v1.4.0 — Collections get a map, and npm users finally get the current stack
Highlights
Collections — ontology graph panel (#2218)
The /collections page gains a Map tab that draws the ontology across your collections: each schema is a node, each ref field an edge. You can see how records point at each other instead of inferring it from schema files. Reverse edges collapse by their declared via.
Collections — calendar sync, file query, flag fields, delete
Google Calendar events sync into a collection, incrementally after the first pass (#2182, #2184). manageCollection can delete items (#2200). New flag field type with its own chip styling. File-backed dataSource queries landed alongside storage virtualization for view images (#2204).
The String()-coercion family
A no-base-to-string sweep found seven places where a non-string value was stringified into "[object Object]" on its way to a user, a filename, or a webhook signature check — collection scalar values, workspace dir names, MCP skill args, relay webhook secrets, the accounting router's action args, and two collection paths (#2208, #2210, #2211, #2213, #2215, #2223, #2225). Each was fixed at the source rather than patched at the render site.
Relay — fail closed on a misconfigured signing secret (#2213)
A malformed or absent webhook signing secret now rejects the request instead of falling through to the handler.
Shared helpers consolidated into core (#2217, #2219)
errorMessage existed 14 times across 4 behaviours; truncate's core copy had dropped the guard keeping output inside max. Both now live once in the browser-safe @mulmoclaude/core/utils.
Sandbox — the frozen-CLI failure mode is self-diagnosable (#2202, #2214)
Neither an upstream CLI release nor docker rmi refreshes the sandbox image's bundled Claude CLI (the rebuild reuses the cached npm install -g layer). The recovery — docker builder prune -a -f — is now documented where the agent reads it.
Note for npm users
mulmoclaude@1.3.0 shipped dep ranges pinned to @mulmoclaude/core@^0.23.0 and @mulmoclaude/collection-plugin@^0.12.0. A caret range on a 0.x package does not float across minors, so installs of 1.3.0 could not receive anything published since — including most of the above. 1.4.0 is the first launcher that actually delivers it.
Ships @mulmoclaude/core@0.28.0, @mulmoclaude/collection-plugin@0.14.0, @mulmoclaude/google-plugin@0.3.2, @mulmoclaude/accounting-plugin@0.3.3.
📦 npm: mulmoclaude@1.4.0
Full Changelog
See CHANGELOG.md.