This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Summary
AI summaryUpdates 🧩 Other notable changes, Cascade publishes, and 🇯🇵 CJK fonts across a mixed release.
Full changelog
Highlights
Three threads run through this release: multi-registry collections, collection-import path unification, and agent self-service troubleshooting. Plus a stack of UX / i18n polish, the Contribute side of the registry going GA with sanitisation + a confirm dialog + dummy-data prompt + fork flow, custom-view i18n in all 8 locales, accounting plugin self-contained i18n, CJK font fixes for both code blocks and PDFs, and a feeds package extraction.
🗂️ Multi-registry collections
Discover now reads ~/mulmoclaude/config/collections-registries.json to load additional registries alongside the official receptron/mulmoclaude-collections. Each entry: { name, indexUrl, rawBaseUrl }. Discover cards carry an origin badge so users can tell which registry an entry came from; previewCollection and performImport accept the registry name to disambiguate collisions. Per-registry cache + stale-on-failure backoff keyed by (name, indexUrl, rawBaseUrl), so editing URLs invalidates the cached index. (#1837)
The official registry and Discover tab themselves also fully land in this release (#1815 / #1817 / #1818 / #1819) — including rename-on-collision (`movies-2`, `movies-3`, …) with an "Imported as" label.
📂 Imports unify with authoring on disk
Imports now write to data/skills/<slug>/ (the same place authored collections live), and the bundle's allowlisted files (`SKILL.md` / `schema.json` / `templates/`) are mirrored 1:1 into .claude/skills/<slug>/ via the same @mulmoclaude/core/skill-bridge rules an agent-authored skill goes through. .origin.json (the imported-vs-authored marker) lives ONLY in data/skills/<slug>/. Editing an imported collection is now identical to editing an authored one; rm -rf data/skills/<slug>/ deletes either kind through the existing bridge hook. (#1839)
Write-then-prune mirror ordering means a transient mirror failure can no longer leave .claude/skills/<slug>/ empty. Imported-collection deletion also works again: isDataDirSafe now accepts BOTH data/<slug>/ (authored) and data/collections/<slug>/ (imported) as valid per-slug subtrees (#1841).
🆘 Agent reads error-recovery.md on tool failure
New config/helps/error-recovery.md indexes the documented fix for common tool failures: gh/git/SSH inside the sandbox, Marp PDF, registry import, build/workspace, plugin runtime. The system prompt now points the agent at it BEFORE asking the user a clarifying question on a failed tool call. CLAUDE.md rule mandates appending new diagnostics to that file (so know-how that lives only in a PR description or docs/ stays accessible to the sandboxed agent). (#1846)
🤝 Contribute (registry export) goes GA
The Contribute icon on each Installed-tab collection card seeds a new chat with a sanitised template prompt; a confirm dialog wraps the icon so a stray click doesn't launch the agent. The agent generates 3-5 synthetic dummy records based on schema.json (privacy-safe by default — never copies real user records), builds the contribution bundle, runs build-index.mjs + validate.mjs, and opens a PR to the registry after user confirmation. Plus an export bundle generator with strict input validation. (#1825 / #1828 / #1830 / #1832 / #1835 / #1845)
🇯🇵 CJK fonts
- Code blocks (chat UI + 11 plugin Views + JSON editor): Windows CJK monospace fonts (
MS Gothic,BIZ UDGothic) added to the monospace stack. Japanese inside code blocks now renders correctly on Windows (was tofu). (#1829) - PDF rendering: Hiragino / Yu Gothic / Meiryo / Noto Sans CJK JP fallback added to
MARKDOWN_CSSbody + Marp inline style so PDF exports of Japanese decks render the glyphs. (#1826)
🧩 Other notable changes
- Custom-view i18n (#1842) — sandboxed views pick up the host locale via
<meta name="mulmoclaude:locale">anddocument.documentElement.lang. - Accounting plugin self-contained i18n (#1838) —
@mulmoclaude/accounting-pluginships its own 8-locale i18n inside the package. - Feeds package extraction (#1840 + #1843) — feeds engine + schema + paths moved to dedicated subpaths of
@mulmoclaude/core. Shareable feed refresh registration so the same feed can be triggered from multiple surfaces. - Field-driven spawn from a record field (#1820) — collection schema `spawn.every` accepts `{ fromField: "interval" }`.
- Imported-collection custom-view fallback (#1836) — view reader falls back to
data/skills/<slug>/views/for project-source collections. - Custom view help — default fields hint (#1834) — the addView prompt clarifies referenced fields must exist on the schema.
- README refresh (#1849) — the npm-shown README catches up with the last year of features;
/publish-mulmoclaudeskill gains a step to verify the README each release.
Cascade publishes
@mulmoclaude/core0.2.7 → 0.2.12@mulmoclaude/collection-plugin0.5.11 → 0.5.16@mulmoclaude/html-plugin0.2.4 → 0.2.5@mulmoclaude/markdown-plugin0.1.6 → 0.1.7- Initial publishes:
@mulmoclaude/[email protected],@mulmoclaude/[email protected],@mulmoclaude/[email protected]
📦 npm: `npx mulmoclaude@latest` — or `[email protected]`
Full changelog: https://github.com/receptron/mulmoclaude/compare/v0.9.0...v0.9.1
Breaking Changes
- Imports now write to `data/skills/` instead of a separate collection directory, unifying authored and imported collections.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MulmoClaude
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]