mulmoclaude 1.2.0 → 1.4.0

package/server/api/routes/wiki/history.ts

@@ -17,7 +17,7 @@ import { randomUUID } from "node:crypto";
 import { TOOL_NAMES } from "../../../../src/config/toolNames.js";
 import { hasMeaningfulChange, writeWikiPage } from "../../../workspace/wiki-pages/io.js";
 import { WORKSPACE_DIRS } from "../../../workspace/paths.js";
-import { isSafeStamp, listSnapshots, readSnapshot, stripSnapshotMeta } from "../../../workspace/wiki-pages/snapshot.js";
+import { isSafeStamp, listSnapshots, readSnapshot, stripSnapshotMeta, type SnapshotContent } from "../../../workspace/wiki-pages/snapshot.js";
 import { mergeFrontmatter, serializeWithFrontmatter } from "../../../utils/markdown/frontmatter.js";
 import { badRequest, notFound } from "../../../utils/httpError.js";
 import { readTextOrNull } from "../../../utils/files/safe.js";
@@ -66,39 +66,37 @@ router.get("/pages/:slug/history", async (req: Request<{ slug: string }>, res: R
   res.json({ slug, snapshots });
 });
 
-router.get("/pages/:slug/history/:stamp", async (req: Request<{ slug: string; stamp: string }>, res: Response) => {
+// Validate `:slug`/`:stamp` and load the snapshot, or respond (400 for
+// an unsafe param, 404 for a missing snapshot) and return null. Shared
+// by the read and restore routes so the guard lives in one place.
+async function resolveSnapshotOr4xx(req: Request<{ slug: string; stamp: string }>, res: Response): Promise<SnapshotContent | null> {
   const { slug, stamp } = req.params;
   if (!isSafeSlug(slug)) {
     badRequest(res, "Unsafe slug");
-    return;
+    return null;
   }
   if (!isSafeStamp(stamp)) {
     badRequest(res, "Unsafe stamp");
-    return;
+    return null;
   }
   const snapshot = await readSnapshot(slug, stamp);
   if (snapshot === null) {
     notFound(res, `snapshot not found: ${slug}/${stamp}`);
-    return;
+    return null;
   }
-  res.json({ slug, snapshot });
+  return snapshot;
+}
+
+router.get("/pages/:slug/history/:stamp", async (req: Request<{ slug: string; stamp: string }>, res: Response) => {
+  const snapshot = await resolveSnapshotOr4xx(req, res);
+  if (!snapshot) return;
+  res.json({ slug: req.params.slug, snapshot });
 });
 
 router.post("/pages/:slug/history/:stamp/restore", async (req: Request<{ slug: string; stamp: string }>, res: Response) => {
+  const snapshot = await resolveSnapshotOr4xx(req, res);
+  if (!snapshot) return;
   const { slug, stamp } = req.params;
-  if (!isSafeSlug(slug)) {
-    badRequest(res, "Unsafe slug");
-    return;
-  }
-  if (!isSafeStamp(stamp)) {
-    badRequest(res, "Unsafe stamp");
-    return;
-  }
-  const snapshot = await readSnapshot(slug, stamp);
-  if (snapshot === null) {
-    notFound(res, `snapshot not found: ${slug}/${stamp}`);
-    return;
-  }
 
   // Strip `_snapshot_*` keys before writing — they describe the
   // *original* save event and would be misleading on the restored

package/server/build/dispatcher.mjs

@@ -126,7 +126,7 @@ async function handleConfigRefresh(payload) {
   await safePost(req);
 }
 
-// packages/core/dist/collection/paths.js
+// packages/core/dist/templatePath-k_WNbL_Q.js
 var TEMPLATES_PREFIX = "templates/";
 function isSafeTemplatePath(value) {
   if (value.length === 0 || value.includes("\\") || value.startsWith("/")) return false;
@@ -201,7 +201,7 @@ function mirrorSkillDelete(workspaceRoot2, slug) {
   return { dest };
 }
 
-// server/utils/errors.ts
+// packages/core/dist/errors-eid6Mes3.js
 function errorMessage(err, fallback) {
   if (err instanceof Error) return err.message;
   if (err !== null && typeof err === "object") {

package/server/events/collection-change.ts

@@ -24,6 +24,7 @@
 // package catches up, but the launcher boots. Matches the feature's
 // "optional everywhere" design (the View-side `subscribeChanges` is optional too).
 
+// eslint-disable-next-line no-restricted-imports -- namespace import is the feature-detect described above; only `setCollectionChangePublisher` is accessed, never the restricted raw io readers
 import * as collectionPlugin from "@mulmoclaude/core/collection/server";
 import type { CollectionChangePayload } from "@mulmoclaude/core/collection/server";
 import { collectionChannel, type CollectionChannelPayload } from "../../src/config/pubsubChannels.js";
@@ -63,8 +64,3 @@ export function initCollectionChangePublisher(instance: IPubSub): void {
     }
   });
 }
-
-/** Detach the publisher (test teardown). No-op against an older package. */
-export function _resetCollectionChangePublisherForTesting(): void {
-  resolveSetPublisher()?.(null);
-}

package/server/events/file-change.ts

@@ -11,7 +11,7 @@
 // publisher; we hand those to the package as the primary channel + normaliser.
 
 import type { IPubSub } from "./pub-sub/index.js";
-import { configureFileChangePublisher, publishFileChange, resetFileChangePublisher } from "@mulmoclaude/core/file-change";
+import { configureFileChangePublisher, publishFileChange } from "@mulmoclaude/core/file-change";
 import { fileChannel, toPosixWorkspacePath } from "../../src/config/pubsubChannels.js";
 import { isMarkdownPath } from "../utils/files/markdown-store.js";
 import { isHtmlPath } from "../utils/files/html-store.js";
@@ -48,8 +48,3 @@ export function initFileChangePublisher(instance: IPubSub): void {
     warn: (message, data) => log.warn("file-change", message, data),
   });
 }
-
-/** Test-only — clear the module singleton so each test starts clean. */
-export function _resetFileChangePublisherForTesting(): void {
-  resetFileChangePublisher();
-}

package/server/events/pub-sub/index.ts

@@ -1,11 +1,19 @@
 import http from "http";
 import { Server as IOServer } from "socket.io";
 
+import { log } from "../../system/logger/index.js";
+
 export interface IPubSub {
   /** Publish data to all clients subscribed to this channel. */
   publish: (channel: string, data: unknown) => void;
 }
 
+const logRoomError =
+  (action: string, channel: string) =>
+  (err: unknown): void => {
+    log.warn("pubsub", `socket room ${action} failed`, { channel, error: String(err) });
+  };
+
 // Channel names are treated as socket.io rooms — one room per
 // channel. Subscribe/unsubscribe is plain `socket.join` /
 // `socket.leave`. Publish broadcasts to the room. Reconnect /
@@ -29,11 +37,16 @@ export function createPubSub(server: http.Server): IPubSub {
   });
 
   ioServer.on("connection", (socket) => {
+    // `join`/`leave` return `void | Promise<void>`: the in-memory adapter runs
+    // synchronously and returns undefined, while a clustered adapter goes over
+    // the wire. Nothing here depends on the result, but the promise branch
+    // still needs a terminal handler — a bare `void` would turn an adapter
+    // failure into an unhandled rejection. `Promise.resolve` normalises both.
     socket.on("subscribe", (channel: unknown) => {
-      if (typeof channel === "string") socket.join(channel);
+      if (typeof channel === "string") Promise.resolve(socket.join(channel)).catch(logRoomError("subscribe", channel));
     });
     socket.on("unsubscribe", (channel: unknown) => {
-      if (typeof channel === "string") socket.leave(channel);
+      if (typeof channel === "string") Promise.resolve(socket.leave(channel)).catch(logRoomError("unsubscribe", channel));
     });
   });
 

package/server/events/relay-client.ts

@@ -277,7 +277,12 @@ function attachSocketHandlers(socket: WebSocket, deps: AttachSocketHandlersDeps)
   });
 
   socket.on("message", (data) => {
-    handleRelayMessage(String(data), { relay, logger, sendResponse: queue.send });
+    // One bad message must not take the socket down: `handleRelayMessage`
+    // already logs the failures it anticipates, so anything reaching here is
+    // unexpected and only needs to be recorded, not propagated.
+    void handleRelayMessage(String(data), { relay, logger, sendResponse: queue.send }).catch((err: unknown) => {
+      logger.error(LOG_PREFIX, "relay message handler threw", { error: String(err) });
+    });
   });
 
   socket.on("close", (code, reason) => {

package/server/events/session-store/index.ts

@@ -183,7 +183,10 @@ export function endRun(chatSessionId: string): void {
   session.statusMessage = "";
   session.abortRun = undefined;
   session.updatedAt = new Date().toISOString();
-  persistHasUnread(chatSessionId, true);
+  // Same fire-and-forget contract as the other unread writes: the in-memory
+  // flag above is what the UI reads, so a failed persist must not break the
+  // finish path.
+  persistHasUnread(chatSessionId, true).catch(() => {});
   publishToSessionChannel(chatSessionId, {
     type: EVENT_TYPES.sessionFinished,
   });
@@ -264,7 +267,13 @@ export function pushSessionEvent(chatSessionId: string, event: Record<string, un
   // notify.
   persistHasUnread(chatSessionId, true)
     .catch(() => {})
-    .then(() => notifySessionsChanged());
+    .then(() => notifySessionsChanged())
+    // Terminal handler: the `.catch` above only covers the persist, so a throw
+    // out of `notifySessionsChanged` would still escape. Same trade as the
+    // agent route (see its BEHAVIOUR NOTE) — this used to bounce the whole
+    // server through the process-level `unhandledRejection` handler; now an
+    // unread-badge glitch stays a glitch. Rethrow here to go back to fail-fast.
+    .catch((err: unknown) => log.warn("session-store", "unread notify failed", { error: String(err) }));
 }
 
 /**

package/server/index.ts

@@ -75,6 +75,10 @@ import { readSessionJsonl, readSessionMeta } from "./utils/files/session-io.js";
 import { resolveBridgeSessionRole } from "./api/bridge/sessionRole.js";
 import { onSessionEvent, initSessionStore } from "./events/session-store/index.js";
 import { initFileChangePublisher } from "./events/file-change.js";
+// Importing also binds the shared mulmoScript server ops to this host's
+// backend and registers the built-in "mulmoScript" dispatch handler (side
+// effect at module load — plans/feat-mulmoscript-plugin.md phase 3).
+import { initMulmoScriptGenerationPublisher } from "./plugins/mulmoscript-server.js";
 import { initCollectionChangePublisher } from "./events/collection-change.js";
 import { getRole, loadAllRoles } from "./workspace/roles.js";
 import { discoverSkills } from "./workspace/skills/index.js";
@@ -93,13 +97,13 @@ import { migrateCookingRecipesFromPlugin } from "./workspace/cooking-recipes/mig
 import { env, isAblated, isGeminiAvailable } from "./system/env.js";
 import { buildSandboxStatus } from "./api/sandboxStatus.js";
 import { existsSync, readFileSync } from "fs";
-import { realpath as fsRealpath } from "fs/promises";
-import { containsDotfileSegment, resolveWithinRoot } from "./utils/files/safe.js";
+import { makeCachedRealpath, resolveArtifactRequestPath } from "./utils/files/safe.js";
 import { cpus, loadavg } from "os";
 import { isDockerAvailable, ensureSandboxImage } from "./system/docker.js";
 import { maybeRunJournal } from "./workspace/journal/index.js";
 import { backfillAllSessions } from "./workspace/chat-index/index.js";
 import { feedRefreshTaskDef } from "@mulmoclaude/core/feeds/server";
+import { googleCalendarSyncTaskDef } from "@mulmoclaude/core/google";
 import { configureFeeds } from "./workspace/feeds/configure.js";
 import { createPubSub } from "./events/pub-sub/index.js";
 import { PUBSUB_CHANNELS } from "../src/config/pubsubChannels.js";
@@ -351,17 +355,7 @@ app.use("/api", (req, res, next) => {
 //  3. `dotfiles: deny` + `fallthrough: false` on `express.static`
 //     itself, plus its built-in `..` normalize for path traversal.
 const IMAGE_EXT_RE = /\.(png|jpe?g|webp|gif|svg|mp4|webm|mov|m4v|ogv|mp3|ogg|oga|wav|m4a|aac)$/i;
-let imagesDirReal: string | null = null;
-async function getImagesDirReal(): Promise<string | null> {
-  if (imagesDirReal) return imagesDirReal;
-  try {
-    imagesDirReal = await fsRealpath(WORKSPACE_PATHS.images);
-    return imagesDirReal;
-  } catch {
-    // Dir not yet materialised (fresh workspace, no image saved).
-    return null;
-  }
-}
+const getImagesDirReal = makeCachedRealpath(WORKSPACE_PATHS.images);
 app.use(
   "/artifacts/images",
   async (req, res, next) => {
@@ -374,17 +368,9 @@ app.use(
       res.status(404).end();
       return;
     }
-    let relPath: string;
-    try {
-      // decodeURIComponent throws URIError on malformed escapes
-      // (`%ZZ`, stray `%`). Fail closed so a junk URL returns 404
-      // instead of bubbling a 500 out of the express error chain.
-      relPath = decodeURIComponent(req.path.replace(/^\//, ""));
-    } catch {
-      res.status(404).end();
-      return;
-    }
-    if (!resolveWithinRoot(root, relPath)) {
+    // No explicit dotfile check here: this mount never short-circuits,
+    // so `express.static`'s `dotfiles: "deny"` below is the authority.
+    if (resolveArtifactRequestPath(root, req.path, false) === null) {
       res.status(404).end();
       return;
     }
@@ -440,16 +426,7 @@ app.use(
 // eslint-disable-next-line sonarjs/regex-complexity -- flat extension allowlist with no nested quantifiers, ReDoS-safe; complexity is just the disjunction count
 const HTML_PREVIEW_EXT_RE = /\.(html?|png|jpe?g|webp|gif|svg|ico|mp4|webm|mov|m4v|ogv|mp3|ogg|oga|wav|m4a|aac)$/i;
 const HTML_DOCUMENT_EXT_RE = /\.html?$/i;
-let htmlsDirReal: string | null = null;
-async function getHtmlsDirReal(): Promise<string | null> {
-  if (htmlsDirReal) return htmlsDirReal;
-  try {
-    htmlsDirReal = await fsRealpath(WORKSPACE_PATHS.htmls);
-    return htmlsDirReal;
-  } catch {
-    return null;
-  }
-}
+const getHtmlsDirReal = makeCachedRealpath(WORKSPACE_PATHS.htmls);
 
 // Honour `X-Forwarded-*` so dev (Vite proxies `/artifacts/html` →
 // `localhost:3001` with `changeOrigin: true`) emits the browser-
@@ -488,26 +465,13 @@ app.use(
       res.status(404).end();
       return;
     }
-    let relPath: string;
-    try {
-      relPath = decodeURIComponent(req.path.replace(/^\//, ""));
-    } catch {
-      res.status(404).end();
-      return;
-    }
-    if (!resolveWithinRoot(root, relPath)) {
-      res.status(404).end();
-      return;
-    }
-    // Dotfile deny — `express.static` below enforces this for the
-    // non-HTML branch via `dotfiles: "deny"`, but the HTML short-
-    // circuit added in #1056 was bypassing the guard and would
-    // happily serve `/artifacts/html/.hidden.html` (Codex review on
-    // #1056). Apply the same policy uniformly so both branches
-    // refuse any path component starting with `.`. The helper
-    // splits on both `/` and `\` so an encoded backslash (`%5C`)
-    // can't sneak a `dir\.hidden.html` past the check on Windows.
-    if (containsDotfileSegment(relPath)) {
+    // denyDotfiles: the HTML short-circuit below serves the file itself
+    // (bypassing `express.static`'s `dotfiles: "deny"`), so this mount
+    // must reject dotfile segments in the guard — without it,
+    // `/artifacts/html/.hidden.html` would be served (Codex review on
+    // #1056).
+    const relPath = resolveArtifactRequestPath(root, req.path, true);
+    if (relPath === null) {
       res.status(404).end();
       return;
     }
@@ -560,16 +524,7 @@ const SVG_RESPONSE_CSP = "default-src 'none'; style-src 'unsafe-inline'; img-src
 // `<img src>` request can't carry an Authorization header. Loopback-
 // only listener + `requireSameOrigin` remain the trust boundary.
 const SVG_EXT_RE = /\.svg$/i;
-let svgsDirReal: string | null = null;
-async function getSvgsDirReal(): Promise<string | null> {
-  if (svgsDirReal) return svgsDirReal;
-  try {
-    svgsDirReal = await fsRealpath(WORKSPACE_PATHS.svgs);
-    return svgsDirReal;
-  } catch {
-    return null;
-  }
-}
+const getSvgsDirReal = makeCachedRealpath(WORKSPACE_PATHS.svgs);
 app.use(
   "/artifacts/svg",
   async (req, res, next) => {
@@ -582,18 +537,10 @@ app.use(
       res.status(404).end();
       return;
     }
-    let relPath: string;
-    try {
-      relPath = decodeURIComponent(req.path.replace(/^\//, ""));
-    } catch {
-      res.status(404).end();
-      return;
-    }
-    if (!resolveWithinRoot(root, relPath)) {
-      res.status(404).end();
-      return;
-    }
-    if (containsDotfileSegment(relPath)) {
+    // denyDotfiles for the same reason as the html mount: this handler
+    // sets headers and serves via a bearer-bypassed <img> path, so the
+    // dotfile guard can't be left solely to `express.static`.
+    if (resolveArtifactRequestPath(root, req.path, true) === null) {
       res.status(404).end();
       return;
     }
@@ -1125,6 +1072,9 @@ function initEventPublishers(pubsub: IPubSub): void {
   // near the route mount; only the pub/sub instance is wired here.
   initAccountingEventPublisher(pubsub);
   initCollectionChangePublisher(pubsub);
+  // MulmoScript generation events → plugin pubsub channel (the extracted
+  // presentMulmoScript View's spinner/reload signal).
+  initMulmoScriptGenerationPublisher(pubsub);
 }
 
 // System task defs + user-configurable schedule overrides. Split out
@@ -1166,6 +1116,7 @@ function buildSystemTaskDefs(): SystemTaskDef[] {
     // factory so the id/schedule/run can't drift across hosts. The override
     // loop below still mutates `task.schedule` host-side.
     feedRefreshTaskDef(),
+    googleCalendarSyncTaskDef(),
   ];
 
   // Apply user-configurable schedule overrides from
@@ -1353,7 +1304,12 @@ process.on("SIGTERM", () => {
   // `http://<laptop-ip>:3001/api/*`), which combined with the
   // workspace file API is a credential-theft risk. Personal dev
   // tool — localhost is the right default.
-  const httpServer = app.listen(port, "127.0.0.1", async () => {
+  // Express discards whatever the listen callback returns, so an async callback
+  // would leave a throw in it as an unhandled rejection. The callback below
+  // stays synchronous and hands the async setup off here. The server arrives as
+  // a parameter rather than a closure variable — `httpServer` is this call's
+  // own result and isn't defined yet at this point.
+  const onListening = async (httpServer: ReturnType<typeof app.listen>): Promise<void> => {
     // Initialize the notifier engine synchronously, before any await
     // in this callback. The HTTP listener is already accepting
     // connections by the time this callback fires, so any awaited
@@ -1410,8 +1366,25 @@ process.on("SIGTERM", () => {
       httpServer.close(() => process.exit(1));
       setTimeout(() => process.exit(1), STARTUP_FAILURE_FORCE_EXIT_MS).unref();
     });
+  };
+
+  const httpServer = app.listen(port, "127.0.0.1", () => {
+    // Terminal handler, not a bare `void`: `onListening` runs the whole
+    // post-listen setup, and a rejection outside its own
+    // `startRuntimeServices(...).catch(...)` branch would otherwise be an
+    // unhandled rejection on a half-initialised server.
+    onListening(httpServer).catch((err: unknown) => {
+      log.error("server", "post-listen initialization failed — exiting", { error: String(err) });
+      process.exit(1);
+    });
   });
-})();
+})().catch((err: unknown) => {
+  // Anything thrown before the listener is up (port resolution, token write)
+  // lands here. Without this the failure surfaced only as an unhandled
+  // rejection — no log line, and the exit code depended on the Node version.
+  log.error("server", "server startup failed — exiting", { error: String(err) });
+  process.exit(1);
+});
 
 function registerDebugTasks(taskManager: ITaskManager, pubsub: IPubSub) {
   let tick = 0;

package/server/plugins/diagnostics.ts

@@ -123,12 +123,6 @@ export function collectPluginMetaDiagnostics(): readonly PluginMetaDiagnostic[]
   return cachedDiagnostics;
 }
 
-/** Reset the cache. Test-only — production code calls
- *  `collectPluginMetaDiagnostics()` once at boot. */
-export function resetPluginMetaDiagnosticsCacheForTest(): void {
-  cachedDiagnostics = null;
-}
-
 /** Run at server boot after the notifier engine is initialized.
  *  Logs every diagnostic via `log.warn` and publishes one notification
  *  per item so the bell shows them. Dedupes against the engine's

package/server/plugins/mulmoscript-server.ts

@@ -0,0 +1,58 @@
+// MulmoClaude's binding of the shared mulmoScript server ops (phase 3 of
+// plans/feat-mulmoscript-plugin.md). The mulmocast orchestration, realpath
+// containment, dispatch routing, and generation tracking all live in
+// @mulmoclaude/mulmoscript-plugin/server; this module supplies the
+// host-specific backend — stories location, artifacts FileOps, hardened
+// atomic writes, the ffmpeg probe, the logger, and the generation fan-out
+// (session `pendingGenerations` channel + plugin pubsub) — and registers
+// the built-in "mulmoScript" dispatch handler. Imported for side effect at
+// boot (server/index.ts); the REST routes in api/routes/mulmo-script.ts
+// consume the same instance.
+
+import path from "path";
+import { createMulmoScriptServerOps, createMulmoScriptDispatchHandler, GENERATION_EVENT } from "@mulmoclaude/mulmoscript-plugin/server";
+import { WORKSPACE_PATHS } from "../workspace/paths.js";
+import { writeFileAtomic } from "../utils/files/atomic.js";
+import { depStatus } from "../system/optionalDeps.js";
+import { log } from "../system/logger/index.js";
+import { publishGeneration } from "../events/session-store/index.js";
+import type { IPubSub } from "../events/pub-sub/index.js";
+import { makeArtifactsFileOps, pluginChannelName } from "./runtime.js";
+import { registerBuiltinDispatch } from "./builtin-dispatch.js";
+
+/** Scope name — matches `wrapWithScope("mulmoScript", …)` in
+ *  `src/plugins/presentMulmoScript/index.ts`, which is what the View's
+ *  `useRuntime().dispatch` / `pubsub` use as the plugin namespace. */
+const MULMOSCRIPT_SCOPE = "mulmoScript";
+
+let pubsubInstance: IPubSub | null = null;
+
+export const mulmoScriptOps = createMulmoScriptServerOps({
+  storiesDir: path.resolve(WORKSPACE_PATHS.stories),
+  artifacts: makeArtifactsFileOps(),
+  writeFileAtomic: async (absolutePath, data) => {
+    await writeFileAtomic(absolutePath, typeof data === "string" ? data : Buffer.from(data.buffer, data.byteOffset, data.byteLength));
+  },
+  isFfmpegAvailable: () => depStatus("ffmpeg")?.available,
+  // Edge-triggered by the package's tracker: fan each transition out to
+  // the per-session pendingGenerations channel (sidebar indicator;
+  // no-ops without a session) AND the plugin pubsub channel the
+  // extracted View subscribes to for spinners + reload-on-finish.
+  onGenerationEvent: (chatSessionId, event) => {
+    publishGeneration(chatSessionId, event.kind, event.filePath, event.key, event.done, event.error);
+    pubsubInstance?.publish(pluginChannelName(MULMOSCRIPT_SCOPE, GENERATION_EVENT), event);
+  },
+  log: {
+    info: (message, data) => log.info("mulmo-script", message, data),
+    warn: (message, data) => log.warn("mulmo-script", message, data),
+    error: (message, data) => log.error("mulmo-script", message, data),
+  },
+});
+
+registerBuiltinDispatch(MULMOSCRIPT_SCOPE, createMulmoScriptDispatchHandler(mulmoScriptOps));
+
+/** Wired at boot (initEventPublishers) — publishes before this are
+ *  session-only. */
+export function initMulmoScriptGenerationPublisher(instance: IPubSub): void {
+  pubsubInstance = instance;
+}

package/server/prompts/system/system.md

@@ -19,7 +19,6 @@ All data lives in the workspace directory as plain files:
 - `conversations/chat/` — chat session history (one .jsonl per session)
 - `conversations/memory/` — distilled user facts as topic files (`<type>/<topic>.md`); see the Memory section below for the index and read rules.
 - `conversations/summaries/` — journal output (daily / topics / archive)
-- `data/calendar/` — calendar events
 - `data/contacts/` — address book entries
 - `data/wiki/` — personal knowledge wiki (index.md, pages/, sources/, log.md)
 - `data/scheduler/` — scheduled tasks
@@ -42,11 +41,11 @@ Raw HTML tags work inside `.md` files too — use them when markdown's `![]()` c
 
 ## Attached file marker
 
-When a user message starts with one or more lines of the form
+When a user message carries one or more lines of the form
 
 `[Attached file: <workspace-relative-path>]`
 
-the user has attached / pasted / dropped a file (or selected one in the UI) for this turn. **Each line is one file** — when the user attaches multiple files in the same turn, you will see multiple consecutive marker lines, in declaration order, before the user's actual message text. Every path always points at a real workspace file:
+the user has attached / pasted / dropped a file (or selected one in the UI) for this turn. **Each line is one file** — when the user attaches multiple files in the same turn, you will see multiple consecutive marker lines, in declaration order. They usually sit before the user's actual message text, but on a slash-command turn they follow it (so the leading `/` stays at the very start for command resolution). Every path always points at a real workspace file:
 
 - `data/attachments/YYYY/MM/<id>.<ext>` — paste/drop/file-picker uploads. The extension reflects the actual format (`.png`, `.pdf`, `.docx`, `.xlsx`, `.txt`, etc.). PPTX uploads are converted server-side and the path you receive is the resulting `.pdf`; the original `.pptx` lives next to it under the same `<id>` if you ever need to inspect it.
 - `artifacts/images/YYYY/MM/<id>.png` — a generated / canvas / edited image the user selected from the sidebar.

package/server/remoteHost/handlers/getCollection.ts

@@ -7,13 +7,14 @@
 //
 // Factory (createGetCollection) keeps the mapping unit-testable with the engine
 // stubbed; the default export wires the real engine functions.
-import { listItems, loadCollection, toDetail } from "../../workspace/collections/index.js";
+import { loadCollection, storeFor, toDetail, type CollectionItem, type LoadedCollection } from "../../workspace/collections/index.js";
 import type { CommandHandler, JsonObject } from "../commandChannel.js";
 import { clampLimit, clampOffset, deriveItems, pageResult } from "./collectionPage.js";
 
 export interface GetCollectionDeps {
   loadCollection: typeof loadCollection;
-  listItems: typeof listItems;
+  /** Store-aware records loader (file records or a dataSource CSV's rows). */
+  listRecords: (collection: LoadedCollection) => Promise<CollectionItem[]>;
   toDetail: typeof toDetail;
 }
 
@@ -25,8 +26,8 @@ export const createGetCollection =
     const limit = clampLimit(params.limit);
     const collection = await deps.loadCollection(slug);
     if (!collection) throw new Error(`collection '${slug}' not found`);
-    const all = deriveItems(collection.schema, await deps.listItems(collection.dataDir));
+    const all = deriveItems(collection.schema, await deps.listRecords(collection));
     return pageResult(deps.toDetail(collection), all, offset, limit);
   };
 
-export const getCollection = createGetCollection({ loadCollection, listItems, toDetail });
+export const getCollection = createGetCollection({ loadCollection, listRecords: (collection) => storeFor(collection).list(), toDetail });

package/server/remoteHost/handlers/getFeed.ts

@@ -2,19 +2,19 @@
 //
 // Returns one feed's detail + a PAGE of its records. A feed IS a
 // LoadedCollection with an `ingest` block, so this reuses the exact collection
-// page path (listItems + toDetail + collectionPage) and returns the SAME shape
+// page path (storeFor + toDetail + collectionPage) and returns the SAME shape
 // as getCollection — the remote renders feed records with the same card view.
 // The feed is located via the feed registry (listFeeds), since feeds live under
 // their own registry rather than the collections dir.
 import { listFeeds as listFeedsRegistry } from "@mulmoclaude/core/feeds/server";
-import { listItems, toDetail } from "../../workspace/collections/index.js";
+import { storeFor, toDetail, type LoadedCollection, type CollectionItem } from "../../workspace/collections/index.js";
 import { workspacePath } from "../../workspace/workspace.js";
 import type { CommandHandler, JsonObject } from "../commandChannel.js";
 import { clampLimit, clampOffset, deriveItems, pageResult } from "./collectionPage.js";
 
 export interface GetFeedDeps {
   listFeeds: typeof listFeedsRegistry;
-  listItems: typeof listItems;
+  listRecords: (collection: LoadedCollection) => Promise<CollectionItem[]>;
   toDetail: typeof toDetail;
   workspaceRoot: string;
 }
@@ -28,8 +28,13 @@ export const createGetFeed =
     const feeds = await deps.listFeeds(deps.workspaceRoot);
     const feed = feeds.find((entry) => entry.slug === slug);
     if (!feed) throw new Error(`feed '${slug}' not found`);
-    const all = deriveItems(feed.schema, await deps.listItems(feed.dataDir));
+    const all = deriveItems(feed.schema, await deps.listRecords(feed));
     return pageResult(deps.toDetail(feed), all, offset, limit);
   };
 
-export const getFeed = createGetFeed({ listFeeds: listFeedsRegistry, listItems, toDetail, workspaceRoot: workspacePath });
+export const getFeed = createGetFeed({
+  listFeeds: listFeedsRegistry,
+  listRecords: (collection) => storeFor(collection).list(),
+  toDetail,
+  workspaceRoot: workspacePath,
+});