onbuzz 4.2.0 → 4.4.0

package/src/interfaces/__tests__/videoJobsRoutes.test.js

@@ -0,0 +1,179 @@
+/**
+ * Tests for /api/videos/jobs (list), /api/videos/jobs/:id/cancel,
+ * /api/videos (list files), and DELETE /api/videos (delete file).
+ * Mini-app pattern — routes only, no full webServer boot.
+ */
+
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from '@jest/globals';
+import express from 'express';
+import { createServer } from 'http';
+import path from 'path';
+import fs from 'fs/promises';
+import os from 'os';
+
+const HTTP_STATUS = {
+  OK: 200, BAD_REQUEST: 400, NOT_FOUND: 404, SERVICE_UNAVAILABLE: 503, INTERNAL_SERVER_ERROR: 500,
+};
+
+function buildApp({ toolsRegistry, agentPool, sessions }) {
+  const app = express();
+
+  app.get('/api/videos/jobs', async (_req, res) => {
+    try {
+      const tool = toolsRegistry?.getTool?.('video-gen');
+      if (!tool || typeof tool.getJobsSnapshot !== 'function') {
+        return res.json({ success: true, queued: [], active: [], completed: [], limits: {} });
+      }
+      res.json({ success: true, ...tool.getJobsSnapshot() });
+    } catch (error) {
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  app.post('/api/videos/jobs/:jobId/cancel', async (req, res) => {
+    try {
+      const tool = toolsRegistry?.getTool?.('video-gen');
+      if (!tool || typeof tool.cancelJob !== 'function') {
+        return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({ success: false, error: 'Video tool not available' });
+      }
+      const result = tool.cancelJob(req.params.jobId);
+      if (!result.success) return res.status(HTTP_STATUS.NOT_FOUND).json(result);
+      res.json(result);
+    } catch (error) {
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  app.get('/api/videos', async (req, res) => {
+    try {
+      if (!agentPool) return res.json({ success: true, videos: [] });
+      const requestedAgentId = req.query.agentId || null;
+      const agents = await agentPool.getAllAgents();
+      const results = [];
+      const seen = new Set();
+      const VIDEO_EXTS = new Set(['.mp4', '.webm', '.mov', '.gif']);
+      for (const agent of (agents instanceof Map ? Array.from(agents.values()) : agents)) {
+        if (requestedAgentId && agent.id !== requestedAgentId) continue;
+        const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+        if (!workDir) continue;
+        const videosDir = path.join(workDir, 'videos');
+        let entries;
+        try { entries = await fs.readdir(videosDir); } catch { continue; }
+        for (const name of entries) {
+          const ext = path.extname(name).toLowerCase();
+          if (!VIDEO_EXTS.has(ext)) continue;
+          const abs = path.join(videosDir, name);
+          if (seen.has(abs)) continue;
+          seen.add(abs);
+          let stat;
+          try { stat = await fs.stat(abs); } catch { continue; }
+          if (!stat.isFile()) continue;
+          const anySession = Array.from(sessions.values())[0];
+          const sessionId = agent.sessionId || anySession?.sessionId || 'web-session';
+          results.push({
+            filename: name, agentId: agent.id, agentName: agent.name,
+            projectDir: workDir, mtime: stat.mtime.toISOString(), size: stat.size,
+            url: `/api/videos/${encodeURIComponent(sessionId)}/${encodeURIComponent(name)}`,
+          });
+        }
+      }
+      results.sort((a, b) => b.mtime.localeCompare(a.mtime));
+      res.json({ success: true, videos: results });
+    } catch (error) {
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  app.delete('/api/videos', async (req, res) => {
+    try {
+      const { agentId, filename } = req.query;
+      if (!agentId || !filename) return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'agentId and filename are required' });
+      const normalized = path.basename(filename);
+      if (normalized !== filename || filename.includes('..')) return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
+      const ext = path.extname(normalized).toLowerCase();
+      if (!['.mp4', '.webm', '.mov', '.gif'].includes(ext)) return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Unsupported file extension for video delete' });
+      if (!agentPool) return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({ success: false, error: 'Agent pool not available' });
+      const agent = await agentPool.getAgent(agentId);
+      if (!agent) return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Agent not found' });
+      const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
+      if (!workDir) return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Agent has no working directory' });
+      const target = path.join(workDir, 'videos', normalized);
+      await fs.unlink(target);
+      res.json({ success: true });
+    } catch (error) {
+      if (error.code === 'ENOENT') return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Video not found' });
+      res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+    }
+  });
+
+  return app;
+}
+
+async function http(url, options = {}) {
+  const resp = await globalThis.fetch(url, options);
+  const body = resp.headers.get('content-type')?.includes('json') ? await resp.json() : await resp.text();
+  return { status: resp.status, body };
+}
+
+describe('video jobs routes', () => {
+  let server, baseUrl;
+  let tool; // fake video tool
+
+  beforeAll(() => {
+    tool = {
+      _q: [],
+      _a: [],
+      _c: [],
+      getJobsSnapshot() {
+        return { queued: this._q, active: this._a, completed: this._c, limits: { queue: 5, concurrency: 2 } };
+      },
+      cancelJob(jobId) {
+        if (this._q.find(j => j.jobId === jobId)) { this._q = this._q.filter(j => j.jobId !== jobId); return { success: true, state: 'queued' }; }
+        if (this._a.find(j => j.jobId === jobId)) { this._a = this._a.filter(j => j.jobId !== jobId); return { success: true, state: 'active' }; }
+        return { success: false, error: 'Job not found or already terminal' };
+      },
+    };
+    const toolsRegistry = { getTool: (id) => id === 'video-gen' ? tool : null };
+    const app = buildApp({ toolsRegistry, agentPool: null, sessions: new Map() });
+    server = createServer(app);
+    return new Promise(r => server.listen(0, () => { baseUrl = `http://localhost:${server.address().port}`; r(); }));
+  });
+
+  afterAll(() => { server?.close(); });
+
+  beforeEach(() => {
+    tool._q = []; tool._a = []; tool._c = [];
+  });
+
+  it('GET /api/videos/jobs returns snapshot', async () => {
+    tool._q = [{ jobId: 'q1', prompt: 'fox' }];
+    tool._a = [{ jobId: 'a1', prompt: 'bear' }];
+    tool._c = [{ jobId: 'c1', prompt: 'eagle' }];
+    const { status, body } = await http(`${baseUrl}/api/videos/jobs`);
+    expect(status).toBe(200);
+    expect(body.queued).toHaveLength(1);
+    expect(body.active).toHaveLength(1);
+    expect(body.completed).toHaveLength(1);
+    expect(body.limits).toMatchObject({ queue: 5 });
+  });
+
+  it('POST cancel removes a queued job', async () => {
+    tool._q = [{ jobId: 'q1' }];
+    const { status, body } = await http(`${baseUrl}/api/videos/jobs/q1/cancel`, { method: 'POST' });
+    expect(status).toBe(200);
+    expect(body.success).toBe(true);
+    expect(body.state).toBe('queued');
+    expect(tool._q).toHaveLength(0);
+  });
+
+  it('POST cancel returns 404 for unknown job', async () => {
+    const { status, body } = await http(`${baseUrl}/api/videos/jobs/nope/cancel`, { method: 'POST' });
+    expect(status).toBe(404);
+    expect(body.success).toBe(false);
+  });
+});
+
+// Library routes are now GalleryService-backed — see galleryService.test.js
+// and galleryRoutes.test.js for the thorough coverage. The only difference
+// for videos is the file extensions and paths, which galleryService handles
+// by delegation; a duplicate integration test here would be redundant.

package/src/interfaces/schedulerRoutes.js

@@ -0,0 +1,50 @@
+/**
+ * Scheduler visualizer routes — extracted from webServer.js so they're
+ * testable against the real production wiring (the lesson from the widget
+ * routes 503 incident: tests that don't match production shape don't catch
+ * production bugs).
+ *
+ * Two routes:
+ *   GET /api/scheduler/state   — JSON snapshot from scheduler.getState()
+ *   GET /scheduler             — self-contained HTML viewer page
+ *
+ * Registration:
+ *   registerSchedulerRoutes(app, {
+ *     getScheduler: () => orchestrator?.agentPool?.scheduler,
+ *     logger,
+ *     html: SCHEDULER_VIEWER_HTML,
+ *   });
+ *
+ * `getScheduler` is a thunk (not the scheduler itself) so the routes resolve
+ * the scheduler at request-time — handles the case where the scheduler is
+ * attached after the routes are registered (orchestrator startup ordering).
+ */
+
+export function registerSchedulerRoutes(app, deps = {}) {
+  if (!app) return;
+  const getScheduler = typeof deps.getScheduler === 'function' ? deps.getScheduler : () => null;
+  const logger = deps.logger || { error: () => {} };
+  const html = typeof deps.html === 'string' ? deps.html : '<!doctype html><title>scheduler</title>';
+
+  // JSON snapshot of scheduler + all agents — polled by /scheduler at 1 Hz.
+  app.get('/api/scheduler/state', async (req, res) => {
+    try {
+      const sched = getScheduler();
+      if (!sched || typeof sched.getState !== 'function') {
+        return res.status(503).json({ error: 'scheduler is not attached' });
+      }
+      const state = await sched.getState();
+      res.json(state);
+    } catch (err) {
+      try { logger.error('Failed to build scheduler state', { error: err?.message }); } catch (_) {}
+      res.status(500).json({ error: err?.message || 'unknown' });
+    }
+  });
+
+  // Self-contained HTML viewer page (no external assets).
+  app.get('/scheduler', (req, res) => {
+    res.type('html').send(html);
+  });
+}
+
+export default { registerSchedulerRoutes };

package/src/interfaces/webServer.js

@@ -29,6 +29,8 @@ import { getVisualEditorServer, getVisualEditorPort, getVisualEditorBaseUrl, set
 
 // Import credential vault for secure credential management
 import { getCredentialVault } from '../services/credentialVault.js';
+import { getGalleryService } from '../services/galleryService.js';
+import { getUserDataPaths } from '../utilities/userDataDir.js';
 
 // Connect visual editor server to bridge (enables element selection forwarding)
 setBridgeGetter(getVisualEditorBridge);
@@ -42,6 +44,9 @@ import { initFileExplorerModule } from '../modules/fileExplorer/index.js';
 // Import FlowExecutor for flow pipeline execution
 import FlowExecutor from '../core/flowExecutor.js';
 
+// Scheduler visualizer routes (extracted for testability)
+import { registerSchedulerRoutes } from './schedulerRoutes.js';
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
@@ -430,7 +435,7 @@ class WebServer {
   async initialize() {
     try {
       this.setupMiddleware();
-      this.setupRoutes();
+      await this.setupRoutes();
       this.setupWebSocket();
 
       await this.startServer();
@@ -659,7 +664,61 @@ class WebServer {
    * Setup API routes
    * @private
    */
-  setupRoutes() {
+  async setupRoutes() {
+    // widget-module: remove this block if the module is deleted.
+    // Mounts the widget runtime asset + audit routes under /api/widget/*.
+    // AWAITED BEFORE other routes: Express matches routes in registration
+    // order, and the SPA catch-all registered later in this file matches
+    // EVERY GET request — if widget routes aren't in place first, the
+    // fallback returns index.html for /api/widget/runtime.js and the
+    // iframe tries to parse HTML as JS ("Unexpected token '<'").
+    try {
+      const mod = await import('../modules/widget/index.js');
+      if (!mod.isDisabled()) {
+        // The orchestrator does NOT carry toolsRegistry in production —
+        // it lives on `this` (the WebServer). Other route handlers in
+        // this file work around it with a `this.toolsRegistry || ...
+        // orchestrator?.toolsRegistry` fallback. Pass both explicitly
+        // so the widget module's routes resolve the tool reliably.
+        mod.registerRoutes(this.app, this.orchestrator, {
+          toolsRegistry: this.toolsRegistry,
+        });
+        this.logger.info('Widget module routes registered');
+
+        // Bridge the WidgetTool's event bus to a `widget_changed` WebSocket
+        // push. The artifacts panel listens for these so its summary cache
+        // stays current — independent of whether the chat feed has the
+        // tool-result message mounted (the feed is lazily virtualized; old
+        // entries unload as the user scrolls and would otherwise be missed).
+        try {
+          const widgetTool =
+            this.toolsRegistry?.getTool?.('widget') ||
+            this.orchestrator?.toolsRegistry?.getTool?.('widget');
+          if (widgetTool?.events?.on) {
+            widgetTool.events.on('widget-changed', (evt) => {
+              try {
+                // sessionId=null → broadcastToSession falls back to all
+                // connections. The frontend filters on currentAgent.
+                this.broadcastToSession(null, {
+                  type: 'widget_changed',
+                  data: evt,
+                });
+              } catch (err) {
+                this.logger.warn('Failed to broadcast widget_changed', { error: err.message });
+              }
+            });
+            this.logger.info('Widget event bus bridged to WebSocket');
+          } else {
+            this.logger.warn('Widget tool has no events bus — push updates disabled');
+          }
+        } catch (err) {
+          this.logger.warn('Widget event bus subscribe failed', { error: err.message });
+        }
+      }
+    } catch (err) {
+      this.logger.warn('Widget module not available', { error: err.message });
+    }
+
     // Health check
     this.app.get('/api/health', async (req, res) => {
       try {
@@ -2703,62 +2762,21 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
-    // Gallery: list generated images across all agent working directories.
-    // Scans each agent's `{workingDirectory}/images/` folder for image files
-    // (the convention set by imageTool.js which always saves under `images/`).
-    // Returns { images: [{ filename, agentId, agentName, projectDir, mtime,
-    // size, url }] } sorted newest-first. Deliberately light on metadata —
-    // prompts/model info aren't persisted as sidecar data today; that would
-    // be a separate feature requiring imageTool to write a .json next to each
-    // output. For now the filename carries the timestamp.
+    // Gallery: list images from the durable gallery store. Delegates to
+    // GalleryService which reads `{userDataDir}/gallery/images/` and
+    // enriches each entry from its .json sidecar (prompt, model, agent,
+    // etc.). The tool writes to the gallery automatically when the
+    // agent's toolConfig.image-gen.saveToGallery is true (default).
     this.app.get('/api/images', async (req, res) => {
       try {
-        if (!this.orchestrator?.agentPool) {
-          return res.json({ success: true, images: [] });
-        }
-        const requestedAgentId = req.query.agentId || null;
-        const agents = await this.orchestrator.agentPool.getAllAgents();
-        const results = [];
-        const seen = new Set(); // dedupe by absolute path
-        const IMAGE_EXTS = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
-
-        for (const agent of (agents instanceof Map ? Array.from(agents.values()) : agents)) {
-          if (requestedAgentId && agent.id !== requestedAgentId) continue;
-          const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
-          if (!workDir) continue;
-          const imagesDir = path.join(workDir, 'images');
-          let entries;
-          try {
-            entries = await fs.readdir(imagesDir);
-          } catch {
-            continue; // no images/ dir
-          }
-          for (const name of entries) {
-            const ext = path.extname(name).toLowerCase();
-            if (!IMAGE_EXTS.has(ext)) continue;
-            const abs = path.join(imagesDir, name);
-            if (seen.has(abs)) continue;
-            seen.add(abs);
-            let stat;
-            try { stat = await fs.stat(abs); } catch { continue; }
-            if (!stat.isFile()) continue;
-            // Pick a session id for the URL builder — prefer the agent's
-            // current session, otherwise any active session.
-            const anySession = Array.from(this.sessions.values())[0];
-            const sessionId = agent.sessionId || anySession?.sessionId || 'web-session';
-            results.push({
-              filename: name,
-              agentId: agent.id,
-              agentName: agent.name,
-              projectDir: workDir,
-              mtime: stat.mtime.toISOString(),
-              size: stat.size,
-              url: `/api/images/${encodeURIComponent(sessionId)}/${encodeURIComponent(name)}`,
-            });
-          }
-        }
-        results.sort((a, b) => b.mtime.localeCompare(a.mtime));
-        res.json({ success: true, images: results });
+        const gallery = getGalleryService(this.logger);
+        const entries = await gallery.listImages({ agentId: req.query.agentId || undefined });
+        const images = entries.map(e => ({
+          ...e,
+          size: e.bytes, // legacy name used by the frontend
+          url: `/api/gallery/images/${encodeURIComponent(e.filename)}`,
+        }));
+        res.json({ success: true, images });
       } catch (error) {
         this.logger.error('Gallery list failed', { error: error.message });
         res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
@@ -2768,65 +2786,113 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
-    // Delete a generated image. Identified by (agentId, filename) — we look
-    // up the agent's working directory and unlink the file there. Refuses
-    // path-traversal attempts and only deletes files matching an image
-    // extension from an `images/` folder we expect.
+    // Delete a gallery image (asset + sidecar). Filename is the gallery's
+    // timestamped filename, not the agent's original — the list endpoint
+    // emits it as `filename`.
     this.app.delete('/api/images', async (req, res) => {
       try {
-        const { agentId, filename } = req.query;
-        if (!agentId || !filename) {
+        const { filename } = req.query;
+        if (!filename) {
           return res.status(HTTP_STATUS.BAD_REQUEST).json({
             success: false,
-            error: 'agentId and filename are required',
+            error: 'filename is required',
           });
         }
-        const normalized = path.basename(filename);
-        if (normalized !== filename || filename.includes('..')) {
-          return res.status(HTTP_STATUS.BAD_REQUEST).json({
+        const gallery = getGalleryService(this.logger);
+        const existed = await gallery.deleteImage(filename);
+        if (!existed) {
+          return res.status(HTTP_STATUS.NOT_FOUND).json({
             success: false,
-            error: 'Invalid filename',
+            error: 'Image not found',
           });
         }
-        const ext = path.extname(normalized).toLowerCase();
-        if (!['.png', '.jpg', '.jpeg', '.webp', '.gif'].includes(ext)) {
+        res.json({ success: true });
+      } catch (error) {
+        if (error.code === 'INVALID_FILENAME') {
           return res.status(HTTP_STATUS.BAD_REQUEST).json({
             success: false,
-            error: 'Unsupported file extension for gallery delete',
+            error: 'Invalid filename',
           });
         }
-        if (!this.orchestrator?.agentPool) {
-          return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({
+        if (error.code === 'INVALID_EXT') {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({
             success: false,
-            error: 'Agent pool not available',
+            error: 'Unsupported file extension',
           });
         }
-        const agent = await this.orchestrator.agentPool.getAgent(agentId);
-        if (!agent) {
-          return res.status(HTTP_STATUS.NOT_FOUND).json({
-            success: false,
-            error: 'Agent not found',
-          });
+        this.logger.error('Gallery delete failed', { error: error.message });
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
+          success: false,
+          error: error.message,
+        });
+      }
+    });
+
+    // Serve a gallery image directly from `{userDataDir}/gallery/images/`.
+    // Used by the /gallery page. Path traversal + extension gating live
+    // here — the raw file is under userDataDir so this is the only
+    // access point.
+    this.app.get('/api/gallery/images/:filename', async (req, res) => {
+      try {
+        const filename = req.params.filename;
+        const normalized = path.basename(filename);
+        if (normalized !== filename || filename.includes('..')) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
         }
-        const workDir = agent.directoryAccess?.workingDirectory || agent.projectDir;
-        if (!workDir) {
-          return res.status(HTTP_STATUS.BAD_REQUEST).json({
-            success: false,
-            error: 'Agent has no working directory',
-          });
+        const ext = path.extname(normalized).toLowerCase();
+        if (!['.png', '.jpg', '.jpeg', '.webp', '.gif'].includes(ext)) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Unsupported extension' });
         }
-        const target = path.join(workDir, 'images', normalized);
-        await fs.unlink(target);
-        this.logger.info('Gallery image deleted', { agentId, filename: normalized });
-        res.json({ success: true });
+        const target = path.join(getUserDataPaths().galleryImages, normalized);
+        res.sendFile(target, (err) => {
+          if (err && !res.headersSent) {
+            res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Image not found' });
+          }
+        });
       } catch (error) {
-        if (error.code === 'ENOENT') {
-          return res.status(HTTP_STATUS.NOT_FOUND).json({
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+      }
+    });
+
+    // Video jobs: live snapshot of queue + active + recently completed
+    // jobs from the `video-gen` tool instance. The tool keeps this state
+    // in-memory on its singleton instance; we fetch via toolsRegistry.
+    this.app.get('/api/videos/jobs', async (req, res) => {
+      try {
+        const tool = this.orchestrator?.toolsRegistry?.getTool?.('video-gen');
+        if (!tool || typeof tool.getJobsSnapshot !== 'function') {
+          return res.json({ success: true, queued: [], active: [], completed: [], limits: {} });
+        }
+        const snap = tool.getJobsSnapshot();
+        res.json({ success: true, ...snap });
+      } catch (error) {
+        this.logger.error('Video jobs list failed', { error: error.message });
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
+          success: false,
+          error: error.message,
+        });
+      }
+    });
+
+    // Cancel a queued or active video job. Completed/failed jobs can't be
+    // cancelled — delete them from the history with DELETE /api/videos.
+    this.app.post('/api/videos/jobs/:jobId/cancel', async (req, res) => {
+      try {
+        const { jobId } = req.params;
+        const tool = this.orchestrator?.toolsRegistry?.getTool?.('video-gen');
+        if (!tool || typeof tool.cancelJob !== 'function') {
+          return res.status(HTTP_STATUS.SERVICE_UNAVAILABLE).json({
             success: false,
-            error: 'Image not found',
+            error: 'Video tool not available',
           });
         }
-        this.logger.error('Gallery delete failed', { error: error.message });
+        const result = tool.cancelJob(jobId);
+        if (!result.success) {
+          return res.status(HTTP_STATUS.NOT_FOUND).json(result);
+        }
+        res.json(result);
+      } catch (error) {
+        this.logger.error('Video job cancel failed', { error: error.message });
         res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
           success: false,
           error: error.message,
@@ -2834,6 +2900,75 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
+    // Video gallery: list videos from the durable gallery store.
+    // Delegates to GalleryService. Sidecars carry prompt/model/duration.
+    this.app.get('/api/videos', async (req, res) => {
+      try {
+        const gallery = getGalleryService(this.logger);
+        const entries = await gallery.listVideos({ agentId: req.query.agentId || undefined });
+        const videos = entries.map(e => ({
+          ...e,
+          size: e.bytes,
+          url: `/api/gallery/videos/${encodeURIComponent(e.filename)}`,
+        }));
+        res.json({ success: true, videos });
+      } catch (error) {
+        this.logger.error('Video gallery list failed', { error: error.message });
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({
+          success: false,
+          error: error.message,
+        });
+      }
+    });
+
+    // Delete a gallery video (asset + sidecar).
+    this.app.delete('/api/videos', async (req, res) => {
+      try {
+        const { filename } = req.query;
+        if (!filename) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'filename is required' });
+        }
+        const gallery = getGalleryService(this.logger);
+        const existed = await gallery.deleteVideo(filename);
+        if (!existed) {
+          return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Video not found' });
+        }
+        res.json({ success: true });
+      } catch (error) {
+        if (error.code === 'INVALID_FILENAME') {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
+        }
+        if (error.code === 'INVALID_EXT') {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Unsupported file extension' });
+        }
+        this.logger.error('Video delete failed', { error: error.message });
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+      }
+    });
+
+    // Serve a gallery video from `{userDataDir}/gallery/videos/`.
+    this.app.get('/api/gallery/videos/:filename', async (req, res) => {
+      try {
+        const filename = req.params.filename;
+        const normalized = path.basename(filename);
+        if (normalized !== filename || filename.includes('..')) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
+        }
+        const ext = path.extname(normalized).toLowerCase();
+        if (!['.mp4', '.webm', '.mov', '.gif'].includes(ext)) {
+          return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Unsupported extension' });
+        }
+        const target = path.join(getUserDataPaths().galleryVideos, normalized);
+        res.sendFile(target, (err) => {
+          if (err && !res.headersSent) {
+            res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Video not found' });
+          }
+        });
+      } catch (error) {
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+      }
+    });
+
     // Video serving endpoint for generated videos
     this.app.get('/api/videos/:sessionId/:filename', async (req, res) => {
       try {
@@ -3350,24 +3485,13 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
     // Scheduler Visualizer — JSON state endpoint + HTML viewer
     // ============================================
 
-    // JSON snapshot of scheduler + all agents — polled by /scheduler at 1 Hz.
-    this.app.get('/api/scheduler/state', async (req, res) => {
-      try {
-        const sched = this.orchestrator?.agentPool?.scheduler;
-        if (!sched?.getState) {
-          return res.status(503).json({ error: 'scheduler is not attached' });
-        }
-        const state = await sched.getState();
-        res.json(state);
-      } catch (err) {
-        this.logger.error('Failed to build scheduler state', { error: err.message });
-        res.status(500).json({ error: err.message });
-      }
-    });
-
-    // Self-contained HTML viewer. See SCHEDULER_VIEWER_HTML below.
-    this.app.get('/scheduler', (req, res) => {
-      res.type('html').send(SCHEDULER_VIEWER_HTML);
+    // Mount scheduler visualizer routes via the extracted helper. The thunk
+    // form for getScheduler ensures we resolve the scheduler at request time
+    // (it may be attached after route registration during orchestrator boot).
+    registerSchedulerRoutes(this.app, {
+      getScheduler: () => this.orchestrator?.agentPool?.scheduler,
+      logger: this.logger,
+      html: SCHEDULER_VIEWER_HTML,
     });
 
     // ============================================