total-recall-brain 3.13.0 → 3.13.2

package/src/server/auth.mjs

@@ -404,6 +404,57 @@ export async function changePasswordHandler(req, res) {
   res.json({ success: true });
 }
 
+/**
+ * Short-lived step-up token for high-risk actions (secret reveal / copy).
+ * Requires a fresh passkey assertion or password re-entry to mint.
+ *
+ * @param {{ purpose?: string, ttlSeconds?: number, actor?: string }} opts
+ */
+export function mintStepUpToken(opts = {}) {
+  const purpose = opts.purpose || 'secrets:reveal';
+  const ttl = Math.min(300, Math.max(15, opts.ttlSeconds || 60));
+  return jwt.sign(
+    {
+      purpose,
+      step_up: true,
+      actor: opts.actor || 'dashboard',
+    },
+    JWT_SECRET,
+    { expiresIn: ttl },
+  );
+}
+
+/**
+ * @param {string} token
+ * @param {string} expectedPurpose
+ * @returns {{ ok: true, payload: object } | { ok: false, error: string }}
+ */
+export function verifyStepUpToken(token, expectedPurpose = 'secrets:reveal') {
+  if (!token || typeof token !== 'string') {
+    return { ok: false, error: 'Step-up token required' };
+  }
+  try {
+    const payload = jwt.verify(token, JWT_SECRET);
+    if (!payload?.step_up || payload.purpose !== expectedPurpose) {
+      return { ok: false, error: 'Invalid step-up purpose' };
+    }
+    return { ok: true, payload };
+  } catch {
+    return { ok: false, error: 'Step-up token invalid or expired — re-authenticate with passkey' };
+  }
+}
+
+/**
+ * Re-check dashboard password (step-up when no passkey registered).
+ */
+export async function verifyDashboardPassword(password) {
+  if (!password) return false;
+  const config = loadSecurityConfig();
+  const passwordHash = config.dashboard?.password_hash;
+  if (!passwordHash) return false;
+  return bcrypt.compare(String(password), passwordHash);
+}
+
 export function logoutHandler(req, res) {
   res.clearCookie('session');
   res.json({ success: true });

package/src/server/index.mjs

@@ -114,7 +114,7 @@ app.get('/health', requireAuthOrLocal, async (req, res) => {
   // CLI agent availability
   const { findBinaryInPath } = await import('../core/runtime.mjs');
   const cliAgents = [];
-  for (const bin of ['antigravity', 'gemini', 'claude', 'codex']) {
+  for (const bin of ['antigravity', 'grok', 'gemini', 'claude', 'codex']) {
     if (findBinaryInPath(bin)) cliAgents.push(bin);
   }
 
@@ -179,7 +179,7 @@ app.get('/health', requireAuthOrLocal, async (req, res) => {
 app.get('/api/health', requireAuth, requireScope('health:read'), async (req, res) => {
   const { findBinaryInPath } = await import('../core/runtime.mjs');
   const agents = [];
-  for (const bin of ['antigravity', 'gemini', 'claude', 'codex']) {
+  for (const bin of ['antigravity', 'grok', 'gemini', 'claude', 'codex']) {
     if (findBinaryInPath(bin)) agents.push(bin);
   }
 
@@ -189,7 +189,7 @@ app.get('/api/health', requireAuth, requireScope('health:read'), async (req, res
       runtime: 'cli-agents',
       uptime_seconds: Math.floor(process.uptime()),
       capabilities: [],
-      reason: 'No CLI agents found. Install antigravity, claude, or codex.',
+      reason: 'No CLI agents found. Install antigravity, grok, claude, or codex.',
     });
   }
 

package/src/server/keys.mjs

@@ -25,6 +25,7 @@ export const KNOWN_SCOPES = [
   'models:read',
   'instructions:read',
   'ssss:read',
+  'ssss:write',
   'memory:read',
   'memory:write',
   'memory:recompile',
@@ -52,6 +53,12 @@ function safeEqualHex(a, b) {
 
 function normalizeKey(raw) {
   const key = { ...raw };
+  // name must always be a string — guard against bad issueKey({ name }) calls
+  if (key.name && typeof key.name === 'object') {
+    key.name = String(key.name.name || key.name.label || 'Unnamed Key');
+  } else if (typeof key.name !== 'string' || !key.name.trim()) {
+    key.name = key.name == null ? 'Unnamed Key' : String(key.name);
+  }
   if (key.token && typeof key.token === 'string') {
     if (key.token === 'local') {
       key.revoked = true;
@@ -129,16 +136,35 @@ function saveKeys(keys) {
   fs.writeFileSync(KEYS_FILE, sanitized.map(k => JSON.stringify(k)).join('\n') + (sanitized.length ? '\n' : ''), { encoding: 'utf8', mode: 0o600 });
 }
 
-export function issueKey(name, options = {}) {
+/**
+ * Issue a PAT.
+ * @param {string|object} nameOrOpts - display name, or { name, scopes, expires_at }
+ * @param {object} [options]
+ */
+export function issueKey(nameOrOpts, options = {}) {
+  let name = nameOrOpts;
+  let opts = options;
+  // Accept issueKey({ name, scopes }) form safely
+  if (nameOrOpts && typeof nameOrOpts === 'object' && !Array.isArray(nameOrOpts)) {
+    name = nameOrOpts.name || nameOrOpts.label || 'Unnamed Key';
+    opts = {
+      scopes: nameOrOpts.scopes ?? options.scopes,
+      expires_at: nameOrOpts.expires_at ?? nameOrOpts.expiresAt ?? options.expires_at ?? options.expiresAt,
+    };
+  }
+  if (typeof name !== 'string' || !name.trim()) {
+    name = 'Unnamed Key';
+  }
+
   const keys = loadKeys();
   const token = `tr_${crypto.randomBytes(32).toString('base64url')}`;
   const key = {
     id: crypto.randomUUID(),
-    name: name || 'Unnamed Key',
+    name: name.trim(),
     token_hash: hashToken(token),
     token_prefix: token.slice(0, 8),
-    scopes: normalizeScopes(options.scopes),
-    expires_at: options.expires_at || options.expiresAt || null,
+    scopes: normalizeScopes(opts.scopes),
+    expires_at: opts.expires_at || opts.expiresAt || null,
     created_at: new Date().toISOString(),
     last_used_at: null,
     hit_count: 0,

package/src/server/rest.mjs

@@ -33,7 +33,7 @@
  *     GET    /api/config              get sanitized runtime + security config
  *
  *   Models (OpenAI-compatible extension)
- *     GET    /v1/models               list available Ollama models
+ *     GET    /v1/models               list available models (OpenAI-compatible)
  *
  *   Vault (admin operations)
  *     POST   /api/vault/compile       trigger full surface compile (re-generates compile.json)
@@ -81,12 +81,16 @@ import { synthesize as synthesizeTts, isTtsEnabled, TtsNotConfiguredError } from
 import { logger } from '../core/logger.mjs';
 import { memoryRouter }   from './routes/memory.mjs';
 import { keysRouter }     from './routes/keys.mjs';
+import { secretsRouter }  from './routes/secrets.mjs';
 import { sessionsRouter } from './routes/sessions.mjs';
 import { shareRouter }    from './routes/share.mjs';
 import { authRouter }     from './routes/auth.mjs';
+import { webauthnRouter } from './routes/webauthn.mjs';
 import { sandboxRouter }  from './routes/sandbox.mjs';
 import { researchRouter } from './routes/research.mjs';
 import { skillsRouter }   from './routes/skills.mjs';
+import { docsRouter }     from './routes/docs.mjs';
+import syncRouter         from './routes/sync.mjs';
 // ollamaUrl removed — CLI agents replace Ollama
 import {
   AGENT_DIR,
@@ -101,7 +105,7 @@ import {
   CONFIG_DIR
 } from './routes/_shared.mjs';
 
-const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const ROOT = process.env.TR_ROOT || path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const MODEL_CATALOG_DIR = path.join(ROOT, 'models', 'catalog', 'total-recall');
 
 function listFilesRecursive(root, predicate) {
@@ -161,14 +165,18 @@ const router = express.Router();
 // handlers below so URL precedence stays identical to the pre-refactor file.
 router.use(memoryRouter);
 router.use(keysRouter);
+router.use(secretsRouter);
 router.use(sessionsRouter);
 router.use(shareRouter);
 router.use(authRouter);
+router.use(webauthnRouter);
 router.use(sandboxRouter);
 router.use(researchRouter);
 router.use(skillsRouter);
+router.use(docsRouter);
+router.use(syncRouter);
 
-// ─── Helpers ──────────────────────────────────────────────────────────────────
+// ─── Brain Routing Middleware ──────────────────────────────────────────────────────────────────
 
 function notFound(res, msg) {
   return res.status(404).json({ error: msg || 'Not found' });
@@ -198,7 +206,6 @@ function sanitizeNode({ body, ...rest }) {
  * POST /api/memory/search/semantic
  * Body: { query: string, top_k?: number }
  * Returns top-k vault nodes ranked by vector similarity to the query.
- * Requires Ollama with nomic-embed-text running.
  */
 router.post('/api/memory/search/semantic', requireAuth, requireScope('memory:read'), async (req, res) => {
   try {
@@ -208,7 +215,6 @@ router.post('/api/memory/search/semantic', requireAuth, requireScope('memory:rea
     if (results.length === 0) return res.status(503).json({ error: 'Embeddings index is empty. Run POST /api/vault/compile to build it.' });
     res.json({ query, top_k: Math.min(Number(top_k) || 5, 20), results });
   } catch (err) {
-    if (err.message?.includes('Ollama')) return res.status(503).json({ error: err.message });
     serverError(res, err);
   }
 });
@@ -233,7 +239,7 @@ router.post('/api/vault/compile', requireAuth, requireScope('memory:recompile'),
       const vaultNodes = getNodes(VAULT_DIR);
       vaultEmbed = await buildEmbeddingsIndex(vaultNodes, DERIVED_DIR);
       sessionEmbed = await buildSessionEmbeddingsIndex(SESSIONS_DIR, DERIVED_DIR);
-    } catch { /* Ollama may not be running — non-fatal */ }
+    } catch { /* embedding service may be unavailable — non-fatal */ }
     res.json({ compiled: true, elapsed_ms: Date.now() - start, vault_embeddings: vaultEmbed, session_embeddings: sessionEmbed });
   } catch (err) {
     serverError(res, err);
@@ -633,7 +639,7 @@ router.get('/api', (req, res) => {
         'GET /api/memory/stats':                  'Node counts by category',
         'GET /api/memory/:slug':                  'Get node by slug',
         'POST /api/memory':                       'Create node (slug, title, category, content)',
-        'POST /api/memory/search/semantic':       'Semantic search by meaning (query, top_k) — requires Ollama',
+        'POST /api/memory/search/semantic':       'Semantic search by meaning (query, top_k)',
         'PUT /api/memory/:slug':                  'Replace node',
         'PATCH /api/memory/:slug':                'Partial update',
         'DELETE /api/memory/:slug':               'Delete node',
@@ -666,7 +672,7 @@ router.get('/api', (req, res) => {
       },
       discovery: {
         'GET /.well-known/total-recall.json': 'Client auto-config manifest',
-        'GET /health':                      'System health (disk, ollama, vault)',
+        'GET /health':                      'System health (disk, embedding service, vault)',
       },
     },
     scopes: {
@@ -751,7 +757,7 @@ router.post('/api/integrations/connect', requireAuth, (req, res) => {
 
     const validClients = [
       'vscode', 'pi', 'hermes', 'openclaw', 'cursor', 'claude-code',
-      'codex', 'gemini', 'aider', 'ultrachat', 'obsidian',
+      'codex', 'gemini', 'aider', 'http-api', 'obsidian',
       'generic', 'antigravity'
     ];
 
@@ -815,7 +821,7 @@ router.get('/api/import/rules', requireAuth, requireScope('memory:read'), (req,
  * Import rule files into the vault.
  * Body: { dirs?: string[], files?: string[], force?: boolean, dryRun?: boolean }
  */
-router.post('/api/import/rules', requireAuth, requireScope('memory:write'), (req, res) => {
+router.post('/api/import/rules', requireAuth, requireScope('memory:write'), async (req, res) => {
   try {
     const { dirs, force = false, dryRun = false } = req.body || {};
     const searchDirs = dirs?.length ? dirs : [process.cwd(), os.homedir()];
@@ -824,7 +830,7 @@ router.post('/api/import/rules', requireAuth, requireScope('memory:write'), (req
       ? detected.filter(f => req.body.files.includes(f.absolutePath))
       : detected.filter(f => !f.alreadyImported || force);
     if (dryRun) return res.json({ dryRun: true, detected, toImport, imported: [], skipped: [], failed: [] });
-    const result = importRuleFiles(toImport, { force, vaultDir: VAULT_DIR });
+    const result = await importRuleFiles(toImport, { force, vaultDir: VAULT_DIR });
     res.json({ detected, ...result });
     
   } catch (err) { serverError(res, err); }
@@ -1519,8 +1525,50 @@ router.post('/api/tts', requireAuth, requireScope('tts:use'), async (req, res) =
 
 // ─── Instructions (sync consumers) ─────────────────────────────────────────────
 
+router.get('/api/dashboard/instructions', requireAuth, requireScope('instructions:read'), (req, res) => {
+  const surfaces = [];
+  const surfaceFiles = ['AGENTS.md', 'GEMINI.md', 'CLAUDE.md', 'INSTRUCTIONS.md'];
+  
+  for (const name of surfaceFiles) {
+    let filePath;
+    if (name === 'INSTRUCTIONS.md') {
+      filePath = path.join(ROOT, name);
+    } else {
+      filePath = path.join(ROOT, name);
+    }
+    
+    let size = 0;
+    let lastCompiled = '';
+    let active = false;
+    
+    if (fs.existsSync(filePath)) {
+      const stat = fs.statSync(filePath);
+      size = stat.size;
+      lastCompiled = stat.mtime.toISOString();
+      active = true;
+    }
+    
+    surfaces.push({
+      name,
+      filename: name,
+      size,
+      lastCompiled,
+      active
+    });
+  }
+  
+  const lastCompileTimestamp = fs.existsSync(INSTRUCTIONS) ? fs.statSync(INSTRUCTIONS).mtime.toISOString() : '';
+  const totalNodes = fs.existsSync(VAULT_DIR) ? getNodes(VAULT_DIR).length : 0;
+  
+  res.json({
+    surfaces,
+    lastCompileTimestamp,
+    totalNodes
+  });
+});
+
 router.get('/api/instructions', requireAuth, requireScope('instructions:read'), (req, res) => {
-  return sendTextResource(res, INSTRUCTIONS, 'instructions');
+  return sendTextResource(res, path.join(ROOT, 'INSTRUCTIONS.md'), 'instructions');
 });
 
 router.put('/api/instructions', requireAuth, requireScope('instructions:write'), (req, res) => {
@@ -1574,7 +1622,23 @@ function absoluteUrl(req, routePath) {
 }
 
 function ssssReferenceDir() {
-  return path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'references');
+  // Prefer compact TR references; fall back to legacy nested module paths.
+  const candidates = [
+    path.join(SKILLS_DIR, 'total-recall', 'references'),
+    path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'references'),
+    path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'references'),
+  ];
+  return candidates.find((p) => fs.existsSync(p)) || candidates[0];
+}
+
+function ssssSkillDocPath() {
+  const candidates = [
+    path.join(SKILLS_DIR, 'total-recall', 'references', 'ssss-reference.md'),
+    path.join(SKILLS_DIR, 'total-recall', 'SKILL.md'),
+    path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'MODULE.md'),
+    path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'SKILL.md'),
+  ];
+  return candidates.find((p) => fs.existsSync(p)) || candidates[0];
 }
 
 function listSsssReferences(req) {
@@ -1615,7 +1679,7 @@ router.get('/api/ssss', requireAuth, requireScope('ssss:read'), (req, res) => {
       name: 'ssss-skill',
       url: absoluteUrl(req, '/api/ssss/skill/ssss'),
       ...(() => {
-        const r = readTextResource(path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'SKILL.md'), 'ssss-skill');
+        const r = readTextResource(ssssSkillDocPath(), 'ssss-skill');
         return r ? { sha256: r.sha256, bytes: r.bytes, modified: r.modified } : { sha256: null, bytes: 0, modified: null };
       })()
     },
@@ -1623,7 +1687,11 @@ router.get('/api/ssss', requireAuth, requireScope('ssss:read'), (req, res) => {
       name: 'ssss-spec',
       url: absoluteUrl(req, '/api/ssss/spec'),
       ...(() => {
-        const r = readTextResource(path.join(ssssReferenceDir(), 'ssss-spec.md'), 'ssss-spec');
+        const refs = ssssReferenceDir();
+        const specPath = ['ssss-reference.md', 'ssss-spec.md']
+          .map((n) => path.join(refs, n))
+          .find((p) => fs.existsSync(p));
+        const r = specPath ? readTextResource(specPath, 'ssss-spec') : null;
         return r ? { sha256: r.sha256, bytes: r.bytes, modified: r.modified } : { sha256: null, bytes: 0, modified: null };
       })()
     },
@@ -1637,16 +1705,29 @@ router.get('/api/ssss', requireAuth, requireScope('ssss:read'), (req, res) => {
   });
 });
 
-router.get('/api/ssss/instructions', requireAuth, requireScope('ssss:read', 'instructions:read'), (_req, res) => {
-  return sendTextResource(res, INSTRUCTIONS, 'instructions');
+router.get('/api/ssss/instructions', requireAuth, requireScope('ssss:read', 'instructions:read'), (req, res) => {
+  const surface = req.query.surface;
+  if (surface) {
+    if (surface === 'INSTRUCTIONS.md') {
+      return sendTextResource(res, path.join(ROOT, 'INSTRUCTIONS.md'), 'instructions');
+    }
+    const safeSurface = path.basename(surface);
+    const surfacePath = path.join(ROOT, safeSurface);
+    return sendTextResource(res, surfacePath, safeSurface);
+  }
+  return sendTextResource(res, path.join(ROOT, 'INSTRUCTIONS.md'), 'instructions');
 });
 
 router.get('/api/ssss/skill/ssss', requireAuth, requireScope('ssss:read'), (_req, res) => {
-  return sendTextResource(res, path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'SKILL.md'), 'ssss-skill');
+  return sendTextResource(res, ssssSkillDocPath(), 'ssss-skill');
 });
 
 router.get('/api/ssss/spec', requireAuth, requireScope('ssss:read'), (_req, res) => {
-  return sendTextResource(res, path.join(ssssReferenceDir(), 'ssss-spec.md'), 'ssss-spec');
+  const refs = ssssReferenceDir();
+  const specPath = ['ssss-reference.md', 'ssss-spec.md']
+    .map((n) => path.join(refs, n))
+    .find((p) => fs.existsSync(p));
+  return sendTextResource(res, specPath || path.join(refs, 'ssss-reference.md'), 'ssss-spec');
 });
 
 router.get('/api/ssss/references', requireAuth, requireScope('ssss:read'), (req, res) => {
@@ -1666,7 +1747,7 @@ router.get('/api/ssss/references/:name', requireAuth, requireScope('ssss:read'),
  * List all known brains (global + registered projects) with state metadata.
  * The global brain reads project brain frontmatter for state display.
  */
-router.get('/api/brains', requireAuth, requireScope('ssss:read'), (req, res) => {
+router.get('/api/brains', requireAuth, requireScope('ssss:read'), async (req, res) => {
   try {
     const globalBrainDir = path.join(os.homedir(), '.agent', 'skills', 'total-recall');
     const brains = [];
@@ -1737,7 +1818,47 @@ router.get('/api/brains', requireAuth, requireScope('ssss:read'), (req, res) =>
             last_compiled: project.last_compiled || getLastModified(path.join(project.brainDir, 'memory-derived', 'graph-index.jsonl')),
           });
         }
-      } catch { /* ignore registry parse errors */ }
+      } catch (err) {
+        logger.error('server', 'Failed to read project registry', { error: err.message });
+      }
+    }
+
+    // Optional remote/tenant vault from config (path-agnostic — user sets vaultDir)
+    try {
+      const config = await import('../core/config.mjs');
+      if (config.remoteVaultSync?.enabled && config.remoteVaultSync.vaultDir) {
+        const tenantVaultDir = config.remoteVaultSync.vaultDir;
+        const tenantId =
+          process.env.TR_TENANT_ID ||
+          path.basename(path.dirname(tenantVaultDir)) ||
+          'remote';
+        const exists = fs.existsSync(tenantVaultDir);
+        let nodeCount = 0;
+        if (exists) {
+          const countMd = (dir) => {
+            if (!fs.existsSync(dir)) return 0;
+            let count = 0;
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+              if (entry.isDirectory()) count += countMd(path.join(dir, entry.name));
+              else if (entry.name.endsWith('.md')) count++;
+            }
+            return count;
+          };
+          nodeCount = countMd(tenantVaultDir);
+        }
+        brains.push({
+          id: `tenant:${tenantId}`,
+          name: process.env.TR_TENANT_NAME || `Tenant (${tenantId})`,
+          layer: 'tenant',
+          path: tenantVaultDir,
+          project_root: path.dirname(tenantVaultDir),
+          exists,
+          node_count: nodeCount,
+          last_compiled: null,
+        });
+      }
+    } catch {
+      // ignore
     }
 
     res.json({ brains });
@@ -1749,13 +1870,15 @@ router.get('/api/brains', requireAuth, requireScope('ssss:read'), (req, res) =>
  * GET /api/brains/:id/nodes
  * List all memory nodes for a specific brain.
  */
-router.get('/api/brains/:id/nodes', requireAuth, requireScope('ssss:read', 'memory:read'), (req, res) => {
+router.get('/api/brains/:id/nodes', requireAuth, requireScope('ssss:read', 'memory:read'), async (req, res) => {
   try {
     const brainId = req.params.id;
     let brainDir;
+    let vaultDir;
 
     if (brainId === 'global') {
       brainDir = path.join(os.homedir(), '.agent', 'skills', 'total-recall');
+      vaultDir = path.join(brainDir, 'memory-vault');
     } else if (brainId.startsWith('project:')) {
       const projectName = brainId.slice('project:'.length);
       const globalBrainDir = path.join(os.homedir(), '.agent', 'skills', 'total-recall');
@@ -1766,14 +1889,35 @@ router.get('/api/brains/:id/nodes', requireAuth, requireScope('ssss:read', 'memo
       const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
       const project = registry.find(p => p.name === projectName);
       if (!project) {
-        return res.status(404).json({ error: `Project \"${projectName}\" not found in registry` });
+        return res.status(404).json({ error: `Project "${projectName}" not found in registry` });
       }
       brainDir = project.brainDir;
+      vaultDir = path.join(brainDir, 'memory-vault');
+    } else if (brainId.startsWith('tenant:')) {
+      const tenantName = brainId.slice('tenant:'.length).replace(/[^a-zA-Z0-9._-]/g, '');
+      const config = await import('../core/config.mjs');
+      // Prefer configured remote vault when id matches configured tenant; else ~/.agent/tenants/<name>/vault
+      const configuredId =
+        process.env.TR_TENANT_ID ||
+        (config.remoteVaultSync?.vaultDir
+          ? path.basename(path.dirname(config.remoteVaultSync.vaultDir))
+          : null);
+      if (
+        config.remoteVaultSync?.enabled &&
+        config.remoteVaultSync.vaultDir &&
+        (tenantName === configuredId || tenantName === 'remote' || tenantName === 'default')
+      ) {
+        vaultDir = config.remoteVaultSync.vaultDir;
+      } else {
+        vaultDir = path.join(os.homedir(), '.agent', 'tenants', tenantName, 'vault');
+        if (!fs.existsSync(vaultDir)) {
+          return res.status(404).json({ error: `Tenant "${tenantName}" not found` });
+        }
+      }
     } else {
-      return res.status(400).json({ error: 'Invalid brain ID. Use \"global\" or \"project:<name>\"' });
+      return res.status(400).json({ error: 'Invalid brain ID. Use "global", "project:<name>", or "tenant:<name>"' });
     }
 
-    const vaultDir = path.join(brainDir, 'memory-vault');
     if (!fs.existsSync(vaultDir)) {
       return res.json({ nodes: [], brain_id: brainId });
     }
@@ -2111,6 +2255,35 @@ router.post('/api/update/run', requireAuth, async (req, res) => {
   }
 });
 
+// ─── DLQ Admin Routes ────────────────────────────────────────────────────────────
+const QUEUE_DIR = path.join(BRAIN_DIR, 'scheduler', 'queue');
+
+router.get('/api/tasks/failed', requireAuth, async (req, res) => {
+  try {
+    const { loadPendingTasks } = await import('../core/scheduler.mjs');
+    const allTasks = loadPendingTasks(QUEUE_DIR);
+    const failed = allTasks.filter(t => t.status === 'failed');
+    res.json({ total: failed.length, tasks: failed });
+  } catch (err) {
+    serverError(res, err);
+  }
+});
+
+router.post('/api/tasks/:id/retry', requireAuth, async (req, res) => {
+  try {
+    const taskId = req.params.id;
+    const { loadPendingTasks, updateTaskStatus } = await import('../core/scheduler.mjs');
+    const allTasks = loadPendingTasks(QUEUE_DIR);
+    const task = allTasks.find(t => t.slug === taskId);
+    if (!task) return res.status(404).json({ error: 'Task not found in queue' });
+    if (task.status !== 'failed') return res.status(400).json({ error: 'Task is not in failed state' });
+    updateTaskStatus(task, 'pending', QUEUE_DIR);
+    res.json({ success: true, message: `Task ${taskId} re-queued` });
+  } catch (err) {
+    serverError(res, err);
+  }
+});
+
 router.get('/api/help', requireAuth, (req, res) => {
   const { topic } = req.query;
   const docsDir = path.join(ROOT, 'docs');