total-recall-brain 3.21.2 → 3.22.0

package/frontend/src/pages/MeshPage.spec.tsx

@@ -2,7 +2,13 @@ import { render, screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { MeshPage } from './MeshPage';
-import { fetchLeader, fetchNodes as fetchMeshNodes, refreshElection } from '../api/mesh';
+import {
+  fetchLeader,
+  fetchNodes as fetchMeshNodes,
+  refreshElection,
+  fetchEnrollmentStatus,
+  enrollThisNode,
+} from '../api/mesh';
 import { fetchHeadscaleNodes, deleteHeadscaleNode, fetchPreAuthKeys, createPreAuthKey, fetchHeadscaleUsers } from '../api/headscale';
 
 vi.mock('../api/mesh', () => ({
@@ -47,6 +53,21 @@ vi.mock('../api/mesh', () => ({
   }),
   fetchElectionHistory: vi.fn().mockResolvedValue([]),
   logElectionObservation: vi.fn().mockResolvedValue({ success: true, recorded: true }),
+  fetchEnrollmentStatus: vi.fn().mockResolvedValue({
+    state: 'enrolled',
+    enrolled: true,
+    backend_state: 'Running',
+    auth_url: null,
+    ips: ['100.64.0.1'],
+    hostname: 'node-a',
+    login_server: 'https://control.example.org',
+    can_auto_enroll: true,
+    auto_enroll_blocked_reason: null,
+    auto_enroll_enabled: true,
+    client_available: true,
+    checked_at: new Date().toISOString(),
+  }),
+  enrollThisNode: vi.fn(),
 }));
 
 vi.mock('../api/headscale', () => ({
@@ -135,7 +156,7 @@ describe('MeshPage', () => {
     vi.mocked(fetchPreAuthKeys).mockResolvedValue([
       { id: 'key1', key: 'hspkey_xyz', user: 'default', reusable: true, expiration: '2099-12-31T23:59:59Z', createdAt: '2024-01-01', used: false }
     ]);
-    vi.mocked(createPreAuthKey).mockResolvedValue({} as any);
+    vi.mocked(createPreAuthKey).mockResolvedValue({} as never);
 
     render(<MeshPage />);
 
@@ -174,4 +195,92 @@ describe('MeshPage', () => {
       expect(screen.getByText('alice')).toBeInTheDocument();
     });
   });
+
+  describe('enrollment banner', () => {
+    const notEnrolled = {
+      state: 'needs_login' as const,
+      enrolled: false,
+      backend_state: 'NeedsLogin',
+      auth_url: 'https://control.example.org/register/abc123',
+      ips: [],
+      hostname: 'node-a',
+      login_server: 'https://control.example.org',
+      can_auto_enroll: true,
+      auto_enroll_blocked_reason: null,
+      auto_enroll_enabled: true,
+      client_available: true,
+      checked_at: new Date().toISOString(),
+    };
+
+    beforeEach(() => {
+      vi.mocked(fetchLeader).mockResolvedValue({ hostname: 'node-a.mesh', ip: '100.64.0.1' });
+      vi.mocked(fetchMeshNodes).mockResolvedValue([]);
+    });
+
+    it('stays hidden when this node is already on the mesh', async () => {
+      vi.mocked(fetchEnrollmentStatus).mockResolvedValue({ ...notEnrolled, state: 'enrolled', enrolled: true });
+      render(<MeshPage />);
+      await waitFor(() => expect(screen.getByText('Mesh Operations Center')).toBeInTheDocument());
+      expect(screen.queryByTestId('enrollment-banner')).not.toBeInTheDocument();
+    });
+
+    it('prompts to enroll and shows the pending registration link', async () => {
+      vi.mocked(fetchEnrollmentStatus).mockResolvedValue(notEnrolled);
+      render(<MeshPage />);
+
+      const banner = await screen.findByTestId('enrollment-banner');
+      expect(banner).toHaveTextContent('This node is not on the mesh');
+      expect(screen.getByRole('link', { name: /approve this node/i })).toHaveAttribute(
+        'href',
+        'https://control.example.org/register/abc123',
+      );
+      expect(screen.getByRole('button', { name: /enroll this node/i })).toBeInTheDocument();
+    });
+
+    it('enrolls on click and re-syncs enrollment state from the server', async () => {
+      const enrolled = { ...notEnrolled, state: 'enrolled' as const, enrolled: true, ips: ['100.64.0.7'], auth_url: null };
+      // The page must trust the server, not its own optimistic state: the
+      // status call flips to `enrolled` only once the node is really up.
+      vi.mocked(fetchEnrollmentStatus).mockResolvedValueOnce(notEnrolled).mockResolvedValue(enrolled);
+      vi.mocked(enrollThisNode).mockResolvedValue({
+        ok: true,
+        changed: true,
+        state: 'enrolled',
+        method: 'preauth-key',
+        status: enrolled,
+      });
+
+      render(<MeshPage />);
+      await userEvent.click(await screen.findByRole('button', { name: /enroll this node/i }));
+
+      await waitFor(() => expect(enrollThisNode).toHaveBeenCalled());
+      await waitFor(() => expect(screen.queryByTestId('enrollment-banner')).not.toBeInTheDocument());
+    });
+
+    it('explains what to configure when no automatic path exists', async () => {
+      vi.mocked(fetchEnrollmentStatus).mockResolvedValue({
+        ...notEnrolled,
+        can_auto_enroll: false,
+        auto_enroll_blocked_reason: 'no-headscale-api-key',
+        login_server: null,
+      });
+      render(<MeshPage />);
+      const banner = await screen.findByTestId('enrollment-banner');
+      expect(banner).toHaveTextContent(/No control server configured/i);
+    });
+
+    it('hides the enroll button when no tailscale client is installed', async () => {
+      vi.mocked(fetchEnrollmentStatus).mockResolvedValue({
+        ...notEnrolled,
+        state: 'client_unavailable',
+        client_available: false,
+        auth_url: null,
+        can_auto_enroll: false,
+      });
+      render(<MeshPage />);
+      const banner = await screen.findByTestId('enrollment-banner');
+      expect(banner).toHaveTextContent(/No Tailscale client detected/i);
+      expect(screen.queryByRole('button', { name: /enroll this node/i })).not.toBeInTheDocument();
+    });
+  });
 });

package/frontend/src/pages/MeshPage.tsx

@@ -10,11 +10,21 @@ import {
   registerLanMeshNodes,
   fetchElectionHistory,
   logElectionObservation,
+  fetchEnrollmentStatus,
+  enrollThisNode,
 } from '../api/mesh';
 import { fetchHeadscaleNodes, fetchPreAuthKeys, fetchHeadscaleUsers, createPreAuthKey, deleteHeadscaleNode } from '../api/headscale';
-import type { MeshNode, LeaderInfo, LanHost, MeshInterfaceSummary, DeviceIoProfile } from '../api/mesh';
+import type {
+  MeshNode,
+  LeaderInfo,
+  LanHost,
+  MeshInterfaceSummary,
+  DeviceIoProfile,
+  EnrollmentStatus,
+} from '../api/mesh';
 import type { HeadscaleNode, PreAuthKey as HeadscalePreAuthKey, HeadscaleUser } from '../api/headscale';
 import { MeshTopology } from '../components/MeshTopology';
+import { EmbeddingProviderPanel } from '../components/EmbeddingProviderPanel';
 import { LatencySparkline } from '../components/LatencySparkline';
 import './MeshPage.css';
 
@@ -45,6 +55,9 @@ export function MeshPage() {
   const [lanTrCount, setLanTrCount] = useState(0);
   const [deviceIo, setDeviceIo] = useState<DeviceIoProfile | null>(null);
   const [uiHints, setUiHints] = useState<string[]>([]);
+  const [enrollment, setEnrollment] = useState<EnrollmentStatus | null>(null);
+  const [enrollBusy, setEnrollBusy] = useState(false);
+  const [enrollMsg, setEnrollMsg] = useState<string | null>(null);
   const [lanRegisterBusy, setLanRegisterBusy] = useState(false);
   const [lanRegisterMsg, setLanRegisterMsg] = useState<string | null>(null);
   const prevLeaderRef = useRef<string | null>(null);
@@ -145,6 +158,10 @@ export function MeshPage() {
             setUiHints(ioRes.ui_hints || ioRes.io?.ui_hints || []);
           })
           .catch(() => { /* optional */ });
+        // Enrollment state drives the join banner; never fail the page on it.
+        fetchEnrollmentStatus()
+          .then(setEnrollment)
+          .catch(() => { /* optional */ });
         pollMsRef.current = POLL_BASE_MS;
       } else if (activeTab === 'headscale-nodes') {
         const nodes = await fetchHeadscaleNodes();
@@ -156,8 +173,8 @@ export function MeshPage() {
         const users = await fetchHeadscaleUsers();
         setHsUsers(users);
       }
-    } catch (err: any) {
-      setError(err.message || `Failed to load ${activeTab} data`);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : `Failed to load ${activeTab} data`);
       // Back off polling on errors to reduce long-task pressure.
       pollMsRef.current = Math.min(POLL_MAX_MS, pollMsRef.current * 1.5);
     } finally {
@@ -188,8 +205,8 @@ export function MeshPage() {
       const l = await refreshElection();
       recordLeaderChange(l, 'manual refresh');
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to refresh election state');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to refresh election state');
     }
   }
 
@@ -202,13 +219,36 @@ export function MeshPage() {
         `Registered ${res.registration?.written_count ?? 0} of ${res.registration?.attempted ?? 0} TR-reachable LAN hosts as mesh_node entities.`,
       );
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'LAN register failed');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'LAN register failed');
     } finally {
       setLanRegisterBusy(false);
     }
   }
 
+  async function handleEnroll() {
+    setEnrollBusy(true);
+    setEnrollMsg(null);
+    try {
+      const result = await enrollThisNode();
+      setEnrollment(result.status);
+      if (result.ok && result.changed) {
+        setEnrollMsg(`Enrolled on the mesh via ${result.method || 'control server'}.`);
+      } else if (result.ok) {
+        setEnrollMsg('This node is already enrolled.');
+      } else if (result.auth_url) {
+        setEnrollMsg('Approve the registration link below to finish joining.');
+      } else {
+        setEnrollMsg(result.hint || result.reason || 'Enrollment did not complete.');
+      }
+      await loadData();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Enrollment failed');
+    } finally {
+      setEnrollBusy(false);
+    }
+  }
+
   async function handleCreateKey(e: React.FormEvent) {
     e.preventDefault();
     try {
@@ -219,8 +259,8 @@ export function MeshPage() {
         expiration: newKeyExpiration
       });
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to create pre-auth key');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to create pre-auth key');
     }
   }
 
@@ -229,8 +269,8 @@ export function MeshPage() {
     try {
       await deleteHeadscaleNode(id);
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to delete node');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to delete node');
     }
   }
 
@@ -278,8 +318,52 @@ export function MeshPage() {
 
       {error && <div className="alert alert-error" style={{ marginBottom: '24px' }}>{error}</div>}
 
+      {enrollment && !enrollment.enrolled && (
+        <div className="alert alert-warning mesh-enrollment-banner" style={{ marginBottom: '24px' }} data-testid="enrollment-banner">
+          <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 16, flexWrap: 'wrap' }}>
+            <div>
+              <strong>This node is not on the mesh</strong>
+              <div style={{ fontSize: 13, marginTop: 4 }}>
+                {enrollment.state === 'client_unavailable'
+                  ? 'No Tailscale client detected. Install Tailscale (or set TR_TAILSCALE_BIN) to join the mesh.'
+                  : enrollment.can_auto_enroll
+                    ? `Ready to enroll automatically against ${enrollment.login_server}.`
+                    : enrollment.login_server
+                      ? `Control server ${enrollment.login_server} — add a Headscale API key to enroll without approving in a browser.`
+                      : 'No control server configured. Add a Headscale API key with its URL, or set TR_HEADSCALE_URL.'}
+              </div>
+              {enrollment.auth_url && (
+                <div style={{ fontSize: 13, marginTop: 8 }}>
+                  Pending registration:{' '}
+                  <a href={enrollment.auth_url} target="_blank" rel="noreferrer noopener">
+                    approve this node
+                  </a>
+                </div>
+              )}
+              {enrollMsg && (
+                <div style={{ fontSize: 13, marginTop: 8, color: 'var(--accent-hover)' }}>{enrollMsg}</div>
+              )}
+            </div>
+            {enrollment.client_available && (
+              <button
+                type="button"
+                className="btn btn-primary"
+                onClick={handleEnroll}
+                disabled={enrollBusy}
+              >
+                {enrollBusy ? 'Enrolling…' : 'Enroll this node'}
+              </button>
+            )}
+          </div>
+        </div>
+      )}
+
       {activeTab === 'mesh' && (
         <div style={{ display: 'flex', flexDirection: 'column', gap: 24 }}>
+          {/* Which mesh node actually serves embeddings, and which model it uses. */}
+          <div className="card">
+            <EmbeddingProviderPanel />
+          </div>
           <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 16 }}>
             <div className="card">
               <h3 style={{ marginTop: 0, marginBottom: 12 }}>Topology</h3>

package/frontend/src/pages/NetworkPage.spec.tsx

@@ -33,14 +33,14 @@ vi.mock('../api/network', () => {
 describe('NetworkPage', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    (getNetworkStats as any).mockResolvedValue({
-      stats: { active: 2, queueLength: 0, errors: 0, timeouts: 0 }
-    });
-    (getNetworkPolicy as any).mockResolvedValue({
+    vi.mocked(getNetworkStats).mockResolvedValue({
+      stats: { active: 2, queueLength: 0, errors: 0, timeouts: 0 } as any
+    } as any);
+    vi.mocked(getNetworkPolicy).mockResolvedValue({
       blocked_domains: ['evil.com'],
       max_global_concurrency: 20
-    });
-    (getAuditLog as any).mockResolvedValue({
+    } as any);
+    vi.mocked(getAuditLog).mockResolvedValue({
       audit: []
     });
   });
@@ -54,10 +54,9 @@ describe('NetworkPage', () => {
     render(<NetworkPage />);
     
     await waitFor(() => {
-      expect(screen.getAllByText(/Network Firewall/i)[0]).toBeInTheDocument();
+      expect(screen.getByText(/Active Connections/i)).toBeInTheDocument();
     });
 
-    expect(screen.getByText(/Active Connections/i)).toBeInTheDocument();
     expect(screen.getByText('2')).toBeInTheDocument();
     expect(screen.getByText('evil.com')).toBeInTheDocument();
   });

package/frontend/src/pages/NetworkPage.tsx

@@ -53,7 +53,7 @@ export default function NetworkPage() {
             : undefined
         ),
       ]);
-      setStats(statsRes.stats || statsRes as any);
+      setStats(statsRes.stats || statsRes as unknown as NetworkStats);
       if (policyRes) {
         setPolicy(policyRes);
         if (!limitsChanged) {
@@ -66,15 +66,15 @@ export default function NetworkPage() {
       }
       setAudit(auditRes.audit || []);
       setError('');
-    } catch (err: any) {
-      setError(err.message || 'Failed to load network data');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to load network data');
     } finally {
       setLoading(false);
     }
   }, [filterDomain, filterStatus, limitsChanged]);
 
   useEffect(() => {
-    loadData();
+    setTimeout(() => void loadData(), 0);
   }, [loadData]);
 
   useEffect(() => {
@@ -94,8 +94,8 @@ export default function NetworkPage() {
       setSuccess(`Blocked ${domain}`);
       setTimeout(() => setSuccess(''), 3000);
       await loadData();
-    } catch (err: any) {
-      setError(err.message);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
     }
   };
 
@@ -105,8 +105,8 @@ export default function NetworkPage() {
       setSuccess(`Unblocked ${domain}`);
       setTimeout(() => setSuccess(''), 3000);
       await loadData();
-    } catch (err: any) {
-      setError(err.message);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
     }
   };
 
@@ -117,8 +117,8 @@ export default function NetworkPage() {
       setSuccess('Limits updated');
       setTimeout(() => setSuccess(''), 3000);
       await loadData();
-    } catch (err: any) {
-      setError(err.message);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
     }
   };
 
@@ -129,8 +129,8 @@ export default function NetworkPage() {
       setSuccess(`Switched to ${!policy.whitelist_mode ? 'whitelist' : 'blocklist'} mode`);
       setTimeout(() => setSuccess(''), 3000);
       await loadData();
-    } catch (err: any) {
-      setError(err.message);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
     }
   };
 

package/frontend/src/pages/NotificationsPage.tsx

@@ -41,15 +41,15 @@ export function NotificationsPage() {
       const [r, h] = await Promise.all([listNotificationRules(), getNotificationHistory()]);
       setRules(r);
       setHistory(h);
-    } catch (err: any) {
-      setError(err.message || 'Failed to load notifications data');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to load notifications data');
     } finally {
       setLoading(false);
     }
   }
 
   useEffect(() => {
-    loadData();
+    setTimeout(() => { void loadData() }, 0);
     const interval = setInterval(loadData, 15000);
     return () => clearInterval(interval);
   }, []);
@@ -70,8 +70,8 @@ export function NotificationsPage() {
       setNewPriority('high');
       setNewQuietHours(false);
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to create notification rule');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to create notification rule');
     }
   }
 
@@ -80,8 +80,8 @@ export function NotificationsPage() {
     try {
       await deleteNotificationRule(id);
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to delete notification rule');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to delete notification rule');
     }
   }
 
@@ -90,8 +90,8 @@ export function NotificationsPage() {
       await sendTestNotification();
       setSuccess('Test notification sent');
       setTimeout(() => setSuccess(null), 3000);
-    } catch (err: any) {
-      setError(err.message || 'Failed to send test notification');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to send test notification');
     }
   }
 

package/frontend/src/pages/OnboardingPage.spec.tsx

@@ -1,4 +1,4 @@
-// @ts-nocheck
+
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { render, screen, waitFor, fireEvent } from '@testing-library/react';
 import { BrowserRouter } from 'react-router-dom';
@@ -18,7 +18,7 @@ describe('OnboardingPage', () => {
   };
 
   it('renders welcome step first', async () => {
-    vi.mocked(api.listMemory).mockResolvedValue([] as any);
+    vi.mocked(api.listMemory).mockResolvedValue([] as never);
 
     renderWithRouter(<OnboardingPage />);
 
@@ -28,8 +28,8 @@ describe('OnboardingPage', () => {
   });
 
   it('navigates to next step', async () => {
-    vi.mocked(api.listMemory).mockResolvedValue([] as any);
-    vi.mocked(api.scanEnvSecrets).mockResolvedValue({ candidates: [] } as any);
+    vi.mocked(api.listMemory).mockResolvedValue([] as never);
+    vi.mocked(api.scanEnvSecrets).mockResolvedValue({ candidates: [] } as never);
 
     renderWithRouter(<OnboardingPage />);
 
@@ -42,10 +42,10 @@ describe('OnboardingPage', () => {
   });
 
   it('handles scan import mode', async () => {
-    vi.mocked(api.listMemory).mockResolvedValue([] as any);
+    vi.mocked(api.listMemory).mockResolvedValue([] as never);
     vi.mocked(api.scanEnvSecrets).mockResolvedValue({
-      candidates: [{ key: 'TEST_KEY', provider: 'test', masked: 'sk-***', source_label: '.env' }]
-    });
+      candidates: [{ key: 'TEST_KEY', provider: 'test', masked: 'sk-***', source_label: '.env' } as any]
+    } as any);
 
     renderWithRouter(<OnboardingPage />);
 

package/frontend/src/pages/OpenWikiPage.tsx

@@ -110,7 +110,7 @@ try {
           // Re-fetch nodes after background ingest completes
           void fetchNodes(activeBrainId || 'global');
         });
-      } catch (e) {
+      } catch {
         // ignore
       }
       
@@ -118,8 +118,8 @@ try {
     };
 
     void initFetch();
-    void fetchHealthData();
-    const interval = setInterval(fetchHealthData, 15000);
+    setTimeout(() => { void fetchHealthData(); }, 0);
+    const interval = setInterval(() => { void fetchHealthData(); }, 15000);
     return () => clearInterval(interval);
   }, [activeBrainId]);
 

package/frontend/src/pages/RulesPage.tsx

@@ -20,7 +20,7 @@ export default function RulesPage({ activeBrainId }: { activeBrainId: string })
     fetchRules();
   }, [activeBrainId]);
 
-  const fetchRules = async () => {
+  async function fetchRules() {
     setLoading(true);
     setError(null);
     try {
@@ -51,7 +51,7 @@ export default function RulesPage({ activeBrainId }: { activeBrainId: string })
         headers: { 'Content-Type': 'application/json' },
       });
       fetchRules();
-    } catch (err) {
+    } catch {
       alert('Failed to archive rule');
     }
   };
@@ -64,7 +64,7 @@ export default function RulesPage({ activeBrainId }: { activeBrainId: string })
         headers: { 'Content-Type': 'application/json' },
       });
       fetchRules();
-    } catch (err) {
+    } catch {
       alert('Failed to restore rule');
     }
   };

package/frontend/src/pages/SecretsPage.spec.tsx

@@ -12,15 +12,15 @@ describe('SecretsPage', () => {
   });
 
   it('renders without crashing', async () => {
-    vi.mocked(api.fetchConfigJson).mockResolvedValue({} as any);
-    vi.mocked(api.fetchSecretsCatalog).mockResolvedValue({ keys: [], by_provider: [], store: 'mock-store' } as any);
-    vi.mocked(api.listApiKeys).mockResolvedValue({ keys: [] } as any);
-    vi.mocked(api.fetchWebAuthnStatus).mockResolvedValue({} as any);
+    vi.mocked(api.fetchConfigJson).mockResolvedValue({} as never);
+    vi.mocked(api.fetchSecretsCatalog).mockResolvedValue({ keys: [], by_provider: [], store: 'mock-store' } as never);
+    vi.mocked(api.listApiKeys).mockResolvedValue({ keys: [] } as never);
+    vi.mocked(api.fetchWebAuthnStatus).mockResolvedValue({} as never);
     vi.mocked(api.fetchGeminiModels).mockResolvedValue([]);
     vi.mocked(api.fetchClaudeModels).mockResolvedValue([]);
     vi.mocked(api.fetchOpenaiModels).mockResolvedValue([]);
     vi.mocked(api.fetchOpenRouterModels).mockResolvedValue([]);
-    vi.mocked(api.getSyncStatus).mockResolvedValue({ nodes: [], localChecksum: 'abc' } as any);
+    vi.mocked(api.getSyncStatus).mockResolvedValue({ nodes: [], localChecksum: 'abc' } as never);
 
     render(
       <BrowserRouter>

package/frontend/src/pages/SecretsPage.tsx

@@ -231,8 +231,8 @@ export default function SecretsPage() {
       const syncData = await getSyncStatus()
       setSyncNodes(syncData.nodes || [])
       setLocalChecksum(syncData.localChecksum)
-    } catch (err: any) {
-      setError(err.message || 'Failed to load sync status')
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to load sync status')
     }
   }, [])
 
@@ -249,10 +249,10 @@ export default function SecretsPage() {
       setSyncLogs(prev => [{ time: new Date().toLocaleTimeString(), event: msg, status: 'success' }, ...prev])
 
       await loadSyncData()
-    } catch (err: any) {
-      const msg = `Sync trigger failed: ${err.message || err}`
+    } catch (err) {
+      const msg = `Sync trigger failed: ${err instanceof Error ? err.message : String(err)}`
       setSyncLogs(prev => [{ time: new Date().toLocaleTimeString(), event: msg, status: 'error' }, ...prev])
-      setError(err.message || 'Failed to trigger synchronization')
+      setError(err instanceof Error ? err.message : 'Failed to trigger synchronization')
     } finally {
       setSyncing(false)
     }
@@ -287,8 +287,8 @@ export default function SecretsPage() {
       setNewSecretKeyName('')
       setNewSecretVal('')
       await loadCatalog()
-    } catch (err: any) {
-      setError(err.message || 'Failed to create secret')
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to create secret')
     } finally {
       setSaving(false)
     }
@@ -296,7 +296,7 @@ export default function SecretsPage() {
 
   useEffect(() => {
     if (tab === 'sync') {
-      void loadSyncData()
+      setTimeout(() => void loadSyncData(), 0)
     }
   }, [tab, loadSyncData])
 
@@ -360,12 +360,11 @@ export default function SecretsPage() {
   }, [])
 
   useEffect(() => {
-    // eslint-disable-next-line
-    void loadCatalog()
-     
-    void loadPats()
-     
-    void loadWebAuthn()
+    setTimeout(() => {
+      void loadCatalog()
+      void loadPats()
+      void loadWebAuthn()
+    }, 0)
   }, [loadCatalog, loadPats, loadWebAuthn])