total-recall-brain 3.44.0 → 3.46.0

package/src/server/routes/plugins.mjs

@@ -3,7 +3,8 @@ import fs from "node:fs";
 import path from "node:path";
 import matter from "../../core/frontmatter.mjs";
 import { requireAuth, requireScope } from "../auth.mjs";
-import { getPluginById } from "../../core/plugin-loader.mjs";
+import { resolvePluginBrainTargets } from '../plugin-brain-targets.mjs';
+import { discoverPlugins, getPluginById } from "../../core/plugin-loader.mjs";
 import {
   listInstalledPlugins,
   listAvailableBundled,
@@ -18,20 +19,25 @@ import {
 import { listPeerPlugins } from "../../core/plugin-peers.mjs";
 import { runPluginCommand, validatePluginSecretInput } from "../../core/plugin-runner.mjs";
 import { readPluginRecord, patchPluginRecord, emit, vaultFor } from '../../core/plugin-store.mjs';
-import { setPluginActive } from '../../core/plugin-activation.mjs';
+import { activatePluginOnUse, setPluginActive } from '../../core/plugin-activation.mjs';
 import { pluginActivation } from '../../core/plugin-state.mjs';
+import { REQUIRED_INSTALLATION_PLUGIN_IDS } from '../../core/default-plugins.mjs';
 import { configurationValues } from '../../core/plugin-contracts/configuration.mjs';
 import { writeNodeValidatedAsync } from "../../core/validated-write.mjs";
 import { walkMd } from "../../core/vault.mjs";
 import { serverError, badRequest, VAULT_DIR, BRAIN_DIR, globalBrainDir, sanitizeNode } from "./_shared.mjs";
 
 const router = Router();
+let activationTail = Promise.resolve();
 
-// Plugins always resolve against the server's own project. Routes used to take
-// a caller-supplied `root`, which let a request point discovery — and the
-// runner — at any directory on disk.
+// Omitted selectors use the serving project. Explicit selectors resolve only
+// through registered brains, without accepting host paths from a request.
 const projectRoot = () => process.cwd();
 
+function surfaceTarget(req, id) {
+  return id === undefined ? { brainDir: BRAIN_DIR, projectRoot: projectRoot() } : resolvePluginBrainTargets([id], req.auth)[0];
+}
+
 router.get('/api/plugins/execution-targets', requireAuth, requireScope('config:read'), async (req, res) => {
   try {
     const { loadPluginModule } = await import('../../core/plugin-runtime.mjs');
@@ -43,19 +49,81 @@ router.get('/api/plugins/execution-targets', requireAuth, requireScope('config:r
 
 router.put('/api/plugins/:id/activation', requireAuth, requireScope('config:write'), async (req, res) => {
   try {
-    const result = await setPluginActive(req.params.id, req.body?.enabled, { projectRoot: projectRoot() });
-    res.status(result.compilation.ok ? 200 : 500).json({ success: result.compilation.ok, ...result });
-  } catch (err) { badRequest(res, err.message); }
+    const { enabled, brainIds, mode } = req.body || {};
+    if (req.query.brain !== undefined || req.body?.brainId !== undefined) {
+      return badRequest(res, 'Use the brainIds array to target plugin activation.');
+    }
+    if (mode === undefined && typeof enabled !== 'boolean') return badRequest(res, 'Plugin activation requires a boolean');
+    if (mode !== undefined && (enabled !== undefined || !['on-use', 'use'].includes(mode) ||
+        !Array.isArray(brainIds) || (mode === 'use' && brainIds.length !== 1))) {
+      return badRequest(res, 'On use requires project brain IDs. Opening a plugin requires one project brain ID.');
+    }
+    // Global changes rebuild project surfaces too, so serialize writes and rebuilds together.
+    const change = activationTail.then(async () => {
+      if (brainIds === undefined) {
+        const result = await setPluginActive(req.params.id, enabled, { projectRoot: projectRoot() });
+        const cleanup = reportedCleanup(result);
+        const success = result.compilation.ok && cleanup?.ok !== false;
+        return { status: success ? 200 : 500, body: { ...result, success, cleanup, ...(cleanup?.error ? { error: cleanup.error } : {}) } };
+      }
+      const targets = resolvePluginBrainTargets(brainIds, req.auth);
+      if (mode && targets.some(target => target.projectRoot === null)) {
+        return { status: 400, body: { error: 'On use is available for individual project brains.' } };
+      }
+      const results = [];
+      for (const target of targets) {
+        results.push(await updateSelectedPluginActivation(req.params.id, enabled, mode, target));
+      }
+      return { status: 200, body: { success: results.every(result => result.success), results } };
+    });
+    activationTail = change.catch(() => {});
+    const { status, body } = await change;
+    res.status(status).json(body);
+  } catch (err) { res.status(err.status || 400).json({ error: err.message }); }
 });
 
+function reportedCleanup(result) {
+  if (!result.cleanup) return undefined;
+  const { ok, state } = result.cleanup;
+  return { ok, state, ...(ok ? {} : { error: 'The plugin is off, but cleanup did not finish. Retry cleanup.' }) };
+}
+
+async function updateSelectedPluginActivation(id, enabled, mode, { brainId, name, projectRoot }) {
+  const identity = { brainId, name };
+  const failure = error => ({ ...identity, success: false, error });
+  try {
+    const plugin = getPluginById(id, projectRoot);
+    if (!plugin?.valid) return failure('Plugin is unavailable in this brain.');
+    if ((enabled === false || mode === 'on-use') && REQUIRED_INSTALLATION_PLUGIN_IDS.includes(id)) {
+      return failure('Required plugins cannot be disabled.');
+    }
+    const result = mode === 'use'
+      ? await activatePluginOnUse(id, { projectRoot })
+      : await setPluginActive(id, mode ?? enabled, { projectRoot, scope: projectRoot === null ? 'shared' : 'project' });
+    if (!result) {
+      const activation = pluginActivation(plugin, { projectRoot });
+      return activation.enabled ? { ...identity, success: true, activation } : failure('This plugin is not set to open on use.');
+    }
+    if (mode === 'use' && !result.activation.enabled) return failure('The plugin was switched off before it could open.');
+    const cleanup = reportedCleanup(result);
+    const error = cleanup?.error || (result.compilation.ok ? undefined : 'Activation was saved, but the workspace could not be rebuilt.');
+    return { ...identity, success: !error, activation: result.activation, cleanup, error };
+  } catch {
+    return failure('Could not complete activation in this brain.');
+  }
+}
+
 router.post('/api/plugins/:id/credentials', requireAuth, requireScope('config:write'), async (req, res) => {
+  let target;
+  try { target = surfaceTarget(req, req.query.brain); }
+  catch (error) { return res.status(error.status || 400).json({ error: 'Could not select the credential workspace.' }); }
   try {
-    const plugin = getPluginById(req.params.id, projectRoot());
+    const plugin = getPluginById(req.params.id, target.projectRoot);
     if (!plugin) return res.status(404).json({ error: 'Plugin not installed' });
     const { key, value } = req.body || {};
     if (typeof key !== 'string' || typeof value !== 'string' || value.length > 16384 || !plugin.manifest.secrets?.some(secret => secret.key === key)) return badRequest(res, 'Invalid declared credential');
     const { loadPluginModule } = await import('../../core/plugin-runtime.mjs');
-    const owner = await loadPluginModule(plugin.id, 'credentials');
+    const owner = await loadPluginModule(plugin.id, 'credentials', { projectRoot: target.projectRoot });
     const result = await owner.saveCredential({ key, value, configuration: readPluginRecord(plugin)?.configuration || {}, brainDir: process.env.TR_SECRETS_BRAIN || globalBrainDir || BRAIN_DIR });
     res.json(result);
   } catch (error) {
@@ -86,15 +154,21 @@ router.put('/api/plugins/:id/configuration', requireAuth, requireScope('config:w
 /** Serve only modules declared by an installed plugin's UI manifest. */
 router.get('/api/plugins/:id/ui/:element', requireAuth, requireScope('config:read'), (req, res) => {
   try {
-    const plugin = getPluginById(req.params.id, projectRoot());
-    if (!plugin?.valid) return res.status(404).json({ error: 'Plugin unavailable' });
+    const target = surfaceTarget(req, req.query.brain);
+    const plugin = getPluginById(req.params.id, target.projectRoot);
+    if (!plugin?.valid || (req.query.brain !== undefined && !pluginActivation(plugin, target).enabled)) {
+      return res.status(404).json({ error: 'Plugin unavailable' });
+    }
     const element = plugin.manifest?.ui?.elements?.find((item) => item.id === req.params.element);
     if (!element) return res.status(404).json({ error: 'UI element unavailable' });
     const root = fs.realpathSync(plugin.dir);
     const file = fs.realpathSync(path.resolve(root, element.module));
     if (!file.startsWith(root + path.sep)) return res.status(400).json({ error: 'Invalid UI module path' });
     res.type('text/javascript').set('X-Content-Type-Options', 'nosniff').send(fs.readFileSync(file, 'utf8'));
-  } catch (err) { serverError(res, err); }
+  } catch (err) {
+    if ([400, 403, 404, 409, 503].includes(err.status)) return res.status(err.status).json({ error: err.message });
+    serverError(res, err);
+  }
 });
 
 /** Serve only the logo a plugin declares in branding.logo, never an arbitrary file. */
@@ -121,15 +195,45 @@ router.get('/api/plugins/:id/logo', requireAuth, requireScope('config:read'), (r
  * Installed plugins (project + global): manifest facts, provenance, content
  * hash, sharing state and scheduled-task history. Nothing else.
  */
-router.get("/api/plugins", requireAuth, requireScope("config:read"), (_req, res) => {
+router.get("/api/plugins", requireAuth, requireScope("config:read"), (req, res) => {
   try {
-    const plugins = listInstalledPlugins(projectRoot());
+    const selection = req.query.brain;
+    if (selection !== undefined && typeof selection !== 'string') return badRequest(res, 'Use one comma-separated brain selector.');
+    const plugins = selection === undefined
+      ? listInstalledPlugins(projectRoot())
+      : selectedPluginInventory(resolvePluginBrainTargets(selection.split(','), req.auth));
     res.json({ success: true, count: plugins.length, plugins });
   } catch (err) {
+    if (err.status) return res.status(err.status).json({ error: err.message });
     serverError(res, err);
   }
 });
 
+function selectedPluginInventory(targets) {
+  const descriptions = new Map();
+  const serving = new Map(discoverPlugins(projectRoot()).map(plugin => [plugin.id, plugin]));
+  const catalogs = targets.map(target => new Map(
+    listInstalledPlugins(target.projectRoot, { descriptions }).map(plugin => [plugin.id, plugin]),
+  ));
+  const ids = new Set(catalogs.flatMap(catalog => [...catalog.keys()]));
+  return [...ids].map(id => {
+    const entries = catalogs.map(catalog => catalog.get(id));
+    const representative = entries.find(plugin => plugin?.valid) || entries.find(Boolean);
+    const activationByBrain = entries.map((plugin, index) => {
+      const { brainId, name } = targets[index];
+      const state = !plugin ? 'unavailable' : !plugin.valid ? 'error' : (plugin.activation?.state || 'error');
+      const mode = state === 'inactive' && plugin.activation?.mode;
+      return { brainId, name, state, enabled: state === 'active', required: !!plugin?.activation?.required, ...(mode ? { mode } : {}) };
+    });
+    const first = activationByBrain[0];
+    const state = activationByBrain.every(item => item.state === first.state && item.mode === first.mode) ? first.state : 'mixed';
+    const activation = { state, enabled: state === 'active', required: activationByBrain.some(item => item.required),
+      ...(state !== 'mixed' && first.mode ? { mode: first.mode } : {}) };
+    return { ...representative, activation, activationByBrain,
+      servingAvailable: Boolean(serving.get(id) && serving.get(id).dir === representative.dir) };
+  });
+}
+
 /**
  * GET /api/plugins/available
  * Plugins bundled with this Total Recall package, installable on any node.
@@ -277,28 +381,7 @@ router.get("/api/plugins/:id", requireAuth, requireScope("config:read"), (req, r
   try {
     const plugin = getPluginById(req.params.id, projectRoot());
     if (!plugin) return res.status(404).json({ success: false, error: `Plugin ${req.params.id} not found` });
-    res.json({ success: true, plugin: { ...describePlugin(plugin), manifest: plugin.manifest } });
-  } catch (err) {
-    serverError(res, err);
-  }
-});
-
-/**
- * PATCH /api/plugins/:id/card-face
- * Customizes card face skin, theme, colors, headline, quick actions, and metrics.
- */
-router.patch("/api/plugins/:id/card-face", requireAuth, requireScope("config:write"), (req, res) => {
-  try {
-    const plugin = getPluginById(req.params.id, projectRoot());
-    if (!plugin) return res.status(404).json({ success: false, error: `Plugin ${req.params.id} not found` });
-    const manifestPath = path.join(plugin.dir, "plugin.json");
-    if (!fs.existsSync(manifestPath)) return res.status(404).json({ success: false, error: "Manifest not found" });
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-    const { card_face = {}, branding = {} } = req.body || {};
-    manifest.card_face = { ...(manifest.card_face || {}), ...card_face };
-    manifest.branding = { ...(manifest.branding || {}), ...branding };
-    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
-    res.json({ success: true, card_face: manifest.card_face, branding: manifest.branding });
+    res.json({ success: true, plugin: { ...describePlugin(plugin, projectRoot()), manifest: plugin.manifest } });
   } catch (err) {
     serverError(res, err);
   }
@@ -312,16 +395,37 @@ router.patch("/api/plugins/:id/card-face", requireAuth, requireScope("config:wri
  * write-level regardless of that declaration.
  */
 router.post("/api/plugins/:id/run", requireAuth, (req, res, next) => {
-  const { subcommand, args = [], stdin, execution } = req.body || {};
+  const { subcommand, args = [], stdin, execution, brainId } = req.body || {};
   try {
-    const plugin = getPluginById(req.params.id, projectRoot());
-    const operation = plugin?.valid && plugin.manifest?.cli?.subcommands?.find(item => item.name === subcommand);
+    const target = surfaceTarget(req, brainId);
+    const plugin = getPluginById(req.params.id, target.projectRoot);
+    if (brainId !== undefined && execution) {
+      return res.status(400).json({ success: false, error: 'Use the selected brain with local plugin execution.' });
+    }
+    if (brainId !== undefined && ['on', 'off'].includes(subcommand || args?.[0])) {
+      return res.status(400).json({ success: false, error: 'Use the selected brain activation control.' });
+    }
+    const declared = plugin?.valid ? plugin.manifest?.cli?.subcommands || [] : [];
+    const operation = declared.find(item => item.name === subcommand);
+    const activation = ['on', 'off'].includes(subcommand) && Array.isArray(args) && !args.length && stdin === undefined && !execution;
+    const browserBlocked = item => item.sensitive_output === true || item.terminal_only === true;
+    if (operation ? browserBlocked(operation) : !activation && declared.some(browserBlocked)) {
+      return res.status(403).json({ success: false, error: 'Use the owning CLI or account controls for this operation.' });
+    }
+    const terminalFlags = new Set((operation ? [operation] : declared).flatMap(item => item.terminal_only_args ?? []));
+    if (Array.isArray(args) && args.some(arg => typeof arg === 'string' && terminalFlags.has(arg.split('=', 1)[0]))) {
+      return res.status(403).json({ success: false, error: 'Use the owning CLI for terminal-only arguments.' });
+    }
     res.locals.executionPlugin = plugin;
+    res.locals.executionTarget = target;
     const read = typeof subcommand === 'string' && Array.isArray(args) && args.every(arg => typeof arg === 'string') &&
       operation?.effect === 'read' && stdin === undefined && !execution &&
       !operation.args?.some(arg => arg.secret);
     return requireScope(read ? 'config:read' : 'config:write')(req, res, next);
-  } catch (error) { badRequest(res, error.message); }
+  } catch (error) {
+    if ([400, 403, 404, 409, 503].includes(error.status)) return res.status(error.status).json({ error: error.message });
+    badRequest(res, error.message);
+  }
 }, async (req, res) => {
   try {
     const { subcommand = "", args = [], stdin, execution } = req.body || {};
@@ -329,21 +433,26 @@ router.post("/api/plugins/:id/run", requireAuth, (req, res, next) => {
       return badRequest(res, "subcommand must be a string and args an array of strings");
     }
     const plugin = res.locals.executionPlugin;
+    const target = res.locals.executionTarget;
+    const cwd = target.projectRoot ?? target.brainDir;
     if (!plugin) return res.status(404).json({ success: false, error: `Plugin ${req.params.id} not found` });
     if (!plugin.valid) return badRequest(res, `Plugin ${plugin.id} has an invalid manifest: ${plugin.errors.join("; ")}`);
     if (!plugin.manifest?.cli?.handler) return badRequest(res, `Plugin ${plugin.id} does not declare a CLI handler`);
+    if (req.body?.brainId !== undefined && !pluginActivation(plugin, target).enabled) {
+      return res.status(403).json({ success: false, error: 'Plugin is off in the selected brain.' });
+    }
     validatePluginSecretInput(plugin, subcommand, stdin);
 
     if (execution) {
       if (stdin !== undefined) return badRequest(res, 'Credential operations require direct local execution');
-      if (!pluginActivation(plugin, { projectRoot: projectRoot() }).enabled && !['on', 'off', 'status', 'health', 'jobs', '--help', 'help'].includes(subcommand)) return badRequest(res, `Plugin ${plugin.id} is inactive`);
+      if (!pluginActivation(plugin, target).enabled && !['on', 'off', 'status', 'health', 'jobs', '--help', 'help'].includes(subcommand)) return badRequest(res, `Plugin ${plugin.id} is inactive`);
       const { loadPluginModule } = await import('../../core/plugin-runtime.mjs');
-      const owner = await loadPluginModule('meta-harness', 'command-executor', { activeRequired: true });
-      const result = await owner.executeCommand({ plugin, subcommand, args, execution, projectRoot: projectRoot() });
+      const owner = await loadPluginModule('meta-harness', 'command-executor', { activeRequired: true, projectRoot: target.projectRoot });
+      const result = await owner.executeCommand({ plugin, subcommand, args, execution, projectRoot: cwd });
       return res.json({ success: result.ok, pluginId: plugin.id, ...result });
     }
 
-    const result = await runPluginCommand(plugin, { subcommand, args, ...(stdin !== undefined ? { stdinText: stdin } : {}), cwd: projectRoot(), secretsBrainDir: process.env.TR_SECRETS_BRAIN || globalBrainDir || BRAIN_DIR, maxOutputBytes: 4 * 1024 * 1024 });
+    const result = await runPluginCommand(plugin, { subcommand, args, ...(stdin !== undefined ? { stdinText: stdin } : {}), cwd, projectRoot: target.projectRoot, secretsBrainDir: process.env.TR_SECRETS_BRAIN || globalBrainDir || BRAIN_DIR, maxOutputBytes: 4 * 1024 * 1024 });
     res.json({ success: result.ok, pluginId: plugin.id, ...result });
   } catch (err) {
     badRequest(res, err.message);

package/src/server/routes/ssss.mjs

@@ -3,184 +3,15 @@
  * Extracted from rest.mjs
  */
 import { Router } from 'express';
-import fs from 'node:fs';
-import path from 'node:path';
-import crypto from 'node:crypto';
 import { requireAuth, requireScope } from '../auth.mjs';
 import { processOperationAsync } from '../../core/operation-validator.mjs';
 import { invalidate } from '../../core/vault-cache.mjs';
 import {
-  ROOT,
-  INSTRUCTIONS,
-  SKILLS_DIR,
   resolveVaultFromQuery,
 } from './_shared.mjs';
 
 const router = Router();
 
-// ─── SSSS Resources (sync and integration consumers) ─────────────────────────
-
-function sha256(content) {
-  return crypto.createHash('sha256').update(content).digest('hex');
-}
-
-function readTextResource(filePath, name) {
-  if (!fs.existsSync(filePath)) return null;
-  const content = fs.readFileSync(filePath, 'utf8');
-  const stat = fs.statSync(filePath);
-  return {
-    name,
-    content,
-    sha256: sha256(content),
-    bytes: stat.size,
-    modified: stat.mtime.toISOString()
-  };
-}
-
-function sendTextResource(res, filePath, name) {
-  const resource = readTextResource(filePath, name);
-  if (!resource) {
-    return res.status(404).json({ error: `${name} is not available` });
-  }
-  return res.json(resource);
-}
-
-function baseUrl(req) {
-  return `${req.protocol}://${req.get('host')}`;
-}
-
-function absoluteUrl(req, routePath) {
-  return new URL(routePath, baseUrl(req)).toString();
-}
-
-function ssssReferenceDir() {
-  // Prefer compact TR references; fall back to legacy nested module paths.
-  const candidates = [
-    path.join(SKILLS_DIR, 'total-recall', 'references'),
-    path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'references'),
-    path.join(SKILLS_DIR, 'okf', 'references'),
-  ];
-  return candidates.find((p) => fs.existsSync(p)) || candidates[0];
-}
-
-function ssssSkillDocPath() {
-  const candidates = [
-    path.join(SKILLS_DIR, 'total-recall', 'references', 'ssss-reference.md'),
-    path.join(SKILLS_DIR, 'total-recall', 'SKILL.md'),
-    path.join(SKILLS_DIR, 'total-recall', 'modules', 'ssss', 'MODULE.md'),
-    path.join(SKILLS_DIR, 'okf', 'SKILL.md'),
-  ];
-  return candidates.find((p) => fs.existsSync(p)) || candidates[0];
-}
-
-function listSsssReferences(req) {
-  const refsDir = ssssReferenceDir();
-  if (!fs.existsSync(refsDir)) return [];
-  return fs.readdirSync(refsDir)
-    .filter(file => file.endsWith('.md'))
-    .sort()
-    .map((file) => {
-      const name = file.replace(/\.md$/, '');
-      const resource = readTextResource(path.join(refsDir, file), name);
-      return {
-        name,
-        url: absoluteUrl(req, `/api/ssss/references/${name}`),
-        sha256: resource?.sha256 || null,
-        bytes: resource?.bytes || 0,
-        modified: resource?.modified || null
-      };
-    });
-}
-
-function safeReferencePath(name) {
-  if (!/^[a-zA-Z0-9_-]+$/.test(String(name || ''))) return null;
-  return path.join(ssssReferenceDir(), `${name}.md`);
-}
-
-router.get('/api/ssss', requireAuth, requireScope('ssss:read'), (req, res) => {
-  const resources = {
-    instructions: {
-      name: 'instructions',
-      url: absoluteUrl(req, '/api/ssss/instructions'),
-      ...(() => {
-        const r = readTextResource(INSTRUCTIONS, 'instructions');
-        return r ? { sha256: r.sha256, bytes: r.bytes, modified: r.modified } : { sha256: null, bytes: 0, modified: null };
-      })()
-    },
-    skill: {
-      name: 'ssss-skill',
-      url: absoluteUrl(req, '/api/ssss/skill/ssss'),
-      ...(() => {
-        const r = readTextResource(ssssSkillDocPath(), 'ssss-skill');
-        return r ? { sha256: r.sha256, bytes: r.bytes, modified: r.modified } : { sha256: null, bytes: 0, modified: null };
-      })()
-    },
-    spec: {
-      name: 'ssss-spec',
-      url: absoluteUrl(req, '/api/ssss/spec'),
-      ...(() => {
-        const refs = ssssReferenceDir();
-        const specPath = ['ssss-reference.md', 'ssss-spec.md']
-          .map((n) => path.join(refs, n))
-          .find((p) => fs.existsSync(p));
-        const r = specPath ? readTextResource(specPath, 'ssss-spec') : null;
-        return r ? { sha256: r.sha256, bytes: r.bytes, modified: r.modified } : { sha256: null, bytes: 0, modified: null };
-      })()
-    },
-    references: listSsssReferences(req)
-  };
-
-  res.json({
-    name: 'ssss',
-    schema_version: 2,
-    resources
-  });
-});
-
-router.get('/api/ssss/instructions', requireAuth, requireScope('ssss:read', 'instructions:read'), (req, res) => {
-  const surface = req.query.surface;
-  // Prefer live INSTRUCTIONS constant (agent brain), then package ROOT fallback
-  const instructionsPath = fs.existsSync(INSTRUCTIONS)
-    ? INSTRUCTIONS
-    : path.join(ROOT, 'INSTRUCTIONS.md');
-  if (surface) {
-    if (surface === 'INSTRUCTIONS.md') {
-      return sendTextResource(res, instructionsPath, 'instructions');
-    }
-    const safeSurface = path.basename(surface);
-    const candidates = [
-      path.join(path.dirname(instructionsPath), safeSurface),
-      path.join(ROOT, safeSurface),
-    ];
-    const surfacePath = candidates.find(p => fs.existsSync(p)) || candidates[0];
-    return sendTextResource(res, surfacePath, safeSurface);
-  }
-  return sendTextResource(res, instructionsPath, 'instructions');
-});
-
-router.get('/api/ssss/skill/ssss', requireAuth, requireScope('ssss:read'), (_req, res) => {
-  return sendTextResource(res, ssssSkillDocPath(), 'ssss-skill');
-});
-
-router.get('/api/ssss/spec', requireAuth, requireScope('ssss:read'), (_req, res) => {
-  const refs = ssssReferenceDir();
-  const specPath = ['ssss-reference.md', 'ssss-spec.md']
-    .map((n) => path.join(refs, n))
-    .find((p) => fs.existsSync(p));
-  return sendTextResource(res, specPath || path.join(refs, 'ssss-reference.md'), 'ssss-spec');
-});
-
-router.get('/api/ssss/references', requireAuth, requireScope('ssss:read'), (req, res) => {
-  res.json({ references: listSsssReferences(req) });
-});
-
-router.get('/api/ssss/references/:name', requireAuth, requireScope('ssss:read'), (req, res) => {
-  const filePath = safeReferencePath(req.params.name);
-  if (!filePath) return res.status(400).json({ error: 'Invalid reference name' });
-  return sendTextResource(res, filePath, req.params.name);
-});
-
-
 export const ssssOperationHandler = async (req, res) => {
   try {
     const vaultRoot = resolveVaultFromQuery(req);

package/src/server/routes/system.mjs

@@ -4,7 +4,6 @@
  * GET  /api/logs/:type           — Read last 200 lines of server or daemon log
  * POST /api/diagnostics/agents   — Run upgrade --agents diagnostics
  * GET  /api/pairing              — Reachable URLs for the mobile pairing QR
- * GET  /api/tasks/failed         — List failed tasks from the DLQ
  * POST /api/tasks/:id/retry      — Re-queue a failed task
  * GET  /api/usage                — Usage ledger + cost summary
  * GET  /api/usage/providers      — Spend as the providers report it
@@ -144,20 +143,6 @@ router.get('/api/pairing', requireAuth, requireScope('config:read'), async (_req
   }
 });
 
-/**
- * GET /api/tasks/failed
- * List failed tasks from the scheduler DLQ.
- */
-router.get('/api/tasks/failed', requireAuth, async (req, res) => {
-  try {
-    const { listTasks } = await import('../../core/task-envelope.mjs');
-    const failed = listTasks(QUEUE_DIR, { status: 'failed' });
-    res.json({ total: failed.length, tasks: failed });
-  } catch (err) {
-    serverError(res, err);
-  }
-});
-
 /**
  * POST /api/tasks/:id/retry
  * Re-queue a failed task.

package/src/server/routes/tasks.mjs

@@ -38,32 +38,6 @@ router.get('/api/tasks', requireAuth, requireScope('tasks:read'), (req, res) =>
   } catch (err) { serverError(res, err); }
 });
 
-router.delete('/api/tasks/cleanup', requireAuth, requireScope('tasks:write'), (req, res) => {
-  try {
-    if (!fs.existsSync(TASKS_DIR)) {
-      return res.json({ deleted: 0 });
-    }
-    let deleted = 0;
-    const files = fs.readdirSync(TASKS_DIR);
-    for (const file of files) {
-      if (!file.endsWith('.md')) continue;
-      const filePath = path.join(TASKS_DIR, file);
-      try {
-        const raw = fs.readFileSync(filePath, 'utf8');
-        const { data } = matter(raw);
-        if (data.status === 'completed') {
-          fs.unlinkSync(filePath);
-          deleted++;
-        }
-      } catch (e) {
-        // skip
-      }
-    }
-    res.json({ deleted });
-    
-  } catch (err) { serverError(res, err); }
-});
-
 router.post('/api/tasks', requireAuth, requireScope('tasks:write'), (req, res) => {
   try {
     const { category, target, body, priority = 5 } = req.body || {};