total-recall-brain 3.23.2 → 3.24.0

package/src/cli/backfill.mjs

@@ -0,0 +1,176 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import { analyzeVault, backfillVault } from '../core/vault-backfill.mjs';
+import { brainDir, resolveBrainLayer } from '../core/config.mjs';
+
+function usage() {
+  console.log(`
+  total-recall backfill [options]
+
+  Bring historical vault nodes up to the current SSSS contract.
+
+  Most nodes in a long-lived vault predate the schema they are validated
+  against. This reports exactly which fields the contract would add, and only
+  writes when you ask it to.
+
+  Options:
+    --apply           Repair the vault (default is a dry run)
+    --vault <path>    Vault to inspect (default: the active brain's vault)
+    --all             Every registered project vault plus the global vault
+    --limit <n>       Repair at most n nodes (use to rehearse on a small batch)
+    --no-snapshot     Skip the pre-apply snapshot (not recommended)
+    --verbose         List each node instead of only the summary
+
+  Examples:
+    total-recall backfill
+    total-recall backfill --apply --limit 25
+    total-recall backfill --all --apply
+`);
+}
+
+function summarize(report, verbose) {
+  const pct = report.total ? ((report.valid / report.total) * 100).toFixed(1) : '100.0';
+  console.log(`\n  ${report.vaultDir.replace(process.env.HOME || '~', '~')}`);
+  console.log(`    ${report.valid}/${report.total} valid on disk (${pct}%)  ·  ${report.invalid} need repair`);
+  if (report.invalid) {
+    console.log(`    ${report.repairable} of those this run can fix; ${report.unfixable.length} it cannot.`);
+  }
+
+  if (report.unreadable.length) {
+    console.log(`    ${report.unreadable.length} unreadable (left untouched):`);
+    for (const u of report.unreadable.slice(0, 5)) console.log(`      ${u}`);
+  }
+
+  const fields = Object.entries(report.fieldCounts).sort((a, b) => b[1] - a[1]);
+  if (fields.length) {
+    console.log('    Fields the contract would add:');
+    for (const [field, count] of fields.slice(0, 12)) {
+      console.log(`      ${String(count).padStart(6)}  ${field}`);
+    }
+  }
+
+  const shapes = Object.entries(report.shapeRepairs || {}).sort((a, b) => b[1] - a[1]);
+  if (shapes.length) {
+    console.log('    Wrong-typed fields it would repair in place:');
+    for (const [field, count] of shapes) {
+      console.log(`      ${String(count).padStart(6)}  ${field}`);
+    }
+  }
+
+  if (report.unfixable?.length) {
+    console.log(`    Cannot be expressed by the contract (left untouched):`);
+    for (const u of report.unfixable.slice(0, 8)) {
+      console.log(`      ${u.file.replace(process.env.HOME || '~', '~')}`);
+      console.log(`        ${u.errors.join('; ').slice(0, 150)}`);
+    }
+  }
+
+  const errors = Object.entries(report.errorCounts).sort((a, b) => b[1] - a[1]);
+  if (errors.length) {
+    console.log('    Why they fail today:');
+    for (const [err, count] of errors.slice(0, 8)) {
+      console.log(`      ${String(count).padStart(6)}  ${err}`);
+    }
+  }
+
+  if (verbose) {
+    for (const node of report.nodes.slice(0, 200)) {
+      console.log(`      ${node.file}`);
+      console.log(`        + ${Object.keys(node.added).join(', ') || '(none)'}`);
+      const changed = Object.keys(node.changed);
+      if (changed.length) console.log(`        ~ ${changed.join(', ')}`);
+    }
+  }
+}
+
+function collectVaults(args) {
+  const explicit = args.indexOf('--vault');
+  if (explicit !== -1 && args[explicit + 1]) {
+    return [path.resolve(args[explicit + 1])];
+  }
+
+  if (!args.includes('--all')) {
+    return [path.join(resolveBrainLayer().brainDir, 'memory-vault')];
+  }
+
+  const vaults = [path.join(brainDir, 'memory-vault')];
+  const registryPath = path.join(brainDir, 'config', 'project-registry.json');
+  if (fs.existsSync(registryPath)) {
+    try {
+      const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+      const entries = Array.isArray(registry) ? registry : (registry.projects || []);
+      for (const entry of entries) {
+        const root = typeof entry === 'string' ? entry : (entry.path || entry.root);
+        if (!root) continue;
+        const candidate = path.join(root, '.agent', 'skills', 'total-recall', 'memory-vault');
+        if (fs.existsSync(candidate) && !vaults.includes(candidate)) vaults.push(candidate);
+      }
+    } catch (err) {
+      console.error(`  ! Could not read project registry: ${err.message}`);
+    }
+  }
+  return vaults;
+}
+
+export default async function backfill(args = []) {
+  if (args.includes('--help') || args.includes('-h')) return usage();
+
+  const apply = args.includes('--apply');
+  const verbose = args.includes('--verbose');
+  const snapshot = !args.includes('--no-snapshot');
+  const limitIndex = args.indexOf('--limit');
+  const limit = limitIndex !== -1 && args[limitIndex + 1]
+    ? parseInt(args[limitIndex + 1], 10)
+    : Infinity;
+
+  const vaults = collectVaults(args);
+  console.log(apply
+    ? `\n  Backfilling ${vaults.length} vault(s) through the SSSS Core Contract.`
+    : `\n  Dry run over ${vaults.length} vault(s) — nothing will be written.`);
+
+  let totalNodes = 0;
+  let totalValid = 0;
+  let totalRepaired = 0;
+  const allFailed = [];
+
+  for (const vaultDir of vaults) {
+    if (!fs.existsSync(vaultDir)) {
+      console.log(`\n  (skipped, not found) ${vaultDir}`);
+      continue;
+    }
+
+    if (!apply) {
+      const report = await analyzeVault(vaultDir);
+      summarize(report, verbose);
+      totalNodes += report.total;
+      totalValid += report.valid;
+      continue;
+    }
+
+    const result = await backfillVault(vaultDir, { snapshot, limit });
+    summarize(result, verbose);
+    if (result.snapshotId) {
+      console.log(`    snapshot: ${result.snapshotId}  (total-recall snapshot rollback ${result.snapshotId})`);
+    }
+    console.log(`    repaired: ${result.repaired}`);
+    if (result.failed.length) {
+      console.log(`    still failing: ${result.failed.length} (left untouched)`);
+      for (const f of result.failed.slice(0, 5)) {
+        console.log(`      ${f.file}: ${f.errors.join('; ').slice(0, 140)}`);
+      }
+    }
+    totalNodes += result.total;
+    totalValid += result.valid;
+    totalRepaired += result.repaired;
+    allFailed.push(...result.failed);
+  }
+
+  const pct = totalNodes ? ((totalValid / totalNodes) * 100).toFixed(1) : '100.0';
+  console.log(`\n  ${totalValid}/${totalNodes} valid before this run (${pct}%)`);
+  if (apply) {
+    console.log(`  ${totalRepaired} repaired, ${allFailed.length} still failing.`);
+    console.log('  Re-run without --apply to confirm the new state.\n');
+  } else {
+    console.log('  Re-run with --apply to repair. A snapshot is taken first.\n');
+  }
+}

package/src/cli/init.mjs

@@ -851,7 +851,7 @@ export default async function init(args) {
       // Auto-sync all .md files from the repo into the vault
       try {
         const { syncSingleRepo } = await import('../core/repo-sync.mjs');
-        const syncResult = syncSingleRepo(cwd, brainDir);
+        const syncResult = await syncSingleRepo(cwd, brainDir);
         if (syncResult.ingested > 0) {
           logOk(`Auto-synced ${syncResult.ingested} files from repo into Total Recall`);
         }

package/src/cli/proposals.mjs

@@ -143,7 +143,7 @@ export default async function proposals(args) {
     case 'reject': {
       if (!id) { console.error('  ❌ Usage: proposals reject <id> [reason]'); process.exitCode = 1; return; }
       const reason = remainingArgs.slice(2).filter(a => !a.startsWith('--')).join(' ') || 'Rejected by user.';
-      setProposalStatus(vaultDir, id, 'rejected', { rejection_reason: reason, reviewed_by: 'user' });
+      await setProposalStatus(vaultDir, id, 'rejected', { rejection_reason: reason, reviewed_by: 'user' });
       console.log(`\n  ✗ Rejected ${id}: ${reason}\n`);
       return;
     }
@@ -172,7 +172,7 @@ export default async function proposals(args) {
         return;
       }
       for (const p of open) {
-        setProposalStatus(vaultDir, p.proposal_id, 'superseded', { superseded_reason: reason });
+        await setProposalStatus(vaultDir, p.proposal_id, 'superseded', { superseded_reason: reason });
       }
       console.log(`\n  ~ Superseded ${open.length} "${topic}" proposal(s).\n`);
       return;
@@ -181,7 +181,7 @@ export default async function proposals(args) {
     case 'revert': {
       if (!id) { console.error('  ❌ Usage: proposals revert <id>'); process.exitCode = 1; return; }
       try {
-        const { reverted, deleted } = revertProposal(vaultDir, id);
+        const { reverted, deleted } = await revertProposal(vaultDir, id);
         console.log(`\n  ✓ Reverted ${id} — ${reverted} file(s) restored, ${deleted} removed.\n`);
       } catch (err) {
         console.error(`  ❌ ${err.message}`);

package/src/cli/secret.mjs

@@ -202,6 +202,11 @@ function printHelp() {
       remove <name>        Delete a target
       deploy <name>        Push the SSOT projection to that target now
                             [--dry-run] [--keys k1,k2]
+    diff-env              Compare repo .env files against the store (no values printed)
+      --path <dir>        Single repo (default: every project-registry path)
+      --filename .env     File to compare (default .env; server/<name> also checked)
+      --strict            Exit 1 on any drift or unadopted key
+      --layer project     Compare against the project-local store (default: global)
     import-env            One-time migrate: scan local .env → store (not the steady-state path)
       --all / --file / --overwrite / --dry-run
     catalog               Full catalog: keys, providers, usage, rotation, cost, tracking
@@ -465,6 +470,9 @@ function parseArgs(args) {
       case '--path':
         out.path = args[++i];
         break;
+      case '--layer':
+        out.layer = args[++i];
+        break;
       case '--all-projects':
         out.allProjects = true;
         break;
@@ -1424,6 +1432,82 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'diff-env') {
+      const { diffEnvAgainstStore, resolveEnvFiles } = await import('../core/secrets-env-diff.mjs');
+      const { loadProjectRegistry } = await import('../core/secrets-env-export.mjs');
+      const { globalBrainDir } = await import('../core/config.mjs');
+
+      // Compare against the GLOBAL store, not whichever layer the cwd resolves
+      // to. A repo with its own .agent/ shadows the global store, so running
+      // this from inside one would diff .env files against a project-local
+      // store and report drift that is really just two different stores —
+      // which is how the real drift stayed invisible. --layer project opts in.
+      const compareBrainDir = opts.layer === 'project' ? brainDir : globalBrainDir;
+
+      const roots = opts.path
+        ? [path.resolve(opts.path)]
+        : loadProjectRegistry()
+          .map((entry) => (typeof entry === 'string' ? entry : entry.path || entry.root))
+          .filter(Boolean);
+
+      const files = resolveEnvFiles(roots, opts.filename ? [opts.filename] : ['.env']);
+      if (!files.length) {
+        console.log('\n  No .env files found for the configured projects.\n');
+        return;
+      }
+
+      const { totals, rows, storeKeyCount } = await diffEnvAgainstStore(compareBrainDir, files);
+
+      console.log(`\n  Secrets store vs .env — ${files.length} file(s), ${storeKeyCount} keys in store`);
+      console.log(`  store: ${compareBrainDir.replace(os.homedir(), '~')}\n`);
+      console.log(`    identical to store : ${totals.match}`);
+      console.log(`    DRIFTED            : ${totals.drift}`);
+      console.log(`    name collisions    : ${totals.collision}`);
+      console.log(`    only in .env       : ${totals.only_env}`);
+      console.log(`    placeholders       : ${totals.placeholder}`);
+
+      const drifted = rows.filter((r) => r.status === 'drift');
+      if (drifted.length) {
+        console.log('\n  Drift — the same key holds different values in the two places.');
+        console.log('  Equal lengths mean the same credential format, i.e. a rotation that');
+        console.log('  landed on one side only. Decide which side is live before exporting.\n');
+        for (const r of drifted) {
+          const shape = r.sameShape ? 'same shape' : 'different shape';
+          console.log(`    ${r.key.padEnd(34)} env=${String(r.envLength).padStart(3)}ch  store=${String(r.storeLength).padStart(3)}ch  (${shape})`);
+          console.log(`      ${r.file.replace(os.homedir(), '~')}`);
+        }
+      }
+
+      const collisions = rows.filter((r) => r.status === 'collision');
+      if (collisions.length) {
+        console.log('\n  Name collisions — the store entry is bound to a different repo, so');
+        console.log('  these are two products\' credentials sharing a variable name, not');
+        console.log('  staleness. Exporting would overwrite one product with the other\'s.\n');
+        const seen = new Set();
+        for (const r of collisions) {
+          const line = `${r.key}|${r.binding}|${r.envRepo}`;
+          if (seen.has(line)) continue;
+          seen.add(line);
+          console.log(`    ${r.key.padEnd(30)} store bound to '${r.binding}' · .env belongs to '${r.envRepo}'`);
+        }
+      }
+
+      const onlyEnv = rows.filter((r) => r.status === 'only_env');
+      if (onlyEnv.length) {
+        console.log('\n  Present in .env but absent from the store (import to adopt):\n');
+        for (const r of onlyEnv) {
+          console.log(`    ${r.key.padEnd(34)} ${r.file.replace(os.homedir(), '~')}`);
+        }
+      }
+
+      console.log('');
+      if (opts.strict && (totals.drift > 0 || totals.only_env > 0)) {
+        console.error('  diff-env --strict: store is not the source of truth for every key.');
+        process.exit(1);
+      }
+      return;
+    }
+
     if (opts.command === 'import-env') {
       const existing = await listSecretsMeta(brainDir);
       const existingSet = new Set(existing.map((e) => e.key));

package/src/core/clarity-rewriter.mjs

@@ -4,7 +4,8 @@ import matter from 'gray-matter';
 import crypto from 'crypto';
 import { callLocalRuntime, cleanAndParseJSON } from './runtime.mjs';
 import { atomicWrite, safeStringify } from './vault.mjs';
-import { getNodes, invalidate } from './vault-cache.mjs';
+import { updateNodeInPlace } from './validated-write.mjs';
+import { getNodes } from './vault-cache.mjs';
 import { logger } from './logger.mjs';
 
 /**
@@ -567,18 +568,6 @@ export async function runCutoffAudit({ vaultDir, queueDir, runtimeConfig }) {
   return { audited: batch.length, flagged, critical };
 }
 
-/** Resolve vault dir from node file path (…/memory-vault/category/slug.md). */
-function vaultDirFromNodeFile(filePath) {
-  if (!filePath) return null;
-  let cur = path.dirname(filePath);
-  while (cur && cur !== path.dirname(cur)) {
-    if (path.basename(cur) === 'memory-vault') return cur;
-    cur = path.dirname(cur);
-  }
-  // Fallback: parent of category dir
-  return path.dirname(path.dirname(filePath));
-}
-
 function nodeFilePath(node) {
   return node?._filepath || node?._filePath || null;
 }
@@ -587,12 +576,11 @@ async function stampVerified(node) {
   const fp = nodeFilePath(node);
   if (!fp) return;
   try {
-    const raw = fs.readFileSync(fp, 'utf8');
-    const { data, content } = matter(raw);
-    data.x_cutoff_verified_at = new Date().toISOString();
-    data.x_cutoff_risk = 'none';
-    atomicWrite(fp, safeStringify(content, data));
-    invalidate(vaultDirFromNodeFile(fp));
+    const result = await updateNodeInPlace(fp, (data) => {
+      data.x_cutoff_verified_at = new Date().toISOString();
+      data.x_cutoff_risk = 'none';
+    });
+    if (!result.success) throw new Error((result.validation?.errors || [result.error]).join('; '));
   } catch (err) {
     logger.debug('clarity-rewriter: stampCutoffRiskNone failed', { err: err.message });
   }
@@ -602,16 +590,15 @@ async function stampCutoffRisk(node, riskLevel, claimCount) {
   const fp = nodeFilePath(node);
   if (!fp) return;
   try {
-    const raw = fs.readFileSync(fp, 'utf8');
-    const { data, content } = matter(raw);
-    data.x_cutoff_risk = riskLevel;
-    data.x_cutoff_claim_count = claimCount;
-    data.x_cutoff_flagged_at = new Date().toISOString();
-    // Lower confidence to reflect that claims are unverified
-    const confidencePenalty = riskLevel === 'critical' ? 0.3 : riskLevel === 'high' ? 0.2 : 0.1;
-    data.confidence = Math.max(0.1, (data.confidence || 0.5) - confidencePenalty);
-    atomicWrite(fp, safeStringify(content, data));
-    invalidate(vaultDirFromNodeFile(fp));
+    const result = await updateNodeInPlace(fp, (data) => {
+      data.x_cutoff_risk = riskLevel;
+      data.x_cutoff_claim_count = claimCount;
+      data.x_cutoff_flagged_at = new Date().toISOString();
+      // Lower confidence to reflect that claims are unverified
+      const confidencePenalty = riskLevel === 'critical' ? 0.3 : riskLevel === 'high' ? 0.2 : 0.1;
+      data.confidence = Math.max(0.1, (data.confidence || 0.5) - confidencePenalty);
+    });
+    if (!result.success) throw new Error((result.validation?.errors || [result.error]).join('; '));
   } catch (err) {
     logger.debug('clarity-rewriter: stampCutoffRisk failed', { err: err.message });
   }
@@ -777,16 +764,15 @@ async function stampNodeForCorrection(node, correctionSlug, disposition) {
   const fp = nodeFilePath(node);
   if (!fp) return;
   try {
-    const raw = fs.readFileSync(fp, 'utf8');
-    const { data, content } = matter(raw);
-    data.status = disposition === 'deleted' ? 'archived' : 'superseded';
-    data.superseded_by = correctionSlug;
-    data.x_correction_applied_at = new Date().toISOString();
-    // Lower confidence significantly — this fact has been proven wrong
-    data.confidence = Math.max(0.05, (data.confidence || 0.5) * 0.3);
-    data.updated = new Date().toISOString();
-    atomicWrite(fp, safeStringify(content, data));
-    invalidate(vaultDirFromNodeFile(fp));
+    const result = await updateNodeInPlace(fp, (data) => {
+      data.status = disposition === 'deleted' ? 'archived' : 'superseded';
+      data.superseded_by = correctionSlug;
+      data.x_correction_applied_at = new Date().toISOString();
+      // Lower confidence significantly — this fact has been proven wrong
+      data.confidence = Math.max(0.05, (data.confidence || 0.5) * 0.3);
+      data.updated = new Date().toISOString();
+    });
+    if (!result.success) throw new Error((result.validation?.errors || [result.error]).join('; '));
   } catch (err) {
     logger.debug('clarity-rewriter: stampNodeForCorrection failed', { err: err.message });
   }

package/src/core/conclusion-writer.mjs

@@ -2,8 +2,8 @@ import fs from 'fs';
 import path from 'path';
 import matter from 'gray-matter';
 import { callLocalRuntime } from './runtime.mjs';
-import { atomicWrite, safeStringify } from './vault.mjs';
-import { getNodes, invalidate } from './vault-cache.mjs';
+import { atomicWrite, safeStringify, writeNode } from './vault.mjs';
+import { getNodes } from './vault-cache.mjs';
 import { logger } from './logger.mjs';
 
 /**
@@ -157,15 +157,21 @@ async function promoteToVault(draftNode, confidenceAdj, vaultDir) {
   data.updated = new Date().toISOString();
   data.x_promoted_at = new Date().toISOString();
 
-  // Compute target path in vault
-  const targetDir = path.join(vaultDir, data.category || 'concepts');
-  if (!fs.existsSync(targetDir)) {
-    fs.mkdirSync(targetDir, { recursive: true });
-  }
+  // This is the doorway every research-derived fact walks through on its way
+  // into the vault, and it used to be a raw atomicWrite — so a draft whose
+  // frontmatter came out of an LLM entered the vault with whatever fields it
+  // happened to have. Promotion is a canonical write and has to clear the
+  // contract; the inbox copy is only removed once it does.
+  const result = await writeNode({ ...data, body: content }, vaultDir, { agentRole: 'system' })
+    .catch((err) => ({ success: false, error: err.message }));
 
-  const targetPath = path.join(targetDir, `${data.slug}.md`);
-  atomicWrite(targetPath, safeStringify(content, data));
-  invalidate(vaultDir);
+  if (result && result.success === false) {
+    logger.warn({
+      subsystem: 'conclusion-writer',
+      message: `Promotion rejected by contract for ${data.slug}: ${result.error}`,
+    });
+    return;
+  }
 
   // Remove from inbox
   try { fs.unlinkSync(draftNode._filepath); } catch { /* ignore */ }
@@ -181,6 +187,8 @@ async function applyRevision(draftNode, confidenceAdj, revisionInstructions) {
   data.x_revision_requested = revisionInstructions;
   data.updated = new Date().toISOString();
 
+  // ssss-raw-write: draftNode is an inbox draft, not a vault node — it is
+  // validated on promotion, not here.
   atomicWrite(draftNode._filepath, safeStringify(content, data));
 }
 
@@ -198,6 +206,8 @@ async function quarantineDraft(draftNode, reason, quarantineDir) {
   data.x_quarantined_at = new Date().toISOString();
 
   const targetPath = path.join(quarantineDir, `${data.slug}.md`);
+  // ssss-raw-write: quarantine is a holding pen outside the vault — a rejected
+  // draft must be parkable precisely when it cannot pass validation.
   atomicWrite(targetPath, safeStringify(content, data));
 
   try { fs.unlinkSync(draftNode._filepath); } catch { /* ignore */ }

package/src/core/crypto.mjs

@@ -8,28 +8,98 @@ const ALGORITHM = 'aes-256-gcm';
 
 const scryptAsync = promisify(crypto.scrypt);
 
+const SCRYPT_PARAMS = {
+  N: 2 ** 16, // CPU/memory cost: 65536
+  r: 8,
+  p: 1,
+  maxmem: 128 * 1024 * 1024
+};
+
+/**
+ * Derived-key cache.
+ *
+ * The KDF above is deliberately expensive (~64 MB, measured 190-240 ms per
+ * derivation). That cost is correct ONCE — it is what makes the store
+ * brute-force resistant — but it was being paid on every single read:
+ * loadSecrets() re-derives per call, and listSecretsMeta / getSecretsCatalog /
+ * getSharedValueHealth each call loadSecrets, so one Secrets page load paid it
+ * three or more times.
+ *
+ * The cache is keyed by BOTH the salt and a digest of the password, so:
+ *   - re-encrypting the store (fresh random salt on every save) misses, and
+ *   - rotating the master password misses.
+ * Neither can serve a stale key. Entries are bounded and evicted oldest-first.
+ *
+ * A cached key is strictly less sensitive than what the caller already holds:
+ * the password itself is in this process, and the decrypted secrets are about
+ * to be. Set TR_SECRETS_KEY_CACHE=0 to disable.
+ */
+const derivedKeyCache = new Map();
+const MAX_CACHED_KEYS = 8;
+
+function keyCacheEnabled() {
+  return process.env.TR_SECRETS_KEY_CACHE !== '0';
+}
+
+function keyCacheId(password, salt) {
+  const pwDigest = crypto.createHash('sha256').update(String(password)).digest();
+  return crypto.createHash('sha256').update(salt).update(pwDigest).digest('base64');
+}
+
+function cacheGet(id) {
+  if (!derivedKeyCache.has(id)) return null;
+  // Refresh recency: delete + re-set moves the entry to the tail.
+  const key = derivedKeyCache.get(id);
+  derivedKeyCache.delete(id);
+  derivedKeyCache.set(id, key);
+  return key;
+}
+
+function cacheSet(id, key) {
+  derivedKeyCache.set(id, key);
+  while (derivedKeyCache.size > MAX_CACHED_KEYS) {
+    derivedKeyCache.delete(derivedKeyCache.keys().next().value);
+  }
+}
+
+/** Drop every cached key — call after a master-password rotation. */
+export function clearDerivedKeyCache() {
+  derivedKeyCache.clear();
+}
+
 /**
  * Derives a 32-byte encryption key from a master password using scrypt
  * (Node built-in — no native dependency required).
  *
  * Parameters chosen for ~64 MB of memory, matching OWASP scrypt guidance.
+ *
+ * @param {object} [opts]
+ * @param {boolean} [opts.cache=true] - false on the encrypt path: every save
+ *   generates a fresh random salt that is never derived against again, so
+ *   caching it would only evict keys that ARE reused.
  */
-export async function deriveKey(password, salt) {
-  return scryptAsync(password, salt, 32, {
-    N: 2 ** 16, // CPU/memory cost: 65536
-    r: 8,
-    p: 1,
-    maxmem: 128 * 1024 * 1024
-  });
+export async function deriveKey(password, salt, opts = {}) {
+  const useCache = opts.cache !== false && keyCacheEnabled();
+  const id = useCache ? keyCacheId(password, salt) : null;
+  if (id) {
+    const hit = cacheGet(id);
+    if (hit) return hit;
+  }
+  const key = await scryptAsync(password, salt, 32, SCRYPT_PARAMS);
+  if (id) cacheSet(id, key);
+  return key;
 }
 
-export function deriveKeySync(password, salt) {
-  return crypto.scryptSync(password, salt, 32, {
-    N: 2 ** 16,
-    r: 8,
-    p: 1,
-    maxmem: 128 * 1024 * 1024
-  });
+export function deriveKeySync(password, salt, opts = {}) {
+  const useCache = opts.cache !== false && keyCacheEnabled();
+  const id = useCache ? keyCacheId(password, salt) : null;
+  if (id) {
+    const hit = cacheGet(id);
+    if (hit) return hit;
+  }
+  const key = crypto.scryptSync(password, salt, 32, SCRYPT_PARAMS);
+  if (id) cacheSet(id, key);
+  return key;
 }
 
 /**
@@ -38,7 +108,7 @@ export function deriveKeySync(password, salt) {
  */
 export async function encryptSecrets(secretsObj, password) {
   const salt = crypto.randomBytes(16);
-  const key = await deriveKey(password, salt);
+  const key = await deriveKey(password, salt, { cache: false });
   const iv = crypto.randomBytes(12);
   const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
   
@@ -52,7 +122,7 @@ export async function encryptSecrets(secretsObj, password) {
 
 export function encryptSecretsSync(secretsObj, password) {
   const salt = crypto.randomBytes(16);
-  const key = deriveKeySync(password, salt);
+  const key = deriveKeySync(password, salt, { cache: false });
   const iv = crypto.randomBytes(12);
   const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
   

package/src/core/daemon-loop.mjs

@@ -241,7 +241,7 @@ async function main() {
 
   // Initial repo sync — auto-ingest all .md files from registered repos
   try {
-    const syncResult = syncAllRepos();
+    const syncResult = await syncAllRepos();
     logger.info({
       subsystem: 'daemon-loop',
       message: `Boot repo-sync: ${syncResult.totalIngested} new files across ${syncResult.repos.length} repos`,
@@ -401,7 +401,7 @@ async function main() {
 
         // Periodic repo sync — pick up any new/changed .md files in registered repos
         try {
-          const syncResult = syncAllRepos();
+          const syncResult = await syncAllRepos();
           if (syncResult.totalIngested > 0) {
             logger.info({
               subsystem: 'daemon-loop',