taskswipe-mcp 0.2.0 → 0.2.1

package/README.md

@@ -25,36 +25,12 @@ row-level security still applies and no service key exists anywhere.
 the server reading credentials from your own machine rather than sending a
 token over the wire.
 
-## One-time VPS setup (Hermes / OpenClaw)
+## Setup
 
-Run one command in an interactive SSH session as the same Linux user that runs
-the agent:
-
-```bash
-npx -y taskswipe-mcp@latest setup hermes
-```
-
-or:
-
-```bash
-npx -y taskswipe-mcp@latest setup openclaw
-```
-
-The installer asks for the TASKKA email and password. Password input is hidden;
-the password is used once to mint a separate session for that VPS and is never
-written to disk. The renewable session is saved at
-`~/.taskswipe-mcp-session.json` with mode `0600`, then the installer registers
-the stdio MCP, installs the TASKKA skill and runs the agent's connection check.
-No tunnel, public port, YAML/JSON edit or hourly token copy is involved.
-
-This is safer than copying the browser refresh token: the browser and VPS have
-independent sessions and can rotate their credentials without racing each other.
-
-## Manual setup and other clients
-
-The production Supabase URL and anon key are baked in as defaults (they're
-public — they ship in the web app's JS bundle); self-hosters can override them
-with `TASKSWIPE_SUPABASE_URL` and `TASKSWIPE_SUPABASE_ANON_KEY`.
+You need your TASKKA login token — that's it. The production Supabase URL
+and anon key are baked in as defaults (they're public — they ship in the web
+app's JS bundle); self-hosters can override them with `TASKSWIPE_SUPABASE_URL`
+and `TASKSWIPE_SUPABASE_ANON_KEY`.
 
 > **Published:** https://www.npmjs.com/package/taskswipe-mcp — so anywhere the
 > examples below run it by path, `npx -y taskswipe-mcp` works instead and needs
@@ -97,23 +73,25 @@ TASKSWIPE_ACCESS_TOKEN = "eyJ..."
 (`codex mcp list` to confirm it registered; note the section is
 `mcp_servers`, snake_case, not `mcpServers`.)
 
-**Hermes Agent** (Nous) — prefer the one-command setup above. Its resulting
-credential-free entry is equivalent to:
+**Hermes Agent** (Nous) — local stdio, tokens refresh themselves. Paste into `~/.hermes/config.yaml`, then install the skill:
 
 ```yaml
 mcp_servers:
   taskka:
     command: "npx"
     args: ["-y", "taskswipe-mcp"]
+    env:
+      TASKSWIPE_ACCESS_TOKEN: "eyJ..."
+      TASKSWIPE_REFRESH_TOKEN: "..."
 ```
 
 ```bash
 hermes skills install https://taskka.app/.well-known/skills/taskka/SKILL.md
 ```
 
-The server reads the renewable VPS session from the owner-only session file.
+Copy both snippets from TASKKA → SETTINGS → AGENTS (signed in) so the tokens are live.
 
-**OpenClaw** — prefer the one-command setup above. Its resulting entry is:
+**OpenClaw** — same local server. Paste into `openclaw.json` (or Control UI → Settings → MCP):
 
 ```json
 {
@@ -121,7 +99,11 @@ The server reads the renewable VPS session from the owner-only session file.
     "servers": {
       "taskka": {
         "command": "npx",
-        "args": ["-y", "taskswipe-mcp@latest"]
+        "args": ["-y", "taskswipe-mcp"],
+        "env": {
+          "TASKSWIPE_ACCESS_TOKEN": "eyJ...",
+          "TASKSWIPE_REFRESH_TOKEN": "..."
+        }
       }
     }
   }
@@ -133,9 +115,7 @@ openclaw skills install https://taskka.app/.well-known/skills/taskka/SKILL.md
 openclaw mcp doctor taskka --probe
 ```
 
-Hosted HTTP (`https://taskka.app/mcp` + `Authorization: Bearer <access>`) works
-for a Control-UI one-shot. Access tokens die in about an hour — always-on
-Hermes/OpenClaw gateways should use the one-time stdio bootstrap above.
+Hosted HTTP (`https://taskka.app/mcp` + `Authorization: Bearer <access>`) works for a Control-UI one-shot. Access tokens die in about an hour — always-on Hermes/OpenClaw gateways should use stdio above.
 
 **Claude Desktop / Cursor** — these do use the JSON shape
 (`claude_desktop_config.json` / `.cursor/mcp.json`):
@@ -166,9 +146,9 @@ JSON.parse(Object.entries(localStorage).find(([k]) => k.includes('auth-token'))[
 
 It expires on its own, which is the point — a leaked token stops working.
 
-### Legacy token-seeded sessions
+### Making it permanent
 
-For older configs, add `TASKSWIPE_REFRESH_TOKEN` next to it — same console snippet, ending in
+Add `TASKSWIPE_REFRESH_TOKEN` next to it — same console snippet, ending in
 `.refresh_token` instead of `.access_token`. With the pair in place the server
 renews itself and keeps the CURRENT session in `~/.taskswipe-mcp-session.json`
 (owner-only file). That file matters: Supabase rotates refresh tokens on every
@@ -176,10 +156,9 @@ use and treats reuse of an old one as theft, so the config values are only the
 seed — after first run the file is the live credential. Signing out of that
 session (or deleting the file AND pasting a fresh pair) is the reset path.
 
-### Stored-password fallback (not recommended)
+### Password fallback
 
-`TASKSWIPE_EMAIL` + `TASKSWIPE_PASSWORD` also work, but this is not what the
-one-time installer does. The server prefers a
+`TASKSWIPE_EMAIL` + `TASKSWIPE_PASSWORD` also work, and the server prefers a
 token whenever both are present. Understand the trade before using it: MCP
 config files sit unencrypted in your home directory, are frequently committed
 by accident, and are read by every tool on the machine. A password there is a
@@ -193,7 +172,7 @@ The repo root carries `.codex-plugin/plugin.json` + `.mcp.json`, which makes
 the whole repo an installable Codex plugin. The path to being listed
 (as of 2026-08):
 
-1. ~~Publish to npm~~ — **done**. The one-time VPS installer ships in `taskswipe-mcp@0.2.0`.
+1. ~~Publish to npm~~ — **done**, `taskswipe-mcp@0.1.0`.
 2. **Interim listing** — submit the GitHub repo URL to the community registry
    at codex-marketplace.com (automated review of the manifest).
 3. **Official directory** — OpenAI's self-serve publishing is "coming soon";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "taskswipe-mcp",
-  "version": "0.2.0",
-  "description": "Read and write your TASKKA day from Hermes, OpenClaw, Claude Code, Codex or Cursor.",
+  "version": "0.2.1",
+  "description": "Read and write your TASKKA day from Claude Code, Claude Desktop, Codex or Cursor.",
   "type": "module",
   "bin": {
     "taskswipe-mcp": "src/index.js"

package/src/brief.js

@@ -87,9 +87,10 @@ export function buildBrief(state = {}, now = new Date()) {
   }
 
   const missed = arr(S.missedTasks)
-  if (missed.length >= 3) {
-    attention.push({ area: 'today', severity: 1,
-      what: `${missed.length} tasks aged out unfinished and are sitting in DROPPED` })
+  if (missed.length) {
+    attention.push({ area: 'dropped', severity: missed.length >= 3 ? 2 : 1,
+      what: `${missed.length} unfinished from earlier days sitting in LOG → DROPPED`,
+      items: missed.slice(0, 4).map(t => t.text) })
   }
 
   // Habits are the app's committed tier: quiet ones are the real signal.
@@ -121,7 +122,7 @@ export function buildBrief(state = {}, now = new Date()) {
     n + (num(e.per100?.kcal) * num(e.grams)) / 100, 0))
   const health = S.healthDaily?.[today] || {}
 
-  const stacks = arr(S.stacks).map(s => ({
+  const stacks = arr(S.stacks).filter(s => !s.retiredAt).map(s => ({
     name: s.name,
     hits: hitRate(stackDoneDays(s), Math.round((num(s.graduationTarget) || 14) * 1.5), now),
     target: num(s.graduationTarget) || 14,
@@ -135,11 +136,23 @@ export function buildBrief(state = {}, now = new Date()) {
   const learningTopics = maps.flatMap(m => arr(m.nodes).filter(n => n.status === 'learning')
     .map(n => `${m.title}: ${n.title}`))
 
+  const biz = arr(S.businessIdeas)
   const areas = {
     today: `${open.length} open, ${done.length} done${S.coreTask ? `, core: ${S.coreTask.task || S.coreTask}` : ''}`,
+    dropped: missed.length
+      ? `${missed.length} unfinished from earlier days (LOG → DROPPED)`
+      : 'nothing sitting in DROPPED',
     backlog: `${arr(S.backlogTasks).length} parked`,
+    docket: `${arr(S.docketTasks).length} coming-up with no clock`,
     deck: `${arr(S.deck).length} cards waiting to be swiped`,
     recurring: `${arr(S.recurringTasks).length} rules`,
+    lists: `${arr(S.lists).length} lists`,
+    frame: `${arr(S.frameworks).length} living frameworks`,
+    business: biz.length
+      ? `${biz.filter(i => i?.stage !== 'ship' && i?.stage !== 'drop').length} live ideas on the spark-to-ship path`
+      : 'no ideas on the path',
+    people: `${arr(S.people).length} people`,
+    things: `${arr(S.things).length} kept`,
     missions: `${arr(S.missions).filter(m => !m.done).length} open`,
     goals: goalFrames.length
       ? `${goalFrames.length} goals${building ? `, building: ${building.text}` : ', none on the crane'}`
@@ -192,8 +205,9 @@ export function buildBrief(state = {}, now = new Date()) {
     drill: {
       more_on_an_area: "detail(area) — any key from `areas`",
       today_in_full: 'today()',
+      dropped_in_full: 'detail({ area: "dropped" })',
       find_anything: 'search(query)',
-      write: 'add_tasks, complete_task, capture, set_core_task',
+      write: 'add_tasks, complete_task, capture, set_core_task, recover_dropped',
     },
   }
 }
@@ -223,6 +237,42 @@ export function buildDetail(state = {}, area = '', now = new Date()) {
         dropped: arr(S.missedTasks).slice(0, 20).map(t => t.text),
       }
     }
+    case 'dropped':
+    case 'log':
+      return {
+        where: 'LOG → DROPPED. Tasks that aged out unfinished from earlier days. Not the backlog, not CUT.',
+        count: arr(S.missedTasks).length,
+        items: arr(S.missedTasks).slice(0, 40).map(t => ({
+          text: t.text,
+          expired: t.expiredDate || null,
+          category: t.category || null,
+        })),
+        recover: 'recover_dropped({ task }) puts one back on today',
+      }
+    case 'docket':
+    case 'calendar':
+      return {
+        docket: arr(S.docketTasks).slice(0, 40).map(t => t.text || t.task),
+        planned_days: Object.keys(S.plannedTasks || {}).length,
+      }
+    case 'lists':
+      return arr(S.lists).slice(0, 30).map(l => ({
+        name: l.title || l.name, items: arr(l.items).length,
+      }))
+    case 'frame':
+      return arr(S.frameworks).slice(0, 20).map(f => ({
+        name: f.name, when: f.when || null, decisions: arr(f.decisions).length,
+      }))
+    case 'business':
+      return arr(S.businessIdeas).slice(0, 40).map(i => ({
+        title: i.title, stage: i.stage || 'spark', next: i.next || null,
+      }))
+    case 'people':
+      return arr(S.people).slice(0, 40).map(p => ({
+        name: p.name, role: p.role || null, company: p.company || null,
+      }))
+    case 'things':
+      return { kept: arr(S.things).length, categories: arr(S.thingsCats).length }
     case 'habits':
       return arr(S.habits).map(h => {
         const days = habitDoneDays(h)
@@ -235,6 +285,7 @@ export function buildDetail(state = {}, area = '', now = new Date()) {
         const window = Math.round(target * 1.5)
         return {
           name: s.name, cue: s.anchor || null, minimum: s.minimum || null,
+          retired: !!s.retiredAt,
           hits: hitRate(days, window, now), target, window,
           ready: hitRate(days, window, now) >= target,
           today: days.has(today),
@@ -250,6 +301,8 @@ export function buildDetail(state = {}, area = '', now = new Date()) {
     }
     case 'food': {
       const day = arr(S.foodLog?.[today])
+      const shopping = arr(S.foodShoppingList)
+      const openShopping = shopping.filter(row => !row.done)
       const tot = day.reduce((a, e) => {
         const f = num(e.grams) / 100
         return {
@@ -264,6 +317,27 @@ export function buildDetail(state = {}, area = '', now = new Date()) {
         totals: Object.fromEntries(Object.entries(tot).map(([k, v]) => [k, Math.round(v)])),
         targets: S.foodTargets || null,
         pantry_size: arr(S.pantry).length,
+        pantry_catalog_size: arr(S.pantry).length,
+        pantry_stock: arr(S.pantryStock).slice(0, 100).map(row => ({
+          name: row.name,
+          quantity: num(row.quantity),
+          unit: row.unit || 'each',
+          location: row.location || null,
+          expires_on: row.expiresOn || null,
+          minimum: num(row.minimum),
+        })),
+        shopping_list: openShopping.slice(0, 60).map(row => ({
+          name: row.name,
+          quantity: num(row.quantity) || 1,
+          unit: row.unit || 'each',
+          source: row.source || 'manual',
+        })),
+        shopping_counts: {
+          open: openShopping.length,
+          bought: shopping.length - openShopping.length,
+          returned: Math.min(openShopping.length, 60),
+        },
+        ordering_rules: String(S.aiPlaybookOverlays?.food || '').slice(0, 4000) || null,
         saved_meals: arr(S.meals).map(m => m.name),
       }
     }

package/src/index.js

@@ -23,53 +23,44 @@ import { TOOLS, byName } from './tools.js'
 
 const log = (...a) => process.stderr.write(a.join(' ') + '\n')
 
-async function startServer() {
-  const server = new Server(
-    { name: 'taskswipe', version: '0.2.0' },
-    { capabilities: { tools: {} } },
-  )
+const server = new Server(
+  { name: 'taskswipe', version: '0.1.0' },
+  { capabilities: { tools: {} } },
+)
 
-  server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: TOOLS.map(t => ({
-      name: t.name,
-      title: t.title,
-      description: t.description,
-      inputSchema: t.inputSchema,
-    })),
-  }))
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: TOOLS.map(t => ({
+    name: t.name,
+    title: t.title,
+    description: t.description,
+    inputSchema: t.inputSchema,
+  })),
+}))
 
-  server.setRequestHandler(CallToolRequestSchema, async (req) => {
-    const tool = byName[req.params.name]
-    if (!tool) {
-      return { isError: true, content: [{ type: 'text', text: `Unknown tool: ${req.params.name}` }] }
-    }
-    try {
-      const result = await tool.run(req.params.arguments || {})
-      return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }
-    } catch (e) {
-      // Returned as a tool error rather than thrown: the model can read it and
-      // tell the user what to fix, instead of the client showing "server error".
-      log(`[taskswipe] ${tool.name} failed:`, e?.message || e)
-      return {
-        isError: true,
-        content: [{ type: 'text', text: `TASKKA: ${e?.message || 'unknown error'}` }],
-      }
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const tool = byName[req.params.name]
+  if (!tool) {
+    return { isError: true, content: [{ type: 'text', text: `Unknown tool: ${req.params.name}` }] }
+  }
+  try {
+    const result = await tool.run(req.params.arguments || {})
+    return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }
+  } catch (e) {
+    // Returned as a tool error rather than thrown: the model can read it and
+    // tell the user what to fix, instead of the client showing "server error".
+    log(`[taskswipe] ${tool.name} failed:`, e?.message || e)
+    return {
+      isError: true,
+      content: [{ type: 'text', text: `TASKKA: ${e?.message || 'unknown error'}` }],
     }
-  })
+  }
+})
 
+if (process.argv[2] === 'setup') {
+  const { runSetup } = await import('./setup.js')
+  await runSetup(process.argv.slice(3))
+} else {
   const transport = new StdioServerTransport()
   await server.connect(transport)
   log('[taskswipe] MCP server ready on stdio —', TOOLS.length, 'tools')
 }
-
-try {
-  if (process.argv[2] === 'setup') {
-    const { runSetup } = await import('./setup.js')
-    await runSetup(process.argv.slice(3))
-  } else {
-    await startServer()
-  }
-} catch (error) {
-  log(`TASKKA setup failed: ${error?.message || error}`)
-  process.exitCode = 1
-}

package/src/ob1.js

@@ -0,0 +1,104 @@
+// OB1 / Open Brain — durable cross-tool memory (Supabase + MCP).
+// TASKKA talks to the same HTTP MCP Codex and Grok already use.
+// Do not dump the vault into it. Capture a concise lesson, not a file.
+
+import { looksLikeSecret } from './os.js'
+
+const MAX_CAPTURE = 4000
+
+function endpoint() {
+  const raw = String(process.env.OPEN_BRAIN_URL || process.env.OB1_MCP_URL || '').trim()
+  if (!raw) return ''
+  const key = String(process.env.OPEN_BRAIN_KEY || process.env.OB1_KEY || '').trim()
+  if (!key || /[?&]key=/.test(raw)) return raw
+  return raw.includes('?') ? `${raw}&key=${encodeURIComponent(key)}` : `${raw}?key=${encodeURIComponent(key)}`
+}
+
+export function ob1Configured() {
+  return !!endpoint()
+}
+
+function parseMcpBody(text) {
+  const src = String(text || '').trim()
+  if (!src) return {}
+  if (src.startsWith('{')) {
+    try { return JSON.parse(src) } catch { /* SSE below */ }
+  }
+  for (const block of src.split('\n\n')) {
+    const line = block.split('\n').find(l => l.startsWith('data: '))
+    if (!line) continue
+    try { return JSON.parse(line.slice(6)) } catch { /* next */ }
+  }
+  return { error: { message: 'ob1_unreadable' } }
+}
+
+async function mcpCall(name, args = {}) {
+  const url = endpoint()
+  if (!url) throw Object.assign(new Error('ob1_unconfigured'), { status: 503 })
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Accept: 'application/json, text/event-stream',
+    },
+    body: JSON.stringify({
+      jsonrpc: '2.0',
+      id: Date.now(),
+      method: 'tools/call',
+      params: { name, arguments: args },
+    }),
+  })
+  const raw = await res.text()
+  const msg = parseMcpBody(raw)
+  if (!res.ok) {
+    throw Object.assign(new Error(msg.error?.message || `ob1_${res.status}`), { status: res.status === 401 ? 403 : 502 })
+  }
+  if (msg.error) {
+    throw Object.assign(new Error(msg.error.message || 'ob1_failed'), { status: 502 })
+  }
+  const text = (msg.result?.content || []).map(c => c.text || '').filter(Boolean).join('\n')
+  if (msg.result?.isError) {
+    throw Object.assign(new Error(text || 'ob1_tool_error'), { status: 502 })
+  }
+  return { text, result: msg.result }
+}
+
+export function formatOb1Capture({ text, source, title } = {}) {
+  const body = String(text || '').trim()
+  const head = ['TASKKA', source, title].filter(Boolean).join(' · ')
+  const packed = head ? `${head}\n\n${body}` : body
+  return packed.slice(0, MAX_CAPTURE)
+}
+
+export async function ob1Status() {
+  if (!ob1Configured()) return { configured: false, thoughts: 0 }
+  try {
+    const { text } = await mcpCall('thought_stats', {})
+    const total = Number((text.match(/Total thoughts:\s*(\d+)/i) || [])[1] || 0)
+    return { configured: true, thoughts: total, summary: text.slice(0, 1200) }
+  } catch (e) {
+    return { configured: true, thoughts: 0, error: e.message || 'ob1_status_failed' }
+  }
+}
+
+export async function searchOb1(query, { limit = 8, threshold = 0.5 } = {}) {
+  const q = String(query || '').trim()
+  if (q.length < 2) return { query: q, results: [] }
+  const { text } = await mcpCall('search_thoughts', { query: q, limit, threshold })
+  return { query: q, text }
+}
+
+export async function listOb1({ limit = 8, days } = {}) {
+  const args = { limit }
+  if (days) args.days = days
+  const { text } = await mcpCall('list_thoughts', args)
+  return { text }
+}
+
+export async function captureOb1({ text, source, title } = {}) {
+  const content = formatOb1Capture({ text, source, title })
+  if (!content.trim()) throw Object.assign(new Error('empty_thought'), { status: 400 })
+  if (looksLikeSecret(content)) throw Object.assign(new Error('secrets_forbidden'), { status: 400 })
+  const { text: reply } = await mcpCall('capture_thought', { content })
+  return { ok: true, message: reply || 'Captured in OB1.' }
+}

package/src/os.js

@@ -0,0 +1,367 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// CALLUM OS — read the life wiki (kalz-D/callum-os).
+//
+// GitHub is the canonical copy. Hermes also keeps a checkout at
+// /opt/data/callum-os; that is used when no GitHub token is present so the
+// VPS agent can still search the vault. TASKKA's serverless path always uses
+// GitHub.
+// ─────────────────────────────────────────────────────────────────────────────
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+export const DEFAULT_REPO = 'kalz-D/callum-os'
+export const DEFAULT_OWNER_EMAIL = 'c.dempsey@live.com.au'
+
+const SKIP_DIR = /(?:^|\/)(?:\.obsidian|\.git|node_modules)(?:\/|$)/
+const NOTE_FILE = /\.(md|txt|markdown)$/i
+const INDEX_PATH = 'index.md'
+
+function repo() {
+  return String(process.env.CALLUM_OS_REPO || DEFAULT_REPO).replace(/^\/+|\/+$/g, '')
+}
+
+function token() {
+  return process.env.CALLUM_OS_GITHUB_TOKEN || process.env.GITHUB_TOKEN || ''
+}
+
+function localDir() {
+  const hinted = String(process.env.CALLUM_OS_DIR || '').trim()
+  if (hinted) return hinted
+  if (fs.existsSync('/opt/data/callum-os/index.md')) return '/opt/data/callum-os'
+  return ''
+}
+
+export function osConfigured() {
+  return !!(token() || localDir())
+}
+
+export function ownerEmails() {
+  return String(process.env.CALLUM_OS_OWNER_EMAIL || DEFAULT_OWNER_EMAIL)
+    .split(/[,\s]+/)
+    .map(s => s.trim().toLowerCase())
+    .filter(Boolean)
+}
+
+export function isOsOwner(user) {
+  const email = String(user?.email || user?.user_metadata?.email || '').toLowerCase()
+  return !!email && ownerEmails().includes(email)
+}
+
+export function safePath(value) {
+  const raw = String(value || '').replace(/\\/g, '/').replace(/^\/+/, '')
+  if (!raw || raw.includes('..') || raw.startsWith('/') || SKIP_DIR.test(raw)) return ''
+  return raw.slice(0, 400)
+}
+
+function isNote(p) {
+  return !!p && !SKIP_DIR.test(p) && NOTE_FILE.test(p)
+}
+
+async function gh(pathname, { method = 'GET', body, headers = {}, ok } = {}) {
+  const auth = token()
+  if (!auth) throw Object.assign(new Error('os_unconfigured'), { status: 503 })
+  const res = await fetch(`https://api.github.com${pathname}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${auth}`,
+      Accept: 'application/vnd.github+json',
+      'User-Agent': 'taskka-callum-os',
+      'X-GitHub-Api-Version': '2022-11-28',
+      ...(body ? { 'Content-Type': 'application/json' } : {}),
+      ...headers,
+    },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  })
+  const data = await res.json().catch(() => ({}))
+  const allowed = ok || (method === 'GET' ? [200] : [200, 201])
+  if (!allowed.includes(res.status)) {
+    const err = new Error(data.message || `github_${res.status}`)
+    err.status = res.status === 403 ? 503 : res.status
+    throw err
+  }
+  return data
+}
+
+let treeCache = { at: 0, files: [], sha: '' }
+
+async function githubTree() {
+  if (treeCache.files.length && Date.now() - treeCache.at < 120_000) return treeCache
+  const head = await gh(`/repos/${repo()}/commits/main`)
+  const sha = head.commit?.tree?.sha || head.sha
+  const body = await gh(`/repos/${repo()}/git/trees/${sha}?recursive=1`)
+  const files = (body.tree || [])
+    .filter(n => n.type === 'blob' && isNote(n.path))
+    .map(n => ({ path: n.path, size: n.size || 0, sha: n.sha }))
+  treeCache = { at: Date.now(), files, sha }
+  return treeCache
+}
+
+function walkLocal(dir, prefix = '') {
+  const out = []
+  let entries = []
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }) } catch { return out }
+  for (const ent of entries) {
+    const rel = prefix ? `${prefix}/${ent.name}` : ent.name
+    if (SKIP_DIR.test(rel)) continue
+    const full = path.join(dir, ent.name)
+    if (ent.isDirectory()) out.push(...walkLocal(full, rel))
+    else if (ent.isFile() && isNote(rel)) {
+      let size = 0
+      try { size = fs.statSync(full).size } catch { /* ignore */ }
+      out.push({ path: rel, size, sha: '' })
+    }
+  }
+  return out
+}
+
+export async function listNotes() {
+  const root = localDir()
+  if (!token() && root) {
+    return { repo: 'local', sha: 'local', files: walkLocal(root) }
+  }
+  const t = await githubTree()
+  return { repo: repo(), sha: t.sha, files: t.files }
+}
+
+function folderOf(p) {
+  const i = p.indexOf('/')
+  return i < 0 ? 'ROOT' : p.slice(0, i)
+}
+
+export function foldersFrom(files) {
+  const map = new Map()
+  for (const f of files) {
+    const folder = folderOf(f.path)
+    if (!map.has(folder)) map.set(folder, [])
+    map.get(folder).push(f)
+  }
+  return [...map.entries()].map(([name, items]) => ({
+    name,
+    count: items.length,
+    files: items.sort((a, b) => a.path.localeCompare(b.path)),
+  }))
+}
+
+export async function readNote(notePath) {
+  const p = safePath(notePath) || INDEX_PATH
+  if (!isNote(p) && p !== INDEX_PATH) {
+    throw Object.assign(new Error('bad_path'), { status: 400 })
+  }
+  const root = localDir()
+  if (!token() && root) {
+    const full = path.join(root, p)
+    if (!full.startsWith(path.resolve(root))) {
+      throw Object.assign(new Error('bad_path'), { status: 400 })
+    }
+    const text = fs.readFileSync(full, 'utf8')
+    return { path: p, text, sha: '', source: 'local' }
+  }
+  const encoded = p.split('/').map(encodeURIComponent).join('/')
+  const data = await gh(`/repos/${repo()}/contents/${encoded}?ref=main`)
+  const text = Buffer.from(data.content || '', 'base64').toString('utf8')
+  return { path: data.path || p, text, sha: data.sha || '', source: 'github', htmlUrl: data.html_url || null }
+}
+
+function snippetAround(text, query, span = 140) {
+  const lower = text.toLowerCase()
+  const q = query.toLowerCase()
+  const i = lower.indexOf(q)
+  if (i < 0) return text.slice(0, span).trim()
+  const start = Math.max(0, i - 40)
+  const end = Math.min(text.length, i + q.length + span)
+  return `${start > 0 ? '…' : ''}${text.slice(start, end).trim()}${end < text.length ? '…' : ''}`
+}
+
+export async function searchNotes(query, limit = 20) {
+  const q = String(query || '').trim()
+  if (q.length < 2) return { query: q, results: [] }
+  const cap = Math.max(1, Math.min(40, Number(limit) || 20))
+  const { files, repo: repoName } = await listNotes()
+  const needle = q.toLowerCase()
+  const pathHits = files
+    .filter(f => f.path.toLowerCase().includes(needle))
+    .map(f => ({ path: f.path, how: 'path', snippet: f.path }))
+
+  const contentHits = []
+  if (token()) {
+    try {
+      const data = await gh(
+        `/search/code?q=${encodeURIComponent(`${q} repo:${repo()} extension:md`)}`,
+        { headers: { Accept: 'application/vnd.github.text-match+json' } },
+      )
+      for (const item of data.items || []) {
+        const p = item.path
+        if (!isNote(p)) continue
+        const frag = item.text_matches?.[0]?.fragment || p
+        contentHits.push({ path: p, how: 'content', snippet: String(frag).replace(/\s+/g, ' ').slice(0, 220) })
+      }
+    } catch {
+      // Code search is extra; path hits still work.
+    }
+  } else {
+    const root = localDir()
+    if (root) {
+      for (const f of files) {
+        try {
+          const text = fs.readFileSync(path.join(root, f.path), 'utf8')
+          if (text.toLowerCase().includes(needle)) {
+            contentHits.push({ path: f.path, how: 'content', snippet: snippetAround(text, q) })
+          }
+        } catch { /* skip unreadable */ }
+        if (contentHits.length >= cap) break
+      }
+    }
+  }
+
+  const seen = new Set()
+  const results = []
+  for (const hit of [...pathHits, ...contentHits]) {
+    const key = hit.path.toLowerCase()
+    if (seen.has(key)) continue
+    seen.add(key)
+    results.push(hit)
+    if (results.length >= cap) break
+  }
+  return { query: q, repo: repoName, count: results.length, results }
+}
+
+export async function osStatus() {
+  const configured = osConfigured()
+  if (!configured) {
+    return { configured: false, writable: false, repo: repo(), files: 0, source: null }
+  }
+  try {
+    const { files, repo: repoName, sha } = await listNotes()
+    return {
+      configured: true,
+      writable: true,
+      repo: repoName,
+      files: files.length,
+      sha,
+      source: token() ? 'github' : 'local',
+    }
+  } catch (e) {
+    return { configured: true, writable: !!token() || !!localDir(), repo: repo(), files: 0, error: e.message || 'os_status_failed' }
+  }
+}
+
+const MAX_NOTE_BYTES = 400_000
+
+export function looksLikeSecret(text) {
+  return /ghp_[A-Za-z0-9]|gho_[A-Za-z0-9]|github_pat_|sk-ant-|sk-proj-|sk_live_|BEGIN [A-Z ]*PRIVATE KEY/i.test(String(text || ''))
+}
+
+export function ensureFrontmatter(text, { title, type = 'Note' } = {}) {
+  const src = String(text || '')
+  if (src.startsWith('---')) return src
+  const date = new Date().toISOString().slice(0, 10)
+  const safeTitle = String(title || 'Note').replace(/[\r\n]+/g, ' ').slice(0, 120)
+  return `---\ntype: ${type}\ntitle: ${safeTitle}\ndate: ${date}\nsource: taskka\n---\n\n${src}`
+}
+
+export function notePathFrom({ folder, name } = {}) {
+  const file = String(name || '')
+    .replace(/\.md$/i, '')
+    .replace(/[^\w\s./-]+/g, '')
+    .trim()
+    .replace(/\s+/g, ' ')
+  if (!file || file.includes('..')) return ''
+  const folderRaw = String(folder || '').trim()
+  const folderPath = !folderRaw || folderRaw === 'ROOT' ? '' : safePath(folderRaw)
+  const rel = folderPath ? `${folderPath}/${file}.md` : `${file}.md`
+  return isNote(rel) ? rel : ''
+}
+
+function bustTree() {
+  treeCache = { at: 0, files: [], sha: '' }
+}
+
+export async function writeNote({ path: notePath, text, message, sha } = {}) {
+  const p = safePath(notePath)
+  if (!isNote(p)) throw Object.assign(new Error('bad_path'), { status: 400 })
+  const body = String(text || '')
+  if (!body.trim()) throw Object.assign(new Error('empty_note'), { status: 400 })
+  if (Buffer.byteLength(body, 'utf8') > MAX_NOTE_BYTES) {
+    throw Object.assign(new Error('note_too_large'), { status: 413 })
+  }
+  if (looksLikeSecret(body)) {
+    throw Object.assign(new Error('secrets_forbidden'), { status: 400 })
+  }
+
+  const root = localDir()
+  if (!token() && root) {
+    const full = path.join(root, p)
+    if (!full.startsWith(path.resolve(root))) {
+      throw Object.assign(new Error('bad_path'), { status: 400 })
+    }
+    fs.mkdirSync(path.dirname(full), { recursive: true })
+    const created = !fs.existsSync(full)
+    fs.writeFileSync(full, body, 'utf8')
+    bustTree()
+    return { path: p, sha: '', created, source: 'local' }
+  }
+
+  let currentSha = sha || ''
+  if (!currentSha) {
+    try {
+      const existing = await readNote(p)
+      currentSha = existing.sha || ''
+    } catch (e) {
+      if (e.status !== 404) throw e
+    }
+  }
+
+  const payload = {
+    message: String(message || `TASKKA: ${currentSha ? 'update' : 'create'} ${p}`).slice(0, 200),
+    content: Buffer.from(body, 'utf8').toString('base64'),
+    branch: 'main',
+  }
+  if (currentSha) payload.sha = currentSha
+
+  const encoded = p.split('/').map(encodeURIComponent).join('/')
+  const put = () => gh(`/repos/${repo()}/contents/${encoded}`, { method: 'PUT', body: payload })
+  let data
+  try {
+    data = await put()
+  } catch (e) {
+    if (e.status !== 409 && e.status !== 422) throw e
+    const existing = await readNote(p)
+    payload.sha = existing.sha
+    data = await put()
+  }
+  bustTree()
+  return {
+    path: data.content?.path || p,
+    sha: data.content?.sha || '',
+    created: !currentSha,
+    htmlUrl: data.content?.html_url || null,
+    source: 'github',
+    commit: data.commit?.sha || null,
+  }
+}
+
+export async function appendNote({ path: notePath, text, message } = {}) {
+  const addition = String(text || '').trim()
+  if (!addition) throw Object.assign(new Error('empty_note'), { status: 400 })
+  if (looksLikeSecret(addition)) {
+    throw Object.assign(new Error('secrets_forbidden'), { status: 400 })
+  }
+  let existing
+  try {
+    existing = await readNote(notePath)
+  } catch (e) {
+    if (e.status === 404) {
+      return writeNote({ path: notePath, text: addition.endsWith('\n') ? addition : `${addition}\n`, message })
+    }
+    throw e
+  }
+  const base = existing.text || ''
+  const next = `${base}${base.endsWith('\n') ? '' : '\n'}${addition}\n`
+  return writeNote({
+    path: existing.path || notePath,
+    text: next,
+    sha: existing.sha,
+    message: message || `TASKKA: append ${existing.path || notePath}`,
+  })
+}

package/src/setup.js

@@ -10,6 +10,7 @@ import process from 'node:process'
 import { persistSession, SESSION_FILE, supa } from './store.js'
 
 const SKILL_URL = 'https://taskka.app/.well-known/skills/taskka/SKILL.md'
+const FOOD_ORDERING_SKILL_URL = 'https://taskka.app/.well-known/skills/food-ordering/SKILL.md'
 const PACKAGE = 'taskswipe-mcp@latest'
 
 export function parseSetupArgs(argv = []) {
@@ -40,6 +41,12 @@ export function setupPlan(target) {
         args: ['skills', 'install', SKILL_URL],
         optional: true,
       },
+      {
+        label: 'Installing the guarded food-ordering skill',
+        command: 'hermes',
+        args: ['skills', 'install', FOOD_ORDERING_SKILL_URL],
+        optional: true,
+      },
       {
         label: 'Testing the MCP connection',
         command: 'hermes',

package/src/store.js

@@ -82,32 +82,48 @@ export function supa() {
 // design. Delete the file to start over from the env seed.
 export const SESSION_FILE = path.join(os.homedir(), '.taskswipe-mcp-session.json')
 
+function sessionCandidates() {
+  const out = []
+  const seen = new Set()
+  const add = file => {
+    const p = String(file || '').trim()
+    if (!p || seen.has(p)) return
+    seen.add(p)
+    out.push(p)
+  }
+  add(process.env.TASKSWIPE_SESSION_FILE)
+  add(SESSION_FILE)
+  add(path.join(os.homedir(), 'taskswipe-mcp-session.json'))
+  add('/opt/data/.taskswipe-mcp-session.json')
+  add('/opt/data/taskswipe-mcp-session.json')
+  return out
+}
+
 function loadSavedSession() {
-  try {
-    const j = JSON.parse(fs.readFileSync(SESSION_FILE, 'utf8'))
-    return j?.access_token && j?.refresh_token ? j : null
-  } catch { return null }
+  for (const file of sessionCandidates()) {
+    try {
+      const j = JSON.parse(fs.readFileSync(file, 'utf8'))
+      if (j?.access_token && j?.refresh_token) return j
+    } catch { /* try the next path */ }
+  }
+  return null
 }
 
 export function persistSession(session) {
-  fs.writeFileSync(
-    SESSION_FILE,
-    JSON.stringify({
-      access_token: session.access_token,
-      refresh_token: session.refresh_token,
-      expires_at: session.expires_at || null,
-    }),
-    { mode: 0o600 },
-  )
-  // writeFile's mode only applies when a file is first created. Correct an
-  // older or manually-created file too, so the credential is always private.
-  fs.chmodSync(SESSION_FILE, 0o600)
-  return SESSION_FILE
+  saveSession(session)
 }
 
 function saveSession(session) {
   try {
-    persistSession(session)
+    fs.writeFileSync(
+      SESSION_FILE,
+      JSON.stringify({
+        access_token: session.access_token,
+        refresh_token: session.refresh_token,
+        expires_at: session.expires_at || null,
+      }),
+      { mode: 0o600 },   // it's a credential — owner-only, like an SSH key
+    )
   } catch (e) {
     console.error('[taskswipe] could not persist session:', e?.message)
   }
@@ -193,22 +209,41 @@ export async function userId() {
     return cachedUserId
   }
 
-  // A password in an MCP config is a non-expiring credential for the whole
-  // account, sitting in plaintext in a file that gets committed by accident all
-  // the time. It still works — but it should never be the silent default, so
-  // say so. stderr, never stdout: stdout is the protocol.
-  console.error(
-    '[taskswipe] Signing in with a stored password. Prefer TASKSWIPE_ACCESS_TOKEN — '
-    + 'it expires on its own. See the README.',
+  const email = process.env.TASKSWIPE_EMAIL
+  const password = process.env.TASKSWIPE_PASSWORD
+  if (email && password) {
+    console.error(
+      '[taskswipe] Signing in with a stored password. Prefer TASKSWIPE_ACCESS_TOKEN — '
+      + 'it expires on its own. See the README.',
+    )
+    const { data, error } = await s.auth.signInWithPassword({ email, password })
+    if (error || !data?.user) throw new Error(`Sign-in failed: ${error?.message || 'unknown error'}`)
+    if (data.session) saveSession(data.session)
+    cachedUserId = data.user.id
+    return cachedUserId
+  }
+
+  throw new Error(
+    'No TASKKA session for this process. Looked for '
+    + sessionCandidates().join(', ')
+    + ` (HOME=${os.homedir()}). Run \`npx -y taskswipe-mcp@latest setup hermes\` `
+    + 'as the same user the Hermes gateway uses. Setup writes a session file — '
+    + 'do not set TASKSWIPE_EMAIL. Or put TASKSWIPE_ACCESS_TOKEN and '
+    + 'TASKSWIPE_REFRESH_TOKEN in the MCP env.',
   )
+}
 
-  const email = env('TASKSWIPE_EMAIL')
-  const password = env('TASKSWIPE_PASSWORD')
-  const { data, error } = await s.auth.signInWithPassword({ email, password })
-  if (error || !data?.user) throw new Error(`Sign-in failed: ${error?.message || 'unknown error'}`)
-  if (data.session) saveSession(data.session)
-  cachedUserId = data.user.id
-  return cachedUserId
+/** Signed-in user for owner-gated tools (Callum OS). */
+export async function currentUser() {
+  if (FAKE) return { email: process.env.CALLUM_OS_OWNER_EMAIL || 'c.dempsey@live.com.au' }
+  const scoped = requestCtx.getStore()?.supa
+  if (scoped) {
+    const { data } = await scoped.auth.getUser()
+    return data?.user || null
+  }
+  await userId()
+  const { data } = await supa().auth.getUser()
+  return data?.user || null
 }
 
 /** Current state plus the stamp a later write must match. */

package/src/tools.js

@@ -13,8 +13,10 @@
 //     can undo a batch.
 // ─────────────────────────────────────────────────────────────────────────────
 
-import { readState, mutate } from './store.js'
+import { readState, mutate, currentUser } from './store.js'
 import { buildBrief, buildDetail } from './brief.js'
+import { isOsOwner, osConfigured, osStatus, readNote, searchNotes, writeNote, appendNote, ensureFrontmatter, notePathFrom } from './os.js'
+import { ob1Configured, ob1Status, searchOb1, captureOb1 } from './ob1.js'
 
 const MAX_ADD = 10
 const uid = () => Math.random().toString(36).slice(2, 11)
@@ -92,9 +94,11 @@ export const TOOLS = [
     title: 'One area, in depth',
     description:
       'Depth on ONE area named by brief(). Pass any key from the brief\'s '
-      + '`areas` — today, habits, stacks, goals, food, lift, mind, study, '
-      + 'squares, backlog, missions. Still summarised: you get what someone '
-      + 'would reason with, not the raw rows.',
+      + '`areas` — today, dropped, backlog, docket, habits, stacks, goals, '
+      + 'food, lift, mind, study, squares, lists, frame, business, people, '
+      + 'things, missions. DROPPED is LOG\'s pile of unfinished tasks from '
+      + 'earlier days. Still summarised: you get what someone would reason '
+      + 'with, not the raw rows.',
     inputSchema: {
       type: 'object',
       properties: { area: { type: 'string', description: 'e.g. "habits", "food", "study"' } },
@@ -324,6 +328,51 @@ export const TOOLS = [
     },
   },
 
+  {
+    name: 'recover_dropped',
+    title: 'Put a DROPPED task back on today',
+    description:
+      'LOG → DROPPED holds tasks that aged out unfinished from earlier days. '
+      + 'This puts one back on today. Refer to it by any part of its text. '
+      + 'Does not charge decay. Use detail({ area: "dropped" }) first if you '
+      + 'do not know the wording.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        task: { type: 'string', minLength: 1, description: 'Any part of the dropped task text.' },
+      },
+      required: ['task'],
+      additionalProperties: false,
+    },
+    async run({ task }) {
+      let result = null
+      await mutate(state => {
+        const list = arr(state.missedTasks)
+        const hit = findTask(list, task)
+        if (!hit) { result = { ok: false, reason: 'no_match' }; return null }
+        if (hit.ambiguous) { result = { ok: false, reason: 'ambiguous', candidates: hit.ambiguous }; return null }
+        const { expiredDate, ...rest } = hit
+        const already = arr(state.todayTasks).find(t => !t.done && (t.text || '').toLowerCase() === (rest.text || '').toLowerCase())
+        result = { ok: true, task: rest.text, already: !!already }
+        return {
+          ...state,
+          missedTasks: list.filter(t => t.id !== hit.id),
+          todayTasks: already
+            ? state.todayTasks
+            : [...arr(state.todayTasks), { ...rest, id: uid(), done: false, createdDate: today(), source: 'mcp' }],
+        }
+      })
+      if (result?.reason === 'no_match') {
+        return { ok: false, message: `Nothing in DROPPED matches "${task}". Call detail({ area: "dropped" }).` }
+      }
+      if (result?.reason === 'ambiguous') {
+        return { ok: false, message: `That matches several in DROPPED: ${result.candidates.join(', ')}. Be more specific.` }
+      }
+      if (result.already) return { ok: true, message: `"${result.task}" was already on today. Removed from DROPPED.` }
+      return { ok: true, message: `Put "${result.task}" back on today from DROPPED.` }
+    },
+  },
+
   {
     name: 'search',
     title: 'Search everything',
@@ -347,9 +396,14 @@ export const TOOLS = [
         if (text && String(text).toLowerCase().includes(q)) hits.push({ where, text: String(text), ...extra })
       }
       arr(state.todayTasks).forEach(t => add('today', t.text, { done: !!t.done }))
+      arr(state.missedTasks).forEach(t => add('dropped', t.text, { expired: t.expiredDate || null }))
+      arr(state.cutTasks).forEach(t => add('cut', t.text))
       arr(state.backlogTasks).forEach(t => add('backlog', t.text))
+      arr(state.docketTasks).forEach(t => add('docket', t.text || t.task))
       arr(state.taskDatabase).forEach(t => add('database', t.text))
       arr(state.ideas).forEach(i => add('ideas', i.text))
+      arr(state.businessIdeas).forEach(i => add('business', i.title, { stage: i.stage || 'spark' }))
+      arr(state.people).forEach(p => add('people', p.name, { role: p.role || null }))
       arr(state.decompress).forEach(d => add('decompress', d.text))
       Object.entries(state.journal || {}).forEach(([date, entries]) =>
         arr(entries).forEach(e => add('journal', e?.text, { date })))
@@ -360,6 +414,183 @@ export const TOOLS = [
       return { query, count: hits.length, results: hits.slice(0, limit) }
     },
   },
+
+  {
+    name: 'os_search',
+    title: 'Search Callum OS',
+    description:
+      'Search Callum OS, the life wiki: businesses, portfolio, knowledge, '
+      + 'life areas and decisions. Use this when the question is about a '
+      + 'company, a written decision, or anything that lives in the vault '
+      + 'rather than today\'s TASKKA tasks.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: { type: 'string', minLength: 2 },
+        limit: { type: 'integer', minimum: 1, maximum: 40, default: 12 },
+      },
+      required: ['query'],
+      additionalProperties: false,
+    },
+    async run({ query, limit = 12 }) {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('Callum OS is locked to the vault owner.')
+      if (!osConfigured()) throw new Error('Callum OS is not configured on this server.')
+      return searchNotes(query, limit)
+    },
+  },
+
+  {
+    name: 'os_read',
+    title: 'Read a Callum OS note',
+    description:
+      'Read one markdown note from Callum OS by path, e.g. "index.md", '
+      + '"10 Businesses/Care in Movement/index.md", or "60 Life/index.md". '
+      + 'Call os_search first if you do not know the path.',
+    inputSchema: {
+      type: 'object',
+      properties: { path: { type: 'string', minLength: 1, maxLength: 400 } },
+      required: ['path'],
+      additionalProperties: false,
+    },
+    async run({ path }) {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('Callum OS is locked to the vault owner.')
+      if (!osConfigured()) throw new Error('Callum OS is not configured on this server.')
+      const note = await readNote(path)
+      const text = String(note.text || '')
+      return { ...note, text: text.length > 12000 ? `${text.slice(0, 12000)}\n…[truncated]` : text }
+    },
+  },
+
+  {
+    name: 'os_status',
+    title: 'Callum OS connection',
+    description: 'Whether Callum OS is reachable and how many notes are in the vault.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    async run() {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('Callum OS is locked to the vault owner.')
+      return osStatus()
+    },
+  },
+
+  {
+    name: 'os_write',
+    title: 'Write a Callum OS note',
+    description:
+      'Create or replace one markdown note in Callum OS. Pass the full vault '
+      + 'path (e.g. "01 Inbox/capture.md" or "10 Businesses/Care in Movement/notes.md"). '
+      + 'This OVERWRITES the file — call os_read first if you are editing. '
+      + 'New notes get YAML frontmatter with type: Note. Never write secrets.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', minLength: 1, maxLength: 400 },
+        text: { type: 'string', minLength: 1, maxLength: 50000 },
+        message: { type: 'string', maxLength: 200 },
+        folder: { type: 'string', description: 'Optional folder when creating from a title instead of a path' },
+        title: { type: 'string', description: 'Optional title used to build a new path under folder' },
+      },
+      additionalProperties: false,
+    },
+    async run({ path, text, message, folder, title }) {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('Callum OS is locked to the vault owner.')
+      if (!osConfigured()) throw new Error('Callum OS is not configured on this server.')
+      const target = path || notePathFrom({ folder: folder || '01 Inbox', name: title || 'Note' })
+      if (!target) throw new Error('Need a path or a title for the new note.')
+      const body = ensureFrontmatter(text, { title: title || target.split('/').pop() })
+      const saved = await writeNote({ path: target, text: body, message })
+      return { ok: true, ...saved, message: saved.created ? `Created ${saved.path}` : `Updated ${saved.path}` }
+    },
+  },
+
+  {
+    name: 'os_append',
+    title: 'Append to a Callum OS note',
+    description:
+      'Add text to the end of an existing Callum OS note (creates it if missing). '
+      + 'Use this for log.md, inbox capture, or adding a decision without rewriting the file.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        path: { type: 'string', minLength: 1, maxLength: 400 },
+        text: { type: 'string', minLength: 1, maxLength: 20000 },
+        message: { type: 'string', maxLength: 200 },
+      },
+      required: ['path', 'text'],
+      additionalProperties: false,
+    },
+    async run({ path, text, message }) {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('Callum OS is locked to the vault owner.')
+      if (!osConfigured()) throw new Error('Callum OS is not configured on this server.')
+      const saved = await appendNote({ path, text, message })
+      return { ok: true, ...saved, message: `Appended to ${saved.path}` }
+    },
+  },
+
+  {
+    name: 'ob1_status',
+    title: 'OB1 connection',
+    description: 'Whether One Brain / OB1 is reachable and how many thoughts it holds.',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    async run() {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('OB1 is locked to the vault owner.')
+      return ob1Status()
+    },
+  },
+
+  {
+    name: 'ob1_search',
+    title: 'Search OB1',
+    description:
+      'Search One Brain / OB1, the durable cross-tool memory. Use this for '
+      + 'preferences, lessons, and decisions that should follow Callum between '
+      + 'apps — not for today\'s TASKKA tasks or a whole Callum OS note.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: { type: 'string', minLength: 2 },
+        limit: { type: 'integer', minimum: 1, maximum: 20, default: 8 },
+      },
+      required: ['query'],
+      additionalProperties: false,
+    },
+    async run({ query, limit = 8 }) {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('OB1 is locked to the vault owner.')
+      if (!ob1Configured()) throw new Error('OB1 is not configured on this server.')
+      return searchOb1(query, { limit })
+    },
+  },
+
+  {
+    name: 'ob1_capture',
+    title: 'Capture to OB1',
+    description:
+      'Save one concise thought to One Brain / OB1. Use this when a map topic, '
+      + 'Parley card, learn, or note should follow Callum into future AI sessions. '
+      + 'Do not dump a whole vault file. Never write secrets.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        text: { type: 'string', minLength: 1, maxLength: 4000 },
+        source: { type: 'string', maxLength: 40, description: 'parley, study-map, note, idea, os' },
+        title: { type: 'string', maxLength: 160 },
+      },
+      required: ['text'],
+      additionalProperties: false,
+    },
+    async run({ text, source, title }) {
+      const user = await currentUser()
+      if (!isOsOwner(user)) throw new Error('OB1 is locked to the vault owner.')
+      if (!ob1Configured()) throw new Error('OB1 is not configured on this server.')
+      return captureOb1({ text, source, title })
+    },
+  },
 ]
 
 export const byName = Object.fromEntries(TOOLS.map(t => [t.name, t]))