total-recall-brain 3.23.3 → 3.24.0

package/frontend/dist/index.html

@@ -17,7 +17,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-c6GHGS_j.js"></script>
+    <script type="module" crossorigin src="/assets/index-CtCDaZYZ.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-C7_Xpk27.css">
   </head>
   <body>

package/frontend/src/pages/SecretsPage.tsx

@@ -1,4 +1,4 @@
-import { useState, useEffect, useCallback, useMemo, useRef, type CSSProperties, type ReactNode } from 'react'
+import { useState, useEffect, useCallback, useMemo, useRef, memo, type CSSProperties, type ReactNode } from 'react'
 import {
   listApiKeys,
   issueApiKey,
@@ -294,36 +294,36 @@ export default function SecretsPage() {
     }
   }
 
+  // The loaders below set state synchronously before their first await, which
+  // react-hooks/set-state-in-effect rightly rejects inside an effect body. The
+  // original code dodged it with setTimeout(..., 0); yielding a microtask does
+  // the same job a macrotask sooner, and unlike the timeout it can be cancelled
+  // — so a fast unmount no longer sets state on a dead component.
   useEffect(() => {
-    if (tab === 'sync') {
-      setTimeout(() => void loadSyncData(), 0)
+    if (tab !== 'sync') return
+    let cancelled = false
+    void Promise.resolve().then(() => {
+      if (!cancelled) void loadSyncData()
+    })
+    return () => {
+      cancelled = true
     }
   }, [tab, loadSyncData])
 
+  /**
+   * Loads the secrets catalog — and ONLY the catalog.
+   *
+   * This used to await, in series: config, then the Gemini / Claude / OpenAI /
+   * OpenRouter model lists, and finally the catalog. The page's actual content
+   * therefore sat behind four external vendor round-trips, and the spinner ran
+   * until the slowest one answered. The model lists belong to the config tab
+   * and are fetched separately (and lazily) below.
+   */
   const loadCatalog = useCallback(async () => {
     setLoading(true)
     setError(null)
     try {
-      
-    try {
-      const config = await fetchConfigJson()
-      if (!config.secrets) config.secrets = {}
-      if (!config.brain) config.brain = {}
-      setConfigData(config)
-
-      const gem = await fetchGeminiModels().catch(() => [])
-      setGeminiModels(gem)
-      const cla = await fetchClaudeModels().catch(() => [])
-      setClaudeModels(cla)
-      const open = await fetchOpenaiModels().catch(() => [])
-      setOpenaiModels(open)
-      const or = await fetchOpenRouterModels().catch(() => [])
-      setOrModels(or)
-    } catch {
-      // ignore fetching models error
-    }
-
-    const data = await fetchSecretsCatalog()
+      const data = await fetchSecretsCatalog()
       setCatalog(data)
       const skey = selectedKeyRef.current
       if (skey) {
@@ -342,6 +342,35 @@ export default function SecretsPage() {
     }
   }, [])
 
+  const loadConfig = useCallback(async () => {
+    try {
+      const config = await fetchConfigJson()
+      if (!config.secrets) config.secrets = {}
+      if (!config.brain) config.brain = {}
+      setConfigData(config)
+    } catch {
+      // config is only needed by the config tab; its absence must not blank the page
+    }
+  }, [])
+
+  /**
+   * Vendor model lists, concurrently rather than in series. Each already
+   * degrades to [] on its own, so one slow or unauthorized vendor cannot hold
+   * up the other three.
+   */
+  const loadModels = useCallback(async () => {
+    const [gem, cla, open, or] = await Promise.all([
+      fetchGeminiModels().catch(() => []),
+      fetchClaudeModels().catch(() => []),
+      fetchOpenaiModels().catch(() => []),
+      fetchOpenRouterModels().catch(() => []),
+    ])
+    setGeminiModels(gem)
+    setClaudeModels(cla)
+    setOpenaiModels(open)
+    setOrModels(or)
+  }, [])
+
   const loadPats = useCallback(async () => {
     try {
       const r = await listApiKeys()
@@ -360,12 +389,27 @@ export default function SecretsPage() {
   }, [])
 
   useEffect(() => {
-    setTimeout(() => {
+    let cancelled = false
+    void Promise.resolve().then(() => {
+      if (cancelled) return
       void loadCatalog()
       void loadPats()
       void loadWebAuthn()
-    }, 0)
-  }, [loadCatalog, loadPats, loadWebAuthn])
+      void loadConfig()
+    })
+    return () => {
+      cancelled = true
+    }
+  }, [loadCatalog, loadPats, loadWebAuthn, loadConfig])
+
+  // Vendor model lists are only rendered by the 'cloud' tab — don't pay for
+  // them until it is opened, and only pay once.
+  const modelsLoadedRef = useRef(false)
+  useEffect(() => {
+    if (tab !== 'cloud' || modelsLoadedRef.current) return
+    modelsLoadedRef.current = true
+    void loadModels()
+  }, [tab, loadModels])
 
   
   const updateSecretsProp = (prop: string, value: string) => {
@@ -402,7 +446,11 @@ export default function SecretsPage() {
 
   // metaForm hoisted
 
-  function openKey(k: SecretCatalogKey, sectionId?: string) {
+  // useCallback with an empty dep list: every setter below is a stable React
+  // setter and the ref is stable, so this identity never needs to change. That
+  // is what lets the memoized SecretKeyRow skip re-rendering — a fresh arrow
+  // function per row per render would defeat memo() entirely.
+  const openKey = useCallback((k: SecretCatalogKey, sectionId?: string) => {
     selectedKeyRef.current = k.key
     setSelected(k)
     setEdit(metaForm(k))
@@ -418,7 +466,7 @@ export default function SecretsPage() {
         return next
       })
     }
-  }
+  }, [])
 
   async function registerPasskey() {
     if (!browserSupportsWebAuthn()) {
@@ -623,30 +671,33 @@ export default function SecretsPage() {
     }
   }
 
-  const keys = (catalog?.keys || []).filter((k) => {
-    if (!filter.trim()) return true
-    const q = filter.toLowerCase()
-    return (
-      k.key.toLowerCase().includes(q) ||
-      (k.provider || '').toLowerCase().includes(q) ||
-      (k.repos || []).some((r) => r.toLowerCase().includes(q)) ||
-      (k.label || '').toLowerCase().includes(q)
+  /**
+   * Filtered key list.
+   *
+   * There were two copies of this predicate — this one, recomputed on EVERY
+   * render, and a second inside the repoSections memo. With ~35 pieces of state
+   * on this component, "every render" means every keystroke anywhere, every
+   * save, every reveal. One memoized predicate now feeds both consumers, so
+   * they can also never disagree about what "matching" means.
+   */
+  const keys = useMemo(() => {
+    const all = catalog?.keys || []
+    const q = filter.trim().toLowerCase()
+    if (!q) return all
+    return all.filter(
+      (k) =>
+        k.key.toLowerCase().includes(q) ||
+        (k.provider || '').toLowerCase().includes(q) ||
+        (k.repos || []).some((r) => r.toLowerCase().includes(q)) ||
+        (k.label || '').toLowerCase().includes(q)
     )
-  })
+  }, [catalog, filter])
 
   /** Group filtered keys into repo sections (one key → one repo; multi = error; none = developer). */
   const repoSections = useMemo<{ id: string; label: string; kind: 'error' | 'developer' | 'repo' | 'provider'; keys: SecretCatalogKey[] }[]>(() => {
     if (!catalog?.keys) return []
-    const f = filter.toLowerCase()
-    const filtered = catalog.keys.filter(
-      (k) =>
-        k.key.toLowerCase().includes(f) ||
-        (k.provider || '').toLowerCase().includes(f) ||
-        (k.repos || []).some((r) => r.toLowerCase().includes(f)) ||
-        (k.label || '').toLowerCase().includes(f)
-    )
-    return groupBy === 'api' ? groupKeysByProvider(filtered) : groupKeysByRepo(filtered)
-  }, [catalog, filter, groupBy])
+    return groupBy === 'api' ? groupKeysByProvider(keys) : groupKeysByRepo(keys)
+  }, [catalog, keys, groupBy])
 
   // Default accordion: open errors + first product/developer section only
   useEffect(() => {
@@ -1324,8 +1375,9 @@ export default function SecretsPage() {
                           <SecretKeyRow
                             key={`${sec.id}::${k.key}`}
                             k={k}
+                            sectionId={sec.id}
                             selected={selected?.key === k.key}
-                            onOpen={() => openKey(k, sec.id)}
+                            onOpen={openKey}
                             groupBy={groupBy}
                           />
                         ))}
@@ -2565,21 +2617,28 @@ function groupKeysByRepo(keys: SecretCatalogKey[]): {
 }
 
 /** Compact single-line-ish row for long catalogs */
-function SecretKeyRow({
+/**
+ * memo()'d because the catalog renders ~100 of these and the list re-renders
+ * on every keystroke in the filter box. Paired with the stable `onOpen`
+ * above, an unrelated state change now re-renders zero rows.
+ */
+const SecretKeyRow = memo(function SecretKeyRow({
   k,
   selected,
+  sectionId,
   onOpen,
   groupBy,
 }: {
   k: SecretCatalogKey
   selected: boolean
-  onOpen: () => void
+  sectionId?: string
+  onOpen: (k: SecretCatalogKey, sectionId?: string) => void
   groupBy?: 'repo' | 'api'
 }) {
   return (
     <button
       type="button"
-      onClick={onOpen}
+      onClick={() => onOpen(k, sectionId)}
       style={{
         width: '100%',
         display: 'grid',
@@ -2668,7 +2727,7 @@ function SecretKeyRow({
       <span style={{ fontSize: 11, color: 'var(--text-tertiary)', flexShrink: 0 }}>›</span>
     </button>
   )
-}
+})
 
 function SummaryCard({ label, value, accent }: { label: string; value: string; accent: string }) {
   return (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.23.3",
+  "version": "3.24.0",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [
@@ -42,7 +42,8 @@
     "routes:manifest": "node scripts/generate-route-manifest.mjs",
     "clean": "rm -rf scratch/* .remember/* *.log",
     "check:dist": "node scripts/check-dist-freshness.mjs",
-    "prepublishOnly": "npm run check:dist"
+    "prepublishOnly": "npm run check:dist",
+    "check:ssss-registry": "node scripts/check-ssss-registry.mjs"
   },
   "repository": {
     "type": "git",

package/scaffold/.agent/skills/total-recall/SKILL.md

@@ -3,15 +3,16 @@ name: total-recall
 provenance: total-recall
 description: >-
   Use this skill to operate Total Recall — portable memory, instructions,
-  openwiki, skill deploy, and secrets. MANDATORY: Read this file before changing
-  TR setup. Nested packages under modules/ are NOT agent skills.
-version: 3.14.1
+  openwiki, skills management, secrets store, mesh/headscale control server, and
+  the test suite. MANDATORY: Read this file before changing TR setup. Nested
+  packages under modules/ are NOT agent skills.
+version: 3.23.3
 repo_scoped: true
 ---
 
 # Total Recall — Master Agent Skill
 
-> **Product focus:** portable personal memory + IDE instructions + openwiki + skill deploy + secrets.
+> **Product focus:** portable personal memory + IDE instructions + openwiki + skills management + secrets + mesh.
 > **Only agent skill in this package.** Implementation helpers live in `modules/` (not skills).
 > Openwiki ships with the brain at `openwiki/`.
 
@@ -60,6 +61,18 @@ You MUST actively reference and apply this skill under the following specific ru
 *   **Trigger**: Immediately after performing any memory node writes.
 *   **Action**: Rebuild the instruction shims. If using CLI commands (`npx total-recall remember` / `forget`), recompilation runs automatically in the background (asynchronously via detached subprocesses) to minimize latency. If editing vault files directly, trigger manual compilation by sending a POST request to `/api/vault/compile` or running `npx total-recall compile`.
 
+### 5b. When handling ANY credential, API key, or password
+Never invent a new place to keep it. It goes in the encrypted secrets store —
+see **SECRETS STORE** below for `--stdin`, the one-repo binding rule, the
+`.env` migration path, and the health gates.
+
+### 5c. When reaching another machine, or editing device/node details
+Use the **MESH / CONTROL SERVER** section. Node details are entity fields on
+SSSS `mesh_node` documents — never hardcoded hostnames.
+
+### 5d. When running tests, typechecks, or builds
+See **TESTS**. Heavy runs go to the Mac Mini or the droplet, never the laptop.
+
 ### 6. When troubleshooting connections, port blocks, or sync errors
 *   **Trigger**: If the REST server is unreachable, ports are blocked, or the upstream sync tool encounters errors.
 *   **Action**: Refer to the active diagnostics manual within this skill to heal the local runtime.
@@ -106,6 +119,9 @@ node .agent/skills/total-recall/scripts/sync-repo.mjs
 ```
 This utility fetches standard skill and invariant definitions from the upstream repository, merges them non-destructively preserving custom user nodes, and auto-recompiles the workspace.
 
+Everything below is the CLI equivalent — see **SKILLS MANAGEMENT** for the full
+registry/multi-repo reference.
+
 ### 5. Premium Browser Setup Wizard Onboarding
 For first-time system installations, migrations, or editor reconnections, launch the visual onboarding setup wizard:
 ```bash
@@ -315,6 +331,45 @@ curl -H "Authorization: Bearer <YOUR_PAT_TOKEN>" \
 
 ---
 
+## 🧩 SKILLS MANAGEMENT (`skill` subcommand)
+
+Two distinct layers. Confusing them is the usual cause of "my edit disappeared".
+
+| Layer | What it is | Commands |
+|---|---|---|
+| **Local brain** | Skills installed in one brain's `skills/` dir | `find` `install` `create` `edit` `scan` `list` `remove` `publish` |
+| **Registry + install map** | The catalog and every repo copy deployed from it | `register` `registry` `deploy` `status` `track` `discover` `sync` `push` `pull` |
+
+```bash
+npx total-recall skill list                  # what this brain has
+npx total-recall skill registry              # catalog entries (skills-registry/index.yaml)
+npx total-recall skill status                # registry + install map + DRIFT summary
+npx total-recall skill status <id>           # drift for one skill
+
+npx total-recall skill track /path/to/repo   # start managing a repo's .agent/skills
+npx total-recall skill discover              # scan tracked repos for skills
+npx total-recall skill sync                  # two-way reconcile across repos
+npx total-recall skill push                  # one-way: catalog/source → all installs
+npx total-recall skill pull                  # one-way: installs → source → fan-out
+npx total-recall skill deploy <id> --repo <path>   # copy into one repo
+```
+
+**Which direction to use.** `sync` picks a winner per skill (`--prefer
+newest|registry|install`, default `newest`). When you have just edited the
+canonical copy and want every repo to match it, use `push` — `sync` can pick a
+repo copy instead if its mtime is newer, which silently reverts your edit.
+`--dry-run` first, always.
+
+**No hardcoded repo paths.** Repos enter the set only via `skill track`, the
+project registry, `--repo`, `TR_SYNC_REPOS`, or cwd detection. Core must never
+name a product repo (this is an open-source invariant, not a preference).
+
+**`--include-core`** is off by default: the `total-recall` skill itself is not
+fanned out unless you ask, so a repo-local edit cannot clobber the master copy
+by accident.
+
+---
+
 ## 🔐 SECRETS STORE (separate from the memory vault — `secret` subcommand)
 
 API keys and credentials are **not** memory nodes. They live encrypted at
@@ -324,13 +379,88 @@ INSTRUCTIONS.md/skill surface (`secret check-surfaces` fails the build if one
 ever leaks in). Full reference: `npx total-recall secret --help`.
 
 ```bash
-npx total-recall secret set <key> <value>            # store (0600, optional AES)
-npx total-recall secret rotate <key> <new-value>      # replace + mark rotated
+npx total-recall secret set <key> --stdin            # store (0600, AES); --stdin keeps it out of argv/history
+npx total-recall secret rotate <key> --stdin          # replace + mark rotated
 npx total-recall secret get <key>                     # print value (audited)
 npx total-recall secret list                          # metadata only, no values
-npx total-recall secret export-env --path <repo>       # SSOT → local .env.local
+npx total-recall secret catalog                       # keys + providers + usage + rotation + cost
+npx total-recall secret export-env --path <repo>       # SSOT → local .env
+```
+
+**Always prefer `--stdin`** (or `--from-clipboard` for `rotate`). A value passed
+as an argv string lands in shell history, in `ps` output, and in this
+transcript. `set`, `rotate` and `rekey` all accept it.
+
+### Master password and `rekey`
+
+The store is AES-256-GCM; the key is scrypt-derived (N=2^16, ~64 MB) from
+`TR_SECRETS_PASSWORD`. On macOS the password belongs in the **Keychain**
+(`security add-generic-password -s total-recall-secrets`), not in a dotfile —
+`rekey` picks the Keychain entry up automatically and rotates every carrier
+(LaunchAgent plist, env file, Keychain) in one transaction, verifying the
+retired password no longer decrypts before it commits.
+
+> **Processes hold the old password until restarted.** After a rekey, anything
+> still running with the retired value fails with `Failed to decrypt secrets
+> store: Unsupported state or unable to authenticate data`. Restart the daemon
+> and any launchd jobs.
+
+The derived key is cached in-process (bounded, keyed on salt **and** password
+digest, so neither a re-encrypt nor a rotation can be served a stale key). This
+matters because the KDF costs ~200 ms and a single dashboard load reads the
+store several times. `TR_SECRETS_KEY_CACHE=0` disables it.
+
+### Getting secrets OUT of `.env` files and INTO the store
+
+`import-env` is the **one-time migration**, not the steady state:
+
+```bash
+npx total-recall secret import-env --dry-run --all   # scan every known repo, change nothing
+npx total-recall secret import-env --all             # import everything new
+npx total-recall secret import-env KEY1 KEY2         # or just these
 ```
 
+> **One credential → exactly ONE repo.** The store rejects a multi-repo binding,
+> and `import-env` derives the binding from *where it found the value* — so a
+> key sitting in six repos' `.env` files fails to import and `--repo` will not
+> override it. That is the rule working: one value in six repos means a leak of
+> any one repo burns all six. Either issue a distinct key per app, or bind it to
+> its owning repo explicitly:
+>
+> ```bash
+> printf '%s' "$VALUE" | npx total-recall secret set <key> --stdin --repos <owning-repo>
+> ```
+
+Once stored, the flow reverses — `.env` becomes a **projection of the store**:
+
+```bash
+npx total-recall secret export-env --path <repo> --dry-run
+npx total-recall secret export-env --all-projects        # every registered project
+npx total-recall secret export-env --no-global           # only keys bound to this repo
+```
+
+By default `export-env` merges only the TR-managed block, leaving hand-written
+lines alone; `--replace-all` overwrites the whole file.
+
+### Health gates (all exit non-zero on a finding)
+
+```bash
+npx total-recall secret check-surfaces    # a secret VALUE leaked into a compiled surface/openwiki
+npx total-recall secret shared            # same value reused under several key names / apps
+npx total-recall secret duplicates        # duplicate entries
+npx total-recall secret tracking-health   # a set secret with no live account/usage binding
+npx total-recall secret rotation-due      # overdue keys (--enqueue to create daemon tasks)
+```
+
+`shared` is the one that catches real risk: it reports when one credential backs
+multiple keys or apps, which defeats per-app revocation. `secret meta <key>
+--shared-ok` waives it deliberately.
+
+**Never** put a secret value in vault markdown, openwiki, a compiled
+INSTRUCTIONS.md, a skill surface, or a `.env.bak-*` file. Backups of `.env` are
+a common accident — they are usually **not** gitignored, so a `git add -A`
+commits live keys.
+
 ### Executed rotation — `rotate-auto` / `rotate-browser` (added 3.22.0)
 
 Rotation used to only ever **print instructions**. It now executes. Every key
@@ -413,6 +543,68 @@ that dead-ends back at a manual dashboard step.
 <!-- END INJECTED MEMORY -->
 
 
+---
+
+## 🕸️ MESH / CONTROL SERVER (`mesh` subcommand)
+
+Headscale administration — node inventory, ACL policy, and Tailscale SSH. This
+is how one machine reaches another (laptop → Mac Mini → droplet) without
+hardcoding hostnames anywhere.
+
+```bash
+npx total-recall mesh status                 # control-server reachability + credential state
+npx total-recall mesh nodes                  # every node and how to reach it
+npx total-recall mesh access <node>          # resolved access for one node
+npx total-recall mesh access import          # propose access from ~/.ssh/config (--apply to save)
+npx total-recall mesh ssh <node> 'uptime'    # run a command on a node
+npx total-recall mesh preauthkey             # enrollment key for `tailscale up --authkey`
+npx total-recall mesh policy get
+npx total-recall mesh policy init-ssh --dry-run
+```
+
+**Device details are entity fields, never literals.** Hostname, mesh IP, role,
+OS, location, capabilities and latency history live on the node's SSSS
+`mesh_node` document plus live discovery. Product code and UI bind to those
+fields — never to a personal machine name.
+
+**Mesh membership is the trust boundary.** Every node admitted to the tailnet
+inherits whatever the policy grants; audit `mesh nodes` before widening it.
+`policy` commands require the control server running with `policy.mode:
+database`.
+
+**WAN timeouts.** Laptop↔cloud probes need **≥10 s**. Shorter timeouts (1.5 s/3 s)
+falsely report a reachable cloud node as down while raw `curl /health` succeeds.
+
+---
+
+## 🧪 TESTS
+
+```bash
+npm test                    # vitest run — whole suite
+npx vitest run <path>       # one spec file
+```
+
+Current baseline: **288 spec files / 1493 tests, ~160 s** on the Mac Mini.
+
+> **Never run the full suite, a full typecheck, or a production build on the
+> laptop.** These go to the Mac Mini or the droplet — local runs cause slowdowns
+> and OOM kills. Sync and run remotely:
+>
+> ```bash
+> rsync -a --delete --exclude=node_modules/ --exclude=.git/ ./ mac-mini:~/github/total-recall/
+> ssh mac-mini 'export PATH=/opt/homebrew/bin:$PATH; cd ~/github/total-recall && npx vitest run'
+> ```
+>
+> A non-login `ssh` shell has no Homebrew on PATH — export it or use `bash -lc`,
+> otherwise the run dies with `command not found: npx` **and still exits 0**.
+
+**Never skip tests** to make a release look clean, and never use `--force` on a
+checker. Audit and clean up any rows, files, or mock entries a suite leaves
+behind in a live database.
+
+`npx` itself adds ~2 s of resolution overhead per invocation. For tight loops
+call the local binary directly: `node bin/total-recall.mjs <cmd>`.
+
 ---
 
 ## Operational modules only (not skills)

package/scaffold/.agent/skills/total-recall/memory-vault/concepts/cli-help-reference.md

@@ -19,10 +19,10 @@ tags:
   - budget
   - sandbox
   - watchdog
-created: 2026-05-25T00:51:00.000Z
-updated: 2026-05-25T00:56:00.000Z
+created: '2026-05-25T00:51:00.000Z'
+updated: '2026-01-04T02:42:09.572Z'
 sentiment_polarity: descriptive
-last_accessed: 2026-05-26T23:03:03.507Z
+last_accessed: '2026-01-04T02:42:09.572Z'
 source:
   type: manual
   session_id: migration-repair
@@ -39,7 +39,16 @@ object: Total Recall Command & Architecture Help Reference
 decay:
   half_life_days: 180
   access_count: 1
-x_temporal_context: 2026-05-26T23:05:06.474Z
+x_temporal_context: '2026-05-26T23:05:06.474Z'
+description: Total Recall Command & Architecture Help Reference
+timestamp: '2026-05-25T00:56:00.000Z'
+x_citations:
+  - source: manual
+    title: Total Recall Command & Architecture Help Reference
+    url: 'session://migration-repair'
+    published: '2026-05-26T23:05:06.474Z'
+    relevance: 1
+    accessed: '2026-08-18T23:41:45.533Z'
 ---
 # Total Recall Command & Architecture Help Reference
 

package/scaffold/.agent/skills/total-recall/memory-vault/invariants/operating-instructions.md

@@ -3,6 +3,8 @@ type: memory
 slug: operating-instructions
 category: invariants
 title: Total Recall Core Operating Protocol
+description: "The absolute operating protocol for agents using Total Recall: SSSS-governed memory, CLI-first mutations, no external database."
+timestamp: 2026-05-15T00:00:00.000Z
 schema_version: 2
 status: active
 confidence: 1

package/scaffold/.agent/skills/total-recall/references/api-reference.md

@@ -43,7 +43,7 @@ Returns the status of the vault, embeddings index, and LLM reachability.
       "vfs": {
         "exists": true,
         "skill_exists": true,
-        "path": "~/.agent"
+        "path": "/Users/greg/.agent"
       }
     }
     ```

package/scaffold/.agent/skills/total-recall/references/cli-reference.md

@@ -23,8 +23,7 @@ Rebuild the derived indexes and compile memory surfaces.
 ### 1.3 `connect`
 Configure an IDE or external client to bind to the Total Recall local server.
 *   **Syntax**: `npx total-recall connect <client> [options]`
-*   **Supported Clients**: `vscode`, `pi`, `hermes`, `openclaw`, `cursor`, `cline`, `claude-code`, `codex`, `antigravity`, `gemini`, `aider`, `http-api`, `obsidian`, `generic`.
-    Any host application not listed here connects through the generic `http-api` client.
+*   **Supported Clients**: `cursor`, `claude-code`, `antigravity`, `gemini`, `vscode`, `windsurf`, `aider`, `ultrachat`, `obsidian`.
 *   **Options**:
     *   `--brain <url>`: Override default brain server URL.
     *   `--token <PAT>`: Inject bearer PAT credentials for authenticating requests.

package/scaffold/.agent/skills/total-recall/research-queue.jsonl

@@ -0,0 +1,7 @@
+{"id":"7478a515-ea8e-4360-93b8-a10cf0642d88","topic":"npm Registry API documentation and developer endpoints","status":"pending","priority":"medium","notes":"Consult official npm documentation for registry APIs, authentication, and package metadata without using raw key strings.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:58:08.631Z","updated_at":"2026-08-18T20:58:08.631Z","completed_at":null,"summary":{"id":"7478a515-ea8e-4360-93b8-a10cf0642d88","topic":"npm Registry API documentation and developer endpoints","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:58:08.631Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
+{"id":"f9757282-dad8-4c3b-b44d-c796555468c5","topic":"Supabase Client, Auth, and REST APIs","status":"pending","priority":"medium","notes":"Use official Supabase documentation to understand authentication, database, and storage API surfaces.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:57:04.280Z","updated_at":"2026-08-18T20:57:04.280Z","completed_at":null,"summary":{"id":"f9757282-dad8-4c3b-b44d-c796555468c5","topic":"Supabase Client, Auth, and REST APIs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:57:04.280Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
+{"id":"e196b27d-c799-4e60-88d0-585c479b6053","topic":"Supabase Database, Auth, Storage, and Management APIs","status":"pending","priority":"medium","notes":"Consult official Supabase documentation for REST API, SDK, and platform integration; do not use raw secret key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:56:34.347Z","updated_at":"2026-08-18T20:56:34.347Z","completed_at":null,"summary":{"id":"e196b27d-c799-4e60-88d0-585c479b6053","topic":"Supabase Database, Auth, Storage, and Management APIs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:56:34.347Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
+{"id":"f6c787c9-212c-4468-a276-5af7d7d78dbc","topic":"Supabase REST API and Client SDKs","status":"pending","priority":"medium","notes":"Use official Supabase documentation for client SDKs, REST API, Database, and Auth endpoints. Do not search using raw key values.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:56:21.400Z","updated_at":"2026-08-18T20:56:21.400Z","completed_at":null,"summary":{"id":"f6c787c9-212c-4468-a276-5af7d7d78dbc","topic":"Supabase REST API and Client SDKs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:56:21.400Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
+{"id":"c95b76a3-9bd3-42fd-8c37-0765cabef6a8","topic":"Documenso document signing and template REST API","status":"pending","priority":"medium","notes":"Consult official Documenso documentation for REST API endpoints, document signing workflows, and API key authentication. Do not query using the raw key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:55:37.372Z","updated_at":"2026-08-18T20:55:37.372Z","completed_at":null,"summary":{"id":"c95b76a3-9bd3-42fd-8c37-0765cabef6a8","topic":"Documenso document signing and template REST API","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:55:37.372Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
+{"id":"9b1f9703-76c3-4743-916a-a3340c2b74f4","topic":"Claude Code messaging API and CLI integration","status":"pending","priority":"medium","notes":"Consult official Anthropic Claude Code documentation for API and integration details; do not use the raw key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:55:25.048Z","updated_at":"2026-08-18T20:55:25.048Z","completed_at":null,"summary":{"id":"9b1f9703-76c3-4743-916a-a3340c2b74f4","topic":"Claude Code messaging API and CLI integration","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:55:25.048Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
+{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","priority":"high","notes":"Queued from repo-wide analysis request on 2026-06-01. Focus on current best practices and meta-patterns for filesystem-native memory OS, validated operation envelopes, append-only logs, cache invalidation, research queue architecture, and secure local-first AI tools.","node_slug":null,"research_phase":"acquisition","created_at":"2026-06-01T06:07:40.102Z","updated_at":"2026-06-01T06:07:40.126Z","completed_at":null,"summary":{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","phase":"acquisition","last_updated":"2026-06-01T06:07:40.126Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}