total-recall-brain 3.18.2 → 3.19.0

package/src/core/webhook-handlers.mjs

@@ -1,19 +1,128 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { buildTaskEnvelope } from './task-envelope.mjs';
+import { persistTaskToDisk } from './scheduler.mjs';
+import { brainDir } from './config.mjs';
 import { logger } from './logger.mjs';
 
+const QUEUE_DIR = path.join(brainDir, 'scheduler', 'queue');
+
+/** Fixed slug so re-pushes overwrite one card instead of flooding the queue. */
+const DEPLOY_SLUG = 'deploy-auto';
+const SKILL_SYNC_SLUG = 'skillsync-auto';
+const NPM_UPDATE_SLUG = 'npm-update-auto';
+
+/**
+ * True when a queue file already exists for this slug (pending/in-progress).
+ * Avoids N× "Auto-deploy" cards for every GitHub push delivery / multi-ref push.
+ */
+function hasPendingTask(slug) {
+  try {
+    return fs.existsSync(path.join(QUEUE_DIR, `${slug}.md`));
+  } catch {
+    return false;
+  }
+}
+
 /**
- * Verified webhooks are recorded as SSSS events by the route. They do not run
- * shell commands or deployments. Product-specific automation must subscribe to
- * those events through an explicitly reviewed workflow with its own gates.
+ * GitHub may fire multiple push webhooks (multi-repo, multi-ref, redeliveries).
+ * Only production/main refs matter for deploy notices; always coalesce to one task.
  */
-export async function handleWebhook(provider, eventType, _payload) {
-  const known =
-    (provider === 'github' && ['push', 'release'].includes(eventType)) ||
-    (provider === 'stripe' && typeof eventType === 'string' && eventType.includes('.'));
-
-  logger.info('webhooks', `Recorded ${provider}.${eventType} webhook`, {
-    provider,
-    eventType,
-    automation: 'disabled',
-  });
-  return { handled: known, action: known ? 'recorded' : 'ignored' };
+function pushRefIsDeployable(payload = {}) {
+  const ref = String(payload.ref || '');
+  if (!ref) return true; // tests / bare payload still queue once
+  return (
+    ref === 'refs/heads/production' ||
+    ref === 'refs/heads/main' ||
+    ref.endsWith('/production') ||
+    ref.endsWith('/main')
+  );
+}
+
+export async function handleWebhook(provider, eventType, payload = {}) {
+  logger.info({ subsystem: 'webhooks', message: `Handling ${provider}.${eventType} webhook` });
+
+  if (provider === 'github' && eventType === 'push') {
+    if (!pushRefIsDeployable(payload)) {
+      logger.info({
+        subsystem: 'webhooks',
+        message: `Skipping deploy queue for non-deploy ref ${payload.ref || '(none)'}`,
+      });
+      return { queued: false, reason: 'ref_not_deployable' };
+    }
+    if (hasPendingTask(DEPLOY_SLUG)) {
+      logger.info({
+        subsystem: 'webhooks',
+        message: 'Deploy task already pending — not queuing another (coalesce)',
+      });
+      return { queued: false, reason: 'already_pending', slug: DEPLOY_SLUG };
+    }
+    // Notify-only card: real production deploy is the droplet watcher on push to production.
+    // Do NOT run bin/deploy.sh here — that caused multi-deploy spam and wrong deploy path.
+    const env = buildTaskEnvelope({
+      intent: 'Auto-deploy triggered by push',
+      slug: DEPLOY_SLUG,
+      kind: 'system',
+      executor: 'command',
+      category: 'deployment',
+      priority: 80,
+      system: true,
+      origin: { agent: 'daemon', created_by: 'webhook-github' },
+      capabilities: ['vault:read'],
+      payload: {
+        command: 'echo "Deploy notice only — production droplet auto-deploy handles the real ship"',
+        ref: payload.ref || null,
+        after: payload.after || null,
+        repository: payload.repository?.full_name || null,
+      },
+    });
+    persistTaskToDisk(env, QUEUE_DIR);
+    logger.info({ subsystem: 'webhooks', message: 'Queued single coalesced deploy notice task' });
+    return { queued: true, slug: DEPLOY_SLUG };
+  }
+
+  if (provider === 'github' && eventType === 'release') {
+    if (hasPendingTask(SKILL_SYNC_SLUG)) {
+      return { queued: false, reason: 'already_pending', slug: SKILL_SYNC_SLUG };
+    }
+    const env = buildTaskEnvelope({
+      intent: 'Skill sync triggered by release',
+      slug: SKILL_SYNC_SLUG,
+      kind: 'system',
+      executor: 'command',
+      category: 'sync',
+      priority: 70,
+      system: true,
+      origin: { agent: 'daemon', created_by: 'webhook-github' },
+      capabilities: ['vault:read'],
+      payload: { command: 'npx total-recall skill sync' },
+    });
+    persistTaskToDisk(env, QUEUE_DIR);
+    logger.info({ subsystem: 'webhooks', message: 'Queued skill-sync task' });
+    return { queued: true, slug: SKILL_SYNC_SLUG };
+  }
+
+  if (provider === 'npm' && eventType === 'package-publish') {
+    if (hasPendingTask(NPM_UPDATE_SLUG)) {
+      return { queued: false, reason: 'already_pending', slug: NPM_UPDATE_SLUG };
+    }
+    const env = buildTaskEnvelope({
+      intent: 'Package update triggered by npm publish',
+      slug: NPM_UPDATE_SLUG,
+      kind: 'system',
+      executor: 'command',
+      category: 'package',
+      priority: 60,
+      system: true,
+      origin: { agent: 'daemon', created_by: 'webhook-npm' },
+      capabilities: ['vault:read'],
+      payload: { command: 'npm update' },
+    });
+    persistTaskToDisk(env, QUEUE_DIR);
+    logger.info({ subsystem: 'webhooks', message: 'Queued npm update task' });
+    return { queued: true, slug: NPM_UPDATE_SLUG };
+  }
+
+  logger.info({ subsystem: 'webhooks', message: `No specific handler for ${provider}.${eventType}` });
+  return { queued: false, reason: 'no_handler' };
 }

package/src/server/auth.mjs

@@ -246,6 +246,12 @@ export function requireAuthOrLocal(req, res, next) {
   const config = loadSecurityConfig();
   if (config.network?.public_health === true) return next();
   if (isLocalRequest(req)) return next();
+  // Mesh peers probe /health for latency + LAN discovery. Traffic is already on
+  // WireGuard; treat mesh socket addresses like local for this gate only.
+  // Never trust X-Forwarded-For for this exemption (same as requireHttps mesh rule).
+  if (isMeshIp(req.socket?.remoteAddress) && forwardedClientIps(req).length === 0) {
+    return next();
+  }
   return requireAuth(req, res, next);
 }
 

package/src/server/index.mjs

@@ -43,6 +43,51 @@ const PACKAGE_VERSION = (() => {
   }
 })();
 
+// ─── PID Lock ───────────────────────────────────────────────────────────────────
+// A second instance that loses the listen() race for PORT has historically kept
+// running indefinitely (no bound port, no work, never exiting) because nothing
+// handled the EADDRINUSE 'error' event. Fail fast instead, mirroring the daemon
+// loop's acquirePidLock/releasePidLock pattern.
+const SERVER_PID_FILE = path.join(configBrainDir, 'server.pid');
+
+function acquireServerPidLock() {
+  try {
+    if (fs.existsSync(SERVER_PID_FILE)) {
+      const existingPid = parseInt(fs.readFileSync(SERVER_PID_FILE, 'utf8').trim(), 10);
+      if (existingPid && !isNaN(existingPid)) {
+        try {
+          process.kill(existingPid, 0); // signal 0 = liveness check only
+          logger.error('server', `Another server instance is already running (PID: ${existingPid}). Exiting.`);
+          process.exit(1);
+        } catch {
+          logger.info('server', `Stale server PID file found (PID: ${existingPid} is dead). Overwriting.`);
+        }
+      }
+    }
+  } catch {
+    // PID file unreadable — proceed
+  }
+  try {
+    fs.mkdirSync(path.dirname(SERVER_PID_FILE), { recursive: true });
+    fs.writeFileSync(SERVER_PID_FILE, String(process.pid), { mode: 0o644 });
+  } catch (err) {
+    logger.warn('server', `Could not write server PID lockfile: ${err.message}`);
+  }
+}
+
+function releaseServerPidLock() {
+  try {
+    if (fs.existsSync(SERVER_PID_FILE)) {
+      const storedPid = parseInt(fs.readFileSync(SERVER_PID_FILE, 'utf8').trim(), 10);
+      if (storedPid === process.pid) fs.unlinkSync(SERVER_PID_FILE);
+    }
+  } catch {
+    // best-effort cleanup
+  }
+}
+
+acquireServerPidLock();
+
 // ─── Watchdog ───────────────────────────────────────────────────────────────────
 // Attach circuit-breaker log monitor before any subsystem can emit events.
 import { attachLogMonitor } from '../core/watchdog.mjs';
@@ -699,6 +744,11 @@ const server = app.listen(PORT, HOST, () => {
   }
   logger.info("server", `Total Recall Brain v3.0.0 is listening on http://${HOST}:${PORT}`);
 });
+server.on('error', (err) => {
+  logger.error('server', `Failed to bind ${HOST}:${PORT}: ${err.message}. Exiting.`);
+  releaseServerPidLock();
+  process.exit(1);
+});
 
 // If bound to a mesh IP, also bind to 127.0.0.1 so local CLI/Dashboard works
 if (HOST !== '127.0.0.1' && HOST !== '0.0.0.0') {
@@ -706,6 +756,11 @@ if (HOST !== '127.0.0.1' && HOST !== '0.0.0.0') {
     setupUpgradeHandler(localServer);
     logger.info("server", `Total Recall Brain v3.0.0 is ALSO listening on http://127.0.0.1:${PORT}`);
   });
+  localServer.on('error', (err) => {
+    logger.error('server', `Failed to bind 127.0.0.1:${PORT}: ${err.message}. Exiting.`);
+    releaseServerPidLock();
+    process.exit(1);
+  });
 }
 
   logger.info("server", "┌─────────────────────────────────────────────┐");
@@ -940,6 +995,7 @@ async function handleShutdown(signal) {
     }
 
     clearTimeout(forceExitTimeout);
+    releaseServerPidLock();
     logger.info('server', 'Graceful shutdown complete. Exiting.');
     process.exit(0);
   });

package/src/server/rest.mjs

@@ -120,6 +120,7 @@ import scriptsRouter      from './routes/scripts.mjs';
 import ttsRouter          from './routes/tts.mjs';
 import updateRouter       from './routes/update.mjs';
 import { rulesRouter }    from './routes/rules.mjs';
+import notificationsRouter from './routes/notifications.mjs';
 // ollamaUrl removed — CLI agents replace Ollama
 import {
   AGENT_DIR,
@@ -233,6 +234,7 @@ router.use(ttsRouter);
 router.use(updateRouter);
 router.use(ssssRouter);
 router.use(rulesRouter);
+router.use(notificationsRouter);
 
 export { router as restRouter };
 export default router;

package/src/server/route-manifest.json

@@ -327,6 +327,26 @@
     "method": "GET",
     "path": "/api/network/stats"
   },
+  {
+    "method": "GET",
+    "path": "/api/notifications/history"
+  },
+  {
+    "method": "GET",
+    "path": "/api/notifications/rules"
+  },
+  {
+    "method": "POST",
+    "path": "/api/notifications/rules"
+  },
+  {
+    "method": "DELETE",
+    "path": "/api/notifications/rules/:id"
+  },
+  {
+    "method": "POST",
+    "path": "/api/notifications/test"
+  },
   {
     "method": "GET",
     "path": "/api/openai-models"
@@ -335,6 +355,10 @@
     "method": "GET",
     "path": "/api/openrouter-models"
   },
+  {
+    "method": "GET",
+    "path": "/api/pairing"
+  },
   {
     "method": "GET",
     "path": "/api/research"
@@ -391,6 +415,10 @@
     "method": "PATCH",
     "path": "/api/secrets/:key"
   },
+  {
+    "method": "POST",
+    "path": "/api/secrets/:key/account-sync"
+  },
   {
     "method": "POST",
     "path": "/api/secrets/:key/reveal"
@@ -399,6 +427,10 @@
     "method": "POST",
     "path": "/api/secrets/:key/rotate"
   },
+  {
+    "method": "POST",
+    "path": "/api/secrets/account-sync"
+  },
   {
     "method": "GET",
     "path": "/api/secrets/checksum"
@@ -443,6 +475,10 @@
     "method": "GET",
     "path": "/api/secrets/scan-env"
   },
+  {
+    "method": "GET",
+    "path": "/api/secrets/shared-values"
+  },
   {
     "method": "GET",
     "path": "/api/secrets/sync"
@@ -459,6 +495,10 @@
     "method": "POST",
     "path": "/api/secrets/sync/trigger-pull"
   },
+  {
+    "method": "GET",
+    "path": "/api/secrets/tracking-health"
+  },
   {
     "method": "GET",
     "path": "/api/secrets/usage"

package/src/server/routes/_shared.mjs

@@ -113,6 +113,29 @@ export function resolveAllVaultsFromQuery(req) {
   return uniqueVaults.length > 0 ? uniqueVaults : [VAULT_DIR];
 }
 
+/**
+ * Derive brain-local paths from a vault directory.
+ * vaultDir is always `…/<brain>/memory-vault`.
+ * Ensures project brains use their own derived indexes / surfaces, not global.
+ *
+ * @param {string} vaultDir
+ * @returns {{ brainDir: string, derivedDir: string, skillsDir: string, instructionsFile: string, sessionsDir: string, inboxDir: string }}
+ */
+export function pathsForVault(vaultDir) {
+  const brainDir = path.dirname(vaultDir);
+  // brainDir = …/.agent/skills/total-recall → agentDir = …/.agent
+  const skillsParent = path.dirname(brainDir); // …/skills
+  const agentDir = path.dirname(skillsParent); // …/.agent
+  return {
+    brainDir,
+    derivedDir: path.join(brainDir, 'memory-derived'),
+    skillsDir: path.join(agentDir, 'skills'),
+    instructionsFile: path.join(agentDir, 'INSTRUCTIONS.md'),
+    sessionsDir: path.join(brainDir, 'sessions'),
+    inboxDir: path.join(brainDir, 'memory-inbox'),
+  };
+}
+
 export function notFound(res, msg) {
   return res.status(404).json({ error: msg || 'Not found' });
 }
@@ -127,6 +150,15 @@ export function serverError(res, err) {
 }
 
 /** Strip the internal `body` field from a vault node into `content`. */
-export function sanitizeNode({ body, ...rest }) {
+export function sanitizeNode(node) {
+  if (!node || typeof node !== 'object') return node;
+  // Strip internal fields — never expose absolute paths or vault internals over the API
+  const {
+    body,
+    _filePath,
+    _filepath,
+    _layer,
+    ...rest
+  } = node;
   return { ...rest, content: body };
 }

package/src/server/routes/config.mjs

@@ -68,7 +68,7 @@ router.get('/api/config', requireAuth, requireScope('config:read'), async (req,
  * GET /api/config-json
  * Returns full config bundle: security, budget, brain, and allowed secrets keys.
  */
-router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, res) => {
+router.get('/api/config-json', requireAuth, requireScope('config:read'), async (req, res) => {
   try {
     const securityPath = path.join(CONFIG_DIR, 'security.yml');
     const budgetPath   = path.join(CONFIG_DIR, 'budget.yml');
@@ -89,8 +89,40 @@ router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, r
     if (fs.existsSync(brainPath)) {
       try { brain = JSON.parse(fs.readFileSync(brainPath, 'utf8')) || {}; } catch {}
     }
-    if (fs.existsSync(secretsPath)) {
-      try { secrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')) || {}; } catch {}
+    // Prefer brain secrets store (AES). Never return raw secret values to the dashboard.
+    const allowedKeys = [
+      'google_api_key',
+      'anthropic_api_key',
+      'openai_api_key',
+      'openrouter_api_key',
+      'tavily_api_key',
+      'brave_api_key',
+      'exa_api_key',
+      'serper_api_key',
+      'github_token',
+    ];
+    const safeSecrets = {};
+    try {
+      const { listSecretsMeta } = await import('../../core/secrets-store.mjs');
+      const meta = await listSecretsMeta(BRAIN_DIR);
+      for (const row of meta) {
+        if (!allowedKeys.includes(row.key)) continue;
+        // Mask only — Settings/Secrets UIs use presence indicators, not values.
+        safeSecrets[row.key] = row.set ? '••••••••' : '';
+      }
+    } catch {
+      if (fs.existsSync(secretsPath)) {
+        try {
+          secrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')) || {};
+        } catch {
+          /* ignore AES/binary */
+        }
+        for (const key of allowedKeys) {
+          if (secrets[key] !== undefined && secrets[key] !== null && secrets[key] !== '') {
+            safeSecrets[key] = '••••••••';
+          }
+        }
+      }
     }
 
     const safeBrain = { ...brain };
@@ -99,14 +131,6 @@ router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, r
       delete safeBrain.token;
     }
 
-    const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'openrouter_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
-    const safeSecrets = {};
-    for (const key of allowedKeys) {
-      if (secrets[key] !== undefined) {
-        safeSecrets[key] = secrets[key];
-      }
-    }
-
     res.json({ security, budget, brain: safeBrain, secrets: safeSecrets });
   } catch (err) { serverError(res, err); }
 });
@@ -146,22 +170,39 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), async
       fs.writeFileSync(brainPath, JSON.stringify(nextBrain, null, 2), { encoding: 'utf8', mode: 0o600 });
     }
     if (secrets) {
-      let existingSecrets = {};
-      if (fs.existsSync(secretsPath)) {
-        try { existingSecrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')) || {}; } catch {}
-      }
-      const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'openrouter_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
+      // Only accept real secret values — ignore masked placeholders from GET /api/config-json.
+      const allowedKeys = [
+        'google_api_key',
+        'anthropic_api_key',
+        'openai_api_key',
+        'openrouter_api_key',
+        'tavily_api_key',
+        'brave_api_key',
+        'exa_api_key',
+        'serper_api_key',
+        'github_token',
+      ];
+      const { setSecret, deleteSecret } = await import('../../core/secrets-store.mjs');
       for (const key of allowedKeys) {
-        if (secrets[key] !== undefined) {
-          if (secrets[key] === '') {
-            delete existingSecrets[key];
-          } else {
-            existingSecrets[key] = secrets[key];
+        if (secrets[key] === undefined) continue;
+        const value = secrets[key];
+        if (value === '' || value == null) {
+          try {
+            await deleteSecret(BRAIN_DIR, key, { action: 'delete', actor: 'settings-config' });
+          } catch {
+            /* key may not exist */
           }
+          continue;
+        }
+        if (typeof value === 'string' && (value.includes('•') || value === '[redacted]')) {
+          // Masked echo from the UI — do not overwrite the store.
+          continue;
         }
+        await setSecret(BRAIN_DIR, key, String(value), {
+          action: 'set',
+          actor: 'settings-config',
+        });
       }
-      const { saveSecrets } = await import('../../core/secrets-store.mjs');
-      await saveSecrets(AGENT_DIR, existingSecrets);
     }
 
     res.json({ success: true });

package/src/server/routes/context.mjs

@@ -1,10 +1,11 @@
 import { Router } from 'express';
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
 import { requireAuth, requireScope } from '../auth.mjs';
-import { serverError, ROOT, BRAIN_DIR, VAULT_DIR, SKILLS_DIR, INSTRUCTIONS, DERIVED_DIR, badRequest } from './_shared.mjs';
-import { logger } from '../../core/logger.mjs';
+import {
+  serverError,
+  badRequest,
+  resolveVaultFromQuery,
+  pathsForVault,
+} from './_shared.mjs';
 
 const router = Router();
 
@@ -12,10 +13,12 @@ router.post('/api/context', requireAuth, requireScope('memory:read'), async (req
   try {
     const { compileContext } = await import('../../core/context-compiler.mjs');
     const { query, budget, momentum_slugs } = req.body || {};
+    const vaultDir = resolveVaultFromQuery(req);
+    const { derivedDir } = pathsForVault(vaultDir);
     const result = await compileContext({
       query: query || '',
-      vaultDir: VAULT_DIR,
-      derivedDir: DERIVED_DIR,
+      vaultDir,
+      derivedDir,
       budget: budget || {},
       consumer: 'api',
       momentumSlugs: momentum_slugs || [],
@@ -29,7 +32,8 @@ router.post('/api/context', requireAuth, requireScope('memory:read'), async (req
 router.get('/api/context/preview', requireAuth, requireScope('memory:read'), async (req, res) => {
   try {
     const { previewContext } = await import('../../core/context-compiler.mjs');
-    const result = previewContext({ vaultDir: VAULT_DIR });
+    const vaultDir = resolveVaultFromQuery(req);
+    const result = previewContext({ vaultDir });
     res.json(result);
   } catch (err) {
     serverError(res, err);
@@ -41,9 +45,10 @@ router.post('/api/context/stream', requireAuth, requireScope('memory:read'), asy
     const { streamParallelContext } = await import('../../core/parallel-context.mjs');
     const { query, budget_tokens, batch_size, concurrency, min_score } = req.body || {};
     if (!query) return badRequest(res, 'query is required');
+    const vaultDir = resolveVaultFromQuery(req);
     const result = await streamParallelContext({
       query,
-      vaultDir: VAULT_DIR,
+      vaultDir,
       budgetTokens: budget_tokens,
       batchSize: batch_size,
       concurrency,

package/src/server/routes/dashboard.mjs

@@ -1,52 +1,73 @@
 import { Router } from 'express';
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { requireAuth, requireScope } from '../auth.mjs';
 import { getNodes } from '../../core/vault-cache.mjs';
-import { VAULT_DIR, INSTRUCTIONS } from './_shared.mjs';
+import {
+  VAULT_DIR,
+  INSTRUCTIONS,
+  ROOT as SHARED_ROOT,
+  resolveVaultFromQuery,
+  pathsForVault,
+} from './_shared.mjs';
 
 const router = Router();
-const ROOT = process.env.TR_ROOT || path.join(path.dirname(new URL(import.meta.url).pathname), '..', '..', '..');
+// Prefer shared ROOT (fileURLToPath-safe). Fall back with fileURLToPath — never URL.pathname
+// (breaks on Windows and on paths with encoded characters).
+const ROOT = process.env.TR_ROOT || SHARED_ROOT || path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
 
 router.get('/api/dashboard/instructions', requireAuth, requireScope('instructions:read'), (req, res) => {
+  const vaultDir = resolveVaultFromQuery(req);
+  const paths = pathsForVault(vaultDir);
+  // skillsDir = …/.agent/skills → agentDir = …/.agent; surfaces often at repo root (parent of .agent)
+  const agentDir = path.dirname(paths.skillsDir);
+  const surfaceBase =
+    path.basename(agentDir) === '.agent' ? path.dirname(agentDir) : agentDir;
+
   const surfaces = [];
   const surfaceFiles = ['AGENTS.md', 'GEMINI.md', 'CLAUDE.md', 'INSTRUCTIONS.md'];
-  
+
   for (const name of surfaceFiles) {
-    let filePath;
-    if (name === 'INSTRUCTIONS.md') {
-      filePath = path.join(ROOT, name);
-    } else {
-      filePath = path.join(ROOT, name);
-    }
-    
+    // Prefer agent-adjacent surfaces; fall back to package ROOT for monorepo dashboard
+    const candidates = [
+      path.join(surfaceBase, name),
+      path.join(agentDir, name),
+      path.join(ROOT, name),
+    ];
+    let filePath = candidates.find((p) => fs.existsSync(p)) || candidates[0];
+
     let size = 0;
     let lastCompiled = '';
     let active = false;
-    
+
     if (fs.existsSync(filePath)) {
       const stat = fs.statSync(filePath);
       size = stat.size;
       lastCompiled = stat.mtime.toISOString();
       active = true;
     }
-    
+
     surfaces.push({
       name,
       filename: name,
       size,
       lastCompiled,
-      active
+      active,
     });
   }
-  
-  const lastCompileTimestamp = fs.existsSync(INSTRUCTIONS) ? fs.statSync(INSTRUCTIONS).mtime.toISOString() : '';
-  const totalNodes = fs.existsSync(VAULT_DIR) ? getNodes(VAULT_DIR).length : 0;
-  
+
+  const instructionsFile = paths.instructionsFile || INSTRUCTIONS;
+  const lastCompileTimestamp = fs.existsSync(instructionsFile)
+    ? fs.statSync(instructionsFile).mtime.toISOString()
+    : '';
+  const totalNodes = fs.existsSync(vaultDir) ? getNodes(vaultDir).length : 0;
+
   res.json({
     surfaces,
     lastCompileTimestamp,
-    totalNodes
+    totalNodes,
+    vault_dir: vaultDir,
   });
 });