unify agent items into a flat file-based store, drop the marketplace

Replace the marketplace service dependency and the native/global/user
scope tiers with a single external directory ($OFFICER_ITEMS_DIR) holding
skills, tools, tasks, processes and extensions as plain files.

- tasks move from Postgres to TASK.md files (new file-backed task layer);
  task editing now works, which the DB path never supported
- skills/tools/processes collapse into one shared file router (single dir)
- remove the marketplace client (sync-marketplace/sync-version) and the
  boot-time sync; pi-bridge/pi-manager/sandbox point at the flat store
- drop the dead tasks + vestigial skills/tools/processes/extensions +
  item_chats tables (migration 0004)
- one-time migration script exports DB tasks and consolidates disk items

Migration verified: all 6 tasks round-trip through the runtime parser
identically to their DB rows (pipeline steps, triggers, script impls and
agentic bodies all intact).

NOTE: not yet functionally tested end-to-end — every item (each task mode,
tool, skill, extension) still needs to be run/exercised in the app before
this is trusted. To be done manually.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/api/tasks/tasks.ts

@@ -1,45 +1,34 @@
 import { createRouter } from '../../create-router';
-import { getTasksForUser, getTaskByDirName, getTaskById, createTask, updateTask, deleteTask } from 'officerdb';
+import { listTasks, getTaskByDirName, createTask, deleteTask } from './task-files';
 
 type TriggerConfig = { type: 'file'; extensions: string[] } | { type: 'directory' };
 
-function isPrivileged(role: string) {
-  return role === 'Super Admin';
-}
-
 export const tasksRouter = createRouter();
 
 tasksRouter.get('/', async (ctx) => {
-  const user = ctx.get('user');
-  const rows = await getTasksForUser(user.id);
+  const summaries = await listTasks();
 
-  const tasks = rows.map((row) => ({
-    id: row.id,
+  const tasks = summaries.map((row) => ({
     dirName: row.dirName,
     name: row.name,
     description: row.description,
-    scope: row.scope,
     triggers: (row.trigger as TriggerConfig[]) ?? [],
     mode: row.mode ?? 'agentic',
-    userId: row.userId,
   }));
 
   return ctx.json(tasks);
 });
 
 tasksRouter.get('/:name', async (ctx) => {
-  const user = ctx.get('user');
   const name = ctx.req.param('name');
 
-  const task = await getTaskByDirName(name, user.id);
+  const task = await getTaskByDirName(name);
   if (!task) return ctx.text('Not found', 404);
 
   return ctx.json({
-    id: task.id,
     dirName: task.dirName,
     name: task.name,
     description: task.description,
-    scope: task.scope,
     mode: task.mode,
     language: task.language,
     body: task.body,
@@ -49,45 +38,35 @@ tasksRouter.get('/:name', async (ctx) => {
     trigger: task.trigger,
     config: task.config,
     version: task.version,
-    userId: task.userId,
+    filePath: task.filePath,
   });
 });
 
 tasksRouter.post('/', async (ctx) => {
-  const user = ctx.get('user');
   const body = await ctx.req.json<{ name: string; description?: string; mode?: string; language?: string }>();
 
   if (!body.name?.trim()) return ctx.text('Name is required', 400);
 
-  const dirName = body.name.trim().toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
-  if (!dirName) return ctx.text('Invalid name', 400);
-
-  const scope = isPrivileged(user.role) ? 'global' : 'user';
-
-  const task = await createTask({
-    scope,
-    userId: user.id,
-    dirName,
-    name: body.name.trim(),
-    description: body.description ?? null,
-    mode: body.mode ?? 'agentic',
-    language: body.language ?? null,
-  });
-
-  return ctx.json(task);
+  try {
+    const task = await createTask({
+      name: body.name,
+      description: body.description ?? null,
+      mode: body.mode ?? 'agentic',
+      language: body.language ?? null,
+    });
+    return ctx.json(task);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : 'Failed to create task';
+    return ctx.text(message, message === 'Task already exists' ? 409 : 400);
+  }
 });
 
 tasksRouter.delete('/:name', async (ctx) => {
-  const user = ctx.get('user');
   const name = ctx.req.param('name');
 
-  const task = await getTaskByDirName(name, user.id);
+  const task = await getTaskByDirName(name);
   if (!task) return ctx.text('Not found', 404);
 
-  // Only owner or Super Admin can delete
-  if (task.scope === 'native') return ctx.text('Cannot delete native tasks', 403);
-  if (task.userId !== user.id && !isPrivileged(user.role)) return ctx.text('Forbidden', 403);
-
-  await deleteTask(task.id);
+  await deleteTask(task.dirName);
   return ctx.json({ ok: true });
 });