total-recall-brain 3.22.0 → 3.23.1

package/frontend/src/pages/MeshPage.tsx

@@ -12,8 +12,11 @@ import {
   logElectionObservation,
   fetchEnrollmentStatus,
   enrollThisNode,
+  fetchAccessProposals,
+  importAccessFromSshConfig,
+  setNodeAccess,
 } from '../api/mesh';
-import { fetchHeadscaleNodes, fetchPreAuthKeys, fetchHeadscaleUsers, createPreAuthKey, deleteHeadscaleNode } from '../api/headscale';
+import { fetchHeadscaleNodes, fetchPreAuthKeys, fetchHeadscaleUsers, createPreAuthKey, deleteHeadscaleNode, fetchHeadscalePolicy, saveHeadscalePolicy, buildMeshSshPolicy } from '../api/headscale';
 import type {
   MeshNode,
   LeaderInfo,
@@ -21,6 +24,7 @@ import type {
   MeshInterfaceSummary,
   DeviceIoProfile,
   EnrollmentStatus,
+  AccessProposal,
 } from '../api/mesh';
 import type { HeadscaleNode, PreAuthKey as HeadscalePreAuthKey, HeadscaleUser } from '../api/headscale';
 import { MeshTopology } from '../components/MeshTopology';
@@ -39,13 +43,43 @@ interface ElectionLogEntry {
   note: string;
 }
 
+/** Editable access fields, as strings so an empty box can clear a value. */
+interface AccessDraft {
+  ssh_user: string;
+  ssh_port: string;
+  identity_file: string;
+  ssh_host: string;
+}
+
+const EMPTY_ACCESS_DRAFT: AccessDraft = {
+  ssh_user: '',
+  ssh_port: '',
+  identity_file: '',
+  ssh_host: '',
+};
+
+function accessDraftFromNode(node: MeshNode | null): AccessDraft {
+  const access = node?.access;
+  return {
+    ssh_user: access?.ssh_user || '',
+    ssh_port: access?.ssh_port ? String(access.ssh_port) : '',
+    identity_file: access?.identity_file || '',
+    ssh_host: access?.ssh_host || '',
+  };
+}
+
 export function MeshPage() {
   const [activeTab, setActiveTab] = useState<'mesh'|'headscale-nodes'|'preauthkeys'|'users'>('mesh');
 
   // Mesh State
   const [meshNodes, setMeshNodes] = useState<MeshNode[]>([]);
   const [leader, setLeader] = useState<LeaderInfo | null>(null);
-  const [selectedNode, setSelectedNode] = useState<MeshNode | null>(null);
+  // Selection is held as a hostname, not a node object: polling replaces the
+  // node list every few seconds, and a captured object goes stale the moment it
+  // does — the detail pane would keep showing the state at the time of click,
+  // including right after an edit was saved.
+  const [selectedHostname, setSelectedHostname] = useState<string | null>(null);
+  const selectedNode = meshNodes.find((node) => node.hostname === selectedHostname) || null;
   const [latencyMs, setLatencyMs] = useState<Record<string, number | null>>({});
   /** Rolling RTT samples per hostname for sparklines (from this node). */
   const [latencyHistory, setLatencyHistory] = useState<Record<string, number[]>>({});
@@ -58,8 +92,21 @@ export function MeshPage() {
   const [enrollment, setEnrollment] = useState<EnrollmentStatus | null>(null);
   const [enrollBusy, setEnrollBusy] = useState(false);
   const [enrollMsg, setEnrollMsg] = useState<string | null>(null);
+  // Mesh SSH is a property of the control server, not of this node, so it is
+  // tracked separately from enrollment.
+  const [sshPolicy, setSshPolicy] = useState<{ configured: boolean; fileMode?: boolean } | null>(null);
+  const [sshBusy, setSshBusy] = useState(false);
+  const [sshMsg, setSshMsg] = useState<string | null>(null);
   const [lanRegisterBusy, setLanRegisterBusy] = useState(false);
   const [lanRegisterMsg, setLanRegisterMsg] = useState<string | null>(null);
+  // A node whose login account is unknown refuses every connection in exactly
+  // the way an unreachable node does, so the gap is surfaced, not just stored.
+  const [accessProposals, setAccessProposals] = useState<AccessProposal[]>([]);
+  const [accessBusy, setAccessBusy] = useState(false);
+  const [accessMsg, setAccessMsg] = useState<string | null>(null);
+  const [accessDraft, setAccessDraft] = useState<AccessDraft>(EMPTY_ACCESS_DRAFT);
+  const [accessSaveBusy, setAccessSaveBusy] = useState(false);
+  const [accessSaveMsg, setAccessSaveMsg] = useState<string | null>(null);
   const prevLeaderRef = useRef<string | null>(null);
   const pollMsRef = useRef(POLL_BASE_MS);
   const electionHistoryLoadedRef = useRef(false);
@@ -78,6 +125,8 @@ export function MeshPage() {
   const [newKeyEphemeral, setNewKeyEphemeral] = useState(false);
   const [newKeyExpiration, setNewKeyExpiration] = useState('2099-12-31T23:59:59Z');
 
+  const nodesMissingAccess = meshNodes.filter((node) => node.access_resolved?.complete === false);
+
   const recordLeaderChange = useCallback((l: LeaderInfo | null, note: string) => {
     if (!l) return;
     const key = `${l.hostname}|${l.ip}`;
@@ -94,6 +143,15 @@ export function MeshPage() {
     }
   }, []);
 
+  // Selecting is the only thing that may overwrite the edit form. Doing it in a
+  // poll-driven effect instead would wipe whatever the user was typing every
+  // few seconds.
+  const selectNode = useCallback((node: MeshNode) => {
+    setSelectedHostname(node.hostname);
+    setAccessDraft(accessDraftFromNode(node));
+    setAccessSaveMsg(null);
+  }, []);
+
   const pushLatencySamples = useCallback((sample: Record<string, number | null>) => {
     setLatencyMs(sample);
     setLatencyHistory((prev) => {
@@ -158,10 +216,23 @@ export function MeshPage() {
             setUiHints(ioRes.ui_hints || ioRes.io?.ui_hints || []);
           })
           .catch(() => { /* optional */ });
+        // Neither of these should ever take the page down — both are optional
+        // capabilities that may simply not be configured yet.
+        void (async () => {
+          try {
+            const p = await fetchHeadscalePolicy();
+            setSshPolicy({ configured: p.configured, fileMode: p.fileMode });
+          } catch {
+            setSshPolicy(null);
+          }
+        })();
         // Enrollment state drives the join banner; never fail the page on it.
         fetchEnrollmentStatus()
           .then(setEnrollment)
           .catch(() => { /* optional */ });
+        fetchAccessProposals()
+          .then((res) => setAccessProposals(res.proposals || []))
+          .catch(() => { /* no ssh config on this host is normal */ });
         pollMsRef.current = POLL_BASE_MS;
       } else if (activeTab === 'headscale-nodes') {
         const nodes = await fetchHeadscaleNodes();
@@ -226,6 +297,55 @@ export function MeshPage() {
     }
   }
 
+  async function handleImportAccess() {
+    setAccessBusy(true);
+    setAccessMsg(null);
+    try {
+      const res = await importAccessFromSshConfig();
+      setAccessMsg(
+        res.failed
+          ? `Recorded ${res.saved} of ${res.attempted}; ${res.failed} could not be saved.`
+          : `Recorded a login account for ${res.saved} node(s).`,
+      );
+      await loadData();
+    } catch (err) {
+      setAccessMsg(err instanceof Error ? err.message : 'Could not import from ssh config');
+    } finally {
+      setAccessBusy(false);
+    }
+  }
+
+  async function handleSaveAccess(e: React.FormEvent) {
+    e.preventDefault();
+    if (!selectedNode) return;
+    setAccessSaveBusy(true);
+    setAccessSaveMsg(null);
+    try {
+      await setNodeAccess({ node: selectedNode.hostname, ...accessDraft });
+      setAccessSaveMsg('Saved to the node entity.');
+      await loadData();
+    } catch (err) {
+      setAccessSaveMsg(err instanceof Error ? err.message : 'Could not save access');
+    } finally {
+      setAccessSaveBusy(false);
+    }
+  }
+
+  async function handleEnableMeshSsh() {
+    setSshBusy(true);
+    setSshMsg(null);
+    try {
+      await saveHeadscalePolicy(buildMeshSshPolicy());
+      const next = await fetchHeadscalePolicy();
+      setSshPolicy({ configured: next.configured, fileMode: next.fileMode });
+      setSshMsg('Mesh SSH enabled. Nodes pick this up automatically.');
+    } catch (err) {
+      setSshMsg(err instanceof Error ? err.message : 'Could not enable mesh SSH');
+    } finally {
+      setSshBusy(false);
+    }
+  }
+
   async function handleEnroll() {
     setEnrollBusy(true);
     setEnrollMsg(null);
@@ -360,6 +480,81 @@ export function MeshPage() {
 
       {activeTab === 'mesh' && (
         <div style={{ display: 'flex', flexDirection: 'column', gap: 24 }}>
+          {/* Without a policy the control server routes packets but authorises
+              nothing, so every machine falls back to its own SSH keys. */}
+          {sshPolicy && !sshPolicy.configured && (
+            <div className="alert alert-warning" data-testid="mesh-ssh-banner">
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 16, flexWrap: 'wrap' }}>
+                <div>
+                  <strong>Mesh SSH is off</strong>
+                  <div style={{ fontSize: 13, marginTop: 4 }}>
+                    {sshPolicy.fileMode
+                      ? 'The control server stores its policy in a file, so it cannot be managed here. Set policy.mode: database in the control server config to enable this.'
+                      : 'Nodes can reach each other, but each still needs its own SSH keys. Enabling mesh SSH lets the control server authorise connections instead.'}
+                  </div>
+                  {sshMsg && (
+                    <div style={{ fontSize: 13, marginTop: 8, color: 'var(--accent-hover)' }}>{sshMsg}</div>
+                  )}
+                </div>
+                {!sshPolicy.fileMode && (
+                  <button type="button" className="btn btn-primary" onClick={handleEnableMeshSsh} disabled={sshBusy}>
+                    {sshBusy ? 'Enabling…' : 'Enable mesh SSH'}
+                  </button>
+                )}
+              </div>
+            </div>
+          )}
+          {sshPolicy?.configured && sshMsg && (
+            <div className="alert alert-success" data-testid="mesh-ssh-ok">{sshMsg}</div>
+          )}
+          {/* The control server can say a node is up but not which account you
+              log in as, and connecting as the wrong one is refused exactly like
+              an unreachable host — so the gap is stated rather than discovered. */}
+          {nodesMissingAccess.length > 0 && (
+            <div className="alert alert-warning" data-testid="mesh-access-banner">
+              <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'flex-start', gap: 16, flexWrap: 'wrap' }}>
+                <div>
+                  <strong>
+                    {nodesMissingAccess.length === 1
+                      ? '1 node has no recorded login account'
+                      : `${nodesMissingAccess.length} nodes have no recorded login account`}
+                  </strong>
+                  <div style={{ fontSize: 13, marginTop: 4 }}>
+                    Any node that tries to reach one of these is refused, in exactly the way an unreachable
+                    machine refuses. {accessProposals.length > 0
+                      ? `This host's ssh config can supply ${accessProposals.length} of them.`
+                      : 'Select a node below to record one.'}
+                  </div>
+                  <div style={{ fontSize: 12, marginTop: 6, color: 'var(--text-secondary)' }}>
+                    {nodesMissingAccess.map((node) => node.hostname).join(', ')}
+                  </div>
+                  {accessProposals.length > 0 && (
+                    <ul style={{ margin: '8px 0 0', paddingLeft: 18, fontSize: 12 }} data-testid="access-proposals">
+                      {accessProposals.map((proposal) => (
+                        <li key={proposal.hostname}>
+                          <strong>{proposal.hostname}</strong> → {proposal.access.ssh_user}{' '}
+                          <span style={{ color: 'var(--text-secondary)' }}>(from Host {proposal.matched_host})</span>
+                        </li>
+                      ))}
+                    </ul>
+                  )}
+                  {accessMsg && (
+                    <div style={{ fontSize: 13, marginTop: 8, color: 'var(--accent-hover)' }}>{accessMsg}</div>
+                  )}
+                </div>
+                {accessProposals.length > 0 && (
+                  <button
+                    type="button"
+                    className="btn btn-primary"
+                    onClick={handleImportAccess}
+                    disabled={accessBusy}
+                  >
+                    {accessBusy ? 'Importing…' : 'Import from ssh config'}
+                  </button>
+                )}
+              </div>
+            </div>
+          )}
           {/* Which mesh node actually serves embeddings, and which model it uses. */}
           <div className="card">
             <EmbeddingProviderPanel />
@@ -371,8 +566,8 @@ export function MeshPage() {
                 nodes={meshNodes}
                 leader={leader}
                 latencyMs={latencyMs}
-                selectedHostname={selectedNode?.hostname}
-                onSelectNode={setSelectedNode}
+                selectedHostname={selectedHostname}
+                onSelectNode={selectNode}
               />
             </div>
             <div className="card">
@@ -455,10 +650,92 @@ export function MeshPage() {
                   </dd>
                   <dt style={{ color: 'var(--text-secondary)' }}>Scope</dt>
                   <dd style={{ margin: 0 }}>{selectedNode.self ? 'This node' : 'Peer'}</dd>
+                  <dt style={{ color: 'var(--text-secondary)' }}>Login</dt>
+                  <dd style={{ margin: 0, fontFamily: 'monospace', fontSize: 12 }} data-testid="node-access-target">
+                    {selectedNode.access_resolved?.complete
+                      ? selectedNode.access_resolved.target
+                      : <span className="badge badge-offline">no login recorded</span>}
+                  </dd>
+                  <dt style={{ color: 'var(--text-secondary)' }}>Access source</dt>
+                  <dd style={{ margin: 0 }}>
+                    {selectedNode.access?.source && selectedNode.access.source !== 'unknown'
+                      ? selectedNode.access.source.replace('_', ' ')
+                      : '—'}
+                  </dd>
+                  {/* Only the open-source build can serve control-server-authorised
+                      SSH; the sandboxed GUI builds never start the server, so a
+                      node running one still needs its own keys. */}
+                  <dt style={{ color: 'var(--text-secondary)' }}>Mesh SSH</dt>
+                  <dd style={{ margin: 0 }} data-testid="node-mesh-ssh">
+                    {selectedNode.access_resolved?.mesh_ssh === 'available'
+                      ? 'authorised by the control server'
+                      : selectedNode.access_resolved?.mesh_ssh === 'unsupported'
+                        ? `not served by this build (${selectedNode.access_resolved.tailscale_variant}) — needs its own keys`
+                        : 'unknown'}
+                  </dd>
                 </dl>
               ) : (
                 <p style={{ color: 'var(--text-secondary)' }}>Click a node in the topology to inspect it.</p>
               )}
+
+              {selectedNode && (
+                <form onSubmit={handleSaveAccess} style={{ marginTop: 16, borderTop: '1px solid var(--border)', paddingTop: 12 }}>
+                  <h4 style={{ margin: '0 0 4px' }}>Access</h4>
+                  <p style={{ fontSize: 12, color: 'var(--text-secondary)', margin: '0 0 12px' }}>
+                    Stored on the node entity, so every machine and agent resolves it the same way.
+                    Leave a box empty to clear it. The address comes from the mesh unless you override it.
+                  </p>
+                  <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 8 }}>
+                    <label style={{ fontSize: 12 }}>
+                      Login account
+                      <input
+                        className="input"
+                        value={accessDraft.ssh_user}
+                        placeholder="e.g. the account you ssh as"
+                        onChange={(e) => setAccessDraft({ ...accessDraft, ssh_user: e.target.value })}
+                      />
+                    </label>
+                    <label style={{ fontSize: 12 }}>
+                      Port
+                      <input
+                        className="input"
+                        value={accessDraft.ssh_port}
+                        placeholder="22"
+                        inputMode="numeric"
+                        onChange={(e) => setAccessDraft({ ...accessDraft, ssh_port: e.target.value })}
+                      />
+                    </label>
+                    <label style={{ fontSize: 12 }}>
+                      Key file
+                      <input
+                        className="input"
+                        value={accessDraft.identity_file}
+                        placeholder="~/.ssh/id_ed25519"
+                        onChange={(e) => setAccessDraft({ ...accessDraft, identity_file: e.target.value })}
+                      />
+                    </label>
+                    <label style={{ fontSize: 12 }}>
+                      Address override
+                      <input
+                        className="input"
+                        value={accessDraft.ssh_host}
+                        placeholder={selectedNode.ip || 'mesh address'}
+                        onChange={(e) => setAccessDraft({ ...accessDraft, ssh_host: e.target.value })}
+                      />
+                    </label>
+                  </div>
+                  <div style={{ display: 'flex', alignItems: 'center', gap: 12, marginTop: 12 }}>
+                    <button type="submit" className="btn btn-primary btn-sm" disabled={accessSaveBusy}>
+                      {accessSaveBusy ? 'Saving…' : 'Save access'}
+                    </button>
+                    {accessSaveMsg && (
+                      <span style={{ fontSize: 12, color: 'var(--accent-hover)' }} data-testid="access-save-msg">
+                        {accessSaveMsg}
+                      </span>
+                    )}
+                  </div>
+                </form>
+              )}
             </div>
           </div>
 
@@ -608,6 +885,7 @@ export function MeshPage() {
                   <th>Role</th>
                   <th>Status</th>
                   <th>Latency</th>
+                  <th>Login</th>
                   <th>Operating System</th>
                   <th>Node</th>
                 </tr>
@@ -618,8 +896,9 @@ export function MeshPage() {
                   return (
                     <tr
                       key={node.hostname}
+                      data-testid={`node-row-${node.hostname}`}
                       className={isNodeLeader ? 'is-leader' : ''}
-                      onClick={() => setSelectedNode(node)}
+                      onClick={() => selectNode(node)}
                       style={{ cursor: 'pointer' }}
                     >
                       <td style={{ fontWeight: 500, display: 'flex', alignItems: 'center', gap: '8px' }}>
@@ -640,6 +919,15 @@ export function MeshPage() {
                       <td style={{ color: 'var(--text-secondary)' }}>
                         {node.self ? '—' : latencyMs[node.hostname] != null ? `${latencyMs[node.hostname]} ms` : '—'}
                       </td>
+                      <td style={{ fontFamily: 'monospace', fontSize: 12 }}>
+                        {node.access_resolved?.complete ? (
+                          node.access_resolved.target
+                        ) : (
+                          <span className="badge badge-offline" title="Connecting will fail as though the node were unreachable">
+                            no login
+                          </span>
+                        )}
+                      </td>
                       <td style={{ color: 'var(--text-secondary)' }}>{node.os || 'Unknown'}</td>
                       <td style={{ color: 'var(--text-secondary)', fontSize: '13px' }}>{node.self ? 'This node' : 'Peer'}</td>
                     </tr>
@@ -647,7 +935,7 @@ export function MeshPage() {
                 })}
                 {meshNodes.length === 0 && !loading && (
                   <tr>
-                    <td colSpan={7} style={{ textAlign: 'center', color: 'var(--text-secondary)', padding: '32px' }}>
+                    <td colSpan={8} style={{ textAlign: 'center', color: 'var(--text-secondary)', padding: '32px' }}>
                       No mesh nodes found
                     </td>
                   </tr>

package/frontend/src/pages/NetworkPage.spec.tsx

@@ -34,12 +34,27 @@ describe('NetworkPage', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     vi.mocked(getNetworkStats).mockResolvedValue({
-      stats: { active: 2, queueLength: 0, errors: 0, timeouts: 0 } as any
-    } as any);
+      stats: {
+        total: 2,
+        blocked: 0,
+        queueLength: 0,
+        active: 2,
+        completed: 0,
+        errors: 0,
+        timeouts: 0,
+        peakActive: 2,
+        peakQueue: 0,
+        domains: {},
+      },
+      audit_count: 0,
+    });
     vi.mocked(getNetworkPolicy).mockResolvedValue({
+      id: 'test-policy',
       blocked_domains: ['evil.com'],
-      max_global_concurrency: 20
-    } as any);
+      max_global_concurrency: 20,
+      max_per_domain_concurrency: 4,
+      default_timeout_ms: 10000,
+    });
     vi.mocked(getAuditLog).mockResolvedValue({
       audit: []
     });

package/frontend/src/pages/OnboardingPage.spec.tsx

@@ -44,8 +44,20 @@ describe('OnboardingPage', () => {
   it('handles scan import mode', async () => {
     vi.mocked(api.listMemory).mockResolvedValue([] as never);
     vi.mocked(api.scanEnvSecrets).mockResolvedValue({
-      candidates: [{ key: 'TEST_KEY', provider: 'test', masked: 'sk-***', source_label: '.env' } as any]
-    } as any);
+      candidates: [
+        {
+          key: 'TEST_KEY',
+          provider: 'test',
+          masked: 'sk-***',
+          source_label: '.env',
+          source: '.env',
+          length: 12,
+          known: true,
+        },
+      ],
+      count: 1,
+      sources_scanned: ['.env'],
+    });
 
     renderWithRouter(<OnboardingPage />);
 

package/frontend/src/pages/SkillsPage.spec.tsx

@@ -9,7 +9,7 @@ describe('SkillsPage', () => {
   beforeEach(() => {
     vi.resetAllMocks();
     vi.mocked(api.listSkills).mockResolvedValue([
-      { name: 'test-skill', description: 'A test skill', repo: 'test' } as any
+      { id: 'test-skill', name: 'test-skill', repo: 'test', source: 'A test skill' },
     ]);
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.22.0",
+  "version": "3.23.1",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [
@@ -39,6 +39,7 @@
     "dev": "node src/server/index.mjs",
     "start": "node src/server/index.mjs",
     "test": "vitest run",
+    "routes:manifest": "node scripts/generate-route-manifest.mjs",
     "clean": "rm -rf scratch/* .remember/* *.log"
   },
   "repository": {

package/scaffold/.agent/skills/total-recall/references/api-reference.md

@@ -43,7 +43,7 @@ Returns the status of the vault, embeddings index, and LLM reachability.
       "vfs": {
         "exists": true,
         "skill_exists": true,
-        "path": "/Users/greg/.agent"
+        "path": "~/.agent"
       }
     }
     ```

package/scaffold/.agent/skills/total-recall/references/cli-reference.md

@@ -23,7 +23,8 @@ Rebuild the derived indexes and compile memory surfaces.
 ### 1.3 `connect`
 Configure an IDE or external client to bind to the Total Recall local server.
 *   **Syntax**: `npx total-recall connect <client> [options]`
-*   **Supported Clients**: `cursor`, `claude-code`, `antigravity`, `gemini`, `vscode`, `windsurf`, `aider`, `ultrachat`, `obsidian`.
+*   **Supported Clients**: `vscode`, `pi`, `hermes`, `openclaw`, `cursor`, `cline`, `claude-code`, `codex`, `antigravity`, `gemini`, `aider`, `http-api`, `obsidian`, `generic`.
+    Any host application not listed here connects through the generic `http-api` client.
 *   **Options**:
     *   `--brain <url>`: Override default brain server URL.
     *   `--token <PAT>`: Inject bearer PAT credentials for authenticating requests.