This release adds 3 notable features for engineering teams evaluating rollout.
Published 24d
LLM Frameworks
✓ No known CVEs patched
✓ No known CVEs patched in this version
Summary
AI summaryBroad release touches Highlights, Internal, Cascade publishes, and favourite.
Full changelog
Highlights
- Writable remote custom views on the mobile companion — LLM-generated mobile-targeted views (phase 3), update/delete over Firestore (phase 4), and inlined workspace image thumbnails so the phone never has to reach
localhost(phase 5). - Chat UI recovers from missed pub/sub events — three complementary fixes so the "考え中…" indicator can never stick mid-turn (immediate
isRunning=falseonsession_finished,usePubSub().onReconnect()catch-up,document.visibilitychangehandler for Safari's silent tab throttling). - Safari no longer freezes on Opus 4.8 degenerate-repetition output — cap the string fed into
marked()at 100k chars in the text-response view, show a truncation banner + preview slice. Full raw text still reachable via Copy. Localised across all 8 locales. ?selected=<id>deep-link respects the user's saved view — no longer force-switches to calendar view and writes "calendar" into localStorage.- Role icons de-collided with the pin star — General →
auto_awesome, Debug →bug_report, unknown-role fallback →smart_toy. PinToggle's ★ (favourite) stays. - Chat-index scheduler skips unchanged sessions — CLI call rate drops from
O(sessions × 24)toO(actually-touched sessions × 24)per day. - billing-clients-worklog recipe reconciles pre-existing data — mandatory reconcile step + slug-contract enforcement + collision detection prevents "setup looks done but ref links break" on legacy worklog data.
- New launcher-sync CI gate — root ↔ launcher ↔ plugin
peerDependenciesaudited on every PR (root cause of #1920).
📦 npm: [email protected]
📖 Full changelog: docs/CHANGELOG.md
Added
- Remote custom views — phase 3 (#1932) — collection views can now specify
target: "mobile"; desktop shows a phone-frame preview;getRemoteViewhandler ships mobile-optimised views over the Firestore command channel. - Remote custom views — phase 4 (#1933) —
mutateRemoteViewhandler for update/delete, with derived-field resolution + clone-safe preview pages. - Remote custom views — phase 5 (#1938) — workspace image thumbnails inlined via
sharp; the phone never has to reachlocalhostfor image bytes.
Changed
- launcher-sync CI gate — strict lockstep (#1927) — invariants 4/5 added: launcher range lower bound == workspace source (strict), and
gui-chat-protocolpeer dep major.minor == launcher pin major.minor. bin/mulmoclaude.jsreads version frompackage.json(#1925) — hardcoded version string is gone;--versionalways matches the shippedpackage.json.- Chat-index scheduler skips unchanged sessions (#1930, tracking #1929) — only sessions whose jsonl mtime is newer than the last index get re-processed.
- billing-clients-worklog recipe reconciles pre-existing data (#1941, tracking #1626) — mandatory reconcile step + slug-contract enforcement + collision detection.
- Session role icons (#1942, tracking #1684) — General →
auto_awesome, Debug →bug_report, unknown-role fallback →smart_toy.
Fixed
- Chat UI silently loses events mid-turn (#1934, tracking #1915).
- Safari freezes on model degenerate-repetition output (#1936, tracking #1863).
?selected=<id>deep-link no longer forces calendar view (#1939, tracking #1675).sharpwas missing from launcherdependencies(#1938) — first thumbnail request wouldERR_MODULE_NOT_FOUND.- CodeQL false-positive in remote-view sessionId sanitisation (#1937).
chat-indexscheduler interval relaxed to 6h (#1931).
Internal
- Root ↔ launcher ↔ plugin peer dep sync gate (#1923) — every PR now audited for three invariants; catches the #1920 class of bug at PR time.
- CHANGELOG.md for 0.9.2 (#1926) — retroactive entry documenting the 30 PRs shipped in 0.9.2.
- Chore release identity rolled back to 0.9.3 (#1945) — earlier
chore(release)commits had preemptively bumped the launcher to 0.9.4 without publishing; rolled back to 0.9.3 so the actual npm publish gets the natural next-after-0.9.2 identity instead of skipping a number.
Cascade publishes
@mulmoclaude/core0.7.0 → 0.7.1 → 0.8.0 → 0.8.1@mulmoclaude/collection-plugin0.6.0 → 0.7.0@mulmobridge/client0.1.4 → 0.1.5
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About MulmoClaude
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]