@swarmclawai/swarmclaw 0.7.2 → 0.7.4

package/src/app/api/plugins/route.ts

@@ -1,32 +1,7 @@
 import { NextResponse } from 'next/server'
 import { getPluginManager } from '@/lib/server/plugins'
 import { notify } from '@/lib/server/ws-hub'
-
-// Ensure all builtin plugins are registered by importing their modules
-import '@/lib/server/session-tools/shell'
-import '@/lib/server/session-tools/file'
-import '@/lib/server/session-tools/edit_file'
-import '@/lib/server/session-tools/web'
-import '@/lib/server/session-tools/memory'
-import '@/lib/server/session-tools/platform'
-import '@/lib/server/session-tools/monitor'
-import '@/lib/server/session-tools/discovery'
-import '@/lib/server/session-tools/sample-ui'
-import '@/lib/server/session-tools/git'
-import '@/lib/server/session-tools/wallet'
-import '@/lib/server/session-tools/connector'
-import '@/lib/server/session-tools/http'
-import '@/lib/server/session-tools/sandbox'
-import '@/lib/server/session-tools/canvas'
-import '@/lib/server/session-tools/chatroom'
-import '@/lib/server/session-tools/delegate'
-import '@/lib/server/session-tools/schedule'
-import '@/lib/server/session-tools/session-info'
-import '@/lib/server/session-tools/openclaw-nodes'
-import '@/lib/server/session-tools/openclaw-workspace'
-import '@/lib/server/session-tools/context-mgmt'
-import '@/lib/server/session-tools/subagent'
-import '@/lib/server/session-tools/plugin-creator'
+import '@/lib/server/builtin-plugins'
 
 export const dynamic = 'force-dynamic'
 
@@ -74,11 +49,13 @@ export async function PATCH(req: Request) {
   
   if (all) {
     await manager.updateAllPlugins()
+    notify('plugins')
     return NextResponse.json({ ok: true, message: 'All plugins updated' })
   }
   
   if (id) {
     await manager.updatePlugin(id)
+    notify('plugins')
     return NextResponse.json({ ok: true, message: `Plugin ${id} updated` })
   }
   

package/src/app/api/plugins/settings/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
-import { loadSettings, saveSettings } from '@/lib/server/storage'
+import { getPluginManager } from '@/lib/server/plugins'
+import '@/lib/server/builtin-plugins'
 
 export const dynamic = 'force-dynamic'
 
@@ -11,9 +12,7 @@ export async function GET(req: Request) {
     return NextResponse.json({ error: 'pluginId required' }, { status: 400 })
   }
 
-  const settings = loadSettings()
-  const pluginSettings = (settings.pluginSettings as Record<string, Record<string, unknown>> | undefined) ?? {}
-  return NextResponse.json(pluginSettings[pluginId] ?? {})
+  return NextResponse.json(getPluginManager().getPublicPluginSettings(pluginId))
 }
 
 /** PUT /api/plugins/settings?pluginId=X — write per-plugin settings */
@@ -24,12 +23,18 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'pluginId required' }, { status: 400 })
   }
 
-  const body = await req.json() as Record<string, unknown>
-  const settings = loadSettings()
-  const pluginSettings = (settings.pluginSettings as Record<string, Record<string, unknown>> | undefined) ?? {}
-  pluginSettings[pluginId] = body
-  settings.pluginSettings = pluginSettings
-  saveSettings(settings)
-
-  return NextResponse.json({ ok: true })
+  try {
+    const body = await req.json() as Record<string, unknown>
+    const saved = getPluginManager().setPluginSettings(pluginId, body)
+    return NextResponse.json({
+      ok: true,
+      values: saved,
+      configuredSecretFields: getPluginManager().getPublicPluginSettings(pluginId).configuredSecretFields,
+    })
+  } catch (err: unknown) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : String(err) },
+      { status: 400 },
+    )
+  }
 }

package/src/app/api/plugins/ui/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { getPluginManager } from '@/lib/server/plugins'
+import '@/lib/server/builtin-plugins'
 
 export const dynamic = 'force-dynamic'
 

package/src/app/api/providers/[id]/discover-models/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from 'next/server'
+import { discoverProviderModels } from '@/lib/server/provider-model-discovery'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(
+  req: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { id } = await params
+  const { searchParams } = new URL(req.url)
+  const result = await discoverProviderModels({
+    providerId: id,
+    credentialId: searchParams.get('credentialId'),
+    endpoint: searchParams.get('endpoint'),
+    force: searchParams.get('force') === '1',
+    requiresApiKey: searchParams.has('requiresApiKey')
+      ? searchParams.get('requiresApiKey') !== '0'
+      : undefined,
+  })
+
+  return NextResponse.json(result, {
+    headers: {
+      'Cache-Control': 'private, no-store',
+    },
+  })
+}

package/src/app/api/schedules/[id]/route.ts

@@ -1,7 +1,9 @@
 import { NextResponse } from 'next/server'
-import { loadSchedules, saveSchedules, deleteSchedule } from '@/lib/server/storage'
+import { loadAgents, loadSchedules, loadSessions, saveSchedules, deleteSchedule } from '@/lib/server/storage'
+import { WORKSPACE_DIR } from '@/lib/server/data-dir'
 import { resolveScheduleName } from '@/lib/schedule-name'
 import { mutateItem, deleteItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
+import { normalizeSchedulePayload } from '@/lib/server/schedule-normalization'
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const ops: CollectionOps<any> = { load: loadSchedules, save: saveSchedules, deleteFn: deleteSchedule, topic: 'schedules' }
@@ -9,15 +11,42 @@ const ops: CollectionOps<any> = { load: loadSchedules, save: saveSchedules, dele
 export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
   const { id } = await params
   const body = await req.json()
-  const result = mutateItem(ops, id, (schedule) => {
-    Object.assign(schedule, body)
-    schedule.id = id
-    schedule.name = resolveScheduleName({
-      name: schedule.name,
-      taskPrompt: schedule.taskPrompt,
+  const sessions = loadSessions()
+  const agents = loadAgents()
+  let result = null
+  try {
+    result = mutateItem(ops, id, (schedule) => {
+      const sessionCwd = typeof schedule.createdInSessionId === 'string'
+        ? sessions[schedule.createdInSessionId]?.cwd
+        : null
+      const normalized = normalizeSchedulePayload({
+        ...schedule,
+        ...(body as Record<string, unknown>),
+        id,
+      }, {
+        cwd: sessionCwd || WORKSPACE_DIR,
+        now: Date.now(),
+      })
+      if (!normalized.ok) throw new Error(normalized.error)
+      const nextSchedule = {
+        ...schedule,
+        ...normalized.value,
+        id,
+        updatedAt: Date.now(),
+      }
+      if (!agents[String(nextSchedule.agentId)]) {
+        throw new Error(`Agent not found: ${String(nextSchedule.agentId)}`)
+      }
+      nextSchedule.name = resolveScheduleName({
+        name: nextSchedule.name,
+        taskPrompt: nextSchedule.taskPrompt,
+      })
+      return nextSchedule
     })
-    return schedule
-  })
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error)
+    return NextResponse.json({ error: message }, { status: 400 })
+  }
   if (!result) return notFound()
   return NextResponse.json(result)
 }

package/src/app/api/schedules/route.ts

@@ -1,11 +1,31 @@
 import { NextResponse } from 'next/server'
 import { genId } from '@/lib/id'
-import { loadSchedules, saveSchedules } from '@/lib/server/storage'
+import { loadAgents, loadSchedules, saveSchedules } from '@/lib/server/storage'
+import { WORKSPACE_DIR } from '@/lib/server/data-dir'
+import { normalizeSchedulePayload } from '@/lib/server/schedule-normalization'
 import { resolveScheduleName } from '@/lib/schedule-name'
 import { findDuplicateSchedule } from '@/lib/schedule-dedupe'
 import { notify } from '@/lib/server/ws-hub'
 export const dynamic = 'force-dynamic'
 
+function asString(value: unknown): string {
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+function asPositiveInt(value: unknown): number | null {
+  const parsed = typeof value === 'number'
+    ? value
+    : typeof value === 'string'
+      ? Number.parseInt(value, 10)
+      : Number.NaN
+  if (!Number.isFinite(parsed)) return null
+  const intValue = Math.trunc(parsed)
+  return intValue > 0 ? intValue : null
+}
+
+function asScheduleType(value: unknown): 'cron' | 'interval' | 'once' {
+  return value === 'cron' || value === 'interval' || value === 'once' ? value : 'cron'
+}
 
 export async function GET(_req: Request) {
   return NextResponse.json(loadSchedules())
@@ -15,28 +35,46 @@ export async function POST(req: Request) {
   const body = await req.json()
   const now = Date.now()
   const schedules = loadSchedules()
-  const scheduleType = body.scheduleType || 'cron'
+  const normalizedSchedule = normalizeSchedulePayload(body as Record<string, unknown>, {
+    cwd: WORKSPACE_DIR,
+    now,
+  })
+  if (!normalizedSchedule.ok) {
+    return NextResponse.json({ error: normalizedSchedule.error }, { status: 400 })
+  }
+
+  const candidate = normalizedSchedule.value
+  const agents = loadAgents()
+  if (!agents[String(candidate.agentId)]) {
+    return NextResponse.json({ error: `Agent not found: ${String(candidate.agentId)}` }, { status: 400 })
+  }
+  const scheduleType = asScheduleType(candidate.scheduleType)
+  const candidateAgentId = asString(candidate.agentId) || null
+  const candidateTaskPrompt = asString(candidate.taskPrompt)
+  const candidateCron = asString(candidate.cron) || null
+  const candidateIntervalMs = asPositiveInt(candidate.intervalMs)
+  const candidateRunAt = asPositiveInt(candidate.runAt)
 
   const duplicate = findDuplicateSchedule(schedules, {
-    agentId: body.agentId || null,
-    taskPrompt: body.taskPrompt || '',
+    agentId: candidateAgentId,
+    taskPrompt: candidateTaskPrompt,
     scheduleType,
-    cron: body.cron,
-    intervalMs: body.intervalMs,
-    runAt: body.runAt,
+    cron: candidateCron,
+    intervalMs: candidateIntervalMs,
+    runAt: candidateRunAt,
   })
   if (duplicate) {
     const duplicateId = duplicate.id || ''
     let changed = false
     const nextName = resolveScheduleName({
-      name: body.name ?? duplicate.name,
-      taskPrompt: body.taskPrompt ?? duplicate.taskPrompt,
+      name: candidate.name ?? duplicate.name,
+      taskPrompt: candidate.taskPrompt ?? duplicate.taskPrompt,
     })
     if (nextName && nextName !== duplicate.name) {
       duplicate.name = nextName
       changed = true
     }
-    const normalizedStatus = typeof body.status === 'string' ? body.status.trim().toLowerCase() : ''
+    const normalizedStatus = typeof candidate.status === 'string' ? candidate.status.trim().toLowerCase() : ''
     if ((normalizedStatus === 'active' || normalizedStatus === 'paused') && duplicate.status !== normalizedStatus) {
       duplicate.status = normalizedStatus as 'active' | 'paused'
       changed = true
@@ -53,29 +91,14 @@ export async function POST(req: Request) {
 
   const id = genId()
 
-  let nextRunAt: number | undefined
-  if (scheduleType === 'once' && body.runAt) {
-    nextRunAt = body.runAt
-  } else if (scheduleType === 'interval' && body.intervalMs) {
-    nextRunAt = now + body.intervalMs
-  } else if (scheduleType === 'cron') {
-    // nextRunAt will be computed by the scheduler engine
-    nextRunAt = undefined
-  }
-
   schedules[id] = {
     id,
-    name: resolveScheduleName({ name: body.name, taskPrompt: body.taskPrompt }),
-    agentId: body.agentId,
-    taskPrompt: body.taskPrompt || '',
+    ...candidate,
+    name: resolveScheduleName({ name: candidate.name, taskPrompt: candidate.taskPrompt }),
     scheduleType,
-    cron: body.cron,
-    intervalMs: body.intervalMs,
-    runAt: body.runAt,
     lastRunAt: undefined,
-    nextRunAt,
-    status: body.status || 'active',
     createdAt: now,
+    updatedAt: now,
   }
   saveSchedules(schedules)
   notify('schedules')

package/src/app/api/settings/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
-import { loadSettings, saveSettings } from '@/lib/server/storage'
-import { DEFAULT_DELEGATION_MAX_DEPTH } from '@/lib/runtime-loop'
+import { normalizeHeartbeatSettingFields } from '@/lib/heartbeat-defaults'
+import { loadPublicSettings, loadSettings, saveSettings } from '@/lib/server/storage'
+import { normalizeRuntimeSettingFields } from '@/lib/runtime-loop'
 export const dynamic = 'force-dynamic'
 
 
@@ -10,8 +11,6 @@ const MEMORY_PER_LOOKUP_MIN = 1
 const MEMORY_PER_LOOKUP_MAX = 200
 const MEMORY_LINKED_MIN = 0
 const MEMORY_LINKED_MAX = 1000
-const DELEGATION_DEPTH_MIN = 1
-const DELEGATION_DEPTH_MAX = 12
 const RESPONSE_CACHE_TTL_MIN_SEC = 5
 const RESPONSE_CACHE_TTL_MAX_SEC = 7 * 24 * 3600
 const RESPONSE_CACHE_MAX_ENTRIES_MIN = 1
@@ -20,6 +19,9 @@ const TASK_QG_MIN_RESULT_MIN = 10
 const TASK_QG_MIN_RESULT_MAX = 2000
 const TASK_QG_MIN_EVIDENCE_MIN = 0
 const TASK_QG_MIN_EVIDENCE_MAX = 8
+const SESSION_RESET_TIMEOUT_MIN = 0
+const SESSION_RESET_TIMEOUT_MAX = 365 * 24 * 60 * 60
+const SECRET_SETTING_KEYS = ['elevenLabsApiKey', 'tavilyApiKey', 'braveApiKey'] as const
 
 function parseIntSetting(value: unknown, fallback: number, min: number, max: number): number {
   const parsed = typeof value === 'number'
@@ -42,13 +44,25 @@ function parseBoolSetting(value: unknown, fallback: boolean): boolean {
 }
 
 export async function GET(_req: Request) {
-  return NextResponse.json(loadSettings())
+  return NextResponse.json(loadPublicSettings())
 }
 
 export async function PUT(req: Request) {
-  const body = await req.json()
+  const body = await req.json() as Record<string, unknown>
+  const sanitizedBody: Record<string, unknown> = { ...body }
+
+  delete sanitizedBody.__encryptedAppSettings
+
+  for (const key of SECRET_SETTING_KEYS) {
+    const configuredKey = `${key}Configured`
+    if (sanitizedBody[key] === null && sanitizedBody[configuredKey] === true) {
+      delete sanitizedBody[key]
+    }
+    delete sanitizedBody[configuredKey]
+  }
+
   const settings = loadSettings()
-  Object.assign(settings, body)
+  Object.assign(settings, sanitizedBody)
 
   const nextDepth = parseIntSetting(
     settings.memoryReferenceDepth ?? settings.memoryMaxDepth,
@@ -68,12 +82,8 @@ export async function PUT(req: Request) {
     MEMORY_LINKED_MIN,
     MEMORY_LINKED_MAX,
   )
-  const nextDelegationDepth = parseIntSetting(
-    settings.delegationMaxDepth,
-    DEFAULT_DELEGATION_MAX_DEPTH,
-    DELEGATION_DEPTH_MIN,
-    DELEGATION_DEPTH_MAX,
-  )
+  const normalizedRuntime = normalizeRuntimeSettingFields(settings)
+  const normalizedHeartbeat = normalizeHeartbeatSettingFields(settings)
   const nextResponseCacheTtlSec = parseIntSetting(
     settings.responseCacheTtlSec,
     15 * 60,
@@ -105,7 +115,8 @@ export async function PUT(req: Request) {
   settings.maxMemoriesPerLookup = nextPerLookup
   settings.memoryMaxPerLookup = nextPerLookup
   settings.maxLinkedMemoriesExpanded = nextLinked
-  settings.delegationMaxDepth = nextDelegationDepth
+  Object.assign(settings, normalizedRuntime)
+  Object.assign(settings, normalizedHeartbeat)
   settings.responseCacheTtlSec = nextResponseCacheTtlSec
   settings.responseCacheMaxEntries = nextResponseCacheMaxEntries
   settings.responseCacheEnabled = parseBoolSetting(settings.responseCacheEnabled, true)
@@ -116,16 +127,43 @@ export async function PUT(req: Request) {
   settings.taskQualityGateRequireArtifact = parseBoolSetting(settings.taskQualityGateRequireArtifact, false)
   settings.taskQualityGateRequireReport = parseBoolSetting(settings.taskQualityGateRequireReport, false)
   settings.integrityMonitorEnabled = parseBoolSetting(settings.integrityMonitorEnabled, true)
+  settings.sessionResetMode = settings.sessionResetMode === 'daily' ? 'daily' : settings.sessionResetMode === 'idle' ? 'idle' : null
+  settings.sessionIdleTimeoutSec = parseIntSetting(
+    settings.sessionIdleTimeoutSec,
+    12 * 60 * 60,
+    SESSION_RESET_TIMEOUT_MIN,
+    SESSION_RESET_TIMEOUT_MAX,
+  )
+  settings.sessionMaxAgeSec = parseIntSetting(
+    settings.sessionMaxAgeSec,
+    7 * 24 * 60 * 60,
+    SESSION_RESET_TIMEOUT_MIN,
+    SESSION_RESET_TIMEOUT_MAX,
+  )
+  if (typeof settings.sessionDailyResetAt === 'string') settings.sessionDailyResetAt = settings.sessionDailyResetAt.trim() || null
+  if (typeof settings.sessionResetTimezone === 'string') settings.sessionResetTimezone = settings.sessionResetTimezone.trim() || null
 
   saveSettings(settings)
 
   // Restart heartbeat service when heartbeat-related settings change
-  const heartbeatKeys = ['heartbeatIntervalSec', 'heartbeatInterval', 'heartbeatPrompt', 'heartbeatEnabled', 'heartbeatActiveStart', 'heartbeatActiveEnd']
-  if (heartbeatKeys.some((k) => k in body)) {
+  const heartbeatKeys = [
+    'heartbeatIntervalSec',
+    'heartbeatInterval',
+    'heartbeatPrompt',
+    'heartbeatEnabled',
+    'heartbeatActiveStart',
+    'heartbeatActiveEnd',
+    'sessionResetMode',
+    'sessionIdleTimeoutSec',
+    'sessionMaxAgeSec',
+    'sessionDailyResetAt',
+    'sessionResetTimezone',
+  ]
+  if (heartbeatKeys.some((k) => k in sanitizedBody)) {
     import('@/lib/server/heartbeat-service').then(({ restartHeartbeatService }) => {
       restartHeartbeatService()
     }).catch(() => { /* heartbeat service may not be initialized yet */ })
   }
 
-  return NextResponse.json(settings)
+  return NextResponse.json(loadPublicSettings())
 }

package/src/app/api/setup/doctor/route.ts

@@ -90,12 +90,14 @@ export async function GET(req: Request) {
   const checkedAt = Date.now()
 
   const nodeVersion = process.versions.node
-  const nodeMajor = Number.parseInt(String(nodeVersion).split('.')[0] || '0', 10)
-  if (nodeMajor >= 20) {
+  const [nodeMajorRaw, nodeMinorRaw] = String(nodeVersion).split('.')
+  const nodeMajor = Number.parseInt(nodeMajorRaw || '0', 10)
+  const nodeMinor = Number.parseInt(nodeMinorRaw || '0', 10)
+  if (nodeMajor > 22 || (nodeMajor === 22 && nodeMinor >= 6)) {
     pushCheck(checks, 'node-version', 'Node.js version', 'pass', `Detected Node ${nodeVersion}.`, true)
   } else {
-    pushCheck(checks, 'node-version', 'Node.js version', 'fail', `Detected Node ${nodeVersion}. Node 20+ is required.`, true)
-    actions.push('Install Node.js 20 or newer from https://nodejs.org and rerun setup.')
+    pushCheck(checks, 'node-version', 'Node.js version', 'fail', `Detected Node ${nodeVersion}. Node 22.6+ is required.`, true)
+    actions.push('Install Node.js 22.6 or newer from https://nodejs.org and rerun setup.')
   }
 
   const npmCheck = run('npm', ['--version'], 5_000)

package/src/app/api/tasks/[id]/route.ts

@@ -1,6 +1,6 @@
 import { genId } from '@/lib/id'
 import { NextResponse } from 'next/server'
-import { loadTasks, saveTasks, logActivity, loadSettings } from '@/lib/server/storage'
+import { loadAgents, loadSettings, loadTasks, logActivity, upsertStoredItems, upsertTask } from '@/lib/server/storage'
 import { notFound } from '@/lib/server/collection-helpers'
 import { disableSessionHeartbeat, enqueueTask, recoverStalledRunningTasks, validateCompletedTasksQueue } from '@/lib/server/queue'
 import { ensureTaskCompletionReport } from '@/lib/server/task-reports'
@@ -13,6 +13,8 @@ import { requestHeartbeatNow } from '@/lib/server/heartbeat-wake'
 import { validateDag, cascadeUnblock } from '@/lib/server/dag-validation'
 import { getPluginManager } from '@/lib/server/plugins'
 import { normalizeTaskQualityGate } from '@/lib/server/task-quality-gate'
+import type { BoardTask } from '@/types'
+import '@/lib/server/builtin-plugins'
 
 export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
   // Keep completed queue integrity even if daemon is not running.
@@ -90,7 +92,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     }
   }
 
-  saveTasks(tasks)
+  upsertTask(id, tasks[id])
   logActivity({ entityType: 'task', entityId: id, action: 'updated', actor: 'user', summary: `Task updated: "${tasks[id].title}" (${prevStatus} → ${tasks[id].status})` })
   if (prevStatus !== tasks[id].status) {
     pushMainLoopEventToMainSessions({
@@ -111,7 +113,12 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
     })
     
     if (tasks[id].status === 'completed') {
-      getPluginManager().runHook('onTaskComplete', { taskId: id, result: tasks[id].result })
+      const agentPlugins = tasks[id].agentId ? (loadAgents()[tasks[id].agentId]?.plugins || []) : []
+      getPluginManager().runHook(
+        'onTaskComplete',
+        { taskId: id, result: tasks[id].result },
+        { enabledIds: agentPlugins },
+      )
     }
 
     // Enqueue system event + heartbeat wake
@@ -131,7 +138,7 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
       // Revert status change and reject
       tasks[id].status = prevStatus
       tasks[id].updatedAt = Date.now()
-      saveTasks(tasks)
+      upsertTask(id, tasks[id])
       return NextResponse.json(
         { error: 'Cannot queue: blocked by incomplete tasks', blockedBy: incompleteBlocker },
         { status: 409 },
@@ -143,7 +150,10 @@ export async function PUT(req: Request, { params }: { params: Promise<{ id: stri
   if (tasks[id].status === 'completed') {
     const unblockedIds = cascadeUnblock(tasks, id)
     if (unblockedIds.length > 0) {
-      saveTasks(tasks)
+      upsertStoredItems('tasks', [
+        [id, tasks[id]],
+        ...unblockedIds.map((uid) => [uid, tasks[uid]] as [string, BoardTask]),
+      ])
       for (const uid of unblockedIds) {
         enqueueTask(uid)
       }
@@ -168,7 +178,7 @@ export async function DELETE(_req: Request, { params }: { params: Promise<{ id:
   tasks[id].status = 'archived'
   tasks[id].archivedAt = Date.now()
   tasks[id].updatedAt = Date.now()
-  saveTasks(tasks)
+  upsertTask(id, tasks[id])
   logActivity({ entityType: 'task', entityId: id, action: 'deleted', actor: 'user', summary: `Task archived: "${tasks[id].title}"` })
   pushMainLoopEventToMainSessions({
     type: 'task_archived',

package/src/app/api/tasks/bulk/route.ts

@@ -1,10 +1,10 @@
 import { NextResponse } from 'next/server'
-import { loadTasks, saveTasks, logActivity } from '@/lib/server/storage'
+import { loadTasks, logActivity, upsertStoredItems } from '@/lib/server/storage'
 import { enqueueTask, disableSessionHeartbeat } from '@/lib/server/queue'
 import { pushMainLoopEventToMainSessions } from '@/lib/server/main-agent-loop'
 import { notify } from '@/lib/server/ws-hub'
 import { createNotification } from '@/lib/server/create-notification'
-import type { BoardTaskStatus } from '@/types'
+import type { BoardTask, BoardTaskStatus } from '@/types'
 
 const VALID_STATUSES: BoardTaskStatus[] = ['backlog', 'queued', 'running', 'completed', 'failed', 'archived']
 
@@ -82,7 +82,7 @@ export async function POST(req: Request) {
     }
   }
 
-  saveTasks(tasks)
+  upsertStoredItems('tasks', results.map((id) => [id, tasks[id]] as [string, BoardTask]))
 
   if (updated > 0) {
     const action = body.status

package/src/app/api/tasks/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from 'next/server'
 import { genId } from '@/lib/id'
-import { loadTasks, saveTasks, loadSettings, loadAgents, logActivity } from '@/lib/server/storage'
+import { deleteTask, loadAgents, loadSettings, loadTasks, logActivity, upsertTask } from '@/lib/server/storage'
 import { TaskCreateSchema, formatZodError } from '@/lib/validation/schemas'
 import { z } from 'zod'
 import { enqueueTask, recoverStalledRunningTasks, validateCompletedTasksQueue } from '@/lib/server/queue'
@@ -13,6 +13,7 @@ import { resolveTaskAgentFromDescription } from '@/lib/server/task-mention'
 import { validateDag } from '@/lib/server/dag-validation'
 import { getPluginManager } from '@/lib/server/plugins'
 import { normalizeTaskQualityGate } from '@/lib/server/task-quality-gate'
+import '@/lib/server/builtin-plugins'
 
 export async function GET(req: Request) {
   // Keep completed queue integrity even if daemon is not running.
@@ -49,7 +50,6 @@ export async function DELETE(req: Request) {
     (filter === 'done' && (task.status === 'completed' || task.status === 'failed')) ||
     (!filter && task.status === 'archived')
 
-  const { deleteTask } = await import('@/lib/server/storage')
   for (const [id, task] of Object.entries(tasks)) {
     if (shouldRemove(task as { status: string; sourceType?: string })) {
       deleteTask(id)
@@ -169,7 +169,12 @@ export async function POST(req: Request) {
     if (validation.ok) {
       tasks[id].completedAt = Date.now()
       tasks[id].error = null
-      getPluginManager().runHook('onTaskComplete', { taskId: id, result: tasks[id].result })
+      const agentPlugins = resolvedAgentId ? (loadAgents()[resolvedAgentId]?.plugins || []) : []
+      getPluginManager().runHook(
+        'onTaskComplete',
+        { taskId: id, result: tasks[id].result },
+        { enabledIds: agentPlugins },
+      )
     } else {
       tasks[id].status = 'failed'
       tasks[id].completedAt = null
@@ -177,7 +182,7 @@ export async function POST(req: Request) {
     }
   }
 
-  saveTasks(tasks)
+  upsertTask(id, tasks[id])
   logActivity({ entityType: 'task', entityId: id, action: 'created', actor: 'user', summary: `Task created: "${tasks[id].title}"` })
   pushMainLoopEventToMainSessions({
     type: 'task_created',

package/src/app/api/webhooks/[id]/route.ts

@@ -8,6 +8,7 @@ import { enqueueSystemEvent } from '@/lib/server/system-events'
 import { requestHeartbeatNow } from '@/lib/server/heartbeat-wake'
 import { mutateItem, deleteItem, notFound, type CollectionOps } from '@/lib/server/collection-helpers'
 import type { WebhookRetryEntry } from '@/types'
+import { triggerWebhookWatchJobs } from '@/lib/server/watch-jobs'
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const ops: CollectionOps<any> = { load: loadWebhooks, save: saveWebhooks }
@@ -126,6 +127,12 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
     })
   }
 
+  triggerWebhookWatchJobs({
+    webhookId: id,
+    event: incomingEvent,
+    payloadPreview: rawBody,
+  })
+
   const agents = loadAgents()
   const agent = webhook.agentId ? agents[webhook.agentId] : null
   if (!agent) {
@@ -165,7 +172,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
       messages: [],
       createdAt: now,
       lastActiveAt: now,
-      sessionType: 'orchestrated',
+      sessionType: 'human',
       agentId: agent.id,
       parentSessionId: null,
       tools: agent.tools || [],