MulmoClaude

Highlights

• Collection → Google Calendar push (#2598, #2600) — the engine behind the new Push to Google button. Google Calendar sync was pull-only and no setting enabled a write-back, which is why "two-way sync" could not be configured. This adds the other direction: it creates events for locally added records and patches the fields a user actually edited, leaving attendees, reminders and recurrence untouched. It never deletes (a Google delete removes the event for every attendee and cannot be undone) and skips a record edited on both sides rather than picking a winner.

  The substance is a new baseline store, <workspace>/data/calendar/.push-state.json, holding the raw value Google last reported per event. toCollectionDateTime deliberately drops the zone offset and flattens all-day into …T00:00, so a push cannot rebuild a Google time from the stored value alone — the baseline is where the original offset and all-day-ness come back from, and it is also the only way to tell a local edit from an untouched record. Pull → push round-trips byte-identically, pinned by test.

  New API: pushCalendarForCollection, toGoogleEventTime, planRecord / conflictingFields / mayAdoptExisting, the .push-state.json accessors, getCalendar, getCalendarEvent, and CalendarEventTime / CalendarEventSpan so an all-day event or an explicit timeZone can be expressed. updateCalendarEvent accepts ifMatch and googleRequest accepts extraHeaders, making the write conditional on the version the conflict check read — a stale etag answers 412 and is reported as a conflict instead of silently overwriting.

• Type-safe remote-host handlers (#2592, #2596) — eight hand-rolled JsonObject casts replaced with real guards, so a malformed command payload is rejected at the boundary rather than crashing downstream.

• ReDoS fix in the HTML attribute iterator (#2587, CodeQL #402) — the polynomial backtracking pattern is gone; hostile markup can no longer stall the parser.

📦 npm: @mulmoclaude/[email protected]

What's Changed

• fix: polynomial ReDoS in the HTML attribute iterator (CodeQL #402) by @isamu in https://github.com/receptron/mulmoclaude/pull/2587
• perf(sessions): stop re-reading every session's meta on each list scan (#2588) by @isamu in https://github.com/receptron/mulmoclaude/pull/2589
• refactor: replace asyncHandler's Request/Response casts with structural bounds by @isamu in https://github.com/receptron/mulmoclaude/pull/2590
• fix: sanitise request-derived values reaching log.* (#2591) by @isamu in https://github.com/receptron/mulmoclaude/pull/2595
• refactor: replace 8 hand-rolled JsonObject casts in remoteHost handlers (#2592) by @isamu in https://github.com/receptron/mulmoclaude/pull/2596
• fix: forward next(err) from asyncHandler when headers are already sent (#2593) by @isamu in https://github.com/receptron/mulmoclaude/pull/2597
• chore(dev): make LAN exposure of the dev server opt-in by @isamu in https://github.com/receptron/mulmoclaude/pull/2599
• feat(calendar): Collection → Google Calendar push button (#2598) by @isamu in https://github.com/receptron/mulmoclaude/pull/2600
• fix: verify the loopback premise the CSRF guard was assuming by @isamu in https://github.com/receptron/mulmoclaude/pull/2601
• refactor: replace unvalidated as casts of external data with type guards (#2594) by @isamu in https://github.com/receptron/mulmoclaude/pull/2603

Full Changelog: https://github.com/receptron/mulmoclaude/compare/@mulmoclaude/[email protected]...@mulmoclaude/[email protected]