total-recall-brain 3.21.2 → 3.22.0

package/frontend/src/pages/SettingsPage.spec.tsx

@@ -18,18 +18,18 @@ describe('SettingsPage', () => {
       budget: { budget: {} },
       brain: {},
       secrets: {},
-    } as any);
+    } as never);
     vi.mocked(api.fetchHealth).mockResolvedValue({
       status: 'healthy',
       version: '1.0.0',
       cli_agents: ['claude'],
-    } as any);
+    } as never);
     vi.mocked(api.checkUpdate).mockResolvedValue({
       updateAvailable: false,
       currentVersion: '1.0.0',
       latestVersion: '1.0.0',
-    } as any);
-    vi.mocked(api.triggerRecompile).mockResolvedValue({ success: true, message: 'ok' } as any);
+    } as never);
+    vi.mocked(api.triggerRecompile).mockResolvedValue({ success: true, message: 'ok' } as never);
 
     await act(async () => {
       render(<SettingsPage />);
@@ -43,8 +43,8 @@ describe('SettingsPage', () => {
   it('shows error + retry when config fails', async () => {
     vi.spyOn(console, 'error').mockImplementation(() => {});
     vi.mocked(api.fetchConfigJson).mockRejectedValue(new Error('Config JSON API error: 500'));
-    vi.mocked(api.fetchHealth).mockResolvedValue({ status: 'healthy' } as any);
-    vi.mocked(api.checkUpdate).mockResolvedValue({ updateAvailable: false } as any);
+    vi.mocked(api.fetchHealth).mockResolvedValue({ status: 'healthy' } as never);
+    vi.mocked(api.checkUpdate).mockResolvedValue({ updateAvailable: false } as never);
     vi.mocked(api.fetchBrains).mockResolvedValue([]);
 
     await act(async () => {

package/frontend/src/pages/SettingsPage.tsx

@@ -15,7 +15,7 @@ import type { ConfigJson } from '../types';
 import { MobilePairing } from '../components/MobilePairing';
 
 function normalizeConfigJson(data: ConfigJson): ConfigJson {
-  const next = { ...data } as ConfigJson & Record<string, any>;
+  const next = { ...data } as ConfigJson & Record<string, unknown>;
   if (!next.security) next.security = {};
   if (!next.security.dashboard) next.security.dashboard = {};
   if (!next.security.api) next.security.api = {};
@@ -79,7 +79,7 @@ export default function SettingsPage({ activeBrainId }: { activeBrainId?: string
         }),
       )
       .catch(console.error);
-    loadConfig();
+    setTimeout(() => { void loadConfig(); }, 0);
   }, [activeBrainId]);
 
   

package/frontend/src/pages/SkillsPage.spec.tsx

@@ -1,4 +1,3 @@
-// @ts-nocheck
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { render, screen } from '@testing-library/react';
 import SkillsPage from './SkillsPage';
@@ -10,7 +9,7 @@ describe('SkillsPage', () => {
   beforeEach(() => {
     vi.resetAllMocks();
     vi.mocked(api.listSkills).mockResolvedValue([
-      { name: 'test-skill', description: 'A test skill', repo: 'test' }
+      { name: 'test-skill', description: 'A test skill', repo: 'test' } as any
     ]);
   });
 

package/frontend/src/pages/SkillsPage.tsx

@@ -327,7 +327,7 @@ export default function SkillsPage({ activeBrainId }: { activeBrainId?: string }
             try {
               const skillDetails = await fetchSkill(target.name, target.repo);
               setSkillContent(skillDetails.content || '');
-            } catch (err) {
+            } catch {
               console.warn(`Could not load SKILL.md for ${target.name}`);
               setSkillContent('');
             }
@@ -633,8 +633,8 @@ Configure triggers, options, and prompts inside this rules sheet to hot-recompil
         setError(res.message || 'Failed to generate repo-expert');
       }
       setTimeout(() => setSuccess(null), 5000);
-    } catch (err: any) {
-      setError(err.message || 'Error generating repo-expert');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Error generating repo-expert');
     } finally {
       void fetchSkillsList(selectedSkill?.name, selectedSkill?.repo);
     }

package/frontend/src/pages/TasksPage.spec.tsx

@@ -11,9 +11,9 @@ describe('TasksPage', () => {
   });
 
   it('renders without crashing', async () => {
-    vi.mocked(api.listTasks).mockResolvedValue({ items: [] } as any);
-    vi.mocked(api.listResearch).mockResolvedValue({ items: [] } as any);
-    vi.mocked(api.fetchLogs).mockResolvedValue({ content: '' } as any);
+    vi.mocked(api.listTasks).mockResolvedValue({ items: [] } as never);
+    vi.mocked(api.listResearch).mockResolvedValue({ items: [] } as never);
+    vi.mocked(api.fetchLogs).mockResolvedValue({ content: '' } as never);
     render(<TasksPage />);
     expect(screen.getByText(/Cognitive Dashboard/i)).toBeInTheDocument();
   });

package/frontend/src/pages/UsagePage.spec.tsx

@@ -17,9 +17,9 @@ describe('UsagePage', () => {
       breakdown: {
         gemini: { dailyUsd: 1.0, weeklyUsd: 5.0, dailyTokens: 100, weeklyTokens: 500 }
       }
-    } as any);
+    } as never);
 
-    vi.mocked(api.fetchConfigJson).mockResolvedValue({} as any);
+    vi.mocked(api.fetchConfigJson).mockResolvedValue({} as never);
 
     await act(async () => {
       render(<UsagePage />);

package/frontend/src/pages/UsagePage.tsx

@@ -495,7 +495,7 @@ export default function UsagePage() {
                 <Tooltip
                   contentStyle={{ background: '#1a1a2e', border: '1px solid rgba(255,255,255,0.1)', borderRadius: 8, fontSize: 12, color: '#e8e8e8' }}
                   labelStyle={{ color: '#fff', fontWeight: 600, marginBottom: 4 }}
-                  formatter={(value: any, name: any) => [`$${Number(value).toFixed(3)}`, String(name).charAt(0).toUpperCase() + String(name).slice(1)]}
+                  formatter={(value: unknown, name: unknown) => [`$${Number(value).toFixed(3)}`, String(name).charAt(0).toUpperCase() + String(name).slice(1)]}
                 />
                 <Legend wrapperStyle={{ fontSize: 12, color: 'var(--text-secondary)' }} />
                 <Area type="monotone" dataKey="gemini" stackId="1" stroke="#3b82f6" fill="url(#gradGemini)" strokeWidth={2} />

package/frontend/src/pages/WebhooksPage.spec.tsx

@@ -71,7 +71,7 @@ describe('WebhooksPage', () => {
   it('runs through the Add Webhook wizard', async () => {
     vi.mocked(fetchWebhookConfigs).mockResolvedValue([]);
     vi.mocked(fetchWebhookEvents).mockResolvedValue([]);
-    vi.mocked(addWebhookConfig).mockResolvedValue({} as any);
+    vi.mocked(addWebhookConfig).mockResolvedValue({} as never);
 
     render(<WebhooksPage />);
     

package/frontend/src/pages/WebhooksPage.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react';
+import { useEffect, useState, useCallback } from 'react';
 import {
   fetchWebhookConfigs,
   fetchWebhookEvents,
@@ -11,7 +11,7 @@ import type { WebhookConfig, WebhookEvent } from '../api/webhooks';
 import './WebhooksPage.css';
 
 // Expandable JSON Viewer Component
-function JsonViewer({ data }: { data: any }) {
+function JsonViewer({ data }: { data: unknown }) {
   const [expanded, setExpanded] = useState(false);
   
   if (!data) return null;
@@ -42,32 +42,32 @@ export function WebhooksPage() {
   const [wizardStep, setWizardStep] = useState(1);
   const [newConfig, setNewConfig] = useState<Partial<WebhookConfig>>({ status: 'active', events: [] });
 
-  async function loadData() {
+  const loadData = useCallback(async () => {
     setLoading(true);
     setError(null);
     try {
       const [c, e] = await Promise.all([fetchWebhookConfigs(), fetchWebhookEvents(filterProvider || undefined)]);
       setConfigs(c);
       setEvents(e);
-    } catch (err: any) {
-      setError(err.message || 'Failed to load webhooks data');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to load webhooks data');
     } finally {
       setLoading(false);
     }
-  }
+  }, [filterProvider]);
 
   useEffect(() => {
-    loadData();
-    const interval = setInterval(loadData, 10000);
+    setTimeout(() => { void loadData() }, 0);
+    const interval = setInterval(() => { void loadData() }, 10000);
     return () => clearInterval(interval);
-  }, [filterProvider]);
+  }, [loadData]);
 
   async function handleTest(provider: string) {
     try {
       await triggerTestWebhook(provider);
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to trigger test webhook');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to trigger test webhook');
     }
   }
 
@@ -75,8 +75,8 @@ export function WebhooksPage() {
     try {
       await redeliverWebhookEvent(eventId);
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to re-deliver webhook event');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to re-deliver webhook event');
     }
   }
 
@@ -88,8 +88,8 @@ export function WebhooksPage() {
       setWizardStep(1);
       setNewConfig({ status: 'active', events: [] });
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to add webhook');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to add webhook');
     }
   }
 
@@ -98,8 +98,8 @@ export function WebhooksPage() {
     try {
       await deleteWebhookConfig(provider);
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to delete webhook');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to delete webhook');
     }
   }
 
@@ -111,8 +111,8 @@ export function WebhooksPage() {
         .join('');
       await addWebhookConfig({ provider, status: 'active', secret: newSecret });
       await loadData();
-    } catch (err: any) {
-      setError(err.message || 'Failed to rotate secret');
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to rotate secret');
     }
   }
 

package/frontend/src/setupTests.ts

@@ -7,10 +7,10 @@ afterEach(() => {
 });
 
 class MockEventSource {
-  constructor(_url: string) {}
+  constructor(_url: string) { void _url; }
   close() {}
-  onmessage: ((event: any) => void) | null = null;
-  onerror: ((event: any) => void) | null = null;
+  onmessage: ((event: unknown) => void) | null = null;
+  onerror: ((event: unknown) => void) | null = null;
 }
 if (typeof window !== 'undefined') {
   Object.defineProperty(window, 'EventSource', {
@@ -28,7 +28,7 @@ class MockResizeObserver {
   unobserve() {}
   disconnect() {}
 }
-(globalThis as any).ResizeObserver = MockResizeObserver;
+(globalThis as typeof globalThis & { ResizeObserver: unknown }).ResizeObserver = MockResizeObserver;
 
 // Mock localStorage
 const localStorageMock = (function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.21.2",
+  "version": "3.22.0",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/scaffold/.agent/skills/total-recall/SKILL.md

@@ -315,6 +315,98 @@ curl -H "Authorization: Bearer <YOUR_PAT_TOKEN>" \
 
 ---
 
+## 🔐 SECRETS STORE (separate from the memory vault — `secret` subcommand)
+
+API keys and credentials are **not** memory nodes. They live encrypted at
+`<brain>/config/secrets.enc`, managed exclusively via `npx total-recall secret
+<cmd>` — never write them into vault markdown, openwiki, or a compiled
+INSTRUCTIONS.md/skill surface (`secret check-surfaces` fails the build if one
+ever leaks in). Full reference: `npx total-recall secret --help`.
+
+```bash
+npx total-recall secret set <key> <value>            # store (0600, optional AES)
+npx total-recall secret rotate <key> <new-value>      # replace + mark rotated
+npx total-recall secret get <key>                     # print value (audited)
+npx total-recall secret list                          # metadata only, no values
+npx total-recall secret export-env --path <repo>       # SSOT → local .env.local
+```
+
+### Executed rotation — `rotate-auto` / `rotate-browser` (added 3.22.0)
+
+Rotation used to only ever **print instructions**. It now executes. Every key
+resolves to one of four rotation classes, so nothing is silently unrotatable:
+
+| Class | How it rotates | Human needed? |
+|---|---|---|
+| `self_generated` | TR mints the value itself (`JWT_SECRET`, `DB_PASSWORD`, `*_WEBHOOK_SECRET`) | **No** |
+| `provider_browser` | TR drives the provider console in its own browser profile | Login/2FA once |
+| `provider_api` | Provider key-management API | No |
+| `manual` | Human-only artifact (SSH keys, recovery codes, OAuth app secrets) | Yes, with reason |
+
+```bash
+npx total-recall secret rotation-status               # coverage for every key
+npx total-recall secret rotation-status --json
+npx total-recall secret rotate-auto <key>             # pick the right method automatically
+npx total-recall secret rotate-browser <key>          # force the console path
+npx total-recall secret rotate-browser <key> --print-only   # legacy: just print steps
+npx total-recall secret browser-logout                # wipe TR's browser profile
+```
+
+**Browser profile.** Console rotation uses a persistent Chromium profile at
+`<brain>/browser-profile` (created `0700`). You log in once per provider; the
+daemon can then rotate unattended. That directory holds live Stripe/GitHub
+sessions — treat it as **equally sensitive to `secrets.enc`**: never sync it,
+never back it up off-machine, and `browser-logout` when you're done.
+
+**Safety invariants** (enforced by `rotation-capability.spec.mjs`):
+
+- The new value is read from the browser's own clipboard **inside TR's process** —
+  it never transits an argv string, an env var, or a chat transcript.
+- Only recipes marked `verified: true` auto-click. Unverified providers run
+  **supervised** — TR opens the console, tells you what to click, and detects the
+  result. It never blind-clicks guessed selectors on a billing dashboard.
+- A captured value is shape-checked against the provider pattern and, where an
+  API probe exists, **verified to authenticate before it replaces the old one**.
+  A failed check stores nothing.
+- The old credential is never revoked until the new one is stored and exported.
+
+### Remote (production) deploy — `secret remote` (added 3.21.1)
+
+`export-env` only ever wrote a **local** file — there was no path from the
+SSOT to an actual production host. `secret remote` closes that gap over SSH,
+entirely generically: every host/path/restart-command is declared per-repo in
+that repo's own `<brain>/config/remote-targets.json`, never hardcoded in
+Total Recall core.
+
+```bash
+# One-time: register a target (per repo, per environment)
+npx total-recall secret remote add production \
+  --host <ip-or-hostname> --path </remote/dir> \
+  --filename .env.local --restart-cmd "pm2 restart <app> --update-env"
+
+npx total-recall secret remote list                    # show configured targets
+npx total-recall secret remote deploy production        # push current SSOT now
+npx total-recall secret remote deploy production --dry-run
+
+# Steady state: rotate AND ship to prod AND restart, in one call
+npx total-recall secret rotate SMTP2GO_API_KEY "<new-value>" --remote production
+```
+
+Secret values travel over SSH **stdin only** — never as an argv string or in
+a shell-interpolated command — written via a remote temp-file + atomic
+rename so a dropped connection can't leave a truncated secrets file live,
+then `chmod 600`. This is also why a value should never be pasted into chat
+to get it into production: paste it straight into `secret set`/`secret
+rotate` in your own terminal, or — if a provider's API supports minting a
+new key from an existing one (e.g. SMTP2GO `POST /api_keys/add`) — mint the
+replacement programmatically and it never has to be typed anywhere at all.
+When self-minting a replacement key, scope it to include the provider's own
+key-management endpoints (not just its functional one) so it can service
+its *own* next rotation too — otherwise you've built a one-shot capability
+that dead-ends back at a manual dashboard step.
+
+---
+
 <!-- BEGIN INJECTED MEMORY: do not edit by hand; rebuilt by total-recall surface -->
 <!-- @route: tfidf, generated_at: 2026-05-21T03:34:14.837Z -->
 

package/scaffold/.agent/skills/total-recall/modules/agents/agents.yml

@@ -10,10 +10,10 @@ agents:
     enabled: true
     exec: flag
 
-  # `-p` MUST be present (non-interactive requires --print) and MUST be LAST:
-  # `--tools` is variadic (`<tools...>`) in the shipped build, so anything after
-  # it — including the appended prompt — is swallowed as a tool name. Proven
-  # both ways on claude v2.1.201.
+  # `-p` MUST be present (non-interactive requires --print) and MUST be the LAST
+  # flag: `--tools` is variadic (`<tools...>`) in the shipped build, so anything
+  # after it — including the appended prompt — is swallowed as a tool name.
+  # Proven both ways on claude v2.1.201.
   - name: claude
     binary: claude
     flags: --output-format json --permission-mode bypassPermissions --setting-sources local --tools "" -p
@@ -23,9 +23,10 @@ agents:
 
   # `-m` is REQUIRED: ~/.codex/config.toml may pin a model the account cannot
   # use (seen: gpt-5.6-sol -> HTTP 400 "not supported when using Codex with a
-  # ChatGPT account"). Account-supported slugs: ~/.codex/models_cache.json.
+  # ChatGPT account"). Overriding per-dispatch avoids editing global config.
+  # Account-supported slugs are listed in ~/.codex/models_cache.json.
   # `--full-auto` is hidden from --help but still works as a deprecated alias;
-  # the explicit `--sandbox` form is OpenAI's current recommendation.
+  # the explicit `--sandbox` form is what OpenAI now recommends for scripts.
   - name: codex
     binary: codex
     flags: -m gpt-5.5 --sandbox workspace-write --json --skip-git-repo-check
@@ -33,10 +34,11 @@ agents:
     enabled: true
     exec: subcommand
 
-  # DISABLED — `antigravity` on PATH is total-recall/bin/antigravity.mjs, a thin
-  # wrapper that POSTs to generativelanguage.googleapis.com with GOOGLE_API_KEY,
-  # i.e. the METERED Gemini API, not the Ultra plan. Verified 2026-08-01: every
-  # call returned 429 "You exceeded your current quota". Use `agy` above.
+  # DISABLED — `antigravity` on PATH is bin/antigravity.mjs, a thin wrapper that
+  # POSTs to generativelanguage.googleapis.com with GOOGLE_API_KEY, i.e. the
+  # METERED Gemini API, not the Ultra plan. Verified 2026-08-01: every call
+  # returned 429 "You exceeded your current quota". Use `agy` above instead.
+  # Do not confuse the two names.
   - name: antigravity
     binary: antigravity
     flags: --sandbox=false --yolo -o json
@@ -44,8 +46,8 @@ agents:
     enabled: false
     exec: flag
 
-  # DISABLED — this user has no Gemini CLI. Do not enable because a `gemini`
-  # binary resolves on PATH; their Google surface is `agy`.
+  # DISABLED — this user has no Gemini CLI. Do not enable on the basis that a
+  # `gemini` binary resolves on PATH; their Google surface is `agy`.
   - name: gemini
     binary: gemini
     flags: --sandbox=false --yolo -o json
@@ -53,7 +55,7 @@ agents:
     enabled: false
     exec: flag
 
-  # DISABLED — not installed. A stale binary may still resolve at
+  # DISABLED — not installed for this user. A stale binary may still resolve at
   # ~/.grok/bin/grok; PATH presence is not proof an agent works.
   - name: grok
     binary: grok

package/scaffold/.agent/skills/total-recall/research-queue.jsonl

@@ -1 +0,0 @@
-{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","priority":"high","notes":"Queued from repo-wide analysis request on 2026-06-01. Focus on current best practices and meta-patterns for filesystem-native memory OS, validated operation envelopes, append-only logs, cache invalidation, research queue architecture, and secure local-first AI tools.","node_slug":null,"research_phase":"acquisition","created_at":"2026-06-01T06:07:40.102Z","updated_at":"2026-06-01T06:07:40.126Z","completed_at":null,"summary":{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","phase":"acquisition","last_updated":"2026-06-01T06:07:40.126Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}

package/src/cli/secret.mjs

@@ -29,6 +29,7 @@ import {
   updateSecretMeta,
   listRotationDue,
   getSharedValueHealth,
+  loadSecrets,
 } from '../core/secrets-store.mjs';
 import {
   scanEnvSources,
@@ -140,7 +141,13 @@ function printHelp() {
     --headscale-url <https-url>
     rotation-due          List keys overdue for rotation
       --enqueue           Create daemon tasks + browser-use prompts for each due key
-    rotate-browser <key>  Print supervised browser-use rotation instructions
+    rotate-browser <key>  Drive the provider console in TR's browser and rotate
+      --print-only        Only print instructions (legacy behaviour)
+      --headless          Allow headless for verified recipes
+    rotate-auto <key>     Rotate by whatever method the key's class supports
+    rotation-status       Rotation coverage for every key in the vault
+      --json              Machine-readable output
+    browser-logout        Delete TR's persistent browser profile (all sessions)
     usage                 Cost/events (add --key-ref for per-key)
 
   rotate options:
@@ -239,9 +246,18 @@ function parseArgs(args) {
     }
   }
   if (
-    ['set', 'get', 'rotate', 'delete', 'meta', 'rotate-browser', 'rm', 'generate', 'account-sync'].includes(
-      out.command,
-    ) &&
+    [
+      'set',
+      'get',
+      'rotate',
+      'delete',
+      'meta',
+      'rotate-browser',
+      'rotate-auto',
+      'rm',
+      'generate',
+      'account-sync',
+    ].includes(out.command) &&
     args[i] &&
     !args[i].startsWith('--')
   ) {
@@ -376,6 +392,15 @@ function parseArgs(args) {
       case '--enqueue':
         out.enqueue = true;
         break;
+      case '--print-only':
+        out.printOnly = true;
+        break;
+      case '--headless':
+        out.headless = true;
+        break;
+      case '--json':
+        out.json = true;
+        break;
       case '--bytes':
         out.bytes = parseInt(args[++i], 10) || 32;
         break;
@@ -945,17 +970,73 @@ export default async function secretCli(argv) {
       return;
     }
 
-    if (opts.command === 'rotate-browser') {
+    if (opts.command === 'rotate-browser' || opts.command === 'rotate-auto') {
       if (!opts.key) {
-        console.error('Usage: total-recall secret rotate-browser <key>');
+        console.error(`Usage: total-recall secret ${opts.command} <key>`);
+        process.exit(1);
+      }
+
+      if (opts.printOnly) {
+        const assist = await getBrowserRotateAssist(brainDir, opts.key);
+        console.log(`\n  🌐 Supervised browser rotation — ${assist.key}\n`);
+        if (assist.console_url) console.log(`  Console: ${assist.console_url}`);
+        if (assist.docs_url) console.log(`  Docs:    ${assist.docs_url}`);
+        console.log(`  Overdue: ${assist.overdue ? 'YES' : 'no'}`);
+        console.log('\n' + assist.prompt + '\n');
+        return;
+      }
+
+      const { rotateViaBrowser, rotateAuto } = await import('../core/secrets-rotate.mjs');
+      const run = opts.command === 'rotate-auto' ? rotateAuto : rotateViaBrowser;
+      console.log(`\n  🔐 Rotating ${opts.key}…\n`);
+      const r = await run(brainDir, opts.key, {
+        headless: !!opts.headless,
+        exportEnv: opts.exportEnv !== false,
+        onStatus: (m) => console.log(`     · ${m}`),
+      });
+
+      if (!r.ok) {
+        console.error(`\n  ❌ ${r.error}`);
+        if (r.console_url) console.error(`     Console: ${r.console_url}`);
         process.exit(1);
       }
-      const assist = await getBrowserRotateAssist(brainDir, opts.key);
-      console.log(`\n  🌐 Supervised browser rotation — ${assist.key}\n`);
-      if (assist.console_url) console.log(`  Console: ${assist.console_url}`);
-      if (assist.docs_url) console.log(`  Docs:    ${assist.docs_url}`);
-      console.log(`  Overdue: ${assist.overdue ? 'YES' : 'no'}`);
-      console.log('\n' + assist.prompt + '\n');
+      console.log(`\n  ✅ Rotated ${r.key}` + (r.method ? ` via ${r.method}` : ''));
+      if (r.verified === true) console.log('     verified against provider API');
+      if (r.supervised) console.log('     (supervised — recipe not yet auto-verified)');
+      if (r.exports?.length) console.log(`     exported to ${r.exports.length} project(s)`);
+      if (r.revoke_hint) console.log(`\n  ⚠️  ${r.revoke_hint}`);
+      return;
+    }
+
+    if (opts.command === 'rotation-status') {
+      const { planAll, summarizePlans } = await import('../core/rotation-capability.mjs');
+      const all = await loadSecrets(brainDir);
+      const keys = Object.keys(all || {}).filter((k) => k !== 'meta');
+      const plans = planAll(keys, all.meta || {});
+      const sum = summarizePlans(plans);
+
+      if (opts.json) {
+        console.log(JSON.stringify({ summary: sum, plans }, null, 2));
+        return;
+      }
+
+      console.log(`\n  🔄 Rotation coverage — ${sum.automatable}/${sum.total} automatable\n`);
+      for (const [cls, n] of Object.entries(sum.byClass)) {
+        console.log(`     ${cls.padEnd(18)} ${n}`);
+      }
+      const manual = plans.filter((p) => !p.automatable && p.class !== 'non_secret');
+      if (manual.length) {
+        console.log(`\n  Needs a human (${manual.length}):`);
+        for (const p of manual) console.log(`     ${p.key.padEnd(34)} ${p.reason}`);
+      }
+      console.log('');
+      return;
+    }
+
+    if (opts.command === 'browser-logout') {
+      const { clearProfile } = await import('../core/browser-session.mjs');
+      const r = clearProfile(brainDir);
+      console.log(r.removed ? `  ✅ Cleared browser profile: ${r.path}` : `  (no profile at ${r.path})`);
       return;
     }