## Highlights - **The collections index has a search box** (#2837): a case-insensitive substring over title and slug, ANDed with the existing Editable/Data chips. No match shows the same empty state the record list uses, and its link clears both narrowings. Chosen over the user-defined tags the issue proposed, because tags start empty on every collection that already exists — search works on the first workspace it meets, with no schema field and no agent-facing documentation. - **The collections index can be re-ordered** (#2836): a Slug / Name toggle, persisted locally. The server's discovery order stays slug-ascending for the watchers, the ontology and the mobile remote; the preference is layered on the client. The toggle hides itself when the current narrowing leaves a single card. - **An unset `embed` no longer reads as a broken link** (#2863): an `embed` whose optional `idField` is empty resolves fail-soft to "no record" by the schema contract, but the detail panel had only `found` and everything-else branches — so a reference nobody had filled in got the red "missing" card with a blank id. It now renders the same em-dash as the panel's other empty fields; the card stays for an id the target collection genuinely lacks. - **Record ids are UUIDs**: generated record ids no longer derive from a counter. ### Breaking - **The shared-app compiler moved out of this stack** (`refactor(collections)!`): it now lives in `receptron/sharedapp`. Hosts that reached into the compiler through this plugin must depend on that package instead. - `@mulmoclaude/core` is a **peer dependency at `^4.0.1`** — the host supplies it, so a host older than that now fails loudly at install instead of silently loading a second copy of core. ### Also in this release - Lint: the plugin's `env.d.ts` was missing the `declare module "*.vue"` shim that every other plugin has. `vue-tsc` resolved `.vue` imports anyway, but eslint's TS program did not — so `ChatView` / `ChatPreview` typed as `any` and surfaced as `no-unsafe-assignment` warnings. Fixed at the type layer rather than suppressed. 📦 **npm**: [`@mulmoclaude/collection-plugin@4.0.0`](https://www.npmjs.com/package/@mulmoclaude/collection-plugin/v/4.0.0) --- ## What's Changed * fix(collections): 生成するレコード ID を UUID にする (#2851) by @isamu in https://github.com/receptron/mulmoclaude/pull/2858 * chore(deps): @mulmoclaude/core をホスト供給の peer に統一し ^3.6.0 に揃える by @isamu in https://github.com/receptron/mulmoclaude/pull/2862 * chore(ci): dead-code-scan に yarn キャッシュを追加し、Windows は実測で不採用にする (#2857) by @isamu in https://github.com/receptron/mulmoclaude/pull/2859 * fix(test): collection root の fixture をプラットフォーム依存でなくする (#2864) by @isamu in https://github.com/receptron/mulmoclaude/pull/2865 * feat(collections): 共有アプリの publish（git → Firestore） by @snakajima in https://github.com/receptron/mulmoclaude/pull/2860 * feat(collections): 共有コレクションを onSnapshot でライブにする by @snakajima in https://github.com/receptron/mulmoclaude/pull/2861 * fix(collections): 共有レコードの同一性はドキュメント ID であって、投稿できるフィールドではない by @snakajima in https://github.com/receptron/mulmoclaude/pull/2868 * feat(collections): 共有コレクションはホストが能力を宣言したときだけ成立する by @snakajima in https://github.com/receptron/mulmoclaude/pull/2870 * feat(collections): ホストが deploy と publish を自分で回せるようにし、旧経路を落とす by @snakajima in https://github.com/receptron/mulmoclaude/pull/2871 * feat(collections): app.json が URL 名（slug）を宣言できるようにする by @snakajima in https://github.com/receptron/mulmoclaude/pull/2872 * feat(collections): 行スコープの assignee ロールと、先着枠のための宣言を追加 by @snakajima in https://github.com/receptron/mulmoclaude/pull/2874 * feat(collections): 枠の排他と、公開ページのビューを宣言できるようにする by @snakajima in https://github.com/receptron/mulmoclaude/pull/2876 * chore(ci): actions のメジャー更新を Dependabot で拾えるようにする by @isamu in https://github.com/receptron/mulmoclaude/pull/2878 * fix: keep runtime files under config/ out of format and lint (#2873) by @isamu in https://github.com/receptron/mulmoclaude/pull/2879 * feat(ci): lint の結果をジョブサマリーにグラフで出す by @isamu in https://github.com/receptron/mulmoclaude/pull/2882 * feat(collections): アプリのページを監査対象ごとに宣言できるようにする（core 3.14.0） by @snakajima in https://github.com/receptron/mulmoclaude/pull/2877 * refactor: move the shared build config out of config/ (#2883) by @isamu in https://github.com/receptron/mulmoclaude/pull/2884 * fix(ci): align the three packages/dist cache keys on root package.json (#2888) by @isamu in https://github.com/receptron/mulmoclaude/pull/2889 * chore(lint): 直せる warn を直し、残りは error + ファイル単位の grandfather に by @isamu in https://github.com/receptron/mulmoclaude/pull/2887 * feat(collections): 監査対象ごとに「何を変えられるか」を射影する by @snakajima in https://github.com/receptron/mulmoclaude/pull/2891 * chore(deps): bump github/codeql-action/upload-sarif from 3.37.1 to 4.37.6 in the github-actions group by @dependabot[bot] in https://github.com/receptron/mulmoclaude/pull/2880 * refactor(collections)!: 共有アプリのコンパイラを receptron/sharedapp に出す by @snakajima in https://github.com/receptron/mulmoclaude/pull/2894 * fix(collections): 未設定の embed（idField が空）を fail-soft 表示にする by @isamu in https://github.com/receptron/mulmoclaude/pull/2895 * feat(collections): 一覧の並び順を slug / 表示名で切り替えられるようにする (#2836) by @isamu in https://github.com/receptron/mulmoclaude/pull/2896 * feat(mcp): ブローカーの起動を外から見えるようにする (#2842) by @isamu in https://github.com/receptron/mulmoclaude/pull/2898 * feat(collections): 一覧を検索欄で絞り込めるようにする by @isamu in https://github.com/receptron/mulmoclaude/pull/2897 * chore(release): @mulmoclaude/core@4.0.1 by @isamu in https://github.com/receptron/mulmoclaude/pull/2899 **Full Changelog**: https://github.com/receptron/mulmoclaude/compare/@mulmoclaude/core@3.6.0...@mulmoclaude/collection-plugin@4.0.0

## Highlights Dependency-range maintenance only — **no shipped source changed** since the previous tag (`yarn audit:releases` reports manifest drift alone). - `@mulmoclaude/core` floor moved `^1.8.0` → `^1.13.0`, picking up the calendar and feeds record-loss fixes released in [core 1.13.0](https://www.npmjs.com/package/@mulmoclaude/core/v/1.13.0) (#2683, #2684, #2688, #2696, #2679, #2693). Nothing an installer resolves changes today — these are `1.x` carets, so the old floor already floated to core 1.13.0. What this release fixes is the declared **floor**, so a consumer pinning an older core cannot assemble a combination this plugin's code does not actually support. 📦 **npm**: [`@mulmoclaude/html-plugin@1.2.1`](https://www.npmjs.com/package/@mulmoclaude/html-plugin/v/1.2.1) --- ## What's Changed * docs(build): record the dispatcher.mjs artifact gate and its two traps by @isamu in https://github.com/receptron/mulmoclaude/pull/2713 * fix(relay): verify Google Chat JWK and OAuth token instead of asserting them by @isamu in https://github.com/receptron/mulmoclaude/pull/2715 * refactor(dashboard): narrow DOM event targets instead of asserting them (#2692) by @isamu in https://github.com/receptron/mulmoclaude/pull/2717 * chore(release): bump the 16 workspaces whose declared ranges drifted by @isamu in https://github.com/receptron/mulmoclaude/pull/2720 **Full Changelog**: https://github.com/receptron/mulmoclaude/compare/@mulmoclaude/core@1.13.0...@mulmoclaude/html-plugin@1.2.1

## Highlights - **Initial publish** — Dev-only debug playground plugin for MulmoClaude. Standalone `/debug` page used as the integration bed for experimental host features (e.g. the Notifier engine). 📦 **npm**: [`@mulmoclaude/debug-plugin@0.2.0`](https://www.npmjs.com/package/@mulmoclaude/debug-plugin/v/0.2.0)

## Highlights ### Wiki-syntax embeds (#1221) Author markdown can now write `[[amazon:B00ICN066A]]`, `[[isbn:9780062316097]]`, or `[[youtube:dQw4w9WgXcQ]]` instead of raw URLs and get a clickable card / link / inline player. The renderer is registry-driven so future prefixes plug in cleanly. - **YouTube** plays inline via `youtube-nocookie.com` (no profile cookies until click), wrapped in a 16:9 box. - **Amazon** shows the product cover thumbnail and links to the user's locale-appropriate storefront — `amazon.co.jp` for `ja`, `amazon.de` for `de`, …, falls back to `.com`. - **ISBN** links to OpenLibrary (Amazon-independent). - External markdown links across wiki / files / chat artifact / sources / skill body now open in a new tab on click instead of being dead-clicks. ### Photo location capture (#1222) Every photo MulmoClaude saves now has its EXIF parsed: lat / lng + timestamp + camera + lens captured into a sidecar JSON under `data/photo-locations/`. HEIC / HEIF / TIFF supported alongside JPEG. New built-in `managePhotoLocations` plugin lets the agent and user list / search / open photos by date, place, or camera. Photos tab in Settings exposes the auto-capture toggle. LINE bridge now forwards inbound image messages to the agent for the same processing. ### Map plugin (#1227) Integrated `@gui-chat-plugin/google-map@0.4.0`. Add a Google Maps API key under Settings → Map and the agent can show locations, add markers, find places, and request directions inline in the chat canvas. Available in `general` / `guide` / `debug` roles. ### Notifications open the source chat (#1262) When the `notify` MCP tool fires from inside a chat session (typically a scheduled background chat reporting completion), the bell entry now carries a navigate target. Clicking opens that chat session instead of just dismissing. ## Breaking Changes None. ## Full Changelog See [CHANGELOG.md](https://github.com/receptron/mulmoclaude/blob/main/docs/CHANGELOG.md#061---2026-05-10) for the complete list.

## Highlights - **Fix image rendering in HTML / PDF** — LLM-generated content emitting `<img src="/artifacts/images/…">` (web-rooted convention) now renders correctly. The path-traversal hardening from #384 was correct but didn't recognise the leading-slash form, so: - PDF generation logged `image path escapes workspace` and produced a broken `<img>`. - presentHtml plugin's iframe srcdoc 404'd the image because `/artifacts/` isn't served at the SPA origin. Both paths now treat leading-slash as workspace-rooted while keeping the workspace boundary check intact (e.g. `/etc/passwd` is still rejected). (#961) 📦 **npm**: [`mulmoclaude@0.5.2`](https://www.npmjs.com/package/mulmoclaude/v/0.5.2)

## Highlights - **Docs**: README gains two env-var rows (`SLACK_BRIDGE_DEFAULT_ROLE` + shared `BRIDGE_DEFAULT_ROLE` fallback). Setting either seeds new bridge sessions with the specified role; `/role <id>` on an existing session still wins. See [#729](https://github.com/receptron/mulmoclaude/pull/729) for the feature. - **Ecosystem section** lists every `@mulmobridge/*` package with npm links so readers can navigate across the bridge family. - **Dep bump**: `@mulmobridge/client` tightened to `^0.1.4` to pick up the dashed-transport env fix. 📦 **npm**: [`@mulmobridge/slack@0.4.1`](https://www.npmjs.com/package/@mulmobridge/slack/v/0.4.1) --- ## What's Changed * docs: plan for top-page regression E2E tests (re: #620) by @ystknsh in https://github.com/receptron/mulmoclaude/pull/672 * feat(chat): session-history side panel as an independent toggle by @isamu in https://github.com/receptron/mulmoclaude/pull/728 * refactor(server): introduce makeUuid / shortId helpers (#723) by @isamu in https://github.com/receptron/mulmoclaude/pull/736 * docs(slack): mirror #729 additions to README.ja.md by @isamu in https://github.com/receptron/mulmoclaude/pull/740 * chore(deps): tighten @mulmobridge/* workspace dep ranges to current published by @isamu in https://github.com/receptron/mulmoclaude/pull/737 * feat(scripts): pre-publish check for README translations in packages/ by @isamu in https://github.com/receptron/mulmoclaude/pull/743 * refactor(client,relay): introduce makeUuid helpers (#723) by @isamu in https://github.com/receptron/mulmoclaude/pull/741 * fix: route workspace-internal links in wiki view to correct views by @ystknsh in https://github.com/receptron/mulmoclaude/pull/742 * chore(e2e): run Playwright on dedicated port 45173 by @isamu in https://github.com/receptron/mulmoclaude/pull/745 * feat(client+bridges): normalize dashed transport ids + full README sweep (closes #738) by @isamu in https://github.com/receptron/mulmoclaude/pull/747 **Full Changelog**: https://github.com/receptron/mulmoclaude/compare/@mulmobridge/chat-service@0.1.2...@mulmobridge/slack@0.4.1

## Highlights - **Docs**: README gains two env-var rows (`DISCORD_BRIDGE_DEFAULT_ROLE` + shared `BRIDGE_DEFAULT_ROLE` fallback). Setting either seeds new bridge sessions with the specified role; `/role <id>` on an existing session still wins. See [#729](https://github.com/receptron/mulmoclaude/pull/729) for the feature. - **Ecosystem section** lists every `@mulmobridge/*` package with npm links so readers can navigate across the bridge family. - **Dep bump**: `@mulmobridge/client` tightened to `^0.1.4` to pick up the dashed-transport env fix. 📦 **npm**: [`@mulmobridge/discord@0.1.1`](https://www.npmjs.com/package/@mulmobridge/discord/v/0.1.1) --- ## What's Changed * docs: plan for top-page regression E2E tests (re: #620) by @ystknsh in https://github.com/receptron/mulmoclaude/pull/672 * feat(chat): session-history side panel as an independent toggle by @isamu in https://github.com/receptron/mulmoclaude/pull/728 * refactor(server): introduce makeUuid / shortId helpers (#723) by @isamu in https://github.com/receptron/mulmoclaude/pull/736 * docs(slack): mirror #729 additions to README.ja.md by @isamu in https://github.com/receptron/mulmoclaude/pull/740 * chore(deps): tighten @mulmobridge/* workspace dep ranges to current published by @isamu in https://github.com/receptron/mulmoclaude/pull/737 * feat(scripts): pre-publish check for README translations in packages/ by @isamu in https://github.com/receptron/mulmoclaude/pull/743 * refactor(client,relay): introduce makeUuid helpers (#723) by @isamu in https://github.com/receptron/mulmoclaude/pull/741 * fix: route workspace-internal links in wiki view to correct views by @ystknsh in https://github.com/receptron/mulmoclaude/pull/742 * chore(e2e): run Playwright on dedicated port 45173 by @isamu in https://github.com/receptron/mulmoclaude/pull/745 * feat(client+bridges): normalize dashed transport ids + full README sweep (closes #738) by @isamu in https://github.com/receptron/mulmoclaude/pull/747 **Full Changelog**: https://github.com/receptron/mulmoclaude/compare/@mulmobridge/chat-service@0.1.2...@mulmobridge/discord@0.1.1

## Highlights - **Opt-in ack reaction (#696, closes #695)** — the Slack bridge can now add an emoji reaction to every inbound message it processes, giving the user an immediate "the bot saw me" signal before the agent finishes thinking. Single dual-purpose env var: - `SLACK_ACK_REACTION=1` → reacts with default 👀 (`:eyes:`) - `SLACK_ACK_REACTION=white_check_mark` → reacts with ✅ - `SLACK_ACK_REACTION=my_bot_ack` → reacts with a custom workspace emoji - unset / `0` / `false` → off (default) ### Upgrade notes - Opt-in only — operators not setting `SLACK_ACK_REACTION` see no change on upgrade. - When enabled, add the `reactions:write` Bot Token Scope in **OAuth & Permissions** and reinstall the Slack App. Without the scope the reaction call fails with `missing_scope`, but the bridge logs a warning and keeps running — reply flow is unaffected. - The reaction is not removed when the bot replies; it stays as a "seen" marker. ### Usage ```bash # Fresh install npx @mulmobridge/slack@latest # Pin npx @mulmobridge/slack@0.4.0 # Enable the ack reaction (after granting reactions:write) SLACK_ACK_REACTION=1 npx @mulmobridge/slack@latest ``` See [`README.md`](https://github.com/receptron/mulmoclaude/blob/main/packages/bridges/slack/README.md#ack-reaction-) / [`README.ja.md`](https://github.com/receptron/mulmoclaude/blob/main/packages/bridges/slack/README.ja.md) for the full grammar, operator setup, and design notes. ## What's Changed * feat(slack): ack reaction on receive (:eyes:) by @isamu in https://github.com/receptron/mulmoclaude/pull/696 * chore(slack): bump @mulmobridge/slack to 0.4.0 by @isamu in https://github.com/receptron/mulmoclaude/pull/698 **Full Changelog**: https://github.com/receptron/mulmoclaude/compare/@mulmobridge/slack@0.3.0...@mulmobridge/slack@0.4.0 📦 **npm**: [`@mulmobridge/slack@0.4.0`](https://www.npmjs.com/package/@mulmobridge/slack/v/0.4.0)