limbo-ai 1.20.4 → 1.21.0

package/cli.js

@@ -162,6 +162,8 @@ function composeContent() {
       - llm_api_key
       - telegram_bot_token
       - gateway_token
+      - groq_api_key
+      - brave_api_key
     env_file:
       - ${LIMBO_DIR}/.env
     environment:
@@ -183,6 +185,10 @@ secrets:
     file: ${SECRETS_DIR}/telegram_bot_token
   gateway_token:
     file: ${SECRETS_DIR}/gateway_token
+  groq_api_key:
+    file: ${SECRETS_DIR}/groq_api_key
+  brave_api_key:
+    file: ${SECRETS_DIR}/brave_api_key
 
 volumes:
   limbo-data:
@@ -218,6 +224,8 @@ function composeContentHardened() {
       - llm_api_key
       - telegram_bot_token
       - gateway_token
+      - groq_api_key
+      - brave_api_key
     env_file:
       - ${LIMBO_DIR}/.env
     environment:
@@ -270,6 +278,10 @@ secrets:
     file: ${SECRETS_DIR}/telegram_bot_token
   gateway_token:
     file: ${SECRETS_DIR}/gateway_token
+  groq_api_key:
+    file: ${SECRETS_DIR}/groq_api_key
+  brave_api_key:
+    file: ${SECRETS_DIR}/brave_api_key
 
 volumes:
   limbo-data:
@@ -699,6 +711,8 @@ function normalizeConfig(cfg, existingEnv = {}) {
     TELEGRAM_BOT_TOKEN: cfg.telegramToken || (cfg.keepExisting ? existingEnv.TELEGRAM_BOT_TOKEN || '' : ''),
     TELEGRAM_AUTO_PAIR_FIRST_DM: cfg.telegramAutoPair || existingEnv.TELEGRAM_AUTO_PAIR_FIRST_DM || 'false',
     GATEWAY_TOKEN: gatewayToken,
+    VOICE_ENABLED: cfg.voiceEnabled || existingEnv.VOICE_ENABLED || 'false',
+    WEB_SEARCH_ENABLED: cfg.webSearchEnabled || existingEnv.WEB_SEARCH_ENABLED || 'false',
   };
 
   return base;
@@ -718,6 +732,8 @@ function writeSecrets(cfg, existingEnv = {}) {
   writeSecretFile('llm_api_key', normalized.LLM_API_KEY);
   writeSecretFile('telegram_bot_token', normalized.TELEGRAM_BOT_TOKEN);
   writeSecretFile('gateway_token', normalized.GATEWAY_TOKEN);
+  writeSecretFile('groq_api_key', cfg.groqApiKey || readSecretFile('groq_api_key'));
+  writeSecretFile('brave_api_key', cfg.braveApiKey || readSecretFile('brave_api_key'));
 }
 
 const SECRET_KEYS = new Set([
@@ -922,7 +938,7 @@ function ensureComposeFile(hardened = false) {
   fs.mkdirSync(path.join(VAULT_DIR, 'maps'), { recursive: true });
   fs.mkdirSync(SECRETS_DIR, { recursive: true, mode: 0o700 });
   // Ensure secret files exist (Docker Compose secrets require the files to be present)
-  for (const name of ['llm_api_key', 'telegram_bot_token', 'gateway_token']) {
+  for (const name of ['llm_api_key', 'telegram_bot_token', 'gateway_token', 'groq_api_key', 'brave_api_key']) {
     const fp = path.join(SECRETS_DIR, name);
     if (!fs.existsSync(fp)) fs.writeFileSync(fp, '', { mode: 0o644 });
   }
@@ -1683,6 +1699,98 @@ function cmdStatus() {
   run('docker compose ps');
 }
 
+function cmdConfig() {
+  const args = process.argv.slice(3);
+  const feature = args[0];
+
+  if (!feature || !['voice', 'web-search'].includes(feature)) {
+    console.log(`
+${c.bold}Usage:${c.reset}
+  limbo config voice --enable --api-key <key>
+  limbo config voice --disable
+  limbo config voice --status
+  limbo config web-search --enable --api-key <key>
+  limbo config web-search --disable
+  limbo config web-search --status
+`);
+    return;
+  }
+
+  if (!fs.existsSync(ENV_FILE)) {
+    die('Limbo is not configured. Run "limbo start" first.');
+  }
+
+  const existingEnv = {};
+  const envContent = fs.readFileSync(ENV_FILE, 'utf8');
+  for (const line of envContent.split('\n')) {
+    const match = line.match(/^([A-Z_]+)=(.*)$/);
+    if (match) existingEnv[match[1]] = match[2].replace(/^"|"$/g, '');
+  }
+
+  const isVoice = feature === 'voice';
+  const envKey = isVoice ? 'VOICE_ENABLED' : 'WEB_SEARCH_ENABLED';
+  const secretName = isVoice ? 'groq_api_key' : 'brave_api_key';
+  const featureLabel = isVoice ? 'Voice transcription' : 'Web search';
+
+  const hasEnable = args.includes('--enable');
+  const hasDisable = args.includes('--disable');
+  const hasStatus = args.includes('--status');
+  const apiKeyIdx = args.indexOf('--api-key');
+  const apiKey = apiKeyIdx !== -1 ? args[apiKeyIdx + 1] : null;
+
+  if (hasStatus) {
+    const enabled = existingEnv[envKey] === 'true';
+    const key = readSecretFile(secretName);
+    console.log(`${featureLabel}: ${enabled ? `${c.green}enabled${c.reset}` : `${c.dim}disabled${c.reset}`}`);
+    if (key) {
+      const masked = key.length > 8 ? key.substring(0, 4) + '...' + key.slice(-4) : '***';
+      console.log(`API Key: ${masked}`);
+    }
+    return;
+  }
+
+  if (!hasEnable && !hasDisable) {
+    die('Specify --enable, --disable, or --status');
+  }
+
+  if (hasEnable) {
+    if (apiKey) {
+      if (isVoice && !apiKey.startsWith('gsk_')) {
+        warn('Groq API keys typically start with gsk_');
+      }
+      if (!isVoice && !apiKey.startsWith('BSA')) {
+        warn('Brave API keys typically start with BSA');
+      }
+      writeSecretFile(secretName, apiKey);
+      ok(`${featureLabel} API key saved.`);
+    } else {
+      const existing = readSecretFile(secretName);
+      if (!existing) {
+        die(`No API key found. Use --api-key <key> to set one.`);
+      }
+    }
+    existingEnv[envKey] = 'true';
+  } else {
+    existingEnv[envKey] = 'false';
+  }
+
+  const newContent = Object.entries(existingEnv)
+    .map(([key, value]) => `${key}=${value}`)
+    .join('\n') + '\n';
+  fs.writeFileSync(ENV_FILE, newContent, { mode: 0o600 });
+  ok(`${featureLabel} ${hasEnable ? 'enabled' : 'disabled'}.`);
+
+  if (fs.existsSync(COMPOSE_FILE)) {
+    log('Restarting container...');
+    try {
+      execSync(`docker compose -f "${COMPOSE_FILE}" restart limbo`, { stdio: 'inherit' });
+      ok('Container restarted.');
+    } catch {
+      warn('Could not restart container. Restart manually with: limbo stop && limbo start');
+    }
+  }
+}
+
 function cmdHelp() {
   console.log(`
 ${c.bold}limbo${c.reset} - personal AI memory agent
@@ -1696,6 +1804,7 @@ ${c.bold}Commands:${c.reset}
   logs          Tail container logs
   update        Pull latest image and restart
   status        Show container status
+  config        Configure optional features (voice, web-search)
   help          Show this help
 
 ${c.bold}Flags:${c.reset}
@@ -1708,6 +1817,13 @@ ${c.bold}Flags:${c.reset}
   --language <code>    Language: en, es (default: en)
   --tunnel-domain <d>  Admin: use branded subdomain for setup tunnel (e.g. limbo.tomasward.com)
 
+${c.bold}Config:${c.reset}
+  limbo config voice --enable --api-key gsk_xxx     Enable voice transcription
+  limbo config voice --disable                       Disable voice transcription
+  limbo config web-search --enable --api-key BSAxxx  Enable web search
+  limbo config web-search --disable                  Disable web search
+  limbo config voice --status                        Show feature status
+
 ${c.bold}Data directory:${c.reset} ${LIMBO_DIR}
 `);
 }
@@ -1724,6 +1840,7 @@ const [,, cmd = 'start'] = process.argv;
     case 'logs':    cmdLogs(); break;
     case 'update':  cmdUpdate(); break;
     case 'status':  cmdStatus(); break;
+    case 'config':  cmdConfig(); break;
     case 'help':
     case '--help':
     case '-h':      cmdHelp(); break;

package/mcp-server/index.js

@@ -5,6 +5,7 @@ import {
   ListToolsRequestSchema,
 } from "@modelcontextprotocol/sdk/types.js";
 
+import { buildIndex } from "./vault-index.js";
 import { vaultSearch } from "./tools/search.js";
 import { vaultRead } from "./tools/read.js";
 import { vaultWriteNote } from "./tools/write.js";
@@ -13,7 +14,7 @@ import { vaultUpdateMap } from "./tools/update-map.js";
 const server = new Server(
   {
     name: "limbo-vault",
-    version: "1.1.0",
+    version: "1.2.0",
   },
   {
     capabilities: {
@@ -172,5 +173,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
 // ── Start ───────────────────────────────────────────────────────────────────
 
+// Build in-memory index before accepting connections
+const noteCount = await buildIndex();
+process.stderr.write(`[limbo-vault] Index built: ${noteCount} notes indexed\n`);
+
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/mcp-server/test/benchmark.js

@@ -0,0 +1,365 @@
+/**
+ * Benchmark: old (filesystem scan) vs new (in-memory index)
+ *
+ * Creates a temporary vault with N notes, then compares:
+ * - vault_search latency
+ * - vault_read latency
+ * - vault_write_note + subsequent search latency
+ *
+ * Run: node test/benchmark.js [noteCount]
+ *   default noteCount = 200
+ */
+
+import { mkdir, writeFile, rm } from "fs/promises";
+import { join, basename, relative } from "path";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
+
+// ── Scaffold a temp vault ──────────────────────────────────────────────────
+
+const NOTE_COUNT = parseInt(process.argv[2] || "200", 10);
+const VAULT_DIR = join(tmpdir(), `limbo-bench-${randomUUID().slice(0, 8)}`);
+const NOTES_DIR = join(VAULT_DIR, "notes");
+const MAPS_DIR = join(VAULT_DIR, "maps");
+
+const DOMAINS = ["personal", "research", "projects", "aios", "limbo"];
+const TYPES = ["fact", "preference", "idea", "insight", "decision"];
+
+function generateNote(i) {
+  const domain = DOMAINS[i % DOMAINS.length];
+  const type = TYPES[i % TYPES.length];
+  const id = `bench-note-${String(i).padStart(4, "0")}`;
+  const title = `Benchmark note number ${i} about ${domain}`;
+  const description = `This is test note ${i} in the ${domain} domain for performance benchmarking`;
+  const body = [
+    `This note contains searchable content for domain ${domain}.`,
+    `Keywords: optimization, performance, latency, throughput, indexing.`,
+    `Note index: ${i}. UUID: ${randomUUID()}.`,
+    `The quick brown fox jumps over the lazy dog.`,
+    i % 7 === 0 ? "Special keyword: UNIQUE_NEEDLE" : "",
+    i % 3 === 0 ? `Reference to [[bench-note-${String(i - 1).padStart(4, "0")}]]` : "",
+  ].join("\n\n");
+
+  const frontmatter = [
+    "---",
+    `id: ${id}`,
+    `title: "${title}"`,
+    `description: "${description}"`,
+    `type: ${type}`,
+    `schema_version: 1`,
+    `domain: ${domain}`,
+    `created: "2026-03-19"`,
+    `source: benchmark`,
+    "topics:",
+    `  - "[[${domain}-map]]"`,
+    "---",
+  ].join("\n");
+
+  return { id, domain, content: `${frontmatter}\n\n${body}\n` };
+}
+
+async function scaffoldVault() {
+  await mkdir(NOTES_DIR, { recursive: true });
+  await mkdir(MAPS_DIR, { recursive: true });
+
+  const writes = [];
+  for (let i = 0; i < NOTE_COUNT; i++) {
+    const { id, domain, content } = generateNote(i);
+    const dir = join(NOTES_DIR, domain);
+    writes.push(
+      mkdir(dir, { recursive: true }).then(() =>
+        writeFile(join(dir, `${id}.md`), content, "utf8")
+      )
+    );
+  }
+  await Promise.all(writes);
+}
+
+async function cleanup() {
+  await rm(VAULT_DIR, { recursive: true, force: true });
+}
+
+// ── Old implementation (filesystem scan) ───────────────────────────────────
+
+import { readdir, readFile, stat } from "fs/promises";
+
+async function oldWalkNotes(dir, base = dir) {
+  const entries = [];
+  let items;
+  try {
+    items = await readdir(dir);
+  } catch {
+    return entries;
+  }
+  for (const item of items) {
+    if (item.startsWith(".") || item === "_meta") continue;
+    const full = join(dir, item);
+    let s;
+    try {
+      s = await stat(full);
+    } catch {
+      continue;
+    }
+    if (s.isDirectory()) {
+      const sub = await oldWalkNotes(full, base);
+      entries.push(...sub);
+    } else if (item.endsWith(".md")) {
+      const rel = relative(base, dir);
+      entries.push({ filePath: full, domain: rel || null });
+    }
+  }
+  return entries;
+}
+
+function oldExtractTitle(content) {
+  const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
+  if (fmMatch) {
+    const titleMatch = fmMatch[1].match(/^title:\s*["']?(.+?)["']?\s*$/m);
+    if (titleMatch) return titleMatch[1];
+  }
+  return null;
+}
+
+async function oldSearch(query) {
+  const files = await oldWalkNotes(NOTES_DIR);
+  const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const regex = new RegExp(escaped, "gi");
+  const results = [];
+  for (const { filePath, domain } of files) {
+    let content;
+    try {
+      content = await readFile(filePath, "utf8");
+    } catch {
+      continue;
+    }
+    const matches = content.match(regex);
+    if (!matches) continue;
+    const noteId = basename(filePath, ".md");
+    const title = oldExtractTitle(content) || noteId;
+    results.push({ noteId, title, score: matches.length, domain });
+  }
+  results.sort((a, b) => b.score - a.score);
+  return results;
+}
+
+async function oldRead(noteId) {
+  // Fast path
+  const flatPath = join(NOTES_DIR, `${noteId}.md`);
+  try {
+    await stat(flatPath);
+    return await readFile(flatPath, "utf8");
+  } catch {}
+
+  // Recursive search
+  async function searchDir(dir) {
+    let items;
+    try {
+      items = await readdir(dir);
+    } catch {
+      return null;
+    }
+    for (const item of items) {
+      if (item.startsWith(".") || item === "_meta") continue;
+      const full = join(dir, item);
+      let s;
+      try {
+        s = await stat(full);
+      } catch {
+        continue;
+      }
+      if (s.isDirectory()) {
+        const candidate = join(full, `${noteId}.md`);
+        try {
+          await stat(candidate);
+          return await readFile(candidate, "utf8");
+        } catch {
+          const found = await searchDir(full);
+          if (found) return found;
+        }
+      }
+    }
+    return null;
+  }
+
+  return searchDir(NOTES_DIR);
+}
+
+// ── New implementation (in-memory index) ───────────────────────────────────
+
+// We inline the index here to avoid env var coupling with vault-index.js
+
+const index = new Map();
+
+function newExtractTitle(content) {
+  const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
+  if (fmMatch) {
+    const titleMatch = fmMatch[1].match(/^title:\s*["']?(.+?)["']?\s*$/m);
+    if (titleMatch) return titleMatch[1];
+    const descMatch = fmMatch[1].match(/^description:\s*["']?(.+?)["']?\s*$/m);
+    if (descMatch) return descMatch[1];
+  }
+  return null;
+}
+
+async function newWalkAndIndex(dir, base = dir) {
+  let items;
+  try {
+    items = await readdir(dir);
+  } catch {
+    return;
+  }
+  const promises = [];
+  for (const item of items) {
+    if (item.startsWith(".") || item === "_meta") continue;
+    const full = join(dir, item);
+    promises.push(
+      stat(full)
+        .then((s) => {
+          if (s.isDirectory()) return newWalkAndIndex(full, base);
+          if (item.endsWith(".md")) {
+            return readFile(full, "utf8")
+              .then((content) => {
+                const noteId = basename(full, ".md");
+                const domain = relative(base, dir) || null;
+                const title = newExtractTitle(content) || noteId;
+                index.set(noteId, { path: full, title, content, domain });
+              })
+              .catch(() => {});
+          }
+        })
+        .catch(() => {})
+    );
+  }
+  await Promise.all(promises);
+}
+
+async function newBuildIndex() {
+  index.clear();
+  await newWalkAndIndex(NOTES_DIR);
+  return index.size;
+}
+
+function newSearch(query) {
+  const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const regex = new RegExp(escaped, "gi");
+  const results = [];
+  for (const [noteId, entry] of index) {
+    const matches = entry.content.match(regex);
+    if (!matches) continue;
+    results.push({ noteId, title: entry.title, score: matches.length, domain: entry.domain });
+  }
+  results.sort((a, b) => b.score - a.score);
+  return results;
+}
+
+function newRead(noteId) {
+  const entry = index.get(noteId);
+  return entry ? entry.content : null;
+}
+
+// ── Benchmark harness ──────────────────────────────────────────────────────
+
+async function timeMs(fn, iterations = 1) {
+  const times = [];
+  for (let i = 0; i < iterations; i++) {
+    const start = performance.now();
+    await fn();
+    times.push(performance.now() - start);
+  }
+  times.sort((a, b) => a - b);
+  return {
+    min: times[0],
+    median: times[Math.floor(times.length / 2)],
+    max: times[times.length - 1],
+    avg: times.reduce((a, b) => a + b, 0) / times.length,
+  };
+}
+
+function fmt(ms) {
+  if (ms < 1) return `${(ms * 1000).toFixed(0)}µs`;
+  return `${ms.toFixed(2)}ms`;
+}
+
+function printResult(label, old, now) {
+  const speedup = old.median / now.median;
+  console.log(`  ${label}`);
+  console.log(`    OLD:  median=${fmt(old.median)}  avg=${fmt(old.avg)}  min=${fmt(old.min)}  max=${fmt(old.max)}`);
+  console.log(`    NEW:  median=${fmt(now.median)}  avg=${fmt(now.avg)}  min=${fmt(now.min)}  max=${fmt(now.max)}`);
+  console.log(`    Speedup: ${speedup.toFixed(1)}x faster`);
+  console.log();
+}
+
+// ── Main ───────────────────────────────────────────────────────────────────
+
+console.log(`\n=== Limbo MCP Benchmark ===`);
+console.log(`Notes: ${NOTE_COUNT}`);
+console.log(`Vault: ${VAULT_DIR}\n`);
+
+try {
+  // Setup
+  console.log("Scaffolding vault...");
+  await scaffoldVault();
+
+  // Build index (one-time cost)
+  console.log("Building index...");
+  const buildTime = await timeMs(() => newBuildIndex(), 3);
+  console.log(`  Index build: median=${fmt(buildTime.median)} (${index.size} notes)\n`);
+
+  const ITERS = 20;
+
+  // ── Search: broad query (many matches) ─────────────────────────────────
+  console.log(`--- Search: broad query ("optimization") × ${ITERS} ---`);
+  const oldSearchBroad = await timeMs(() => oldSearch("optimization"), ITERS);
+  const newSearchBroad = await timeMs(() => newSearch("optimization"), ITERS);
+  printResult("Broad search", oldSearchBroad, newSearchBroad);
+
+  // ── Search: narrow query (few matches) ─────────────────────────────────
+  console.log(`--- Search: narrow query ("UNIQUE_NEEDLE") × ${ITERS} ---`);
+  const oldSearchNarrow = await timeMs(() => oldSearch("UNIQUE_NEEDLE"), ITERS);
+  const newSearchNarrow = await timeMs(() => newSearch("UNIQUE_NEEDLE"), ITERS);
+  printResult("Narrow search", oldSearchNarrow, newSearchNarrow);
+
+  // ── Search: no matches ─────────────────────────────────────────────────
+  console.log(`--- Search: miss ("xyzzy_nonexistent") × ${ITERS} ---`);
+  const oldSearchMiss = await timeMs(() => oldSearch("xyzzy_nonexistent"), ITERS);
+  const newSearchMiss = await timeMs(() => newSearch("xyzzy_nonexistent"), ITERS);
+  printResult("Miss search", oldSearchMiss, newSearchMiss);
+
+  // ── Read: note in subdirectory (worst case for old) ────────────────────
+  console.log(`--- Read: note in subdirectory × ${ITERS} ---`);
+  const readTarget = `bench-note-${String(Math.floor(NOTE_COUNT / 2)).padStart(4, "0")}`;
+  const oldReadSub = await timeMs(() => oldRead(readTarget), ITERS);
+  const newReadSub = await timeMs(() => newRead(readTarget), ITERS);
+  printResult(`Read "${readTarget}"`, oldReadSub, newReadSub);
+
+  // ── Read: nonexistent note ─────────────────────────────────────────────
+  console.log(`--- Read: nonexistent note × ${ITERS} ---`);
+  const oldReadMiss = await timeMs(() => oldRead("does-not-exist-999"), ITERS);
+  const newReadMiss = await timeMs(() => newRead("does-not-exist-999"), ITERS);
+  printResult("Read miss", oldReadMiss, newReadMiss);
+
+  // ── Correctness check ──────────────────────────────────────────────────
+  console.log("--- Correctness ---");
+  const oldResults = await oldSearch("optimization");
+  const newResults = newSearch("optimization");
+  const oldCount = oldResults.length;
+  const newCount = newResults.length;
+  const match = oldCount === newCount;
+  console.log(`  Old result count: ${oldCount}`);
+  console.log(`  New result count: ${newCount}`);
+  console.log(`  Match: ${match ? "PASS ✓" : "FAIL ✗"}`);
+  if (!match) {
+    console.log("  WARNING: result counts differ!");
+  }
+
+  // Verify read returns identical content
+  const oldContent = await oldRead(readTarget);
+  const newContent = newRead(readTarget);
+  const readMatch = oldContent === newContent;
+  console.log(`  Read content match: ${readMatch ? "PASS ✓" : "FAIL ✗"}`);
+  console.log();
+
+} finally {
+  await cleanup();
+  console.log("Cleaned up.\n");
+}

package/mcp-server/tools/read.js

@@ -1,65 +1,13 @@
-import { readFile, readdir, stat } from "fs/promises";
-import { join, resolve } from "path";
+import { readFile } from "fs/promises";
+import { resolve } from "path";
+import { ensureIndex, getNote } from "../vault-index.js";
 
 const VAULT_PATH = process.env.VAULT_PATH || "/data/vault";
-const NOTES_DIR = join(VAULT_PATH, "notes");
-
-/**
- * Recursively find a note file by ID. Checks flat first, then subdirectories.
- * Returns the file path or null.
- */
-async function findNote(noteId) {
-  // Fast path: check flat location first
-  const flatPath = join(NOTES_DIR, `${noteId}.md`);
-  try {
-    await stat(flatPath);
-    return flatPath;
-  } catch {
-    // Not in root — search subdirectories
-  }
-
-  return searchDir(NOTES_DIR, noteId);
-}
-
-async function searchDir(dir, noteId) {
-  let items;
-  try {
-    items = await readdir(dir);
-  } catch {
-    return null;
-  }
-
-  for (const item of items) {
-    if (item.startsWith(".") || item === "_meta") continue;
-
-    const full = join(dir, item);
-    let s;
-    try {
-      s = await stat(full);
-    } catch {
-      continue;
-    }
-
-    if (s.isDirectory()) {
-      // Check if the note exists directly in this subdirectory
-      const candidate = join(full, `${noteId}.md`);
-      try {
-        await stat(candidate);
-        return candidate;
-      } catch {
-        // Recurse deeper
-        const found = await searchDir(full, noteId);
-        if (found) return found;
-      }
-    }
-  }
-
-  return null;
-}
+const NOTES_DIR = resolve(VAULT_PATH, "notes");
 
 /**
  * vault_read(noteId): reads full content of a note by ID.
- * Searches recursively through subdirectories.
+ * Uses in-memory index for O(1) path lookup — no recursive filesystem search.
  * Returns the raw markdown content including YAML frontmatter.
  * Returns null if the note doesn't exist.
  */
@@ -74,19 +22,16 @@ export async function vaultRead(noteId) {
     throw new Error("noteId contains invalid characters");
   }
 
-  const filePath = await findNote(safe);
-  if (!filePath) return null;
+  await ensureIndex();
+  const entry = getNote(safe);
+  if (!entry) return null;
 
   // Defense-in-depth: ensure resolved path stays within vault
-  const resolved = resolve(filePath);
-  if (!resolved.startsWith(resolve(NOTES_DIR) + "/")) {
+  const resolved = resolve(entry.path);
+  if (!resolved.startsWith(NOTES_DIR + "/")) {
     throw new Error("Path traversal detected");
   }
 
-  try {
-    return await readFile(filePath, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    throw err;
-  }
+  // Return content from index (already in memory)
+  return entry.content;
 }

package/mcp-server/tools/search.js

@@ -1,118 +1,15 @@
-import { readdir, readFile, stat } from "fs/promises";
-import { join, basename, relative } from "path";
-
-const VAULT_PATH = process.env.VAULT_PATH || "/data/vault";
-const NOTES_DIR = join(VAULT_PATH, "notes");
-
-/**
- * Recursively collects all .md files under a directory.
- * Returns array of { filePath, domain } where domain is the relative subdirectory.
- */
-async function walkNotes(dir, base = dir) {
-  const entries = [];
-  let items;
-  try {
-    items = await readdir(dir);
-  } catch {
-    return entries;
-  }
-
-  for (const item of items) {
-    // Skip hidden directories and _meta
-    if (item.startsWith(".") || item === "_meta") continue;
-
-    const full = join(dir, item);
-    let s;
-    try {
-      s = await stat(full);
-    } catch {
-      continue;
-    }
-
-    if (s.isDirectory()) {
-      const sub = await walkNotes(full, base);
-      entries.push(...sub);
-    } else if (item.endsWith(".md")) {
-      const rel = relative(base, dir);
-      entries.push({ filePath: full, domain: rel || null });
-    }
-  }
-  return entries;
-}
-
-/**
- * Extracts the title from YAML frontmatter, falling back to description or first H1.
- */
-function extractTitle(content) {
-  const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
-  if (fmMatch) {
-    const titleMatch = fmMatch[1].match(/^title:\s*["']?(.+?)["']?\s*$/m);
-    if (titleMatch) return titleMatch[1];
-    // Fallback: use description if no title field
-    const descMatch = fmMatch[1].match(/^description:\s*["']?(.+?)["']?\s*$/m);
-    if (descMatch) return descMatch[1];
-  }
-  const h1Match = content.match(/^#\s+(.+)$/m);
-  if (h1Match) return h1Match[1];
-  return null;
-}
+import { ensureIndex, search } from "../vault-index.js";
 
 /**
- * Finds a short snippet around the first match.
- */
-function extractSnippet(content, regex, maxLen = 150) {
-  regex.lastIndex = 0;
-  const match = regex.exec(content);
-  regex.lastIndex = 0;
-  if (!match) return "";
-  const start = Math.max(0, match.index - 60);
-  const end = Math.min(content.length, match.index + maxLen);
-  let snippet = content.slice(start, end).replace(/\n/g, " ").trim();
-  if (start > 0) snippet = "..." + snippet;
-  if (end < content.length) snippet += "...";
-  return snippet;
-}
-
-/**
- * vault_search(query): recursive search across all .md files in vault/notes/.
+ * vault_search(query): searches all notes via in-memory index.
  * Returns [{noteId, title, snippet, score, domain}] sorted by score desc.
- *
- * NOTE: Current implementation is a linear scan (O(n) per query). This is fine
- * for small vaults (hundreds of notes), but will need optimization at scale —
- * consider an inverted index (e.g. SQLite FTS5) when the vault grows large.
+ * No disk I/O after initial index build.
  */
 export async function vaultSearch(query) {
   if (query.length > 200) {
     throw new Error("Search query too long (max 200 characters)");
   }
 
-  const files = await walkNotes(NOTES_DIR);
-  if (files.length === 0) return [];
-
-  // Always escape user input to prevent ReDoS from pathological patterns
-  const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const regex = new RegExp(escaped, "gi");
-
-  const results = [];
-  for (const { filePath, domain } of files) {
-    let content;
-    try {
-      content = await readFile(filePath, "utf8");
-    } catch {
-      continue;
-    }
-
-    const matches = content.match(regex);
-    if (!matches) continue;
-
-    const noteId = basename(filePath, ".md");
-    const title = extractTitle(content) || noteId;
-    const score = matches.length;
-    const snippet = extractSnippet(content, regex);
-
-    results.push({ noteId, title, snippet, score, domain });
-  }
-
-  results.sort((a, b) => b.score - a.score);
-  return results;
+  await ensureIndex();
+  return search(query);
 }

package/mcp-server/tools/update-map.js

@@ -26,8 +26,23 @@ function buildMapFrontmatter(name) {
   return lines.join("\n");
 }
 
+/**
+ * Extracts wikilink noteIds from a block of text.
+ * Matches [[noteId]] and [[noteId|Display Title]].
+ */
+function extractWikilinks(text) {
+  const regex = /\[\[([^\]|]+)/g;
+  const ids = new Set();
+  let match;
+  while ((match = regex.exec(text)) !== null) {
+    ids.add(match[1].trim());
+  }
+  return ids;
+}
+
 /**
  * Finds or creates a section in markdown content.
+ * Deduplicates entries — skips any whose wikilink noteId already exists in the section.
  * Returns the updated content string.
  */
 function upsertSection(content, section, entries) {
@@ -37,20 +52,37 @@ function upsertSection(content, section, entries) {
   const sectionIdx = lines.findIndex((l) => l.trim() === sectionHeader);
 
   if (sectionIdx === -1) {
-    // Section doesn't exist — append it
+    // Section doesn't exist — append it (all entries are new)
     const toAdd = ["", sectionHeader, "", ...entries, ""];
-    return lines.concat(toAdd).join("\n");
+    return { content: lines.concat(toAdd).join("\n"), added: entries.length };
   }
 
   // Find where the section ends (next ## or EOF)
-  let insertIdx = sectionIdx + 1;
-  while (insertIdx < lines.length && !lines[insertIdx].startsWith("## ")) {
-    insertIdx++;
+  let endIdx = sectionIdx + 1;
+  while (endIdx < lines.length && !lines[endIdx].startsWith("## ")) {
+    endIdx++;
   }
 
-  // Insert entries before the next section (or EOF)
-  lines.splice(insertIdx, 0, ...entries);
-  return lines.join("\n");
+  // Collect existing wikilinks in this section
+  const sectionText = lines.slice(sectionIdx, endIdx).join("\n");
+  const existing = extractWikilinks(sectionText);
+
+  // Filter out entries whose noteId is already present
+  const newEntries = entries.filter((entry) => {
+    const entryIds = extractWikilinks(entry);
+    for (const id of entryIds) {
+      if (existing.has(id)) return false;
+    }
+    return true;
+  });
+
+  if (newEntries.length === 0) {
+    return { content: content, added: 0 };
+  }
+
+  // Insert new entries before the next section (or EOF)
+  lines.splice(endIdx, 0, ...newEntries);
+  return { content: lines.join("\n"), added: newEntries.length };
 }
 
 /**
@@ -85,7 +117,11 @@ export async function vaultUpdateMap(map, section, entries) {
     existing = `${buildMapFrontmatter(map)}\n\n# ${map}\n`;
   }
 
-  const updated = upsertSection(existing, section, entries);
-  await writeFile(filePath, updated, "utf8");
-  return { map: safeMap, section, added: entries.length };
+  const { content: updated, added } = upsertSection(existing, section, entries);
+
+  if (added > 0) {
+    await writeFile(filePath, updated, "utf8");
+  }
+
+  return { map: safeMap, section, added };
 }

package/mcp-server/tools/write.js

@@ -1,5 +1,6 @@
 import { writeFile, mkdir } from "fs/promises";
-import { join, resolve } from "path";
+import { join, resolve, relative } from "path";
+import { updateEntry } from "../vault-index.js";
 
 const VAULT_PATH = process.env.VAULT_PATH || "/data/vault";
 const NOTES_DIR = join(VAULT_PATH, "notes");
@@ -91,5 +92,10 @@ export async function vaultWriteNote(note) {
   }
 
   await writeFile(filePath, fileContent, "utf8");
+
+  // Update in-memory index immediately — no re-scan needed
+  const domain = relative(NOTES_DIR, resolve(targetDir)) || null;
+  updateEntry(safe, filePath, fileContent, domain);
+
   return { id: safe, path: filePath };
 }

package/mcp-server/vault-index.js

@@ -0,0 +1,127 @@
+import { readdir, readFile, stat } from "fs/promises";
+import { join, basename, relative } from "path";
+
+const VAULT_PATH = process.env.VAULT_PATH || "/data/vault";
+const NOTES_DIR = join(VAULT_PATH, "notes");
+
+// In-memory index: noteId → { path, title, content, domain }
+const index = new Map();
+let built = false;
+
+function extractTitle(content) {
+  const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
+  if (fmMatch) {
+    const titleMatch = fmMatch[1].match(/^title:\s*["']?(.+?)["']?\s*$/m);
+    if (titleMatch) return titleMatch[1];
+    const descMatch = fmMatch[1].match(/^description:\s*["']?(.+?)["']?\s*$/m);
+    if (descMatch) return descMatch[1];
+  }
+  const h1Match = content.match(/^#\s+(.+)$/m);
+  if (h1Match) return h1Match[1];
+  return null;
+}
+
+/**
+ * Recursively walks notes/ and indexes all .md files in parallel.
+ * Uses Promise.all for concurrent I/O instead of sequential await.
+ */
+async function walkAndIndex(dir, base = dir) {
+  let items;
+  try {
+    items = await readdir(dir);
+  } catch {
+    return;
+  }
+
+  const promises = [];
+  for (const item of items) {
+    if (item.startsWith(".") || item === "_meta") continue;
+    const full = join(dir, item);
+    promises.push(
+      stat(full)
+        .then((s) => {
+          if (s.isDirectory()) {
+            return walkAndIndex(full, base);
+          }
+          if (item.endsWith(".md")) {
+            return readFile(full, "utf8")
+              .then((content) => {
+                const noteId = basename(full, ".md");
+                const domain = relative(base, dir) || null;
+                const title = extractTitle(content) || noteId;
+                index.set(noteId, { path: full, title, content, domain });
+              })
+              .catch(() => {});
+          }
+        })
+        .catch(() => {})
+    );
+  }
+  await Promise.all(promises);
+}
+
+/**
+ * Build (or rebuild) the full in-memory index from disk.
+ */
+export async function buildIndex() {
+  index.clear();
+  await walkAndIndex(NOTES_DIR);
+  built = true;
+  return index.size;
+}
+
+/**
+ * Ensure the index is built before use.
+ */
+export async function ensureIndex() {
+  if (!built) await buildIndex();
+}
+
+/**
+ * O(1) lookup by noteId. Returns { path, title, content, domain } or null.
+ */
+export function getNote(noteId) {
+  return index.get(noteId) || null;
+}
+
+/**
+ * Update a single entry in the index (called after vault_write_note).
+ */
+export function updateEntry(noteId, path, content, domain) {
+  const title = extractTitle(content) || noteId;
+  index.set(noteId, { path, title, content, domain });
+}
+
+/**
+ * Search all indexed notes by keyword. O(n) over in-memory strings — no disk I/O.
+ */
+export function search(query) {
+  const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const regex = new RegExp(escaped, "gi");
+
+  const results = [];
+  for (const [noteId, entry] of index) {
+    const matches = entry.content.match(regex);
+    if (!matches) continue;
+
+    const score = matches.length;
+
+    // Extract snippet around first match
+    regex.lastIndex = 0;
+    const match = regex.exec(entry.content);
+    regex.lastIndex = 0;
+    let snippet = "";
+    if (match) {
+      const start = Math.max(0, match.index - 60);
+      const end = Math.min(entry.content.length, match.index + 150);
+      snippet = entry.content.slice(start, end).replace(/\n/g, " ").trim();
+      if (start > 0) snippet = "..." + snippet;
+      if (end < entry.content.length) snippet += "...";
+    }
+
+    results.push({ noteId, title: entry.title, snippet, score, domain: entry.domain });
+  }
+
+  results.sort((a, b) => b.score - a.score);
+  return results;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limbo-ai",
-  "version": "1.20.4",
+  "version": "1.21.0",
   "description": "Your personal AI memory agent — install and manage Limbo via npx",
   "type": "commonjs",
   "bin": {

package/setup-server/public/index.html

@@ -686,6 +686,7 @@
       <div class="progress-dot"></div>
       <div class="progress-dot"></div>
       <div class="progress-dot"></div>
+      <div class="progress-dot"></div>
     </div>
 
     <!-- Nav Header -->
@@ -1160,8 +1161,107 @@
       </div>
     </div>
 
-    <!-- Step 7: Confirm -->
+    <!-- Step 7: Optional Features -->
     <div class="step" data-step="7">
+      <h2 class="step-title">
+        <span data-lang="en">Optional Features</span>
+        <span data-lang="es">Funcionalidades Opcionales</span>
+      </h2>
+      <p class="step-desc">
+        <span data-lang="en">Enable additional capabilities for Limbo. You can always change these later.</span>
+        <span data-lang="es">Habilitá capacidades adicionales para Limbo. Podés cambiar esto después.</span>
+      </p>
+
+      <!-- Voice Messages (Groq) -->
+      <div class="toggle-row" style="margin-bottom:12px">
+        <div>
+          <div class="toggle-label">
+            <span data-lang="en">Voice Messages</span>
+            <span data-lang="es">Mensajes de Voz</span>
+          </div>
+          <div class="toggle-sub">
+            <span data-lang="en">Transcribe voice notes with Groq Whisper</span>
+            <span data-lang="es">Transcribir notas de voz con Groq Whisper</span>
+          </div>
+        </div>
+        <label class="toggle">
+          <input type="checkbox" id="voiceToggle" onchange="toggleFeatureVoice()">
+          <span class="toggle-track"></span>
+          <span class="toggle-thumb"></span>
+        </label>
+      </div>
+
+      <div id="voiceFields" class="tg-fields">
+        <div class="input-group">
+          <label class="input-label" for="groqKeyInput">Groq API Key</label>
+          <input
+            type="password"
+            class="input-field"
+            id="groqKeyInput"
+            placeholder="gsk_..."
+            autocomplete="off"
+            spellcheck="false"
+          >
+          <div class="validation-msg" id="groqKeyValidation"></div>
+          <p class="input-hint">
+            <span data-lang="en">Get your key at <a href="https://console.groq.com/keys" target="_blank">console.groq.com/keys</a></span>
+            <span data-lang="es">Obtené tu key en <a href="https://console.groq.com/keys" target="_blank">console.groq.com/keys</a></span>
+          </p>
+        </div>
+      </div>
+
+      <!-- Web Search (Brave) -->
+      <div class="toggle-row" style="margin-bottom:12px">
+        <div>
+          <div class="toggle-label">
+            <span data-lang="en">Web Search</span>
+            <span data-lang="es">Búsqueda Web</span>
+          </div>
+          <div class="toggle-sub">
+            <span data-lang="en">Search the web via Brave Search API</span>
+            <span data-lang="es">Buscar en la web con Brave Search API</span>
+          </div>
+        </div>
+        <label class="toggle">
+          <input type="checkbox" id="webSearchToggle" onchange="toggleFeatureWebSearch()">
+          <span class="toggle-track"></span>
+          <span class="toggle-thumb"></span>
+        </label>
+      </div>
+
+      <div id="webSearchFields" class="tg-fields">
+        <div class="input-group">
+          <label class="input-label" for="braveKeyInput">Brave API Key</label>
+          <input
+            type="password"
+            class="input-field"
+            id="braveKeyInput"
+            placeholder="BSA..."
+            autocomplete="off"
+            spellcheck="false"
+          >
+          <div class="validation-msg" id="braveKeyValidation"></div>
+          <p class="input-hint">
+            <span data-lang="en">Get your key at <a href="https://brave.com/search/api/" target="_blank">brave.com/search/api</a></span>
+            <span data-lang="es">Obtené tu key en <a href="https://brave.com/search/api/" target="_blank">brave.com/search/api</a></span>
+          </p>
+        </div>
+      </div>
+
+      <div class="btn-row">
+        <button class="btn-secondary" onclick="skipFeatures()">
+          <span data-lang="en">Skip</span>
+          <span data-lang="es">Omitir</span>
+        </button>
+        <button class="btn-primary" onclick="submitFeatures()">
+          <span data-lang="en">Continue</span>
+          <span data-lang="es">Continuar</span>
+        </button>
+      </div>
+    </div>
+
+    <!-- Step 8: Confirm -->
+    <div class="step" data-step="8">
       <h2 class="step-title">
         <span data-lang="en">Ready to launch</span>
         <span data-lang="es">Listo para arrancar</span>
@@ -1233,11 +1333,15 @@
       apiKey: '',
       model: null,
       telegram: { enabled: true, botToken: '' },
+      features: {
+        voice: { enabled: false, apiKey: '' },
+        webSearch: { enabled: false, apiKey: '' },
+      },
       subscriptionDone: false,
       subscriptionEmail: '',
     };
 
-    const totalSteps = 7;
+    const totalSteps = 8;
 
     // --- Prefix validation rules ---
     const keyPrefixes = {
@@ -1292,7 +1396,8 @@
       if (n === 4) setupApiKeyStep();
       if (n === 5) fetchModels();
       if (n === 6) resetTelegramUI();
-      if (n === 7) buildSummary();
+      if (n === 7) resetFeaturesUI();
+      if (n === 8) buildSummary();
     }
 
     document.getElementById('btnBack').addEventListener('click', () => {
@@ -1843,7 +1948,105 @@
       }
     }
 
-    // --- Step 7: Summary ---
+    // --- Step 7: Features ---
+    function toggleFeatureVoice() {
+      const enabled = document.getElementById('voiceToggle').checked;
+      state.features.voice.enabled = enabled;
+      document.getElementById('voiceFields').classList.toggle('visible', enabled);
+    }
+
+    function toggleFeatureWebSearch() {
+      const enabled = document.getElementById('webSearchToggle').checked;
+      state.features.webSearch.enabled = enabled;
+      document.getElementById('webSearchFields').classList.toggle('visible', enabled);
+    }
+
+    function resetFeaturesUI() {
+      document.getElementById('voiceFields').classList.toggle('visible', state.features.voice.enabled);
+      document.getElementById('webSearchFields').classList.toggle('visible', state.features.webSearch.enabled);
+    }
+
+    document.getElementById('groqKeyInput').addEventListener('input', function () {
+      const val = this.value.trim();
+      const msgEl = document.getElementById('groqKeyValidation');
+      state.features.voice.apiKey = val;
+      if (!val) {
+        this.className = 'input-field';
+        msgEl.innerHTML = '';
+        return;
+      }
+      if (val.startsWith('gsk_') && val.length > 10) {
+        this.className = 'input-field valid';
+        const msg = state.language === 'es' ? 'Formato válido' : 'Valid format';
+        msgEl.innerHTML = `<span class="validation-msg success">${msg}</span>`;
+      } else if (!val.startsWith('gsk_')) {
+        this.className = 'input-field invalid';
+        const msg = state.language === 'es'
+          ? 'La key debe empezar con <code>gsk_</code>'
+          : 'Key should start with <code>gsk_</code>';
+        msgEl.innerHTML = `<span class="validation-msg error">${msg}</span>`;
+      } else {
+        this.className = 'input-field';
+        msgEl.innerHTML = '';
+      }
+    });
+
+    document.getElementById('braveKeyInput').addEventListener('input', function () {
+      const val = this.value.trim();
+      const msgEl = document.getElementById('braveKeyValidation');
+      state.features.webSearch.apiKey = val;
+      if (!val) {
+        this.className = 'input-field';
+        msgEl.innerHTML = '';
+        return;
+      }
+      if (val.startsWith('BSA') && val.length > 10) {
+        this.className = 'input-field valid';
+        const msg = state.language === 'es' ? 'Formato válido' : 'Valid format';
+        msgEl.innerHTML = `<span class="validation-msg success">${msg}</span>`;
+      } else if (!val.startsWith('BSA')) {
+        this.className = 'input-field invalid';
+        const msg = state.language === 'es'
+          ? 'La key debe empezar con <code>BSA</code>'
+          : 'Key should start with <code>BSA</code>';
+        msgEl.innerHTML = `<span class="validation-msg error">${msg}</span>`;
+      } else {
+        this.className = 'input-field';
+        msgEl.innerHTML = '';
+      }
+    });
+
+    function skipFeatures() {
+      state.features.voice = { enabled: false, apiKey: '' };
+      state.features.webSearch = { enabled: false, apiKey: '' };
+      goToStep(8);
+    }
+
+    function submitFeatures() {
+      if (state.features.voice.enabled) {
+        const key = document.getElementById('groqKeyInput').value.trim();
+        if (!key) {
+          const msgEl = document.getElementById('groqKeyValidation');
+          const msg = state.language === 'es' ? 'Ingresá tu API key de Groq' : 'Enter your Groq API key';
+          msgEl.innerHTML = `<span class="validation-msg error">${msg}</span>`;
+          return;
+        }
+        state.features.voice.apiKey = key;
+      }
+      if (state.features.webSearch.enabled) {
+        const key = document.getElementById('braveKeyInput').value.trim();
+        if (!key) {
+          const msgEl = document.getElementById('braveKeyValidation');
+          const msg = state.language === 'es' ? 'Ingresá tu API key de Brave' : 'Enter your Brave API key';
+          msgEl.innerHTML = `<span class="validation-msg error">${msg}</span>`;
+          return;
+        }
+        state.features.webSearch.apiKey = key;
+      }
+      goToStep(8);
+    }
+
+    // --- Step 8: Summary ---
     function buildSummary() {
       const card = document.getElementById('summaryCard');
       const l = state.language;
@@ -1886,6 +2089,20 @@
             : (l === 'es' ? 'Desactivado' : 'Disabled'),
           step: 6,
         },
+        {
+          label: l === 'es' ? 'Voz' : 'Voice',
+          value: state.features.voice.enabled
+            ? (l === 'es' ? 'Activado' : 'Enabled')
+            : (l === 'es' ? 'Desactivado' : 'Disabled'),
+          step: 7,
+        },
+        {
+          label: l === 'es' ? 'Búsqueda Web' : 'Web Search',
+          value: state.features.webSearch.enabled
+            ? (l === 'es' ? 'Activado' : 'Enabled')
+            : (l === 'es' ? 'Desactivado' : 'Disabled'),
+          step: 7,
+        },
       ];
 
       card.innerHTML = items
@@ -1917,8 +2134,11 @@
       state.subscriptionDone = false;
       state.subscriptionEmail = '';
       state.telegram = { enabled: true, botToken: '' };
+      state.features = { voice: { enabled: false, apiKey: '' }, webSearch: { enabled: false, apiKey: '' } };
       pairingActive = false;
       document.getElementById('tgToggle').checked = true;
+      document.getElementById('voiceToggle').checked = false;
+      document.getElementById('webSearchToggle').checked = false;
       resetTelegramUI();
       goToStep(1);
     }
@@ -1943,6 +2163,16 @@
           enabled: state.telegram.enabled,
           botToken: state.telegram.enabled ? state.telegram.botToken : '',
         },
+        features: {
+          voice: {
+            enabled: state.features.voice.enabled,
+            apiKey: state.features.voice.enabled ? state.features.voice.apiKey : '',
+          },
+          webSearch: {
+            enabled: state.features.webSearch.enabled,
+            apiKey: state.features.webSearch.enabled ? state.features.webSearch.apiKey : '',
+          },
+        },
       };
       if (state.authMode === 'api-key') {
         payload.apiKey = state.apiKey;

package/setup-server/server.js

@@ -734,6 +734,15 @@ async function handleConfigure(req, res) {
       // chat_id is already captured by /api/telegram/pair during wizard Step 6
     }
 
+    // Handle optional features (voice transcription, web search)
+    const features = data.features || {};
+    if (features.voice && features.voice.enabled && features.voice.apiKey) {
+      writeSecretFile('groq_api_key', features.voice.apiKey);
+    }
+    if (features.webSearch && features.webSearch.enabled && features.webSearch.apiKey) {
+      writeSecretFile('brave_api_key', features.webSearch.apiKey);
+    }
+
     const gatewayToken = ensureGatewayToken();
 
     // Build env vars (excluding secrets)
@@ -745,6 +754,8 @@ async function handleConfigure(req, res) {
       MODEL_NAME:                 modelName,
       LIMBO_PORT:                 String(PORT),
       TELEGRAM_ENABLED:           telegram.enabled ? 'true' : 'false',
+      VOICE_ENABLED:              (features.voice && features.voice.enabled) ? 'true' : 'false',
+      WEB_SEARCH_ENABLED:         (features.webSearch && features.webSearch.enabled) ? 'true' : 'false',
     };
 
     // Write .env file (quote values to handle special chars)