Skip to main content

Global Capability Contracts

This executable inventory covers every explicit page route in frontend/src/App.tsx, every literal method/path declaration in every mounted backend/src/routes/*.ts Express router, and every literal WebSocket upgrade pathname in backend/src/websocketServer.ts. Each endpoint has exactly one capability owner, and every WebSocket endpoint has authentication evidence. Every capability also declares whether schemas, manifests, and defaults apply, with source evidence or a specific not-applicable reason, plus documentation and a named behavioral test registered in normal package or browser CI.

Executable provider details remain governed by scripts/capability-contracts.json and scripts/test-capability-contracts.mjs; this global inventory links to that contract instead of duplicating its manifest and default rules.

CapabilityUI routesHTTP endpointsWebSocket endpointsSchemasManifestsDefaultsDocumentationNamed behavioral tests
Home/00N/A — The Home page is a navigation and composition surface with no independent request or response payload.N/A — The Home page is built into the application and is not installed or discovered through a manifest.frontend/src/utils/welcomePrompts.tsdocs/00-README.mdnew chats rotate through distinct creator prompts
frontend/e2e/welcome-prompts.spec.ts (test:e2e)
Chat/chat
/c/:sessionId		221backend/src/types/index.tsscripts/capability-contracts.jsonbackend/src/services/preferencesService.tsdocs/01-QUICK_START.mdChatRequestService prepares target, persona prompt, and shared messages
scripts/test-chat-context.mjs (test:package)
Model management/models460backend/src/types/index.tsscripts/capability-contracts.jsonbackend/src/services/ollamaService.tsdocs/02-WORKING_WITH_MODELS.mdcloud library pulls append the Ollama cloud suffix automatically
frontend/e2e/model-manager.spec.ts (test:e2e)
Personas/personas120backend/src/types/index.tsN/A — Personas are account resources persisted by Libre and do not use an installable or discovery manifest.frontend/src/components/persona-form/defaults.tsdocs/16-PERSONA_DEVELOPMENT_FRAMEWORK.mdmemory insert acknowledgement loss resolves the committed row and retry is idempotent
scripts/test-memory-reliability.mjs (test:package)
Media gallery/gallery190backend/src/types/index.tsscripts/capability-contracts.jsonscripts/test-capability-contracts.mjsdocs/38-MEDIA_GENERATION.mdvideo jobs can stop waiting, reopen, and resume without losing the handle
frontend/e2e/media-generation.spec.ts (test:e2e)
Notes/notes40backend/src/types/index.tsN/A — Notes are first-party account resources and have no installable or discovery manifest.N/A — Notes have no implicit content or presentation default beyond explicit user-supplied fields.docs/03-PRO_TIPS.mdnotes open in Markdown preview and make editing explicit
frontend/e2e/notes.spec.ts (test:e2e)
Work/work
/work/:taskId		291backend/src/types/work.tsscripts/capability-contracts.jsonbackend/src/services/workRuntimeShared.tsdocs/33-WORKSPACES.mdruntime limits expose admission capacity and live occupancy
scripts/test-work-runtime.mjs (test:package)
production Work upgrade applies task-bound ticket authentication
scripts/test-websocket-tickets.mjs (test:package)
Agent CLI models/agents10backend/src/services/agentCliService.tsN/A — Agent CLI adapters are compiled first-party definitions and are not loaded from provider manifests.backend/src/services/agentAccessService.tsdocs/36-AGENT_CLI_MODELS.mdevery agent CLI passes an explicit model through to its argv
scripts/test-agent-cli-chat.mjs (test:package)
Artifacts/artifacts10frontend/src/utils/artifactParser.tsfrontend/src/artifact-runtime/manifest.tsfrontend/src/components/ArtifactSlideOutPanel.tsxdocs/13-ARTIFACTS_FEATURE.mdchat detects multi-file HTML artifacts and renders them in the slide-out panel
frontend/e2e/artifacts.spec.ts (test:e2e)
Provider usage/usage10backend/src/services/pluginUsageService.tsN/A — Usage analytics consume provider events but define no installable or discovery manifest of their own.backend/src/services/pluginUsageService.tsdocs/37-SYSTEM_MONITORING.mdthe usage endpoint is explicitly protected by administrator middleware
scripts/test-plugin-usage-analytics.mjs (test:package)
System diagnostics/system50backend/src/services/systemDiagnosticsService.tsN/A — System diagnostics are a built-in authenticated report and have no installable or discovery manifest.backend/src/services/healthService.tsdocs/37-SYSTEM_MONITORING.mdsystem route requires both authentication and current administrator status
scripts/test-system-diagnostics.mjs (test:package)
User administration/users70backend/src/types/index.tsN/A — User administration is a built-in identity capability and has no installable or discovery manifest.N/A — User role and account status are selected by bootstrap or approval policy rather than a reusable capability default.docs/12-AUTHENTICATION.mdpublic registrations require administrator approval before authentication
scripts/test-user-approval.mjs (test:package)
Authentication/login240backend/src/types/index.tsN/A — Authentication is a built-in security boundary and is not installed or discovered through a manifest.backend/src/services/registrationPolicy.tsdocs/12-AUTHENTICATION.md
docs/12-AUTHENTICATION.md		password login requires and submits a Turnstile token
frontend/e2e/auth.spec.ts (test:e2e)
revoking the session rejects its token with 401
scripts/test-auth-sessions.mjs (test:package)
scope-to-path matrix: notes scope on notes, chat, and auth routes
scripts/test-api-tokens.mjs (test:package)
verifyIdToken accepts a good token and returns its claims
scripts/test-oidc-provider.mjs (test:package)
Access Control—120backend/src/persistence/securityTypes.tsN/A — Access control is a built-in security boundary and is not installed or discovered through a manifest.backend/src/services/authorizationService.tsdocs/12-AUTHENTICATION.mdgroup grants reach members and die with the membership
scripts/test-authorization.mjs (test:package)
a rolled-back duplicate group create leaves no audit row
scripts/test-security-audit.mjs (test:package)
Data portability—30backend/src/services/dataArchiveService.tsbackend/src/services/dataArchiveService.tsbackend/src/services/dataArchiveService.tsdocs/41-DATA_PORTABILITY.mdv3 export is complete, checksummed, user-scoped, and explicit about exclusions
scripts/test-data-archive.mjs (test:package)
Document knowledge and retrieval—150backend/src/types/index.tsscripts/capability-contracts.jsonbackend/src/services/preferencesService.tsdocs/09-RAG_FEATURE.mdkeyword retrieval sees session documents AND user-scoped uploads
scripts/test-rag-retrieval.mjs (test:package)
Persona memory—60backend/src/types/index.tsN/A — Persona memory is an internal persona resource and has no installable or discovery manifest.frontend/src/components/persona-form/defaults.tsdocs/16-PERSONA_DEVELOPMENT_FRAMEWORK.mdpersona deletion during vector publication still removes the recreated vector
scripts/test-memory-reliability.mjs (test:package)
Web search—50backend/src/services/webSearchService.tsN/A — Web search uses administrator connection settings rather than an installable provider manifest.backend/src/services/webSearchService.tsdocs/39-WEB_SEARCH.mdweb search ships disabled and validates its configuration
scripts/test-web-search.mjs (test:package)
Settings and preferences—90backend/src/types/index.tsN/A — Settings aggregate first-party and provider configuration but do not define a separate installable manifest.backend/src/services/preferencesService.tsdocs/35-PROVIDER_CONNECTIONS.mdtheme preference survives refresh and retries a failed save
frontend/e2e/settings.spec.ts (test:e2e)
Speech input and output—100backend/src/types/index.tsscripts/capability-contracts.jsonscripts/test-capability-contracts.mjsdocs/42-SPEECH_TO_TEXT.md
docs/27-QWEN3_TTS.md		STT sends an OpenAI-compatible multipart request to the selected route
scripts/test-stt-routing.mjs (test:package)
provider speech input discloses its route and transcribes recorded audio
frontend/e2e/stt.spec.ts (test:e2e)
invalid provider audio is rejected safely without inserting a transcript
frontend/e2e/stt.spec.ts (test:e2e)
TTS routes a shared model alias through the selected plugin and user valve
scripts/test-tts-routing.mjs (test:package)
Hugging Face Hub—70backend/src/routes/huggingfaceHub.tsN/A — Hub model metadata is remote API data; Libre defines no local installable manifest for the browser capability.backend/src/routes/huggingfaceHub.tsdocs/29-HUGGINGFACE_HUB.mdHugging Face Hub task discovery is authenticated route behavior
scripts/test-huggingface-hub-routes.mjs (test:package)
Libre Claw—260backend/src/services/libreClawService.tsN/A — Libre Claw is an explicitly configured service integration and does not use a Libre provider manifest.backend/src/services/libreClawService.tsdocs/31-LIBRE_CLAW_INTEGRATION.mdWork and Agents are hidden and route-protected for non-admin users
frontend/e2e/sidebar-create-actions.spec.ts (test:e2e)
Durable jobs and events—40backend/src/platform/jobs/durableJobTypes.tsN/A — Durable jobs use registered handler types and persisted payload contracts, not installable manifests.backend/src/platform/jobs/embeddedDurableJobWorker.tsdocs/45-PLATFORM_FOUNDATION.mdordered event replay uses global cursors and per-stream sequences
scripts/test-durable-jobs.mjs (test:package)
Solo and team deployment profiles—00backend/src/platform/runtimeConfig.tshelm/libre-webui/values.schema.jsonhelm/libre-webui/values.yamldocs/45-PLATFORM_FOUNDATION.mdreal Redis coordinates independent replicas and fails closed after shutdown
scripts/test-platform-coordination.mjs (test:package)
Recovery and backup—00backend/src/services/recoveryInventoryService.tsbackend/src/platform/recovery/backupArchive.tsbackend/src/services/recoveryInventoryService.tsdocs/44-RECOVERY_READINESS.mdintegrated backup is signed, encrypted, tamper-evident, and clean-restorable
scripts/test-integrated-backup.mjs (test:package)
team backup restores a clean PostgreSQL and versioned S3 target with authenticated PGVector state
scripts/test-team-backup.mjs (test:package)

Exact backend route inventory​

Home​

No mounted Express endpoint. The executable boundary is the UI and/or source evidence recorded above.

Chat​

  • DELETE /api/chat/folders/:folderId — backend/src/routes/chat.ts (mount /api/chat, subpath /folders/:folderId)
  • DELETE /api/chat/sessions — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions)
  • DELETE /api/chat/sessions/:sessionId — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId)
  • GET /api/chat/folders — backend/src/routes/chat.ts (mount /api/chat, subpath /folders)
  • GET /api/chat/sessions — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions)
  • GET /api/chat/sessions/:sessionId — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId)
  • GET /api/chat/sessions/:sessionId/events — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/events)
  • GET /api/chat/sessions/:sessionId/messages/:messageId/branches — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/messages/:messageId/branches)
  • POST /api/chat/folders — backend/src/routes/chat.ts (mount /api/chat, subpath /folders)
  • POST /api/chat/sessions — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions)
  • POST /api/chat/sessions/:sessionId/followups — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/followups)
  • POST /api/chat/sessions/:sessionId/generate — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/generate)
  • POST /api/chat/sessions/:sessionId/generate-title — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/generate-title)
  • POST /api/chat/sessions/:sessionId/generate/stream — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/generate/stream)
  • POST /api/chat/sessions/:sessionId/generations — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/generations)
  • POST /api/chat/sessions/:sessionId/generations/:assistantMessageId/cancel — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/generations/:assistantMessageId/cancel)
  • POST /api/chat/sessions/:sessionId/messages — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/messages)
  • POST /api/chat/sessions/:sessionId/messages/:messageId/branch — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/messages/:messageId/branch)
  • POST /api/chat/sessions/:sessionId/messages/:messageId/branches — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/messages/:messageId/branches)
  • PUT /api/chat/folders/:folderId — backend/src/routes/chat.ts (mount /api/chat, subpath /folders/:folderId)
  • PUT /api/chat/sessions/:sessionId — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId)
  • PUT /api/chat/sessions/:sessionId/messages/:messageId — backend/src/routes/chat.ts (mount /api/chat, subpath /sessions/:sessionId/messages/:messageId)

Model management​

  • DELETE /api/ollama/models — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models)
  • GET /api/ollama/health — backend/src/routes/ollama.ts (mount /api/ollama, subpath /health)
  • GET /api/ollama/library — backend/src/routes/ollama.ts (mount /api/ollama, subpath /library)
  • GET /api/ollama/models — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models)
  • GET /api/ollama/models/:modelName/defaults — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/:modelName/defaults)
  • GET /api/ollama/models/access — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/access)
  • GET /api/ollama/models/pull-all/stream — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/pull-all/stream)
  • GET /api/ollama/models/show — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/show)
  • GET /api/ollama/pull/stream — backend/src/routes/ollama.ts (mount /api/ollama, subpath /pull/stream)
  • GET /api/ollama/running — backend/src/routes/ollama.ts (mount /api/ollama, subpath /running)
  • GET /api/ollama/version — backend/src/routes/ollama.ts (mount /api/ollama, subpath /version)
  • HEAD /api/ollama/blobs/:digest — backend/src/routes/ollama.ts (mount /api/ollama, subpath /blobs/:digest)
  • POST /api/ollama/blobs/:digest — backend/src/routes/ollama.ts (mount /api/ollama, subpath /blobs/:digest)
  • POST /api/ollama/chat — backend/src/routes/ollama.ts (mount /api/ollama, subpath /chat)
  • POST /api/ollama/chat/stream — backend/src/routes/ollama.ts (mount /api/ollama, subpath /chat/stream)
  • POST /api/ollama/embed — backend/src/routes/ollama.ts (mount /api/ollama, subpath /embed)
  • POST /api/ollama/embeddings — backend/src/routes/ollama.ts (mount /api/ollama, subpath /embeddings)
  • POST /api/ollama/models — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models)
  • POST /api/ollama/models/copy — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/copy)
  • POST /api/ollama/models/pull — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/pull)
  • POST /api/ollama/models/pull-all — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/pull-all)
  • POST /api/ollama/models/push — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/push)
  • POST /api/ollama/models/unload — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/unload)
  • POST /api/ollama/models/unload-all — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/unload-all)
  • PUT /api/ollama/models/access — backend/src/routes/ollama.ts (mount /api/ollama, subpath /models/access)
  • DELETE /api/plugins/:id — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id)
  • DELETE /api/plugins/:id/credentials — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/credentials)
  • DELETE /api/plugins/:id/variables — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/variables)
  • GET /api/plugins — backend/src/routes/plugins.ts (mount /api/plugins, subpath /)
  • GET /api/plugins/:id — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id)
  • GET /api/plugins/:id/credentials/check — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/credentials/check)
  • GET /api/plugins/:id/export — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/export)
  • GET /api/plugins/:id/variables — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/variables)
  • GET /api/plugins/active — backend/src/routes/plugins.ts (mount /api/plugins, subpath /active)
  • GET /api/plugins/active/current — backend/src/routes/plugins.ts (mount /api/plugins, subpath /active/current)
  • GET /api/plugins/credentials/all — backend/src/routes/plugins.ts (mount /api/plugins, subpath /credentials/all)
  • GET /api/plugins/status/all — backend/src/routes/plugins.ts (mount /api/plugins, subpath /status/all)
  • POST /api/plugins/:id/credentials — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/credentials)
  • POST /api/plugins/activate/:id — backend/src/routes/plugins.ts (mount /api/plugins, subpath /activate/:id)
  • POST /api/plugins/deactivate — backend/src/routes/plugins.ts (mount /api/plugins, subpath /deactivate)
  • POST /api/plugins/deactivate/:id — backend/src/routes/plugins.ts (mount /api/plugins, subpath /deactivate/:id)
  • POST /api/plugins/discover/:id — backend/src/routes/plugins.ts (mount /api/plugins, subpath /discover/:id)
  • POST /api/plugins/install — backend/src/routes/plugins.ts (mount /api/plugins, subpath /install)
  • POST /api/plugins/upload — backend/src/routes/plugins.ts (mount /api/plugins, subpath /upload)
  • PUT /api/plugins/:id — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id)
  • PUT /api/plugins/:id/variables — backend/src/routes/plugins.ts (mount /api/plugins, subpath /:id/variables)

Personas​

  • DELETE /api/personas/:id — backend/src/routes/personas.ts (mount /api/personas, subpath /:id)
  • GET /api/personas — backend/src/routes/personas.ts (mount /api/personas, subpath /)
  • GET /api/personas/:id — backend/src/routes/personas.ts (mount /api/personas, subpath /:id)
  • GET /api/personas/:id/backup — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/backup)
  • GET /api/personas/:id/download — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/download)
  • GET /api/personas/:id/export — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/export)
  • GET /api/personas/:id/export/dna — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/export/dna)
  • GET /api/personas/defaults/parameters — backend/src/routes/personas.ts (mount /api/personas, subpath /defaults/parameters)
  • GET /api/personas/stats/count — backend/src/routes/personas.ts (mount /api/personas, subpath /stats/count)
  • POST /api/personas — backend/src/routes/personas.ts (mount /api/personas, subpath /)
  • POST /api/personas/import — backend/src/routes/personas.ts (mount /api/personas, subpath /import)
  • PUT /api/personas/:id — backend/src/routes/personas.ts (mount /api/personas, subpath /:id)
  • DELETE /api/image-gen/gallery/:imageId — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /gallery/:imageId)
  • GET /api/image-gen/config/:pluginId — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /config/:pluginId)
  • GET /api/image-gen/gallery — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /gallery)
  • GET /api/image-gen/gallery/:imageId — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /gallery/:imageId)
  • GET /api/image-gen/models — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /models)
  • GET /api/image-gen/plugins — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /plugins)
  • POST /api/image-gen/generate — backend/src/routes/imageGen.ts (mount /api/image-gen, subpath /generate)
  • DELETE /api/media/gallery/:mediaId — backend/src/routes/media.ts (mount /api/media, subpath /gallery/:mediaId)
  • DELETE /api/media/video/jobs/:jobId — backend/src/routes/media.ts (mount /api/media, subpath /video/jobs/:jobId)
  • GET /api/media/gallery — backend/src/routes/media.ts (mount /api/media, subpath /gallery)
  • GET /api/media/gallery/:mediaId/content — backend/src/routes/media.ts (mount /api/media, subpath /gallery/:mediaId/content)
  • GET /api/media/models — backend/src/routes/media.ts (mount /api/media, subpath /models)
  • GET /api/media/video/jobs — backend/src/routes/media.ts (mount /api/media, subpath /video/jobs)
  • GET /api/media/video/jobs/:jobId — backend/src/routes/media.ts (mount /api/media, subpath /video/jobs/:jobId)
  • POST /api/media/audio/generate — backend/src/routes/media.ts (mount /api/media, subpath /audio/generate)
  • POST /api/media/audio/voice-clone — backend/src/routes/media.ts (mount /api/media, subpath /audio/voice-clone)
  • POST /api/media/sound/generate — backend/src/routes/media.ts (mount /api/media, subpath /sound/generate)
  • POST /api/media/video/generate — backend/src/routes/media.ts (mount /api/media, subpath /video/generate)
  • POST /api/media/video/jobs/:jobId/resume — backend/src/routes/media.ts (mount /api/media, subpath /video/jobs/:jobId/resume)

Notes​

  • DELETE /api/notes/:noteId — backend/src/routes/notes.ts (mount /api/notes, subpath /:noteId)
  • GET /api/notes — backend/src/routes/notes.ts (mount /api/notes, subpath /)
  • POST /api/notes — backend/src/routes/notes.ts (mount /api/notes, subpath /)
  • PUT /api/notes/:noteId — backend/src/routes/notes.ts (mount /api/notes, subpath /:noteId)

Work​

  • DELETE /api/work/policies/:id — backend/src/routes/work.ts (mount /api/work, subpath /policies/:id)
  • DELETE /api/work/tasks/:id — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id)
  • GET /api/work/access — backend/src/routes/work.ts (mount /api/work, subpath /access)
  • GET /api/work/admin/overview — backend/src/routes/work.ts (mount /api/work, subpath /admin/overview)
  • GET /api/work/capabilities — backend/src/routes/work.ts (mount /api/work, subpath /capabilities)
  • GET /api/work/policies — backend/src/routes/work.ts (mount /api/work, subpath /policies)
  • GET /api/work/tasks — backend/src/routes/work.ts (mount /api/work, subpath /tasks)
  • GET /api/work/tasks/:id — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id)
  • GET /api/work/tasks/:id/file — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/file)
  • GET /api/work/tasks/:id/files — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/files)
  • GET /api/work/tasks/:id/git — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git)
  • GET /api/work/tasks/:id/git/diff — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git/diff)
  • GET /api/work/tasks/:id/messages — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/messages)
  • GET /api/work/tasks/:taskId/runs/:runId/events — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:taskId/runs/:runId/events)
  • PATCH /api/work/tasks/:id — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id)
  • POST /api/work/policies — backend/src/routes/work.ts (mount /api/work, subpath /policies)
  • POST /api/work/tasks — backend/src/routes/work.ts (mount /api/work, subpath /tasks)
  • POST /api/work/tasks/:id/cancel — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/cancel)
  • POST /api/work/tasks/:id/git/branches — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git/branches)
  • POST /api/work/tasks/:id/git/commit — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git/commit)
  • POST /api/work/tasks/:id/git/init — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git/init)
  • POST /api/work/tasks/:id/git/stage — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git/stage)
  • POST /api/work/tasks/:id/git/switch — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/git/switch)
  • POST /api/work/tasks/:id/preview/start — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/preview/start)
  • POST /api/work/tasks/:id/preview/stop — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/preview/stop)
  • POST /api/work/tasks/:id/runs — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/runs)
  • PUT /api/work/access — backend/src/routes/work.ts (mount /api/work, subpath /access)
  • PUT /api/work/policies/:id — backend/src/routes/work.ts (mount /api/work, subpath /policies/:id)
  • PUT /api/work/tasks/:id/file — backend/src/routes/work.ts (mount /api/work, subpath /tasks/:id/file)

Agent CLI models​

  • GET /api/agent-clis/models — backend/src/routes/agentCli.ts (mount /api/agent-clis, subpath /models)

Artifacts​

  • GET /api/artifacts/sandbox — backend/src/routes/artifacts.ts (mount /api/artifacts, subpath /sandbox)

Provider usage​

  • GET /api/plugins/usage — backend/src/routes/plugins.ts (mount /api/plugins, subpath /usage)

System diagnostics​

  • GET /health — backend/src/routes/health.ts (mount /health, subpath /)
  • GET /health/deep — backend/src/routes/health.ts (mount /health, subpath /deep)
  • GET /health/live — backend/src/routes/health.ts (mount /health, subpath /live)
  • GET /health/ready — backend/src/routes/health.ts (mount /health, subpath /ready)
  • GET /api/system — backend/src/routes/systemDiagnostics.ts (mount /api/system, subpath /)

User administration​

  • DELETE /api/users/:id — backend/src/routes/users.ts (mount /api/users, subpath /:id)
  • GET /api/users — backend/src/routes/users.ts (mount /api/users, subpath /)
  • GET /api/users/pending-approvals — backend/src/routes/users.ts (mount /api/users, subpath /pending-approvals)
  • PATCH /api/users/:id — backend/src/routes/users.ts (mount /api/users, subpath /:id)
  • PATCH /api/users/:id/approve — backend/src/routes/users.ts (mount /api/users, subpath /:id/approve)
  • PATCH /api/users/me/avatar — backend/src/routes/users.ts (mount /api/users, subpath /me/avatar)
  • POST /api/users — backend/src/routes/users.ts (mount /api/users, subpath /)

Authentication​

  • DELETE /api/auth/sessions/:id — backend/src/routes/auth.ts (mount /api/auth, subpath /sessions/:id)
  • DELETE /api/auth/tokens/:id — backend/src/routes/auth.ts (mount /api/auth, subpath /tokens/:id)
  • GET /api/auth/encryption-key — backend/src/routes/auth.ts (mount /api/auth, subpath /encryption-key)
  • GET /api/auth/me — backend/src/routes/auth.ts (mount /api/auth, subpath /me)
  • GET /api/auth/oauth/github — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/github)
  • GET /api/auth/oauth/github/callback — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/github/callback)
  • GET /api/auth/oauth/github/status — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/github/status)
  • GET /api/auth/oauth/huggingface — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/huggingface)
  • GET /api/auth/oauth/huggingface/callback — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/huggingface/callback)
  • GET /api/auth/oauth/huggingface/status — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/huggingface/status)
  • GET /api/auth/oauth/oidc — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/oidc)
  • GET /api/auth/oauth/oidc/callback — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/oidc/callback)
  • GET /api/auth/oauth/oidc/status — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/oidc/status)
  • GET /api/auth/sessions — backend/src/routes/auth.ts (mount /api/auth, subpath /sessions)
  • GET /api/auth/system-info — backend/src/routes/auth.ts (mount /api/auth, subpath /system-info)
  • GET /api/auth/tokens — backend/src/routes/auth.ts (mount /api/auth, subpath /tokens)
  • GET /api/auth/verify — backend/src/routes/auth.ts (mount /api/auth, subpath /verify)
  • POST /api/auth/login — backend/src/routes/auth.ts (mount /api/auth, subpath /login)
  • POST /api/auth/logout — backend/src/routes/auth.ts (mount /api/auth, subpath /logout)
  • POST /api/auth/oauth/exchange — backend/src/routes/auth.ts (mount /api/auth, subpath /oauth/exchange)
  • POST /api/auth/sessions/revoke-others — backend/src/routes/auth.ts (mount /api/auth, subpath /sessions/revoke-others)
  • POST /api/auth/signup — backend/src/routes/auth.ts (mount /api/auth, subpath /signup)
  • POST /api/auth/tokens — backend/src/routes/auth.ts (mount /api/auth, subpath /tokens)
  • POST /api/auth/websocket-ticket — backend/src/routes/auth.ts (mount /api/auth, subpath /websocket-ticket)

Access Control​

  • DELETE /api/access/grants/:id — backend/src/routes/access.ts (mount /api/access, subpath /grants/:id)
  • GET /api/access/grants — backend/src/routes/access.ts (mount /api/access, subpath /grants)
  • GET /api/access/shared-with-me — backend/src/routes/access.ts (mount /api/access, subpath /shared-with-me)
  • POST /api/access/grants — backend/src/routes/access.ts (mount /api/access, subpath /grants)
  • GET /api/audit — backend/src/routes/audit.ts (mount /api/audit, subpath /)
  • DELETE /api/groups/:id — backend/src/routes/groups.ts (mount /api/groups, subpath /:id)
  • DELETE /api/groups/:id/members/:userId — backend/src/routes/groups.ts (mount /api/groups, subpath /:id/members/:userId)
  • GET /api/groups — backend/src/routes/groups.ts (mount /api/groups, subpath /)
  • GET /api/groups/effective/:userId — backend/src/routes/groups.ts (mount /api/groups, subpath /effective/:userId)
  • PATCH /api/groups/:id — backend/src/routes/groups.ts (mount /api/groups, subpath /:id)
  • POST /api/groups — backend/src/routes/groups.ts (mount /api/groups, subpath /)
  • POST /api/groups/:id/members — backend/src/routes/groups.ts (mount /api/groups, subpath /:id/members)

Data portability​

  • GET /api/preferences/export — backend/src/routes/preferences.ts (mount /api/preferences, subpath /export)
  • POST /api/preferences/import — backend/src/routes/preferences.ts (mount /api/preferences, subpath /import)
  • POST /api/preferences/import/preflight — backend/src/routes/preferences.ts (mount /api/preferences, subpath /import/preflight)

Document knowledge and retrieval​

  • DELETE /api/documents/:documentId — backend/src/routes/documents.ts (mount /api/documents, subpath /:documentId)
  • DELETE /api/documents/collections/:collectionId — backend/src/routes/documents.ts (mount /api/documents, subpath /collections/:collectionId)
  • GET /api/documents — backend/src/routes/documents.ts (mount /api/documents, subpath /)
  • GET /api/documents/:documentId — backend/src/routes/documents.ts (mount /api/documents, subpath /:documentId)
  • GET /api/documents/:documentId/source — backend/src/routes/documents.ts (mount /api/documents, subpath /:documentId/source)
  • GET /api/documents/collections — backend/src/routes/documents.ts (mount /api/documents, subpath /collections)
  • GET /api/documents/embeddings/status — backend/src/routes/documents.ts (mount /api/documents, subpath /embeddings/status)
  • GET /api/documents/session/:sessionId — backend/src/routes/documents.ts (mount /api/documents, subpath /session/:sessionId)
  • POST /api/documents/collections — backend/src/routes/documents.ts (mount /api/documents, subpath /collections)
  • POST /api/documents/embeddings/regenerate — backend/src/routes/documents.ts (mount /api/documents, subpath /embeddings/regenerate)
  • POST /api/documents/fetch-url — backend/src/routes/documents.ts (mount /api/documents, subpath /fetch-url)
  • POST /api/documents/search — backend/src/routes/documents.ts (mount /api/documents, subpath /search)
  • POST /api/documents/upload — backend/src/routes/documents.ts (mount /api/documents, subpath /upload)
  • PUT /api/documents/:documentId/collection — backend/src/routes/documents.ts (mount /api/documents, subpath /:documentId/collection)
  • GET /api/embeddings/models — backend/src/routes/embeddings.ts (mount /api/embeddings, subpath /models)

Persona memory​

  • DELETE /api/personas/:id/memory — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/memory)
  • GET /api/personas/:id/memory/core — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/memory/core)
  • GET /api/personas/:id/memory/stats — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/memory/stats)
  • GET /api/personas/:id/memory/status — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/memory/status)
  • POST /api/personas/:id/memory/consolidate — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/memory/consolidate)
  • POST /api/personas/:id/memory/decay — backend/src/routes/personas.ts (mount /api/personas, subpath /:id/memory/decay)
  • GET /api/search/access — backend/src/routes/search.ts (mount /api/search, subpath /access)
  • GET /api/search/config — backend/src/routes/search.ts (mount /api/search, subpath /config)
  • POST /api/search/test — backend/src/routes/search.ts (mount /api/search, subpath /test)
  • PUT /api/search/access — backend/src/routes/search.ts (mount /api/search, subpath /access)
  • PUT /api/search/config — backend/src/routes/search.ts (mount /api/search, subpath /config)

Settings and preferences​

  • GET /api/preferences — backend/src/routes/preferences.ts (mount /api/preferences, subpath /)
  • POST /api/preferences/embedding-settings/reset — backend/src/routes/preferences.ts (mount /api/preferences, subpath /embedding-settings/reset)
  • POST /api/preferences/generation-options/reset — backend/src/routes/preferences.ts (mount /api/preferences, subpath /generation-options/reset)
  • PUT /api/preferences — backend/src/routes/preferences.ts (mount /api/preferences, subpath /)
  • PUT /api/preferences/default-model — backend/src/routes/preferences.ts (mount /api/preferences, subpath /default-model)
  • PUT /api/preferences/embedding-settings — backend/src/routes/preferences.ts (mount /api/preferences, subpath /embedding-settings)
  • PUT /api/preferences/generation-options — backend/src/routes/preferences.ts (mount /api/preferences, subpath /generation-options)
  • PUT /api/preferences/model-generation-options — backend/src/routes/preferences.ts (mount /api/preferences, subpath /model-generation-options)
  • PUT /api/preferences/system-message — backend/src/routes/preferences.ts (mount /api/preferences, subpath /system-message)

Speech input and output​

  • GET /api/stt/models — backend/src/routes/stt.ts (mount /api/stt, subpath /models)
  • POST /api/stt/transcribe — backend/src/routes/stt.ts (mount /api/stt, subpath /transcribe)
  • DELETE /api/tts/voice-profiles/:profileId — backend/src/routes/tts.ts (mount /api/tts, subpath /voice-profiles/:profileId)
  • GET /api/tts/models — backend/src/routes/tts.ts (mount /api/tts, subpath /models)
  • GET /api/tts/plugins — backend/src/routes/tts.ts (mount /api/tts, subpath /plugins)
  • GET /api/tts/voice-profiles — backend/src/routes/tts.ts (mount /api/tts, subpath /voice-profiles)
  • GET /api/tts/voices/:pluginId — backend/src/routes/tts.ts (mount /api/tts, subpath /voices/:pluginId)
  • POST /api/tts/generate — backend/src/routes/tts.ts (mount /api/tts, subpath /generate)
  • POST /api/tts/generate-base64 — backend/src/routes/tts.ts (mount /api/tts, subpath /generate-base64)
  • POST /api/tts/voice-clone — backend/src/routes/tts.ts (mount /api/tts, subpath /voice-clone)

Hugging Face Hub​

  • GET /api/huggingface-hub/models — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /models)
  • GET /api/huggingface-hub/models/:author/:modelName — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /models/:author/:modelName)
  • GET /api/huggingface-hub/models/:author/:modelName/gguf — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /models/:author/:modelName/gguf)
  • GET /api/huggingface-hub/models/:author/:modelName/has-gguf — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /models/:author/:modelName/has-gguf)
  • GET /api/huggingface-hub/tasks — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /tasks)
  • GET /api/huggingface-hub/trending — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /trending)
  • POST /api/huggingface-hub/cache/clear — backend/src/routes/huggingfaceHub.ts (mount /api/huggingface-hub, subpath /cache/clear)

Libre Claw​

  • DELETE /api/libre-claw/automations/:automationId — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId)
  • GET /api/libre-claw/access — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /access)
  • GET /api/libre-claw/automations — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations)
  • GET /api/libre-claw/automations/:automationId — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId)
  • GET /api/libre-claw/config/fallback — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /config/fallback)
  • GET /api/libre-claw/config/model — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /config/model)
  • GET /api/libre-claw/dashboard — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /dashboard)
  • GET /api/libre-claw/health — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /health)
  • GET /api/libre-claw/runs — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /runs)
  • GET /api/libre-claw/runs/:runId — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /runs/:runId)
  • GET /api/libre-claw/runs/:runId/events — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /runs/:runId/events)
  • GET /api/libre-claw/status — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /status)
  • GET /api/libre-claw/usage — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /usage)
  • PATCH /api/libre-claw/automations/:automationId — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId)
  • PATCH /api/libre-claw/config/fallback — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /config/fallback)
  • PATCH /api/libre-claw/config/model — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /config/model)
  • PATCH /api/libre-claw/config/theme — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /config/theme)
  • POST /api/libre-claw/automations — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations)
  • POST /api/libre-claw/automations/:automationId/pause — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId/pause)
  • POST /api/libre-claw/automations/:automationId/resume — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId/resume)
  • POST /api/libre-claw/automations/:automationId/run — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId/run)
  • POST /api/libre-claw/runs — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /runs)
  • POST /api/libre-claw/runs/:runId/cancel — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /runs/:runId/cancel)
  • POST /api/libre-claw/runs/:runId/permissions/:toolCallId — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /runs/:runId/permissions/:toolCallId)
  • PUT /api/libre-claw/access — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /access)
  • PUT /api/libre-claw/automations/:automationId — backend/src/routes/libreClaw.ts (mount /api/libre-claw, subpath /automations/:automationId)

Durable jobs and events​

  • GET /api/jobs — backend/src/routes/jobs.ts (mount /api/jobs, subpath /)
  • GET /api/jobs/:jobId — backend/src/routes/jobs.ts (mount /api/jobs, subpath /:jobId)
  • GET /api/jobs/:jobId/events — backend/src/routes/jobs.ts (mount /api/jobs, subpath /:jobId/events)
  • POST /api/jobs/:jobId/cancel — backend/src/routes/jobs.ts (mount /api/jobs, subpath /:jobId/cancel)

Solo and team deployment profiles​

No mounted Express endpoint. The executable boundary is the UI and/or source evidence recorded above.

Recovery and backup​

No mounted Express endpoint. The executable boundary is the UI and/or source evidence recorded above.

Exact WebSocket route inventory​

  • WEBSOCKET /ws — Chat, backend/src/websocketServer.ts; authentication evidence: backend/src/websocketServer.ts, scripts/test-websocket-tickets.mjs
  • WEBSOCKET /ws/work-terminal — Work, backend/src/websocketServer.ts; authentication evidence: backend/src/workTerminalServer.ts, scripts/test-websocket-tickets.mjs

Enforcement boundary​

The package gate parses TypeScript/JavaScript source, resolves every imported Express router to its literal application mount, and reconciles every literal router method/path declaration and WebSocket upgrade pathname one-for-one with this inventory. It fails on an unmounted route file, an unsupported router.route() builder, a dynamic route path, a missing or duplicate endpoint owner, missing WebSocket authentication evidence, a changed UI route, missing schema/manifest/default applicability, stale evidence, or a stale generated document.

Focused-test evidence is scoped to one exact named test(...) declaration and at least two behavior patterns inside that test body. Backend tests must be exact file arguments to test:package; Playwright specs must match normal discovery. The gate also proves that both runners execute in the normal pull-request and dev/main Format & Lint workflow.