npm - total-recall-brain - Versions diffs - 3.24.2 → 3.25.1 - Mend

total-recall-brain 3.24.2 → 3.25.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/docs/ARCHITECTURE.md +5 -5
package/frontend/dist/assets/{index-BQL-opnK.js → index-DWCNvgnv.js} +128 -128
package/frontend/dist/index.html +1 -1
package/frontend/src/api/mesh.ts +24 -0
package/frontend/src/api/system.ts +26 -0
package/frontend/src/api/update.ts +16 -0
package/frontend/src/components/TailnetEnroll.spec.tsx +118 -0
package/frontend/src/components/TailnetEnroll.tsx +237 -0
package/frontend/src/components/brand/BrandMark.tsx +1 -1
package/frontend/src/index.css +1 -1
package/frontend/src/pages/SettingsPage.spec.tsx +31 -0
package/frontend/src/pages/SettingsPage.tsx +59 -2
package/package.json +1 -1
package/scaffold/.agent/skills/total-recall/SKILL.md +3 -2
package/scaffold/.agent/skills/total-recall/references/api-reference.md +1 -1
package/scaffold/.agent/skills/total-recall/references/cli-reference.md +1 -1
package/scaffold/.agent/skills/total-recall/skills-registry/index.yaml +3 -2461
package/src/cli/mesh.mjs +9 -0
package/src/core/server-restart.mjs +130 -0
package/src/server/route-manifest.json +8 -0
package/src/server/routes/mesh.mjs +40 -0
package/src/server/routes/system.mjs +38 -1
package/src/server/routes/update.mjs +67 -8

package/frontend/dist/index.html CHANGED Viewed

@@ -17,7 +17,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-BQL-opnK.js"></script>
+    <script type="module" crossorigin src="/assets/index-DWCNvgnv.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-C7_Xpk27.css">
   </head>
   <body>

package/frontend/src/api/mesh.ts CHANGED Viewed

@@ -306,3 +306,27 @@ export async function registerLanMeshNodes(opts?: { probe?: boolean; limit?: num
     limit: opts?.limit ?? 32,
   });
 }
+/** A short-lived bearer credential that lets a NEW device join the tailnet. */
+export interface PreAuthKey {
+  success: boolean;
+  key: string;
+  expiration: string;
+  reusable: boolean;
+  ephemeral: boolean;
+  ttl_minutes: number;
+  /** Control-server URL to enter on the device. Never carries the token. */
+  login_server: string | null;
+}
+export async function mintPreAuthKey(opts?: {
+  reusable?: boolean;
+  ephemeral?: boolean;
+  ttlMinutes?: number;
+}): Promise<PreAuthKey> {
+  return post('/api/mesh/preauthkey', {
+    reusable: opts?.reusable === true,
+    ephemeral: opts?.ephemeral === true,
+    ttlMinutes: opts?.ttlMinutes,
+  });
+}

package/frontend/src/api/system.ts CHANGED Viewed

@@ -77,6 +77,32 @@ export async function restartDaemon(): Promise<{ success: boolean; message: stri
   return res.json()
 }
+export interface RestartResult {
+  success: boolean
+  scheduled: boolean
+  message: string
+  supervisor?: { supervised: boolean; kind: string | null; label: string | null; reason: string }
+}
+/**
+ * Restart the brain server itself. Answers 409 on a host where nothing would
+ * respawn the process — that is a real answer, not a failure, so the message is
+ * surfaced rather than thrown.
+ */
+export async function restartServer(): Promise<RestartResult> {
+  const res = await apiFetch(`${API_BASE}/api/server/restart`, { method: 'POST' })
+  const data = await res.json().catch(() => ({}))
+  if (!res.ok && res.status !== 409) {
+    throw new Error(data.message || data.error || `Restart server API error: ${res.status}`)
+  }
+  return {
+    success: Boolean(data.success),
+    scheduled: Boolean(data.scheduled),
+    message: data.message || (data.scheduled ? 'Server restarting.' : 'Server did not restart.'),
+    supervisor: data.supervisor,
+  }
+}
 export async function fetchBrains(): Promise<Record<string, unknown>[]> {
   const res = await apiFetch(`${API_BASE}/api/brains`)
   const data = await res.json()

package/frontend/src/api/update.ts CHANGED Viewed

@@ -22,9 +22,18 @@ export async function checkUpdate(): Promise<UpdateCheckResult> {
   }
 }
+export interface UpdateRestartInfo {
+  /** true when the update replaced the code this server is running */
+  required: boolean
+  /** true when a restart into that code has been scheduled */
+  scheduled: boolean
+  reason: string
+}
 export async function runUpdate(): Promise<{
   success: boolean
   message: string
+  restart?: UpdateRestartInfo
   summary?: {
     latest?: string
     updated?: number
@@ -49,6 +58,13 @@ export async function runUpdate(): Promise<{
   return {
     success,
     message: data.message || (success ? 'Package auto-update finished' : 'Package auto-update failed'),
+    restart: data.restart
+      ? {
+          required: Boolean(data.restart.required),
+          scheduled: Boolean(data.restart.scheduled),
+          reason: String(data.restart.reason ?? ''),
+        }
+      : undefined,
     summary: data.summary,
   }
 }

package/frontend/src/components/TailnetEnroll.spec.tsx ADDED Viewed

@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, waitFor, fireEvent } from '@testing-library/react';
+import { TailnetEnroll } from './TailnetEnroll';
+vi.mock('../api/mesh', () => ({
+  fetchNodes: vi.fn(),
+  fetchEnrollmentStatus: vi.fn(),
+  mintPreAuthKey: vi.fn(),
+}));
+import { fetchNodes, fetchEnrollmentStatus, mintPreAuthKey } from '../api/mesh';
+const node = (over = {}) => ({
+  hostname: 'laptop', ip: '100.64.0.3', online: true, self: false, os: 'macOS', ...over,
+});
+describe('TailnetEnroll', () => {
+  beforeEach(() => {
+    vi.mocked(fetchNodes).mockResolvedValue([node(), node({ hostname: 'macmini', ip: '100.64.0.2', self: true })] as never);
+    vi.mocked(fetchEnrollmentStatus).mockResolvedValue({ login_server: 'https://control.example.org' } as never);
+    vi.mocked(mintPreAuthKey).mockResolvedValue({
+      success: true,
+      key: 'hskey-auth-TESTKEY',
+      expiration: new Date(Date.now() + 60_000).toISOString(),
+      reusable: false,
+      ephemeral: true,
+      ttl_minutes: 15,
+      login_server: 'https://headscale.example.com',
+    } as never);
+  });
+  it('shows the control server and phone steps BEFORE any key is minted', async () => {
+    // The regression: instructions lived inside the `minted` branch behind a
+    // collapsed <details>, so step one -- the URL you must enter on the phone
+    // -- was invisible until a 15-minute countdown was already running.
+    render(<TailnetEnroll />);
+    expect(await screen.findByTestId('enroll-instructions')).toBeTruthy();
+    expect((await screen.findByTestId('enroll-login-server')).textContent).toContain(
+      'https://control.example.org',
+    );
+    expect(screen.getByText(/On a phone/i)).toBeTruthy();
+    expect(mintPreAuthKey).not.toHaveBeenCalled();
+  });
+  it('takes the control server from config, not from a minted key', async () => {
+    render(<TailnetEnroll />);
+    await waitFor(() =>
+      expect(screen.getByTestId('enroll-login-server').textContent).toContain('control.example.org'),
+    );
+    expect(fetchEnrollmentStatus).toHaveBeenCalled();
+  });
+  it('says what to do when no control server is configured', async () => {
+    vi.mocked(fetchEnrollmentStatus).mockResolvedValue({ login_server: null } as never);
+    render(<TailnetEnroll />);
+    await waitFor(() =>
+      expect(screen.getByTestId('enroll-login-server').textContent).toMatch(/not configured/i),
+    );
+  });
+  it('keeps the Reset Keychain step visible — skipping it is why sign-in reverts to the public service', async () => {
+    render(<TailnetEnroll />);
+    expect(await screen.findByText(/Reset Keychain/i)).toBeTruthy();
+  });
+  it('lists mesh nodes', async () => {
+    render(<TailnetEnroll />);
+    await waitFor(() => expect(screen.getByTestId('enroll-node-list')).toHaveTextContent('laptop'));
+    expect(screen.getByTestId('enroll-node-list')).toHaveTextContent('macmini');
+  });
+  it('mints a key and shows a QR to scan', async () => {
+    render(<TailnetEnroll />);
+    fireEvent.click(screen.getByTestId('enroll-mint'));
+    await waitFor(() => expect(screen.getByTestId('enroll-qr').querySelector('svg')).toBeTruthy());
+    expect(screen.getByTestId('enroll-copy')).toBeTruthy();
+  });
+  it('config wins over the minted key for the control server URL', async () => {
+    // Deliberate precedence: the key echoes back whatever server issued it,
+    // but config is the source of truth and is available before any mint.
+    render(<TailnetEnroll />);
+    fireEvent.click(screen.getByTestId('enroll-mint'));
+    await waitFor(() => expect(screen.getByTestId('enroll-copy')).toBeTruthy());
+    expect(screen.getByTestId('enroll-login-server')).toHaveTextContent('control.example.org');
+  });
+  it('passes the reusable and ephemeral choices through to the API', async () => {
+    render(<TailnetEnroll />);
+    fireEvent.click(screen.getByTestId('enroll-reusable'));
+    fireEvent.click(screen.getByTestId('enroll-mint'));
+    await waitFor(() => expect(mintPreAuthKey).toHaveBeenCalledWith({ reusable: true, ephemeral: false }));
+  });
+  // A key is a bearer credential with a short TTL; a dead one must not sit on
+  // screen looking scannable.
+  it('marks the key expired once its TTL has elapsed', async () => {
+    vi.mocked(mintPreAuthKey).mockResolvedValue({
+      success: true, key: 'hskey-auth-OLD', expiration: new Date(Date.now() - 1000).toISOString(),
+      reusable: false, ephemeral: false, ttl_minutes: 15, login_server: 'https://headscale.example.com',
+    } as never);
+    render(<TailnetEnroll />);
+    fireEvent.click(screen.getByTestId('enroll-mint'));
+    await waitFor(() => expect(screen.getByTestId('enroll-ttl')).toHaveTextContent('expired'));
+    expect(screen.getByTestId('enroll-qr')).toHaveTextContent('Key expired');
+  });
+  it('surfaces a mint failure instead of silently doing nothing', async () => {
+    vi.mocked(mintPreAuthKey).mockRejectedValue(new Error('headscale unreachable'));
+    render(<TailnetEnroll />);
+    fireEvent.click(screen.getByTestId('enroll-mint'));
+    await waitFor(() => expect(screen.getByTestId('tailnet-enroll-error')).toHaveTextContent('headscale unreachable'));
+  });
+  it('warns about nodes with no recorded login account', async () => {
+    render(<TailnetEnroll />);
+    await waitFor(() => expect(screen.getByTestId('enroll-access-warning')).toHaveTextContent('no recorded login account'));
+  });
+});

package/frontend/src/components/TailnetEnroll.tsx ADDED Viewed

@@ -0,0 +1,237 @@
+import { useEffect, useState } from 'react';
+import { QRCodeSVG } from 'qrcode.react';
+import { fetchNodes, fetchEnrollmentStatus, mintPreAuthKey } from '../api/mesh';
+import type { MeshNode, PreAuthKey } from '../api/mesh';
+/**
+ * Add a device (phone, tablet, another machine) to the self-hosted tailnet.
+ *
+ * Enrolling a phone had no UI at all: `/api/mesh/enroll` only ever enrolls the
+ * host the server runs on, so the only way to add a device was
+ * `total-recall mesh preauthkey` — a CLI, which is exactly what you do not have
+ * on the device you are trying to enroll.
+ */
+export function TailnetEnroll() {
+  const [nodes, setNodes] = useState<MeshNode[]>([]);
+  const [minted, setMinted] = useState<PreAuthKey | null>(null);
+  const [reusable, setReusable] = useState(false);
+  const [ephemeral, setEphemeral] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+  const [serverCopied, setServerCopied] = useState(false);
+  const [secondsLeft, setSecondsLeft] = useState<number | null>(null);
+  // The control-server URL is the FIRST thing you need on the phone, and it is
+  // config, not a property of a key. Reading it only off a minted key meant the
+  // URL stayed invisible until a 15-minute countdown was already running.
+  const [controlServer, setControlServer] = useState<string | null>(null);
+  useEffect(() => {
+    fetchNodes()
+      .then(setNodes)
+      .catch((e) => setError(e?.message ?? 'could not load nodes'));
+    fetchEnrollmentStatus()
+      .then((st) => setControlServer(st.login_server))
+      .catch(() => setControlServer(null));
+  }, []);
+  // An enrollment key is a bearer credential with a short TTL. Show the time
+  // remaining rather than leaving a dead key on screen looking usable.
+  useEffect(() => {
+    if (!minted) return undefined;
+    const tick = () => {
+      const ms = new Date(minted.expiration).getTime() - Date.now();
+      setSecondsLeft(Math.max(0, Math.floor(ms / 1000)));
+    };
+    tick();
+    const id = setInterval(tick, 1000);
+    return () => clearInterval(id);
+  }, [minted]);
+  const mint = async () => {
+    setBusy(true);
+    setError(null);
+    setCopied(false);
+    try {
+      setMinted(await mintPreAuthKey({ reusable, ephemeral }));
+    } catch (e) {
+      setError(e instanceof Error ? e.message : 'could not mint an enrollment key');
+    } finally {
+      setBusy(false);
+    }
+  };
+  const expired = secondsLeft !== null && secondsLeft <= 0;
+  const loginServer = controlServer ?? minted?.login_server ?? null;
+  // `complete` is the resolver's own verdict: false when the login account is
+  // unknown and the node would refuse you. No resolved access at all counts as
+  // unknown too. (There is no `ssh_user` field — the account is `user`.)
+  const unknownAccess = nodes.filter((n) => !n.self && n.access_resolved?.complete !== true);
+  return (
+    <section data-testid="tailnet-enroll" style={{ marginTop: 24 }}>
+      <h3 style={{ marginBottom: 4 }}>Add a device to the tailnet</h3>
+      <p style={{ fontSize: 12, opacity: 0.75, marginTop: 0 }}>
+        Point the device at this control server, then authenticate it with a short-lived key.
+      </p>
+      {/*
+        Instructions come BEFORE the key and are open by default. They used to
+        live inside the `minted` branch behind a collapsed <details>, so the
+        control-server URL -- step one, and the thing you cannot proceed
+        without -- was invisible until a 15-minute countdown was already
+        running. Nothing here is hardcoded: the URL is whatever the brain's
+        config resolves to.
+      */}
+      <div
+        data-testid="enroll-instructions"
+        style={{ margin: '12px 0', padding: 14, borderRadius: 8, border: '1px solid var(--border)', background: 'var(--bg-secondary)' }}
+      >
+        <div style={{ fontSize: 12, marginBottom: 10 }}>
+          <strong>Control server</strong>
+          <div style={{ display: 'flex', gap: 8, alignItems: 'center', marginTop: 4 }}>
+            <code data-testid="enroll-login-server" style={{ wordBreak: 'break-all', flex: 1 }}>
+              {loginServer ?? 'not configured — set the Headscale URL in Secrets first'}
+            </code>
+            {loginServer && (
+              <button
+                type="button"
+                data-testid="enroll-copy-server"
+                onClick={() => { navigator.clipboard?.writeText(loginServer); setServerCopied(true); }}
+              >
+                {serverCopied ? 'Copied' : 'Copy'}
+              </button>
+            )}
+          </div>
+        </div>
+        <details open style={{ fontSize: 12 }}>
+          <summary style={{ cursor: 'pointer', fontWeight: 600 }}>On a phone (iOS)</summary>
+          <ol style={{ paddingLeft: 18, lineHeight: 1.7, marginBottom: 6 }}>
+            <li>Install <strong>Tailscale</strong> from the App Store — <strong>1.38.1 or newer</strong>, the first release that supports an alternate control server.</li>
+            <li>
+              <strong>Sign out of Tailscale first.</strong> The alternate-server setting is only read while
+              the app is logged out.
+            </li>
+            <li>
+              Open <strong>iOS Settings</strong>, scroll past Game Center and TV Provider to{' '}
+              <strong>Tailscale</strong>, and put the control server above into{' '}
+              <strong>Alternate Coordination Server URL</strong>.
+            </li>
+            <li>
+              <strong>If this device was ever signed into Tailscale's own service, turn on “Reset Keychain”.</strong>{' '}
+              Skipping this is the usual reason the app keeps going back to the public login.
+            </li>
+            <li>Force-quit Tailscale from the app switcher, then reopen it — the setting is read at launch.</li>
+            <li>Tap the plain <strong>Sign in</strong> option (not SSO). It should open this control server's page.</li>
+            <li>Authenticate with the key below.</li>
+          </ol>
+          <p style={{ opacity: 0.75, margin: 0 }}>
+            The in-app route — account icon → <strong>Log in…</strong> → options menu →{' '}
+            <strong>Use custom coordination server</strong> — reaches the same place when it works, but that
+            menu has been reported unresponsive on some builds. The Settings route above is the reliable one.
+          </p>
+        </details>
+        <details style={{ fontSize: 12, marginTop: 8 }}>
+          <summary style={{ cursor: 'pointer', fontWeight: 600 }}>On Android</summary>
+          <ol style={{ paddingLeft: 18, lineHeight: 1.7, margin: '4px 0 0' }}>
+            <li>Install Tailscale from Google Play and make sure it is signed out.</li>
+            <li>Open the app, tap the account icon, then <strong>Log in…</strong>.</li>
+            <li>Open the top-right options menu → <strong>Use custom coordination server</strong>.</li>
+            <li>Enter the control server above, then authenticate with the key below.</li>
+          </ol>
+        </details>
+      </div>
+      {error && (
+        <div
+          role="alert"
+          data-testid="tailnet-enroll-error"
+          style={{ margin: '10px 0', padding: 10, borderRadius: 8, border: '1px solid #ef4444', color: '#ef4444', fontSize: 12 }}
+        >
+          {error}
+        </div>
+      )}
+      <div style={{ display: 'flex', gap: 16, alignItems: 'center', flexWrap: 'wrap', margin: '12px 0' }}>
+        <label style={{ fontSize: 12, display: 'flex', gap: 6, alignItems: 'center' }}>
+          <input type="checkbox" checked={reusable} onChange={(e) => setReusable(e.target.checked)} data-testid="enroll-reusable" />
+          Reusable (enroll more than one device)
+        </label>
+        <label style={{ fontSize: 12, display: 'flex', gap: 6, alignItems: 'center' }}>
+          <input type="checkbox" checked={ephemeral} onChange={(e) => setEphemeral(e.target.checked)} data-testid="enroll-ephemeral" />
+          Ephemeral (drops off the list when offline)
+        </label>
+        <button type="button" onClick={mint} disabled={busy} data-testid="enroll-mint" style={{ cursor: busy ? 'wait' : 'pointer' }}>
+          {busy ? 'Minting…' : minted ? 'Mint another key' : 'Get enrollment key'}
+        </button>
+      </div>
+      {minted && (
+        <div style={{ display: 'flex', gap: 20, flexWrap: 'wrap', alignItems: 'flex-start' }}>
+          <div style={{ background: '#fff', padding: 16, borderRadius: 8 }} data-testid="enroll-qr">
+            {expired ? (
+              <div style={{ width: 150, height: 150, display: 'flex', alignItems: 'center', justifyContent: 'center', color: '#ef4444', fontSize: 12, textAlign: 'center' }}>
+                Key expired — mint another
+              </div>
+            ) : (
+              <QRCodeSVG value={minted.key} size={150} level="M" includeMargin />
+            )}
+          </div>
+          <div style={{ flex: 1, minWidth: 260 }}>
+            <div style={{ fontSize: 12, marginBottom: 6 }}>
+              <strong>Enrollment key</strong>{' '}
+              <span data-testid="enroll-ttl" style={{ opacity: 0.7 }}>
+                {expired ? '(expired)' : `(expires in ${secondsLeft}s, ${minted.reusable ? 'reusable' : 'single-use'})`}
+              </span>
+              <div style={{ display: 'flex', gap: 8, alignItems: 'center', marginTop: 4 }}>
+                <code style={{ wordBreak: 'break-all', flex: 1, opacity: expired ? 0.4 : 1 }}>{minted.key}</code>
+                <button
+                  type="button"
+                  disabled={expired}
+                  onClick={() => { navigator.clipboard?.writeText(minted.key); setCopied(true); }}
+                  data-testid="enroll-copy"
+                >
+                  {copied ? 'Copied' : 'Copy'}
+                </button>
+              </div>
+            </div>
+            <details style={{ fontSize: 12, marginTop: 6 }}>
+              <summary style={{ cursor: 'pointer' }}>On a computer</summary>
+              <pre style={{ whiteSpace: 'pre-wrap', wordBreak: 'break-all' }}>
+{`tailscale up --login-server ${loginServer ?? '<control-server>'} --authkey ${expired ? '<expired — mint another>' : minted.key}`}
+              </pre>
+              <p style={{ opacity: 0.75 }}>
+                Always pass <code>--login-server</code> alongside any <code>--reset</code>, or the client
+                silently repoints at the public Tailscale control plane.
+              </p>
+            </details>
+          </div>
+        </div>
+      )}
+      <div style={{ marginTop: 20 }}>
+        <h4 style={{ marginBottom: 6 }}>Nodes ({nodes.length})</h4>
+        <ul data-testid="enroll-node-list" style={{ listStyle: 'none', padding: 0, fontSize: 12, margin: 0 }}>
+          {nodes.map((n) => (
+            <li key={`${n.hostname}-${n.ip ?? 'noip'}`} style={{ padding: '4px 0', display: 'flex', gap: 8 }}>
+              <span title={n.online ? 'online' : 'offline'}>{n.online ? '🟢' : '⚪️'}</span>
+              <strong>{n.hostname}</strong>
+              <code style={{ opacity: 0.75 }}>{n.ip ?? '—'}</code>
+              {n.self && <span style={{ opacity: 0.6 }}>(this host)</span>}
+            </li>
+          ))}
+        </ul>
+        {unknownAccess.length > 0 && (
+          <p data-testid="enroll-access-warning" style={{ fontSize: 12, color: '#f59e0b', marginBottom: 0 }}>
+            {unknownAccess.length} node(s) have no recorded login account — connecting to one fails as
+            though it were unreachable. Run <code>total-recall mesh access import</code>.
+          </p>
+        )}
+      </div>
+    </section>
+  );
+}

package/frontend/src/components/brand/BrandMark.tsx CHANGED Viewed

@@ -1,4 +1,4 @@
-/** Official Total Recall brand marks from portfolio-site assets/logos. */
+/** Official Total Recall brand marks. */
 export type BrandVariant = 'lockup' | 'icon' | 'badge' | 'mark'

package/frontend/src/index.css CHANGED Viewed

@@ -1,6 +1,6 @@
 /* ═══════════════════════════════════════════════════════════════════════════════
    Total Recall — Design System (premium · brand blue vault)
-   Brand mark: portfolio-site/assets/logos/total-recall.png (cube lockup)
+   Brand mark: the Total Recall cube lockup.
    ═══════════════════════════════════════════════════════════════════════════════ */
 :root {

package/frontend/src/pages/SettingsPage.spec.tsx CHANGED Viewed

@@ -54,4 +54,35 @@ describe('SettingsPage', () => {
     expect(await screen.findByTestId('settings-error')).toBeInTheDocument();
     expect(screen.getByText(/Config JSON API error: 500/i)).toBeInTheDocument();
   }, 10000);
+  it('restarts the server from the UI and reports the outcome', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    vi.mocked(api.fetchConfigJson).mockResolvedValue({
+      security: { bind: {}, network: {}, rate_limits: {}, sandbox: {}, dashboard: {}, api: {} },
+      budget: { budget: {} },
+      brain: {},
+      secrets: {},
+    } as never);
+    vi.mocked(api.fetchHealth).mockResolvedValue({ status: 'healthy', version: '1.0.0' } as never);
+    vi.mocked(api.checkUpdate).mockResolvedValue({ updateAvailable: false } as never);
+    vi.mocked(api.restartServer).mockResolvedValue({
+      success: false,
+      scheduled: false,
+      message: 'refusing to exit: no supervisor would restart this process',
+    } as never);
+    await act(async () => {
+      render(<SettingsPage />);
+    });
+    const button = await screen.findByTestId('restart-server', {}, { timeout: 4000 });
+    await act(async () => {
+      button.click();
+    });
+    expect(api.restartServer).toHaveBeenCalled();
+    // An unsupervised host is a real answer, surfaced verbatim — not swallowed
+    // and not presented as a successful restart.
+    expect(screen.getByText(/refusing to exit/i)).toBeInTheDocument();
+  }, 10000);
 });

package/frontend/src/pages/SettingsPage.tsx CHANGED Viewed

@@ -7,6 +7,7 @@ import {
   checkUpdate,
   runUpdate,
   restartDaemon,
+  restartServer,
   triggerRecompile,
   apiFetch,
   getApiBase,
@@ -14,6 +15,7 @@ import {
 import type { HealthData } from '../types';
 import type { ConfigJson } from '../types';
 import { MobilePairing } from '../components/MobilePairing';
+import { TailnetEnroll } from '../components/TailnetEnroll';
 function normalizeConfigJson(data: ConfigJson): ConfigJson {
   const next = { ...data } as ConfigJson & Record<string, unknown>;
@@ -52,6 +54,40 @@ export default function SettingsPage({ activeBrainId }: { activeBrainId?: string
   const [updating, setUpdating] = useState(false);
   const [updateMessage, setUpdateMessage] = useState<string | null>(null);
   const [restartingDaemon, setRestartingDaemon] = useState(false);
+  const [restartingServer, setRestartingServer] = useState(false);
+  const handleRestartServer = async () => {
+    setRestartingServer(true);
+    setUpdateMessage(null);
+    try {
+      const res = await restartServer();
+      setUpdateMessage(res.message);
+      if (res.scheduled) {
+        // The server is about to drop this connection on purpose. Poll health
+        // until it answers again instead of leaving the page looking hung.
+        setTimeout(function poll(attempt = 0) {
+          fetchHealth()
+            .then((h) => {
+              setHealth(h);
+              setUpdateMessage('Server restarted — reconnected.');
+              setRestartingServer(false);
+            })
+            .catch(() => {
+              if (attempt >= 20) {
+                setUpdateMessage('Server restarted but has not answered yet — reload in a moment.');
+                setRestartingServer(false);
+                return;
+              }
+              setTimeout(() => poll(attempt + 1), 1500);
+            });
+        }, 2000);
+        return;
+      }
+    } catch (err: unknown) {
+      setUpdateMessage('Restart error: ' + (err as Error).message);
+    }
+    setRestartingServer(false);
+  };
   const handleRestartDaemon = async () => {
     setRestartingDaemon(true);
@@ -141,10 +177,17 @@ export default function SettingsPage({ activeBrainId }: { activeBrainId?: string
           s?.up_to_date != null ? `${s.up_to_date} current` : null,
           s?.latest ? `latest ${s.latest}` : null,
         ].filter(Boolean);
+        // Say what actually happened to this server, rather than telling the
+        // user to go work out whether a restart is needed.
+        const restartNote = res.restart?.scheduled
+          ? ' Server is restarting into the new code.'
+          : res.restart?.required
+            ? ` Server still runs the old code — ${res.restart.reason}`
+            : '';
         setUpdateMessage(
           bits.length
-            ? `Update complete — ${bits.join(' · ')}. Restart daemon/server if this host still runs old code.`
-            : res.message || 'Update complete.',
+            ? `Update complete — ${bits.join(' · ')}.${restartNote}`
+            : (res.message || 'Update complete.') + restartNote,
         );
       } else {
         const failDetail = (res.summary?.results || [])
@@ -559,6 +602,10 @@ export default function SettingsPage({ activeBrainId }: { activeBrainId?: string
           <MobilePairing />
         </div>
+        <div className="settings-card glow-on-hover">
+          <TailnetEnroll />
+        </div>
         {/* --- Global System Layer --- */}
         {/* Network & Binding */}
         <div className="settings-card">
@@ -1010,6 +1057,16 @@ export default function SettingsPage({ activeBrainId }: { activeBrainId?: string
               >
                 {restartingDaemon ? 'Restarting…' : 'Restart Daemon'}
               </button>
+              <button
+                className="btn-secondary"
+                onClick={handleRestartServer}
+                disabled={restartingServer}
+                data-testid="restart-server"
+                title="Restart the brain server so newly installed code is the code that runs"
+                style={{ fontSize: 13, padding: '8px 14px', borderRadius: 8, cursor: 'pointer' }}
+              >
+                {restartingServer ? 'Restarting…' : 'Restart Server'}
+              </button>
               <button
                 className="btn-primary"
                 onClick={handleRunUpdate}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.24.2",
+  "version": "3.25.1",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/scaffold/.agent/skills/total-recall/SKILL.md CHANGED Viewed

@@ -591,8 +591,9 @@ Current baseline: **288 spec files / 1493 tests, ~160 s** on the Mac Mini.
 > and OOM kills. Sync and run remotely:
 >
 > ```bash
-> rsync -a --delete --exclude=node_modules/ --exclude=.git/ ./ mac-mini:~/github/total-recall/
-> ssh mac-mini 'export PATH=/opt/homebrew/bin:$PATH; cd ~/github/total-recall && npx vitest run'
+> REMOTE=build-host; REMOTE_DIR=code/total-recall   # your own host and path
+> rsync -a --delete --exclude=node_modules/ --exclude=.git/ ./ "$REMOTE:$REMOTE_DIR/"
+> ssh "$REMOTE" "export PATH=/opt/homebrew/bin:\$PATH; cd $REMOTE_DIR && npx vitest run"
 > ```
 >
 > A non-login `ssh` shell has no Homebrew on PATH — export it or use `bash -lc`,

package/scaffold/.agent/skills/total-recall/references/api-reference.md CHANGED Viewed

@@ -43,7 +43,7 @@ Returns the status of the vault, embeddings index, and LLM reachability.
       "vfs": {
         "exists": true,
         "skill_exists": true,
-        "path": "/Users/greg/.agent"
+        "path": "<home>/.agent"
       }
     }
     ```

package/scaffold/.agent/skills/total-recall/references/cli-reference.md CHANGED Viewed

@@ -23,7 +23,7 @@ Rebuild the derived indexes and compile memory surfaces.
 ### 1.3 `connect`
 Configure an IDE or external client to bind to the Total Recall local server.
 *   **Syntax**: `npx total-recall connect <client> [options]`
-*   **Supported Clients**: `cursor`, `claude-code`, `antigravity`, `gemini`, `vscode`, `windsurf`, `aider`, `ultrachat`, `obsidian`.
+*   **Supported Clients**: `vscode`, `cursor`, `cline`, `codex`, `antigravity`, `gemini`, `aider`, `obsidian`, `pi`, `hermes`, `openclaw`, `generic`.
 *   **Options**:
     *   `--brain <url>`: Override default brain server URL.
     *   `--token <PAT>`: Inject bearer PAT credentials for authenticating requests.