MulmoClaude

Highlights

First release since 1.0.0. This version graduates @mulmoclaude/common into the repo's canonical home for pure, zero-dependency, isomorphic utilities shared by the host, @mulmoclaude/core, the bridges, and the plugins. Every addition below replaced hand-copied implementations that had been drifting apart.

• @mulmoclaude/common/ssrf — the one SSRF deny-list (#2459). The CIDR deny-list, isBlockedIp / isBlockedIpv4 / isBlockedIpv6, isBlockedHostname, parseSafeUrlShape, and stripIpv6Brackets now live here. Previously the mastodon bridge and core's feeds HTTP client each carried their own table and had already drifted — the core copy was missing four ranges (192.0.0.0/24, 198.18.0.0/15, 224.0.0.0/4, 240.0.0.0/4) plus the hostname blocklist. The shared table is the union, so neither consumer lost coverage. Consumers keep only their own node:dns resolution / redirect re-check wrapper.

  Consolidating also surfaced two real bypasses that existed in both copies and are fixed here:

  • WHATWG URL serializes [::ffff:127.0.0.1] in hex (::ffff:7f00:1), so a dotted-quad-only regex let IPv4-mapped loopback through. Both notations are now parsed.
  • The old string-prefix IPv6 check under-blocked fe81::–febf:: (inside fe80::/10); the shared check is mask-based.

• errorMessage(err, fallback?) (#2400). The single implementation of "unwrap an unknown throwable into a string", including gRPC-style { details } and plain { message } objects. Because common is a browser-safe leaf, Vue and plugin surfaces can import it directly — the home @mulmoclaude/core/utils could not reach. Plugin-side copies in x-plugin and mulmoscript-plugin were folded onto it in #2461, and the spotify / html plugin copies in #2483.

• toUtcIsoDate(timestamp) (#2480). Date → YYYY-MM-DD in UTC. The host and x-plugin copies were byte-identical and now import this one. The @receptron/task-scheduler copy is deliberately kept for leaf-package independence and is documented as such.

• escapeHtml(value) (#2483). The shared five-character entity escaper, reachable from browser and server surfaces alike.

• scanEnvOptions(env, { prefixes, allowKeys? }) and snakeToLowerCamel(snake) (#2487). The one two-tier environment-variable scraper behind @mulmobridge/client's readBridgeEnvOptions and the host's resolveRelayBridgeOptions. The relay side's secret-exclusion allowlist (which keeps RELAY_TOKEN / RELAY_URL out of bridge options) is preserved as the allowKeys parameter and pinned by a mutation-checked test.

• StructuredLogger and MinimalLogger types (#2486). Canonical shapes for the two logger interfaces that had been re-declared in eleven places across core's domain host-adapters, the host logger, the scheduler, the notifier, the collection watchers, and several plugins. Consumers now alias these types, which keeps every public name and structure unchanged while removing the drift risk.

• Bridge allowlist parsing and shared type guards (isRecord, isObj, isNonEmptyString, isStringRecord, isStringArray, isUnknownArray, isErrorWithCode, hasStringProp, hasNumberProp, parseCsvList, parseCsvSet) continue from 1.0.0, with the bridge↔bridge and bridge↔relay dedup work of #2403 built on top.

Note for consumers

Workspace packages have declared ^1.1.0 since #2400, but 1.1.0 had never been published — only 1.0.0 was on npm, so that range could not resolve for npm-installed consumers. This release fixes that; no dependency-range changes are needed.

The package remains a zero-runtime-dependency, browser-safe leaf: any tier may depend on it without creating an uphill import.

📦 npm: @mulmoclaude/[email protected]

What's Changed

• chore(plans): archive the shipped File Explorer drag-drop plan by @isamu in https://github.com/receptron/mulmoclaude/pull/2279
• fix(mastodon): validate attachment URLs before fetching them by @isamu in https://github.com/receptron/mulmoclaude/pull/2281
• chore(deps): update mulmocast and @mulmocast/types to 2.9.0 by @snakajima in https://github.com/receptron/mulmoclaude/pull/2284
• fix(markdown-utils): stop makeTasksInteractive scanning superlinearly by @isamu in https://github.com/receptron/mulmoclaude/pull/2282
• refactor(plugins): route lang loaders through createUseT by @isamu in https://github.com/receptron/mulmoclaude/pull/2283
• chore(release): @mulmoclaude/core + 14 plugins to 1.0.0 by @isamu in https://github.com/receptron/mulmoclaude/pull/2287
• chore(deps): Bump fast-uri from 3.1.2 to 3.1.4 by @dependabot[bot] in https://github.com/receptron/mulmoclaude/pull/2285
• chore(deps): Bump hono from 4.12.25 to 4.12.31 by @dependabot[bot] in https://github.com/receptron/mulmoclaude/pull/2286
• chore(plans): archive 73 shipped plans under plans/done/ by @isamu in https://github.com/receptron/mulmoclaude/pull/2288
• refactor(collection): split skill assets out of io.ts by @isamu in https://github.com/receptron/mulmoclaude/pull/2289
• docs(core): document the ASCII-only aggregate alias constraint (#2276) by @isamu in https://github.com/receptron/mulmoclaude/pull/2290
• feat(chat): "new messages" affordance for the sidebar chat list by @isamu in https://github.com/receptron/mulmoclaude/pull/2291
• test: cover the mulmoscript helpers and the view-query concurrency guard by @isamu in https://github.com/receptron/mulmoclaude/pull/2303
• refactor(core): give every collection-schema cross-field rule a name by @isamu in https://github.com/receptron/mulmoclaude/pull/2304
• refactor(server): extract retry policy, skill events and message decoration from agent.ts by @isamu in https://github.com/receptron/mulmoclaude/pull/2297
• refactor(server): extract the collection route's request parsers, with tests by @isamu in https://github.com/receptron/mulmoclaude/pull/2305
• refactor(server): extract browser-visible origin resolution from index.ts by @isamu in https://github.com/receptron/mulmoclaude/pull/2306
• refactor(server): extract the file-content write validators, with tests by @isamu in https://github.com/receptron/mulmoclaude/pull/2307
• update by @isamu in https://github.com/receptron/mulmoclaude/pull/2313
• test: cover the external-skill path sanitisers and hook payload extractors by @isamu in https://github.com/receptron/mulmoclaude/pull/2317
• test(spreadsheet): cover toNumber and parseCriteria by @isamu in https://github.com/receptron/mulmoclaude/pull/2328
• test(spreadsheet): cover date-string parsing and format inference by @isamu in https://github.com/receptron/mulmoclaude/pull/2329
• test(spreadsheet): cover A1 column conversion and Excel serial dates by @isamu in https://github.com/receptron/mulmoclaude/pull/2327
• fix(collections): resolve spawn intervals by own property, not prototype chain by @isamu in https://github.com/receptron/mulmoclaude/pull/2316
• refactor(agent): delegate parseStreamEvent to createStreamParser().parse by @isamu in https://github.com/receptron/mulmoclaude/pull/2350
• refactor(feeds): dedup the feed-summary projection between REST and remote-host (#2338) by @isamu in https://github.com/receptron/mulmoclaude/pull/2351
• refactor(workspace): extract generic validateEntryList from the two dir validators by @isamu in https://github.com/receptron/mulmoclaude/pull/2347
• fix(collections): reject undeclared mutate params by own property by @isamu in https://github.com/receptron/mulmoclaude/pull/2326
• fix(spreadsheet): replace date-format tokens in one pass by @isamu in https://github.com/receptron/mulmoclaude/pull/2331
• refactor: extract shared posixPath helpers in src/utils/path (#2337) by @isamu in https://github.com/receptron/mulmoclaude/pull/2348
• refactor(sessions): make src/types/session.ts the single source of truth for SessionSummary by @isamu in https://github.com/receptron/mulmoclaude/pull/2349
• refactor(plugins): extract the shared endpoint-dispatch execute() from 9 frontend plugins by @isamu in https://github.com/receptron/mulmoclaude/pull/2352
• refactor(memory): dedup LLM-JSON parsing helpers into llm-json.ts by @isamu in https://github.com/receptron/mulmoclaude/pull/2346
• refactor(memory): slugifyTopicName reuses compactAlnum instead of reimplementing it by @isamu in https://github.com/receptron/mulmoclaude/pull/2353
• update by @isamu in https://github.com/receptron/mulmoclaude/pull/2361
• fix(plugins): detect aggregate key collisions by own property by @isamu in https://github.com/receptron/mulmoclaude/pull/2354
• fix(logging): validate LOG_LEVEL by own property, not in by @isamu in https://github.com/receptron/mulmoclaude/pull/2355
• refactor(remoteView): centralise the mobile-target guard in resolveMobileView by @isamu in https://github.com/receptron/mulmoclaude/pull/2363
• refactor(collections): dedup store-failure → HTTP mapping and view/action lookups by @isamu in https://github.com/receptron/mulmoclaude/pull/2364
• docs(core): route the schema author to the googleCalendar block (#2312) by @isamu in https://github.com/receptron/mulmoclaude/pull/2370
• refactor(sessions): share readSessionDeletedIds instead of duplicating it by @isamu in https://github.com/receptron/mulmoclaude/pull/2373
• refactor(files): extract the shared write preamble + written-file response by @isamu in https://github.com/receptron/mulmoclaude/pull/2369
• refactor(mulmo-script): fold the duplicated beat-op handler skeleton by @isamu in https://github.com/receptron/mulmoclaude/pull/2377
• fix(google): normalise synced calendar datetimes to the shape collections parse by @isamu in https://github.com/receptron/mulmoclaude/pull/2372
• feat(spreadsheet): read ambiguous slash dates in the user's locale order by @isamu in https://github.com/receptron/mulmoclaude/pull/2333
• refactor(skills): dedup the catalog-source + external-args preamble in skills.ts by @isamu in https://github.com/receptron/mulmoclaude/pull/2375
• refactor(sessions): extract the backward jsonl scan shared by agent.ts and server/index.ts by @isamu in https://github.com/receptron/mulmoclaude/pull/2374
• refactor(frontend): extract createMutationQueue and the markdown blob POST by @isamu in https://github.com/receptron/mulmoclaude/pull/2371
• refactor(mulmoscript-plugin): extract View.vue pure helpers + tests (safe layer of #2299) by @isamu in https://github.com/receptron/mulmoclaude/pull/2380
• refactor(wiki): extract View.vue pure helpers + share splitFrontmatter (#2300) by @isamu in https://github.com/receptron/mulmoclaude/pull/2382
• refactor(manageSkills): extract pure catalog/badge helpers + markdown dedup (safe layer of #2301) by @isamu in https://github.com/receptron/mulmoclaude/pull/2381
• refactor(collection-plugin): extract CollectionView pure helpers + dedup click-outside (#2298, safe layer) by @isamu in https://github.com/receptron/mulmoclaude/pull/2384
• update by @isamu in https://github.com/receptron/mulmoclaude/pull/2378
• refactor(core): extract host-adapter slot factory shared by collection/feeds/google (#2401) by @isamu in https://github.com/receptron/mulmoclaude/pull/2416
• refactor(collection): unify hand-mirrored schema-walk preload functions (#2406) by @isamu in https://github.com/receptron/mulmoclaude/pull/2417
• fix(spreadsheet): expand $, lowercase and single-cell range references by @isamu in https://github.com/receptron/mulmoclaude/pull/2379
• test(files): stop the open/reveal tests from launching Finder on macOS CI by @isamu in https://github.com/receptron/mulmoclaude/pull/2385
• test(spreadsheet): cover parseFunctionArgs and normalizeData by @isamu in https://github.com/receptron/mulmoclaude/pull/2413
• refactor(spreadsheet): extract DATEDIF unit math into a pure function by @isamu in https://github.com/receptron/mulmoclaude/pull/2415
• refactor(core): consolidate the 3 fetchWithTimeout impls into @mulmoclaude/core/fetch (#2398) by @isamu in https://github.com/receptron/mulmoclaude/pull/2420
• refactor(common): move errorMessage into browser-safe @mulmoclaude/common (#2400) by @isamu in https://github.com/receptron/mulmoclaude/pull/2418
• refactor(core): single-source writeFileAtomic into @mulmoclaude/core/files (#2399) by @isamu in https://github.com/receptron/mulmoclaude/pull/2419
• refactor(collection): single-source registry types from core (#2407) by @isamu in https://github.com/receptron/mulmoclaude/pull/2421
• refactor(relay): collapse duplicated webhook skeletons (#2402) by @isamu in https://github.com/receptron/mulmoclaude/pull/2423
• refactor(wiki): reuse @mulmoclaude/markdown-utils frontmatter parser (#2410) by @isamu in https://github.com/receptron/mulmoclaude/pull/2424
• refactor(accounting-plugin): single-source server↔vue response/report types (#2411) by @isamu in https://github.com/receptron/mulmoclaude/pull/2425
• fix(spreadsheet): substitute cell references by position, not string replace by @isamu in https://github.com/receptron/mulmoclaude/pull/2376
• refactor: single-source artifact path builders in @mulmoclaude/core (#2405) by @isamu in https://github.com/receptron/mulmoclaude/pull/2426
• fix(spreadsheet): correct IPMT sign and PPMT so IPMT+PPMT equals PMT (#2386) by @isamu in https://github.com/receptron/mulmoclaude/pull/2430
• refactor: move useFileWatch into @mulmoclaude/core/plugin-vue (#2404) by @isamu in https://github.com/receptron/mulmoclaude/pull/2422
• fix(spreadsheet): DATEDIF "MD" no longer returns negative days (#2414) by @isamu in https://github.com/receptron/mulmoclaude/pull/2429
• refactor(packages): fold small in-package clones (#2412) by @isamu in https://github.com/receptron/mulmoclaude/pull/2434
• refactor(bridges): Phase-3 dedup — bridge↔bridge and bridge↔relay clones (#2403) by @isamu in https://github.com/receptron/mulmoclaude/pull/2437
• refactor(build): extract shared plugin vite.config.ts boilerplate (#2409) by @isamu in https://github.com/receptron/mulmoclaude/pull/2435
• refactor(#2408): dedup markdown host ↔ markdown-plugin (useMarkdownDoc, 8-locale lang, clipboard) into core/plugin-vue by @isamu in https://github.com/receptron/mulmoclaude/pull/2436
• refactor(spreadsheet): extract evaluator Excel→JS translation into pure module (#2395) by @isamu in https://github.com/receptron/mulmoclaude/pull/2439
• fix(spreadsheet): resolve cross-sheet date references to raw values (#2332) by @isamu in https://github.com/receptron/mulmoclaude/pull/2440
• fix(spreadsheet): #2390 lookup boundary/cross-sheet + refactor #2396 range-parse consolidation by @isamu in https://github.com/receptron/mulmoclaude/pull/2441
• fix(spreadsheet): exclude blank cells from range aggregates by @isamu in https://github.com/receptron/mulmoclaude/pull/2383
• fix(core): guard prototype-chain lookups that silently misbehave (#2324) by @isamu in https://github.com/receptron/mulmoclaude/pull/2438
• fix(spreadsheet): correct SUBSTITUTE/RIGHT/LEFT/PROPER edge cases (#2388) by @isamu in https://github.com/receptron/mulmoclaude/pull/2433
• refactor(app): extract session lifecycle into useSessionLifecycle (safe layer of #2302) by @isamu in https://github.com/receptron/mulmoclaude/pull/2444
• fix(core): guard prototype-key field pointers (#2318) and where lookups (#2323) by @isamu in https://github.com/receptron/mulmoclaude/pull/2443
• fix: guard handler-dispatch lookups against prototype keys (#2319) by @isamu in https://github.com/receptron/mulmoclaude/pull/2445
• fix(spreadsheet): evaluate IFS conditions by parsing, not eval by @isamu in https://github.com/receptron/mulmoclaude/pull/2362
• refactor(spreadsheet): extract PV/NPER/RATE/IRR/NPV into pure financial-math helpers (#2394) by @isamu in https://github.com/receptron/mulmoclaude/pull/2442
• fix(core): guard prototype-key dangling ref/embed lookups (#2322) by @isamu in https://github.com/receptron/mulmoclaude/pull/2446
• fix(spreadsheet): numeric coercion for ABS/SIGN, MODE, AVERAGEIF (#2391) by @isamu in https://github.com/receptron/mulmoclaude/pull/2449
• fix: surface spreadsheet formula failures as typed errors (#2359) by @isamu in https://github.com/receptron/mulmoclaude/pull/2450
• fix(spreadsheet): compute arithmetic in IFS condition operands (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2448
• fix(spreadsheet): unify boolean coercion across IF and AND/OR/NOT (#2387) by @isamu in https://github.com/receptron/mulmoclaude/pull/2431
• chore(release): @mulmobridge/[email protected] (drift fix) by @isamu in https://github.com/receptron/mulmoclaude/pull/2452
• fix(spreadsheet): enforce domain/boundary rules for the math functions (#2389) by @isamu in https://github.com/receptron/mulmoclaude/pull/2432
• fix(spreadsheet): #2360 (partial) STDEV/VAR sample estimator + HLOOKUP/VLOOKUP approximate match by @isamu in https://github.com/receptron/mulmoclaude/pull/2453
• refactor(spreadsheet): remove duplicated handler-side arg-count checks (#2397) by @isamu in https://github.com/receptron/mulmoclaude/pull/2454
• refactor(collection-plugin): split CollectionView.vue (#2298) by @isamu in https://github.com/receptron/mulmoclaude/pull/2455
• refactor(manageSkills): split View.vue into components/composables (#2301) by @isamu in https://github.com/receptron/mulmoclaude/pull/2456
• refactor(wiki): split View.vue into components/composables (#2300) by @isamu in https://github.com/receptron/mulmoclaude/pull/2457
• refactor(mulmoscript-plugin): split View.vue into components/composables (#2299) by @isamu in https://github.com/receptron/mulmoclaude/pull/2458
• chore(ci): exclude generated plugin barrels from the jscpd duplication scan (#2464) by @isamu in https://github.com/receptron/mulmoclaude/pull/2465
• refactor: single-source the SSRF deny-list into @mulmoclaude/common (#2459) by @isamu in https://github.com/receptron/mulmoclaude/pull/2469
• refactor: single-source faithful-copy host helpers out of mulmoscript/x-plugin (#2461) by @isamu in https://github.com/receptron/mulmoclaude/pull/2467
• fix: settle a pending confirm before replacing state in shared confirm.ts (#2463) by @isamu in https://github.com/receptron/mulmoclaude/pull/2466
• refactor: fold byte-identical host↔core helpers into their canonical homes (#2460) by @isamu in https://github.com/receptron/mulmoclaude/pull/2468
• refactor: extract createPluginI18n shared by accounting/collection vue lang (#2462) by @isamu in https://github.com/receptron/mulmoclaude/pull/2470
• refactor(plugins): pure-fn sweep + verified bug fixes across src/plugins by @isamu in https://github.com/receptron/mulmoclaude/pull/2471
• refactor(wiki): extract View.vue child component (#2300) by @isamu in https://github.com/receptron/mulmoclaude/pull/2475
• fix: address post-merge CodeRabbit nitpicks on #2469/#2468 by @isamu in https://github.com/receptron/mulmoclaude/pull/2473
• fix(spreadsheet): IF evaluates its chosen branch through the engine (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2474
• refactor(manageSkills): extract View.vue child components (#2301) by @isamu in https://github.com/receptron/mulmoclaude/pull/2472
• refactor(collection-plugin): extract CollectionView child components (#2298) by @isamu in https://github.com/receptron/mulmoclaude/pull/2476
• refactor(mulmoscript-plugin): extract View.vue child components (#2299) by @isamu in https://github.com/receptron/mulmoclaude/pull/2477
• fix(scheduler): harden TasksTab refetch, remount, delete, and i18n by @isamu in https://github.com/receptron/mulmoclaude/pull/2478
• fix(spreadsheet): COUNTIF/SUMIF criteria match case-insensitively, with wildcards (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2485
• fix(wiki): stale-response tokens + honest snapshot-load failure by @isamu in https://github.com/receptron/mulmoclaude/pull/2484
• refactor(spreadsheet): represent formula errors as a distinct value type (#2451) by @isamu in https://github.com/receptron/mulmoclaude/pull/2492
• refactor: single-source toUtcIsoDate into @mulmoclaude/common (#2480) by @isamu in https://github.com/receptron/mulmoclaude/pull/2491
• fix(manageSkills): star-lock ownership + same-repo update/uninstall guard by @isamu in https://github.com/receptron/mulmoclaude/pull/2479
• fix(wiki): reserve the 'deleted' state for not-found, not any failed fetch by @isamu in https://github.com/receptron/mulmoclaude/pull/2496
• refactor: sweep of verified small folds — spotify types, nextFileVersion export, confirm header truthfulness (#2489) by @isamu in https://github.com/receptron/mulmoclaude/pull/2495
• refactor: derive host StartChatParams from chat-service; use protocol Attachment (#2488) by @isamu in https://github.com/receptron/mulmoclaude/pull/2494
• refactor: consolidate bridge/relay env scanning into @mulmoclaude/common scanEnvOptions (#2487) by @isamu in https://github.com/receptron/mulmoclaude/pull/2497
• refactor(manageSkills): single-source the Ref field lists shared by State and the public interface (#2481) by @isamu in https://github.com/receptron/mulmoclaude/pull/2500
• fix(spreadsheet): #2360 — empty-range AVERAGE/MEDIAN and FLOOR(x, 0) return Excel errors, not 0 by @isamu in https://github.com/receptron/mulmoclaude/pull/2501
• update by @isamu in https://github.com/receptron/mulmoclaude/pull/2504
• refactor: adopt createSerialLock() from gui-chat-protocol 1.2.0, delete 3 withWriteLock copies (#2490) by @isamu in https://github.com/receptron/mulmoclaude/pull/2511
• fix(plugins): chart sparse-instances crash + generateImage deep-watch waste by @isamu in https://github.com/receptron/mulmoclaude/pull/2507
• fix(manageRoles): IME Enter, re-entrancy, delete confirm, refresh-failure by @isamu in https://github.com/receptron/mulmoclaude/pull/2509
• fix(spreadsheet): TEXT honours digit grouping and format decimals (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2510
• refactor(dedup): fold the known-duplicates 残党 (errorMessage / escapeHtml / ONE_DAY_MS) + refresh stale table rows (#2483) by @isamu in https://github.com/receptron/mulmoclaude/pull/2508
• refactor: consolidate the logger interface family via type aliases (#2486) by @isamu in https://github.com/receptron/mulmoclaude/pull/2498
• fix(spreadsheet): aggregates accept several arguments, as Excel does (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2502
• fix(spreadsheet): MID bounds and VALUE whole-string parsing (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2503
• fix(textResponse): i18n speaker labels + StackView link/edit wiring by @isamu in https://github.com/receptron/mulmoclaude/pull/2505

Full Changelog: https://github.com/receptron/mulmoclaude/compare/@mulmoclaude/[email protected]...@mulmoclaude/[email protected]