total-recall-brain 3.44.0 → 3.46.0

package/src/core/workspace-drawers.mjs

@@ -0,0 +1,79 @@
+/** Private dashboard chrome settings, shared by the HTTP and CLI adapters. */
+import path from 'node:path';
+import { executePluginState, PluginStateStore } from './plugin-state-store.mjs';
+
+const OWNER = 'workspace-ui';
+const ID = /^[a-z][a-z0-9-]{0,63}$/;
+const EMPTY = { html: '', chunks: [], panels: [], shortcuts: [] };
+export const MAX_DRAWER_HTML_BYTES = 64 * 1024;
+
+export class DrawerInputError extends Error {}
+
+function stateFile(brainDir, edge) {
+  if (edge !== 'right' && edge !== 'bottom') throw new DrawerInputError('Choose the right or bottom drawer.');
+  return path.join(brainDir, 'config', `workspace-drawer-${edge}.json`);
+}
+
+function list(value, name, limit) {
+  if (!Array.isArray(value) || value.length > limit) throw new DrawerInputError(`${name} must contain at most ${limit} items.`);
+  return value;
+}
+
+function shortcutHref(value) {
+  if (typeof value !== 'string' || value.length > 1024 || /[\u0000-\u0020\u007f\\]/.test(value)) {
+    throw new DrawerInputError('Use a dashboard path or an HTTPS address for each shortcut.');
+  }
+  const base = 'https://workspace.invalid';
+  let url;
+  try { url = new URL(value, base); } catch { throw new DrawerInputError('Invalid shortcut address.'); }
+  if (value.startsWith('/') && !value.startsWith('//') && url.origin === base && !url.pathname.startsWith('//') &&
+      !/%(?:2f|5c)/i.test(url.pathname)) {
+    return url.pathname + url.search + url.hash;
+  }
+  if (value.startsWith('https://') && !url.username && !url.password) return url.href;
+  throw new DrawerInputError('Use a dashboard path or an HTTPS address for each shortcut.');
+}
+
+export function validateDrawerConfig(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !Object.hasOwn(EMPTY, key))) {
+    throw new DrawerInputError('Invalid drawer configuration.');
+  }
+  const { html = '', chunks = [], panels = [], shortcuts = [] } = value;
+  if (typeof html !== 'string' || Buffer.byteLength(html, 'utf8') > MAX_DRAWER_HTML_BYTES) {
+    throw new DrawerInputError('Drawer HTML must be at most 64 KiB.');
+  }
+  const chunkIds = list(chunks, 'Chunks', 8).map(key => {
+    if (typeof key !== 'string' || key.split(':').length !== 2 || key.split(':').some(id => !ID.test(id))) {
+      throw new DrawerInputError('Each chunk needs a plugin ID and a chunk ID.');
+    }
+    return key;
+  });
+  const references = list(panels, 'Panels', 6).map(panel => {
+    if (typeof panel?.plugin !== 'string' || typeof panel?.element !== 'string' ||
+        !ID.test(panel.plugin) || !ID.test(panel.element)) throw new DrawerInputError('Invalid plugin panel reference.');
+    return { plugin: panel.plugin, element: panel.element };
+  });
+  const links = list(shortcuts, 'Shortcuts', 16).map(shortcut => {
+    const label = typeof shortcut?.label === 'string' ? shortcut.label.trim() : '';
+    if (!label || label.length > 80 || /[\u0000-\u001f\u007f]/.test(label)) throw new DrawerInputError('Give each shortcut a name of 1–80 characters.');
+    return { label, href: shortcutHref(shortcut.href) };
+  });
+  return { html, chunks: [...new Set(chunkIds)], panels: references, shortcuts: links };
+}
+
+export function readDrawerConfig(brainDir, edge) {
+  const store = new PluginStateStore(stateFile(brainDir, edge), OWNER);
+  const config = validateDrawerConfig(store.read(EMPTY));
+  return { config, version: store.version };
+}
+
+export async function writeDrawerConfig(brainDir, edge, config, version) {
+  if (version !== null && (typeof version !== 'string' || !/^[0-9a-f]{64}$/.test(version))) {
+    throw new DrawerInputError('Reload the drawer before saving.');
+  }
+  const value = validateDrawerConfig(config);
+  const result = await executePluginState({
+    file: stateFile(brainDir, edge), plugin: OWNER, action: 'write', value, expectedVersion: version,
+  });
+  return { config: value, version: result.version };
+}

package/src/server/api.mjs

@@ -15,10 +15,10 @@ import { runInSandbox } from '../core/sandbox.mjs';
 import { resolveAgentDir } from '../cli/agent-dir.mjs';
 import { removeSessionEmbeddingFromIndex } from '../core/embeddings.mjs';
 import path from 'path';
-import os from 'os';
 import fs from 'fs';
 import matter from '../core/frontmatter.mjs';
 import { agentDir, brainDir, surfaceDir, instructionsFilePath } from '../core/config.mjs';
+import { resolveVaultFromQuery } from './routes/_shared.mjs';
 
 const AGENT_DIR = process.env.AGENT_DIR || agentDir;
 const BRAIN_DIR = process.env.TR_BRAIN || path.join(AGENT_DIR, 'skills', 'total-recall');
@@ -43,32 +43,9 @@ const MODEL_CATALOG_DIR = path.join(ROOT, 'models', 'catalog', 'total-recall');
  * @returns {string} Absolute path to the memory-vault directory
  */
 function resolveVaultDir(brainId) {
-  if (!brainId || brainId === 'global') {
-    return VAULT_DIR;
-  }
-
-  if (brainId.startsWith('project:')) {
-    const projectName = brainId.slice('project:'.length);
-    const globalBrainDir = path.join(os.homedir(), '.agent', 'skills', 'total-recall');
-    const registryPath = path.join(globalBrainDir, 'config', 'project-registry.json');
-
-    if (fs.existsSync(registryPath)) {
-      try {
-        const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
-        const project = registry.find(p => p.name === projectName);
-        if (project) {
-          const projectVaultDir = path.join(project.brainDir, 'memory-vault');
-          if (fs.existsSync(projectVaultDir)) {
-            return projectVaultDir;
-          }
-        }
-      } catch {
-        // Registry parse error — fall through to default
-      }
-    }
-  }
-
-  return VAULT_DIR;
+  return typeof brainId === 'string' && (brainId === 'global' || brainId.startsWith('project:'))
+    ? resolveVaultFromQuery({ query: { brain: brainId } })
+    : VAULT_DIR;
 }
 
 function sha256(content) {

package/src/server/index.mjs

@@ -352,6 +352,8 @@ app.get('/health', requireAuthOrLocal, async (req, res) => {
     cloudflare: cloudflareStatus,
     emergency_alerts: emergencyAlerts || null,
     fetch_gate,
+    // Whether the served dashboard is as new as this checkout's frontend sources.
+    dashboard: dashboardBundle.state(),
     vfs: {
       exists: vaultExists,
       skill_exists: skillExists,
@@ -444,24 +446,30 @@ try {
 
 const frontendDist = path.join(ROOT, 'frontend', 'dist');
 
-// Auto-build frontend if dist/ doesn't exist
-if (!fs.existsSync(path.join(frontendDist, 'index.html'))) {
-  const frontendDir = path.join(ROOT, 'frontend');
-  if (fs.existsSync(path.join(frontendDir, 'package.json'))) {
-    logger.info('server', 'Frontend not built. Building automatically...');
-    try {
-      const { execSync } = await import('node:child_process');
-      execSync('npm install --no-audit --no-fund 2>/dev/null && npm run build', {
-        cwd: frontendDir,
-        stdio: 'pipe',
-        timeout: 120_000,
-      });
-      logger.info('server', 'Frontend build complete.');
-    } catch (err) {
-      logger.warn('server', `Frontend auto-build failed: ${err.message?.split('\\n')[0] || 'unknown error'}. Dashboard will show API info instead.`);
+// Live refresh for the memory page on this port (the /stream monitor listens on 127.0.0.1 only).
+const { memoryEventsHandler } = await import('./memory-events.mjs');
+app.get('/api/memory-events', requireAuth, memoryEventsHandler(logEvents));
+
+// Keep the served dashboard as new as its sources. A missing or stale bundle is
+// rebuilt in the background while the current one keeps serving; express.static
+// resolves files per request, so the swapped-in build serves without a restart.
+// Building only when index.html was missing left every later frontend commit unserved.
+const { watchDashboardBundle } = await import('../core/dashboard-bundle.mjs');
+const dashboardBundle = watchDashboardBundle({
+  root: ROOT,
+  report: (state) => {
+    if (state.status === 'current' && state.rebuilt) {
+      logger.info('server', `Dashboard bundle rebuilt from newer sources (${Math.round(state.durationMs / 1000)} s); serving it now.`);
+    } else if (state.status === 'current') {
+      logger.info('server', 'Dashboard bundle is current.');
+    } else if (state.retryInMs) {
+      logger.info('server', `Dashboard bundle is ${state.status}; rebuilding once the sources stop changing.`);
+    } else {
+      logger.error('server', `Dashboard bundle is ${state.status} and was not rebuilt: ${state.reason}.${state.build?.output ? ` Build output: ${state.build.output.slice(-1500)}` : ''}`);
     }
-  }
-}
+  },
+});
+dashboardBundle.check();
 
 app.use(express.static(frontendDist));
 
@@ -803,8 +811,7 @@ app.get('/chat', (req, res) => {
 
 // SPA fallback — serve index.html for all unmatched routes
 app.get(/^(.*)$/, (req, res) => {
-  const indexPath = path.join(frontendDist, 'index.html');
-  res.sendFile(indexPath, (err) => {
+  res.sendFile('index.html', { root: frontendDist }, (err) => {
     if (err) {
       // Frontend not built yet — return a helpful message
       res.status(200).json({
@@ -814,7 +821,7 @@ app.get(/^(.*)$/, (req, res) => {
           memory: 'GET /api/memory',
           sandbox: 'POST /api/sandbox',
           health: 'GET /health',
-          dashboard: 'Build frontend first: cd frontend && npm run build'
+          dashboard: `Dashboard bundle is ${dashboardBundle.state().status}${dashboardBundle.state().reason ? `: ${dashboardBundle.state().reason}` : ''}. The server rebuilds it from frontend/ in the background.`
         }
       });
     }
@@ -874,7 +881,7 @@ const server = app.listen(PORT, HOST, () => {
 
   // Only meaningful once the socket is up: asking before the callback fires
   // reads an empty set, which is "unknown", so the watch never armed.
-  if (isReachableFromOtherDevices() === false) {
+  if (bindResolution.usedLoopbackFallback && isReachableFromOtherDevices() === false) {
     logger.warn(
       'server',
       `Bound to loopback only — no other device can reach this brain at :${PORT}. `

package/src/server/invoke-core-child.mjs

@@ -0,0 +1,24 @@
+/** Full-mode owner work shares invoke's process-group and output limits. */
+import path from 'node:path';
+console.log = console.info = console.debug = (...args) => console.error(...args);
+
+try {
+  let input = '';
+  for await (const chunk of process.stdin) {
+    input += chunk;
+    if (Buffer.byteLength(input) > 32768) throw new Error('Input limit');
+  }
+  const { operation, params, brain, registryBrain } = JSON.parse(input);
+  // Config and Auth must use the serving brain, not a brain inferred from cwd.
+  process.env.AGENT_DIR = path.dirname(path.dirname(brain));
+  process.env.TR_SECRETS_BRAIN = brain;
+  const { executeCoreOperation } = await import('./invoke-core-operations.mjs');
+  const result = await executeCoreOperation(operation, params, { brain, registryBrain });
+  process.stdout.write(JSON.stringify({ ok: true, result }));
+} catch (err) {
+  // Return curated policy codes only. Never return owner exception text.
+  const { InvokeError } = await import('./invoke-execution.mjs');
+  process.stdout.write(JSON.stringify({ ok: false, error: err instanceof InvokeError ? err.code : 'operation-failed',
+    status: err instanceof InvokeError ? err.status : 502 }));
+  process.exitCode = 1;
+}

package/src/server/invoke-core-operations.mjs

@@ -0,0 +1,102 @@
+/** Owner adapters for the retired one-off remote routes. */
+import fs from 'node:fs';
+import path from 'node:path';
+import matter from '../core/frontmatter.mjs';
+import { readRegisteredProjects } from '../core/brain-registry.mjs';
+import { InvokeError } from './invoke-execution.mjs';
+
+export const CORE_OPERATIONS = Object.freeze({
+  'context.preview': { scope: 'memory:read', family: 'context' },
+  'context.stream': { scope: 'memory:read', family: 'context' },
+  'context.flash.health': { scope: 'memory:read', family: 'context' },
+  'brains.sync': { scope: 'memory:write', family: 'brains' },
+  'tasks.cleanup': { scope: 'tasks:write', family: 'tasks' },
+  'tasks.failed': { scope: 'tasks:read', family: 'tasks' },
+  'vault.hash': { scope: 'memory:read', family: 'vault' },
+});
+
+export function validateCoreParams(operation, params) {
+  if (params.timeoutMs !== undefined && (!Number.isFinite(Number(params.timeoutMs)) || Number(params.timeoutMs) <= 0)) {
+    throw new InvokeError(400, 'invalid-timeout', 'timeoutMs must be positive and finite.');
+  }
+  const allowed = new Set(['target', 'timeoutMs']);
+  if (!['brains.sync', 'context.flash.health'].includes(operation)) allowed.add('brainId');
+  if (operation === 'context.stream') for (const key of ['query', 'budget_tokens', 'concurrency', 'min_score']) allowed.add(key);
+  if (Object.keys(params).some(key => !allowed.has(key))) throw new InvokeError(400, 'unknown-parameter', 'Unsupported operation parameter.');
+  if (params.brainId !== undefined && (typeof params.brainId !== 'string' || !params.brainId || params.brainId.includes(','))) {
+    throw new InvokeError(400, 'invalid-brain', 'brainId must select one brain.');
+  }
+  if (params.brainId !== undefined && !['server', 'global'].includes(params.brainId) &&
+    !/^project:[^/\\\0,]+$/.test(params.brainId)) {
+    throw new InvokeError(400, 'invalid-brain', 'brainId must select the server or a registered project.');
+  }
+  if (operation === 'context.stream') {
+    if (typeof params.query !== 'string' || !params.query.trim()) throw new InvokeError(400, 'invalid-query', 'query is required.');
+    for (const [key, min, max] of [['budget_tokens', 1, 65536], ['concurrency', 1, 4], ['min_score', 0, 100]]) {
+      if (params[key] !== undefined && (!Number.isInteger(params[key]) || params[key] < min || params[key] > max)) {
+        throw new InvokeError(400, 'invalid-parameter', `Invalid ${key}.`);
+      }
+    }
+  }
+}
+
+function selectedBrain(brainId, brain, registryBrain) {
+  if (brainId === undefined || brainId === 'server' || brainId === 'global') return brain;
+  if (brainId.startsWith('project:')) {
+    const name = brainId.slice('project:'.length);
+    const project = readRegisteredProjects(registryBrain).find(row => row.name === name || row.project_id === name);
+    if (project?.brainDir && fs.existsSync(path.join(project.brainDir, 'memory-vault'))) return project.brainDir;
+  }
+  throw new InvokeError(404, 'brain-unavailable', 'Selected brain is unavailable.');
+}
+
+export async function executeCoreOperation(operation, params, { brain, registryBrain }) {
+  if (!Object.hasOwn(CORE_OPERATIONS, operation)) throw new InvokeError(404, 'unknown-operation', 'Unknown operation.');
+  validateCoreParams(operation, params);
+  const selected = selectedBrain(params.brainId, brain, registryBrain);
+  const vaultDir = path.join(selected, 'memory-vault');
+  switch (operation) {
+    case 'context.preview': {
+      const { previewContext } = await import('../core/context-compiler.mjs');
+      return previewContext({ vaultDir });
+    }
+    case 'context.stream': {
+      const { streamParallelContext } = await import('../core/parallel-context.mjs');
+      const result = await streamParallelContext({ query: params.query, vaultDir,
+        budgetTokens: params.budget_tokens, concurrency: params.concurrency, minScore: params.min_score });
+      // Provider diagnostics can contain a credential-bearing URL.
+      return { ...result, scored: result.scored.map(({ error, ...row }) => error ? { ...row, error: 'provider-failed' } : row) };
+    }
+    case 'context.flash.health': {
+      const { checkFlashHealth } = await import('../core/parallel-context.mjs');
+      const { error, ...result } = await checkFlashHealth();
+      return error ? { ...result, error: 'provider-unavailable' } : result;
+    }
+    case 'brains.sync': {
+      const { syncAllRepos } = await import('../core/repo-sync.mjs');
+      const result = await syncAllRepos({ registryBrain });
+      if (result.repos.some(row => row.errors)) throw new InvokeError(502, 'sync-failed', 'Some repositories failed to sync.');
+      return { ok: true, ...result };
+    }
+    case 'tasks.cleanup': {
+      const queue = path.join(selected, 'scheduler/queue');
+      let deleted = 0;
+      if (fs.existsSync(queue)) for (const entry of fs.readdirSync(queue, { withFileTypes: true })) {
+        if (!entry.isFile() || !entry.name.endsWith('.md')) continue;
+        const file = path.join(queue, entry.name);
+        const { data } = matter(fs.readFileSync(file, 'utf8'));
+        if (data.status === 'completed') { fs.unlinkSync(file); deleted++; }
+      }
+      return { deleted };
+    }
+    case 'tasks.failed': {
+      const { listTasks } = await import('../core/task-envelope.mjs');
+      const tasks = listTasks(path.join(selected, 'scheduler/queue'), { status: 'failed' });
+      return { total: tasks.length, tasks };
+    }
+    case 'vault.hash': {
+      const file = path.join(selected, 'memory-derived/vault-hash.txt');
+      return { vault_hash: fs.existsSync(file) ? fs.readFileSync(file, 'utf8').trim() : null, vault_dir: vaultDir };
+    }
+  }
+}

package/src/server/memory-events.mjs

@@ -0,0 +1,31 @@
+/**
+ * Live refresh for the memory page, on the dashboard's own port.
+ *
+ * The page listened to `/stream` on the dashboard origin, but the server
+ * serves `/stream` only on the 127.0.0.1 monitor port, so the dashboard got
+ * its HTML fallback and the live refresh never connected. This stream is
+ * authenticated like the rest of the dashboard API and carries only the
+ * subsystem name of the events that change what the page shows, never log
+ * contents.
+ */
+export const MEMORY_EVENT_SUBSYSTEMS = new Set(['conflict-detector', 'rebuild', 'session-watcher']);
+const HEARTBEAT_MS = 25000;
+
+/** @param {import('node:events').EventEmitter} events Emits 'log' entries ({ subsystem, ... }). */
+export function memoryEventsHandler(events, { heartbeatMs = HEARTBEAT_MS } = {}) {
+  return (req, res) => {
+    res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
+    res.write(': connected\n\n');
+    const onLog = (entry) => {
+      if (MEMORY_EVENT_SUBSYSTEMS.has(entry?.subsystem)) res.write(`data: ${JSON.stringify({ subsystem: entry.subsystem })}\n\n`);
+    };
+    events.on('log', onLog);
+    // Comment lines keep proxies from closing an idle stream.
+    const heartbeat = setInterval(() => res.write(': ping\n\n'), heartbeatMs);
+    heartbeat.unref?.();
+    req.on('close', () => {
+      events.off('log', onLog);
+      clearInterval(heartbeat);
+    });
+  };
+}

package/src/server/plugin-brain-targets.mjs

@@ -0,0 +1,89 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { dashboardBrainDir, globalBrainDirFor, readBrainToggles, readRegisteredProjects } from '../core/brain-registry.mjs';
+import { projectPluginsDir } from '../core/plugin-loader.mjs';
+import { readProjectId } from '../core/project-id.mjs';
+import { keyHasScope } from './keys.mjs';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const PROJECT_SELECTOR = /^project:[^/\\:,\x00-\x1f\x7f]{1,160}$/u;
+
+const targetError = (status, message) => Object.assign(new Error(message), { status });
+
+function optionalDirectoriesAreLocal(brainDir) {
+  for (const name of ['plugins', 'memory-vault', 'memory-derived']) {
+    try {
+      if (!fs.lstatSync(path.join(brainDir, name)).isDirectory()) return false;
+    } catch (error) {
+      if (error.code !== 'ENOENT') return false;
+    }
+  }
+  return true;
+}
+
+function resolveProject(row, sharedBrain, toggles) {
+  try {
+    if (typeof row.path !== 'string' || !path.isAbsolute(row.path) ||
+        typeof row.brainDir !== 'string' || !path.isAbsolute(row.brainDir)) return null;
+    const projectRoot = fs.realpathSync(row.path);
+    const brainDir = path.dirname(projectPluginsDir(projectRoot));
+    const identity = path.join(brainDir, 'config', 'brain.json');
+    if (brainDir === sharedBrain || fs.realpathSync(row.brainDir) !== brainDir ||
+        fs.realpathSync(brainDir) !== brainDir || fs.realpathSync(identity) !== identity ||
+        !fs.lstatSync(identity).isFile() || readProjectId(brainDir) !== row.project_id ||
+        toggles[path.resolve(row.brainDir)] === false || toggles[brainDir] === false ||
+        !optionalDirectoriesAreLocal(brainDir)) return null;
+    return { brainDir, projectRoot };
+  } catch {
+    return null;
+  }
+}
+
+function authorize(auth, scope) {
+  if (auth?.type === 'dashboard_session') return;
+  if (auth?.type !== 'pat' || !keyHasScope(auth, scope)) {
+    throw targetError(403, 'The token does not grant access to a selected brain.');
+  }
+}
+
+/** Resolve selected IDs against server-owned registrations before plugin I/O. */
+export function resolvePluginBrainTargets(ids, auth, { registryBrain = globalBrainDirFor() } = {}) {
+  if (!Array.isArray(ids) || !ids.length || ids.length > 64 ||
+      ids.some(id => typeof id !== 'string' || (id !== 'global' && !PROJECT_SELECTOR.test(id)))) {
+    throw targetError(400, 'Select up to 64 global or registered project brain IDs.');
+  }
+  let sharedBrain, rows, toggles, globalToggles;
+  try {
+    const projectRegistryBrain = dashboardBrainDir(process.env, registryBrain);
+    sharedBrain = fs.realpathSync(registryBrain);
+    globalToggles = ids.includes('global') ? readBrainToggles(registryBrain, { strict: true }) : {};
+    const needsProjects = ids.some(id => id !== 'global');
+    toggles = needsProjects ? readBrainToggles(projectRegistryBrain, { strict: true }) : {};
+    rows = needsProjects ? readRegisteredProjects(projectRegistryBrain) : [];
+  } catch {
+    throw targetError(503, 'Brain registry metadata is unavailable.');
+  }
+  const resolved = new Set();
+  return [...new Set(ids)].map(brainId => {
+    if (brainId === 'global') {
+      authorize(auth, 'brain:global');
+      if (globalToggles[path.resolve(registryBrain)] === false || globalToggles[sharedBrain] === false) {
+        throw targetError(404, 'The selected global brain is unavailable.');
+      }
+      return { brainId, name: 'Global Brain', brainDir: sharedBrain, projectRoot: null };
+    }
+    const selector = brainId.slice('project:'.length);
+    const matches = rows.filter(row => row.name === selector || row.project_id === selector);
+    if (matches.length > 1) throw targetError(409, 'A selected project brain ID is ambiguous.');
+    const row = matches[0];
+    if (typeof row?.project_id !== 'string' || !UUID.test(row.project_id) || rows.filter(candidate => candidate.project_id === row.project_id).length !== 1) {
+      throw targetError(404, 'A selected project brain is unavailable.');
+    }
+    authorize(auth, 'brain:project-' + row.project_id);
+    const target = resolveProject(row, sharedBrain, toggles);
+    if (!target) throw targetError(404, 'A selected project brain is unavailable.');
+    if (resolved.has(target.brainDir)) throw targetError(400, 'Select each project brain once.');
+    resolved.add(target.brainDir);
+    return { brainId, name: row.name || selector, ...target };
+  });
+}

package/src/server/rest.mjs

@@ -121,6 +121,7 @@ import updateRouter       from './routes/update.mjs';
 import { rulesRouter }    from './routes/rules.mjs';
 import notificationsRouter from './routes/notifications.mjs';
 import pluginsRouter      from './routes/plugins.mjs';
+import uiChunksRouter     from './routes/ui-chunks.mjs';
 // ollamaUrl removed — CLI agents replace Ollama
 import {
   AGENT_DIR,
@@ -235,6 +236,7 @@ router.use(ssssRouter);
 router.use(rulesRouter);
 router.use(notificationsRouter);
 router.use(pluginsRouter);
+router.use(uiChunksRouter);
 for (const pluginRouter of await (await import('../core/plugin-runtime.mjs')).loadPluginRouters()) router.use(pluginRouter);
 
 export { router as restRouter };

package/src/server/route-inventory.mjs

@@ -29,13 +29,14 @@ export function extractRoutes(router) {
 
     for (const layer of stack) {
       if (layer.route) {
-        const pathStr = layer.route.path;
+        // Express keeps aliases and regular expressions in Route.path.
+        const paths = [layer.route.path].flat(Infinity).map(String);
         const methods = Object.keys(layer.route.methods)
           .filter((method) => layer.route.methods[method])
           .map((method) => method.toUpperCase());
 
         for (const method of methods) {
-          routes.push({ method, path: pathStr });
+          for (const path of paths) routes.push({ method, path });
         }
       } else if (layer.name === 'router' && layer.handle && layer.handle.stack) {
         // Sub-router mounted via router.use()