total-recall-brain 3.18.2 → 3.18.3

package/src/server/routes/secrets.mjs

@@ -118,15 +118,18 @@ router.get('/api/secrets/sync/status', requireAuth, requireScope('keys:read', 'c
     const peers = getMeshPeers();
     const authorization = await getMeshSyncAuthorization();
     
+    // Mesh peers over Tailscale can take multi-second RTT under load (WAN laptop↔cloud).
+    // 1.5s was too aggressive and reported healthy peers as unreachable.
+    const PEER_PROBE_TIMEOUT_MS = 10_000;
     const nodes = await Promise.all(peers.map(async (peer) => {
       try {
         const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 1500);
+        const timeoutId = setTimeout(() => controller.abort(), PEER_PROBE_TIMEOUT_MS);
         
         const response = await throttledFetch(meshPeerUrl(peer.ip, '/api/secrets/checksum'), {
           signal: controller.signal,
           headers: { Authorization: authorization }
-        }, 1_500);
+        }, PEER_PROBE_TIMEOUT_MS);
         clearTimeout(timeoutId);
         
         if (response.ok) {
@@ -164,10 +167,11 @@ router.post('/api/secrets/sync/trigger', requireAuth, requireScope('keys:write',
     const peers = getMeshPeers();
     const authorization = await getMeshSyncAuthorization();
     
+    const PEER_TRIGGER_TIMEOUT_MS = 10_000;
     const results = await Promise.all(peers.map(async (peer) => {
       try {
         const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 1500);
+        const timeoutId = setTimeout(() => controller.abort(), PEER_TRIGGER_TIMEOUT_MS);
         
         const response = await throttledFetch(meshPeerUrl(peer.ip, '/api/secrets/sync/trigger-pull'), {
           method: 'POST',
@@ -176,7 +180,7 @@ router.post('/api/secrets/sync/trigger', requireAuth, requireScope('keys:write',
             'Content-Type': 'application/json',
             Authorization: authorization
           }
-        }, 1_500);
+        }, PEER_TRIGGER_TIMEOUT_MS);
         clearTimeout(timeoutId);
         
         return {
@@ -233,6 +237,108 @@ router.get('/api/secrets/providers', requireAuth, requireScope('keys:read', 'con
   res.json({ providers: listProviders() });
 });
 
+/**
+ * GET /api/secrets/tracking-health
+ * Hard status: any set secret without tracking_status=ok|exempt is an error.
+ */
+router.get(
+  '/api/secrets/tracking-health',
+  requireAuth,
+  requireScope('keys:read', 'config:read'),
+  async (req, res) => {
+    try {
+      const brainDir = brainDirFromReq(req);
+      const { getTrackingHealth } = await import('../../core/provider-account-sync.mjs');
+      const health = await getTrackingHealth(brainDir);
+      res.status(health.healthy ? 200 : 409).json(health);
+    } catch (err) {
+      serverError(res, err);
+    }
+  },
+);
+
+/**
+ * GET /api/secrets/shared-values
+ * Same credential material under multiple secret names / apps → ERROR (rotate per app).
+ */
+router.get(
+  '/api/secrets/shared-values',
+  requireAuth,
+  requireScope('keys:read', 'config:read'),
+  async (req, res) => {
+    try {
+      const brainDir = brainDirFromReq(req);
+      const { getSharedValueHealth } = await import('../../core/secrets-store.mjs');
+      const health = await getSharedValueHealth(brainDir);
+      res.status(health.healthy ? 200 : 409).json(health);
+    } catch (err) {
+      serverError(res, err);
+    }
+  },
+);
+
+/**
+ * POST /api/secrets/account-sync
+ * Live-probe vendor account/usage/subscription APIs and persist tracking meta.
+ * Body: { key?, keys?, strict?, use_ai? }
+ */
+router.post(
+  '/api/secrets/account-sync',
+  requireAuth,
+  requireScope('keys:write', 'config:write'),
+  async (req, res) => {
+    try {
+      const brainDir = brainDirFromReq(req);
+      const body = req.body || {};
+      const {
+        syncSecretAccount,
+        syncAllSecretAccounts,
+      } = await import('../../core/provider-account-sync.mjs');
+      const opts = {
+        strict: body.strict !== false,
+        use_ai: !!body.use_ai,
+        force_exempt: !!body.force_exempt,
+      };
+      if (body.key) {
+        const result = await syncSecretAccount(brainDir, body.key, opts);
+        const ok = result.tracking_status === 'ok' || result.tracking_status === 'exempt';
+        return res.status(ok ? 200 : 409).json(result);
+      }
+      if (Array.isArray(body.keys) && body.keys.length) {
+        opts.keys = body.keys;
+      }
+      const report = await syncAllSecretAccounts(brainDir, opts);
+      res.status(report.healthy ? 200 : 409).json(report);
+    } catch (err) {
+      serverError(res, err);
+    }
+  },
+);
+
+/**
+ * POST /api/secrets/:key/account-sync — sync one secret by path param
+ */
+router.post(
+  '/api/secrets/:key/account-sync',
+  requireAuth,
+  requireScope('keys:write', 'config:write'),
+  async (req, res) => {
+    try {
+      const brainDir = brainDirFromReq(req);
+      const { syncSecretAccount } = await import('../../core/provider-account-sync.mjs');
+      const result = await syncSecretAccount(brainDir, req.params.key, {
+        strict: req.body?.strict !== false,
+        use_ai: !!req.body?.use_ai,
+        force_exempt: !!req.body?.force_exempt,
+      });
+      const ok = result.tracking_status === 'ok' || result.tracking_status === 'exempt';
+      res.status(ok ? 200 : 409).json(result);
+    } catch (err) {
+      serverError(res, err);
+    }
+  },
+);
+
 router.get('/api/secrets/usage', requireAuth, requireScope('keys:read', 'config:read'), async (req, res) => {
   try {
     const brainDir = brainDirFromReq(req);

package/src/server/routes/system.mjs

@@ -115,7 +115,26 @@ router.post('/api/diagnostics/agents', requireAuth, requireScope('health:read'),
   }
 });
 
-
+/**
+ * GET /api/pairing
+ * Reachable URLs for the Settings mobile pairing QR (LAN / mesh / loopback).
+ */
+router.get('/api/pairing', requireAuth, requireScope('config:read'), async (_req, res) => {
+  try {
+    const { buildPairingInfo } = await import('../../core/pairing.mjs');
+    const { getMeshIp } = await import('../../core/mesh.mjs');
+    const protocol = _req.secure || String(_req.headers['x-forwarded-proto'] || '').includes('https')
+      ? 'https'
+      : 'http';
+    const info = buildPairingInfo({
+      protocol,
+      meshIp: getMeshIp(),
+    });
+    res.json(info);
+  } catch (err) {
+    serverError(res, err);
+  }
+});
 
 /**
  * GET /api/tasks/failed

package/src/server/routes/update.mjs

@@ -6,7 +6,7 @@ import { ROOT, serverError } from './_shared.mjs';
 import { brainDir as configBrainDir } from '../../core/config.mjs';
 import {
   PACKAGE_NAME,
-  fetchLatestNpmVersion,
+  fetchLatestNpmVersionAsync,
   inspectProjectPackage,
   listUpdateRoots,
   runPackageAutoUpdate,
@@ -27,7 +27,8 @@ router.get('/api/update/check', requireAuth, async (_req, res) => {
       current = null;
     }
 
-    const latest = fetchLatestNpmVersion() || '';
+    // Non-blocking npm view (spawnSync blocked the whole server and froze Settings).
+    const latest = (await fetchLatestNpmVersionAsync({ timeoutMs: 8_000 })) || '';
     const roots = listUpdateRoots({ brainDir: configBrainDir });
     const projects = roots.map(({ root, name, source }) => {
       const info = inspectProjectPackage(root);
@@ -43,12 +44,18 @@ router.get('/api/update/check', requireAuth, async (_req, res) => {
     });
 
     const consumersBehind = projects.filter((p) => p.update_available).length;
+    const updateAvailable =
+      Boolean(latest && current && current !== latest) || consumersBehind > 0;
 
     res.json({
       package: PACKAGE_NAME,
       current,
+      currentVersion: current,
       latest,
-      update_available: Boolean(latest && current && current !== latest) || consumersBehind > 0,
+      latestVersion: latest,
+      // snake + camel for dashboard clients
+      update_available: updateAvailable,
+      updateAvailable,
       auto_update_enabled: isPackageAutoUpdateEnabled(),
       projects,
       consumers_behind: consumersBehind,
@@ -82,7 +89,7 @@ router.post('/api/update/run', requireAuth, requireScope('config:write'), async
     // Also kick a local install in ROOT when this host is a consumer (non-source)
     const hostInfo = inspectProjectPackage(ROOT);
     if (!hostInfo.isSourceTree && (hostInfo.declared || hostInfo.installed) && !dryRun) {
-      const latest = summary.latest || fetchLatestNpmVersion();
+      const latest = summary.latest || (await fetchLatestNpmVersionAsync());
       if (latest && needsUpdate(hostInfo.installed, latest)) {
         const proc = spawn('npm', ['install', `${PACKAGE_NAME}@${latest}`, '--save'], {
           cwd: ROOT,