total-recall-brain 3.6.5 → 3.6.7

package/extension/background.js

@@ -10,6 +10,10 @@ const { share, search, healthCheck } = self.BrainClient;
 // Context menu registration
 // ---------------------------------------------------------------------------
 chrome.runtime.onInstalled.addListener(() => {
+  if (chrome.sidePanel && chrome.sidePanel.setPanelBehavior) {
+    chrome.sidePanel.setPanelBehavior({ openPanelOnActionClick: true }).catch(console.error);
+  }
+
   chrome.contextMenus.create({
     id: 'send-to-brain',
     title: 'Send to Brain',

package/extension/content-script.js

@@ -398,7 +398,15 @@
           toast.classList.add('visible');
           setTimeout(() => toast.classList.remove('visible'), 2500);
         } else {
-          toast.textContent = '❌ Action failed';
+          let errText = '❌ Action failed';
+          if (res && res.error) {
+            if (res.error.includes('Authentication failed')) {
+              errText = '❌ Auth Error - Check PAT';
+            } else {
+              errText = `❌ ${res.error}`;
+            }
+          }
+          toast.textContent = errText;
           toast.style.background = '#e74c3c';
           toast.style.boxShadow = '0 4px 12px rgba(231, 76, 60, 0.3)';
           toast.classList.add('visible');

package/extension/manifest.json

@@ -10,7 +10,6 @@
     "service_worker": "background.js"
   },
   "action": {
-    "default_popup": "popup/popup.html",
     "default_icon": {
       "16": "icons/icon-16.png",
       "48": "icons/icon-48.png",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.6.5",
+  "version": "3.6.7",
   "description": "Sovereign AI system — database-free, SSSS-powered personal intelligence engine deployable to any POSIX host.",
   "type": "module",
   "bin": {

package/src/core/daemon-loop.mjs

@@ -38,63 +38,81 @@ const RECOMPILE_EVERY_N_TASKS = 20;
 // Pause between task iterations (ms)
 const TASK_SLEEP_MS = 10000;
 
-// ─── Categories that require LLM (skipped in deterministic mode) ────────────────
-
-const LLM_REQUIRED_CATEGORIES = new Set([
-  'system2-deliberation',
-  'conscious-enforcement',
-  'cutoff-audit',
-]);
-
-/**
- * Check if a task requires an LLM to execute.
- * These tasks are skipped — the daemon is deterministic.
- */
-function requiresLLM(task) {
-  if (LLM_REQUIRED_CATEGORIES.has(task.category)) return true;
-
-  const slug = task.slug;
-  if (slug.startsWith('research-deliberation-')) return true;
-  if (slug.startsWith('research-improvement-')) return true;
-  if (slug.startsWith('research-monitoring-')) return true;
-  if (slug.startsWith('research-expansion-')) return true;
-  if (slug.includes('self-diagnosis')) return true;
-  if (slug.includes('clarity-review')) return true;
-  if (slug.includes('staleness-check')) return true;
-  if (slug.includes('inference')) return true;
-  if (slug.includes('post-mortem')) return true;
-  if (slug.includes('compliance')) return true;
-
-  return false;
-}
+// ─── Tasks are no longer skipped to conserve resources. We use CLI agents! ───
 
 async function dispatchTask(task) {
-  if (requiresLLM(task)) {
-    logger.info({
-      subsystem: 'daemon-loop',
-      message: `Skipping task (requires LLM): ${task.slug} [${task.category}]`,
-    });
-    return { success: true, skippedLLM: true, output: 'Skipped — handled by IDE agents' };
-  }
-
   const category = task.category;
 
   try {
-    switch (category) {
-      case 'memory-maintenance':
-        return await runMaintenanceTask(task);
-
-      case 'proactive-research':
-      case 'research-acquisition':
-        return await runResearchTask(task);
-
-      default:
-        logger.info({
-          subsystem: 'daemon-loop',
-          message: `Skipping task (not deterministic): ${task.slug} [${category}]`,
-        });
-        return { success: true, skippedLLM: true, output: 'Skipped — handled by IDE agents' };
+    const { loadRuntimeConfig } = await import('./runtime.mjs');
+    const runtimeConfig = await loadRuntimeConfig();
+
+    // ─── Research & Proactive Tasks (LLM + Fetching) ───
+    if (task.slug.startsWith('research-') || category === 'proactive-research' || category === 'research-acquisition') {
+      if (task.slug.startsWith('staleness-check-')) {
+         const { runStalenessCheck } = await import('./clarity-rewriter.mjs');
+         const result = await runStalenessCheck(task.target, { vaultDir: VAULT_DIR, queueDir: QUEUE_DIR, runtimeConfig });
+         return { success: true, output: `Staleness check complete: ${result.verdict} (conf: ${result.confidence})` };
+      }
+      return await runResearchTask(task, runtimeConfig);
+    }
+    
+    // ─── System 2 Inference ───
+    if (category === 'system2-deliberation') {
+      const { runInferenceTask } = await import('./inference-engine.mjs');
+      const slugs = task.target ? task.target.split(',') : [];
+      const result = await runInferenceTask(slugs, {
+        vaultDir: VAULT_DIR,
+        inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'),
+        runtimeConfig
+      });
+      return { success: true, output: `Inference complete: ${result.conclusions?.length || 0} conclusions` };
+    }
+
+    // ─── Cutoff Audit ───
+    if (category === 'cutoff-audit' || task.slug.startsWith('cutoff-audit-')) {
+      const { runCutoffAudit } = await import('./clarity-rewriter.mjs');
+      const result = await runCutoffAudit({ vaultDir: VAULT_DIR, queueDir: QUEUE_DIR, runtimeConfig });
+      return { success: true, output: `Cutoff audit complete: ${result.audited} audited, ${result.flagged} flagged, ${result.critical} critical` };
+    }
+
+    // ─── Self Diagnosis & Conscious Enforcement ───
+    if (category === 'conscious-enforcement' || task.slug.includes('self-diagnosis')) {
+      if (task.slug.startsWith('post-mortem-')) {
+        const { runPostMortem } = await import('./post-mortem.mjs');
+        const sessionPath = path.join(brainDir, 'sessions', task.target);
+        const result = await runPostMortem(sessionPath, { vaultDir: VAULT_DIR, inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'), runtimeConfig });
+        return { success: true, output: `Post-mortem complete: ${result.nodesCreated || 0} nodes extracted` };
+      }
+
+      if (task.slug.includes('self-diagnosis')) {
+        const { runSelfDiagnosis } = await import('./fact-seeker.mjs');
+        await runSelfDiagnosis({ vaultDir: VAULT_DIR, runtimeConfig });
+        return { success: true, output: `Self-diagnosis complete` };
+      }
+      return { success: true, output: `Conscious enforcement handled` };
+    }
+
+    // ─── Memory Maintenance ───
+    if (category === 'memory-maintenance') {
+      if (task.slug.startsWith('clarity-review-')) {
+        const { runClarityReview } = await import('./clarity-rewriter.mjs');
+        const result = await runClarityReview(task.target, { vaultDir: VAULT_DIR, inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'), runtimeConfig });
+        return { success: true, output: `Clarity review complete: rewrote=${result.rewrote}` };
+      }
+      if (task.slug.startsWith('memory-compaction-')) {
+        const { runMemoryCompaction } = await import('./fact-seeker.mjs');
+        const result = await runMemoryCompaction({ vaultDir: VAULT_DIR, inboxDir: path.join(BRAIN_DIR, 'memory-inbox', 'pending'), runtimeConfig });
+        return { success: true, output: `Memory compaction complete. Consolidated nodes: ${result.consolidatedCount || 0}` };
+      }
+      return await runMaintenanceTask(task);
     }
+
+    logger.info({
+      subsystem: 'daemon-loop',
+      message: `Skipping unhandled task category: ${task.slug} [${category}]`,
+    });
+    return { success: true, output: 'Skipped unhandled task' };
   } catch (err) {
     logger.info({
       subsystem: 'daemon-loop',
@@ -106,10 +124,10 @@ async function dispatchTask(task) {
 
 // ─── Research Engine (Web Fetching Only — No LLM Synthesis) ─────────────────────
 
-async function runResearchTask(task) {
+async function runResearchTask(task, runtimeConfig) {
   const inboxDir = path.join(BRAIN_DIR, 'memory-inbox', 'pending');
 
-  // Knowledge acquisition — fetch from web, save raw results
+  // Phase 1: Knowledge acquisition
   if (task.slug.startsWith('research-acquisition-') || task.category === 'proactive-research' || task.slug.includes('fact-seeker') || task.slug.includes('knowledge-acquisition')) {
     const { runKnowledgeAcquisitionCycle } = await import('./fact-seeker.mjs');
     const forceTopic = task.target || null;
@@ -121,6 +139,7 @@ async function runResearchTask(task) {
       skillsDir: SKILLS_DIR,
       derivedDir: DERIVED_DIR,
       instructionsFile: INSTRUCTIONS_FILE,
+      runtimeConfig
     });
     if (result.skipped) return { success: true, output: `Knowledge acquisition: ${result.skipped}` };
     const surfaceNote = result.surfaced ? ' [SURFACED]' : ' [staged]';
@@ -131,8 +150,59 @@ async function runResearchTask(task) {
     };
   }
 
+  // Phase 2: Deliberation
+  if (task.slug.startsWith('research-deliberation-')) {
+    const { runResearchDeliberationCycle } = await import('./fact-seeker.mjs');
+    const result = await runResearchDeliberationCycle({
+      vaultDir: VAULT_DIR,
+      nodeSlug: task._node_slug || 'pending',
+      topic: task.title || task.target || 'Unknown Topic',
+      runtimeConfig
+    });
+    return { success: true, output: `Deliberation complete: ${result.slug || 'done'}` };
+  }
+
+  // Phase 3: Improvement
+  if (task.slug.startsWith('research-improvement-')) {
+    const { runResearchImprovementCycle } = await import('./fact-seeker.mjs');
+    const result = await runResearchImprovementCycle({
+      vaultDir: VAULT_DIR,
+      nodeSlug: task._node_slug || 'pending',
+      topic: task.title || task.target || 'Unknown Topic',
+      runtimeConfig
+    });
+    return { success: true, output: `Improvement complete` };
+  }
+
+  // Phase 4: Monitoring
+  if (task.slug.startsWith('research-monitoring-')) {
+    const { runResearchMonitoringCycle } = await import('./fact-seeker.mjs');
+    const result = await runResearchMonitoringCycle({
+      vaultDir: VAULT_DIR,
+      nodeSlug: task._node_slug || 'pending',
+      topic: task.title || task.target || 'Unknown Topic',
+      runtimeConfig,
+      skillsDir: SKILLS_DIR,
+      derivedDir: DERIVED_DIR,
+      instructionsFile: INSTRUCTIONS_FILE
+    });
+    return { success: true, output: `Monitoring complete` };
+  }
+
+  // Phase 5: Expansion
+  if (task.slug.startsWith('research-expansion-')) {
+    const { runResearchExpansionCycle } = await import('./fact-seeker.mjs');
+    const result = await runResearchExpansionCycle({
+      vaultDir: VAULT_DIR,
+      nodeSlug: task._node_slug || 'pending',
+      topic: task.title || task.target || 'Unknown Topic',
+      runtimeConfig
+    });
+    return { success: true, output: `Expansion complete` };
+  }
+
   // Conclusion writer — validate pending drafts (deterministic checks)
-  if (task.slug.includes('validate') || task.category === 'research-acquisition') {
+  if (task.slug.includes('validate')) {
     const { runConclusionWriter } = await import('./conclusion-writer.mjs');
     const result = await runConclusionWriter({
       inboxDir,
@@ -313,8 +383,18 @@ async function main() {
         try {
           if (result.skippedLLM) {
             updateTaskStatus(task, 'pending', QUEUE_DIR);
+          } else if (result.success) {
+            updateTaskStatus(task, 'completed', QUEUE_DIR);
           } else {
-            updateTaskStatus(task, result.success ? 'completed' : 'failed', QUEUE_DIR);
+            // Dead Letter Queue / Retry Logic
+            task.retry_count = (task.retry_count || 0) + 1;
+            if (task.retry_count >= 3) {
+              logger.info({ subsystem: 'daemon-loop', message: `Task ${task.slug} failed 3 times. Moving to DLQ (failed).` });
+              updateTaskStatus(task, 'failed', QUEUE_DIR);
+            } else {
+              logger.info({ subsystem: 'daemon-loop', message: `Task ${task.slug} failed. Retry ${task.retry_count}/3. Requeueing.` });
+              updateTaskStatus(task, 'pending', QUEUE_DIR);
+            }
           }
         } catch (statusErr) {
           logger.info({
@@ -334,15 +414,26 @@ async function main() {
             patch.node_slug = result.factSlug;
           }
           // If the task was skipped because it requires an LLM, DO NOT complete the research project.
-          // Wait for an IDE agent to run it.
           if (result.skippedLLM) {
             patch.status = 'pending';
-          } else if (result.success && task._research_phase === 'acquisition' && result.factSlug) {
-            // Acquisition is done, advance to deliberation phase for LLM processing!
-            patch.status = 'pending';
-            patch.research_phase = 'deliberation';
-            // Also notify the user/UI that phase 1 is complete!
-            patch.completed_at = new Date().toISOString();
+          } else if (result.success && result.factSlug) {
+            if (task._research_phase === 'acquisition') {
+              patch.status = 'pending';
+              patch.research_phase = 'deliberation';
+              patch.completed_at = new Date().toISOString();
+            } else if (task._research_phase === 'deliberation') {
+              patch.status = 'pending';
+              patch.research_phase = 'improvement';
+            } else if (task._research_phase === 'improvement') {
+              patch.status = 'pending';
+              patch.research_phase = 'monitoring';
+            } else if (task._research_phase === 'monitoring') {
+              patch.status = 'pending';
+              patch.research_phase = 'expansion';
+            } else if (task._research_phase === 'expansion') {
+              patch.status = 'done';
+              patch.completed_at = new Date().toISOString();
+            }
           }
           updateQueueItem(task._research_id, patch);
         } catch (err) {

package/src/core/fact-seeker.mjs

@@ -529,7 +529,8 @@ export function buildMultiNoteGraph(topic, synthesis, parsedSupportingNotes, sta
     return { slug, body: bodyLines.join('\n'), frontmatter };
   });
 
-  const masterSlug = `fact-master-${crypto.randomBytes(5).toString('hex')}`;
+  const topicHash = crypto.createHash('md5').update(topic).digest('hex').slice(0, 10);
+  const masterSlug = `fact-master-${topicHash}`;
 
   // Bidirectionally link the master node and supporting notes
   const masterRelated = supportingNodes.map(n => n.slug);
@@ -658,7 +659,8 @@ async function writeAndSurfaceImmediately(topic, synthesis, sourceResults, {
   const topResults = sourceResults.slice(0, 4);
   for (const r of topResults) {
     const summary = await synthesizeSupportingNote(topic, r, runtimeConfig);
-    const slug = `fact-note-${crypto.randomBytes(5).toString('hex')}`;
+    const noteHash = crypto.createHash('md5').update(r.url || r.title || r.snippet).digest('hex').slice(0, 10);
+    const slug = `fact-note-${noteHash}`;
     parsedSupportingNotes.push({ result: r, summary, slug });
   }
 
@@ -700,7 +702,8 @@ async function writeDraftToInbox(topic, synthesis, sourceResults, inboxDir, runt
   const topResults = sourceResults.slice(0, 4);
   for (const r of topResults) {
     const summary = await synthesizeSupportingNote(topic, r, runtimeConfig);
-    const slug = `fact-note-${crypto.randomBytes(5).toString('hex')}`;
+    const noteHash = crypto.createHash('md5').update(r.url || r.title || r.snippet).digest('hex').slice(0, 10);
+    const slug = `fact-note-${noteHash}`;
     parsedSupportingNotes.push({ result: r, summary, slug });
   }
 

package/src/core/research-queue.mjs

@@ -325,6 +325,14 @@ export function listQueue({ status, query, limit = 100, offset = 0, brainDir: ov
  */
 export function addToQueue({ topic, priority = 'medium', notes, brainDir: overrideBrainDir } = {}) {
   if (!topic) throw new Error('topic is required');
+
+  const items = loadQueue(overrideBrainDir);
+  const normalizedTopic = String(topic).trim().toLowerCase();
+  const existing = items.find(i => i.topic.trim().toLowerCase() === normalizedTopic);
+  if (existing) {
+    return existing;
+  }
+
   const item = {
     id:           crypto.randomUUID(),
     topic:        String(topic),
@@ -338,7 +346,6 @@ export function addToQueue({ topic, priority = 'medium', notes, brainDir: overri
     completed_at: null,
   };
   item.summary = compileResearchProjectSummary(item, null);
-  const items = loadQueue(overrideBrainDir);
   items.unshift(item);
   saveQueue(items, overrideBrainDir);
 

package/src/core/scheduler.mjs

@@ -210,6 +210,7 @@ export function generateIdleTask({ vaultDir, sessionsDir }) {
     () => generateInferenceTask(vaultDir),
     () => generatePostMortemTask(sessionsDir),
     () => generateClarityReviewTask(vaultDir),
+    () => generateMemoryCompactionTask(vaultDir),
   ];
 
   const strategy = cleanStrategies[_idleCycleCounter % cleanStrategies.length];
@@ -248,18 +249,34 @@ function generateClarityReviewTask(vaultDir) {
   if (nodes.length === 0) {
     return makeFallbackTask('memory-maintenance', 'No active nodes to review');
   }
-
-  const target = nodes[crypto.randomInt(0, nodes.length)];
+  const target = nodes[Math.floor(Math.random() * nodes.length)];
   return {
     type: 'task',
-    slug: `clarity-review-${target.slug}-${Date.now().toString(36)}`,
+    slug: `clarity-review-${crypto.randomBytes(4).toString('hex')}`,
     priority: 30,
     category: 'memory-maintenance',
     target: target.slug,
     status: 'pending',
     created_by: 'scheduler-idle',
-    reason: `Idle task: review "${target.title}" for clarity and actionability.`,
-    body: `## Objective\nReview memory node "${target.slug}" and evaluate:\n1. Is the title descriptive enough for a 7-item skill injection?\n2. Is the body actionable by an AI agent?\n3. Does the frontmatter accurately reflect the content?\n\nIf improvements are needed, generate a rewrite proposal.`,
+    reason: `Idle task: selected active node ${target.slug} for clarity review.`,
+    body: `Analyze node ${target.slug} for clarity, deduplication, formatting, and structural integrity. Rewrite via SSSS strict compliance if needed.`,
+  };
+}
+
+/**
+ * Generate a memory compaction task to fuse highly overlapping fragmented nodes.
+ */
+function generateMemoryCompactionTask(vaultDir) {
+  return {
+    type: 'task',
+    slug: `memory-compaction-${crypto.randomBytes(4).toString('hex')}`,
+    priority: 35,
+    category: 'memory-maintenance',
+    target: 'global',
+    status: 'pending',
+    created_by: 'scheduler-idle',
+    reason: `Idle task: scan vault for fragmented nodes to merge into comprehensive master documents.`,
+    body: `Scan for highly overlapping or fragmented memory nodes and fuse them into comprehensive master nodes, archiving the fragments.`,
   };
 }
 
@@ -523,6 +540,7 @@ export function createScheduler({ queueDir, vaultDir, sessionsDir }) {
         body,
         _research_id: item.id,
         _research_phase: phase,
+        _node_slug: item.node_slug,
       });
     }
     if (researchItems.length > 0) {

package/src/core/schema.mjs

@@ -644,6 +644,28 @@ export const PhoneNumberSchema = z.object({
   user_id: z.string().optional().nullable(),
 });
 
+export const DomainSchema = z.object({
+  type: z.literal('domain'),
+  domain_name: z.string(),
+  registrar: z.string(),
+  status: z.string(),
+  payment_status: z.string(),
+  workspace_id: z.string().optional().nullable(),
+  user_id: z.string().optional().nullable(),
+  base_price_usd: z.number().optional().nullable(),
+  purchase_price_usd: z.number().optional().nullable(),
+  annual_renewal_usd: z.number().optional().nullable(),
+  markup_amount_usd: z.number().optional().nullable(),
+  markup_rate: z.number().optional().nullable(),
+  expires_at: z.string().optional().nullable(),
+  payment_method: z.string().optional().nullable(),
+  vercel_domain_id: z.string().optional().nullable(),
+  stripe_payment_intent_id: z.string().optional().nullable(),
+  stripe_checkout_session_id: z.string().optional().nullable(),
+  credits_charged: z.number().optional().nullable(),
+  credit_transaction_id: z.string().optional().nullable(),
+});
+
 export const WorkspaceSchema = z.object({
   type: z.literal('workspace'),
   name: z.string(),
@@ -804,6 +826,7 @@ export const SSSS_SCHEMAS = {
   workspace_transfer: WorkspaceTransferSchema,
   extension: ExtensionSchema,
   phone_number: PhoneNumberSchema,
+  domain: DomainSchema,
   workspace: WorkspaceSchema,
   commerce_catalog: CommerceCatalogSchema,
   product: ProductSchema,

package/src/core/surface.mjs

@@ -395,8 +395,9 @@ async function writeShim(shimPath, skillsDir, nodes = [], { vaultDir, derivedDir
     if (fs.existsSync(shimPath)) {
       const stat = fs.lstatSync(shimPath);
       if (stat.isSymbolicLink()) {
-        fs.unlinkSync(shimPath);
-        atomicWrite(shimPath, fullContent);
+        // If it's a symlink, DO NOT destroy it. It likely points to INSTRUCTIONS.md natively,
+        // and its content will update automatically when the target updates.
+        return;
       } else {
         const raw = fs.readFileSync(shimPath, 'utf8');
         let cleaned = raw;
@@ -465,12 +466,9 @@ async function compilePointers(instructionsFile, skillsDir, nodes = [], { vaultD
   const connectedClients = readConnectedClients(clientsPath);
 
   if (connectedClients === null) {
-    // No clients.json → backward compat: write ALL client shims
-    for (const files of Object.values(CLIENT_SHIMS)) {
-      for (const file of files) {
-        await writeShim(path.join(baseDir, file), skillsDir, nodes, { vaultDir, derivedDir });
-      }
-    }
+    // Backward compat loop removed to prevent context exhaustion.
+    // By default, we only write INSTRUCTIONS.md.
+    // Users must explicitly use 'npx total-recall connect' to register client IDEs.
   } else {
     // Only write shims for connected clients
     for (const client of connectedClients) {

package/src/server/rest.mjs

@@ -83,6 +83,10 @@ import { memoryRouter }   from './routes/memory.mjs';
 import { keysRouter }     from './routes/keys.mjs';
 import { sessionsRouter } from './routes/sessions.mjs';
 import { shareRouter }    from './routes/share.mjs';
+import { authRouter }     from './routes/auth.mjs';
+import { sandboxRouter }  from './routes/sandbox.mjs';
+import { researchRouter } from './routes/research.mjs';
+import { skillsRouter }   from './routes/skills.mjs';
 // ollamaUrl removed — CLI agents replace Ollama
 import {
   AGENT_DIR,
@@ -159,6 +163,10 @@ router.use(memoryRouter);
 router.use(keysRouter);
 router.use(sessionsRouter);
 router.use(shareRouter);
+router.use(authRouter);
+router.use(sandboxRouter);
+router.use(researchRouter);
+router.use(skillsRouter);
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -490,36 +498,7 @@ router.post('/api/diagnostics/agents', requireAuth, requireScope('health:read'),
 // ─── Keys ─────────── (moved to ./routes/keys.mjs)
 // ─── Sessions ─────── (moved to ./routes/sessions.mjs)
 // ─── Sandbox ──────────────────────────────────────────────────────────────────
-
-/**
- * POST /api/sandbox
- * Body: { code }
- */
-// Sandbox is rate-limited *before* requireAuth on purpose — limiter keys on
-// the authenticated principal when present, so it's IP-bucketed for
-// pre-auth misuse and key-bucketed once a PAT is attached.
-router.post('/api/sandbox', sandboxRateLimiter(), requireAuth, requireScope('sandbox:run'), requireSandboxEnabled, async (req, res) => {
-  try {
-    const { code } = req.body || {};
-    if (!code) return badRequest(res, 'code is required');
-
-    const tmpDir  = path.join(os.tmpdir(), 'total-recall-sandbox');
-    fs.mkdirSync(tmpDir, { recursive: true });
-    const script  = path.join(tmpDir, `rest-${Date.now()}.mjs`);
-    fs.writeFileSync(script, code);
-
-    const result = await runInSandbox(script, 15000);
-    try { fs.unlinkSync(script); } catch {}
-
-    res.json({
-      success: result.success,
-      exit_code: result.code,
-      output: result.output,
-    });
-  } catch (err) {
-    serverError(res, err);
-  }
-});
+// Moved to routes/sandbox.mjs
 
 // ─── Config ───────────────────────────────────────────────────────────────────
 
@@ -707,41 +686,7 @@ router.get('/api', (req, res) => {
 });
 
 // ─── Research Queue ───────────────────────────────────────────────────────────
-// Thin REST wrappers over src/core/research-queue.mjs
-
-router.get('/api/research', requireAuth, requireScope('memory:read'), (req, res) => {
-  try {
-    const { status, query, limit, offset } = req.query;
-    res.json(listQueue({ status, query, limit, offset }));
-  } catch (err) { serverError(res, err); }
-});
-
-router.post('/api/research', requireAuth, requireScope('memory:write'), (req, res) => {
-  try {
-    const { topic, priority, notes } = req.body || {};
-    if (!topic) return badRequest(res, 'topic is required');
-    res.status(201).json(addToQueue({ topic, priority, notes }));
-  } catch (err) { serverError(res, err); }
-});
-
-router.patch('/api/research/:id', requireAuth, requireScope('memory:write'), (req, res) => {
-  try {
-    res.json(updateQueueItem(req.params.id, req.body || {}));
-  } catch (err) {
-    if (err.status === 404) return notFound(res, err.message);
-    serverError(res, err);
-  }
-});
-
-router.delete('/api/research/:id', requireAuth, requireScope('memory:write'), (req, res) => {
-  try {
-    res.json(removeFromQueue(req.params.id));
-  } catch (err) {
-    if (err.status === 404) return notFound(res, err.message);
-    serverError(res, err);
-  }
-});
-
+// Moved to routes/research.mjs
 // ─── Active Integrations ──────────────────────────────────────────────────────
 
 /**
@@ -1098,110 +1043,7 @@ router.get('/api/files', requireAuth, requireScope('files:read'), (req, res) =>
   } catch (err) { serverError(res, err); }
 });
 
-router.get('/api/skills', requireAuth, requireScope('files:read', 'ssss:read'), (req, res) => {
-  try {
-    if (!fs.existsSync(SKILLS_DIR)) {
-      fs.mkdirSync(SKILLS_DIR, { recursive: true });
-    }
-    const skills = fs.readdirSync(SKILLS_DIR).map(dir => {
-      const dirPath = path.join(SKILLS_DIR, dir);
-      const stats = fs.statSync(dirPath);
-      
-      let subSkills = [];
-      const subSkillsPath = path.join(dirPath, 'skills');
-      if (fs.existsSync(subSkillsPath) && fs.statSync(subSkillsPath).isDirectory()) {
-        try {
-          subSkills = fs.readdirSync(subSkillsPath).filter(sd => 
-            fs.statSync(path.join(subSkillsPath, sd)).isDirectory()
-          );
-        } catch (e) {}
-      }
-
-      return {
-        name: dir,
-        size: stats.size,
-        modified: stats.mtime,
-        isDirectory: stats.isDirectory(),
-        subSkills
-      };
-    });
-    res.json(skills);
-  } catch (err) { serverError(res, err); }
-});
-
-router.get('/api/skills/search', requireAuth, requireScope('files:read', 'ssss:read'), async (req, res) => {
-  try {
-    const q = req.query.q || '';
-    if (!q) {
-      return res.status(400).json({ error: 'Missing search query parameter `q`.' });
-    }
-    const { searchAndSort } = await import('../../.agent/skills/total-recall/skills/skill/scripts/find-skills.mjs');
-    const results = searchAndSort(q);
-    res.json(results);
-  } catch (err) { serverError(res, err); }
-});
-
-router.post('/api/skills/install', requireAuth, requireScope('files:write', 'ssss:write'), async (req, res) => {
-  try {
-    const { pkg } = req.body;
-    if (!pkg) {
-      return res.status(400).json({ error: 'Missing required `pkg` body parameter.' });
-    }
-    const { installSkill } = await import('../../.agent/skills/total-recall/skills/skill/scripts/install-skill.mjs');
-    const result = installSkill(pkg);
-    res.json(result);
-  } catch (err) { serverError(res, err); }
-});
-
-router.get('/api/skills/:name', requireAuth, requireScope('files:read', 'ssss:read'), (req, res) => {
-  try {
-    const { name } = req.params;
-    if (name.includes('..') || name.includes('/') || name.includes('\\')) {
-      return res.status(400).json({ error: 'Invalid skill name' });
-    }
-    const skillPath = path.join(SKILLS_DIR, name, 'SKILL.md');
-    if (!fs.existsSync(skillPath)) {
-      return res.status(404).json({ error: `Skill "${name}" not found` });
-    }
-    const content = fs.readFileSync(skillPath, 'utf8');
-    res.json({ name, content });
-  } catch (err) { serverError(res, err); }
-});
-
-router.put('/api/skills/:name', requireAuth, requireScope('files:write', 'ssss:write'), (req, res) => {
-  try {
-    const { name } = req.params;
-    const { content } = req.body;
-    if (name.includes('..') || name.includes('/') || name.includes('\\')) {
-      return res.status(400).json({ error: 'Invalid skill name' });
-    }
-    if (typeof content !== 'string') {
-      return res.status(400).json({ error: 'Missing or invalid `content` field.' });
-    }
-    const skillDir = path.join(SKILLS_DIR, name);
-    if (!fs.existsSync(skillDir)) {
-      fs.mkdirSync(skillDir, { recursive: true });
-    }
-    const skillPath = path.join(skillDir, 'SKILL.md');
-    fs.writeFileSync(skillPath, content, 'utf8');
-    res.json({ success: true, message: `Skill "${name}" updated successfully` });
-  } catch (err) { serverError(res, err); }
-});
-
-router.delete('/api/skills/:name', requireAuth, requireScope('files:write', 'ssss:write'), (req, res) => {
-  try {
-    const { name } = req.params;
-    if (name.includes('..') || name.includes('/') || name.includes('\\')) {
-      return res.status(400).json({ error: 'Invalid skill name' });
-    }
-    const skillDir = path.join(SKILLS_DIR, name);
-    if (!fs.existsSync(skillDir)) {
-      return res.status(404).json({ error: `Skill "${name}" not found` });
-    }
-    fs.rmSync(skillDir, { recursive: true, force: true });
-    res.json({ success: true, message: `Skill "${name}" deleted successfully` });
-  } catch (err) { serverError(res, err); }
-});
+// Moved to routes/skills.mjs
 
 // ─── Scripts Editor & Execution ───────────────────────────────────────────────
 
@@ -1345,6 +1187,12 @@ router.get('/api/tasks', requireAuth, requireScope('tasks:read'), (req, res) =>
       try {
         const raw = fs.readFileSync(path.join(TASKS_DIR, file), 'utf8');
         const { data, content } = matter(raw);
+        
+        // By default, filter out completed tasks
+        if (req.query.status !== 'all' && data.status === 'completed') {
+          continue;
+        }
+        
         tasks.push({ ...data, body: content.trim(), slug: file.replace('.md', '') });
       } catch (e) {
         // skip
@@ -1354,6 +1202,31 @@ router.get('/api/tasks', requireAuth, requireScope('tasks:read'), (req, res) =>
   } catch (err) { serverError(res, err); }
 });
 
+router.delete('/api/tasks/cleanup', requireAuth, requireScope('tasks:write'), (req, res) => {
+  try {
+    if (!fs.existsSync(TASKS_DIR)) {
+      return res.json({ deleted: 0 });
+    }
+    let deleted = 0;
+    const files = fs.readdirSync(TASKS_DIR);
+    for (const file of files) {
+      if (!file.endsWith('.md')) continue;
+      const filePath = path.join(TASKS_DIR, file);
+      try {
+        const raw = fs.readFileSync(filePath, 'utf8');
+        const { data } = matter(raw);
+        if (data.status === 'completed') {
+          fs.unlinkSync(filePath);
+          deleted++;
+        }
+      } catch (e) {
+        // skip
+      }
+    }
+    res.json({ deleted });
+  } catch (err) { serverError(res, err); }
+});
+
 router.post('/api/tasks', requireAuth, requireScope('tasks:write'), (req, res) => {
   try {
     const { category, target, body, priority = 5 } = req.body || {};
@@ -1559,26 +1432,7 @@ router.post('/api/capture/:source', requireAuth, requireScope('memory:write'), a
 });
 
 // ─── Consolidated Auth Routes ──────────────────────────────────────────────────
-
-router.post('/auth/login', loginHandler);
-router.post('/auth/logout', logoutHandler);
-router.post('/auth/change-password', requireAuth, changePasswordHandler);
-router.get('/auth/me', requireAuth, (req, res) => res.json({ authenticated: true }));
-
-router.get("/auth/status", (req, res) => {
-  const config = loadSecurityConfig();
-  const configured = !!config.dashboard?.password_hash;
-  res.json({ configured });
-});
-
-router.post("/auth/setup", async (req, res) => {
-  const config = loadSecurityConfig();
-  const alreadyConfigured = !!config.dashboard?.password_hash;
-  if (alreadyConfigured) {
-    return res.status(400).json({ error: "Dashboard password is already configured" });
-  }
-  return changePasswordHandler(req, res);
-});
+// Moved to routes/auth.mjs
 
 // ─── Voice / TTS (Kokoro / System) ───────────────────────────────────────────────
 

package/src/server/route-manifest.json

@@ -295,6 +295,10 @@
     "method": "POST",
     "path": "/api/tasks"
   },
+  {
+    "method": "DELETE",
+    "path": "/api/tasks/cleanup"
+  },
   {
     "method": "POST",
     "path": "/api/tts"

package/src/server/routes/auth.mjs

@@ -0,0 +1,32 @@
+import express from 'express';
+import {
+  requireAuth,
+  loadSecurityConfig,
+  loginHandler,
+  logoutHandler,
+  changePasswordHandler,
+} from '../auth.mjs';
+
+export const authRouter = express.Router();
+
+// ─── Consolidated Auth Routes ──────────────────────────────────────────────────
+
+authRouter.post('/auth/login', loginHandler);
+authRouter.post('/auth/logout', logoutHandler);
+authRouter.post('/auth/change-password', requireAuth, changePasswordHandler);
+authRouter.get('/auth/me', requireAuth, (req, res) => res.json({ authenticated: true }));
+
+authRouter.get("/auth/status", (req, res) => {
+  const config = loadSecurityConfig();
+  const configured = !!config.dashboard?.password_hash;
+  res.json({ configured });
+});
+
+authRouter.post("/auth/setup", async (req, res) => {
+  const config = loadSecurityConfig();
+  const alreadyConfigured = !!config.dashboard?.password_hash;
+  if (alreadyConfigured) {
+    return res.status(400).json({ error: "Dashboard password is already configured" });
+  }
+  return changePasswordHandler(req, res);
+});

package/src/server/routes/research.mjs

@@ -0,0 +1,55 @@
+import express from 'express';
+import { requireAuth, requireScope } from '../auth.mjs';
+import { listQueue, addToQueue, updateQueueItem, removeFromQueue } from '../../core/research-queue.mjs';
+import { logger } from '../../core/logger.mjs';
+
+function badRequest(res, msg) {
+  return res.status(400).json({ error: msg });
+}
+
+function notFound(res, msg) {
+  return res.status(404).json({ error: msg || 'Not found' });
+}
+
+function serverError(res, err) {
+  logger.error('research', 'Internal server error', { error: err.message, stack: err.stack });
+  return res.status(500).json({ error: 'Internal server error' });
+}
+
+export const researchRouter = express.Router();
+
+// ─── Research Queue ───────────────────────────────────────────────────────────
+// Thin REST wrappers over src/core/research-queue.mjs
+
+researchRouter.get('/api/research', requireAuth, requireScope('memory:read'), (req, res) => {
+  try {
+    const { status, query, limit, offset } = req.query;
+    res.json(listQueue({ status, query, limit, offset }));
+  } catch (err) { serverError(res, err); }
+});
+
+researchRouter.post('/api/research', requireAuth, requireScope('memory:write'), (req, res) => {
+  try {
+    const { topic, priority, notes } = req.body || {};
+    if (!topic) return badRequest(res, 'topic is required');
+    res.status(201).json(addToQueue({ topic, priority, notes }));
+  } catch (err) { serverError(res, err); }
+});
+
+researchRouter.patch('/api/research/:id', requireAuth, requireScope('memory:write'), (req, res) => {
+  try {
+    res.json(updateQueueItem(req.params.id, req.body || {}));
+  } catch (err) {
+    if (err.status === 404) return notFound(res, err.message);
+    serverError(res, err);
+  }
+});
+
+researchRouter.delete('/api/research/:id', requireAuth, requireScope('memory:write'), (req, res) => {
+  try {
+    res.json(removeFromQueue(req.params.id));
+  } catch (err) {
+    if (err.status === 404) return notFound(res, err.message);
+    serverError(res, err);
+  }
+});

package/src/server/routes/sandbox.mjs

@@ -0,0 +1,55 @@
+import express from 'express';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { runInSandbox } from '../../core/sandbox.mjs';
+import {
+  requireAuth,
+  requireScope,
+  sandboxRateLimiter,
+  requireSandboxEnabled,
+} from '../auth.mjs';
+import { logger } from '../../core/logger.mjs';
+
+function badRequest(res, msg) {
+  return res.status(400).json({ error: msg });
+}
+
+function serverError(res, err) {
+  logger.error('sandbox', 'Internal server error', { error: err.message, stack: err.stack });
+  return res.status(500).json({ error: 'Internal server error' });
+}
+
+export const sandboxRouter = express.Router();
+
+// ─── Sandbox ──────────────────────────────────────────────────────────────────
+
+/**
+ * POST /api/sandbox
+ * Body: { code }
+ */
+// Sandbox is rate-limited *before* requireAuth on purpose — limiter keys on
+// the authenticated principal when present, so it's IP-bucketed for
+// pre-auth misuse and key-bucketed once a PAT is attached.
+sandboxRouter.post('/api/sandbox', sandboxRateLimiter(), requireAuth, requireScope('sandbox:run'), requireSandboxEnabled, async (req, res) => {
+  try {
+    const { code } = req.body || {};
+    if (!code) return badRequest(res, 'code is required');
+
+    const tmpDir  = path.join(os.tmpdir(), 'total-recall-sandbox');
+    fs.mkdirSync(tmpDir, { recursive: true });
+    const script  = path.join(tmpDir, `rest-${Date.now()}.mjs`);
+    fs.writeFileSync(script, code);
+
+    const result = await runInSandbox(script, 15000);
+    try { fs.unlinkSync(script); } catch {}
+
+    res.json({
+      success: result.success,
+      exit_code: result.code,
+      output: result.output,
+    });
+  } catch (err) {
+    serverError(res, err);
+  }
+});

package/src/server/routes/skills.mjs

@@ -0,0 +1,118 @@
+import express from 'express';
+import fs from 'node:fs';
+import path from 'node:path';
+import { requireAuth, requireScope } from '../auth.mjs';
+import { logger } from '../../core/logger.mjs';
+import { SKILLS_DIR } from './_shared.mjs';
+
+function serverError(res, err) {
+  logger.error('skills', 'Internal server error', { error: err.message, stack: err.stack });
+  return res.status(500).json({ error: 'Internal server error' });
+}
+
+export const skillsRouter = express.Router();
+
+skillsRouter.get('/api/skills', requireAuth, requireScope('files:read', 'ssss:read'), (req, res) => {
+  try {
+    if (!fs.existsSync(SKILLS_DIR)) {
+      fs.mkdirSync(SKILLS_DIR, { recursive: true });
+    }
+    const skills = fs.readdirSync(SKILLS_DIR).map(dir => {
+      const dirPath = path.join(SKILLS_DIR, dir);
+      const stats = fs.statSync(dirPath);
+      
+      let subSkills = [];
+      const subSkillsPath = path.join(dirPath, 'skills');
+      if (fs.existsSync(subSkillsPath) && fs.statSync(subSkillsPath).isDirectory()) {
+        try {
+          subSkills = fs.readdirSync(subSkillsPath).filter(sd => 
+            fs.statSync(path.join(subSkillsPath, sd)).isDirectory()
+          );
+        } catch (e) {}
+      }
+
+      return {
+        name: dir,
+        size: stats.size,
+        modified: stats.mtime,
+        isDirectory: stats.isDirectory(),
+        subSkills
+      };
+    });
+    res.json(skills);
+  } catch (err) { serverError(res, err); }
+});
+
+skillsRouter.get('/api/skills/search', requireAuth, requireScope('files:read', 'ssss:read'), async (req, res) => {
+  try {
+    const q = req.query.q || '';
+    if (!q) {
+      return res.status(400).json({ error: 'Missing search query parameter `q`.' });
+    }
+    const { searchAndSort } = await import('../../../.agent/skills/total-recall/skills/skill/scripts/find-skills.mjs');
+    const results = searchAndSort(q);
+    res.json(results);
+  } catch (err) { serverError(res, err); }
+});
+
+skillsRouter.post('/api/skills/install', requireAuth, requireScope('files:write', 'ssss:write'), async (req, res) => {
+  try {
+    const { pkg } = req.body;
+    if (!pkg) {
+      return res.status(400).json({ error: 'Missing required `pkg` body parameter.' });
+    }
+    const { installSkill } = await import('../../../.agent/skills/total-recall/skills/skill/scripts/install-skill.mjs');
+    const result = installSkill(pkg);
+    res.json(result);
+  } catch (err) { serverError(res, err); }
+});
+
+skillsRouter.get('/api/skills/:name', requireAuth, requireScope('files:read', 'ssss:read'), (req, res) => {
+  try {
+    const { name } = req.params;
+    if (name.includes('..') || name.includes('/') || name.includes('\\')) {
+      return res.status(400).json({ error: 'Invalid skill name' });
+    }
+    const skillPath = path.join(SKILLS_DIR, name, 'SKILL.md');
+    if (!fs.existsSync(skillPath)) {
+      return res.status(404).json({ error: `Skill "${name}" not found` });
+    }
+    const content = fs.readFileSync(skillPath, 'utf8');
+    res.json({ name, content });
+  } catch (err) { serverError(res, err); }
+});
+
+skillsRouter.put('/api/skills/:name', requireAuth, requireScope('files:write', 'ssss:write'), (req, res) => {
+  try {
+    const { name } = req.params;
+    const { content } = req.body;
+    if (name.includes('..') || name.includes('/') || name.includes('\\')) {
+      return res.status(400).json({ error: 'Invalid skill name' });
+    }
+    if (typeof content !== 'string') {
+      return res.status(400).json({ error: 'Missing or invalid `content` field.' });
+    }
+    const skillDir = path.join(SKILLS_DIR, name);
+    if (!fs.existsSync(skillDir)) {
+      fs.mkdirSync(skillDir, { recursive: true });
+    }
+    const skillPath = path.join(skillDir, 'SKILL.md');
+    fs.writeFileSync(skillPath, content, 'utf8');
+    res.json({ success: true, message: `Skill "${name}" updated successfully` });
+  } catch (err) { serverError(res, err); }
+});
+
+skillsRouter.delete('/api/skills/:name', requireAuth, requireScope('files:write', 'ssss:write'), (req, res) => {
+  try {
+    const { name } = req.params;
+    if (name.includes('..') || name.includes('/') || name.includes('\\')) {
+      return res.status(400).json({ error: 'Invalid skill name' });
+    }
+    const skillDir = path.join(SKILLS_DIR, name);
+    if (!fs.existsSync(skillDir)) {
+      return res.status(404).json({ error: `Skill "${name}" not found` });
+    }
+    fs.rmSync(skillDir, { recursive: true, force: true });
+    res.json({ success: true, message: `Skill "${name}" deleted successfully` });
+  } catch (err) { serverError(res, err); }
+});