude/core/collection/server";
+export { storeFor, collectionWritable, readOnlyRefusal, type CollectionStore } from "@mulmoclaude/core/collection/server";
 export { deleteCollection, deleteCollectionRefusalMessage, type DeleteCollectionResult } from "@mulmoclaude/core/collection/server";
 export { deleteCustomView, type DeleteViewResult } from "@mulmoclaude/core/collection/server";
+// NOTE (storage virtualization, plans/refactor-storage-virtualization.md):
+// the raw io functions (`listItems` / `readItem` / `writeItem` /
+// `deleteItem`) are deliberately NOT re-exported — host code reads AND
+// writes records only through `storeFor(...)` (write/delete exist only on
+// writable stores) so a future storage backend can't be bypassed.
 export {
-  listItems,
-  readItem,
-  writeItem,
-  deleteItem,
   safeRecordId,
   generateItemId,
   resolveCreateItemId,

package/server/workspace/collections/remoteView.ts

@@ -23,16 +23,14 @@ import {
 } from "@mulmoclaude/core/remote-view";
 import { enrichItems } from "@mulmoclaude/core/collection/server";
 import {
-  deleteItem,
-  listItems,
   readCustomViewHtml,
   readCustomViewI18n,
-  readItem,
   safeRecordId,
-  writeItem,
+  storeFor,
   type CollectionCustomView,
   type CollectionItem,
   type CollectionSchema,
+  type CollectionStore,
   type LoadedCollection,
 } from "./index.js";
 import { resolveThumbnail } from "../../utils/files/thumbnail-store.js";
@@ -108,6 +106,7 @@ export type MutateRemoteViewResult =
   | { kind: "view-not-found"; viewId: string }
   | { kind: "not-mobile"; viewId: string }
   | { kind: "not-writable"; viewId: string }
+  | { kind: "read-only-collection" }
   | { kind: "field-not-editable"; field: string }
   | { kind: "delete-not-allowed" }
   | { kind: "invalid-patch" }
@@ -116,9 +115,7 @@ export type MutateRemoteViewResult =
   | { kind: "path-escape" };
 
 export interface MutateRemoteViewDeps {
-  readItem: typeof readItem;
-  writeItem: typeof writeItem;
-  deleteItem: typeof deleteItem;
+  storeFor: (collection: LoadedCollection) => CollectionStore;
   enrichItems: typeof enrichItems;
   resolveThumbnail: typeof resolveThumbnail;
 }
@@ -129,13 +126,18 @@ export const createMutateRemoteView =
     const view = (collection.schema.views ?? []).find((entry) => entry.id === viewId);
     if (!view) return { kind: "view-not-found", viewId };
     if (view.target !== "mobile") return { kind: "not-mobile", viewId };
+    // A dataSource collection is read-only regardless of what write surface
+    // the view declares — the collection-level rule outranks the view's. The
+    // store encodes it as absent write/delete methods.
+    const store = deps.storeFor(collection);
+    if (!store.write || !store.delete) return { kind: "read-only-collection" };
     if (!isWritableView(view)) return { kind: "not-writable", viewId };
-    return request.op === "delete" ? deleteViaView(deps, collection, view.allowDelete === true, request.id) : updateViaView(deps, collection, view, request);
+    return request.op === "delete" ? deleteViaView(store.delete, view.allowDelete === true, request.id) : updateViaView(deps, store, collection, view, request);
   };
 
-async function deleteViaView(deps: MutateRemoteViewDeps, collection: LoadedCollection, allowDelete: boolean, itemId: string): Promise<MutateRemoteViewResult> {
+async function deleteViaView(remove: NonNullable<CollectionStore["delete"]>, allowDelete: boolean, itemId: string): Promise<MutateRemoteViewResult> {
   if (!allowDelete) return { kind: "delete-not-allowed" };
-  const result = await deps.deleteItem(collection.dataDir, itemId, { slug: collection.slug });
+  const result = await remove(itemId);
   if (result.kind === "invalid-id") return { kind: "invalid-id", id: result.itemId };
   if (result.kind === "path-escape") return { kind: "path-escape" };
   if (result.kind === "not-found") return { kind: "item-not-found", id: result.itemId };
@@ -144,10 +146,13 @@ async function deleteViaView(deps: MutateRemoteViewDeps, collection: LoadedColle
 
 async function updateViaView(
   deps: MutateRemoteViewDeps,
+  store: CollectionStore,
   collection: LoadedCollection,
   view: CollectionCustomView,
   request: Extract<RemoteViewMutateRequest, { op: "update" }>,
 ): Promise<MutateRemoteViewResult> {
+  const { write } = store;
+  if (!write) return { kind: "read-only-collection" }; // unreachable: caller guards presence
   const { primaryKey } = collection.schema;
   const patchKeys = Object.keys(request.patch);
   if (patchKeys.length === 0) return { kind: "invalid-patch" };
@@ -156,17 +161,17 @@ async function updateViaView(
   // desync the file name from the record) even if an author listed it.
   const offending = patchKeys.find((key) => key === primaryKey || !allowed.has(key));
   if (offending) return { kind: "field-not-editable", field: offending };
-  // Classify a bad id BEFORE readItem — which returns null for an unsafe id, a
-  // path-escape, AND a genuinely-missing record alike — so update reports the
-  // same explicit `invalid-id` the delete path does (via deleteItem) instead of
-  // masking it as a 404. (A valid id whose dataDir escapes the workspace can
-  // hold no record, so it still resolves to item-not-found; a real write is
-  // additionally refused by writeItem's own containment guard below.)
+  // Classify a bad id BEFORE the store read — which returns null for an unsafe
+  // id, a path-escape, AND a genuinely-missing record alike — so update reports
+  // the same explicit `invalid-id` the delete path does (via `store.delete`)
+  // instead of masking it as a 404. (A valid id whose data location escapes the
+  // workspace can hold no record, so it still resolves to item-not-found; a
+  // real write is additionally refused by the store's own containment guard.)
   if (safeRecordId(request.id) === null) return { kind: "invalid-id", id: request.id };
-  const existing = await deps.readItem(collection.dataDir, request.id, { slug: collection.slug });
+  const existing = await store.read(request.id);
   if (!existing) return { kind: "item-not-found", id: request.id };
   const merged: CollectionItem = { ...existing, ...request.patch, [primaryKey]: request.id };
-  const result = await deps.writeItem(collection.dataDir, request.id, merged, { slug: collection.slug });
+  const result = await write(request.id, merged);
   if (result.kind === "invalid-id") return { kind: "invalid-id", id: result.itemId };
   if (result.kind === "path-escape") return { kind: "path-escape" };
   if (result.kind === "conflict") return { kind: "item-not-found", id: result.itemId }; // unreachable: refuseOverwrite is false
@@ -196,7 +201,7 @@ async function updateViaView(
   return { kind: "ok", op: "update", item: item as CollectionItem };
 }
 
-export const mutateRemoteView = createMutateRemoteView({ readItem, writeItem, deleteItem, enrichItems, resolveThumbnail });
+export const mutateRemoteView = createMutateRemoteView({ storeFor, enrichItems, resolveThumbnail });
 
 // ── Item pages with inlined image thumbnails (phase 5 — plans/feat-remote-view-images.md) ──
 // A mobile view's `getItems`, view-aware so it can inline the `imageFields` its
@@ -213,7 +218,9 @@ export type RemoteViewItemsResult =
   | { kind: "too-large"; bytes: number };
 
 export interface RemoteViewItemsDeps {
-  listItems: typeof listItems;
+  /** Load every record of the collection — store-aware (file records or a
+   *  `dataSource` CSV's rows), unlike a raw dataDir `listItems`. */
+  listRecords: (collection: LoadedCollection) => Promise<CollectionItem[]>;
   enrichItems: typeof enrichItems;
   resolveThumbnail: typeof resolveThumbnail;
 }
@@ -271,7 +278,7 @@ export const createRemoteViewItems =
     // formulas evaluated with a full ref cache (`ticker.price`, `shares * ticker.price`
     // resolve), toggles projected, embeds resolved. The phone gets plain resolved
     // scalars — no network, no dataUrl — so mobile numbers match desktop exactly.
-    const items = await deps.listItems(collection.dataDir);
+    const items = await deps.listRecords(collection);
     const derived = (await deps.enrichItems(collection, items)) as RemoteViewItem[];
     const page = pageFromItems(derived, request, collection.schema.primaryKey);
     // Resolving an `embed` column attaches a whole target record per row, so the
@@ -289,7 +296,7 @@ export const createRemoteViewItems =
     return { kind: "ok", page, inlined, omitted };
   };
 
-export const remoteViewItems = createRemoteViewItems({ listItems, enrichItems, resolveThumbnail });
+export const remoteViewItems = createRemoteViewItems({ listRecords: (collection) => storeFor(collection).list(), enrichItems, resolveThumbnail });
 
 /** Message per non-ok item-page kind — shared by the channel handler (throws)
  *  and the HTTP route (sends with the matching status). */
@@ -307,6 +314,8 @@ export function mutateRemoteViewFailureMessage(result: Exclude<MutateRemoteViewR
   if (result.kind === "not-mobile") return `custom view '${result.viewId}' is not a mobile view — declare target: "mobile" in its views[] entry`;
   if (result.kind === "not-writable")
     return `mobile view '${result.viewId}' is read-only — declare editableFields and/or allowDelete in its views[] entry to allow writes`;
+  if (result.kind === "read-only-collection")
+    return `collection '${slug}' is read-only (backed by an external dataSource) — update the data file itself instead`;
   if (result.kind === "field-not-editable")
     return `field '${result.field}' is not editable from this view — add it to the view's editableFields (the primary key is never editable)`;
   if (result.kind === "delete-not-allowed") return `this view may not delete records — set allowDelete: true in its views[] entry`;

package/server/workspace/collections/watcher.ts

@@ -15,5 +15,6 @@ export {
   _syncWatchersForTesting,
   _tickTimeTriggersForTesting,
   _scheduleItemReconcileForTesting,
+  _scheduleStorageReconcileForTesting,
   type CollectionWatcherOptions,
 } from "@mulmoclaude/core/collection-watchers";

package/server/workspace/custom-dirs.ts

@@ -9,7 +9,7 @@ import path from "path";
 import { workspacePath, WORKSPACE_DIRS } from "./paths.js";
 import { log } from "../system/logger/index.js";
 import { writeJsonAtomicSync } from "../utils/files/json.js";
-import { isRecord } from "../utils/types.js";
+import { hasStringProp, isRecord } from "../utils/types.js";
 
 // ── Types ───────────────────────────────────────────────────────
 
@@ -82,16 +82,23 @@ function sanitizeDescription(raw: string): string {
 
 function validateEntry(raw: unknown): CustomDirEntry | null {
   if (!isRecord(raw)) return null;
-  const obj = raw as Record<string, unknown>;
 
-  const validPath = validatePath(String(obj.path ?? ""));
+  // Type-check the field rather than `String(...)`-ing it. This file is fed by a
+  // hand-edited config, so `path` can be an array or object; stringifying one
+  // handed `validatePath` the literal "[object Object]" to evaluate as a path.
+  // (`validatePath`'s own `typeof !== "string"` check could never fire behind a
+  // `String()` call.)
+  if (!hasStringProp(raw, "path")) return null;
+  const validPath = validatePath(raw.path);
   if (!validPath) return null;
 
-  const structure = isValidStructure(obj.structure) ? obj.structure : DIR_STRUCTURES.flat;
+  const structure = isValidStructure(raw.structure) ? raw.structure : DIR_STRUCTURES.flat;
 
   return {
     path: validPath,
-    description: sanitizeDescription(String(obj.description ?? "")),
+    // A non-string description is dropped rather than described as
+    // "[object Object]" — it is optional, so absent is the honest reading.
+    description: sanitizeDescription(hasStringProp(raw, "description") ? raw.description : ""),
     structure,
   };
 }
@@ -153,7 +160,10 @@ export function validateCustomDirs(raw: unknown): { entries: CustomDirEntry[] }
     if (entry) {
       entries.push(entry);
     } else {
-      const itemPath = isRecord(item) ? String((item as Record<string, unknown>).path ?? "") : "";
+      // Only echo a genuine string back in the error; a non-string `path` is
+      // exactly the case where "[object Object]" would mislead the reader about
+      // what their config actually says.
+      const itemPath = hasStringProp(item, "path") ? item.path : "";
       errors.push(`entry ${i}: invalid path "${itemPath}"`);
     }
   });

package/server/workspace/journal/state.ts

@@ -1,8 +1,4 @@
-import {
-  readJournalState as readJournalStateRaw,
-  writeJournalState as writeJournalStateRaw,
-  journalStateExists as journalStateExistsRaw,
-} from "../../utils/files/journal-io.js";
+import { readJournalState as readJournalStateRaw, writeJournalState as writeJournalStateRaw } from "../../utils/files/journal-io.js";
 import { ONE_HOUR_MS, ONE_DAY_MS } from "../../utils/time.js";
 import { log } from "../../system/logger/index.js";
 import { isRecord } from "../../utils/types.js";
@@ -106,7 +102,3 @@ export async function readState(workspaceRoot: string): Promise<JournalState> {
 export async function writeState(workspaceRoot: string, state: JournalState): Promise<void> {
   await writeJournalStateRaw(state, workspaceRoot);
 }
-
-export function stateFileExists(workspaceRoot: string): boolean {
-  return journalStateExistsRaw(workspaceRoot);
-}

package/server/workspace/memory/topic-index-hook.ts

@@ -117,12 +117,3 @@ export async function maybeRegenerateTopicIndex(relativePath: string): Promise<b
     return false;
   }
 }
-
-/** Test-only — drop the per-workspace regen chain so each test
- *  starts with a fresh queue. Without this, a chain rejection from
- *  one test could carry into the next (the .catch in `chainRegen`
- *  swallows it for the next caller, but the test runner sees the
- *  unhandled-rejection from the original promise). */
-export function _resetTopicIndexRegenChainForTesting(): void {
-  regenChains.clear();
-}

package/server/workspace/memory/topic-io.ts

@@ -33,10 +33,6 @@ export function topicMemoryIndexPath(workspaceRoot: string): string {
   return path.join(workspaceRoot, WORKSPACE_FILES.memoryIndex);
 }
 
-export function topicFilePath(workspaceRoot: string, type: MemoryType, topic: string): string {
-  return path.join(topicMemoryRoot(workspaceRoot), type, `${topic}.md`);
-}
-
 // Both loaders walk types in `MEMORY_TYPES` order (a stable
 // constant) and sort filenames within each type by name. This pins
 // the order of entries in the agent's system prompt so a `readdir`