total-recall-brain 3.13.2 → 3.14.4

package/src/core/skills-registry.mjs

@@ -1060,3 +1060,41 @@ export function pullAllSkills(brainDir, opts = {}) {
 export function defaultBrainDir() {
   return process.env._TR_TEST_BRAIN_DIR || path.join(os.homedir(), '.agent', 'skills', 'total-recall');
 }
+/**
+ * Pipeline to resolve skill locations across Embedded, Project, and Global scopes.
+ * Implements the SSOT for Embedded (repo) vs System (brain) priority.
+ *
+ * @param {string} skillName
+ * @param {string} [currentRepoPath] - Optional local project path (Embedded layer)
+ * @param {string} [projectBrainDir] - Optional project brain (Project layer)
+ * @param {string} [globalBrainDir] - Optional global brain (Global layer)
+ * @returns {{ type: 'embedded'|'project'|'global', path: string } | null}
+ */
+export function resolveSkillPipeline(skillName, currentRepoPath, projectBrainDir, globalBrainDir) {
+  // 1. Embedded Skills (Repo-specific memory)
+  if (currentRepoPath) {
+    const embeddedPath = path.join(currentRepoPath, '.agent', 'skills', skillName);
+    if (fs.existsSync(embeddedPath)) {
+      return { type: 'embedded', path: embeddedPath };
+    }
+  }
+
+  // 2. Project Skills (Context Layer)
+  if (projectBrainDir) {
+    const projectPath = path.join(projectBrainDir, '.agent', 'skills', skillName);
+    if (fs.existsSync(projectPath)) {
+      return { type: 'project', path: projectPath };
+    }
+  }
+
+  // 3. Global System Skills (Identity Layer)
+  if (globalBrainDir) {
+    // Standard system skills path inside the global brain registry
+    const globalPath = path.join(resolveRegistryDir(globalBrainDir), 'skills', skillName);
+    if (fs.existsSync(globalPath)) {
+      return { type: 'global', path: globalPath };
+    }
+  }
+
+  return null;
+}

package/src/core/surface.mjs

@@ -312,7 +312,7 @@ export async function buildRulesBlock(skillsDir, nodes = [], { consumer = 'ide',
     combined = `## Total Recall — Active Memory Context\n\nYour memories and rules are loaded from the active brain vault.\n`;
   } else {
     // Compact CLI reference (OKF §6 progressive disclosure — summary, not full manual)
-    combined = `## Total Recall — Sovereign Memory System (Installed)
+    combined = `## Total Recall — Persistent Memory System (Installed)
 
 **Quick Reference:**
 - \`npx total-recall remember <category> "<content>" [options]\` — Save to memory (categories: invariant, preference, correction, fact, concept, pattern, anti-pattern, decision, lore; key flags: --importance, --priority, --modality, --tags, --global, --project)

package/src/core/task_runner.mjs

@@ -103,11 +103,17 @@ async function handleSystem2Deliberation(task, context) {
   logger.info('task-runner', `Running System 2 deliberation for: ${task.target}`);
 }
 
+import { runCrons } from './crons.mjs';
+
 /**
  * Main loop for the task runner.
  */
 export async function runTaskQueue(queueDir, context) {
   logger.info('task-runner', 'Starting Task Runner...');
+  
+  // Run background daemon crons (examine code, sync, secret management)
+  await runCrons(context);
+
   const pending = loadPendingTasks(queueDir);
 
   if (pending.length === 0) {

package/src/core/usage-tracker.mjs

@@ -6,18 +6,22 @@ import { logger } from './logger.mjs';
 import { brainDir } from './config.mjs';
 
 // Standard pricing constants ($ per million tokens)
+// Pricing verified via web search (July 2026)
 export const PRICING = {
   claude: {
+    // Claude 3.5 Sonnet Standard Pricing
     input: 3.00 / 1000000,
     output: 15.00 / 1000000,
-    cacheRead: 0.30 / 1000000,
-    cacheCreation: 3.75 / 1000000
+    cacheRead: 0.30 / 1000000, // 0.1x base
+    cacheCreation: 3.75 / 1000000 // 1.25x base
   },
   gemini: {
+    // Gemini 1.5 Flash (legacy)
     input: 0.075 / 1000000,
     output: 0.30 / 1000000
   },
   codex: {
+    // GPT-4o Standard (used by Codex CLI)
     input: 2.50 / 1000000,
     output: 10.00 / 1000000
   }
@@ -269,11 +273,20 @@ export function calculateCurrentCost() {
         weeklyUsd: codexWeeklyCost,
         dailyTokens: codex.dailyInput + codex.dailyOutput,
         weeklyTokens: codex.weeklyInput + codex.weeklyOutput
-      }
+      },
+      openrouter: { dailyUsd: 0, weeklyUsd: 0, dailyTokens: 0, weeklyTokens: 0 },
+      tavily: { dailyUsd: 0, weeklyUsd: 0, dailyTokens: 0, weeklyTokens: 0 },
+      brave: { dailyUsd: 0, weeklyUsd: 0, dailyTokens: 0, weeklyTokens: 0 },
+      exa: { dailyUsd: 0, weeklyUsd: 0, dailyTokens: 0, weeklyTokens: 0 },
+      serper: { dailyUsd: 0, weeklyUsd: 0, dailyTokens: 0, weeklyTokens: 0 }
     }
   };
 }
 
+export function syncUsageLedger(pricingMap) {
+  // Currently a no-op hook for future backend usage ledger syncing.
+}
+
 /**
  * Safely load and parse budget.yml config.
  *

package/src/core/vault-watcher.mjs

@@ -0,0 +1,92 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { invalidate, getNodes } from './vault-cache.mjs';
+import { compileSurface } from './surface.mjs';
+import { buildEmbeddingsIndex, buildSessionEmbeddingsIndex } from './embeddings.mjs';
+import { logger } from './logger.mjs';
+
+/**
+ * Vault Watcher
+ * Watches the memory-vault directory for external edits (e.g., from Obsidian).
+ * Debounces changes and triggers cache invalidation, surface compilation, and embeddings rebuild.
+ */
+
+let recompileTimer = null;
+const RECOMPILE_DEBOUNCE_MS = 2000;
+let watcher = null;
+
+export function startVaultWatcher(vaultDir, skillsDir, derivedDir, sessionsDir, instructionsFile) {
+  if (watcher) return watcher;
+  
+  if (!fs.existsSync(vaultDir)) {
+    fs.mkdirSync(vaultDir, { recursive: true });
+  }
+
+  const callback = (eventType, filename) => {
+    // Only react to markdown files
+    if (!filename || !filename.endsWith('.md')) return;
+
+    // Immediately invalidate the cache so subsequent reads see the change
+    invalidate(vaultDir);
+
+    if (recompileTimer) clearTimeout(recompileTimer);
+    recompileTimer = setTimeout(async () => {
+      recompileTimer = null;
+      try {
+        logger.info({
+          subsystem: 'vault-watcher',
+          message: `Detected external edits (${filename} etc). Recompiling surface and embeddings...`,
+        });
+
+        // 1. Recompile instructions surface
+        await compileSurface({
+          vaultDir,
+          skillsDir,
+          derivedDir,
+          instructionsFile,
+        });
+
+        // 2. Rebuild embeddings
+        try {
+          const vaultNodes = getNodes(vaultDir);
+          await buildEmbeddingsIndex(vaultNodes, derivedDir);
+          await buildSessionEmbeddingsIndex(sessionsDir, derivedDir);
+        } catch (embedErr) {
+          // Ollama/embeddings offline non-fatal
+        }
+
+        logger.info({
+          subsystem: 'vault-watcher',
+          message: 'Finished rebuilding index for external changes.',
+        });
+      } catch (err) {
+        logger.error({
+          subsystem: 'vault-watcher',
+          message: `Recompile failed: ${err.message}`,
+        });
+      }
+    }, RECOMPILE_DEBOUNCE_MS);
+  };
+
+  try {
+    watcher = fs.watch(vaultDir, { recursive: false }, callback);
+    logger.info({
+      subsystem: 'vault-watcher',
+      message: `Watching ${vaultDir} for external Obsidian edits`,
+    });
+  } catch (err) {
+    logger.error({
+      subsystem: 'vault-watcher',
+      message: `Failed to start vault watcher: ${err.message}`,
+    });
+  }
+
+  return {
+    stop() {
+      if (watcher) {
+        try { watcher.close(); } catch {}
+        watcher = null;
+      }
+    }
+  };
+}

package/src/core/vault.mjs

@@ -3,8 +3,6 @@ import path from 'path';
 import matter from 'gray-matter';
 import { logger } from './logger.mjs';
 
-const SAFE_NAME = /^[a-zA-Z0-9_-]+$/;
-
 /**
  * Atomic file write using write-then-rename to prevent partial corruption.
  */

package/src/server/api.mjs

@@ -179,7 +179,7 @@ function ssssReferenceDir() {
   const candidates = [
     path.join(SKILLS_DIR, 'total-recall', 'references'),
     path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'references'),
-    path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'references'),
+    path.join(SKILLS_DIR, 'okf', 'references'),
   ];
   return candidates.find((p) => fs.existsSync(p)) || candidates[0];
 }

package/src/server/rest.mjs

@@ -802,11 +802,11 @@ router.post('/api/integrations/connect', requireAuth, (req, res) => {
 /**
  * GET /api/import/rules
  * Detect existing rule files in given dirs.
- * Query: ?dir=/path  (repeatable, default: process.cwd())
+ * Query: ?dir=/path  (repeatable, default: ROOT)
  */
 router.get('/api/import/rules', requireAuth, requireScope('memory:read'), (req, res) => {
   try {
-    const allowedRoots = [process.cwd(), os.homedir()];
+    const allowedRoots = [ROOT, VAULT_DIR];
     const rawDirs = req.query.dir ? (Array.isArray(req.query.dir) ? req.query.dir : [req.query.dir]) : allowedRoots;
     const dirs = rawDirs.filter(d => allowedRoots.some(root => path.resolve(d).startsWith(path.resolve(root))));
     if (dirs.length === 0) return badRequest(res, 'No permitted directories specified');
@@ -824,7 +824,7 @@ router.get('/api/import/rules', requireAuth, requireScope('memory:read'), (req,
 router.post('/api/import/rules', requireAuth, requireScope('memory:write'), async (req, res) => {
   try {
     const { dirs, force = false, dryRun = false } = req.body || {};
-    const searchDirs = dirs?.length ? dirs : [process.cwd(), os.homedir()];
+    const searchDirs = dirs?.length ? dirs : [ROOT, VAULT_DIR];
     const detected = detectRuleFiles(searchDirs);
     const toImport = req.body?.files?.length
       ? detected.filter(f => req.body.files.includes(f.absolutePath))
@@ -1042,14 +1042,18 @@ router.get('/api/files', requireAuth, requireScope('files:read'), (req, res) =>
       fs.mkdirSync(FILES_DIR, { recursive: true });
     }
     const files = fs.readdirSync(FILES_DIR).map(file => {
-      const stats = fs.statSync(path.join(FILES_DIR, file));
-      return {
-        name: file,
-        size: stats.size,
-        modified: stats.mtime,
-        isDirectory: stats.isDirectory()
-      };
-    });
+      try {
+        const stats = fs.statSync(path.join(FILES_DIR, file));
+        return {
+          name: file,
+          size: stats.size,
+          modified: stats.mtime,
+          isDirectory: stats.isDirectory()
+        };
+      } catch (err) {
+        return null;
+      }
+    }).filter(Boolean);
     res.json(files);
     
   } catch (err) { serverError(res, err); }
@@ -1069,13 +1073,17 @@ router.get("/api/scripts", requireAuth, requireScope("files:read"), (req, res) =
     const files = fs.readdirSync(SCRIPTS_DIR).filter(file => 
       file.endsWith(".mjs") || file.endsWith(".js") || file.endsWith(".py") || file.endsWith(".sh")
     ).map(file => {
-      const stats = fs.statSync(path.join(SCRIPTS_DIR, file));
-      return {
-        name: file,
-        size: stats.size,
-        modified: stats.mtime
-      };
-    });
+      try {
+        const stats = fs.statSync(path.join(SCRIPTS_DIR, file));
+        return {
+          name: file,
+          size: stats.size,
+          modified: stats.mtime
+        };
+      } catch (err) {
+        return null;
+      }
+    }).filter(Boolean);
     res.json(files);
   } catch (err) {
     serverError(res, err);
@@ -1320,7 +1328,7 @@ router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, r
       delete safeBrain.token;
     }
 
-    const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
+    const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'openrouter_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
     const safeSecrets = {};
     for (const key of allowedKeys) {
       if (secrets[key] !== undefined) {
@@ -1372,7 +1380,7 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), (req,
           existingSecrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')) || {};
         } catch {}
       }
-      const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
+      const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'openrouter_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
       for (const key of allowedKeys) {
         if (secrets[key] !== undefined) {
           if (secrets[key] === '') {
@@ -1626,7 +1634,7 @@ function ssssReferenceDir() {
   const candidates = [
     path.join(SKILLS_DIR, 'total-recall', 'references'),
     path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'references'),
-    path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'references'),
+    path.join(SKILLS_DIR, 'okf', 'references'),
   ];
   return candidates.find((p) => fs.existsSync(p)) || candidates[0];
 }
@@ -1636,7 +1644,7 @@ function ssssSkillDocPath() {
     path.join(SKILLS_DIR, 'total-recall', 'references', 'ssss-reference.md'),
     path.join(SKILLS_DIR, 'total-recall', 'SKILL.md'),
     path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'MODULE.md'),
-    path.join(SKILLS_DIR, 'total-recall', 'skills', 'tr-ssss', 'SKILL.md'),
+    path.join(SKILLS_DIR, 'okf', 'SKILL.md'),
   ];
   return candidates.find((p) => fs.existsSync(p)) || candidates[0];
 }
@@ -2028,7 +2036,14 @@ router.get('/api/gemini-models', requireAuth, async (req, res) => {
 
 
 
-    if (!apiKey) return res.json({ models: [], source: 'missing_key' });
+    const fallbackModels = [
+      { id: 'gemini-3.5-flash', displayName: 'Gemini 3.5 Flash', pricing: null },
+      { id: 'gemini-3.5-pro', displayName: 'Gemini 3.5 Pro', pricing: null },
+      { id: 'gemini-2.5-pro', displayName: 'Gemini 2.5 Pro', pricing: null },
+      { id: 'gemini-2.5-flash', displayName: 'Gemini 2.5 Flash', pricing: null }
+    ];
+
+    if (!apiKey) return res.json({ models: fallbackModels, source: 'missing_key' });
 
     try {
       const controller = new AbortController();
@@ -2058,7 +2073,7 @@ router.get('/api/gemini-models', requireAuth, async (req, res) => {
       }
     } catch {}
 
-    res.json({ models: [], source: 'api_error' });
+    res.json({ models: fallbackModels, source: 'api_error' });
   } catch (err) {
     serverError(res, err);
   }
@@ -2215,42 +2230,39 @@ router.get('/api/update/check', requireAuth, async (req, res) => {
  */
 router.post('/api/update/run', requireAuth, async (req, res) => {
   try {
-    res.json({ success: true, message: 'Update started. Server is updating and will restart shortly.' });
-
-    setImmediate(async () => {
-      logger.info('update', 'Starting auto-update process...');
-      try {
-        const { exec } = await import('node:child_process');
-        
-        const runCmd = (cmd, cwd) => new Promise((resolve, reject) => {
-          logger.info('update', `Running: ${cmd} in ${cwd}`);
-          exec(cmd, { cwd }, (err, stdout, stderr) => {
-            if (err) {
-              logger.error('update', `Command failed: ${cmd}. Error: ${err.message}`);
-              return reject(err);
-            }
-            resolve({ stdout, stderr });
-          });
-        });
-
-        // 1. git pull
-        await runCmd('git pull', ROOT);
-        // 2. npm install
-        await runCmd('npm install', ROOT);
-        // 3. build/install frontend if package.json exists
-        const frontendPath = path.join(ROOT, 'frontend');
-        if (fs.existsSync(path.join(frontendPath, 'package.json'))) {
-          await runCmd('npm install', frontendPath);
-          await runCmd('npm run build', frontendPath);
+    logger.info('update', 'Starting auto-update process...');
+    const { exec } = await import('node:child_process');
+    
+    const runCmd = (cmd, cwd) => new Promise((resolve, reject) => {
+      logger.info('update', `Running: ${cmd} in ${cwd}`);
+      exec(cmd, { cwd }, (err, stdout, stderr) => {
+        if (err) {
+          logger.error('update', `Command failed: ${cmd}. Error: ${err.message}`);
+          return reject(err);
         }
-
-        logger.info('update', 'Update successfully applied. Restarting server...');
-        process.exit(0);
-      } catch (err) {
-        logger.error('update', `Auto-update failed: ${err.message}`);
-      }
+        resolve({ stdout, stderr });
+      });
     });
+
+    // 1. git pull
+    await runCmd('git pull', ROOT);
+    // 2. npm install
+    await runCmd('npm install', ROOT);
+    // 3. build/install frontend if package.json exists
+    const frontendPath = path.join(ROOT, 'frontend');
+    if (fs.existsSync(path.join(frontendPath, 'package.json'))) {
+      await runCmd('npm install', frontendPath);
+      await runCmd('npm run build', frontendPath);
+    }
+
+    logger.info('update', 'Update successfully applied. Restarting server...');
+    res.json({ success: true, message: 'Update successfully applied. Server is restarting.' });
+    
+    setTimeout(() => {
+      process.exit(0);
+    }, 1000);
   } catch (err) {
+    logger.error('update', `Auto-update failed: ${err.message}`);
     serverError(res, err);
   }
 });

package/src/server/route-manifest.json

@@ -367,6 +367,14 @@
     "method": "POST",
     "path": "/api/skills/install"
   },
+  {
+    "method": "POST",
+    "path": "/api/skills/toggle"
+  },
+  {
+    "method": "POST",
+    "path": "/api/skills/audit"
+  },
   {
     "method": "GET",
     "path": "/api/skills/search"

package/src/server/routes/_shared.mjs

@@ -24,7 +24,7 @@ export const FILES_DIR    = path.join(BRAIN_DIR, 'files');
 export const TASKS_DIR    = path.join(BRAIN_DIR, 'scheduler', 'queue');
 export const CONFIG_DIR   = path.join(BRAIN_DIR, 'config');
 
-const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+export const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
 export const MODEL_CATALOG_DIR = path.join(ROOT, 'models', 'catalog', 'total-recall');
 
 /**

package/src/server/routes/secrets.mjs

@@ -11,7 +11,7 @@
 import express from 'express';
 import path from 'node:path';
 import { requireAuth, requireScope, verifyStepUpToken } from '../auth.mjs';
-import { badRequest, serverError, notFound, BRAIN_DIR, resolveVaultFromQuery } from './_shared.mjs';
+import { badRequest, serverError, notFound, BRAIN_DIR, resolveVaultFromQuery, ROOT } from './_shared.mjs';
 import {
   listSecretsMeta,
   setSecret,
@@ -161,7 +161,7 @@ router.post('/api/secrets/export-env', requireAuth, requireScope('keys:write', '
       return res.json({ results, store: path.join(brainDir, 'config', 'secrets.enc') });
     }
 
-    const targetPath = body.path || body.project_path || process.cwd();
+    const targetPath = body.path || body.project_path || ROOT;
     if (body.preview_only || body.previewOnly) {
       const projection = await buildEnvProjection(brainDir, {
         projectPath: targetPath,
@@ -194,7 +194,7 @@ router.post('/api/secrets/export-env', requireAuth, requireScope('keys:write', '
 router.get('/api/secrets/export-env', requireAuth, requireScope('keys:read', 'config:read'), async (req, res) => {
   try {
     const brainDir = brainDirFromReq(req);
-    const targetPath = req.query.path || process.cwd();
+    const targetPath = req.query.path || ROOT;
     const projection = await buildEnvProjection(brainDir, {
       projectPath: targetPath,
       includeGlobal: req.query.no_global !== '1',
@@ -236,7 +236,7 @@ router.get('/api/secrets/scan-env', requireAuth, requireScope('keys:write', 'con
     const scan = scanEnvSources({
       brainDir,
       includeProcessEnv: true,
-      cwd: process.cwd(),
+      cwd: ROOT,
     });
     res.json(publicScanResult(scan, existingSet));
   } catch (err) {

package/src/server/routes/skills.mjs

@@ -73,11 +73,9 @@ const SKILL_DIR_CANDIDATES = SKILL_ROOTS.map((r) => r.rel);
  */
 const TR_SKILL_EXCLUDE = new Set([
   'total-recall',
-  'tr-skill',
-  'tr-ssss',
-  'tr-research',
-  'tr-cli-agents',
-  'tr-cli-agent',
+  'skill',
+  'okf',
+  'research',
   'cli-agents', // TR CLI agent registry package, not an app skill
 ]);
 
@@ -85,7 +83,6 @@ function isTrSkillName(name) {
   if (!name || typeof name !== 'string') return true;
   const n = name.toLowerCase();
   if (TR_SKILL_EXCLUDE.has(n)) return true;
-  if (n.startsWith('tr-')) return true;
   if (n.startsWith('total-recall')) return true;
   return false;
 }
@@ -187,10 +184,16 @@ function scanSkillRoot(skillsRoot, repo, projectPath, rootInfo) {
 
 /**
  * Collect skills for all registered projects, grouped by repo → IDE.
- * Excludes total-recall / tr-* system skills.
+ * Excludes total-recall system skills.
  */
 export function collectSkillsByRepo() {
   const registry = loadProjectRegistry();
+  // Inject the global homedir so global skills are also scanned and managed
+  registry.unshift({
+    name: 'Global',
+    path: os.homedir()
+  });
+
   const byRepo = new Map();
 
   for (const entry of registry) {
@@ -260,7 +263,7 @@ export function collectSkillsByRepo() {
       ide_label,
       docs,
     })),
-    excluded_note: 'total-recall and tr-* skills are hidden from this catalog',
+    excluded_note: 'total-recall skills are hidden from this catalog',
   };
 }
 
@@ -334,8 +337,8 @@ function resolveTrSkillScript(scriptName) {
   const candidates = [
     path.join(AGENT_DIR, 'skills', 'total-recall', 'modules', 'skill-deploy', 'scripts', scriptName),
     path.join(ROOT, 'scaffold', '.agent', 'skills', 'total-recall', 'modules', 'skill-deploy', 'scripts', scriptName),
-    path.join(AGENT_DIR, 'skills', 'total-recall', 'skills', 'tr-skill', 'scripts', scriptName),
-    path.join(ROOT, 'scaffold', '.agent', 'skills', 'total-recall', 'skills', 'tr-skill', 'scripts', scriptName),
+    path.join(AGENT_DIR, 'skills', 'skill', 'scripts', scriptName),
+    path.join(ROOT, 'scaffold', '.agent', 'skills', 'skill', 'scripts', scriptName),
   ];
   const found = candidates.find((candidate) => fs.existsSync(candidate));
   if (!found) {
@@ -535,3 +538,82 @@ skillsRouter.delete('/api/skills/:name', requireAuth, requireScope('files:write'
     serverError(res, err);
   }
 });
+
+import { callLocalRuntime, loadRuntimeConfig } from '../../core/runtime.mjs';
+
+skillsRouter.post('/api/skills/toggle', requireAuth, requireScope('ssss:write'), async (req, res) => {
+  try {
+    const { skillName, targetRepo, enabled } = req.body;
+    if (!skillName || !targetRepo || targetRepo === 'Global') {
+      return res.status(400).json({ error: 'Missing parameters or invalid target repo' });
+    }
+
+    const globalSkillPath = path.join(os.homedir(), '.agent', 'skills', skillName);
+    const targetSkillPath = path.join(targetRepo, '.agent', 'skills', skillName);
+
+    if (enabled) {
+      if (!fs.existsSync(globalSkillPath)) {
+        return res.status(400).json({ error: 'Global skill not found' });
+      }
+      fs.cpSync(globalSkillPath, targetSkillPath, { recursive: true });
+      
+      const targetSkillMd = path.join(targetSkillPath, 'SKILL.md');
+      if (fs.existsSync(targetSkillMd)) {
+        let content = fs.readFileSync(targetSkillMd, 'utf8');
+        content += `\n\n> **Repo Scope Override:** This skill was copied from the Global registry and is now scoped to \`${targetRepo}\`.\n`;
+        fs.writeFileSync(targetSkillMd, content, 'utf8');
+      }
+    } else {
+      if (fs.existsSync(targetSkillPath)) {
+        fs.rmSync(targetSkillPath, { recursive: true, force: true });
+      }
+    }
+
+    res.json({ success: true, message: `Skill ${skillName} ${enabled ? 'enabled' : 'disabled'} for ${targetRepo}` });
+  } catch (err) {
+    serverError(res, err);
+  }
+});
+
+skillsRouter.post('/api/skills/audit', requireAuth, requireScope('ssss:read'), async (req, res) => {
+  try {
+    const { skillName, repoPath } = req.body;
+    if (!skillName) return res.status(400).json({ error: 'skillName required' });
+
+    let skillDir;
+    try {
+      ({ skillDir } = resolveSkillDir(repoPath || 'Global', skillName, {}));
+    } catch (e) {
+      return res.status(404).json({ error: e.message });
+    }
+
+    const skillPath = path.join(skillDir, 'SKILL.md');
+    if (!fs.existsSync(skillPath)) return res.status(404).json({ error: 'SKILL.md not found' });
+
+    const content = fs.readFileSync(skillPath, 'utf8');
+    const prompt = `Analyze this AI Agent SKILL.md document.
+Identify if it is outdated, incorrect, or problematic.
+Propose specific updates to improve it.
+If it looks perfect, say so.
+Return a JSON object: { "outdated": boolean, "problematic": boolean, "reason": string, "proposed_changes": string }
+
+SKILL DOCUMENT:
+${content}`;
+
+    const config = loadRuntimeConfig();
+    const result = await callLocalRuntime(prompt, "You are an expert AI agent capabilities auditor. Always return valid JSON matching the requested schema.", config);
+
+    // Extract JSON block
+    const match = result.match(/\{[\s\S]*\}/);
+    let auditData;
+    try {
+        auditData = JSON.parse(match ? match[0] : result);
+    } catch (e) {
+        auditData = { outdated: false, problematic: true, reason: 'Failed to parse AI response', proposed_changes: 'Check server logs. AI output was not valid JSON.' };
+    }
+
+    res.json({ success: true, audit: auditData });
+  } catch (err) {
+    serverError(res, err);
+  }
+});