mulmoclaude 1.3.0 → 1.4.0

package/server/api/routes/collections.ts

@@ -19,7 +19,6 @@ import {
   deleteCollection,
   deleteCollectionRefusalMessage,
   deleteCustomView,
-  deleteItem,
   loadCollection,
   readSkillTemplate,
   readCustomViewHtml,
@@ -27,6 +26,7 @@ import {
   readOnlyRefusal,
   buildActionSeedPrompt,
   buildCollectionActionSeedPrompt,
+  buildWorkspaceOntology,
   promptPathsFor,
   resolveCreateItemId,
   storeFor,
@@ -34,13 +34,13 @@ import {
   toSummary,
   applyMutateAction,
   validateCollectionRecords,
-  writeItem,
 } from "../../workspace/collections/index.js";
 import type {
   CollectionMutateAction,
   CollectionSeededAction,
   CollectionDetail,
   CollectionItem,
+  CollectionOntologyEntry,
   CollectionSummary,
   DeleteViewResult,
   LoadedCollection,
@@ -57,7 +57,8 @@ import {
   type RemoteViewBuildResult,
   type RemoteViewItemsResult,
 } from "../../workspace/collections/remoteView.js";
-import { clampLimit, clampOffset, normalizeFields, normalizeMutate } from "@mulmoclaude/core/remote-view";
+import { clampImageMaxEdge, clampLimit, clampOffset, normalizeFields, normalizeMutate } from "@mulmoclaude/core/remote-view";
+import { resolveThumbnail } from "../../utils/files/thumbnail-store.js";
 import { badRequest, notFound, conflict, forbidden, methodNotAllowed, serverError, serviceUnavailable } from "../../utils/httpError.js";
 import { ONE_MINUTE_MS } from "../../utils/time.js";
 import { errorMessage } from "../../utils/errors.js";
@@ -102,6 +103,10 @@ interface CollectionsListResponse {
   collections: CollectionSummary[];
 }
 
+interface CollectionOntologyResponse {
+  entries: CollectionOntologyEntry[];
+}
+
 interface CollectionDetailResponse {
   collection: CollectionDetail;
   items: CollectionItem[];
@@ -184,6 +189,19 @@ router.get(API_ROUTES.collections.list, async (_req: Request, res: Response<Coll
   }
 });
 
+// Raw workspace-ontology entries (buildWorkspaceOntology — derived on
+// demand, never stored); the /collections Map tab builds its graph from
+// these with the shared `buildOntologyGraph`. Registered before the
+// `:slug` routes so "ontology" is never swallowed as a slug.
+router.get(API_ROUTES.collections.ontology, async (_req: Request, res: Response<CollectionOntologyResponse>) => {
+  try {
+    res.json({ entries: await buildWorkspaceOntology() });
+  } catch (err) {
+    log.warn("collections", "ontology failed", { error: errorMessage(err) });
+    serverError(res, errorMessage(err));
+  }
+});
+
 router.get(API_ROUTES.collections.detail, async (req: Request<{ slug: string }>, res: Response<CollectionDetailResponse>) => {
   const collection = await loadCollectionOr404(req.params.slug, res);
   if (!collection) return;
@@ -243,7 +261,8 @@ function extractRecord(body: unknown): CollectionItem | null {
 router.post(API_ROUTES.collections.items, async (req: Request<{ slug: string }>, res: Response<ItemMutationResponse>) => {
   const collection = await loadCollectionOr404(req.params.slug, res);
   if (!collection) return;
-  if (!collectionWritable(collection)) {
+  const createStore = storeFor(collection).write;
+  if (!createStore) {
     methodNotAllowed(res, readOnlyRefusal(collection.slug));
     return;
   }
@@ -262,7 +281,7 @@ router.post(API_ROUTES.collections.items, async (req: Request<{ slug: string }>,
   const itemId = resolveCreateItemId(collection.schema, record) ?? generateItemId();
   const recordWithId: CollectionItem = { ...record, [collection.schema.primaryKey]: itemId };
   try {
-    const result = await writeItem(collection.dataDir, itemId, recordWithId, { refuseOverwrite: true, slug: collection.slug });
+    const result = await createStore(itemId, recordWithId, { refuseOverwrite: true });
     if (result.kind === "invalid-id") {
       badRequest(res, `invalid item id: ${result.itemId}`);
       return;
@@ -286,7 +305,8 @@ router.post(API_ROUTES.collections.items, async (req: Request<{ slug: string }>,
 router.put(API_ROUTES.collections.item, async (req: Request<{ slug: string; itemId: string }>, res: Response<ItemMutationResponse>) => {
   const collection = await loadCollectionOr404(req.params.slug, res);
   if (!collection) return;
-  if (!collectionWritable(collection)) {
+  const updateStore = storeFor(collection).write;
+  if (!updateStore) {
     methodNotAllowed(res, readOnlyRefusal(collection.slug));
     return;
   }
@@ -307,7 +327,7 @@ router.put(API_ROUTES.collections.item, async (req: Request<{ slug: string; item
   // record id never drift.
   const recordWithId: CollectionItem = { ...record, [primaryKey]: req.params.itemId };
   try {
-    const result = await writeItem(collection.dataDir, req.params.itemId, recordWithId, { slug: collection.slug });
+    const result = await updateStore(req.params.itemId, recordWithId);
     if (result.kind === "invalid-id") {
       badRequest(res, `invalid item id: ${result.itemId}`);
       return;
@@ -333,12 +353,13 @@ router.put(API_ROUTES.collections.item, async (req: Request<{ slug: string; item
 router.delete(API_ROUTES.collections.item, async (req: Request<{ slug: string; itemId: string }>, res: Response<DeleteResponse>) => {
   const collection = await loadCollectionOr404(req.params.slug, res);
   if (!collection) return;
-  if (!collectionWritable(collection)) {
+  const deleteStore = storeFor(collection).delete;
+  if (!deleteStore) {
     methodNotAllowed(res, readOnlyRefusal(collection.slug));
     return;
   }
   try {
-    const result = await deleteItem(collection.dataDir, req.params.itemId, { slug: collection.slug });
+    const result = await deleteStore(req.params.itemId);
     if (result.kind === "invalid-id") {
       badRequest(res, `invalid item id: ${result.itemId}`);
       return;
@@ -589,6 +610,20 @@ function sendToolResult(res: Response, raw: string): void {
   }
 }
 
+// ── View-data routes: a FROZEN public contract ──────────────────────────────
+// Everything under `viewData*` below is called by LLM-authored custom-view
+// HTML files persisted in users' workspaces (`data/skills/*/views/*.html`,
+// `feeds/*/views/*.html`), written against the contract in
+// `packages/core/assets/helps/custom-view.md`. Those files cannot be
+// re-generated or migrated centrally, so this surface must stay
+// backward-compatible indefinitely: keep `?fields=` / `?ids=` semantics, the
+// `{ collection, count, items }` / `{ written, rejected }` / `{ rows }`
+// response shapes, and the status-code semantics (400 with `{ error }`,
+// 403 mutate-kind, 409 require-gate) stable. Evolve by ADDITION only —
+// new optional params, new routes — never by renaming or reshaping.
+// Storage virtualization (new `CollectionStore` backends — see
+// `@mulmoclaude/core` collection/server/store.ts) must be invisible here.
+//
 // The view-data fetch comes from a sandboxed (opaque-origin) iframe, so it is
 // a cross-origin request that the browser gates with CORS. `*` is safe here:
 // auth is the unguessable scoped token in the Authorization header (not a
@@ -637,6 +672,12 @@ export function makeViewActionRateLimiter(max: number, windowMs: number, now: ()
 
 const VIEW_ACTION_RATE_LIMIT_PER_MINUTE = 60;
 const viewActionRateLimit = makeViewActionRateLimiter(VIEW_ACTION_RATE_LIMIT_PER_MINUTE, ONE_MINUTE_MS);
+// Image thumbnails get their own, roomier bucket: a gallery legitimately
+// fetches dozens of images on first paint, so the action budget (60/min)
+// would starve it — while the endpoint still needs a ceiling (each request
+// is a record scan + a thumbnail decode).
+const VIEW_IMAGE_RATE_LIMIT_PER_MINUTE = 300;
+const viewImageRateLimit = makeViewActionRateLimiter(VIEW_IMAGE_RATE_LIMIT_PER_MINUTE, ONE_MINUTE_MS);
 
 router.options(API_ROUTES.collections.viewData, viewDataCors, (_req: Request, res: Response) => {
   res.status(204).end();
@@ -931,6 +972,83 @@ router.post(
   },
 );
 
+/** True when `relPath` is a CURRENT value of one of the schema's
+ *  `image`-type fields (top-level fields only, matching the remote view's
+ *  `inlineFields` rule) across `items`. This is the authorization rule for
+ *  the view-data image route: a scoped view token may resolve exactly these
+ *  paths and nothing else — never an arbitrary workspace file. Early-exit
+ *  scan (no per-request Set allocation). Exported for the unit test. */
+export function isAuthorizedImagePath(schema: LoadedCollection["schema"], items: CollectionItem[], relPath: string): boolean {
+  const imageFields = Object.entries(schema.fields)
+    .filter(([, spec]) => spec.type === "image")
+    .map(([name]) => name);
+  if (imageFields.length === 0 || relPath.length === 0) return false;
+  return items.some((item) => imageFields.some((field) => item[field] === relPath));
+}
+
+export interface ViewDataImageDeps {
+  loadCollection: (slug: string) => Promise<LoadedCollection | null>;
+  listRecords: (collection: LoadedCollection) => Promise<CollectionItem[]>;
+  resolveThumbnail: typeof resolveThumbnail;
+}
+
+/** The image-route handler behind a deps seam so its contract (400 missing
+ *  path / 404 unknown collection / 404 unauthorized path / 404 unresolvable
+ *  / clamped `maxEdge` plumbing / 500 on a thrown resolver) is
+ *  unit-testable without mounting the express app — same factory pattern as
+ *  the remote-view handlers. */
+export const createViewDataImageHandler =
+  (deps: ViewDataImageDeps) =>
+  async (req: Request<{ slug: string }>, res: Response): Promise<void> => {
+    const collection = await deps.loadCollection(req.params.slug);
+    if (!collection) {
+      notFound(res, `collection '${req.params.slug}' not found`);
+      return;
+    }
+    const relPath = typeof req.query.path === "string" ? req.query.path : "";
+    if (relPath.length === 0) {
+      badRequest(res, "pass `path` — an image field's workspace-relative value");
+      return;
+    }
+    try {
+      const items = await deps.listRecords(collection);
+      if (!isAuthorizedImagePath(collection.schema, items, relPath)) {
+        notFound(res, "path is not a current value of this collection's image fields");
+        return;
+      }
+      const dataUrl = await deps.resolveThumbnail(relPath, clampImageMaxEdge(req.query.maxEdge));
+      if (dataUrl === null) {
+        notFound(res, "image could not be resolved");
+        return;
+      }
+      res.json({ path: relPath, dataUrl });
+    } catch (err) {
+      log.warn("collections", "view-data image failed", { slug: collection.slug, error: errorMessage(err) });
+      serverError(res, "image resolve failed");
+    }
+  };
+
+router.options(API_ROUTES.collections.viewDataImage, viewDataCors, (_req: Request, res: Response) => {
+  res.status(204).end();
+});
+
+// Scoped image read: resolve one record-referenced image path into a
+// downscaled `data:` thumbnail (same resolver + clamps as the remote view's
+// `imageFields` inlining). The record scan doubles as the authorization
+// check — the requested path must be a CURRENT image-field value — and runs
+// under the same in-flight cap as /query (both are per-request full scans).
+// Sandboxed views can't attach the bearer to an <img>, so the JSON
+// { dataUrl } shape (fetch → img.src) is the contract; see
+// packages/core/assets/helps/custom-view.md "Displaying images".
+router.get(
+  API_ROUTES.collections.viewDataImage,
+  viewDataCors,
+  viewImageRateLimit,
+  viewQueryConcurrency,
+  requireViewToken("read"),
+  createViewDataImageHandler({ loadCollection, listRecords: (collection) => storeFor(collection).list(), resolveThumbnail }),
+);
+
 // Scoped write: validated putItems. Requires the `write` capability.
 router.put(API_ROUTES.collections.viewData, viewDataCors, requireViewToken("write"), async (req: Request<{ slug: string }>, res: Response) => {
   try {

package/server/build/dispatcher.mjs

@@ -126,7 +126,7 @@ async function handleConfigRefresh(payload) {
   await safePost(req);
 }
 
-// packages/core/dist/collection/paths.js
+// packages/core/dist/templatePath-k_WNbL_Q.js
 var TEMPLATES_PREFIX = "templates/";
 function isSafeTemplatePath(value) {
   if (value.length === 0 || value.includes("\\") || value.startsWith("/")) return false;
@@ -201,7 +201,7 @@ function mirrorSkillDelete(workspaceRoot2, slug) {
   return { dest };
 }
 
-// server/utils/errors.ts
+// packages/core/dist/errors-eid6Mes3.js
 function errorMessage(err, fallback) {
   if (err instanceof Error) return err.message;
   if (err !== null && typeof err === "object") {

package/server/events/collection-change.ts

@@ -24,6 +24,7 @@
 // package catches up, but the launcher boots. Matches the feature's
 // "optional everywhere" design (the View-side `subscribeChanges` is optional too).
 
+// eslint-disable-next-line no-restricted-imports -- namespace import is the feature-detect described above; only `setCollectionChangePublisher` is accessed, never the restricted raw io readers
 import * as collectionPlugin from "@mulmoclaude/core/collection/server";
 import type { CollectionChangePayload } from "@mulmoclaude/core/collection/server";
 import { collectionChannel, type CollectionChannelPayload } from "../../src/config/pubsubChannels.js";

package/server/events/pub-sub/index.ts

@@ -1,11 +1,19 @@
 import http from "http";
 import { Server as IOServer } from "socket.io";
 
+import { log } from "../../system/logger/index.js";
+
 export interface IPubSub {
   /** Publish data to all clients subscribed to this channel. */
   publish: (channel: string, data: unknown) => void;
 }
 
+const logRoomError =
+  (action: string, channel: string) =>
+  (err: unknown): void => {
+    log.warn("pubsub", `socket room ${action} failed`, { channel, error: String(err) });
+  };
+
 // Channel names are treated as socket.io rooms — one room per
 // channel. Subscribe/unsubscribe is plain `socket.join` /
 // `socket.leave`. Publish broadcasts to the room. Reconnect /
@@ -29,11 +37,16 @@ export function createPubSub(server: http.Server): IPubSub {
   });
 
   ioServer.on("connection", (socket) => {
+    // `join`/`leave` return `void | Promise<void>`: the in-memory adapter runs
+    // synchronously and returns undefined, while a clustered adapter goes over
+    // the wire. Nothing here depends on the result, but the promise branch
+    // still needs a terminal handler — a bare `void` would turn an adapter
+    // failure into an unhandled rejection. `Promise.resolve` normalises both.
     socket.on("subscribe", (channel: unknown) => {
-      if (typeof channel === "string") socket.join(channel);
+      if (typeof channel === "string") Promise.resolve(socket.join(channel)).catch(logRoomError("subscribe", channel));
     });
     socket.on("unsubscribe", (channel: unknown) => {
-      if (typeof channel === "string") socket.leave(channel);
+      if (typeof channel === "string") Promise.resolve(socket.leave(channel)).catch(logRoomError("unsubscribe", channel));
     });
   });
 

package/server/events/relay-client.ts

@@ -277,7 +277,12 @@ function attachSocketHandlers(socket: WebSocket, deps: AttachSocketHandlersDeps)
   });
 
   socket.on("message", (data) => {
-    handleRelayMessage(String(data), { relay, logger, sendResponse: queue.send });
+    // One bad message must not take the socket down: `handleRelayMessage`
+    // already logs the failures it anticipates, so anything reaching here is
+    // unexpected and only needs to be recorded, not propagated.
+    void handleRelayMessage(String(data), { relay, logger, sendResponse: queue.send }).catch((err: unknown) => {
+      logger.error(LOG_PREFIX, "relay message handler threw", { error: String(err) });
+    });
   });
 
   socket.on("close", (code, reason) => {

package/server/events/session-store/index.ts

@@ -183,7 +183,10 @@ export function endRun(chatSessionId: string): void {
   session.statusMessage = "";
   session.abortRun = undefined;
   session.updatedAt = new Date().toISOString();
-  persistHasUnread(chatSessionId, true);
+  // Same fire-and-forget contract as the other unread writes: the in-memory
+  // flag above is what the UI reads, so a failed persist must not break the
+  // finish path.
+  persistHasUnread(chatSessionId, true).catch(() => {});
   publishToSessionChannel(chatSessionId, {
     type: EVENT_TYPES.sessionFinished,
   });
@@ -264,7 +267,13 @@ export function pushSessionEvent(chatSessionId: string, event: Record<string, un
   // notify.
   persistHasUnread(chatSessionId, true)
     .catch(() => {})
-    .then(() => notifySessionsChanged());
+    .then(() => notifySessionsChanged())
+    // Terminal handler: the `.catch` above only covers the persist, so a throw
+    // out of `notifySessionsChanged` would still escape. Same trade as the
+    // agent route (see its BEHAVIOUR NOTE) — this used to bounce the whole
+    // server through the process-level `unhandledRejection` handler; now an
+    // unread-badge glitch stays a glitch. Rethrow here to go back to fail-fast.
+    .catch((err: unknown) => log.warn("session-store", "unread notify failed", { error: String(err) }));
 }
 
 /**

package/server/index.ts

@@ -103,6 +103,7 @@ import { isDockerAvailable, ensureSandboxImage } from "./system/docker.js";
 import { maybeRunJournal } from "./workspace/journal/index.js";
 import { backfillAllSessions } from "./workspace/chat-index/index.js";
 import { feedRefreshTaskDef } from "@mulmoclaude/core/feeds/server";
+import { googleCalendarSyncTaskDef } from "@mulmoclaude/core/google";
 import { configureFeeds } from "./workspace/feeds/configure.js";
 import { createPubSub } from "./events/pub-sub/index.js";
 import { PUBSUB_CHANNELS } from "../src/config/pubsubChannels.js";
@@ -1115,6 +1116,7 @@ function buildSystemTaskDefs(): SystemTaskDef[] {
     // factory so the id/schedule/run can't drift across hosts. The override
     // loop below still mutates `task.schedule` host-side.
     feedRefreshTaskDef(),
+    googleCalendarSyncTaskDef(),
   ];
 
   // Apply user-configurable schedule overrides from
@@ -1302,7 +1304,12 @@ process.on("SIGTERM", () => {
   // `http://<laptop-ip>:3001/api/*`), which combined with the
   // workspace file API is a credential-theft risk. Personal dev
   // tool — localhost is the right default.
-  const httpServer = app.listen(port, "127.0.0.1", async () => {
+  // Express discards whatever the listen callback returns, so an async callback
+  // would leave a throw in it as an unhandled rejection. The callback below
+  // stays synchronous and hands the async setup off here. The server arrives as
+  // a parameter rather than a closure variable — `httpServer` is this call's
+  // own result and isn't defined yet at this point.
+  const onListening = async (httpServer: ReturnType<typeof app.listen>): Promise<void> => {
     // Initialize the notifier engine synchronously, before any await
     // in this callback. The HTTP listener is already accepting
     // connections by the time this callback fires, so any awaited
@@ -1359,8 +1366,25 @@ process.on("SIGTERM", () => {
       httpServer.close(() => process.exit(1));
       setTimeout(() => process.exit(1), STARTUP_FAILURE_FORCE_EXIT_MS).unref();
     });
+  };
+
+  const httpServer = app.listen(port, "127.0.0.1", () => {
+    // Terminal handler, not a bare `void`: `onListening` runs the whole
+    // post-listen setup, and a rejection outside its own
+    // `startRuntimeServices(...).catch(...)` branch would otherwise be an
+    // unhandled rejection on a half-initialised server.
+    onListening(httpServer).catch((err: unknown) => {
+      log.error("server", "post-listen initialization failed — exiting", { error: String(err) });
+      process.exit(1);
+    });
   });
-})();
+})().catch((err: unknown) => {
+  // Anything thrown before the listener is up (port resolution, token write)
+  // lands here. Without this the failure surfaced only as an unhandled
+  // rejection — no log line, and the exit code depended on the Node version.
+  log.error("server", "server startup failed — exiting", { error: String(err) });
+  process.exit(1);
+});
 
 function registerDebugTasks(taskManager: ITaskManager, pubsub: IPubSub) {
   let tick = 0;

package/server/prompts/system/system.md

@@ -19,7 +19,6 @@ All data lives in the workspace directory as plain files:
 - `conversations/chat/` — chat session history (one .jsonl per session)
 - `conversations/memory/` — distilled user facts as topic files (`<type>/<topic>.md`); see the Memory section below for the index and read rules.
 - `conversations/summaries/` — journal output (daily / topics / archive)
-- `data/calendar/` — calendar events
 - `data/contacts/` — address book entries
 - `data/wiki/` — personal knowledge wiki (index.md, pages/, sources/, log.md)
 - `data/scheduler/` — scheduled tasks

package/server/remoteHost/handlers/getFeed.ts

@@ -2,19 +2,19 @@
 //
 // Returns one feed's detail + a PAGE of its records. A feed IS a
 // LoadedCollection with an `ingest` block, so this reuses the exact collection
-// page path (listItems + toDetail + collectionPage) and returns the SAME shape
+// page path (storeFor + toDetail + collectionPage) and returns the SAME shape
 // as getCollection — the remote renders feed records with the same card view.
 // The feed is located via the feed registry (listFeeds), since feeds live under
 // their own registry rather than the collections dir.
 import { listFeeds as listFeedsRegistry } from "@mulmoclaude/core/feeds/server";
-import { listItems, toDetail } from "../../workspace/collections/index.js";
+import { storeFor, toDetail, type LoadedCollection, type CollectionItem } from "../../workspace/collections/index.js";
 import { workspacePath } from "../../workspace/workspace.js";
 import type { CommandHandler, JsonObject } from "../commandChannel.js";
 import { clampLimit, clampOffset, deriveItems, pageResult } from "./collectionPage.js";
 
 export interface GetFeedDeps {
   listFeeds: typeof listFeedsRegistry;
-  listItems: typeof listItems;
+  listRecords: (collection: LoadedCollection) => Promise<CollectionItem[]>;
   toDetail: typeof toDetail;
   workspaceRoot: string;
 }
@@ -28,8 +28,13 @@ export const createGetFeed =
     const feeds = await deps.listFeeds(deps.workspaceRoot);
     const feed = feeds.find((entry) => entry.slug === slug);
     if (!feed) throw new Error(`feed '${slug}' not found`);
-    const all = deriveItems(feed.schema, await deps.listItems(feed.dataDir));
+    const all = deriveItems(feed.schema, await deps.listRecords(feed));
     return pageResult(deps.toDetail(feed), all, offset, limit);
   };
 
-export const getFeed = createGetFeed({ listFeeds: listFeedsRegistry, listItems, toDetail, workspaceRoot: workspacePath });
+export const getFeed = createGetFeed({
+  listFeeds: listFeedsRegistry,
+  listRecords: (collection) => storeFor(collection).list(),
+  toDetail,
+  workspaceRoot: workspacePath,
+});

package/server/services/translation/index.ts

@@ -88,9 +88,16 @@ export function createTranslationService(deps: TranslationServiceDeps): Translat
     const next = prev.catch(() => undefined).then(runner);
     const tracked = next.catch(() => undefined);
     chains.set(namespace, tracked);
-    tracked.then(() => {
-      if (chains.get(namespace) === tracked) chains.delete(namespace);
-    });
+    // Housekeeping only — the caller waits on `next`, not on this. Still needs
+    // a terminal handler: `tracked` swallowed the runner's rejection, but the
+    // cleanup callback itself is not covered by that. Silent by design: a
+    // failed map-entry cleanup is not worth a log line, and it used to reach
+    // the process-level `unhandledRejection` handler and exit the server.
+    tracked
+      .then(() => {
+        if (chains.get(namespace) === tracked) chains.delete(namespace);
+      })
+      .catch(() => {});
     return next;
   }
 

package/server/utils/errors.ts

@@ -2,24 +2,10 @@
 // `err instanceof Error ? err.message : String(err)` — searching for
 // one canonical helper is easier than grepping for the inline form.
 //
-// Non-Error objects with a `details` (gRPC convention) or `message`
-// string field have that field surfaced — without this, gRPC errors
-// like `{ code, details, metadata }` show up to users as
-// `[object Object]`.
-//
-// The optional `fallback` covers the common route-handler idiom where
-// a throw of a plain non-Error value should surface as a descriptive
-// message ("rebuild failed") rather than `String(err)` noise. Prefer
-// passing a fallback at error-response boundaries — omit it for
-// logging contexts where `String(err)` is fine.
-
-export function errorMessage(err: unknown, fallback?: string): string {
-  if (err instanceof Error) return err.message;
-  if (err !== null && typeof err === "object") {
-    const obj = err as { details?: unknown; message?: unknown };
-    if (typeof obj.details === "string" && obj.details) return obj.details;
-    if (typeof obj.message === "string" && obj.message) return obj.message;
-  }
-  if (fallback !== undefined) return fallback;
-  return String(err);
-}
+// The implementation lives in `@mulmoclaude/core/utils` so the host, the
+// collection engine, the scheduler and the Google engine can't drift apart
+// again: before #2217 this function existed 14 times across 4 behaviours, and
+// gRPC-shaped errors surfaced as "[object Object]" through half of them.
+// Re-exported (rather than repointing 92 files) so host code keeps reaching
+// for `server/utils/errors.js` by name.
+export { errorMessage } from "@mulmoclaude/core/utils";

package/server/utils/text.ts

@@ -1,29 +1,13 @@
 // Shared text helpers. Use these instead of re-implementing the
 // same operation per file (#1306).
 //
+// `truncate` lives in `@mulmoclaude/core/utils` so the host, the collection
+// engine and the Google engine share one implementation — the copies had
+// already drifted on the `ellipsis.length >= max` guard (#2217). Re-exported
+// (rather than repointing ~5 import sites) to keep `server/utils/text.ts` the
+// one place host code looks for general string helpers.
+//
 // Why not in `format/`: these are general string operations, not
 // presentation-layer formatters. Reserve `format/` for locale-aware
 // or unit-aware display helpers.
-
-/** Truncate `text` to at most `max` characters, appending `ellipsis`
- *  when the input is too long.
- *
- *  The ellipsis is part of the budget: `truncate("hello world", 8)`
- *  yields `"hello w…"` (7 chars of the original + the ellipsis = 8
- *  total). This avoids the off-by-one bug where naive
- *  `slice(0, max) + "…"` overshoots `max`.
- *
- *  Edge cases:
- *  - `text.length <= max` → return `text` unchanged.
- *  - `max <= 0` → return the empty string (callers asking for "no
- *    output" should get "no output", not a stray ellipsis).
- *  - If `ellipsis.length > max`, the ellipsis itself is truncated
- *    to fit `max` rather than throwing — keeps callers safe from
- *    surprising errors when they pick a tiny max with a multi-char
- *    ellipsis. */
-export function truncate(text: string, max: number, ellipsis = "…"): string {
-  if (max <= 0) return "";
-  if (text.length <= max) return text;
-  if (ellipsis.length >= max) return ellipsis.slice(0, max);
-  return text.slice(0, max - ellipsis.length) + ellipsis;
-}
+export { truncate } from "@mulmoclaude/core/utils";

package/server/workspace/collections/index.ts

@@ -14,11 +14,12 @@ export { enrichItems, computeCollectionIcon } from "@mulmoclaude/core/collection
 export { storeFor, collectionWritable, readOnlyRefusal, type CollectionStore } from "@mulmoclaude/core/collection/server";
 export { deleteCollection, deleteCollectionRefusalMessage, type DeleteCollectionResult } from "@mulmoclaude/core/collection/server";
 export { deleteCustomView, type DeleteViewResult } from "@mulmoclaude/core/collection/server";
+// NOTE (storage virtualization, plans/refactor-storage-virtualization.md):
+// the raw io functions (`listItems` / `readItem` / `writeItem` /
+// `deleteItem`) are deliberately NOT re-exported — host code reads AND
+// writes records only through `storeFor(...)` (write/delete exist only on
+// writable stores) so a future storage backend can't be bypassed.
 export {
-  listItems,
-  readItem,
-  writeItem,
-  deleteItem,
   safeRecordId,
   generateItemId,
   resolveCreateItemId,