total-recall-brain 3.28.2 → 3.30.1

package/src/core/surface.mjs

@@ -11,6 +11,9 @@ import {
   inferMemoryLayer,
 } from './memory-layers.mjs';
 import { assemblePluginContexts } from './plugin-context.mjs';
+import { selectResearchBriefs, formatResearchBriefs } from './research-surface.mjs';
+import { loadQueue } from './research-queue.mjs';
+import { brainDir as globalBrainDir } from './config.mjs';
 
 /**
  * Extract [[slug]] wikilink references and relative Markdown link targets from body text.
@@ -307,6 +310,26 @@ async function compactNode(node, derivedDir, force = false) {
   return compacted;
 }
 
+/**
+ * Finished background research for the current project, plus research the user
+ * asked for recently, as a compact brief section (see research-surface.mjs).
+ * Reports live in the global brain, so nodes are looked up there when the
+ * caller's node set (e.g. a project vault) does not contain them.
+ */
+export function buildResearchSection(nodes = [], { projectRoot, queueItems, researchNodes, now } = {}) {
+  try {
+    const items = queueItems || loadQueue();
+    if (!items.some((i) => i.status === 'done' && i.node_slug)) return '';
+    const project = path.basename(projectRoot || process.cwd());
+    const pool = researchNodes || [...nodes, ...getNodes(path.join(globalBrainDir, 'memory-vault'))];
+    const section = formatResearchBriefs(selectResearchBriefs({ queueItems: items, nodes: pool, project, now }));
+    return section ? `\n\n${section}` : '';
+  } catch (err) {
+    logger.debug('surface', `Research section skipped: ${err.message}`);
+    return '';
+  }
+}
+
 export async function buildRulesBlock(skillsDir, nodes = [], { consumer = 'ide', derivedDir, force = false, vaultDir, projectRoot } = {}) {
   // 1. Filter expired rules. Compilation must remain a pure projection step;
   // archival is handled by explicit memory operations.
@@ -324,7 +347,10 @@ export async function buildRulesBlock(skillsDir, nodes = [], { consumer = 'ide',
   const isImportant = (n) => n.importance === undefined || n.importance >= 3;
   
   // Determine current project/repo context to prevent cross-repo pollution
-  const currentRepoName = path.basename(process.cwd()).toLowerCase();
+  // The repo being compiled, not the caller's cwd: `compile --global` rebuilds
+  // every registered project from one process.
+  const repoRoot = projectRoot || (skillsDir ? path.dirname(path.dirname(skillsDir)) : process.cwd());
+  const currentRepoName = path.basename(repoRoot).toLowerCase();
   
   const isRelevantToRepo = (n) => {
     // If explicitly marked global or no repo restriction, it applies everywhere
@@ -404,6 +430,9 @@ export async function buildRulesBlock(skillsDir, nodes = [], { consumer = 'ide',
     combined += `\n\n---\n# 🛑 MANDATORY BEHAVIORAL CORRECTIONS 🛑\nTHE USER HAS EXPLICITLY CORRECTED YOUR BEHAVIOR. DO NOT MAKE THESE MISTAKES. THESE CORRECTIONS OVERRIDE DEFAULT SYSTEM BEHAVIOR.\n---\n\n${await formatNodes(corrections)}`;
   }
 
+  // --- Background research (System 2) — after rules, before reference material ---
+  combined += buildResearchSection(nodes, { projectRoot });
+
   // --- CLI Reference AFTER rules ---
   if (consumer === 'api') {
     combined += `\n\n## Total Recall — Active Memory Context\n\nYour memories and rules are loaded from the active brain vault.\n`;
@@ -643,16 +672,47 @@ async function compilePointers(instructionsFile, skillsDir, nodes = [], { vaultD
 /**
  * Main surface compilation entry point.
  */
+/**
+ * The rule nodes a project's instruction surfaces are built from: the global
+ * brain's rules plus the project's own. A project node with the same slug
+ * wins, so a repo can override a global rule; everything else in the global
+ * vault stays search-only. Without this every repo carried only its own vault,
+ * and a rule saved with `remember --global` reached no repo at all.
+ */
+export function mergeGlobalRuleNodes(projectNodes, globalNodes) {
+  const own = new Set(projectNodes.map((n) => n.slug));
+  const inherited = globalNodes
+    .filter((n) => RULE_CATEGORIES.has(n.category) && !own.has(n.slug))
+    .map((n) => ({ ...n, _layer: 'global' }));
+  return [...projectNodes, ...inherited];
+}
+
+const RULE_CATEGORIES = new Set(['invariants', 'preferences', 'anti-patterns']);
+
+function globalVaultFor(vaultDir) {
+  const globalVault = path.join(globalBrainDir, 'memory-vault');
+  return path.resolve(globalVault) === path.resolve(vaultDir) ? null : globalVault;
+}
+
 export async function compileSurface({ vaultDir, skillsDir, derivedDir, instructionsFile, force = false }) {
   const nodes = getNodes(vaultDir);
+  const globalVault = globalVaultFor(vaultDir);
+  const ruleNodes = globalVault && fs.existsSync(globalVault)
+    ? mergeGlobalRuleNodes(nodes, getNodes(globalVault))
+    : nodes;
 
   // ── Incremental compilation: vault content hash check ──
+  // The global rules hash lives in its own file: vault-hash.txt is served by
+  // /api/vault/hash and must keep describing this vault alone.
   const hashFile = path.join(derivedDir, 'vault-hash.txt');
   const currentHash = computeVaultHash(vaultDir);
+  const globalHashFile = path.join(derivedDir, 'global-rules-hash.txt');
+  const globalHash = globalVault && fs.existsSync(globalVault) ? computeVaultHash(globalVault) : '';
 
   if (!force && fs.existsSync(hashFile)) {
     const storedHash = fs.readFileSync(hashFile, 'utf8').trim();
-    if (storedHash === currentHash) {
+    const storedGlobal = fs.existsSync(globalHashFile) ? fs.readFileSync(globalHashFile, 'utf8').trim() : '';
+    if (storedHash === currentHash && storedGlobal === globalHash) {
       return {
         nodesProcessed: nodes.length,
         skillsInjected: 0,
@@ -665,7 +725,7 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
   }
 
   // 1. Write pointer and active rules to all instruction shims
-  const skillsInjected = await compilePointers(instructionsFile, skillsDir, nodes, { vaultDir, derivedDir, force });
+  const skillsInjected = await compilePointers(instructionsFile, skillsDir, ruleNodes, { vaultDir, derivedDir, force });
 
   // 2. Build derived indexes (powers semantic search API)
   if (!fs.existsSync(derivedDir)) {
@@ -730,6 +790,7 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
 
   // 5. Write vault hash + projection manifest
   atomicWrite(hashFile, currentHash);
+  atomicWrite(globalHashFile, globalHash);
   writeProjectionManifest(derivedDir, currentHash);
 
   // 6. Generate live OKF Index and Log

package/src/core/task-executors.mjs

@@ -369,6 +369,14 @@ async function runResearchLegacy(task, ctx) {
     String(task.slug || '').includes('fact-seeker') ||
     String(task.slug || '').includes('knowledge-acquisition')
   ) {
+    // Research needs a topic somebody chose. A task without one used to pull
+    // "the next agenda topic" — which is how self-spawned tangents got
+    // researched — so it is now a no-op (RESEARCH_SYSTEM2).
+    const topic = String(task.target || '').trim();
+    if (!topic || topic === 'global') {
+      return { success: true, output: 'No research topic on this task — nothing to research.', executor: 'research' };
+    }
+
     // Prefer deep multi-source research when this came from the research queue
     const deep =
       String(task.slug || '').startsWith('research-acquisition-') ||
@@ -497,51 +505,6 @@ async function runResearchLegacy(task, ctx) {
     };
   }
 
-  if (String(task.slug || '').startsWith('research-monitoring-')) {
-    const missing = requireNode('Monitoring');
-    if (missing) return missing;
-    const { runResearchMonitoringCycle } = await import('./fact-seeker.mjs');
-    const result = await runResearchMonitoringCycle({
-      vaultDir: VAULT_DIR,
-      nodeSlug: task._node_slug,
-      topic: task.title || task.target || 'Unknown Topic',
-      runtimeConfig,
-      skillsDir: SKILLS_DIR,
-      derivedDir: DERIVED_DIR,
-      instructionsFile: INSTRUCTIONS_FILE,
-    });
-    if (result?.success === false) {
-      return { success: false, error: result.error || 'Monitoring failed', executor: 'research' };
-    }
-    return {
-      success: true,
-      output: result?.output || 'Monitoring complete',
-      factSlug: result?.factSlug || task._node_slug,
-      executor: 'research',
-    };
-  }
-
-  if (String(task.slug || '').startsWith('research-expansion-')) {
-    const missing = requireNode('Expansion');
-    if (missing) return missing;
-    const { runResearchExpansionCycle } = await import('./fact-seeker.mjs');
-    const result = await runResearchExpansionCycle({
-      vaultDir: VAULT_DIR,
-      nodeSlug: task._node_slug,
-      topic: task.title || task.target || 'Unknown Topic',
-      runtimeConfig,
-    });
-    if (result?.success === false) {
-      return { success: false, error: result.error || 'Expansion failed', executor: 'research' };
-    }
-    return {
-      success: true,
-      output: result?.output || 'Expansion complete',
-      factSlug: result?.factSlug || task._node_slug,
-      executor: 'research',
-    };
-  }
-
   if (String(task.slug || '').includes('validate')) {
     const { runConclusionWriter } = await import('./conclusion-writer.mjs');
     const result = await runConclusionWriter({

package/src/core/vault-cache.mjs

@@ -60,6 +60,75 @@ export function invalidate(vaultDir) {
   }
 }
 
+/**
+ * Watches a directory tree without keeping the process alive.
+ *
+ * macOS and Windows implement `fs.watch({ recursive: true })` natively as one
+ * handle, so `unref()` works. On Linux, Node emulates it with one inotify
+ * watcher per subdirectory and `unref()` on the returned object does not reach
+ * them, so every CLI command that touched the vault cache hung after printing
+ * its result. There, each directory gets its own non-recursive, unref'd
+ * watcher instead; directories created later are picked up as they appear.
+ *
+ * @param {string} root - Directory to watch
+ * @param {(eventType: string, filename: string) => void} onChange - Receives paths relative to root
+ * @returns {{ close: () => void }}
+ */
+function watchTree(root, onChange) {
+  if (process.platform === 'darwin' || process.platform === 'win32') {
+    const watcher = fs.watch(root, { recursive: true }, onChange);
+    watcher.unref();
+    return watcher;
+  }
+
+  const watchers = new Map();
+  const watchDir = (dir) => {
+    if (watchers.has(dir)) return;
+    let watcher;
+    try {
+      watcher = fs.watch(dir, (eventType, filename) => {
+        if (!filename) return;
+        const full = path.join(dir, String(filename));
+        if (eventType === 'rename') {
+          try {
+            if (fs.statSync(full).isDirectory()) walk(full);
+          } catch {
+            // Removed; its watcher closes itself on error.
+          }
+        }
+        onChange(eventType, path.relative(root, full));
+      });
+    } catch {
+      return;
+    }
+    watcher.on('error', () => {
+      watcher.close();
+      watchers.delete(dir);
+    });
+    watcher.unref();
+    watchers.set(dir, watcher);
+  };
+  const walk = (dir) => {
+    watchDir(dir);
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const item of entries) {
+      if (item.isDirectory()) walk(path.join(dir, item.name));
+    }
+  };
+  walk(root);
+  return {
+    close() {
+      for (const watcher of watchers.values()) watcher.close();
+      watchers.clear();
+    },
+  };
+}
+
 /**
  * Starts a filesystem watcher on the vault directory to automatically invalidate the cache
  * when external edits occur.
@@ -82,15 +151,12 @@ function startWatcher(vaultDir) {
 
   logger.info('Starting filesystem watcher for vault cache', { vaultDir: resolvedDir });
   try {
-    const watcher = fs.watch(resolvedDir, { recursive: true }, (eventType, filename) => {
+    entry.watcher = watchTree(resolvedDir, (eventType, filename) => {
       if (filename && filename.endsWith('.md')) {
         logger.info(`Vault filesystem change detected (${eventType}: ${filename}), invalidating cache`);
         invalidate(resolvedDir);
       }
     });
-    // Unref the watcher so it does not prevent Node from exiting cleanly
-    watcher.unref();
-    entry.watcher = watcher;
   } catch (err) {
     logger.warn('Failed to start vault fs watcher, cache will rely on explicit invalidations', { error: err.message });
   }

package/src/server/api.mjs

@@ -436,6 +436,7 @@ COMPUTER USE TOOLS (desktop/X11 — use to control apps or the full desktop):
 - 'computer_scroll': Scroll up or down at screen coordinates.
 
 CODE / MEMORY:
+- 'queue_research': Queue deep BACKGROUND research when the user asks you to research a topic in depth or later. Findings arrive in memory, not in this reply. Never use it on your own initiative; use 'search_web' for answers now.
 - 'execute_code': Run Node.js to call APIs, process data, or perform calculations.
 - 'update_design': Write markdown to DESIGN.md when asked to create a UI or document.
 
@@ -645,6 +646,26 @@ ${interviewTask}`;
       }
     }
 
+    // System 2 grounding: background research relevant to what the user just
+    // asked. One embedding lookup, no LLM call; failure never blocks the reply.
+    try {
+      const lastUser = [...messages].reverse().find((m) => m.role === 'user');
+      const lastText = typeof lastUser?.content === 'string' ? lastUser.content : '';
+      if (lastText) {
+        const { findRelevantResearch, formatChatResearch } = await import('../core/research-surface.mjs');
+        const found = await findRelevantResearch(lastText, {
+          vaultDir: VAULT_DIR,
+          derivedDir: path.join(path.dirname(VAULT_DIR), 'memory-derived'),
+        });
+        if (found.length) {
+          baseSystemPrompt += formatChatResearch(found);
+          logger.info('api', `Research grounding: ${found.map((f) => f.slug).join(', ')}`);
+        }
+      }
+    } catch (err) {
+      logger.warn('api', `Research grounding skipped: ${err.message}`);
+    }
+
     let currentMessages = [...messages];
     if (currentMessages.length > 0 && currentMessages[0].role === 'system') {
       currentMessages[0].content = `${baseSystemPrompt}\n\n${currentMessages[0].content}`;

package/src/server/rest.mjs

@@ -125,6 +125,7 @@ import { rulesRouter }    from './routes/rules.mjs';
 import notificationsRouter from './routes/notifications.mjs';
 import meshPresenceRouter from './routes/mesh-presence.mjs';
 import pluginsRouter      from './routes/plugins.mjs';
+import pluginsMeshRouter  from './routes/plugins-mesh.mjs';
 // ollamaUrl removed — CLI agents replace Ollama
 import {
   AGENT_DIR,
@@ -243,6 +244,7 @@ router.use(rulesRouter);
 router.use(notificationsRouter);
 router.use(meshPresenceRouter);
 router.use(pluginsRouter);
+router.use(pluginsMeshRouter);
 
 export { router as restRouter };
 export default router;

package/src/server/route-manifest.json

@@ -351,6 +351,14 @@
     "method": "GET",
     "path": "/api/mesh/nodes"
   },
+  {
+    "method": "GET",
+    "path": "/api/mesh/plugins"
+  },
+  {
+    "method": "GET",
+    "path": "/api/mesh/plugins/:id/bundle"
+  },
   {
     "method": "POST",
     "path": "/api/mesh/preauthkey"
@@ -451,10 +459,6 @@
     "method": "GET",
     "path": "/api/plugins/:id"
   },
-  {
-    "method": "POST",
-    "path": "/api/plugins/:id/rate"
-  },
   {
     "method": "GET",
     "path": "/api/plugins/:id/readme"
@@ -463,14 +467,22 @@
     "method": "POST",
     "path": "/api/plugins/:id/run"
   },
+  {
+    "method": "POST",
+    "path": "/api/plugins/:id/share"
+  },
   {
     "method": "GET",
-    "path": "/api/plugins/catalog"
+    "path": "/api/plugins/available"
   },
   {
     "method": "POST",
     "path": "/api/plugins/install"
   },
+  {
+    "method": "GET",
+    "path": "/api/plugins/peers"
+  },
   {
     "method": "GET",
     "path": "/api/proposals"
@@ -495,6 +507,10 @@
     "method": "GET",
     "path": "/api/proposals/stale"
   },
+  {
+    "method": "GET",
+    "path": "/api/public/plugins/:id/bundle"
+  },
   {
     "method": "GET",
     "path": "/api/research"

package/src/server/routes/collab.mjs

@@ -7,14 +7,29 @@ import jwt from 'jsonwebtoken';
 import { WebSocket } from 'ws';
 import { brainDir as configBrainDir } from '../../core/config.mjs';
 
-const JWT_SECRET = process.env.JWT_SECRET || 'total-recall-collab-secret-key-1234';
-
 // Setup database paths in brainDir
 const DATA_DIR = path.join(configBrainDir, 'collab');
 if (!fs.existsSync(DATA_DIR)) {
   fs.mkdirSync(DATA_DIR, { recursive: true });
 }
 
+// Signing secret: JWT_SECRET from the environment, otherwise a random secret
+// generated once and persisted beside the collab store. There is deliberately no
+// hardcoded fallback — a secret that ships in public source lets anyone forge a
+// token for any username.
+const JWT_SECRET_FILE = path.join(DATA_DIR, '.jwt-secret');
+export function resolveJwtSecret(env = process.env, secretFile = JWT_SECRET_FILE) {
+  if (env.JWT_SECRET) return env.JWT_SECRET;
+  try {
+    const existing = fs.readFileSync(secretFile, 'utf8').trim();
+    if (existing.length >= 32) return existing;
+  } catch { /* not created yet */ }
+  const generated = crypto.randomBytes(48).toString('base64url');
+  fs.writeFileSync(secretFile, generated, { encoding: 'utf8', mode: 0o600 });
+  return generated;
+}
+const JWT_SECRET = resolveJwtSecret();
+
 const USERS_FILE = path.join(DATA_DIR, 'users.json');
 const GROUPS_FILE = path.join(DATA_DIR, 'groups.json');
 const ANNOTATIONS_FILE = path.join(DATA_DIR, 'annotations.json');
@@ -203,7 +218,7 @@ collabRouter.post('/api/collab/annotations', requireCollabAuth, (req, res) => {
       return res.status(403).json({ error: 'You are not a member of this group' });
     }
     const note = addAnnotation(url, groupCode, req.user.username, text, excerpt);
-    broadcastToUrl(url, { type: 'ANNOTATION_ADDED', annotation: note });
+    broadcastToUrl(url, { type: 'ANNOTATION_ADDED', annotation: note }, { audienceGroups: [groupCode] });
     res.json(note);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -240,7 +255,7 @@ export function handleCollabUpgrade(request, socket, head, wss) {
               type: 'USER_JOINED',
               username: clientInfo.username,
               url: cleanUrl
-            }, ws);
+            }, { excludeWs: ws, audienceGroups: groupCodesOf(clientInfo.username) });
           }
 
           if (data.type === 'CHAT_MESSAGE') {
@@ -250,7 +265,7 @@ export function handleCollabUpgrade(request, socket, head, wss) {
               username: clientInfo.username,
               text: data.text,
               created_at: new Date().toISOString()
-            });
+            }, { audienceGroups: groupCodesOf(clientInfo.username) });
           }
         } catch (err) {
           ws.send(JSON.stringify({ type: 'ERROR', error: 'Invalid frame' }));
@@ -263,7 +278,7 @@ export function handleCollabUpgrade(request, socket, head, wss) {
           broadcastToUrl(clientInfo.currentUrl, {
             type: 'USER_LEFT',
             username: clientInfo.username
-          });
+          }, { excludeWs: ws, audienceGroups: groupCodesOf(clientInfo.username) });
         }
         clients.delete(ws);
       });
@@ -274,13 +289,25 @@ export function handleCollabUpgrade(request, socket, head, wss) {
   }
 }
 
-function broadcastToUrl(url, messageObj, excludeWs = null) {
+function groupCodesOf(username) {
+  return getUserGroups(username).map(g => g.code);
+}
+
+/**
+ * Send to sockets viewing `url` that share at least one of `audienceGroups`.
+ * Presence and chat are group-private: two unrelated groups reading the same
+ * page must never see each other's messages. An empty audience reaches no one.
+ */
+export function broadcastToUrl(url, messageObj, { excludeWs = null, audienceGroups = [] } = {}, registry = clients) {
   const cleanUrl = url.split('#')[0];
   const payload = JSON.stringify(messageObj);
+  const audience = new Set(audienceGroups);
+  if (audience.size === 0) return;
+  const groups = loadGroups();
 
-  for (const [ws, info] of clients.entries()) {
-    if (ws !== excludeWs && info.currentUrl === cleanUrl && ws.readyState === WebSocket.OPEN) {
-      ws.send(payload);
-    }
+  for (const [ws, info] of registry.entries()) {
+    if (ws === excludeWs || info.currentUrl !== cleanUrl || ws.readyState !== WebSocket.OPEN) continue;
+    const shares = groups.some(g => audience.has(g.code) && g.members.includes(info.username));
+    if (shares) ws.send(payload);
   }
 }

package/src/server/routes/extension.mjs

@@ -34,14 +34,15 @@ router.get('/api/extension/download', requireAuth, requireScope('config:read'),
     res.setHeader('Content-Disposition', 'attachment; filename="total-recall-extension.zip"');
 
     // Use zip if available, fall back to tar
-    const zip = spawn('zip', ['-r', '-', '.'], { cwd: extDir, stdio: ['ignore', 'pipe', 'ignore'] });
+    // Unit specs live beside the extension sources but are not part of the product.
+    const zip = spawn('zip', ['-r', '-', '.', '-x', '*.spec.mjs'], { cwd: extDir, stdio: ['ignore', 'pipe', 'ignore'] });
     zip.stdout.pipe(res);
     zip.on('error', () => {
       // zip not available — try tar
       if (!res.headersSent) {
         res.setHeader('Content-Type', 'application/gzip');
         res.setHeader('Content-Disposition', 'attachment; filename="total-recall-extension.tar.gz"');
-        const tar = spawn('tar', ['czf', '-', '-C', path.dirname(extDir), 'extension'], { stdio: ['ignore', 'pipe', 'ignore'] });
+        const tar = spawn('tar', ['czf', '-', '--exclude=*.spec.mjs', '-C', path.dirname(extDir), 'extension'], { stdio: ['ignore', 'pipe', 'ignore'] });
         tar.stdout.pipe(res);
         tar.on('error', err => { if (!res.headersSent) serverError(res, err); });
         tar.on('close', () => { if (!res.writableEnded) res.end(); });

package/src/server/routes/memory.mjs

@@ -119,6 +119,17 @@ const PASSTHROUGH_FIELDS = [
   'project',
 ];
 
+function stripInternalFields(result) {
+  const clean = {};
+  for (const [key, value] of Object.entries(result)) {
+    if (!key.startsWith('_')) clean[key] = value;
+  }
+  if (clean.type !== 'session' && clean.content === undefined && typeof clean.body === 'string') {
+    clean.content = clean.body;
+  }
+  return clean;
+}
+
 router.get('/api/memory', requireAuth, requireScope('memory:read'), (req, res) => {
   try {
     const vaultDirs = resolveAllVaultsFromQuery(req);
@@ -137,7 +148,7 @@ router.get('/api/memory', requireAuth, requireScope('memory:read'), (req, res) =
         }
       }
     }
-    const { q, category, tag, tags, status, limit = '200', offset = '0' } = req.query;
+    const { q, category, tag, tags, status, sort, limit = '200', offset = '0' } = req.query;
 
     if (q) {
       const query = String(q).toLowerCase();
@@ -163,6 +174,15 @@ router.get('/api/memory', requireAuth, requireScope('memory:read'), (req, res) =
       }
     }
 
+    // sort=recent (newest created first) / sort=updated (newest update first), so a
+    // paged client sees the latest nodes instead of vault walk order. `recent` keys
+    // on creation because dream consolidation re-stamps `updated` on old nodes.
+    if (sort === 'recent' || sort === 'updated') {
+      const field = sort === 'recent' ? 'created' : 'updated';
+      const ts = (n) => Date.parse(n[field] || n.created || '') || 0;
+      list.sort((a, b) => ts(b) - ts(a));
+    }
+
     const total = list.length;
     const off   = Math.max(0, parseInt(offset, 10) || 0);
     const lim   = Math.min(500, Math.max(1, parseInt(limit, 10) || 200));
@@ -456,7 +476,9 @@ router.post('/api/memory/search/semantic', requireAuth, requireScope('memory:rea
     }
 
     merged.sort((a, b) => (b.score || 0) - (a.score || 0));
-    const results = merged.slice(0, k);
+    // Never expose absolute vault paths (_filePath, _brainVault, …) over the API;
+    // mirror sanitizeNode's `content` so clients read one field for the text.
+    const results = merged.slice(0, k).map(stripInternalFields);
 
     if (!anyIndex || results.length === 0) {
       return res.status(503).json({

package/src/server/routes/mesh.mjs

@@ -6,6 +6,7 @@ import {
   getMeshPeers,
   getMeshHostname,
   listEnrichedMeshNodes,
+  meshVaultRoot,
   listMeshNodeEntities,
   attachSelfInterfaces,
   normalizeHostname,
@@ -26,7 +27,6 @@ import {
 // headscale rejects anything else with a 500; validate up front instead.
 const AUTH_REQUEST_PREFIX = 'hskey-authreq-';
 import { throttledFetch } from '../../core/throttled-fetch.mjs';
-import { defaultVaultRoot } from '../../core/vfs-documents.mjs';
 import {
   listLocalInterfaces,
   summarizeInterfacesForEntity,
@@ -101,7 +101,7 @@ router.get('/api/mesh/leader', requireAuth, requireScope('config:read'), async (
  * Self node includes live interface kinds (wifi/ethernet/vpn_overlay/…).
  */
 router.get('/api/mesh/nodes', requireAuth, requireScope('config:read'), async (req, res) => {
-  const vaultRoot = defaultVaultRoot();
+  const vaultRoot = meshVaultRoot();
   let nodes = listEnrichedMeshNodes(vaultRoot);
   try {
     nodes = attachSelfInterfaces(nodes, summarizeInterfacesForEntity());
@@ -169,7 +169,7 @@ router.post('/api/mesh/access', requireAuth, requireScope('config:write'), async
   }
 
   try {
-    const result = await setMeshNodeAccess(target, patch, { vaultRoot: defaultVaultRoot() });
+    const result = await setMeshNodeAccess(target, patch, { vaultRoot: meshVaultRoot() });
     if (!result.written) {
       const notFound = result.reason === 'node-not-found';
       res.status(notFound ? 404 : 500).json({
@@ -194,7 +194,7 @@ router.post('/api/mesh/access', requireAuth, requireScope('config:write'), async
  */
 router.get('/api/mesh/access/proposals', requireAuth, requireScope('config:read'), async (_req, res) => {
   try {
-    const nodes = listEnrichedMeshNodes(defaultVaultRoot());
+    const nodes = listEnrichedMeshNodes(meshVaultRoot());
     res.json({
       proposals: proposeAccessFromSshConfig(nodes, readSshConfig()),
       missing_access: nodes
@@ -210,7 +210,7 @@ router.get('/api/mesh/access/proposals', requireAuth, requireScope('config:read'
 /** Apply every proposal from this host's ssh config to the node entities. */
 router.post('/api/mesh/access/import', requireAuth, requireScope('config:write'), async (_req, res) => {
   try {
-    const vaultRoot = defaultVaultRoot();
+    const vaultRoot = meshVaultRoot();
     const proposals = proposeAccessFromSshConfig(listEnrichedMeshNodes(vaultRoot), readSshConfig());
     const results = [];
     for (const proposal of proposals) {
@@ -434,7 +434,7 @@ router.delete('/api/mesh/watch', requireAuth, requireScope('config:write'), asyn
 router.get('/api/mesh/io', requireAuth, requireScope('config:read'), async (_req, res) => {
   try {
     const live = detectDeviceIo();
-    const entities = listMeshNodeEntities(defaultVaultRoot());
+    const entities = listMeshNodeEntities(meshVaultRoot());
     const selfHost = normalizeHostname(getMeshHostname());
     const ent = entities.find(
       (e) => normalizeHostname(e.hostname) === selfHost,
@@ -498,7 +498,7 @@ router.post('/api/mesh/lan/register', requireAuth, requireScope('config:write'),
       maxProbes: limit,
     });
     const registration = await registerLanMeshNodes(snapshot.hosts, {
-      vaultRoot: defaultVaultRoot(),
+      vaultRoot: meshVaultRoot(),
       onlyReachable: true,
     });
     res.json({