total-recall-brain 3.25.1 → 3.25.2

package/frontend/dist/index.html

@@ -17,7 +17,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-DWCNvgnv.js"></script>
+    <script type="module" crossorigin src="/assets/index-wFSsoOKK.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-C7_Xpk27.css">
   </head>
   <body>

package/frontend/src/api/mesh.ts

@@ -1,4 +1,4 @@
-import { get, post } from './_base';
+import { get, post, apiFetch, API_BASE } from './_base';
 
 export interface MeshInterfaceSummary {
   name: string;
@@ -278,6 +278,31 @@ export interface EnrollResult {
 }
 
 /** Enrollment state of this node on the mesh control server. */
+export interface RegisteredNode {
+  success: boolean;
+  user?: string;
+  message: string;
+  node?: { id: string | null; name: string | null; ip_addresses: string[]; online: boolean } | null;
+}
+
+/**
+ * Approve a device that registered interactively.
+ *
+ * iOS has no other option: the upstream Tailscale app refuses pre-auth keys
+ * against a custom control server, so a phone always ends up on headscale's
+ * "run this on the server" page waiting for approval.
+ */
+export async function registerNode(authId: string, user?: string): Promise<RegisteredNode> {
+  const res = await apiFetch(`${API_BASE}/api/mesh/register-node`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ auth_id: authId, ...(user ? { user } : {}) }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(data.message || `register failed: ${res.status}`);
+  return data as RegisteredNode;
+}
+
 export async function fetchEnrollmentStatus(): Promise<EnrollmentStatus> {
   return get('/api/mesh/enrollment');
 }

package/frontend/src/components/TailnetEnroll.spec.tsx

@@ -37,7 +37,7 @@ describe('TailnetEnroll', () => {
     expect((await screen.findByTestId('enroll-login-server')).textContent).toContain(
       'https://control.example.org',
     );
-    expect(screen.getByText(/On a phone/i)).toBeTruthy();
+    expect(screen.getByText('On a phone (iOS)')).toBeTruthy();
     expect(mintPreAuthKey).not.toHaveBeenCalled();
   });
 

package/frontend/src/components/TailnetEnroll.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useState } from 'react';
 import { QRCodeSVG } from 'qrcode.react';
-import { fetchNodes, fetchEnrollmentStatus, mintPreAuthKey } from '../api/mesh';
+import { fetchNodes, fetchEnrollmentStatus, mintPreAuthKey, registerNode } from '../api/mesh';
 import type { MeshNode, PreAuthKey } from '../api/mesh';
 
 /**
@@ -25,6 +25,9 @@ export function TailnetEnroll() {
   // config, not a property of a key. Reading it only off a minted key meant the
   // URL stayed invisible until a 15-minute countdown was already running.
   const [controlServer, setControlServer] = useState<string | null>(null);
+  const [authId, setAuthId] = useState('');
+  const [approving, setApproving] = useState(false);
+  const [approved, setApproved] = useState<string | null>(null);
 
   useEffect(() => {
     fetchNodes()
@@ -61,6 +64,26 @@ export function TailnetEnroll() {
     }
   };
 
+  const approve = async () => {
+    setApproving(true);
+    setError(null);
+    setApproved(null);
+    try {
+      // Accept a pasted whole command as well as a bare id — the device shows
+      // the id inside `headscale nodes register --user X --key <id>`, and
+      // making someone extract a substring by hand is a needless failure.
+      const match = authId.match(/hskey-authreq-[A-Za-z0-9._-]+/);
+      const res = await registerNode(match ? match[0] : authId.trim());
+      setApproved(res.message);
+      setAuthId('');
+      setNodes(await fetchNodes().catch(() => nodes));
+    } catch (e) {
+      setError(e instanceof Error ? e.message : 'could not approve device');
+    } finally {
+      setApproving(false);
+    }
+  };
+
   const expired = secondsLeft !== null && secondsLeft <= 0;
   const loginServer = controlServer ?? minted?.login_server ?? null;
   // `complete` is the resolver's own verdict: false when the login account is
@@ -105,6 +128,48 @@ export function TailnetEnroll() {
           </div>
         </div>
 
+        {/*
+          Approving an interactively-registered device is the ONLY route that
+          works for iOS: the upstream Tailscale app refuses a pre-auth key when
+          pointed at a custom control server, so a phone always lands on
+          headscale's "run this command on the server" page. Until this panel
+          existed, finishing that required SSH and a CLI -- on the machine you
+          are not holding.
+        */}
+        <div
+          data-testid="enroll-approve"
+          style={{ margin: '0 0 12px', padding: 12, borderRadius: 8, border: '1px solid var(--border)' }}
+        >
+          <strong style={{ fontSize: 12 }}>Device waiting for approval?</strong>
+          <p style={{ fontSize: 12, opacity: 0.75, margin: '4px 0 8px' }}>
+            If a device shows “run the command below in the headscale server”, paste that whole line
+            (or just the <code>hskey-authreq-…</code> part) here.
+          </p>
+          <div style={{ display: 'flex', gap: 8, flexWrap: 'wrap' }}>
+            <input
+              type="text"
+              value={authId}
+              onChange={(e) => setAuthId(e.target.value)}
+              placeholder="hskey-authreq-…"
+              data-testid="enroll-authid"
+              style={{ flex: 1, minWidth: 220, fontFamily: 'var(--font-mono)', fontSize: 12 }}
+            />
+            <button
+              type="button"
+              onClick={approve}
+              disabled={approving || !authId.trim()}
+              data-testid="enroll-approve-btn"
+            >
+              {approving ? 'Approving…' : 'Approve device'}
+            </button>
+          </div>
+          {approved && (
+            <p data-testid="enroll-approved" style={{ fontSize: 12, color: '#10b981', margin: '8px 0 0' }}>
+              {approved}
+            </p>
+          )}
+        </div>
+
         <details open style={{ fontSize: 12 }}>
           <summary style={{ cursor: 'pointer', fontWeight: 600 }}>On a phone (iOS)</summary>
           <ol style={{ paddingLeft: 18, lineHeight: 1.7, marginBottom: 6 }}>
@@ -119,12 +184,20 @@ export function TailnetEnroll() {
               <strong>Alternate Coordination Server URL</strong>.
             </li>
             <li>
-              <strong>If this device was ever signed into Tailscale's own service, turn on “Reset Keychain”.</strong>{' '}
-              Skipping this is the usual reason the app keeps going back to the public login.
+              <strong>Turn on “Reset Keychain”.</strong> Treat this as required, not optional. The app keeps
+              its node key in the iOS keychain and will otherwise replay an old registration id forever —
+              force-quitting does not clear it, and the server rejects the stale id every time while the
+              phone keeps showing a page that looks perfectly valid.
             </li>
             <li>Force-quit Tailscale from the app switcher, then reopen it — the setting is read at launch.</li>
             <li>Tap the plain <strong>Sign in</strong> option (not SSO). It should open this control server's page.</li>
-            <li>Authenticate with the key below.</li>
+            <li>
+              The page will say <em>“run the command below in the headscale server”</em>. That is expected —
+              copy the line it shows and paste it into <strong>Device waiting for approval?</strong> above.
+              <strong> Do not use the enrollment key below on a phone:</strong> the Tailscale iOS app does not
+              accept pre-auth keys against a custom control server, so interactive sign-in plus approval here
+              is the only route that works.
+            </li>
           </ol>
           <p style={{ opacity: 0.75, margin: 0 }}>
             The in-app route — account icon → <strong>Log in…</strong> → options menu →{' '}
@@ -139,7 +212,8 @@ export function TailnetEnroll() {
             <li>Install Tailscale from Google Play and make sure it is signed out.</li>
             <li>Open the app, tap the account icon, then <strong>Log in…</strong>.</li>
             <li>Open the top-right options menu → <strong>Use custom coordination server</strong>.</li>
-            <li>Enter the control server above, then authenticate with the key below.</li>
+            <li>Enter the control server above. If it accepts the key below, use it; if it shows a
+                “run this command” page instead, approve it above like iOS.</li>
           </ol>
         </details>
       </div>
@@ -164,7 +238,7 @@ export function TailnetEnroll() {
           Ephemeral (drops off the list when offline)
         </label>
         <button type="button" onClick={mint} disabled={busy} data-testid="enroll-mint" style={{ cursor: busy ? 'wait' : 'pointer' }}>
-          {busy ? 'Minting…' : minted ? 'Mint another key' : 'Get enrollment key'}
+          {busy ? 'Minting…' : minted ? 'Mint another key' : 'Get enrollment key (computers)'}
         </button>
       </div>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.25.1",
+  "version": "3.25.2",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/scaffold/.agent/skills/total-recall/scripts/sync-repo.mjs

@@ -135,16 +135,30 @@ function writePreservingInjectedBlock(srcFile, dstFile) {
   return 'updated';
 }
 
+// Per-brain state a template must NEVER overwrite. memory-vault was always
+// here; the rest were not, and a sync across repos would have destroyed one
+// repo's 7 queued research topics and its 68-line skills catalog. If a file
+// records what THIS brain has done, it is state, not a template.
+const STATE_DIRS = new Set([
+  'memory-vault', 'memory-derived', 'memory-inbox', 'sessions', 'logs',
+  'scheduler', 'config', 'backups', 'browser-profile', 'skills-registry',
+  '.snapshots', '.git', 'node_modules',
+]);
+const STATE_FILES = new Set([
+  'research-queue.jsonl', 'daemon.pid', '.extension-connected', 'graph.canvas',
+]);
+
 function walk(dir) {
   const out = [];
   for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
     const p = path.join(dir, e.name);
     if (e.isDirectory()) {
-      // memory-vault is the user's own memory. A template must never overwrite it.
-      if (e.name === 'memory-vault' || e.name === 'memory-derived' || e.name === 'sessions') continue;
-      if (e.name === '.git' || e.name === 'node_modules') continue;
+      if (STATE_DIRS.has(e.name)) continue;
       out.push(...walk(p));
-    } else out.push(p);
+    } else {
+      if (STATE_FILES.has(e.name) || e.name.endsWith('.enc')) continue;
+      out.push(p);
+    }
   }
   return out;
 }

package/src/server/route-manifest.json

@@ -351,6 +351,10 @@
     "method": "POST",
     "path": "/api/mesh/preauthkey"
   },
+  {
+    "method": "POST",
+    "path": "/api/mesh/register-node"
+  },
   {
     "method": "GET",
     "path": "/api/network/audit"

package/src/server/routes/mesh.mjs

@@ -16,7 +16,15 @@ import {
   readSshConfig,
   resolveNodeAccess,
 } from '../../core/mesh-access.mjs';
-import { createHeadscalePreAuthKey, resolveHeadscaleConfig } from '../../core/headscale-client.mjs';
+import {
+  createHeadscalePreAuthKey,
+  resolveHeadscaleConfig,
+  resolveHeadscaleUser,
+  headscaleFetch,
+} from '../../core/headscale-client.mjs';
+
+// headscale rejects anything else with a 500; validate up front instead.
+const AUTH_REQUEST_PREFIX = 'hskey-authreq-';
 import { throttledFetch } from '../../core/throttled-fetch.mjs';
 import { defaultVaultRoot } from '../../core/vfs-documents.mjs';
 import {
@@ -304,6 +312,63 @@ router.post('/api/mesh/preauthkey', requireAuth, requireScope('config:write'), a
   }
 });
 
+/**
+ * POST /api/mesh/register-node
+ * Approve a device that registered interactively.
+ *
+ * This is the ONLY path that works for iOS. The upstream Tailscale iOS app
+ * does not accept a pre-auth key when pointed at a custom control server, so a
+ * phone always lands on headscale's "run this command on the server" page and
+ * waits for server-side approval. Without this endpoint that approval was only
+ * reachable over SSH + CLI, which is exactly the machine the user is not
+ * holding.
+ *
+ * Body: { auth_id, user? }
+ */
+router.post('/api/mesh/register-node', requireAuth, requireScope('config:write'), async (req, res) => {
+  try {
+    const authId = String(req.body?.auth_id || '').trim();
+    if (!authId) {
+      return res.status(400).json({ success: false, message: 'auth_id is required (the hskey-authreq-… value shown on the device)' });
+    }
+    // Fail with the fix rather than passing a malformed id through to a 500.
+    if (!authId.startsWith(AUTH_REQUEST_PREFIX)) {
+      return res.status(400).json({
+        success: false,
+        message: `that does not look like a registration id — expected it to start with "${AUTH_REQUEST_PREFIX}". `
+          + 'Copy the whole value from the device screen, not the surrounding command.',
+      });
+    }
+
+    const user = await resolveHeadscaleUser(BRAIN_DIR, req.body?.user);
+    const query = `?user=${encodeURIComponent(user)}&key=${encodeURIComponent(authId)}`;
+    const result = await headscaleFetch(`/api/v1/node/register${query}`, { method: 'POST' }, BRAIN_DIR);
+    const node = (typeof result === 'string' ? JSON.parse(result) : result)?.node ?? null;
+
+    res.json({
+      success: true,
+      user,
+      node: node && {
+        id: node.id ?? null,
+        name: node.name ?? node.givenName ?? null,
+        ip_addresses: node.ipAddresses ?? [],
+        online: node.online ?? false,
+      },
+      message: node?.name ? `${node.name} joined the tailnet.` : 'Device registered.',
+    });
+  } catch (err) {
+    const msg = String(err?.message || '');
+    // headscale answers 500 for an expired/unknown id; say so in those terms.
+    const stale = /not found|expired|invalid/i.test(msg);
+    res.status(stale ? 409 : 500).json({
+      success: false,
+      message: stale
+        ? 'That registration id is no longer valid — it expires quickly. Reopen sign-in on the device to get a fresh one.'
+        : msg || 'could not register device',
+    });
+  }
+});
+
 /**
  * This host's I/O capability profile for agent UI generation
  * (screen, touch, mic, speaker, keyboard, camera, headless, …).

package/scaffold/.agent/skills/total-recall/research-queue.jsonl

@@ -1,7 +0,0 @@
-{"id":"7478a515-ea8e-4360-93b8-a10cf0642d88","topic":"npm Registry API documentation and developer endpoints","status":"pending","priority":"medium","notes":"Consult official npm documentation for registry APIs, authentication, and package metadata without using raw key strings.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:58:08.631Z","updated_at":"2026-08-18T20:58:08.631Z","completed_at":null,"summary":{"id":"7478a515-ea8e-4360-93b8-a10cf0642d88","topic":"npm Registry API documentation and developer endpoints","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:58:08.631Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"f9757282-dad8-4c3b-b44d-c796555468c5","topic":"Supabase Client, Auth, and REST APIs","status":"pending","priority":"medium","notes":"Use official Supabase documentation to understand authentication, database, and storage API surfaces.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:57:04.280Z","updated_at":"2026-08-18T20:57:04.280Z","completed_at":null,"summary":{"id":"f9757282-dad8-4c3b-b44d-c796555468c5","topic":"Supabase Client, Auth, and REST APIs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:57:04.280Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"e196b27d-c799-4e60-88d0-585c479b6053","topic":"Supabase Database, Auth, Storage, and Management APIs","status":"pending","priority":"medium","notes":"Consult official Supabase documentation for REST API, SDK, and platform integration; do not use raw secret key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:56:34.347Z","updated_at":"2026-08-18T20:56:34.347Z","completed_at":null,"summary":{"id":"e196b27d-c799-4e60-88d0-585c479b6053","topic":"Supabase Database, Auth, Storage, and Management APIs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:56:34.347Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"f6c787c9-212c-4468-a276-5af7d7d78dbc","topic":"Supabase REST API and Client SDKs","status":"pending","priority":"medium","notes":"Use official Supabase documentation for client SDKs, REST API, Database, and Auth endpoints. Do not search using raw key values.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:56:21.400Z","updated_at":"2026-08-18T20:56:21.400Z","completed_at":null,"summary":{"id":"f6c787c9-212c-4468-a276-5af7d7d78dbc","topic":"Supabase REST API and Client SDKs","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:56:21.400Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"c95b76a3-9bd3-42fd-8c37-0765cabef6a8","topic":"Documenso document signing and template REST API","status":"pending","priority":"medium","notes":"Consult official Documenso documentation for REST API endpoints, document signing workflows, and API key authentication. Do not query using the raw key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:55:37.372Z","updated_at":"2026-08-18T20:55:37.372Z","completed_at":null,"summary":{"id":"c95b76a3-9bd3-42fd-8c37-0765cabef6a8","topic":"Documenso document signing and template REST API","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:55:37.372Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"9b1f9703-76c3-4743-916a-a3340c2b74f4","topic":"Claude Code messaging API and CLI integration","status":"pending","priority":"medium","notes":"Consult official Anthropic Claude Code documentation for API and integration details; do not use the raw key string.","node_slug":null,"research_phase":"acquisition","created_at":"2026-08-18T20:55:25.048Z","updated_at":"2026-08-18T20:55:25.048Z","completed_at":null,"summary":{"id":"9b1f9703-76c3-4743-916a-a3340c2b74f4","topic":"Claude Code messaging API and CLI integration","status":"pending","phase":"acquisition","last_updated":"2026-08-18T20:55:25.048Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}
-{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","priority":"high","notes":"Queued from repo-wide analysis request on 2026-06-01. Focus on current best practices and meta-patterns for filesystem-native memory OS, validated operation envelopes, append-only logs, cache invalidation, research queue architecture, and secure local-first AI tools.","node_slug":null,"research_phase":"acquisition","created_at":"2026-06-01T06:07:40.102Z","updated_at":"2026-06-01T06:07:40.126Z","completed_at":null,"summary":{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","phase":"acquisition","last_updated":"2026-06-01T06:07:40.126Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}