MulmoClaude

Highlights

• Push to Google button (#2598, #2600) — a googleCalendar collection now gets a second header button next to Sync, so records created or edited locally can reach the calendar. Deliberately a separate button rather than making Sync bidirectional: which direction the data moved must never be ambiguous, and this direction writes to a calendar other people may be reading.

  The button reports what happened rather than just succeeding quietly. Setup problems (no linked Google account, a read-only calendar) and per-record skips arrive as fields on an HTTP 200, so pushProblems surfaces both in the banner — a push that rendered only its counts would show a setup failure as "0 created", sending the user to audit their records instead of their settings.

  Labels and result messages are translated across all eight locales.

📦 npm: @mulmoclaude/[email protected]

Requires @mulmoclaude/core@^1.7.0 for the push engine, and a host serving POST /api/collections/:slug/calendar-push.

What's Changed

• fix: polynomial ReDoS in the HTML attribute iterator (CodeQL #402) by @isamu in https://github.com/receptron/mulmoclaude/pull/2587
• perf(sessions): stop re-reading every session's meta on each list scan (#2588) by @isamu in https://github.com/receptron/mulmoclaude/pull/2589
• refactor: replace asyncHandler's Request/Response casts with structural bounds by @isamu in https://github.com/receptron/mulmoclaude/pull/2590
• fix: sanitise request-derived values reaching log.* (#2591) by @isamu in https://github.com/receptron/mulmoclaude/pull/2595
• refactor: replace 8 hand-rolled JsonObject casts in remoteHost handlers (#2592) by @isamu in https://github.com/receptron/mulmoclaude/pull/2596
• fix: forward next(err) from asyncHandler when headers are already sent (#2593) by @isamu in https://github.com/receptron/mulmoclaude/pull/2597
• chore(dev): make LAN exposure of the dev server opt-in by @isamu in https://github.com/receptron/mulmoclaude/pull/2599
• feat(calendar): Collection → Google Calendar push button (#2598) by @isamu in https://github.com/receptron/mulmoclaude/pull/2600
• fix: verify the loopback premise the CSRF guard was assuming by @isamu in https://github.com/receptron/mulmoclaude/pull/2601
• refactor: replace unvalidated as casts of external data with type guards (#2594) by @isamu in https://github.com/receptron/mulmoclaude/pull/2603

Full Changelog: https://github.com/receptron/mulmoclaude/compare/@mulmoclaude/[email protected]...@mulmoclaude/[email protected]