total-recall-brain 3.18.2 → 3.18.3

package/src/cli/secret.mjs

@@ -28,6 +28,7 @@ import {
   getSecretsCatalog,
   updateSecretMeta,
   listRotationDue,
+  getSharedValueHealth,
 } from '../core/secrets-store.mjs';
 import {
   scanEnvSources,
@@ -79,9 +80,22 @@ function printHelp() {
       --dry-run           Show keys that would be written
     import-env            One-time migrate: scan local .env → store (not the steady-state path)
       --all / --file / --overwrite / --dry-run
-    catalog               Full catalog: keys, providers, usage, rotation, cost
+    catalog               Full catalog: keys, providers, usage, rotation, cost, tracking
     providers             List provider registry (docs/schema/tiers)
+    account-sync [key]    Live-probe vendor account/usage/subscription APIs
+      --all               Sync every set secret (default if no key)
+      --strict            partial (no $ API) → ERROR (default)
+      --no-strict         Allow partial status
+      --use-ai            AI-classify unknown keys (slow)
+      --exempt            Mark key tracking_exempt (with optional --monthly-cost)
+    tracking-health       Fail (exit 1) if any set secret is untracked
+    shared                List credential values reused across keys/apps (exit 1 if any)
+      --shared-ok         Mark key as intentional share (waive) — use with meta
     meta <key>            Update metadata (no value change)
+      --tracking-exempt   Waive live account API requirement
+      --no-tracking-exempt
+      --shared-ok         Allow this key to share its value with other secret names
+      --no-shared-ok
       --repo <name>       Bind to exactly ONE product repo (not multi)
       --repos <name>      Same as --repo (single name only; multi rejected)
       --tier <id>         Subscription tier
@@ -167,6 +181,11 @@ function parseArgs(args) {
     enqueue: false,
     bytes: 32,
     format: 'base64url',
+    strict: true,
+    use_ai: false,
+    exempt: false,
+    tracking_exempt: null,
+    shared_ok: null,
   };
   if (!args.length || args[0] === '--help' || args[0] === '-h') {
     out.help = true;
@@ -175,7 +194,9 @@ function parseArgs(args) {
   out.command = args[0];
   let i = 1;
   if (
-    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate'].includes(out.command) &&
+    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate', 'account-sync'].includes(
+      out.command,
+    ) &&
     args[i] &&
     !args[i].startsWith('--')
   ) {
@@ -301,6 +322,30 @@ function parseArgs(args) {
       case '--format':
         out.format = args[++i] || 'base64url';
         break;
+      case '--strict':
+        out.strict = true;
+        break;
+      case '--no-strict':
+        out.strict = false;
+        break;
+      case '--use-ai':
+        out.use_ai = true;
+        break;
+      case '--exempt':
+        out.exempt = true;
+        break;
+      case '--tracking-exempt':
+        out.tracking_exempt = true;
+        break;
+      case '--no-tracking-exempt':
+        out.tracking_exempt = false;
+        break;
+      case '--shared-ok':
+        out.shared_ok = true;
+        break;
+      case '--no-shared-ok':
+        out.shared_ok = false;
+        break;
       case '--help':
       case '-h':
         out.help = true;
@@ -457,6 +502,121 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'account-sync' || opts.command === 'sync-accounts') {
+      const {
+        syncSecretAccount,
+        syncAllSecretAccounts,
+        getTrackingHealth,
+      } = await import('../core/provider-account-sync.mjs');
+      const syncOpts = {
+        strict: opts.strict !== false,
+        use_ai: !!opts.use_ai,
+        force_exempt: !!opts.exempt,
+      };
+      if (opts.key) {
+        if (opts.exempt) {
+          await updateSecretMeta(
+            brainDir,
+            opts.key,
+            {
+              tracking_exempt: true,
+              monthly_cost_usd: opts.monthly_cost ?? undefined,
+            },
+            { actor: 'cli' },
+          );
+        }
+        const r = await syncSecretAccount(brainDir, opts.key, syncOpts);
+        const icon =
+          r.tracking_status === 'ok' ? '✅' : r.tracking_status === 'exempt' ? '⏭' : '❌';
+        console.log(`\n  ${icon} ${r.key}  status=${r.tracking_status}  provider=${r.provider || '-'}`);
+        if (r.probe) console.log(`     probe: ${r.probe}`);
+        if (r.error) console.log(`     error: ${r.error}`);
+        if (r.account) console.log(`     account: ${JSON.stringify(r.account)}`);
+        if (r.usage) console.log(`     usage: ${JSON.stringify(r.usage)}`);
+        if (r.subscription) console.log(`     subscription: ${JSON.stringify(r.subscription)}`);
+        console.log('');
+        if (r.tracking_status === 'error') process.exit(1);
+        return;
+      }
+      console.log('\n  🔄 Live provider account/usage sync (all set secrets)…\n');
+      const report = await syncAllSecretAccounts(brainDir, syncOpts);
+      console.log(`  total=${report.total}  ok/exempt=${report.ok}  errors=${report.errors}`);
+      console.log(`  ${report.healthy ? '✅' : '❌'} ${report.message}`);
+      if (report.error_keys?.length) {
+        console.log('\n  Untracked / failed:');
+        for (const e of report.error_keys.slice(0, 50)) {
+          console.log(`    • ${e.key}: ${e.error}`);
+        }
+        if (report.error_keys.length > 50) {
+          console.log(`    … and ${report.error_keys.length - 50} more`);
+        }
+      }
+      const health = await getTrackingHealth(brainDir);
+      console.log(
+        `\n  tracking-health: healthy=${health.healthy} ok=${health.ok} exempt=${health.exempt} errors=${health.errors}\n`,
+      );
+      if (!report.healthy) process.exit(1);
+      return;
+    }
+
+    if (opts.command === 'tracking-health' || opts.command === 'tracking') {
+      const { getTrackingHealth } = await import('../core/provider-account-sync.mjs');
+      const health = await getTrackingHealth(brainDir);
+      console.log(`\n  ${health.healthy ? '✅' : '❌'} ${health.message}`);
+      console.log(`     ok=${health.ok}  exempt=${health.exempt}  errors=${health.errors}`);
+      if (health.error_keys?.length) {
+        console.log('');
+        for (const e of health.error_keys) {
+          console.log(`    • ${e.key.padEnd(28)} ${(e.provider || '-').padEnd(14)} ${e.error}`);
+        }
+      }
+      const shared = await getSharedValueHealth(brainDir);
+      console.log(`\n  ${shared.healthy ? '✅' : '❌'} ${shared.message}`);
+      if (shared.errors?.length) {
+        for (const e of shared.errors) {
+          console.log(`    • fp=${e.fingerprint} apps=[${e.apps.join(', ')}]`);
+          console.log(`      keys: ${e.keys.join(', ')}`);
+        }
+      }
+      console.log('');
+      if (!health.healthy || !shared.healthy) process.exit(1);
+      return;
+    }
+
+    if (opts.command === 'shared' || opts.command === 'shared-values' || opts.command === 'duplicates') {
+      const shared = await getSharedValueHealth(brainDir);
+      console.log(`\n  ${shared.healthy ? '✅' : '❌'} ${shared.message}`);
+      console.log(
+        `     groups=${shared.groups.length}  error_groups=${shared.error_groups}  multi_app=${shared.multi_app_groups}  keys_in_error=${shared.shared_keys}`,
+      );
+      if (shared.groups.length) {
+        console.log('');
+        for (const g of shared.groups) {
+          const icon = g.severity === 'error' ? '❌' : '⏭';
+          console.log(
+            `  ${icon} fingerprint ${g.fingerprint}  ×${g.count}  apps=[${g.apps.join(', ')}]`,
+          );
+          for (const m of g.members) {
+            console.log(
+              `      • ${m.key.padEnd(36)} app=${String(m.app).padEnd(16)} provider=${m.provider || '-'}  ${m.masked || ''}`,
+            );
+          }
+          if (g.error) console.log(`      → ${g.error}`);
+          console.log(
+            `      fix: rotate each key to a unique value, then: secret rotate <key> <new> --export-env`,
+          );
+          console.log(
+            `      waive (rare): secret meta <key> --shared-ok   # only if intentional mirror`,
+          );
+          console.log('');
+        }
+      } else {
+        console.log('\n  No shared credential values detected.\n');
+      }
+      if (!shared.healthy) process.exit(1);
+      return;
+    }
+
     if (opts.command === 'meta') {
       if (!opts.key) {
         console.error('Usage: total-recall secret meta <key> [--repo ...] [--tier ...]');
@@ -475,6 +635,11 @@ export default async function secretCli(argv) {
       if (opts.project) patch.project_path = opts.project;
       if (opts.provider) patch.provider = opts.provider;
       if (opts.scope) patch.scope = opts.scope;
+      if (opts.tracking_exempt != null) {
+        patch.tracking_exempt = opts.tracking_exempt;
+        if (opts.tracking_exempt) patch.tracking_status = 'exempt';
+      }
+      if (opts.shared_ok != null) patch.shared_value_ok = opts.shared_ok;
       // Fill docs from catalog if provider set and no docs
       if (patch.provider && !patch.api_docs_url) {
         const p = getProvider(patch.provider);
@@ -538,10 +703,22 @@ export default async function secretCli(argv) {
       console.log(`\n  Secrets metadata — ${resolveSecretsPath(brainDir)}\n`);
       for (const r of rows) {
         const repos = r.repos?.length ? r.repos.join(',') : '-';
+        const tr = r.tracking_status || 'never';
+        const trIcon = tr === 'ok' ? '✅' : tr === 'exempt' ? '⏭' : '❌';
+        const share = r.shared_value ? ' 🔗SHARED' : '';
         console.log(
-          `  • ${r.key.padEnd(28)} len=${String(r.length).padStart(4)}  ${(r.provider || '-').padEnd(12)} tier=${r.subscription_tier || '-'}  $${r.monthly_cost_usd ?? '-'}  repos=${repos}`,
+          `  • ${r.key.padEnd(28)} len=${String(r.length).padStart(4)}  ${(r.provider || '-').padEnd(12)} ${trIcon}${tr.padEnd(7)} tier=${r.subscription_tier || '-'}  $${r.monthly_cost_usd ?? '-'}  repos=${repos}${share}`,
         );
         if (r.api_docs_url) console.log(`      docs: ${r.api_docs_url}`);
+        if (r.tracking_error && tr === 'error') console.log(`      tracking: ${r.tracking_error}`);
+        if (r.shared_value_error) {
+          console.log(`      shared: ${r.shared_value_error}`);
+          if (r.shared_with?.length) {
+            console.log(
+              `      same value as: ${r.shared_with.map((s) => `${s.key}(${s.app})`).join(', ')}`,
+            );
+          }
+        }
       }
       console.log('');
       return;

package/src/core/daemon-loop.mjs

@@ -469,19 +469,28 @@ async function main() {
             status: result.success ? 'pending' : 'failed',
             notes: result.output ? `Phase output: ${result.output}` : (result.error || null),
           };
-          if (result.factSlug) {
+          if (result.factSlug && result.factSlug !== 'pending') {
             patch.node_slug = result.factSlug;
           }
+          const nodeSlug = patch.node_slug || task._node_slug;
           if (result.skippedLLM) {
             patch.status = 'pending';
           } else if (result.success) {
+            // Never advance past acquisition without a real memory/draft node
             if (task._research_phase === 'acquisition' && !result.factSlug) {
               patch.status = 'failed';
-              patch.notes = 'No insights found during acquisition.';
+              patch.notes =
+                result.error ||
+                'No insights found during acquisition (no web results / synthesis failed).';
             } else if (task._research_phase === 'acquisition') {
               patch.status = 'pending';
               patch.research_phase = 'deliberation';
-              patch.completed_at = new Date().toISOString();
+              patch.completed_at = null;
+            } else if (!nodeSlug || nodeSlug === 'pending') {
+              // Later phase without content → force back to acquisition
+              patch.status = 'pending';
+              patch.research_phase = 'acquisition';
+              patch.notes = `Phase ${task._research_phase} had no node_slug — re-running acquisition.`;
             } else if (task._research_phase === 'deliberation') {
               patch.status = 'pending';
               patch.research_phase = 'improvement';
@@ -492,8 +501,25 @@ async function main() {
               patch.status = 'pending';
               patch.research_phase = 'expansion';
             } else if (task._research_phase === 'expansion') {
-              patch.status = 'done';
-              patch.completed_at = new Date().toISOString();
+              // Only mark done when we still have a real node
+              if (nodeSlug && nodeSlug !== 'pending') {
+                patch.status = 'done';
+                patch.node_slug = nodeSlug;
+                patch.completed_at = new Date().toISOString();
+              } else {
+                patch.status = 'failed';
+                patch.notes = 'Expansion finished without a research memory node.';
+              }
+            }
+          } else {
+            // Failure on later phase: if no node, reset to acquisition for retry
+            if (
+              (!task._node_slug || task._node_slug === 'pending') &&
+              task._research_phase !== 'acquisition'
+            ) {
+              patch.status = 'pending';
+              patch.research_phase = 'acquisition';
+              patch.notes = `Reset to acquisition after ${task._research_phase} failure: ${result.error || 'unknown'}`;
             }
           }
           updateQueueItem(task._research_id, patch);

package/src/core/notifications.mjs

@@ -1,77 +1,247 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import crypto from 'node:crypto';
 import { logger } from './logger.mjs';
+import { findVfsDocumentByPath, listVfsDocumentsUnder } from './vfs-documents.mjs';
+import {
+  appendVfsEvent,
+  deleteVfsDocument,
+  listVfsEvents,
+  writeVfsDocument,
+} from './ssss-operation-service.mjs';
 
 const execFileAsync = promisify(execFile);
 
+/** Supported mesh / system alert events (Agent Rules / dashboard selector). */
+export const NOTIFICATION_EVENTS = new Set([
+  'node_offline',
+  'leader_change',
+  'webhook_failed',
+  'secret_sync_failed',
+  'daemon_error',
+  'research_complete',
+  'test',
+]);
+
+export const NOTIFICATION_CHANNELS = new Set(['desktop', 'webhook', 'email']);
+export const NOTIFICATION_PRIORITIES = new Set(['critical', 'high', 'low']);
+
+const RULES_PREFIX = 'system/notification-rules';
+const HISTORY_WORKSPACE = 'notifications';
+const MAX_HISTORY = 100;
+
+function rulePath(id) {
+  return `${RULES_PREFIX}/${id}.md`;
+}
+
+function eventOpts(intent) {
+  return {
+    actorRole: 'system',
+    intent,
+    workspaceId: HISTORY_WORKSPACE,
+  };
+}
+
 /**
  * Sends a macOS desktop notification using terminal-notifier if available,
  * falling back to osascript.
  *
- * @param {string} title - The notification title
- * @param {string} message - The notification message content
- * @param {object} [options] - Additional parameters
- * @param {string} [options.open] - Absolute path or URL to open on clicking "Open" or "Show"
- * @param {string} [options.sound] - macOS sound name (e.g., 'Glass', 'Hero', 'Sosumi', 'default')
- * @param {string} [options.subtitle] - Subtitle text to show
- * @param {string} [options.group] - Group ID to allow notification replacement rather than stacking
+ * @param {string} title
+ * @param {string} message
+ * @param {object} [options]
+ * @returns {Promise<{ delivered: boolean, channel: string, error?: string }>}
  */
 export async function sendSystemNotification(title, message, options = {}) {
-  // Bypassed in tests
   const isTest = process.env.VITEST || process.env._TR_TEST_AGENT_DIR || process.env.NODE_ENV === 'test';
   if (isTest) {
     logger.debug('notifications: bypassing system notification in test environment');
-    return;
+    return { delivered: true, channel: 'desktop', bypassed: true };
   }
 
   const {
     open,
     sound = 'default',
     subtitle = 'Total Recall',
-    group = 'total-recall-system'
+    group = 'total-recall-system',
   } = options;
 
-  // Sanitize inputs to prevent unexpected arguments/escaping issues
   const cleanMessage = String(message).replace(/[^ -~]/g, '').replace(/["'`$\\]/g, '').slice(0, 200);
   const cleanTitle = String(title).replace(/[^ -~]/g, '').replace(/["'`$\\]/g, '').slice(0, 100);
-  const cleanSubtitle = subtitle ? String(subtitle).replace(/[^ -~]/g, '').replace(/["'`$\\]/g, '').slice(0, 100) : '';
+  const cleanSubtitle = subtitle
+    ? String(subtitle).replace(/[^ -~]/g, '').replace(/["'`$\\]/g, '').slice(0, 100)
+    : '';
 
   try {
-    // 1. Try terminal-notifier first (supports click actions, custom sounds, subtitles, grouping)
-    const args = [
-      '-title', cleanTitle,
-      '-message', cleanMessage,
-      '-group', group,
-    ];
-    if (cleanSubtitle) {
-      args.push('-subtitle', cleanSubtitle);
-    }
+    const args = ['-title', cleanTitle, '-message', cleanMessage, '-group', group];
+    if (cleanSubtitle) args.push('-subtitle', cleanSubtitle);
     if (open) {
-      // Ensure file url is correct format or HTTP(S) URL
-      const openTarget = (open.startsWith('/') || open.startsWith('~')) ? `file://${open}` : open;
-      args.push('-open', openTarget);
-      args.push('-actions', 'Open');
-    }
-    if (sound && sound !== 'default') {
-      args.push('-sound', sound);
+      const openTarget = open.startsWith('/') || open.startsWith('~') ? `file://${open}` : open;
+      args.push('-open', openTarget, '-actions', 'Open');
     }
+    if (sound && sound !== 'default') args.push('-sound', sound);
 
     await execFileAsync('terminal-notifier', args, { timeout: 3000 });
-    logger.debug('notifications: successfully sent notification via terminal-notifier', { title, message });
-  } catch (err) {
-    // 2. Fall back to plain AppleScript display notification if terminal-notifier fails
+    logger.debug('notifications: sent via terminal-notifier', { title });
+    return { delivered: true, channel: 'desktop' };
+  } catch {
     try {
       const appleScriptParts = [
         `display notification "${cleanMessage.replace(/"/g, '\\"')}"`,
-        `with title "${cleanTitle.replace(/"/g, '\\"')}"`
+        `with title "${cleanTitle.replace(/"/g, '\\"')}"`,
       ];
       if (sound && sound !== 'default') {
         appleScriptParts.push(`sound name "${sound}"`);
       }
       await execFileAsync('osascript', ['-e', appleScriptParts.join(' ')], { timeout: 3000 });
-      logger.debug('notifications: successfully sent fallback osascript notification', { title, message });
+      logger.debug('notifications: sent via osascript', { title });
+      return { delivered: true, channel: 'desktop' };
     } catch (fallbackErr) {
-      logger.debug('notifications: both terminal-notifier and osascript failed', { err: fallbackErr.message });
+      logger.debug('notifications: desktop delivery failed', { err: fallbackErr.message });
+      return { delivered: false, channel: 'desktop', error: fallbackErr.message };
     }
   }
 }
+
+function publicRule(doc) {
+  const fm = doc.frontmatter || doc;
+  return {
+    id: String(fm.id || doc.vfs_path?.replace(/^.*\//, '').replace(/\.md$/, '') || ''),
+    event: String(fm.event || ''),
+    channel: String(fm.channel || 'desktop'),
+    priority: String(fm.priority || 'high'),
+    enabled: fm.enabled !== false && fm.enabled !== 'false',
+    quietHours: fm.quietHours === true || fm.quietHours === 'true',
+  };
+}
+
+export function listNotificationRules() {
+  return listVfsDocumentsUnder(RULES_PREFIX)
+    .filter((doc) => (doc.type || doc.frontmatter?.type) === 'notification_rule' || doc.event || doc.frontmatter?.event)
+    .map(publicRule)
+    .filter((r) => r.id && r.event);
+}
+
+/**
+ * @param {object} input
+ * @param {string} input.event
+ * @param {string} input.channel
+ * @param {string} input.priority
+ * @param {boolean} [input.enabled]
+ * @param {boolean} [input.quietHours]
+ */
+export async function createNotificationRule(input = {}) {
+  const event = String(input.event || '').trim();
+  const channel = String(input.channel || 'desktop').trim();
+  const priority = String(input.priority || 'high').trim();
+  if (!NOTIFICATION_EVENTS.has(event) || event === 'test') {
+    throw Object.assign(new Error(`Unsupported event: ${event}`), { status: 400 });
+  }
+  if (!NOTIFICATION_CHANNELS.has(channel)) {
+    throw Object.assign(new Error(`Unsupported channel: ${channel}`), { status: 400 });
+  }
+  if (!NOTIFICATION_PRIORITIES.has(priority)) {
+    throw Object.assign(new Error(`Unsupported priority: ${priority}`), { status: 400 });
+  }
+
+  const id = crypto.randomUUID();
+  const now = new Date().toISOString();
+  const title = `Notify: ${event} → ${channel}`;
+  const description = `Alert on ${event} via ${channel} (${priority})`;
+  const frontmatter = {
+    type: 'notification_rule',
+    title,
+    description,
+    timestamp: now,
+    id,
+    event,
+    channel,
+    priority,
+    enabled: input.enabled !== false,
+    quietHours: !!input.quietHours,
+    created: now,
+    updated: now,
+  };
+
+  await writeVfsDocument(rulePath(id), frontmatter, description, {
+    actorRole: 'admin',
+    intent: 'Create notification rule',
+  });
+
+  return publicRule({ frontmatter });
+}
+
+export async function deleteNotificationRule(id) {
+  const ruleId = String(id || '').trim();
+  if (!ruleId) throw Object.assign(new Error('Rule id is required'), { status: 400 });
+  const path = rulePath(ruleId);
+  const existing = findVfsDocumentByPath(path);
+  if (!existing) throw Object.assign(new Error('Notification rule not found'), { status: 404 });
+  await deleteVfsDocument(path, {
+    actorRole: 'admin',
+    intent: 'Delete notification rule',
+  });
+  return { success: true, id: ruleId };
+}
+
+/**
+ * @param {object} entry
+ * @param {string} entry.title
+ * @param {string} entry.message
+ * @param {string} entry.channel
+ * @param {'delivered'|'failed'} entry.status
+ */
+export async function recordNotificationDelivery(entry) {
+  const id = crypto.randomUUID();
+  const timestamp = new Date().toISOString();
+  const payload = {
+    kind: 'notification_delivery',
+    id,
+    title: String(entry.title || 'Notification').slice(0, 200),
+    message: String(entry.message || '').slice(0, 1000),
+    channel: String(entry.channel || 'desktop'),
+    status: entry.status === 'failed' ? 'failed' : 'delivered',
+    timestamp,
+  };
+  await appendVfsEvent(`notifications/delivery/${id}`, payload, eventOpts('Record notification delivery'));
+  return payload;
+}
+
+export async function listNotificationHistory({ limit = MAX_HISTORY } = {}) {
+  const events = await listVfsEvents({ workspaceId: HISTORY_WORKSPACE });
+  const entries = events
+    .filter((event) => event.payload?.kind === 'notification_delivery')
+    .map((event) => {
+      const p = event.payload || {};
+      return {
+        id: p.id || event.event_id || crypto.randomUUID(),
+        title: p.title || 'Notification',
+        message: p.message || '',
+        channel: p.channel || 'desktop',
+        status: p.status === 'failed' ? 'failed' : 'delivered',
+        timestamp: p.timestamp || event.timestamp || new Date().toISOString(),
+      };
+    })
+    .sort((a, b) => String(b.timestamp).localeCompare(String(a.timestamp)));
+
+  const n = Number(limit);
+  return Number.isFinite(n) && n > 0 ? entries.slice(0, n) : entries.slice(0, MAX_HISTORY);
+}
+
+/**
+ * Deliver a test notification on the desktop channel and record history.
+ */
+export async function sendTestNotification() {
+  const title = 'Total Recall';
+  const message = 'Test notification from the dashboard';
+  const result = await sendSystemNotification(title, message, {
+    subtitle: 'Notifications',
+    group: 'total-recall-test',
+  });
+  const entry = await recordNotificationDelivery({
+    title,
+    message,
+    channel: 'desktop',
+    status: result.delivered ? 'delivered' : 'failed',
+  });
+  return { ...entry, delivery: result };
+}