resources

src/servers/api/integrations/integrations.ts

@@ -106,6 +106,7 @@ integrationsRouter.get('/google/status', async (ctx) => {
     configured: !!(config?.clientId && config?.clientSecret),
     connected: !!connection?.accessToken,
     email: connection?.email ?? null,
+    picture: connection?.picture ?? null,
   });
 });
 
@@ -201,9 +202,11 @@ export const googleCallbackHandler = async (ctx: any) => {
   });
 
   let googleEmail = email;
+  let picture: string | null = null;
   if (userinfoResponse.ok) {
     const userinfo = await userinfoResponse.json();
     googleEmail = userinfo.email ?? email;
+    picture = userinfo.picture ?? null;
   }
 
   await writeUserGoogle(email, {
@@ -211,6 +214,7 @@ export const googleCallbackHandler = async (ctx: any) => {
     refreshToken: tokens.refresh_token,
     expiresAt: Date.now() + tokens.expires_in * 1000,
     email: googleEmail,
+    picture,
     scope: tokens.scope,
   });
 

src/servers/api/pi/pi-bridge.ts

@@ -1,12 +1,13 @@
 import { join, relative } from "path";
-import { readdirSync, existsSync, mkdirSync } from "node:fs";
+import { readdirSync, existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
 import type { Subprocess } from "bun";
 import type { PiEvent, MessageCost } from "./types";
 import { readApiKeys } from "../server-settings/pi-mono";
 import { readSearxngConfig } from "../server-settings/searxng";
-import { PI_CONFIG_DIR, getGlobalSkillsDir, getUserSkillsDir, getGlobalExtensionsDir, getUserExtensionsDir, getGlobalToolsDir, getUserToolsDir } from "../../data-path";
+import { PI_CONFIG_DIR, DATA_PATH, getGlobalSkillsDir, getUserSkillsDir, getGlobalExtensionsDir, getUserExtensionsDir, getGlobalToolsDir, getUserToolsDir, getNativeResourcesDir, getGlobalResourcesDir } from "../../data-path";
 import { ensureDockerContainer } from "../terminal/websocket";
 import { logger } from "./logger";
+import { parseFrontmatter } from "../skills/skills";
 
 export type PiEventHandler = (event: PiEvent) => void;
 
@@ -52,6 +53,106 @@ function collectExtensionFlags(email: string, containerPaths?: PathOverrides): s
   return flags;
 }
 
+function generateResourceSkill(outputDir: string): string | null {
+  const nativeDir = getNativeResourcesDir();
+  const globalDir = getGlobalResourcesDir();
+
+  // Collect all resource dirs (global overrides native)
+  const resourceDirs = new Map<string, string>();
+  for (const dir of [nativeDir, globalDir]) {
+    if (!existsSync(dir)) continue;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      if (existsSync(join(dir, entry.name, 'RESOURCE.md'))) {
+        resourceDirs.set(entry.name, dir);
+      }
+    }
+  }
+
+  if (resourceDirs.size === 0) return null;
+
+  const sections: string[] = [];
+  for (const [name, baseDir] of resourceDirs) {
+    const resourceMd = join(baseDir, name, 'RESOURCE.md');
+    let mdContent = '';
+    try { mdContent = readFileSync(resourceMd, 'utf-8'); } catch { continue; }
+    const { frontmatter } = parseFrontmatter(mdContent);
+
+    // Merge native + global config
+    let nativeConfig: Record<string, string> = {};
+    let globalConfig: Record<string, string> = {};
+    try { nativeConfig = JSON.parse(readFileSync(join(nativeDir, name, 'config.json'), 'utf-8')); } catch {}
+    try { globalConfig = JSON.parse(readFileSync(join(globalDir, name, 'config.json'), 'utf-8')); } catch {}
+
+    const config: Record<string, string> = {};
+    for (const key of Object.keys(nativeConfig)) config[key] = globalConfig[key] ?? nativeConfig[key]!;
+    for (const key of Object.keys(globalConfig)) if (!(key in config)) config[key] = globalConfig[key]!;
+
+    const hasValues = Object.values(config).some((v) => v !== '');
+    const configLines = Object.entries(config)
+      .filter(([, v]) => v)
+      .map(([k, v]) => /key|secret|password|token/i.test(k) ? `- **${k}**: (configured)` : `- **${k}**: ${v}`);
+
+    sections.push([
+      `### ${frontmatter.name || name}`,
+      hasValues ? 'Status: **configured**' : 'Status: not configured',
+      ...configLines,
+    ].join('\n'));
+  }
+
+  const skillContent = [
+    '---',
+    'name: Available Resources',
+    'description: External services and APIs configured on this Officer instance',
+    '---',
+    '',
+    'These are external services available to you. Use their configured URLs directly via HTTP requests.',
+    'Do NOT try to install local alternatives (like tesseract, whisper, etc.) — use the configured HTTP APIs instead.',
+    '',
+    ...sections,
+  ].join('\n');
+
+  const skillDir = join(outputDir, '.generated', 'available-resources');
+  mkdirSync(skillDir, { recursive: true });
+  writeFileSync(join(skillDir, 'SKILL.md'), skillContent, 'utf-8');
+  return skillDir;
+}
+
+function buildResourcesEnv(): string {
+  const nativeDir = getNativeResourcesDir();
+  const globalDir = getGlobalResourcesDir();
+
+  const resourceDirs = new Map<string, string>();
+  for (const dir of [nativeDir, globalDir]) {
+    if (!existsSync(dir)) continue;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      if (existsSync(join(dir, entry.name, 'RESOURCE.md')) || existsSync(join(dir, entry.name, 'config.json'))) {
+        resourceDirs.set(entry.name, dir);
+      }
+    }
+  }
+
+  const result: Record<string, Record<string, string>> = {};
+  for (const [name] of resourceDirs) {
+    let nativeConfig: Record<string, string> = {};
+    let globalConfig: Record<string, string> = {};
+    try { nativeConfig = JSON.parse(readFileSync(join(nativeDir, name, 'config.json'), 'utf-8')); } catch {}
+    try { globalConfig = JSON.parse(readFileSync(join(globalDir, name, 'config.json'), 'utf-8')); } catch {}
+
+    const config: Record<string, string> = {};
+    for (const key of Object.keys(nativeConfig)) config[key] = globalConfig[key] ?? nativeConfig[key]!;
+    for (const key of Object.keys(globalConfig)) if (!(key in config)) config[key] = globalConfig[key]!;
+
+    // Only include resources that have at least one non-empty value
+    if (Object.values(config).some((v) => v !== '')) {
+      result[name] = config;
+    }
+  }
+
+  return JSON.stringify(result);
+}
+
 type SandboxOptions = {
   userId: number;
   username: string;
@@ -87,19 +188,27 @@ export async function spawnPi(
       user: '/officer/user/extensions',
     });
 
+    // Generate resource context skill (host-side, mounted into container)
+    const resourceSkillHost = generateResourceSkill(DATA_PATH);
+    const resourceSkillFlags = resourceSkillHost ? ['--skill', '/officer/generated/available-resources'] : [];
+
     const piArgs = [
       'pi', '--mode', 'rpc',
       '--no-skills', '--no-prompt-templates', '--no-themes',
       ...skillFlags,
       ...extensionFlags,
+      ...resourceSkillFlags,
     ];
     if (model) piArgs.push('--model', model);
 
+    const resourcesEnv = buildResourcesEnv();
+
     const envFlags = [
       '-e', `PI_CODING_AGENT_DIR=${containerPiConfig}`,
       '-e', `HOME=${containerHome}`,
       '-e', `PI_TOOLS_DIRS=/officer/tools:/officer/user/tools`,
       '-e', `PI_SEARXNG_URL=${searxng.url}`,
+      '-e', `OFFICER_RESOURCES=${resourcesEnv}`,
     ];
     for (const [key, value] of Object.entries(storedKeys)) {
       if (value?.trim()) envFlags.push('-e', `${key}=${value.trim()}`);
@@ -130,7 +239,12 @@ export async function spawnPi(
     const searxng = await readSearxngConfig();
     const skillFlags = collectSkillFlags(email);
     const extensionFlags = collectExtensionFlags(email);
-    const args = ['pi', '--mode', 'rpc', '--no-skills', '--no-prompt-templates', '--no-themes', ...skillFlags, ...extensionFlags];
+
+    // Generate resource context skill
+    const resourceSkillDir = generateResourceSkill(DATA_PATH);
+    const resourceSkillFlags = resourceSkillDir ? ['--skill', resourceSkillDir] : [];
+
+    const args = ['pi', '--mode', 'rpc', '--no-skills', '--no-prompt-templates', '--no-themes', ...skillFlags, ...extensionFlags, ...resourceSkillFlags];
     if (model) args.push('--model', model);
 
     if (!existsSync(cwd)) {
@@ -144,7 +258,7 @@ export async function spawnPi(
       stdin: 'pipe',
       stdout: 'pipe',
       stderr: 'pipe',
-      env: { ...process.env, ...storedKeys, PI_CODING_AGENT_DIR: PI_CONFIG_DIR, PI_TOOLS_DIRS: toolsDirs, PI_SEARXNG_URL: searxng.url },
+      env: { ...process.env, ...storedKeys, PI_CODING_AGENT_DIR: PI_CONFIG_DIR, PI_TOOLS_DIRS: toolsDirs, PI_SEARXNG_URL: searxng.url, OFFICER_RESOURCES: buildResourcesEnv() },
     });
 
     logger.info('Spawned Pi locally', {

src/servers/api/server-settings/ocr.ts

@@ -1,5 +1,6 @@
 import { createRouter } from '../../create-router';
 import { settingsPath } from './server-settings';
+import { readResourceConfig } from './resources';
 
 type OcrConfig = {
   url: string;
@@ -7,6 +8,9 @@ type OcrConfig = {
 };
 
 export async function readOcrConfig(): Promise<OcrConfig | undefined> {
+  const config = await readResourceConfig('optical-character-recognition');
+  if (config.url) return { url: config.url, model: config.model ?? '' };
+  // Fallback to legacy settings.json
   const settings = await Bun.file(settingsPath).json().catch(() => ({}));
   return settings.ocr as OcrConfig | undefined;
 }

src/servers/api/server-settings/resources.ts

@@ -1,259 +1,224 @@
-import { readdir, mkdir } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { readdir, mkdir, rm } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
 import { createRouter } from '../../create-router';
-import { DATA_PATH, getResourcesDir } from '../../data-path';
+import { getNativeResourcesDir, getGlobalResourcesDir } from '../../data-path';
+import { parseFrontmatter } from '../skills/skills';
 
-type ResourceCredentials = {
-  apiKey?: string;
-  username?: string;
-  password?: string;
-};
-
-export type ResourceConnectionConfig = {
-  url: string;
-  credentials?: ResourceCredentials;
-};
-
-type ResourcesConfig = Record<string, ResourceConnectionConfig>;
-
-type Resource = {
-  id: string;
-  name: string;
-  subtitle: string;
-  type: string;
-  port: string | null;
-  path: string | null;
-  description: string;
-  installCommand: string | null;
-  uninstallCommand: string | null;
-  manageCommand: string | null;
-  verifyCommand: string | null;
-  updateCommand: string | null;
-  installed: boolean;
-  version: string | null;
-  connectionConfig: ResourceConnectionConfig | null;
-};
-
-const stripBackticks = (value: string) => value.replace(/^`(.+)`$/, '$1');
-
-const resolveCommand = (command: string): string => {
-  return command.replace(/\$DATA_PATH/g, DATA_PATH);
-};
-
-function parseResourceFile(
-  filename: string,
-  content: string,
-): Omit<Resource, 'installed' | 'version' | 'connectionConfig'> {
-  const id = filename
-    .replace(/^SERVICE_/, '')
-    .replace(/\.md$/, '')
-    .toLowerCase()
-    .replace(/_/g, '-');
-
-  const headingMatch = content.match(/^#\s+(.+?)\s+—\s+(.+)$/m);
-  const name = headingMatch?.[1] ?? id;
-  const subtitle = headingMatch?.[2] ?? '';
-
-  const field = (key: string): string | null => {
-    const match = content.match(new RegExp(`^-\\s+\\*\\*${key}:\\*\\*\\s+(.+)$`, 'm'));
-    return match?.[1]?.trim() ?? null;
-  };
-
-  const rawType = field('Type') ?? 'native';
-  const rawPort = field('Port');
-  const port = rawPort && !rawPort.startsWith('none') ? rawPort : null;
-
-  const rawPath = field('Path');
-
-  return {
-    id,
-    name,
-    subtitle,
-    type: rawType,
-    port,
-    path: rawPath ? stripBackticks(rawPath) : null,
-    description: field('Description') ?? '',
-    installCommand: field('Install') ? resolveCommand(stripBackticks(field('Install')!)) : null,
-    uninstallCommand: field('Uninstall') ? resolveCommand(stripBackticks(field('Uninstall')!)) : null,
-    manageCommand: field('Manage') ? resolveCommand(stripBackticks(field('Manage')!)) : null,
-    verifyCommand: field('Verify') ? resolveCommand(stripBackticks(field('Verify')!)) : null,
-    updateCommand: field('Update') ? resolveCommand(stripBackticks(field('Update')!)) : null,
-  };
+async function readResourceDirs(dir: string): Promise<Map<string, string>> {
+  const result = new Map<string, string>();
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const resourceFile = join(dir, entry.name, 'RESOURCE.md');
+      if (await Bun.file(resourceFile).exists()) {
+        result.set(entry.name, resourceFile);
+      }
+    }
+  } catch {
+    // directory doesn't exist yet
+  }
+  return result;
 }
 
-const CONFIG_FILENAME = 'resources-config.json';
-
-const getConfigPath = () => join(getResourcesDir(), CONFIG_FILENAME);
-
-export async function readConfig(): Promise<ResourcesConfig> {
-  const path = getConfigPath();
-  if (!existsSync(path)) return {};
-  const text = await Bun.file(path).text();
-  return JSON.parse(text) as ResourcesConfig;
+async function readConfigFile(dir: string): Promise<Record<string, string>> {
+  try {
+    return await Bun.file(join(dir, 'config.json')).json();
+  } catch {
+    return {};
+  }
 }
 
-async function writeConfig(config: ResourcesConfig): Promise<void> {
-  const dir = getResourcesDir();
-  if (!existsSync(dir)) await mkdir(dir, { recursive: true });
-  await Bun.write(getConfigPath(), JSON.stringify(config, null, 2));
+function mergeConfig(native: Record<string, string>, global: Record<string, string>): Record<string, string> {
+  const merged: Record<string, string> = {};
+  for (const key of Object.keys(native)) {
+    merged[key] = global[key] ?? native[key]!;
+  }
+  for (const key of Object.keys(global)) {
+    if (!(key in merged)) merged[key] = global[key]!;
+  }
+  return merged;
+}
+
+function isPrivileged(role: string) {
+  return role === 'Admin' || role === 'Owner' || role === 'Super Admin';
+}
+
+export async function readResourceConfig(name: string): Promise<Record<string, string>> {
+  const nativeConfig = await readConfigFile(join(getNativeResourcesDir(), name));
+  const globalConfig = await readConfigFile(join(getGlobalResourcesDir(), name));
+  return mergeConfig(nativeConfig, globalConfig);
 }
 
 const CHECK_TIMEOUT_MS = 3_000;
 
-async function checkPort(port: number): Promise<boolean> {
-  try {
-    const socket = await Bun.connect({
-      hostname: '127.0.0.1',
-      port,
-      socket: {
-        data() {},
-        open(s) {
-          s.end();
-        },
-        error() {},
-      },
-    });
-    socket.end();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function checkVerifyCommand(command: string): Promise<{ installed: boolean; version: string | null }> {
-  try {
-    const proc = Bun.spawn(['sh', '-c', command], { stdout: 'pipe', stderr: 'pipe' });
-    const timeout = new Promise<never>((_, reject) =>
-      setTimeout(() => {
-        proc.kill();
-        reject(new Error('timeout'));
-      }, CHECK_TIMEOUT_MS),
-    );
-    const result = Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
-    const [stdout, stderr] = await Promise.race([result, timeout]);
-    if (proc.exitCode !== 0) return { installed: false, version: null };
-    const output = (stdout + stderr).trim();
-    const versionMatch = output.match(/(\d+\.\d+[\w.-]*)/);
-    return { installed: true, version: versionMatch?.[1] ?? null };
-  } catch {
-    return { installed: false, version: null };
-  }
-}
-
-function extractFirstPort(portStr: string): number | null {
-  const match = portStr.match(/(\d+)/);
-  return match ? parseInt(match[1]!, 10) : null;
-}
-
-async function checkUrl(url: string): Promise<boolean> {
-  try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS);
-    await fetch(url, { signal: controller.signal });
-    clearTimeout(timeout);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-type CheckResourceStatusParams = {
-  resource: Omit<Resource, 'installed' | 'version' | 'connectionConfig'>;
-  configUrl?: string;
-};
-
-async function checkResourceStatus({
-  resource,
-  configUrl,
-}: CheckResourceStatusParams): Promise<{ installed: boolean; version: string | null }> {
-  if (resource.path) {
-    const fullPath = `${getResourcesDir()}/${resource.path}`;
-    return { installed: existsSync(fullPath), version: null };
-  }
-  if (resource.port) {
-    if (configUrl) {
-      const reachable = await checkUrl(configUrl);
-      if (reachable) return { installed: true, version: null };
-    }
-    const port = extractFirstPort(resource.port);
-    if (port) {
-      const reachable = await checkPort(port);
-      return { installed: reachable, version: null };
-    }
-  }
-  if (resource.verifyCommand) {
-    return checkVerifyCommand(resource.verifyCommand);
-  }
-  return { installed: false, version: null };
-}
-
-function buildConnectionConfig(
-  resource: Omit<Resource, 'installed' | 'version' | 'connectionConfig'>,
-  config: ResourcesConfig,
-): ResourceConnectionConfig | null {
-  if (!resource.port) return null;
-  if (config[resource.id]) return config[resource.id]!;
-  const port = extractFirstPort(resource.port);
-  return { url: `http://127.0.0.1:${port ?? resource.port}` };
-}
-
-async function parseResources() {
-  const dir = getResourcesDir();
-  if (!existsSync(dir)) return [];
-  const files = await readdir(dir);
-  const serviceFiles = files.filter((f) => f.startsWith('SERVICE_') && f.endsWith('.md'));
-  return Promise.all(
-    serviceFiles.map(async (filename) => {
-      const content = await Bun.file(`${dir}/${filename}`).text();
-      return parseResourceFile(filename, content);
-    }),
-  );
-}
-
-async function loadResources(): Promise<Resource[]> {
-  const [parsed, config] = await Promise.all([parseResources(), readConfig()]);
-  return Promise.all(
-    parsed.map(async (r) => {
-      const configUrl = config[r.id]?.url;
-      const status = await checkResourceStatus({ resource: r, configUrl });
-      const connectionConfig = buildConnectionConfig(r, config);
-      return { ...r, ...status, connectionConfig };
-    }),
-  );
-}
-
 export const resourcesRouter = createRouter();
 
 resourcesRouter.get('/', async (ctx) => {
-  const resources = await loadResources();
+  const nativeResources = await readResourceDirs(getNativeResourcesDir());
+  const globalResources = await readResourceDirs(getGlobalResourcesDir());
+
+  const merged = new Map(nativeResources);
+  for (const [name, path] of globalResources) merged.set(name, path);
+
+  const resources = await Promise.all(
+    Array.from(merged.entries()).map(async ([dirName, filePath]) => {
+      const raw = await Bun.file(filePath).text();
+      const { frontmatter } = parseFrontmatter(raw);
+      const scope = globalResources.has(dirName) && !nativeResources.has(dirName) ? 'global' as const : nativeResources.has(dirName) ? 'native' as const : 'global' as const;
+      const config = await readResourceConfig(dirName);
+      return { dirName, name: frontmatter.name || dirName, description: frontmatter.description, scope, config };
+    }),
+  );
+
   return ctx.json(resources);
 });
 
-resourcesRouter.get('/config', async (ctx) => {
-  const config = await readConfig();
-  return ctx.json(config);
+resourcesRouter.get('/:name', async (ctx) => {
+  const name = ctx.req.param('name');
+
+  const nativeResources = await readResourceDirs(getNativeResourcesDir());
+  const globalResources = await readResourceDirs(getGlobalResourcesDir());
+
+  const filePath = globalResources.get(name) ?? nativeResources.get(name);
+  if (!filePath) return ctx.text('Not found', 404);
+
+  const scope = globalResources.has(name) && !nativeResources.has(name) ? 'global' as const : 'native' as const;
+  const raw = await Bun.file(filePath).text();
+  const { frontmatter, body, rawYaml } = parseFrontmatter(raw);
+  const config = await readResourceConfig(name);
+
+  const globalConfigPath = join(getGlobalResourcesDir(), name, 'config.json');
+  const chatMeta = join(dirname(filePath), 'chat', 'meta.json');
+  const chatSessionId = await Bun.file(chatMeta).json().then((m: { id: string }) => m.id).catch(() => null);
+  const guidePath = join(getNativeResourcesDir(), 'GUIDE.md');
+
+  return ctx.json({
+    dirName: name,
+    name: frontmatter.name || name,
+    description: frontmatter.description,
+    scope,
+    body,
+    rawFrontmatter: rawYaml,
+    filePath,
+    config,
+    configPath: globalConfigPath,
+    chatSessionId,
+    guidePath,
+  });
 });
 
-resourcesRouter.patch('/config/:id', async (ctx) => {
-  const id = ctx.req.param('id');
-  const body = await ctx.req.json<Partial<ResourceConnectionConfig>>();
-  const config = await readConfig();
-  const existing = config[id] ?? { url: '' };
-  config[id] = { ...existing, ...body };
-  await writeConfig(config);
-  return ctx.json(config[id]);
+resourcesRouter.patch('/:name/config', async (ctx) => {
+  const user = ctx.get('user');
+  if (!isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  const name = ctx.req.param('name');
+  const body = await ctx.req.json<Record<string, string | null>>();
+
+  const globalDir = join(getGlobalResourcesDir(), name);
+  await mkdir(globalDir, { recursive: true });
+
+  const existing = await readConfigFile(globalDir);
+  for (const [key, value] of Object.entries(body)) {
+    if (value === null) delete existing[key];
+    else existing[key] = value;
+  }
+
+  await Bun.write(join(globalDir, 'config.json'), JSON.stringify(existing, null, 2));
+
+  const merged = await readResourceConfig(name);
+  return ctx.json(merged);
 });
 
-resourcesRouter.post('/:id/ping', async (ctx) => {
-  const id = ctx.req.param('id');
+resourcesRouter.post('/', async (ctx) => {
+  const user = ctx.get('user');
+  if (!isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  const { name } = await ctx.req.json<{ name: string }>();
+  if (!name?.trim()) return ctx.text('Name is required', 400);
+
+  const dirName = name.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
+  if (!dirName) return ctx.text('Invalid name', 400);
+
+  const dir = join(getGlobalResourcesDir(), dirName);
+  const filePath = join(dir, 'RESOURCE.md');
+
+  if (await Bun.file(filePath).exists()) {
+    return ctx.text('Resource already exists', 409);
+  }
+
+  await mkdir(dir, { recursive: true });
+  await Bun.write(filePath, `---\nname: ${name.trim()}\ndescription: \n---\n`);
+  await Bun.write(join(dir, 'config.json'), JSON.stringify({ url: '', api_key: '', username: '', password: '' }, null, 2));
+
+  return ctx.json({ name: name.trim(), dirName, filePath, scope: 'global' });
+});
+
+resourcesRouter.delete('/:name', async (ctx) => {
+  const user = ctx.get('user');
+  if (!isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  const name = ctx.req.param('name');
+  const nativeResources = await readResourceDirs(getNativeResourcesDir());
+
+  if (nativeResources.has(name)) return ctx.text('Cannot delete native resource', 400);
+
+  const dir = join(getGlobalResourcesDir(), name);
+  const filePath = join(dir, 'RESOURCE.md');
+  if (!(await Bun.file(filePath).exists())) return ctx.text('Not found', 404);
+
+  await rm(dir, { recursive: true });
+  return ctx.json({ ok: true });
+});
+
+resourcesRouter.get('/:name/chat', async (ctx) => {
+  const name = ctx.req.param('name');
+
+  const nativeResources = await readResourceDirs(getNativeResourcesDir());
+  const globalResources = await readResourceDirs(getGlobalResourcesDir());
+
+  const filePath = globalResources.get(name) ?? nativeResources.get(name);
+  if (!filePath) return ctx.text('Not found', 404);
+
+  const chatDir = join(getGlobalResourcesDir(), name, 'chat');
+  const sessionId = await Bun.file(join(chatDir, 'meta.json')).json().then((m: { id: string }) => m.id).catch(() => null);
+  const messages = await Bun.file(join(chatDir, 'messages.json')).json().catch(() => []);
+
+  return ctx.json({ sessionId, messages });
+});
+
+resourcesRouter.put('/:name/chat', async (ctx) => {
+  const user = ctx.get('user');
+  if (!isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  const name = ctx.req.param('name');
+  const { sessionId, messages } = await ctx.req.json<{ sessionId: string; messages: unknown[] }>();
+
+  const chatDir = join(getGlobalResourcesDir(), name, 'chat');
+  await mkdir(chatDir, { recursive: true });
+  await Bun.write(join(chatDir, 'messages.json'), JSON.stringify(messages));
+  if (sessionId) await Bun.write(join(chatDir, 'meta.json'), JSON.stringify({ id: sessionId }));
+
+  return ctx.json({ ok: true });
+});
+
+resourcesRouter.delete('/:name/chat', async (ctx) => {
+  const user = ctx.get('user');
+  if (!isPrivileged(user.role)) return ctx.text('Forbidden', 403);
+
+  const name = ctx.req.param('name');
+  const chatDir = join(getGlobalResourcesDir(), name, 'chat');
+  await rm(chatDir, { recursive: true, force: true });
+
+  return ctx.json({ ok: true });
+});
+
+resourcesRouter.post('/:name/ping', async (ctx) => {
+  const name = ctx.req.param('name');
   const body = await ctx.req.json<{ url?: string }>().catch((): { url?: string } => ({}));
-  const config = await readConfig();
-  const resources = await loadResources();
-  const resource = resources.find((r) => r.id === id);
-  if (!resource) return ctx.json({ error: 'Resource not found' }, 404);
+  const config = await readResourceConfig(name);
 
-  const url = body.url ?? config[id]?.url ?? resource.connectionConfig?.url;
+  const url = body.url ?? config.url;
   if (!url) return ctx.json({ error: 'No URL configured' }, 400);
 
   try {
@@ -268,67 +233,3 @@ resourcesRouter.post('/:id/ping', async (ctx) => {
     return ctx.json({ reachable: false, latencyMs: null });
   }
 });
-
-resourcesRouter.post('/error-log', async (ctx) => {
-  const body = await ctx.req.json<{ command: string; output: string; exitCode: number }>();
-  const timestamp = Date.now();
-  const filePath = `/tmp/officer-error-${timestamp}.md`;
-  const md = [
-    `# Command Failed (exit code ${body.exitCode})`,
-    '',
-    '```',
-    body.command,
-    '```',
-    '',
-    '## Output',
-    '',
-    '```',
-    body.output,
-    '```',
-  ].join('\n');
-  await Bun.write(filePath, md);
-  return ctx.json({ filePath });
-});
-
-resourcesRouter.post('/:id/run', async (ctx) => {
-  const id = ctx.req.param('id');
-  const { action } = await ctx.req.json<{ action: string }>();
-
-  const parsed = await parseResources();
-  const resource = parsed.find((r) => r.id === id);
-  if (!resource) return ctx.json({ error: 'Resource not found' }, 404);
-
-  const commands: Record<string, string | null> = {
-    install: resource.installCommand,
-    uninstall: resource.uninstallCommand,
-    verify: resource.verifyCommand,
-    update: resource.updateCommand,
-    manage: resource.manageCommand,
-  };
-
-  const command = commands[action];
-  if (!command) return ctx.json({ error: `No ${action} command for this resource` }, 400);
-
-  if (command.trimStart().startsWith('sudo')) {
-    return ctx.json({ error: 'Sudo commands must run in terminal' }, 400);
-  }
-
-  try {
-    const proc = Bun.spawn(['sh', '-c', command], { stdout: 'pipe', stderr: 'pipe' });
-    const [stdout, stderr] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-    ]);
-    await proc.exited;
-    return ctx.json({ exitCode: proc.exitCode, output: (stdout + stderr).trim() });
-  } catch {
-    return ctx.json({ exitCode: 1, output: 'Failed to execute command' });
-  }
-});
-
-resourcesRouter.get('/:id', async (ctx) => {
-  const resources = await loadResources();
-  const resource = resources.find((r) => r.id === ctx.req.param('id'));
-  if (!resource) return ctx.json({ error: 'Resource not found' }, 404);
-  return ctx.json(resource);
-});

src/servers/api/server-settings/stt.ts

@@ -1,11 +1,15 @@
 import { createRouter } from '../../create-router';
 import { settingsPath } from './server-settings';
+import { readResourceConfig } from './resources';
 
 type SttConfig = {
   url: string;
 };
 
 export async function readSttConfig(): Promise<SttConfig | undefined> {
+  const config = await readResourceConfig('speech-to-text');
+  if (config.url) return { url: config.url };
+  // Fallback to legacy settings.json
   const settings = await Bun.file(settingsPath).json().catch(() => ({}));
   return settings.stt as SttConfig | undefined;
 }

src/servers/api/server-settings/tts.ts

@@ -1,5 +1,6 @@
 import { createRouter } from '../../create-router';
 import { settingsPath } from './server-settings';
+import { readResourceConfig } from './resources';
 
 type TtsConfig = {
   provider: 'openai' | 'elevenlabs';
@@ -15,8 +16,19 @@ function maskSecret(value: string | undefined): string | undefined {
 }
 
 export async function readTtsConfig(): Promise<TtsConfig | undefined> {
-  const settings = await Bun.file(settingsPath).json().catch(() => ({}));
-  return settings.tts as TtsConfig | undefined;
+  const config = await readResourceConfig('text-to-speech');
+  if (!config.url && !config.provider) {
+    // Fallback to legacy settings.json
+    const settings = await Bun.file(settingsPath).json().catch(() => ({}));
+    return settings.tts as TtsConfig | undefined;
+  }
+  return {
+    provider: (config.provider || 'openai') as 'openai' | 'elevenlabs',
+    url: config.url ?? '',
+    apiKey: config.api_key || undefined,
+    model: config.model ?? '',
+    voice: config.voice ?? '',
+  };
 }
 
 export const ttsRouter = createRouter();

src/servers/api/terminal/Dockerfile.terminal-sidecar

@@ -2,7 +2,7 @@ FROM imbios/bun-node:22-slim
 
 RUN apt-get update \
   && apt-get install -y \
-    python3 make gcc g++ zsh git curl wget ca-certificates \
+    python3 python3-pip python3-venv make gcc g++ zsh git curl wget ca-certificates \
     sudo gosu locales \
     zip unzip tree btop net-tools tmux \
     procps psmisc lsof less file man-db \
@@ -50,6 +50,19 @@ RUN curl -fsSL "https://github.com/jesseduffield/lazygit/releases/download/v${LA
   && rm -rf /tmp/lazygit.tar.gz /tmp/LICENSE /tmp/README.md
 
 
+ENV GOLANG_VERSION=1.23.6
+RUN curl -fsSL "https://go.dev/dl/go${GOLANG_VERSION}.linux-amd64.tar.gz" -o /tmp/go.tar.gz \
+  && tar -C /usr/local -xzf /tmp/go.tar.gz \
+  && rm /tmp/go.tar.gz
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+ENV RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal \
+  && chmod -R a+rw $CARGO_HOME
+
+ENV PATH="/usr/local/cargo/bin:${PATH}"
+
 RUN npm install -g @mariozechner/pi-coding-agent
 
 WORKDIR /tmp

src/servers/api/terminal/websocket.ts

@@ -2,7 +2,7 @@ import type { ServerWebSocket } from 'bun';
 import { mkdirSync, statSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getHomeDir, getGlobalSkillsDir, getGlobalToolsDir, getGlobalExtensionsDir, getUserSkillsDir, getUserToolsDir } from '@@/data-path';
+import { getHomeDir, getGlobalSkillsDir, getGlobalToolsDir, getGlobalExtensionsDir, getUserSkillsDir, getUserToolsDir, DATA_PATH } from '@@/data-path';
 import { syncUserPiConfig } from '@@/api/server-settings/sync-user-pi-config';
 import { getUsers } from 'officerdb';
 
@@ -163,6 +163,7 @@ const startDockerSidecar = (port: number, homeDir: string, userId: number, usern
       '-v', `${getGlobalExtensionsDir()}:/officer/extensions:ro`,
       '-v', `${getUserSkillsDir(email)}:/officer/user/skills:ro`,
       '-v', `${getUserToolsDir(email)}:/officer/user/tools:ro`,
+      '-v', `${join(DATA_PATH, '.generated')}:/officer/generated:ro`,
       '-w', containerHome,
       tag,
     ],