total-recall-brain 3.21.0 → 3.21.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.21.0",
+  "version": "3.21.2",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/src/cli/secret.mjs

@@ -48,11 +48,28 @@ import {
   enqueueRotationDueTasks,
   getBrowserRotateAssist,
 } from '../core/secrets-rotate.mjs';
+import {
+  loadRemoteTargets,
+  addRemoteTarget,
+  removeRemoteTarget,
+  deployEnvToRemote,
+  deployKeyToRemotes,
+} from '../core/secrets-remote-deploy.mjs';
 import { listProviders, getProvider } from '../core/provider-catalog.mjs';
 import { resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 
+// Reads a secret value from stdin (fd 0) so it never has to appear as a CLI
+// argument — CLI args land in shell history, `ps aux`, and any transcript
+// that echoes the command. Trims exactly one trailing newline (what a
+// pasted/piped value normally carries), not all whitespace, so a value that
+// legitimately starts or ends with a space round-trips intact.
+function readStdinValue() {
+  const raw = fs.readFileSync(0, 'utf8');
+  return raw.endsWith('\n') ? raw.slice(0, -1) : raw;
+}
+
 function printHelp() {
   console.log(`
   total-recall secret — Secrets store (separate from memory vault)
@@ -60,11 +77,13 @@ function printHelp() {
   Usage: total-recall secret <command> [options]
 
   Commands:
-    set <key> <value>     Store a secret (0600 file; optional AES via TR_SECRETS_PASSWORD)
+    set <key> [value]     Store a secret (0600 file; optional AES via TR_SECRETS_PASSWORD)
+                           --stdin reads the value from fd0 instead of argv,
+                           so it never lands in shell history/ps/a transcript
     generate <key>        Generate a random secret for outside integrations
     get <key>             Print secret value (audited)
     list                  List keys + metadata only (no values)
-    rotate <key> <value>  Replace value and mark rotated
+    rotate <key> [value]  Replace value and mark rotated (also supports --stdin)
     delete <key>          Remove a secret
     audit [--limit N]     Recent set/get/rotate events (no values)
     usage [--days N]      Sum usage.jsonl for last N days (default 1)
@@ -77,7 +96,18 @@ function printHelp() {
       --no-example        Skip .env.example
       --no-global         Only keys bound to this repo (skip unbound)
       --replace-all       Overwrite entire .env (default: merge TR block only)
+      --remote <name>     Also push the SSOT projection to a configured remote
+                           target over SSH (see 'secret remote') instead of
+                           (or in addition to) a local file
       --dry-run           Show keys that would be written
+    remote <cmd>          Manage remote (production) deploy targets — generic,
+                           per-repo config, no host/path ever hardcoded in TR
+      add <name>           --host <h> --path </remote/dir> [--user root]
+                            [--port 22] [--filename .env] [--restart-cmd "..."]
+      list                 Show configured targets (no secret values)
+      remove <name>        Delete a target
+      deploy <name>        Push the SSOT projection to that target now
+                            [--dry-run] [--keys k1,k2]
     import-env            One-time migrate: scan local .env → store (not the steady-state path)
       --all / --file / --overwrite / --dry-run
     catalog               Full catalog: keys, providers, usage, rotation, cost, tracking
@@ -116,6 +146,8 @@ function printHelp() {
   rotate options:
     --export-env          After rotate, write .env to bound repos (and cwd if unbound)
     --export-all          After rotate, export-env to all project-registry paths
+    --remote <name>       After rotate, also push to a configured remote target
+                           (production, etc.) over SSH — see 'secret remote'
 
   set / rotate options:
     --provider <name>     Optional provider tag (e.g. openai, anthropic)
@@ -186,6 +218,13 @@ function parseArgs(args) {
     exempt: false,
     tracking_exempt: null,
     shared_ok: null,
+    subcommand: null,
+    remote: null,
+    remoteHost: null,
+    remoteUser: 'root',
+    remotePort: 22,
+    restartCmd: null,
+    stdin: false,
   };
   if (!args.length || args[0] === '--help' || args[0] === '-h') {
     out.help = true;
@@ -193,6 +232,12 @@ function parseArgs(args) {
   }
   out.command = args[0];
   let i = 1;
+  if (out.command === 'remote') {
+    if (args[i] && !args[i].startsWith('--')) out.subcommand = args[i++];
+    if (['add', 'remove', 'rm', 'deploy'].includes(out.subcommand) && args[i] && !args[i].startsWith('--')) {
+      out.key = args[i++]; // reused as the remote target name
+    }
+  }
   if (
     ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate', 'account-sync'].includes(
       out.command,
@@ -208,6 +253,21 @@ function parseArgs(args) {
   while (i < args.length) {
     const a = args[i];
     switch (a) {
+      case '--remote':
+        out.remote = args[++i];
+        break;
+      case '--host':
+        out.remoteHost = args[++i];
+        break;
+      case '--user':
+        out.remoteUser = args[++i] || 'root';
+        break;
+      case '--port':
+        out.remotePort = parseInt(args[++i], 10) || 22;
+        break;
+      case '--restart-cmd':
+        out.restartCmd = args[++i];
+        break;
       case '--provider':
         out.provider = args[++i];
         break;
@@ -346,6 +406,9 @@ function parseArgs(args) {
       case '--no-shared-ok':
         out.shared_ok = false;
         break;
+      case '--stdin':
+        out.stdin = true;
+        break;
       case '--help':
       case '-h':
         out.help = true;
@@ -377,6 +440,22 @@ export default async function secretCli(argv) {
     process.exit(1);
   }
 
+  if (opts.stdin) {
+    if (!['set', 'rotate'].includes(opts.command)) {
+      console.error('❌ --stdin is only valid with `set` or `rotate`');
+      process.exit(1);
+    }
+    if (!opts.key) {
+      console.error(`Usage: total-recall secret ${opts.command} <key> --stdin`);
+      process.exit(1);
+    }
+    opts.value = readStdinValue();
+    if (!opts.value) {
+      console.error('❌ --stdin read an empty value');
+      process.exit(1);
+    }
+  }
+
   try {
     if (opts.command === 'set') {
       if (!opts.key || opts.value == null) {
@@ -724,11 +803,121 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'remote') {
+      if (!opts.subcommand) {
+        console.error(
+          'Usage: total-recall secret remote <add|list|remove|deploy> [...]\n' +
+            '  add <name> --host <h> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]\n' +
+            '  list\n' +
+            '  remove <name>\n' +
+            '  deploy <name> [--dry-run] [--keys k1,k2]',
+        );
+        process.exit(1);
+      }
+
+      if (opts.subcommand === 'add') {
+        if (!opts.key || !opts.remoteHost || !opts.path) {
+          console.error(
+            'Usage: total-recall secret remote add <name> --host <host> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]',
+          );
+          process.exit(1);
+        }
+        const { path: targetsPath } = addRemoteTarget(brainDir, {
+          name: opts.key,
+          host: opts.remoteHost,
+          user: opts.remoteUser,
+          port: opts.remotePort,
+          remotePath: opts.path,
+          filename: opts.filename || '.env',
+          restartCommand: opts.restartCmd || null,
+          keys: opts.keys.length ? opts.keys : undefined,
+        });
+        console.log(`\n  ✅ Remote target added: ${opts.key}`);
+        console.log(`     ${opts.remoteUser}@${opts.remoteHost}:${opts.path}/${opts.filename || '.env'}`);
+        if (opts.restartCmd) console.log(`     restart: ${opts.restartCmd}`);
+        console.log(`     config: ${targetsPath}\n`);
+        return;
+      }
+
+      if (opts.subcommand === 'list') {
+        const targets = loadRemoteTargets(brainDir);
+        if (!targets.length) {
+          console.log(`\n  No remote targets configured for this repo.\n`);
+          return;
+        }
+        console.log(`\n  Remote deploy targets\n`);
+        for (const t of targets) {
+          console.log(
+            `  • ${t.name.padEnd(20)} ${t.user}@${t.host}:${t.port}  ${t.remotePath}/${t.filename}`,
+          );
+          if (t.restartCommand) console.log(`      restart: ${t.restartCommand}`);
+          if (t.keys?.length) console.log(`      keys: ${t.keys.join(', ')}`);
+        }
+        console.log('');
+        return;
+      }
+
+      if (opts.subcommand === 'remove' || opts.subcommand === 'rm') {
+        if (!opts.key) {
+          console.error('Usage: total-recall secret remote remove <name>');
+          process.exit(1);
+        }
+        const r = removeRemoteTarget(brainDir, opts.key);
+        console.log(r.removed ? `  ✅ Removed remote target: ${opts.key}` : `  Remote target not found: ${opts.key}`);
+        return;
+      }
+
+      if (opts.subcommand === 'deploy') {
+        if (!opts.key) {
+          console.error('Usage: total-recall secret remote deploy <name> [--dry-run] [--keys k1,k2]');
+          process.exit(1);
+        }
+        const r = await deployEnvToRemote(brainDir, opts.key, {
+          dryRun: opts.dryRun,
+          keys: opts.keys.length ? opts.keys : undefined,
+        });
+        if (r.dryRun) {
+          console.log(`\n  📤 dry-run remote deploy → ${r.target} (${r.host})`);
+          console.log(`     would write ${r.count} keys → ${r.remoteFile}\n`);
+          return;
+        }
+        console.log(`\n  ✅ Deployed ${r.count} secret(s) → ${r.target} (${r.host}:${r.remoteFile})`);
+        if (r.restarted) console.log(`     restart: ok`);
+        else if (r.restartOutput) console.log(`     restart: FAILED — ${r.restartOutput.slice(0, 300)}`);
+        console.log(`     (values written with mode 0600 remotely; not printed)\n`);
+        return;
+      }
+
+      console.error(`Unknown remote subcommand: ${opts.subcommand}`);
+      process.exit(1);
+    }
+
     if (opts.command === 'rotate') {
       if (!opts.key || !opts.value) {
-        console.error('Usage: total-recall secret rotate <key> <new-value> [--export-env|--export-all]');
+        console.error('Usage: total-recall secret rotate <key> <new-value> [--export-env|--export-all|--remote <name>]');
         process.exit(1);
       }
+      if (opts.remote) {
+        await rotateSecret(brainDir, opts.key, opts.value, { provider: opts.provider, scope: opts.scope });
+        console.log(`  ✅ Rotated: ${opts.key}`);
+        const r = await deployEnvToRemote(brainDir, opts.remote, {});
+        console.log(`  ✅ Deployed to remote target: ${r.target} (${r.host}:${r.remoteFile}, ${r.count} keys)`);
+        if (r.restarted) console.log(`     restart: ok`);
+        else if (r.restartOutput) console.log(`     restart: FAILED — ${r.restartOutput.slice(0, 300)}`);
+        if (opts.exportEnv || opts.exportAll) {
+          const localR = await rotateSecretAndExport(brainDir, opts.key, opts.value, {
+            provider: opts.provider,
+            actor: 'cli',
+            exportEnv: true,
+            exportAllProjects: opts.exportAll,
+            exportCwd: true,
+            includeGlobal: true,
+          });
+          const ok = (localR.exports || []).filter((e) => e.ok !== false);
+          console.log(`     local export-env: ${ok.length} target(s)`);
+        }
+        return;
+      }
       if (opts.exportEnv || opts.exportAll) {
         const r = await rotateSecretAndExport(brainDir, opts.key, opts.value, {
           provider: opts.provider,
@@ -859,6 +1048,23 @@ export default async function secretCli(argv) {
         keys: opts.keys.length ? opts.keys : undefined,
       };
 
+      if (opts.remote) {
+        const r = await deployEnvToRemote(brainDir, opts.remote, {
+          dryRun: opts.dryRun,
+          keys: opts.keys.length ? opts.keys : undefined,
+        });
+        if (r.dryRun) {
+          console.log(`\n  📤 dry-run remote export → ${r.target} (${r.host})`);
+          console.log(`     would write ${r.count} keys → ${r.remoteFile}\n`);
+        } else {
+          console.log(`\n  ✅ Exported ${r.count} secret(s) → ${r.target} (${r.host}:${r.remoteFile})`);
+          if (r.restarted) console.log(`     restart: ok`);
+          else if (r.restartOutput) console.log(`     restart: FAILED — ${r.restartOutput.slice(0, 300)}`);
+          console.log(`     (values written with mode 0600 remotely; not printed)\n`);
+        }
+        if (!opts.path && !opts.allProjects) return; // --remote alone doesn't also touch local disk
+      }
+
       if (opts.allProjects) {
         const results = await exportEnvToRegistry(brainDir, exportOpts);
         console.log(`\n  📤 export-env → ${results.length} project(s) from ${resolveSecretsPath(brainDir)}\n`);

package/src/core/secrets-remote-deploy.mjs

@@ -0,0 +1,258 @@
+/**
+ * Push the Total Recall secrets-store SSOT to a remote deploy target over SSH.
+ *
+ * Generic by design — Total Recall core never hardcodes a hostname, path, or
+ * product name. Every target (host, remote path, restart command) is
+ * declared by the user in this repo's own remote-targets.json, the same way
+ * repos/scopes are declared for export-env. This module only knows how to:
+ *   1. build the same dotenv projection export-env already builds,
+ *   2. fetch + merge it into a REMOTE file over SSH (never local disk),
+ *   3. optionally run a user-declared restart command over SSH.
+ *
+ * Secret values never touch argv, shell history, or process listings on
+ * either end — they're piped over stdin to a remote `cat > file` and never
+ * echoed back. Callers must not log the returned `dotenv`/`map` fields.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { buildEnvProjection, mergeEnvManagedBlock, projectSlugFromPath } from './secrets-env-export.mjs';
+import { resolveSecretsPath } from './secrets-store.mjs';
+
+/**
+ * @param {string} brainDir
+ */
+export function resolveRemoteTargetsPath(brainDir) {
+  return path.join(path.dirname(resolveSecretsPath(brainDir)), 'remote-targets.json');
+}
+
+/**
+ * @typedef {{
+ *   name: string,
+ *   host: string,
+ *   user?: string,
+ *   port?: number,
+ *   remotePath: string,
+ *   filename?: string,
+ *   restartCommand?: string,
+ *   sshOpts?: string[],
+ *   keys?: string[],
+ *   includeGlobal?: boolean,
+ * }} RemoteTarget
+ */
+
+/** @param {string} brainDir @returns {RemoteTarget[]} */
+export function loadRemoteTargets(brainDir) {
+  const p = resolveRemoteTargetsPath(brainDir);
+  if (!fs.existsSync(p)) return [];
+  try {
+    const data = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return Array.isArray(data) ? data : [];
+  } catch {
+    return [];
+  }
+}
+
+/** @param {string} brainDir @param {RemoteTarget[]} targets */
+export function saveRemoteTargets(brainDir, targets) {
+  const p = resolveRemoteTargetsPath(brainDir);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  fs.writeFileSync(p, `${JSON.stringify(targets, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  try {
+    fs.chmodSync(p, 0o600);
+  } catch {
+    /* windows / fs without chmod */
+  }
+  return p;
+}
+
+/** @param {string} brainDir @param {RemoteTarget} target */
+export function addRemoteTarget(brainDir, target) {
+  if (!target?.name) throw new Error('Remote target requires a name');
+  if (!target?.host) throw new Error('Remote target requires a host');
+  if (!target?.remotePath) throw new Error('Remote target requires remotePath (remote directory)');
+  const targets = loadRemoteTargets(brainDir).filter((t) => t.name !== target.name);
+  targets.push({
+    name: target.name,
+    host: target.host,
+    user: target.user || 'root',
+    port: target.port || 22,
+    remotePath: target.remotePath,
+    filename: target.filename || '.env',
+    restartCommand: target.restartCommand || null,
+    sshOpts: target.sshOpts || [],
+    keys: target.keys || undefined,
+    includeGlobal: target.includeGlobal !== false,
+  });
+  const p = saveRemoteTargets(brainDir, targets);
+  return { path: p, targets };
+}
+
+/** @param {string} brainDir @param {string} name */
+export function removeRemoteTarget(brainDir, name) {
+  const targets = loadRemoteTargets(brainDir);
+  const next = targets.filter((t) => t.name !== name);
+  const removed = next.length !== targets.length;
+  if (removed) saveRemoteTargets(brainDir, next);
+  return { removed, targets: next };
+}
+
+function sshBaseArgs(target) {
+  return [
+    '-o', 'BatchMode=yes',
+    '-o', 'ConnectTimeout=8',
+    '-p', String(target.port || 22),
+    ...(target.sshOpts || []),
+  ];
+}
+
+function sshDestination(target) {
+  return `${target.user || 'root'}@${target.host}`;
+}
+
+/**
+ * Run a remote command over SSH, optionally piping stdin. Never uses a
+ * shell-interpolated string built from secret values — the remote command
+ * itself is a fixed, non-secret string; the secret body travels over stdin.
+ */
+function runSsh(target, remoteCommand, { input } = {}) {
+  const args = [...sshBaseArgs(target), sshDestination(target), remoteCommand];
+  const result = spawnSync('ssh', args, {
+    input: input != null ? input : undefined,
+    encoding: 'utf8',
+    timeout: 20000,
+  });
+  return result;
+}
+
+function quoteRemotePath(p) {
+  // POSIX single-quote escaping — safe for arbitrary remote paths.
+  return `'${String(p).replace(/'/g, `'\\''`)}'`;
+}
+
+/**
+ * Fetch the current remote file body (empty string if absent/unreachable-file).
+ */
+function fetchRemoteFile(target, remoteFile) {
+  const r = runSsh(target, `cat ${quoteRemotePath(remoteFile)} 2>/dev/null || true`);
+  if (r.error) throw new Error(`SSH connect failed for target "${target.name}": ${r.error.message}`);
+  return r.stdout || '';
+}
+
+/**
+ * Write body to the remote file via stdin (never as an argv/shell string),
+ * then chmod 600. Uses a temp file + atomic rename on the remote side so a
+ * dropped connection mid-write can't leave a truncated secrets file live.
+ */
+function writeRemoteFile(target, remoteFile, body) {
+  const tmp = `${remoteFile}.tr-tmp.$$`;
+  const cmd =
+    `set -e; TMP="${remoteFile}.tr-tmp.$$"; ` +
+    `cat > "$TMP" && chmod 600 "$TMP" && mv "$TMP" ${quoteRemotePath(remoteFile)}`;
+  const r = runSsh(target, cmd, { input: body });
+  if (r.error) throw new Error(`SSH write failed for target "${target.name}": ${r.error.message}`);
+  if (r.status !== 0) {
+    throw new Error(
+      `Remote write failed for target "${target.name}" (exit ${r.status}): ${(r.stderr || '').slice(0, 500)}`,
+    );
+  }
+  return true;
+}
+
+/**
+ * Deploy the SSOT projection to one configured remote target.
+ *
+ * @param {string} brainDir
+ * @param {string} targetName
+ * @param {{ dryRun?: boolean, keys?: string[], skipRestart?: boolean }} opts
+ */
+export async function deployEnvToRemote(brainDir, targetName, opts = {}) {
+  const targets = loadRemoteTargets(brainDir);
+  const target = targets.find((t) => t.name === targetName);
+  if (!target) {
+    throw new Error(
+      `Unknown remote target "${targetName}". Configure one first: npx total-recall secret remote add ${targetName} --host <host> --path </remote/dir>`,
+    );
+  }
+
+  // Match the same projection local `export-env --path .` builds: repo-bound
+  // secrets (set with --repo <name>) only resolve when the caller's project
+  // slug is passed through. Without this, deployEnvToRemote silently dropped
+  // every repo-scoped key and pushed only unbound/global ones — the opposite
+  // of what --repo scoping is for. cwd is the right default since this CLI
+  // is always invoked from the repo root (same assumption --path . makes).
+  const projectPath = opts.projectPath || process.cwd();
+  const projection = await buildEnvProjection(brainDir, {
+    includeGlobal: target.includeGlobal !== false,
+    keys: opts.keys?.length ? opts.keys : target.keys,
+    projectPath,
+    projectSlug: opts.projectSlug || projectSlugFromPath(projectPath),
+  });
+
+  const remoteFile = path.posix.join(target.remotePath, target.filename || '.env');
+
+  if (opts.dryRun) {
+    return {
+      dryRun: true,
+      target: target.name,
+      host: target.host,
+      remoteFile,
+      keys: projection.keys,
+      count: projection.count,
+    };
+  }
+
+  if (!projection.count) {
+    return {
+      dryRun: false,
+      target: target.name,
+      host: target.host,
+      remoteFile,
+      keys: [],
+      count: 0,
+      skipped: 'no matching keys',
+    };
+  }
+
+  const existing = fetchRemoteFile(target, remoteFile);
+  const merged = mergeEnvManagedBlock(existing, projection.body);
+  writeRemoteFile(target, remoteFile, merged);
+
+  let restarted = false;
+  let restartOutput = null;
+  if (target.restartCommand && !opts.skipRestart) {
+    const r = runSsh(target, target.restartCommand);
+    restarted = r.status === 0;
+    restartOutput = (r.stdout || '') + (r.stderr || '');
+  }
+
+  return {
+    dryRun: false,
+    target: target.name,
+    host: target.host,
+    remoteFile,
+    keys: projection.keys,
+    count: projection.count,
+    restarted,
+    restartOutput: restartOutput ? restartOutput.slice(0, 2000) : null,
+  };
+}
+
+/**
+ * Deploy to every remote target that has this key bound via `keys`, or to
+ * every target when the key list is unset (target opts into "all keys").
+ */
+export async function deployKeyToRemotes(brainDir, key, opts = {}) {
+  const targets = loadRemoteTargets(brainDir);
+  const matching = targets.filter((t) => !t.keys?.length || t.keys.includes(key));
+  const results = [];
+  for (const t of matching) {
+    try {
+      results.push(await deployEnvToRemote(brainDir, t.name, opts));
+    } catch (err) {
+      results.push({ target: t.name, host: t.host, ok: false, error: err.message });
+    }
+  }
+  return results;
+}