MulmoClaude

Summary

The first launcher release since 1.4.0 (2026-07-20): 211 merged PRs, 707 commits, six days. Most of it is internal, so here is the shape of it before the detail.

• npm delivery is repaired — this is the point of the release. [email protected] declared 0.x ranges for every internal package, and a 0.x caret cannot float across minors (^0.28.0 means >=0.28.0 <0.29.0). Nothing published in the last six days could reach an installed user: not @mulmoclaude/core 1.0.0→1.3.0, not the 14 plugins, not the 32-package @mulmobridge/* 1.0.0 suite. All 17 launcher ranges now point at the 1.x line, verified by a clean install of the packed tarball.
• 87 refactor PRs — a deduplication campaign. Two new browser-safe leaf packages (@mulmoclaude/common, @mulmoclaude/markdown-utils) plus new @mulmoclaude/core subpaths absorbed code hand-copied across the host, plugins, bridges and relay. Behaviour-preserving by intent — the interesting part is the bugs that folding the copies together exposed.
• 69 fix PRs, 35 of them in the spreadsheet engine. A systematic Excel-compatibility pass over lookup bounds, criteria matching, financial functions, date math and error values.
• 11 features. The user-visible ones: remote-host auto-recovery, reorderable launcher shortcuts, drag-and-drop into File Explorer folders, and a related-collections pulldown.
• Four of the largest .vue files were split into components and composables — CollectionView, manageSkills, wiki, mulmoscript.

Highlights

If your UI looked broken, this release fixes it (#2558, #2561, #2563)

Material Icons draw their glyphs from ligatures, so an icon element's text content is the icon name. Chrome's page translation rewrites those text nodes, the ligature stops matching, and every icon-only control renders its name as a literal word — inflating each button to that word's width. Combined with the translator's nav overlays, the result reads as "the CSS never loaded", which is exactly how it kept being reported. The app chrome now carries translate="no" (it already ships in 8 locales), and agent / user content opts back in with translate="yes". Setup problems of this shape also gained a home at docs/troubleshooting.md.

Remote host — disconnects are visible and recover on their own (#2535, #2538)

A transient Firestore onSnapshot error used to take the remote host down permanently and silently. It now re-subscribes with bounded exponential backoff (1 s → 16 s over five attempts) and surfaces the state in the UI; fatal codes or exhausted retries still go offline deliberately. The replay path is safe against double execution — the claimCommand queued→processing transaction still gates each command exactly once.

Spreadsheet engine — an Excel-compatibility pass (#2360 and 34 sibling PRs)

Lookup functions respect index bounds and approximate-match semantics; COUNTIF/SUMIF criteria match case-insensitively and honour wildcards; aggregates accept multiple arguments and exclude blanks; IF/IFS evaluate their chosen branch by parsing rather than eval; IPMT + PPMT now equals PMT, and RATE/IRR report #NUM! on non-convergence instead of a wrong number; DATEDIF "MD" no longer returns negative days. Formula errors became a distinct value type rather than strings that could be mistaken for data.

The deduplication campaign found real bugs

Folding hand-copied code together exposed defects hiding in the divergence. The feeds HTTP client's SSRF table had drifted from the mastodon bridge's and was missing four CIDR ranges plus the hostname blocklist — and consolidating them surfaced two bypasses present in both copies: WHATWG URL serialises [::ffff:127.0.0.1] in hex, so a dotted-quad-only regex let IPv4-mapped loopback through, and a string-prefix IPv6 check under-blocked fe81::–febf:: inside fe80::/10. Both are fixed and now mask-based (#2459).

Smaller, user-visible

Reorderable pinned launcher shortcuts (#2519). Drop files straight onto a folder row in the File Explorer (#2270). A related-collections pulldown in the collection view header, and deleting a collection now also clears the Google Calendar sync token and feeds ingest cursor that used to outlive it — the cause of "I recreated it and it stays empty" (#2428, #2550). A "new messages" affordance in the sidebar chat list (#2291). Beat numbers in the MulmoScript editor (#2543). On Windows, .gitignore rules apply below the workspace root again (#2542).

Full Changelog

See CHANGELOG.md.

📦 npm: [email protected]