total-recall-brain 3.22.0 → 3.23.0

package/bin/total-recall.mjs

@@ -81,6 +81,7 @@ const COMMANDS = {
   relay:    'relay.mjs',
   uninstall: 'uninstall.mjs',
   map:      'map.mjs',
+  mesh:     'mesh.mjs',
   brain:    'brain.mjs',
   config:   'config.mjs',
   skill:    'skill.mjs',
@@ -109,6 +110,7 @@ function printHelp() {
     daemon <cmd>        Background worker (start|stop|status)
     skill <cmd>         Skills registry, deploy, multi-repo sync
     secret <cmd>        Secrets store + usage (not the vault)
+    mesh <cmd>          Control-server mesh: nodes, ACL policy, Tailscale SSH
     brain <cmd>         Register / ensure any project brain
     status / doctor     Health and diagnostics
 

package/frontend/src/api/headscale.ts

@@ -1,4 +1,4 @@
-import { get, post, del } from './_base';
+import { get, post, del, apiFetch } from './_base';
 
 export interface HeadscaleNode {
   id: string;
@@ -69,3 +69,70 @@ export async function fetchHeadscaleUsers(): Promise<HeadscaleUser[]> {
   const data = await get<UsersResponse>('/api/headscale/user');
   return data.users || [];
 }
+
+export interface HeadscalePolicy {
+  policy: string | null;
+  updatedAt: string | null;
+  configured: boolean;
+  /** True when the server is in database mode but no policy has been written yet. */
+  unset?: boolean;
+}
+
+/**
+ * Read the control server's ACL policy.
+ *
+ * A 409 means the server is in `policy.mode: file`, where the policy lives on
+ * the server's disk and the API cannot manage it. That is a fixable
+ * configuration state rather than a failure, so it is surfaced as a typed
+ * result the UI can explain instead of a thrown error.
+ */
+export async function fetchHeadscalePolicy(): Promise<HeadscalePolicy & { fileMode?: boolean }> {
+  try {
+    return await get<HeadscalePolicy>('/api/headscale/policy');
+  } catch (err) {
+    const status = (err as { status?: number })?.status;
+    if (status === 409) {
+      return { policy: null, updatedAt: null, configured: false, fileMode: true };
+    }
+    throw err;
+  }
+}
+
+export async function saveHeadscalePolicy(policy: string): Promise<HeadscalePolicy> {
+  const res = await apiFetch('/api/headscale/policy', {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ policy }),
+  });
+  if (!res.ok) {
+    const detail = await res.json().catch(() => ({}));
+    const error = new Error((detail as { error?: string }).error || `Policy save failed (${res.status})`);
+    (error as { status?: number }).status = res.status;
+    throw error;
+  }
+  return res.json();
+}
+
+/**
+ * The single-operator policy: every mesh member reaches every member, and may
+ * SSH between them. Mesh membership is the trust boundary, so anything admitted
+ * to the tailnet inherits this — narrow it before admitting a node you do not
+ * control.
+ */
+export function buildMeshSshPolicy(allowRoot = false): string {
+  return JSON.stringify(
+    {
+      acls: [{ action: 'accept', src: ['*'], dst: ['*:*'] }],
+      ssh: [
+        {
+          action: 'accept',
+          src: ['autogroup:member'],
+          dst: ['autogroup:self'],
+          users: allowRoot ? ['autogroup:nonroot', 'root'] : ['autogroup:nonroot'],
+        },
+      ],
+    },
+    null,
+    2,
+  );
+}

package/frontend/src/api/mesh.spec.ts

@@ -5,6 +5,9 @@ import {
   refreshElection,
   fetchElectionHistory,
   logElectionObservation,
+  fetchAccessProposals,
+  importAccessFromSshConfig,
+  setNodeAccess,
 } from './mesh';
 import * as base from './_base';
 
@@ -54,4 +57,28 @@ describe('mesh api', () => {
       note: 'observed',
     });
   });
+
+  it('fetchAccessProposals calls GET /api/mesh/access/proposals', async () => {
+    vi.mocked(base.get).mockResolvedValue({ proposals: [], missing_access: [], checked_at: 't' });
+    await fetchAccessProposals();
+    expect(base.get).toHaveBeenCalledWith('/api/mesh/access/proposals');
+  });
+
+  // Proposing and applying are separate calls on purpose: a wrong login written
+  // to the vault is worse than none, because it then looks authored.
+  it('importAccessFromSshConfig calls POST /api/mesh/access/import', async () => {
+    vi.mocked(base.post).mockResolvedValue({ success: true, attempted: 0, saved: 0, failed: 0, results: [] });
+    await importAccessFromSshConfig();
+    expect(base.post).toHaveBeenCalledWith('/api/mesh/access/import', {});
+  });
+
+  it('setNodeAccess posts the fields it was given, so an empty one can clear', async () => {
+    vi.mocked(base.post).mockResolvedValue({ success: true, path: 'p', access: {} });
+    await setNodeAccess({ node: 'node-b.mesh', ssh_user: 'operator', identity_file: '' });
+    expect(base.post).toHaveBeenCalledWith('/api/mesh/access', {
+      node: 'node-b.mesh',
+      ssh_user: 'operator',
+      identity_file: '',
+    });
+  });
 });

package/frontend/src/api/mesh.ts

@@ -8,6 +8,40 @@ export interface MeshInterfaceSummary {
   ipv6?: string[];
 }
 
+export type TailscaleVariant = 'daemon' | 'sandboxed' | 'missing' | 'unknown';
+export type MeshSshCapability = 'available' | 'unsupported' | 'unknown';
+export type AccessSource = 'probe' | 'ssh_config' | 'manual' | 'unknown';
+
+/**
+ * How to log in to a node — stored on the node entity, because the control
+ * server knows a machine exists but not which account you reach it as.
+ */
+export interface MeshNodeAccess {
+  ssh_user?: string | null;
+  ssh_port?: number | null;
+  ssh_host?: string | null;
+  identity_file?: string | null;
+  tailscale_variant?: TailscaleVariant;
+  mesh_ssh?: MeshSshCapability;
+  source?: AccessSource;
+  verified_at?: string | null;
+}
+
+/** Server-resolved connection details; address precedence is decided there. */
+export interface ResolvedNodeAccess {
+  user: string | null;
+  host: string | null;
+  port: number;
+  identity_file: string | null;
+  mesh_ssh: MeshSshCapability;
+  tailscale_variant: TailscaleVariant;
+  source: AccessSource;
+  verified_at: string | null;
+  /** False when the login account is unknown — the node will refuse you. */
+  complete: boolean;
+  target: string | null;
+}
+
 export interface MeshNode {
   hostname: string;
   ip: string | null;
@@ -31,6 +65,9 @@ export interface MeshNode {
   /** Device I/O profile for agent UI generation (screen/touch/mic/…). */
   io?: DeviceIoProfile | null;
   ui_hints?: string[];
+  /** Raw access record from the vault entity (absent until one is recorded). */
+  access?: MeshNodeAccess | null;
+  access_resolved?: ResolvedNodeAccess;
 }
 
 export interface DeviceIoProfile {
@@ -79,6 +116,54 @@ export async function fetchNodes(): Promise<MeshNode[]> {
   return data.nodes;
 }
 
+export interface AccessProposal {
+  hostname: string;
+  ip: string | null;
+  /** The `Host` block the login was taken from, so the guess is auditable. */
+  matched_host: string;
+  access: MeshNodeAccess;
+}
+
+/** Logins this host's ssh config could supply for nodes that have none. */
+export async function fetchAccessProposals(): Promise<{
+  proposals: AccessProposal[];
+  missing_access: string[];
+  checked_at: string;
+}> {
+  return get('/api/mesh/access/proposals');
+}
+
+/** Apply every ssh-config proposal to its node entity. */
+export async function importAccessFromSshConfig(): Promise<{
+  success: boolean;
+  attempted: number;
+  saved: number;
+  failed: number;
+  results: Array<{
+    hostname: string;
+    ssh_user: string | null;
+    matched_host: string;
+    written: boolean;
+    reason: string | null;
+  }>;
+}> {
+  return post('/api/mesh/access/import', {});
+}
+
+/**
+ * Record how to reach a node. Omit a field to leave it alone; send it empty to
+ * clear it.
+ */
+export async function setNodeAccess(body: {
+  node: string;
+  ssh_user?: string;
+  ssh_port?: string | number;
+  ssh_host?: string;
+  identity_file?: string;
+}): Promise<{ success: boolean; path: string; access: MeshNodeAccess }> {
+  return post('/api/mesh/access', body);
+}
+
 export async function refreshElection(): Promise<LeaderInfo> {
   const data = await post<{ leader: LeaderInfo | null }>('/api/mesh/election/refresh', {});
   if (!data.leader) throw new Error('No online mesh leader is available');

package/frontend/src/components/EmbeddingProviderPanel.tsx

@@ -29,17 +29,35 @@ export function EmbeddingProviderPanel() {
   const [error, setError] = useState<string | null>(null)
   const [busy, setBusy] = useState(false)
 
-  const load = useCallback(async () => {
+  /**
+   * `shouldApply` lets the mount effect drop a response that arrived after the
+   * panel went away, or after a newer request superseded it — a fetch started
+   * on mount has no other way to know it is no longer the current one.
+   */
+  const load = useCallback(async (shouldApply: () => boolean = () => true) => {
     try {
-      setStatus(await fetchEmbeddingProvider())
+      const next = await fetchEmbeddingProvider()
+      if (!shouldApply()) return
+      setStatus(next)
       setError(null)
     } catch (err) {
+      if (!shouldApply()) return
       setError(err instanceof Error ? err.message : String(err))
     }
   }, [])
 
   useEffect(() => {
-    void load()
+    let active = true
+    // Deferred a tick rather than called from the effect body: loading straight
+    // from an effect trips react-hooks/set-state-in-effect, and this is how the
+    // rest of the app loads on mount (see BrainSelector).
+    const timer = setTimeout(() => {
+      void load(() => active)
+    }, 0)
+    return () => {
+      active = false
+      clearTimeout(timer)
+    }
   }, [load])
 
   const onPin = useCallback(

package/frontend/src/pages/MeshPage.spec.tsx

@@ -8,6 +8,9 @@ import {
   refreshElection,
   fetchEnrollmentStatus,
   enrollThisNode,
+  fetchAccessProposals,
+  importAccessFromSshConfig,
+  setNodeAccess,
 } from '../api/mesh';
 import { fetchHeadscaleNodes, deleteHeadscaleNode, fetchPreAuthKeys, createPreAuthKey, fetchHeadscaleUsers } from '../api/headscale';
 
@@ -68,6 +71,15 @@ vi.mock('../api/mesh', () => ({
     checked_at: new Date().toISOString(),
   }),
   enrollThisNode: vi.fn(),
+  // Default to a host with no ssh config to import from, so the access banner
+  // stays out of the way of tests asserting on other things.
+  fetchAccessProposals: vi.fn().mockResolvedValue({
+    proposals: [],
+    missing_access: [],
+    checked_at: new Date().toISOString(),
+  }),
+  importAccessFromSshConfig: vi.fn(),
+  setNodeAccess: vi.fn(),
 }));
 
 vi.mock('../api/headscale', () => ({
@@ -76,6 +88,11 @@ vi.mock('../api/headscale', () => ({
   fetchPreAuthKeys: vi.fn(),
   createPreAuthKey: vi.fn(),
   fetchHeadscaleUsers: vi.fn(),
+  // Mesh SSH policy: default to "already configured" so the banner stays out of
+  // the way of tests that are asserting on other things.
+  fetchHeadscalePolicy: vi.fn().mockResolvedValue({ policy: '{}', configured: true }),
+  saveHeadscalePolicy: vi.fn().mockResolvedValue({ policy: '{}', configured: true }),
+  buildMeshSshPolicy: vi.fn(() => '{}'),
 }));
 
 describe('MeshPage', () => {
@@ -283,4 +300,151 @@ describe('MeshPage', () => {
       expect(screen.queryByRole('button', { name: /enroll this node/i })).not.toBeInTheDocument();
     });
   });
+
+  // A node reached with the wrong login refuses the connection in exactly the
+  // way an unreachable node does. The page has to say so, or the operator
+  // debugs the network instead of the one missing fact.
+  describe('node access', () => {
+    const reachable = {
+      hostname: 'node-a.mesh',
+      ip: '100.64.0.1',
+      online: true,
+      self: false,
+      os: 'linux',
+      access: { ssh_user: 'operator', source: 'ssh_config' as const },
+      access_resolved: {
+        user: 'operator',
+        host: '100.64.0.1',
+        port: 22,
+        identity_file: null,
+        mesh_ssh: 'unknown' as const,
+        tailscale_variant: 'unknown' as const,
+        source: 'ssh_config' as const,
+        verified_at: null,
+        complete: true,
+        target: 'operator@100.64.0.1',
+      },
+    };
+    const noLogin = {
+      hostname: 'node-b.mesh',
+      ip: '100.64.0.2',
+      online: true,
+      self: false,
+      os: 'linux',
+      access_resolved: { ...reachable.access_resolved, user: null, host: '100.64.0.2', source: 'unknown' as const, complete: false, target: null },
+    };
+
+    beforeEach(() => {
+      vi.mocked(fetchLeader).mockResolvedValue({ hostname: 'node-a.mesh', ip: '100.64.0.1' });
+    });
+
+    it('shows the resolved login target for a node that has one', async () => {
+      vi.mocked(fetchMeshNodes).mockResolvedValue([reachable]);
+      render(<MeshPage />);
+      await waitFor(() => expect(screen.getAllByText('operator@100.64.0.1').length).toBeGreaterThan(0));
+      expect(screen.queryByTestId('mesh-access-banner')).not.toBeInTheDocument();
+    });
+
+    it('warns about nodes with no recorded login account', async () => {
+      vi.mocked(fetchMeshNodes).mockResolvedValue([reachable, noLogin]);
+      render(<MeshPage />);
+      const banner = await screen.findByTestId('mesh-access-banner');
+      expect(banner).toHaveTextContent('1 node has no recorded login account');
+      expect(banner).toHaveTextContent('node-b.mesh');
+      // Nothing to import from: the button must not appear and imply otherwise.
+      expect(screen.queryByRole('button', { name: /import from ssh config/i })).not.toBeInTheDocument();
+    });
+
+    it('offers the ssh config as a source and imports it on click', async () => {
+      vi.mocked(fetchMeshNodes).mockResolvedValue([noLogin]);
+      vi.mocked(fetchAccessProposals).mockResolvedValue({
+        proposals: [
+          { hostname: 'node-b.mesh', ip: '100.64.0.2', matched_host: 'node-b', access: { ssh_user: 'operator', source: 'ssh_config' } },
+        ],
+        missing_access: ['node-b.mesh'],
+        checked_at: new Date().toISOString(),
+      });
+      vi.mocked(importAccessFromSshConfig).mockResolvedValue({
+        success: true, attempted: 1, saved: 1, failed: 0,
+        results: [{ hostname: 'node-b.mesh', ssh_user: 'operator', matched_host: 'node-b', written: true, reason: null }],
+      });
+
+      render(<MeshPage />);
+      // The proposal is shown before it is applied — a wrong login written to
+      // the vault is worse than none, because it looks authored.
+      const proposals = await screen.findByTestId('access-proposals');
+      expect(proposals).toHaveTextContent('from Host node-b');
+
+      await userEvent.click(screen.getByRole('button', { name: /import from ssh config/i }));
+      await waitFor(() => expect(importAccessFromSshConfig).toHaveBeenCalled());
+      expect(await screen.findByText(/Recorded a login account for 1 node/)).toBeInTheDocument();
+    });
+
+    it('reports a partial import honestly rather than as a success', async () => {
+      vi.mocked(fetchMeshNodes).mockResolvedValue([noLogin]);
+      vi.mocked(fetchAccessProposals).mockResolvedValue({
+        proposals: [
+          { hostname: 'node-b.mesh', ip: '100.64.0.2', matched_host: 'node-b', access: { ssh_user: 'operator', source: 'ssh_config' } },
+        ],
+        missing_access: ['node-b.mesh'],
+        checked_at: new Date().toISOString(),
+      });
+      vi.mocked(importAccessFromSshConfig).mockResolvedValue({
+        success: false, attempted: 2, saved: 1, failed: 1,
+        results: [],
+      });
+
+      render(<MeshPage />);
+      await userEvent.click(await screen.findByRole('button', { name: /import from ssh config/i }));
+      expect(await screen.findByText(/Recorded 1 of 2; 1 could not be saved/)).toBeInTheDocument();
+    });
+
+    it('records a login typed for the selected node', async () => {
+      vi.mocked(fetchMeshNodes).mockResolvedValue([noLogin]);
+      vi.mocked(setNodeAccess).mockResolvedValue({
+        success: true,
+        path: 'system/mesh-nodes/node-b.md',
+        access: { ssh_user: 'operator' },
+      });
+
+      render(<MeshPage />);
+      await userEvent.click(await screen.findByTestId('node-row-node-b.mesh'));
+
+      await userEvent.type(screen.getByLabelText(/login account/i), 'operator');
+      await userEvent.type(screen.getByLabelText(/^port$/i), '2222');
+      await userEvent.click(screen.getByRole('button', { name: /save access/i }));
+
+      await waitFor(() =>
+        expect(setNodeAccess).toHaveBeenCalledWith({
+          node: 'node-b.mesh',
+          ssh_user: 'operator',
+          ssh_port: '2222',
+          identity_file: '',
+          ssh_host: '',
+        }),
+      );
+      expect(await screen.findByTestId('access-save-msg')).toHaveTextContent('Saved to the node entity');
+    });
+
+    // Polling replaces the node list on every cycle; a captured node object
+    // would keep the pane on the state at the moment of the click — including
+    // straight after an edit, where it would show the value it just replaced.
+    it('keeps the detail pane on live data after a reload', async () => {
+      vi.mocked(refreshElection).mockResolvedValue({ hostname: 'node-a.mesh', ip: '100.64.0.1' });
+      vi.mocked(fetchMeshNodes)
+        .mockResolvedValueOnce([noLogin])
+        .mockResolvedValue([
+          { ...noLogin, access: { ssh_user: 'operator' }, access_resolved: reachable.access_resolved },
+        ]);
+
+      render(<MeshPage />);
+      await userEvent.click(await screen.findByTestId('node-row-node-b.mesh'));
+      expect(await screen.findByTestId('node-access-target')).toHaveTextContent('no login recorded');
+
+      await userEvent.click(screen.getByText('Refresh Election'));
+      await waitFor(() =>
+        expect(screen.getByTestId('node-access-target')).toHaveTextContent('operator@100.64.0.1'),
+      );
+    });
+  });
 });