MulmoClaude

Highlights

First release since 1.0.1. The workspace had moved to 1.2.0 without a matching publish, so this release carries a large backlog — the deduplication campaign, several prototype-pollution guards, and new browser-safe subpaths.

Security

• SSRF deny-list single-sourced (#2459). The feeds HTTP client had its own CIDR table, which had drifted from the mastodon bridge's copy and was missing four ranges (192.0.0.0/24, 198.18.0.0/15, 224.0.0.0/4, 240.0.0.0/4) plus the hostname blocklist. It now imports @mulmoclaude/common/ssrf, whose table is the union of both, and gains two bypass fixes that were present in every copy: IPv4-mapped IPv6 in hex form ([::ffff:127.0.0.1], which WHATWG URL serializes as ::ffff:7f00:1) is now caught, and the IPv6 check is mask-based rather than string-prefix, which had under-blocked fe81::–febf:: inside fe80::/10.

• Prototype-chain lookup guards (#2318, #2319, #2322, #2323, #2324). Record field pointers, where lookups, handler dispatch, and dangling ref / embed resolution could read through the prototype chain, so a key like constructor or __proto__ silently returned a function or object instead of missing. Each lookup is now guarded.

• resolveWithinRoot single-sourced (#2461). The realpath-based path-containment check — previously a faithful copy carried by mulmoscript-plugin because a plugin may not import host code — now lives on the server-only @mulmoclaude/core/files subpath, with tests covering .. escapes, real symlink escapes, and nonexistent paths.

New and consolidated subpaths

• @mulmoclaude/core/artifacts (#2405) — shared, browser-safe artifact path builders (slugifyArtifact, buildArtifactRelPath, yearMonthUtc), replacing copies in the chart / html / mulmoscript plugins and, later, the host's yearMonthUtc (#2460).
• @mulmoclaude/core/plugin-vue (#2404, #2436) — useFileWatch (shared by the html and markdown plugin views, since a plugin cannot import another plugin), useMarkdownDoc, useClipboardCopy, and the pure nextFileVersion / fileWatchChannel rules. #2489 surfaced nextFileVersion on the barrel and extracted useFileVersion, so the host composable stops re-implementing the monotonic-mtime rule.
• @mulmoclaude/core/plugin-vue/i18n (#2462) — createPluginI18n(messages, localeSource), owning the createI18n construction, the detached effectScope, and the retry-safe lazy locale sync that the accounting and collection plugins had each written out. Deliberately its own subpath so importers of the main plugin-vue barrel do not have to resolve vue-i18n.
• @mulmoclaude/core/files (#2399) — one writeFileAtomic, replacing three copies whose opts.mode handling and uniqueTmp defaults had diverged.
• @mulmoclaude/core/fetch (#2398) — one fetchWithTimeout, consolidating three implementations.
• @mulmoclaude/core/translation/client gains loadTranslated (#2460), the peek-then-fetch batch loader the host and collection plugin had each written.

Internal consolidation

• Host-adapter slot factory (#2401) shared by the collection / feeds / google domains, and in #2486 their logger interfaces became aliases of the canonical StructuredLogger in @mulmoclaude/common — eleven structurally identical declarations across the repo now resolve to two shared types, with every public name and structure preserved.
• Schema-walk preload unification (#2406) — uniqueRefTargets / uniqueEmbedTargets / uniqueBacklinkSources were hand-mirrored between server enrichment and the client linked-cache fetch, which must preload the same set or one drifts.
• Wiki frontmatter (#2410) now reuses @mulmoclaude/markdown-utils, and escapeHtml comes from @mulmoclaude/common (#2483).
• createSerialLock() adopted from gui-chat-protocol 1.2.0 (#2490).

Dependencies

Requires @mulmoclaude/common@^1.1.0 and @mulmoclaude/markdown-utils@^1.3.0, both published today.

📦 npm: @mulmoclaude/[email protected]

What's Changed

• fix(spreadsheet): VLOOKUP / HLOOKUP index bounds (#2360) by @isamu in https://github.com/receptron/mulmoclaude/pull/2506
• test(manageSkills): guard external-link click wiring on markdown bodies (#2493) by @isamu in https://github.com/receptron/mulmoclaude/pull/2512

Full Changelog: https://github.com/receptron/mulmoclaude/compare/@mulmoclaude/[email protected]...@mulmoclaude/[email protected]