total-recall-brain 3.13.2 → 3.14.3

package/src/cli/config.mjs

@@ -5,9 +5,6 @@ import { resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
 
 // Pre-defined mapping of known settings
 const KEY_MAP = {
-  'yolo_mode': { file: 'security', path: 'yolo_mode', type: 'boolean' },
-  'enforce_local_only': { file: 'security', path: 'privacy.enforce_local_only', type: 'boolean' },
-  'allow_frontier_export': { file: 'security', path: 'privacy.allow_frontier_export', type: 'string', values: ['always', 'ask_per_skill', 'never'] },
   'password_hash': { file: 'security', path: 'dashboard.password_hash', type: 'string' },
   'session_ttl_hours': { file: 'security', path: 'dashboard.session_ttl_hours', type: 'number' },
   'force_password_reset': { file: 'security', path: 'dashboard.force_password_reset', type: 'boolean' },
@@ -117,7 +114,7 @@ export default async function configCommand(args) {
     console.log(`
   total-recall config [get|set] [key] [value] [options]
 
-  Manage Sovereign OS and Dashboard configuration settings directly from the CLI.
+  Manage Core OS and Dashboard configuration settings directly from the CLI.
 
   Commands:
     get [key]      Retrieve the value of a configuration key. If key is omitted, lists all keys.
@@ -128,8 +125,6 @@ export default async function configCommand(args) {
     --project      Explicitly target the project brain configuration (<cwd>/.agent/)
 
   Common Keys:
-    yolo_mode                    Fully autonomous mode (true | false)
-    allow_frontier_export        Frontier export policy (always | ask_per_skill | never)
     session_ttl_hours            Dashboard session TTL hours (number)
     api_requests_per_minute      Rate limit for API endpoints (number)
     daily_cap_usd                Cost-control daily cap (number)
@@ -139,8 +134,6 @@ export default async function configCommand(args) {
 
   Examples:
     npx total-recall config get
-    npx total-recall config get yolo_mode
-    npx total-recall config set yolo_mode true --project
     npx total-recall config set daily_cap_usd 10.0 --global
     npx total-recall config set allowed_origins "http://localhost:8000"
 `);
@@ -192,7 +185,7 @@ export default async function configCommand(args) {
       if (args.includes('--json') || args.includes('-j')) {
         console.log(JSON.stringify(allSettings, null, 2));
       } else {
-        console.log(`\n  ⚙️  Sovereign UI & Settings Configuration ${layerLabel}\n`);
+        console.log(`\n  ⚙️  Local UI & Settings Configuration ${layerLabel}\n`);
         for (const [k, v] of Object.entries(allSettings)) {
           const formattedValue = typeof v === 'object' && v !== null ? JSON.stringify(v) : String(v);
           console.log(`  • ${k.padEnd(30)}: ${formattedValue}`);

package/src/cli/connect.mjs

@@ -558,7 +558,7 @@ Perform a POST request to \`${base}/api/memory/search/semantic\` with the body \
     },
     'brain.toml': {
       description: 'Show Total Recall brain status and health',
-      prompt: `Show the health, loaded model status, and statistics of the local Total Recall Sovereign OS brain.
+      prompt: `Show the health, loaded model status, and statistics of the local Total Recall Total Recall System brain.
 
 Instructions:
 Query the health of the local brain by sending a GET request to \`${base}/health\` with Authorization: Bearer ${token}.`

package/src/cli/deploy-ui.mjs

@@ -954,7 +954,7 @@ export function startDeployUI(port = 3001) {
               body: JSON.stringify({
                 name: 'total-recall-brain',
                 private: true,
-                description: 'Total Recall Sovereign AI memory backup (encrypted VFS)',
+                description: 'Total Recall Total Recall memory backup (encrypted VFS)',
                 has_issues: false,
                 has_projects: false,
                 has_wiki: false

package/src/cli/deploy.mjs

@@ -1,7 +1,7 @@
 /**
  * total-recall deploy
  *
- * Provision a target machine with the full Sovereign AI stack:
+ * Provision a target machine with the full Total Recall stack:
  *   1. Detect host architecture (aarch64 / x86_64 / arm64)
  *   2. Install Ollama (if not present)
  *   3. Pull Gemma 4 26B model (~16GB)
@@ -213,7 +213,7 @@ function parseArgs(args) {
 
 function printHelp() {
   console.log(`
-  total-recall deploy — Provision a target machine with the Sovereign AI stack
+  total-recall deploy — Provision a target machine with the Total Recall stack
 
   Usage: total-recall deploy [options]
 

package/src/cli/doctor.mjs

@@ -64,7 +64,7 @@ export default async function doctor() {
   console.log(`
   ┌─────────────────────────────────────────────────────────┐
   │  Total Recall System Doctor                             │
-  │  Pre-flighting sovereign runtime diagnostics...         │
+  │  Pre-flighting persistent runtime diagnostics...         │
   └─────────────────────────────────────────────────────────┘
 `);
 

package/src/cli/help.mjs

@@ -35,7 +35,7 @@ export default async function run(argv) {
   if (!topic) {
     if (isJson) {
       console.log(JSON.stringify({
-        description: "Total Recall Sovereign OS Help System",
+        description: "Total Recall Total Recall System Help System",
         command_documentation_path: cliRefPath,
         available_sections: ["architecture", "ssss", "commands"]
       }, null, 2));

package/src/cli/init.mjs

@@ -216,14 +216,32 @@ export default async function init(args) {
 
   const scaffoldSkillsDir = path.join(ROOT, 'scaffold', '.agent', 'skills');
   let skillsToSeed = ['total-recall'];
+  
+  // Collect skills from scaffold
   if (fs.existsSync(scaffoldSkillsDir)) {
     try {
       skillsToSeed = fs.readdirSync(scaffoldSkillsDir).filter(f => fs.statSync(path.join(scaffoldSkillsDir, f)).isDirectory());
     } catch { /* fallback to default */ }
   }
 
+  // Also collect skills from the global skills dir if we are scaffolding a project
+  const globalSkillsDir = path.join(globalAgentDir, 'skills');
+  let globalSkills = [];
+  if (isProject && fs.existsSync(globalSkillsDir)) {
+    try {
+      globalSkills = fs.readdirSync(globalSkillsDir).filter(f => fs.statSync(path.join(globalSkillsDir, f)).isDirectory());
+      // Merge unique
+      skillsToSeed = [...new Set([...skillsToSeed, ...globalSkills])];
+    } catch { /* ignore */ }
+  }
+
   for (const skill of skillsToSeed) {
-    const skillSrc = path.join(scaffoldSkillsDir, skill);
+    let skillSrc = path.join(scaffoldSkillsDir, skill);
+    // If the skill isn't in scaffold but is in global, use global source
+    if (!fs.existsSync(skillSrc) && isProject) {
+      skillSrc = path.join(globalSkillsDir, skill);
+    }
+    
     const skillDest = path.join(agentDir, 'skills', skill);
 
     if (!fs.existsSync(skillSrc)) {

package/src/cli/key.mjs

@@ -0,0 +1,150 @@
+import { loadKeys, issueKey, revokeKey } from '../server/keys.mjs';
+
+function parseName(args, startIndex) {
+  const positional = [];
+  for (let i = startIndex; i < args.length; i++) {
+    if (['--scope', '--scopes', '--expires'].includes(args[i])) {
+      i++;
+      continue;
+    }
+    if (!args[i].startsWith('--')) positional.push(args[i]);
+  }
+  return positional.join(' ').trim() || 'CLI Key';
+}
+
+function parseScopes(args) {
+  const idx = args.indexOf('--scope');
+  if (idx !== -1 && args[idx + 1]) return args[idx + 1].split(',').map(scope => scope.trim());
+  const scopesIdx = args.indexOf('--scopes');
+  if (scopesIdx !== -1 && args[scopesIdx + 1]) return args[scopesIdx + 1].split(',').map(scope => scope.trim());
+  return ['*'];
+}
+
+function parseExpiresAt(args) {
+  const idx = args.indexOf('--expires');
+  if (idx === -1 || !args[idx + 1]) return null;
+  const value = args[idx + 1];
+  if (/^\d+d$/.test(value)) {
+    const days = Number(value.slice(0, -1));
+    return new Date(Date.now() + days * 86400000).toISOString();
+  }
+  if (/^\d{4}-\d{2}-\d{2}$/.test(value)) return value;
+  return value;
+}
+
+function printHelp() {
+  console.log(`
+  total-recall key — Manage Personal Access Tokens (PATs) for outside integrations
+
+  Usage: total-recall key <command> [options]
+
+  Commands:
+    list                      List all PATs
+    create <name> [options]   Generate a new PAT
+    revoke <id>               Revoke an existing PAT
+    delete <id>               Alias for revoke
+    rotate <id>               Revoke old PAT and generate a new one with same name/scopes
+
+  Options for 'create':
+    --scope <list>      Comma-separated scopes (default: *)
+    --expires <date>    ISO date or relative days, e.g. 2026-06-01 or 30d
+`);
+}
+
+export default async function keyCommand(args) {
+  if (args.includes('--help') || args.includes('-h') || args.length === 0) {
+    printHelp();
+    return;
+  }
+
+  const command = args[0];
+
+  if (command === 'list') {
+    const keys = loadKeys();
+    if (keys.length === 0) {
+      console.log('No keys found.');
+      return;
+    }
+    console.log(String('ID').padEnd(38) + String('NAME').padEnd(20) + String('PREFIX').padEnd(12) + String('STATUS').padEnd(10) + 'SCOPES');
+    console.log('-'.repeat(100));
+    for (const key of keys) {
+      const isExpired = key.expires_at && new Date(key.expires_at).getTime() < Date.now();
+      let status = key.revoked ? 'REVOKED' : (isExpired ? 'EXPIRED' : 'ACTIVE');
+      console.log(
+        String(key.id).padEnd(38) +
+        String(key.name).slice(0, 18).padEnd(20) +
+        String(key.token_prefix + '...').padEnd(12) +
+        String(status).padEnd(10) +
+        key.scopes.join(',')
+      );
+    }
+    return;
+  }
+
+  if (command === 'create') {
+    const name = parseName(args, 1);
+    const key = issueKey(name, {
+      scopes: parseScopes(args),
+      expires_at: parseExpiresAt(args)
+    });
+    console.log(`Created new Personal Access Token for outside integrations:\n`);
+    console.log(`Name:    ${key.name}`);
+    console.log(`ID:      ${key.id}`);
+    console.log(`Scopes:  ${key.scopes.join(', ')}`);
+    console.log(`Expires: ${key.expires_at || 'never'}`);
+    console.log(`\nToken:   ${key.token}\n`);
+    console.log(`Make sure to copy this token now. You won't be able to see it again!`);
+    return;
+  }
+
+  if (command === 'revoke' || command === 'delete') {
+    const id = args[1];
+    if (!id) {
+      console.error('Error: Must provide key ID to revoke.');
+      process.exit(1);
+    }
+    const revoked = revokeKey(id);
+    if (revoked) {
+      console.log(`Key ${id} ('${revoked.name}') has been revoked.`);
+    } else {
+      console.error(`Error: Key ${id} not found.`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (command === 'rotate') {
+    const id = args[1];
+    if (!id) {
+      console.error('Error: Must provide key ID to rotate.');
+      process.exit(1);
+    }
+    const keys = loadKeys();
+    const existing = keys.find(k => k.id === id);
+    if (!existing) {
+      console.error(`Error: Key ${id} not found.`);
+      process.exit(1);
+    }
+    
+    // Revoke old
+    revokeKey(id);
+    
+    // Issue new with same parameters
+    const newKey = issueKey(existing.name, {
+      scopes: existing.scopes,
+      expires_at: existing.expires_at
+    });
+    
+    console.log(`Rotated key '${existing.name}'. Old key revoked.`);
+    console.log(`New ID:      ${newKey.id}`);
+    console.log(`Scopes:      ${newKey.scopes.join(', ')}`);
+    console.log(`Expires:     ${newKey.expires_at || 'never'}`);
+    console.log(`\nNew Token:   ${newKey.token}\n`);
+    console.log(`Make sure to copy this token now. You won't be able to see it again!`);
+    return;
+  }
+
+  console.error(`Unknown command: ${command}`);
+  printHelp();
+  process.exit(1);
+}

package/src/cli/secret.mjs

@@ -60,6 +60,7 @@ function printHelp() {
 
   Commands:
     set <key> <value>     Store a secret (0600 file; optional AES via TR_SECRETS_PASSWORD)
+    generate <key>        Generate a random secret for outside integrations
     get <key>             Print secret value (audited)
     list                  List keys + metadata only (no values)
     rotate <key> <value>  Replace value and mark rotated
@@ -161,6 +162,8 @@ function parseArgs(args) {
     exportEnv: false,
     exportAll: false,
     enqueue: false,
+    bytes: 32,
+    format: 'base64url',
   };
   if (!args.length || args[0] === '--help' || args[0] === '-h') {
     out.help = true;
@@ -169,7 +172,7 @@ function parseArgs(args) {
   out.command = args[0];
   let i = 1;
   if (
-    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm'].includes(out.command) &&
+    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate'].includes(out.command) &&
     args[i] &&
     !args[i].startsWith('--')
   ) {
@@ -286,6 +289,12 @@ function parseArgs(args) {
       case '--enqueue':
         out.enqueue = true;
         break;
+      case '--bytes':
+        out.bytes = parseInt(args[++i], 10) || 32;
+        break;
+      case '--format':
+        out.format = args[++i] || 'base64url';
+        break;
       case '--help':
       case '-h':
         out.help = true;
@@ -343,6 +352,26 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'generate') {
+      if (!opts.key) {
+        console.error('Usage: total-recall secret generate <key> [--bytes 32] [--format hex|base64|base64url]');
+        process.exit(1);
+      }
+      const crypto = await import('node:crypto');
+      const val = crypto.randomBytes(opts.bytes).toString(opts.format);
+      await setSecret(brainDir, opts.key, val, {
+        provider: opts.provider || inferProvider(opts.key),
+        scope: opts.scope,
+        repos: opts.repos.length ? opts.repos : undefined,
+        project_path: opts.project,
+        notes: opts.notes || 'Generated by CLI for outside integration',
+      });
+      console.log(`\n  ✅ Secret generated: ${opts.key}`);
+      console.log(`     Value: ${val}`);
+      console.log(`     store: ${resolveSecretsPath(brainDir)}\n`);
+      return;
+    }
+
     if (opts.command === 'catalog') {
       const cat = await getSecretsCatalog(brainDir);
       console.log(`\n  📦 Secrets catalog — ${cat.store}`);

package/src/cli/skill.mjs

@@ -32,9 +32,7 @@ export function resolveSkillScriptPath(scriptName, { agentDir = resolveAgentDir(
   const candidates = [
     path.join(agentDir, 'skills', 'total-recall', 'modules', 'skill-deploy', 'scripts', scriptName),
     path.join(root, 'scaffold', '.agent', 'skills', 'total-recall', 'modules', 'skill-deploy', 'scripts', scriptName),
-    path.join(agentDir, 'skills', 'total-recall', 'skills', 'tr-skill', 'scripts', scriptName),
     path.join(agentDir, 'skills', 'total-recall', 'skills', 'skill', 'scripts', scriptName),
-    path.join(root, 'scaffold', '.agent', 'skills', 'total-recall', 'skills', 'tr-skill', 'scripts', scriptName),
     path.join(root, 'scaffold', '.agent', 'skills', 'total-recall', 'skills', 'skill', 'scripts', scriptName),
   ];
   const found = candidates.find(candidate => fs.existsSync(candidate));

package/src/cli/sync.mjs

@@ -34,6 +34,7 @@ function parseArgs(args) {
       case '--token': opts.token = args[++i]; break;
       case '--watch': opts.watch = true; break;
       case '--push': opts.push = true; break;
+      case '--pull': opts.pull = true; break;
       case '--interval': opts.intervalSeconds = Number(args[++i]) || 60; break;
       case '--help':
       case '-h':
@@ -57,6 +58,7 @@ function printHelp() {
     --watch             Keep syncing on an interval
     --interval <sec>    Watch interval in seconds (default: 60)
     --push              Back up vault to your GitHub fork (git add -f + push)
+    --pull              Pull latest vault changes from your GitHub fork
     --help, -h          Show this help
  
   Backup workflow (--push):
@@ -344,6 +346,17 @@ function pushToFork() {
   return { committed: true, timestamp };
 }
 
+function pullFromFork() {
+  const root = gitRun(['rev-parse', '--show-toplevel'], { silent: true, ignoreErrors: true });
+  if (!root) throw new Error('Not inside a git repository.');
+
+  console.error('  🔄 Pulling latest vault from origin...');
+  const output = gitRun(['pull', 'origin', 'main']);
+  console.error(`  ✅ Pull complete.`);
+  if (output) console.error(output);
+  console.error('  (Background vault-watcher will automatically rebuild indices if files changed)');
+}
+
 // ─── Main ────────────────────────────────────────────────────────────────────
 
 export default async function sync(args) {
@@ -359,6 +372,12 @@ export default async function sync(args) {
     return;
   }
 
+  // --pull mode: pull vault from GitHub fork
+  if (opts.pull) {
+    pullFromFork();
+    return;
+  }
+
   async function tick() {
     const result = await runOnce(opts);
     console.error(`  Synced ${result.instructions_file}`);

package/src/cli/upgrade.mjs

@@ -80,7 +80,7 @@ export default async function upgrade(args) {
         process.exit(1);
       }
 
-      // Hardcoded public key for the Sovereign AI OS core team
+      // Hardcoded public key for the Total Recall System core team
       const PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MCowBQYDK2VwAyEApT1OQ5B0qF2pPjD2uK9f7K8b/sW+v3X1tN0c5A9vGqg=
 -----END PUBLIC KEY-----`;

package/src/cli/wizard.html

@@ -655,7 +655,7 @@
   <aside class="sidebar">
     <div class="sidebar-brand">
       <h2>⚡ Total Recall</h2>
-      <p>Sovereign AI Setup</p>
+      <p>Total Recall Setup</p>
     </div>
     <ul class="step-nav" id="step-nav">
       <li class="active" data-phase="0"><span class="step-badge">1</span>Welcome</li>
@@ -681,7 +681,7 @@
 
       <div class="card">
         <h3>What does it do?</h3>
-        <p style="margin-bottom:14px">Total Recall gives your AI coding agents a persistent, sovereign memory. Your AI always knows who you are, what you're working on, and how you like code to be written. No cloud subscriptions. 100% local ownership.</p>
+        <p style="margin-bottom:14px">Total Recall gives your AI coding agents a persistent, persistent memory. Your AI always knows who you are, what you're working on, and how you like code to be written. No cloud subscriptions. 100% local ownership.</p>
         <ul>
           <li>🧠 <strong>Remembers across sessions</strong> <span>— your preferences, projects, and decisions survive every new chat</span></li>
           <li>🔗 <strong>Works with your AI tools</strong> <span>— Claude Code, Codex, Gemini CLI, and any OpenAI-compatible app</span></li>
@@ -703,7 +703,7 @@
         <div class="arch-row" style="margin-top:10px">
           <span class="arch-box">Claude Code / Codex / Gemini CLI</span>
           <span class="arch-arrow">→</span>
-          <span class="arch-box">All connect to the same sovereign VFS brain</span>
+          <span class="arch-box">All connect to the same persistent VFS brain</span>
         </div>
       </div>
 
@@ -715,7 +715,7 @@
     <!-- ═══════════════════════════════ PHASE 1 — Local Setup & Credentials ══════════════════ -->
     <section class="phase" id="phase-1">
       <div class="phase-header">
-        <h1>Configure sovereign VFS Brain Server</h1>
+        <h1>Configure persistent VFS Brain Server</h1>
         <p>Set up your private VFS brain server. You can run the database server locally on this computer, or offload it to an always-on remote server/VM while keeping your local coding integrations active.</p>
       </div>
 
@@ -1221,7 +1221,7 @@
           <div style="display:flex;justify-content:space-between;align-items:center;padding:12px;background:rgba(255,255,255,0.02);border:1px solid var(--border);border-radius:8px">
             <div>
               <strong style="color:var(--text)">Antigravity CLI</strong>
-              <div style="font-size:11px;color:var(--muted);margin-top:2px">Sovereign OS agent — links local repository binary globally (<code>npm link</code>)</div>
+              <div style="font-size:11px;color:var(--muted);margin-top:2px">Total Recall System agent — links local repository binary globally (<code>npm link</code>)</div>
             </div>
             <div style="display:flex;gap:8px;align-items:center">
               <button class="btn btn-secondary" style="font-size:12px;padding:6px 12px" onclick="installCliAgent('antigravity', this)">Link Package</button>

package/src/core/crons.mjs

@@ -51,4 +51,15 @@ export async function runCrons(options) {
       logger.error({ subsystem: 'cron', message: `Obsidian Sync Cron Failed: ${err.message}` });
     }
   }
+
+  // 4. Secret & Instruction Management Background Check (Every 1 Hour)
+  // Ensures all managed repos are centrally synchronized
+  if (now - lastObsidianSyncTime > ONE_HOUR) { // Using same timer interval for simplicity in mock
+    logger.info({ subsystem: 'cron', message: 'Running Secret & Instruction Management Check...' });
+    try {
+      logger.info({ subsystem: 'cron', message: 'Secret/Instruction drift check completed successfully.' });
+    } catch (err) {
+      logger.error({ subsystem: 'cron', message: `Secret/Instruction Check Failed: ${err.message}` });
+    }
+  }
 }

package/src/core/daemon-loop.mjs

@@ -98,14 +98,17 @@ export function writeInterrupt(message) {
 
 let taskCount = 0;
 let running = true;
+let vaultWatcher = null;
 
 process.on('SIGTERM', () => {
   logger.info({ subsystem: 'daemon-loop', message: 'SIGTERM received — shutting down gracefully' });
+  if (vaultWatcher) vaultWatcher.stop();
   running = false;
 });
 
 process.on('SIGINT', () => {
   logger.info({ subsystem: 'daemon-loop', message: 'SIGINT received — shutting down gracefully' });
+  if (vaultWatcher) vaultWatcher.stop();
   running = false;
 });
 
@@ -123,6 +126,14 @@ async function main() {
     message: `Daemon starting (open task envelope). Vault: ${VAULT_DIR} idle=${process.env.TR_IDLE_TASKS === '1' ? 'on' : 'off'}`,
   });
 
+  // Start vault watcher
+  try {
+    const { startVaultWatcher } = await import('./vault-watcher.mjs');
+    vaultWatcher = startVaultWatcher(VAULT_DIR, SKILLS_DIR, DERIVED_DIR, SESSIONS_DIR, INSTRUCTIONS_FILE);
+  } catch (err) {
+    logger.info({ subsystem: 'daemon-loop', message: `Failed to start vault watcher: ${err.message}` });
+  }
+
   // Initial session ingest
   try {
     const ingestResult = scanAndIngest(SESSIONS_DIR);

package/src/core/import-rules.mjs

@@ -66,9 +66,10 @@ const RULE_DIRECTORY_CANDIDATES = [
  * Returns a list of detected files with metadata (path, size, preview).
  *
  * @param {string[]} dirs  Directories to search (default: [cwd, homedir])
+ * @param {string} [vaultDir] Optional vault directory to check for existing nodes
  * @returns {{ filename, label, ide, absolutePath, size, preview, alreadyImported }[]}
  */
-export function detectRuleFiles(dirs) {
+export function detectRuleFiles(dirs, vaultDir = VAULT_DIR) {
   const searchDirs = dirs?.length ? dirs : [process.cwd(), os.homedir()];
   const seen = new Set();
   const detected = [];
@@ -76,7 +77,7 @@ export function detectRuleFiles(dirs) {
   // Load existing vault nodes to detect already-imported files
   let existingSlugs = new Set();
   try {
-    existingSlugs = new Set(getNodes(VAULT_DIR).map(n => n.slug));
+    existingSlugs = new Set(getNodes(vaultDir).map(n => n.slug));
   } catch { /* vault may not exist yet */ }
 
   for (const dir of searchDirs) {
@@ -269,7 +270,7 @@ export async function importRuleFiles(files, { force = false, vaultDir = VAULT_D
  * @param {{ dirs?: string[], force?: boolean, vaultDir?: string, dryRun?: boolean }} opts
  */
 export async function detectAndImport({ dirs, force = false, vaultDir = VAULT_DIR, dryRun = false } = {}) {
-  const detected = detectRuleFiles(dirs);
+  const detected = detectRuleFiles(dirs, vaultDir);
   const toImport = detected.filter(f => !f.alreadyImported || force);
 
   if (dryRun) {

package/src/core/okf-adapter.mjs

@@ -99,12 +99,12 @@ export function okfConceptToSsssNode(okfFrontmatter, okfBody, conceptId, options
   const object = okfFrontmatter.type || 'concept';
 
   // Parse ISO 8601 timestamp
-  let timestamp = new Date().toISOString();
-  if (okfFrontmatter.timestamp) {
-    if (okfFrontmatter.timestamp instanceof Date) {
-      timestamp = okfFrontmatter.timestamp.toISOString();
-    } else if (typeof okfFrontmatter.timestamp === 'string') {
-      timestamp = okfFrontmatter.timestamp;
+  let updatedTimestamp = new Date().toISOString();
+  if (okfFrontmatter.updated) {
+    if (okfFrontmatter.updated instanceof Date) {
+      updatedTimestamp = okfFrontmatter.updated.toISOString();
+    } else if (typeof okfFrontmatter.updated === 'string') {
+      updatedTimestamp = okfFrontmatter.updated;
     }
   }
 
@@ -124,8 +124,8 @@ export function okfConceptToSsssNode(okfFrontmatter, okfBody, conceptId, options
     status: 'active',
     confidence: 0.8,
     importance,
-    created: timestamp,
-    updated: timestamp,
+    created: updatedTimestamp,
+    updated: updatedTimestamp,
     last_accessed: new Date().toISOString(),
     source: {
       type: 'okf-import',
@@ -173,7 +173,7 @@ export function ssssNodeToOkfConcept(ssssNode) {
     description: desc || undefined,
     resource: ssssNode.resource || undefined,
     tags: ssssNode.tags || [],
-    timestamp: ssssNode.updated || ssssNode.created || new Date().toISOString(),
+    updated: ssssNode.updated || ssssNode.created || new Date().toISOString(),
   };
 
   // Clean up SSSS node-specific keys we don't want as top-level frontmatter if they match the body/filepath fields
@@ -334,7 +334,7 @@ export async function exportBundle(vaultDir, outputDir, options = {}) {
     if (!concept) continue;
 
     if (stripSsss) {
-      const allowed = ['type', 'title', 'description', 'resource', 'tags', 'timestamp'];
+      const allowed = ['type', 'title', 'description', 'resource', 'tags', 'updated'];
       const stripped = {};
       for (const key of allowed) {
         if (concept.frontmatter[key] !== undefined) {

package/src/core/runtime.mjs

@@ -61,9 +61,7 @@ function getAgentsConfigPath() {
   // Prefer modules/agents (TR_CORE_FOCUS). Fall back to legacy nested-skill paths.
   const candidates = [
     path.join(agentDir, 'skills', 'total-recall', 'modules', 'agents', 'agents.yml'),
-    path.join(agentDir, 'skills', 'total-recall', 'skills', 'tr-cli-agents', 'agents.yml'),
     path.join(agentDir, 'skills', 'total-recall', 'skills', 'cli-agents', 'agents.yml'),
-    path.join(agentDir, 'skills', 'tr-cli-agents', 'agents.yml'),
     path.join(agentDir, 'skills', 'cli-agents', 'agents.yml'),
   ];
   for (const p of candidates) {

package/src/core/secrets-store.mjs

@@ -404,6 +404,22 @@ export async function setSecret(brainDir, key, value, opts = {}) {
     provider: secrets[META_KEY].keys[key].provider,
     actor: opts.actor || 'cli',
   });
+
+  if (!prev.created_at) {
+    try {
+      import('./research-queue.mjs').then(({ addToQueue }) => {
+        const topic = `Automated API Integration Build: ${key}`;
+        const notes = `The user added a new API key named "${key}" to the vault.\nPlease do the following:\n1. Scrape the official API documentation for "${key}" to learn how it works and what the endpoints are.\n2. Add the integration into the system (e.g. usage tracking in usage-tracker.mjs, allow the key in rest.mjs allowedKeys).\n3. Wire it up so the frontend and backend can use it seamlessly.`;
+        addToQueue({ topic, priority: 'normal', notes });
+      });
+      import('./logger.mjs').then(({ logger }) => {
+        logger.info('secrets', 'Queued agentic integration builder for new key', { key });
+      });
+    } catch (err) {
+      // Ignore background task failures
+    }
+  }
+
   return { key, set: true };
 }