This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Affected surfaces
Summary
AI summaryBroad release touches Highlights, collections, deps, and feat.
Full changelog
Highlights
- New server-only
./googlesubpath: the local Google OAuth engine extracted from the MulmoClaude host (PR #2120) — loopback + PKCE consent flow (authorizeGoogle), token store at~/.config/mulmoclaude/google-token.json(mode 600, atomic writes with the Windows transient-rename retry), single-flight auth-flow manager, Calendar v3 REST helpers (createCalendarEvent/listCalendarEvents), and a strict shared RFC3339 date-time validator (isIsoDateTimeWithOffset) that rejects offset-less, impossible (e.g. Feb 31), and out-of-range values. Host specifics are injected viaconfigureGoogleHost(same pattern as the collection engine). Requested consent scopes:calendar.events,tasks,drive.file. assets/helps/error-recovery.md: new "Google tool — link / credential / API errors" section so agents can guide users through not-linked / client-secret / API-403 recovery.google-auth-libraryis now a dependency of core (moved from the host manifests).
📦 npm: @mulmoclaude/[email protected]
Note: npm delta is 0.19.1 → 0.20.0 (PR #2120). Tags for 0.14–0.19.1 were not created at their release time; tagging discipline resumes from this release.
What's Changed
- fix(files): linkified data/ & artifacts/ paths resolve from workspace root (#1548) by @isamu in https://github.com/receptron/mulmoclaude/pull/2090
- fix(sandbox): log claude's workspace-trust stderr notice at debug, not error (#2055) by @isamu in https://github.com/receptron/mulmoclaude/pull/2091
- chore(deps): bump ws to ^8.21.1 and @vitejs/plugin-vue to ^6.0.8 by @isamu in https://github.com/receptron/mulmoclaude/pull/2092
- chore(lint): bump eslint-plugin-sonarjs to 4.2 + fix flagged e2e waits/skips by @isamu in https://github.com/receptron/mulmoclaude/pull/2094
- fix: write system prompt to a file, pass --system-prompt-file (Windows ENAMETOOLONG, #2078) by @isamu in https://github.com/receptron/mulmoclaude/pull/2093
- refactor(collections): make zod the single source of truth for the schema contract by @snakajima in https://github.com/receptron/mulmoclaude/pull/2097
- feat(collections): compiled zod record validators — enforced write gate, strict report-only scan by @snakajima in https://github.com/receptron/mulmoclaude/pull/2098
- update by @isamu in https://github.com/receptron/mulmoclaude/pull/2100
- chore(deps): bump discord.js to ^14.27.0 and vue-router to ^5.2.0 by @isamu in https://github.com/receptron/mulmoclaude/pull/2101
- chore(deps): upgrade @slack/web-api to ^8 and @slack/socket-mode to ^3 by @isamu in https://github.com/receptron/mulmoclaude/pull/2102
- feat(collections): getOntology — machine-readable workspace ontology (plan step ①) by @snakajima in https://github.com/receptron/mulmoclaude/pull/2099
- feat(collections): backlinks — display-only reverse refs (plan step ②) by @snakajima in https://github.com/receptron/mulmoclaude/pull/2103
- feat(collections): kind:"agent" actions — silent per-record/collection workers (plan step ③) by @snakajima in https://github.com/receptron/mulmoclaude/pull/2104
- feat(collections): kind:"mutate" — declarative host-executed writes (plan step ④) by @snakajima in https://github.com/receptron/mulmoclaude/pull/2105
- fix(chat): catch up a text card truncated mid-stream after socket.io reconnect (#2096) by @isamu in https://github.com/receptron/mulmoclaude/pull/2107
- update by @isamu in https://github.com/receptron/mulmoclaude/pull/2106
- test(e2e): cover multi-file ChatInput attachment (#1666) by @isamu in https://github.com/receptron/mulmoclaude/pull/2109
- feat: Google OAuth(ローカル)+ Google Calendar リモートコマンド by @isamu in https://github.com/receptron/mulmoclaude/pull/2110
- chore(plans): archive shipped Google OAuth Calendar plan by @isamu in https://github.com/receptron/mulmoclaude/pull/2112
- feat: 設定画面に Google 連携 UI(OAuth 開始 / 状態表示 / 解除) by @isamu in https://github.com/receptron/mulmoclaude/pull/2113
- feat(collections): rollup — cross-collection aggregates over backlink relations (plan step ⑤) by @snakajima in https://github.com/receptron/mulmoclaude/pull/2116
- docs(collections): egress sync pattern — plan step ⑥; ontology plan complete by @snakajima in https://github.com/receptron/mulmoclaude/pull/2117
- feat(collections): extract manageCollection into @mulmoclaude/core/collection/server by @snakajima in https://github.com/receptron/mulmoclaude/pull/2118
- feat(mulmoScript): per-beat generate/play buttons + surface real generation errors by @snakajima in https://github.com/receptron/mulmoclaude/pull/2119
- feat: エージェントに Google Calendar ツールを公開(google-plugin + core 抽出 + error-recovery 案内) by @isamu in https://github.com/receptron/mulmoclaude/pull/2120
Full Changelog: https://github.com/receptron/mulmoclaude/compare/v1.0.0...@mulmoclaude/[email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MulmoClaude
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]