@swarmclawai/swarmclaw 0.7.1 → 0.7.3

package/src/app/api/connectors/doctor/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server'
+import { buildConnectorDoctorPreview, buildConnectorDoctorReport, type ConnectorDoctorPreviewInput } from '@/lib/server/connectors/doctor'
+import { loadConnectors } from '@/lib/server/storage'
+
+export const dynamic = 'force-dynamic'
+
+export async function POST(req: Request) {
+  const body = await req.json().catch(() => ({})) as ConnectorDoctorPreviewInput
+  const connectors = loadConnectors()
+  const baseConnector = typeof body.id === 'string' ? connectors[body.id] : null
+  const connector = buildConnectorDoctorPreview({ baseConnector, input: body })
+  return NextResponse.json(buildConnectorDoctorReport(connector, body.sampleMsg, { baseConnector }))
+}

package/src/app/api/files/open/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import { exec } from 'child_process'
+import { spawn } from 'child_process'
 import fs from 'fs'
 import path from 'path'
 
@@ -19,25 +19,27 @@ export async function POST(req: Request) {
   const isDir = fs.statSync(resolved).isDirectory()
   const platform = process.platform
 
-  // Determine the command to reveal in the OS file manager
-  let cmd: string
+  let command: string
+  let args: string[]
   if (platform === 'darwin') {
-    // macOS: -R reveals in Finder (selects the item), for dirs just open the dir
-    cmd = isDir ? `open "${resolved}"` : `open -R "${resolved}"`
+    command = 'open'
+    args = isDir ? [resolved] : ['-R', resolved]
   } else if (platform === 'win32') {
-    cmd = isDir ? `explorer "${resolved}"` : `explorer /select,"${resolved}"`
+    command = 'explorer'
+    args = isDir ? [resolved] : [`/select,${resolved}`]
   } else {
-    // Linux: xdg-open on the directory containing the file
-    cmd = `xdg-open "${isDir ? resolved : path.dirname(resolved)}"`
+    command = 'xdg-open'
+    args = [isDir ? resolved : path.dirname(resolved)]
   }
 
   return new Promise<NextResponse>((resolve) => {
-    exec(cmd, (err) => {
-      if (err) {
-        resolve(NextResponse.json({ error: err.message }, { status: 500 }))
-      } else {
-        resolve(NextResponse.json({ ok: true }))
-      }
+    const child = spawn(command, args, { stdio: 'ignore' })
+    child.once('error', (err) => {
+      resolve(NextResponse.json({ error: err.message }, { status: 500 }))
+    })
+    child.once('spawn', () => {
+      child.unref()
+      resolve(NextResponse.json({ ok: true }))
     })
   })
 }

package/src/app/api/memory/maintenance/route.ts

@@ -1,6 +1,9 @@
 import { NextResponse } from 'next/server'
+import path from 'path'
 import { getMemoryDb } from '@/lib/server/memory-db'
 import { loadSettings } from '@/lib/server/storage'
+import { syncAllSessionArchiveMemories } from '@/lib/server/session-archive-memory'
+import { DATA_DIR } from '@/lib/server/data-dir'
 
 function parseBool(value: unknown, fallback: boolean): boolean {
   if (typeof value === 'boolean') return value
@@ -33,10 +36,13 @@ export async function GET(req: Request) {
     24 * 365,
   )
   const analyzed = db.analyzeMaintenance(ttlHours)
+  const archiveSync = syncAllSessionArchiveMemories()
   return NextResponse.json({
     ok: true,
     ttlHours,
     analyzed,
+    archiveSync,
+    archiveExportDir: path.join(DATA_DIR, 'session-archives'),
   })
 }
 
@@ -46,6 +52,9 @@ export async function POST(req: Request) {
   const db = getMemoryDb()
   const ttlHours = parseIntBounded(body?.ttlHours ?? settings.memoryWorkingTtlHours, 24, 1, 24 * 365)
   const maxDeletes = parseIntBounded(body?.maxDeletes, 500, 1, 20_000)
+  const archiveSync = body?.syncArchives === false
+    ? { synced: 0, skipped: 0, sessionIds: [] }
+    : syncAllSessionArchiveMemories()
   const result = db.maintain({
     ttlHours,
     maxDeletes,
@@ -57,7 +66,8 @@ export async function POST(req: Request) {
     ok: true,
     ttlHours,
     maxDeletes,
+    archiveSync,
+    archiveExportDir: path.join(DATA_DIR, 'session-archives'),
     ...result,
   })
 }
-

package/src/app/api/openclaw/agent-files/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+import { resolveOpenClawGatewayAgentId } from '@/lib/server/openclaw-agent-resolver'
 
 const AGENT_FILES = ['SOUL.md', 'IDENTITY.md', 'USER.md', 'TOOLS.md', 'HEARTBEAT.md', 'MEMORY.md', 'AGENTS.md'] as const
 
@@ -16,12 +17,24 @@ export async function GET(req: Request) {
     return NextResponse.json({ error: 'OpenClaw gateway not connected' }, { status: 503 })
   }
 
+  let gatewayAgentId: string
+  try {
+    gatewayAgentId = await resolveOpenClawGatewayAgentId(agentId, gw)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    const status = message.includes('not an OpenClaw agent') ? 400 : 404
+    return NextResponse.json({ error: message }, { status })
+  }
+
   const files: Record<string, { content: string; error?: string }> = {}
   await Promise.all(
     AGENT_FILES.map(async (filename) => {
       try {
-        const result = await gw.rpc('agents.files.get', { agentId, filename }) as { content?: string } | undefined
-        files[filename] = { content: result?.content ?? '' }
+        const result = await gw.rpc('agents.files.get', {
+          agentId: gatewayAgentId,
+          name: filename,
+        }) as { file?: { content?: string } } | undefined
+        files[filename] = { content: result?.file?.content ?? '' }
       } catch (err: unknown) {
         files[filename] = { content: '', error: err instanceof Error ? err.message : String(err) }
       }
@@ -48,10 +61,20 @@ export async function PUT(req: Request) {
   }
 
   try {
-    await gw.rpc('agents.files.set', { agentId, filename, content: content ?? '' })
+    const gatewayAgentId = await resolveOpenClawGatewayAgentId(agentId, gw)
+    await gw.rpc('agents.files.set', {
+      agentId: gatewayAgentId,
+      name: filename,
+      content: content ?? '',
+    })
     return NextResponse.json({ ok: true })
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : String(err)
-    return NextResponse.json({ error: message }, { status: 502 })
+    const status = message.includes('not an OpenClaw agent')
+      ? 400
+      : message.includes('not found')
+        ? 404
+        : 502
+    return NextResponse.json({ error: message }, { status })
   }
 }

package/src/app/api/openclaw/skills/route.ts

@@ -1,5 +1,7 @@
 import { NextResponse } from 'next/server'
 import { ensureGatewayConnected } from '@/lib/server/openclaw-gateway'
+import { resolveOpenClawGatewayAgentId } from '@/lib/server/openclaw-agent-resolver'
+import { normalizeOpenClawSkillsPayload } from '@/lib/server/openclaw-skills-normalize'
 import { loadAgents, saveAgents } from '@/lib/server/storage'
 import { notify } from '@/lib/server/ws-hub'
 import type { OpenClawSkillEntry, SkillAllowlistMode } from '@/types'
@@ -18,11 +20,17 @@ export async function GET(req: Request) {
   }
 
   try {
-    const result = await gw.rpc('skills.status', { agentId }) as OpenClawSkillEntry[] | undefined
-    return NextResponse.json(result ?? [])
+    const gatewayAgentId = await resolveOpenClawGatewayAgentId(agentId, gw)
+    const result = await gw.rpc('skills.status', { agentId: gatewayAgentId }) as unknown
+    return NextResponse.json(normalizeOpenClawSkillsPayload(result))
   } catch (err: unknown) {
     const message = err instanceof Error ? err.message : String(err)
-    return NextResponse.json({ error: message }, { status: 502 })
+    const status = message.includes('not an OpenClaw agent')
+      ? 400
+      : message.includes('not found')
+        ? 404
+        : 502
+    return NextResponse.json({ error: message }, { status })
   }
 }
 

package/src/app/api/plugins/dependencies/route.ts

@@ -0,0 +1,24 @@
+import { NextResponse } from 'next/server'
+import { getPluginManager } from '@/lib/server/plugins'
+
+export async function POST(req: Request) {
+  const body = await req.json()
+  const filename = typeof body?.filename === 'string' ? body.filename : ''
+  const packageManager = typeof body?.packageManager === 'string' ? body.packageManager : undefined
+
+  if (!filename) {
+    return NextResponse.json({ error: 'filename is required' }, { status: 400 })
+  }
+
+  try {
+    const result = await getPluginManager().installPluginDependencies(filename, {
+      packageManager: packageManager as import('@/types').PluginPackageManager | undefined,
+    })
+    return NextResponse.json({ ok: true, dependencyInfo: result })
+  } catch (err: unknown) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : String(err) },
+      { status: 400 },
+    )
+  }
+}

package/src/app/api/plugins/install/route.ts

@@ -1,110 +1,33 @@
 import { NextResponse } from 'next/server'
-import fs from 'fs'
-import path from 'path'
-import { getPluginManager } from '@/lib/server/plugins'
-
-const PLUGINS_DIR = path.join(process.cwd(), 'data', 'plugins')
-
-function toRawUrl(url: string): string {
-  if (url.includes('github.com') && url.includes('/blob/')) {
-    return url.replace('github.com', 'raw.githubusercontent.com').replace('/blob/', '/')
-  }
-  if (url.includes('gist.github.com')) {
-    return url.endsWith('/raw') ? url : `${url}/raw`
-  }
-  return url
-}
-
-function normalizeMarketplaceUrl(url: string): string {
-  const trimmed = typeof url === 'string' ? url.trim() : ''
-  if (!trimmed) return trimmed
-
-  let normalized = trimmed
-    .replace('github.com/swarmclawai/plugins/', 'github.com/swarmclawai/swarmforge/')
-    .replace('raw.githubusercontent.com/swarmclawai/plugins/', 'raw.githubusercontent.com/swarmclawai/swarmforge/')
-
-  normalized = toRawUrl(normalized)
-
-  // Legacy registry entries used master and old repo names.
-  normalized = normalized
-    .replace('/swarmclawai/swarmforge/master/', '/swarmclawai/swarmforge/main/')
-    .replace('/swarmclawai/plugins/master/', '/swarmclawai/swarmforge/main/')
-    .replace('/swarmclawai/plugins/main/', '/swarmclawai/swarmforge/main/')
-
-  return normalized
-}
+import { getPluginManager, sanitizePluginFilename } from '@/lib/server/plugins'
 
 export async function POST(req: Request) {
   const body = await req.json()
-  const { url, filename } = body
-  const rawUrl = normalizeMarketplaceUrl(url)
+  const url = typeof body?.url === 'string' ? body.url : ''
+  const filename = typeof body?.filename === 'string' ? body.filename : ''
 
-  // Validate URL
-  if (!url || typeof url !== 'string' || !url.startsWith('https://')) {
+  if (!url || !url.startsWith('https://')) {
     return NextResponse.json(
       { error: 'URL must be a valid HTTPS URL' },
       { status: 400 },
     )
   }
 
-  // Validate filename
-  if (!filename || typeof filename !== 'string' || !filename.endsWith('.js')) {
-    return NextResponse.json(
-      { error: 'Filename must end in .js' },
-      { status: 400 },
-    )
-  }
-
-  // Path traversal protection
-  const sanitized = path.basename(filename)
-  if (sanitized !== filename || filename.includes('..')) {
-    return NextResponse.json(
-      { error: 'Invalid filename' },
-      { status: 400 },
-    )
-  }
-
   try {
-    const res = await fetch(rawUrl, { signal: AbortSignal.timeout(15_000) })
-    if (!res.ok) {
-      return NextResponse.json(
-        { error: `Download failed (HTTP ${res.status}) from ${rawUrl}` },
-        { status: 502 },
-      )
-    }
-    const contentType = res.headers.get('content-type') || ''
-    let code = await res.text()
-
-    // Reject HTML responses (likely a GitHub page, not raw content)
-    if (contentType.includes('text/html') && code.includes('<!DOCTYPE')) {
-      return NextResponse.json(
-        { error: 'URL returned an HTML page instead of JavaScript. Use a raw/direct link to the .js file.' },
-        { status: 400 },
-      )
-    }
-
-    // Compatibility fix: Strip node-fetch requires if present, as modern Node has global fetch
-    code = code.replace(/const\s+fetch\s*=\s*require\(['"]node-fetch['"]\);?/g, '// node-fetch stripped for compatibility')
-    code = code.replace(/import\s+fetch\s+from\s+['"]node-fetch['"];?/g, '// node-fetch stripped for compatibility')
-
-    // Ensure plugins directory exists
-    if (!fs.existsSync(PLUGINS_DIR)) {
-      fs.mkdirSync(PLUGINS_DIR, { recursive: true })
-    }
-
-    const dest = path.join(PLUGINS_DIR, sanitized)
-    fs.writeFileSync(dest, code, 'utf8')
-
-    // Force plugin manager to re-scan so the new plugin appears in listings
-    getPluginManager().reload()
-
-    return NextResponse.json({ ok: true, filename: sanitized })
+    const sanitizedFilename = sanitizePluginFilename(filename)
+    const installed = await getPluginManager().installPluginFromUrl(url, sanitizedFilename)
+    return NextResponse.json({ ok: true, filename: installed.filename, hash: installed.sourceHash })
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : String(err)
-    const isTimeout = msg.includes('abort') || msg.includes('timeout')
+    const isTimeout = /abort|timeout/i.test(msg)
+    const status = /valid HTTPS URL|Filename|Invalid filename|HTML page|too large/i.test(msg)
+      ? 400
+      : isTimeout
+        ? 504
+        : 500
     return NextResponse.json(
-      { error: isTimeout ? 'Download timed out — the plugin URL may be unreachable' : `Install failed: ${msg}` },
-      { status: isTimeout ? 504 : 500 },
+      { error: isTimeout ? 'Download timed out — the plugin URL may be unreachable' : msg },
+      { status },
     )
   }
 }

package/src/app/api/plugins/route.ts

@@ -1,31 +1,7 @@
 import { NextResponse } from 'next/server'
 import { getPluginManager } from '@/lib/server/plugins'
-
-// Ensure all builtin plugins are registered by importing their modules
-import '@/lib/server/session-tools/shell'
-import '@/lib/server/session-tools/file'
-import '@/lib/server/session-tools/edit_file'
-import '@/lib/server/session-tools/web'
-import '@/lib/server/session-tools/memory'
-import '@/lib/server/session-tools/platform'
-import '@/lib/server/session-tools/monitor'
-import '@/lib/server/session-tools/discovery'
-import '@/lib/server/session-tools/sample-ui'
-import '@/lib/server/session-tools/git'
-import '@/lib/server/session-tools/wallet'
-import '@/lib/server/session-tools/connector'
-import '@/lib/server/session-tools/http'
-import '@/lib/server/session-tools/sandbox'
-import '@/lib/server/session-tools/canvas'
-import '@/lib/server/session-tools/chatroom'
-import '@/lib/server/session-tools/delegate'
-import '@/lib/server/session-tools/schedule'
-import '@/lib/server/session-tools/session-info'
-import '@/lib/server/session-tools/openclaw-nodes'
-import '@/lib/server/session-tools/openclaw-workspace'
-import '@/lib/server/session-tools/context-mgmt'
-import '@/lib/server/session-tools/subagent'
-import '@/lib/server/session-tools/plugin-creator'
+import { notify } from '@/lib/server/ws-hub'
+import '@/lib/server/builtin-plugins'
 
 export const dynamic = 'force-dynamic'
 
@@ -44,6 +20,7 @@ export async function POST(req: Request) {
 
   const manager = getPluginManager()
   manager.setEnabled(filename, enabled)
+  notify('plugins')
 
   return NextResponse.json({ ok: true })
 }
@@ -59,6 +36,7 @@ export async function DELETE(req: Request) {
   if (!deleted) {
     return NextResponse.json({ error: 'Cannot delete built-in or non-existent plugin' }, { status: 400 })
   }
+  notify('plugins')
   return NextResponse.json({ ok: true })
 }
 
@@ -71,11 +49,13 @@ export async function PATCH(req: Request) {
   
   if (all) {
     await manager.updateAllPlugins()
+    notify('plugins')
     return NextResponse.json({ ok: true, message: 'All plugins updated' })
   }
   
   if (id) {
     await manager.updatePlugin(id)
+    notify('plugins')
     return NextResponse.json({ ok: true, message: `Plugin ${id} updated` })
   }
   

package/src/app/api/plugins/settings/route.ts

@@ -0,0 +1,40 @@
+import { NextResponse } from 'next/server'
+import { getPluginManager } from '@/lib/server/plugins'
+import '@/lib/server/builtin-plugins'
+
+export const dynamic = 'force-dynamic'
+
+/** GET /api/plugins/settings?pluginId=X — read per-plugin settings */
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const pluginId = searchParams.get('pluginId')
+  if (!pluginId) {
+    return NextResponse.json({ error: 'pluginId required' }, { status: 400 })
+  }
+
+  return NextResponse.json(getPluginManager().getPublicPluginSettings(pluginId))
+}
+
+/** PUT /api/plugins/settings?pluginId=X — write per-plugin settings */
+export async function PUT(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const pluginId = searchParams.get('pluginId')
+  if (!pluginId) {
+    return NextResponse.json({ error: 'pluginId required' }, { status: 400 })
+  }
+
+  try {
+    const body = await req.json() as Record<string, unknown>
+    const saved = getPluginManager().setPluginSettings(pluginId, body)
+    return NextResponse.json({
+      ok: true,
+      values: saved,
+      configuredSecretFields: getPluginManager().getPublicPluginSettings(pluginId).configuredSecretFields,
+    })
+  } catch (err: unknown) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : String(err) },
+      { status: 400 },
+    )
+  }
+}

package/src/app/api/plugins/ui/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { getPluginManager } from '@/lib/server/plugins'
+import '@/lib/server/builtin-plugins'
 
 export const dynamic = 'force-dynamic'
 

package/src/app/api/settings/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import { loadSettings, saveSettings } from '@/lib/server/storage'
+import { loadPublicSettings, loadSettings, saveSettings } from '@/lib/server/storage'
 import { DEFAULT_DELEGATION_MAX_DEPTH } from '@/lib/runtime-loop'
 export const dynamic = 'force-dynamic'
 
@@ -20,6 +20,9 @@ const TASK_QG_MIN_RESULT_MIN = 10
 const TASK_QG_MIN_RESULT_MAX = 2000
 const TASK_QG_MIN_EVIDENCE_MIN = 0
 const TASK_QG_MIN_EVIDENCE_MAX = 8
+const SESSION_RESET_TIMEOUT_MIN = 0
+const SESSION_RESET_TIMEOUT_MAX = 365 * 24 * 60 * 60
+const SECRET_SETTING_KEYS = ['elevenLabsApiKey', 'tavilyApiKey', 'braveApiKey'] as const
 
 function parseIntSetting(value: unknown, fallback: number, min: number, max: number): number {
   const parsed = typeof value === 'number'
@@ -42,13 +45,25 @@ function parseBoolSetting(value: unknown, fallback: boolean): boolean {
 }
 
 export async function GET(_req: Request) {
-  return NextResponse.json(loadSettings())
+  return NextResponse.json(loadPublicSettings())
 }
 
 export async function PUT(req: Request) {
-  const body = await req.json()
+  const body = await req.json() as Record<string, unknown>
+  const sanitizedBody: Record<string, unknown> = { ...body }
+
+  delete sanitizedBody.__encryptedAppSettings
+
+  for (const key of SECRET_SETTING_KEYS) {
+    const configuredKey = `${key}Configured`
+    if (sanitizedBody[key] === null && sanitizedBody[configuredKey] === true) {
+      delete sanitizedBody[key]
+    }
+    delete sanitizedBody[configuredKey]
+  }
+
   const settings = loadSettings()
-  Object.assign(settings, body)
+  Object.assign(settings, sanitizedBody)
 
   const nextDepth = parseIntSetting(
     settings.memoryReferenceDepth ?? settings.memoryMaxDepth,
@@ -116,16 +131,43 @@ export async function PUT(req: Request) {
   settings.taskQualityGateRequireArtifact = parseBoolSetting(settings.taskQualityGateRequireArtifact, false)
   settings.taskQualityGateRequireReport = parseBoolSetting(settings.taskQualityGateRequireReport, false)
   settings.integrityMonitorEnabled = parseBoolSetting(settings.integrityMonitorEnabled, true)
+  settings.sessionResetMode = settings.sessionResetMode === 'daily' ? 'daily' : settings.sessionResetMode === 'idle' ? 'idle' : null
+  settings.sessionIdleTimeoutSec = parseIntSetting(
+    settings.sessionIdleTimeoutSec,
+    12 * 60 * 60,
+    SESSION_RESET_TIMEOUT_MIN,
+    SESSION_RESET_TIMEOUT_MAX,
+  )
+  settings.sessionMaxAgeSec = parseIntSetting(
+    settings.sessionMaxAgeSec,
+    7 * 24 * 60 * 60,
+    SESSION_RESET_TIMEOUT_MIN,
+    SESSION_RESET_TIMEOUT_MAX,
+  )
+  if (typeof settings.sessionDailyResetAt === 'string') settings.sessionDailyResetAt = settings.sessionDailyResetAt.trim() || null
+  if (typeof settings.sessionResetTimezone === 'string') settings.sessionResetTimezone = settings.sessionResetTimezone.trim() || null
 
   saveSettings(settings)
 
   // Restart heartbeat service when heartbeat-related settings change
-  const heartbeatKeys = ['heartbeatIntervalSec', 'heartbeatInterval', 'heartbeatPrompt', 'heartbeatEnabled', 'heartbeatActiveStart', 'heartbeatActiveEnd']
-  if (heartbeatKeys.some((k) => k in body)) {
+  const heartbeatKeys = [
+    'heartbeatIntervalSec',
+    'heartbeatInterval',
+    'heartbeatPrompt',
+    'heartbeatEnabled',
+    'heartbeatActiveStart',
+    'heartbeatActiveEnd',
+    'sessionResetMode',
+    'sessionIdleTimeoutSec',
+    'sessionMaxAgeSec',
+    'sessionDailyResetAt',
+    'sessionResetTimezone',
+  ]
+  if (heartbeatKeys.some((k) => k in sanitizedBody)) {
     import('@/lib/server/heartbeat-service').then(({ restartHeartbeatService }) => {
       restartHeartbeatService()
     }).catch(() => { /* heartbeat service may not be initialized yet */ })
   }
 
-  return NextResponse.json(settings)
+  return NextResponse.json(loadPublicSettings())
 }

package/src/app/api/tasks/[id]/route.ts

@@ -1,6 +1,6 @@
 import { genId } from '@/lib/id'
 import { NextResponse } from 'next/server'
-import { loadTasks, saveTasks, logActivity, loadSettings } from '@/lib/server/storage'
+import { loadAgents, loadSettings, loadTasks, logActivity, upsertStoredItems, upsertTask } from '@/lib/server/storage'
 import { notFound } from '@/lib/server/collection-helpers'
 import { disableSessionHeartbeat, enqueueTask, recoverStalledRunningTasks, validateCompletedTasksQueue } from '@/lib/server/queue'
 import { ensureTaskCompletionReport } from '@/lib/server/task-reports'
@@ -13,6 +13,7 @@ import { requestHeartbeatNow } from '@/lib/server/heartbeat-wake'
 import { validateDag, cascadeUnblock } from '@/lib/server/dag-validation'
 import { getPluginManager } from '@/lib/server/plugins'
 import { normalizeTaskQualityGate } from '@/lib/server/task-quality-gate'
+import '@/lib/server/builtin-plugins'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   // Keep completed queue integrity even if daemon is not running.
@@ -90,7 +91,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     }
   }
 
-  saveTasks(tasks)
+  upsertTask(id, tasks[id])
   logActivity({ entityType: 'task', entityId: id, action: 'updated', actor: 'user', summary: `Task updated: "${tasks[id].title}" (${prevStatus} → ${tasks[id].status})` })
   if (prevStatus !== tasks[id].status) {
     pushMainLoopEventToMainSessions({
@@ -111,7 +112,12 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     })
     
     if (tasks[id].status === 'completed') {
-      getPluginManager().runHook('onTaskComplete', { taskId: id, result: tasks[id].result })
+      const agentPlugins = tasks[id].agentId ? (loadAgents()[tasks[id].agentId]?.plugins || []) : []
+      getPluginManager().runHook(
+        'onTaskComplete',
+        { taskId: id, result: tasks[id].result },
+        { enabledIds: agentPlugins },
+      )
     }
 
     // Enqueue system event + heartbeat wake
@@ -131,7 +137,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       // Revert status change and reject
       tasks[id].status = prevStatus
       tasks[id].updatedAt = Date.now()
-      saveTasks(tasks)
+      upsertTask(id, tasks[id])
       return NextResponse.json(
         { error: 'Cannot queue: blocked by incomplete tasks', blockedBy: incompleteBlocker },
         { status: 409 },
@@ -143,7 +149,10 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   if (tasks[id].status === 'completed') {
     const unblockedIds = cascadeUnblock(tasks, id)
     if (unblockedIds.length > 0) {
-      saveTasks(tasks)
+      upsertStoredItems('tasks', [
+        [id, tasks[id]],
+        ...unblockedIds.map((uid) => [uid, tasks[uid]] as [string, any]),
+      ])
       for (const uid of unblockedIds) {
         enqueueTask(uid)
       }
@@ -168,7 +177,7 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
   tasks[id].status = 'archived'
   tasks[id].archivedAt = Date.now()
   tasks[id].updatedAt = Date.now()
-  saveTasks(tasks)
+  upsertTask(id, tasks[id])
   logActivity({ entityType: 'task', entityId: id, action: 'deleted', actor: 'user', summary: `Task archived: "${tasks[id].title}"` })
   pushMainLoopEventToMainSessions({
     type: 'task_archived',

package/src/app/api/tasks/bulk/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import { loadTasks, saveTasks, logActivity } from '@/lib/server/storage'
+import { loadTasks, logActivity, upsertStoredItems } from '@/lib/server/storage'
 import { enqueueTask, disableSessionHeartbeat } from '@/lib/server/queue'
 import { pushMainLoopEventToMainSessions } from '@/lib/server/main-agent-loop'
 import { notify } from '@/lib/server/ws-hub'
@@ -82,7 +82,7 @@ export async function POST(req: Request) {
     }
   }
 
-  saveTasks(tasks)
+  upsertStoredItems('tasks', results.map((id) => [id, tasks[id]] as [string, any]))
 
   if (updated > 0) {
     const action = body.status