total-recall-brain 3.28.0 → 3.28.2

package/src/core/daemon-loop.mjs

@@ -172,24 +172,59 @@ export function releasePidLock() {
 let taskCount = 0;
 let running = true;
 let vaultWatcher = null;
+let shuttingDown = false;
+
+// Upper bound on a graceful stop. A loop iteration can be mid-task, so the
+// signal cannot exit instantly — but it must exit *eventually*.
+const SHUTDOWN_GRACE_MS = 30000;
 
 import { releaseLease } from './leader-election.mjs';
 
-process.on('SIGTERM', async () => {
-  logger.info({ subsystem: 'daemon-loop', message: 'SIGTERM received — shutting down gracefully' });
-  if (vaultWatcher) vaultWatcher.stop();
-  await releaseLease();
-  releasePidLock();
+/**
+ * Graceful stop, with a guaranteed exit.
+ *
+ * Clearing `running` alone never stopped this process. The vault and source
+ * watchers hold the event loop open, so `daemon stop` printed "✅ Daemon
+ * stopped" while the daemon kept running — still executing the OLD module code
+ * and still ingesting sessions. No "Daemon stopped." line ever reached
+ * daemon.log across three separate SIGTERMs. The fallback timer bounds that, so
+ * even a wedged iteration cannot keep the daemon alive indefinitely.
+ */
+function shutdown(signal) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+  logger.info({ subsystem: 'daemon-loop', message: `${signal} received — shutting down gracefully` });
   running = false;
-});
-
-process.on('SIGINT', async () => {
-  logger.info({ subsystem: 'daemon-loop', message: 'SIGINT received — shutting down gracefully' });
   if (vaultWatcher) vaultWatcher.stop();
-  await releaseLease();
-  releasePidLock();
-  running = false;
-});
+
+  const fallback = setTimeout(() => {
+    logger.info({
+      subsystem: 'daemon-loop',
+      message: `Graceful shutdown exceeded ${SHUTDOWN_GRACE_MS}ms — forcing exit`,
+    });
+    process.exit(0);
+  }, SHUTDOWN_GRACE_MS);
+  fallback.unref();
+
+  Promise.resolve()
+    .then(() => releaseLease())
+    .catch((err) => {
+      logger.info({
+        subsystem: 'daemon-loop',
+        message: `Lease release failed during shutdown: ${err.message}`,
+      });
+    })
+    .finally(() => {
+      try {
+        releasePidLock();
+      } catch {
+        // Lock already gone — nothing to release.
+      }
+    });
+}
+
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+process.on('SIGINT', () => shutdown('SIGINT'));
 
 process.on('uncaughtException', (err) => {
   logger.error({ subsystem: 'daemon-loop', message: `Uncaught Exception (suppressed to keep daemon alive): ${err.stack || err.message}` });
@@ -291,7 +326,7 @@ async function main() {
 
   // Deterministic election (lowest mesh IP) — tryAcquire/renew are no-op shims
   // that re-evaluate isLeader(); no node-local lease documents are written.
-  const { tryAcquireLease, isLeader, getLeaderInfo, renewLease } = await import('./leader-election.mjs');
+  const { tryAcquireLease, isLeader, getLeaderInfo, renewLease, leaderPin } = await import('./leader-election.mjs');
 
   const acquired = await tryAcquireLease();
   if (acquired) {
@@ -300,7 +335,22 @@ async function main() {
     const info = await getLeaderInfo();
     const leaderStr = info ? info.hostname : 'unknown';
     logger.info({ subsystem: 'daemon-loop', message: `Starting as FOLLOWER (leader: ${leaderStr})` });
-    
+
+    // Lowest-online-IP says nothing about whether the elected node can run Total
+    // Recall. On this mesh the shared droplet holds 100.64.0.1 and runs no TR at
+    // all, so every real machine idled as a follower for months: the daemon
+    // reported itself healthy while the pipeline stayed silent. A follower with
+    // no pin configured anywhere is almost certainly that mistake, and it is
+    // invisible without this warning — followers skip the task loop entirely.
+    if (!leaderPin()) {
+      logger.warn(
+        'daemon-loop',
+        `No leader pin found — following "${leaderStr}" by lowest-IP order. Followers skip the task loop, ` +
+        `so this node will run no research, dream cycle, or surface recompile. ` +
+        `Pin the brain host with TR_LEADER_IP=<mesh-ip> or {"leaderIp":"<mesh-ip>"} in config/leader.json.`,
+      );
+    }
+
     // Phase 4C: Startup Sync (follower only)
     try {
       const { syncLoop } = await import('./secrets-sync.mjs');
@@ -653,6 +703,9 @@ async function main() {
   }
 
   logger.info({ subsystem: 'daemon-loop', message: 'Daemon stopped.' });
+  // The watchers keep the event loop alive, so returning from main() is not
+  // enough — without this the process lingers and `daemon stop` lies.
+  process.exit(0);
 }
 
 main().catch(async (err) => {

package/src/core/embeddings.mjs

@@ -61,15 +61,25 @@ let currentDbPath = null;
 const dbVssEnabled = new WeakMap();
 
 /**
- * better-sqlite3 on Linux appends ".so" when the path already ends in ".so",
- * producing "vss0.so.so". Strip known extensions before loadExtension.
+ * better-sqlite3 appends the platform suffix, so a path that already ends in
+ * ".so" reports "vss0.so.so: cannot open shared object file". Strip known
+ * extensions before loadExtension.
+ *
+ * When BOTH attempts fail, rethrow the FIRST error: the second is the artifact
+ * of the appended suffix, and logging it hid the real cause on a Linux host —
+ * "vss0.so.so: cannot open shared object file" while the actual reason was a
+ * missing libblas.so.3 that `ldd vss0.so` names immediately.
  */
 function loadExtensionBare(db, absolutePath) {
   const bare = String(absolutePath).replace(/\.(so|dylib|dll)$/i, '');
   try {
     db.loadExtension(bare);
-  } catch {
-    db.loadExtension(absolutePath);
+  } catch (bareErr) {
+    try {
+      db.loadExtension(absolutePath);
+    } catch {
+      throw bareErr;
+    }
   }
 }
 

package/src/core/fact-seeker.mjs

@@ -96,6 +96,20 @@ export function loadAgenda() {
 function saveAgenda(topics) {
   const agendaFile = getAgendaFile();
   const dir = path.dirname(agendaFile);
+  // Same backstop as the research queue (see research-queue.mjs): a test run must
+  // never rewrite the operator's real agenda. The 29 leaked "Automated API
+  // Integration Build:" fixture topics came from exactly this hole.
+  const isTest = Boolean(process.env.VITEST) || process.env.NODE_ENV === 'test';
+  if (
+    isTest &&
+    !process.env.AGENT_DIR &&
+    !process.env._TR_TEST_AGENT_DIR &&
+    path.resolve(dir) === path.resolve(getBrainDir())
+  ) {
+    throw new Error(
+      'Refusing to write the real research agenda from a test run: set _TR_TEST_AGENT_DIR',
+    );
+  }
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
   atomicWrite(agendaFile, topics.map(t => JSON.stringify(t)).join('\n') + '\n');
 }
@@ -137,6 +151,68 @@ export function addToAgenda({ topic, priority = 50, source, rationale = '', tags
   return existing || agenda.find(t => t.topic.toLowerCase() === topic.toLowerCase());
 }
 
+/**
+ * Status for a topic retired on purpose — distinct from `failed`.
+ *
+ * A cancelled topic was never attempted, so recording it as a failure
+ * misreports pipeline health. See `reclassifyCancelledAgendaTopics()`.
+ */
+export const CANCELLED_STATUS = 'cancelled';
+
+/**
+ * Retire obsolete key-name scrape topics from the AGENDA.
+ *
+ * Companion to `cancelBogusApiIntegrationQueueItems()` in
+ * secret-integration-research.mjs. That one walks the QUEUE, but the June/July
+ * 2026 pollution actually landed in the agenda (29 "Automated API Integration
+ * Build: <KEY>" fixture topics), so the designated remediation never touched it.
+ * The agenda is fact-seeker's file, so the agenda half lives here.
+ *
+ * Also sweeps legacy rows still recorded as `failed` with a `cancelled_reason`
+ * onto CANCELLED_STATUS.
+ */
+export function cancelBogusAgendaTopics() {
+  const agenda = loadAgenda();
+  let cancelled = 0;
+  for (const t of agenda) {
+    if (t.status !== 'pending' && t.status !== 'in_progress') continue;
+    if (!/^Automated API Integration Build:/i.test(String(t.topic || ''))) continue;
+    t.status = CANCELLED_STATUS;
+    t.coverage_score = 0;
+    t.cancelled_reason =
+      'obsolete key-name scrape job; re-add the secret to trigger AI provider inference';
+    cancelled += 1;
+  }
+  if (cancelled > 0) saveAgenda(agenda);
+  return { cancelled, reclassified: reclassifyCancelledAgendaTopics() };
+}
+
+/**
+ * Repair topics that were retired before CANCELLED_STATUS existed.
+ *
+ * A row carrying `status: 'failed'` *together with* a `cancelled_reason` was
+ * cancelled, never attempted — `cancelled_reason` is written only by the
+ * cancellation paths. The 2026-09 agenda cleanup retired 231 such topics
+ * (204 unbounded follow-ups + 27 obsolete fixtures) as `failed`, so anything
+ * tallying `status === 'failed'` reported 231 phantom failures beside 43
+ * genuinely pending topics. Move them onto the dedicated status so failure
+ * counts mean real failures. Idempotent.
+ *
+ * @returns {number} rows reclassified
+ */
+export function reclassifyCancelledAgendaTopics() {
+  const agenda = loadAgenda();
+  let reclassified = 0;
+  for (const t of agenda) {
+    if (t.status === 'failed' && t.cancelled_reason) {
+      t.status = CANCELLED_STATUS;
+      reclassified += 1;
+    }
+  }
+  if (reclassified > 0) saveAgenda(agenda);
+  return reclassified;
+}
+
 /**
  * Mark a topic as researched and update its coverage score.
  */
@@ -918,9 +994,25 @@ export async function runKnowledgeAcquisitionCycle({
   const coverageScore = Math.min(1.0, (results.length / 5) * confidence);
   markTopicResearched(topicId, { coverageScore, sourcesConsulted: sourcesUsed });
 
-  // Enqueue follow-up research for identified gaps (self-multiplication)
-  const gaps = synthesis.further_research_needed || [];
-  for (const gap of gaps.slice(0, 3)) {
+  // Enqueue follow-up research for identified gaps (self-multiplication).
+  //
+  // Bounded per parent topic. Research runs five phases and the monitoring and
+  // expansion phases repeat, so an uncapped 3 gaps per cycle compounds without
+  // limit — two completed reports generated 116 and 98 follow-ups respectively,
+  // none of which ever ran. The agenda is a backlog, not a fan-out tree.
+  const FOLLOW_UP_CAP_PER_TOPIC = 5;
+  const alreadySpawned = loadAgenda().filter(
+    (t) => t.source === `follow-up:${topic}`,
+  ).length;
+  const remaining = Math.max(0, FOLLOW_UP_CAP_PER_TOPIC - alreadySpawned);
+  const gaps = (synthesis.further_research_needed || []).slice(0, remaining);
+  if (remaining === 0 && (synthesis.further_research_needed || []).length > 0) {
+    logger.info({
+      subsystem: 'fact-seeker',
+      message: `Follow-up cap reached for "${topic}" (${alreadySpawned} already queued); not spawning more.`,
+    });
+  }
+  for (const gap of gaps) {
     addToAgenda({
       topic: gap,
       priority: Math.max(20, topicEntry.priority - 15),

package/src/core/headscale-client.mjs

@@ -6,7 +6,8 @@
  * hardcoded here — it is resolved from the operator's own secret entry or
  * environment, so this works against any Headscale (or Tailscale SaaS) install.
  */
-import { getSecretsCatalog, getSecret } from './secrets-store.mjs';
+import path from 'node:path';
+import { getSecretsCatalog, getSecret, defaultBrainDir } from './secrets-store.mjs';
 import { throttledFetch } from './throttled-fetch.mjs';
 
 const DEFAULT_TIMEOUT_MS = 10_000;
@@ -39,10 +40,32 @@ export function normalizeControlUrl(url) {
 /**
  * Locate the operator's headscale credential without knowing its key name.
  * Any secret whose provider is `headscale` is treated as the control-server token.
+ *
+ * The control server is a machine-level resource, not a per-repo one, so the
+ * credential normally lives in the GLOBAL brain while callers pass whichever
+ * project brain they happen to be running in. Falling back to the global store
+ * is what lets `mesh status`, `mesh nodes` and node enrollment work from inside
+ * any project checkout — without it every project reported "not configured"
+ * while the key sat in ~/.agent the whole time.
  */
+async function locateHeadscaleKey(brainDir) {
+  const target = brainDir || defaultBrainDir();
+
+  const local = await getSecretsCatalog(target);
+  const hit = local.keys.find((k) => k.provider === 'headscale');
+  if (hit) return { meta: hit, storeDir: target };
+
+  const globalDir = defaultBrainDir();
+  if (path.resolve(globalDir) === path.resolve(target)) return null;
+
+  const globalCatalog = await getSecretsCatalog(globalDir);
+  const globalHit = globalCatalog.keys.find((k) => k.provider === 'headscale');
+  return globalHit ? { meta: globalHit, storeDir: globalDir } : null;
+}
+
 export async function findHeadscaleKeyMeta(brainDir) {
-  const catalog = await getSecretsCatalog(brainDir);
-  return catalog.keys.find((k) => k.provider === 'headscale') || null;
+  const found = await locateHeadscaleKey(brainDir);
+  return found ? found.meta : null;
 }
 
 /**
@@ -51,12 +74,13 @@ export async function findHeadscaleKeyMeta(brainDir) {
  * gracefully should use `describeHeadscaleAvailability()` instead.
  */
 export async function resolveHeadscaleConfig(brainDir) {
-  const meta = await findHeadscaleKeyMeta(brainDir);
-  if (!meta) {
+  const found = await locateHeadscaleKey(brainDir);
+  if (!found) {
     throw new Error('Headscale API Key not configured in ApiKeysPage');
   }
+  const { meta, storeDir } = found;
 
-  const got = await getSecret(brainDir, meta.key, {
+  const got = await getSecret(storeDir, meta.key, {
     action: 'use',
     actor: 'headscale-client',
   });

package/src/core/leader-election.mjs

@@ -1,4 +1,7 @@
+import fs from 'node:fs';
+import path from 'node:path';
 import { getMeshPeers, getMeshSelf } from './mesh.mjs';
+import { brainDir } from './config.mjs';
 
 /**
  * Deterministic lowest-mesh-IP leader election.
@@ -19,6 +22,44 @@ import { getMeshPeers, getMeshSelf } from './mesh.mjs';
 /** Documented upper bound for isLeader() flip after the prior leader goes offline. */
 export const FAILOVER_BOUND_MS = 12_000;
 
+/**
+ * Operator pin for which node leads.
+ *
+ * Lowest-online-IP is deterministic, but it says nothing about whether that node
+ * can actually run the daemon. On this mesh the shared droplet holds the lowest
+ * IP (100.64.0.1) and runs no Total Recall at all — it captured leadership
+ * permanently, so it could never serve `/api/secrets/sync` and every other node
+ * idled as a follower: no research, no dream cycle, no surface recompile,
+ * anywhere. Followers skip the task loop entirely, so "lowest IP" quietly became
+ * "nobody works".
+ *
+ * Set `TR_LEADER_IP` to the mesh IP of the machine that owns the canonical brain
+ * on EVERY node that runs Total Recall, so they all agree on the answer. A node
+ * whose own IP is not the pin never leads. When the pinned node is offline nobody
+ * leads — fail-closed, which is the right default for an explicit operator
+ * choice, and far better than electing a leader that cannot do the work.
+ */
+export function leaderPin(brain = brainDir) {
+  const raw = String(process.env.TR_LEADER_IP || '').trim();
+  if (raw) return raw;
+
+  // File fallback. The env var only exists when the supervisor supplies it:
+  // `total-recall daemon start` from a plain shell has no TR_LEADER_IP, so the
+  // pin silently disappeared and the node became a follower of the lowest-IP
+  // peer — the droplet, which runs no Total Recall. That is the exact
+  // "lowest IP quietly became nobody works" outage this pin was added to fix,
+  // and it is invisible: the daemon starts, looks healthy, and does nothing.
+  try {
+    const file = path.join(brain, 'config', 'leader.json');
+    if (!fs.existsSync(file)) return null;
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const ip = String(parsed?.leaderIp || '').trim();
+    return ip || null;
+  } catch {
+    return null;
+  }
+}
+
 function compareNodes(a, b) {
   const ipOrder = String(a.ip || '').localeCompare(String(b.ip || ''), undefined, { numeric: true });
   return ipOrder || String(a.hostname || '').localeCompare(String(b.hostname || ''));
@@ -31,6 +72,14 @@ function compareNodes(a, b) {
 export async function getLeaderInfo() {
   const nodes = getMeshPeers({ includeSelf: true }).filter((node) => node.online);
   if (nodes.length === 0) return null;
+
+  const pin = leaderPin();
+  if (pin) {
+    const pinned = nodes.find((node) => node.ip === pin);
+    if (!pinned) return null;
+    return { hostname: pinned.hostname, ip: pinned.ip, strategy: 'pinned-mesh-ip' };
+  }
+
   const leader = [...nodes].sort(compareNodes)[0];
   return { hostname: leader.hostname, ip: leader.ip, strategy: 'lowest-mesh-ip' };
 }

package/src/core/research-queue.mjs

@@ -28,6 +28,27 @@ function getQueueFile(overrideBrainDir) {
   return path.join(dir, 'research-queue.jsonl');
 }
 
+/**
+ * Refuse to write the operator's REAL research state from inside a test run.
+ *
+ * The June/July 2026 agenda accumulated 29 "Automated API Integration Build:"
+ * fixture entries plus a queue file the daemon never drained, because a code
+ * path reached the default brain while tests were running. Threading `brainDir`
+ * through every caller is the real fix; this is the backstop, so a future caller
+ * that forgets it fails loudly instead of quietly polluting real data. Tests
+ * point at a temp brain with _TR_TEST_AGENT_DIR (or AGENT_DIR).
+ */
+function assertNotRealBrainInTest(dir, what) {
+  const isTest = Boolean(process.env.VITEST) || process.env.NODE_ENV === 'test';
+  if (!isTest) return;
+  if (process.env._TR_TEST_AGENT_DIR || process.env.AGENT_DIR) return;
+  if (path.resolve(dir) === path.resolve(getBrainDir())) {
+    throw new Error(
+      `Refusing to write the real ${what} from a test run: pass an explicit brainDir or set _TR_TEST_AGENT_DIR`,
+    );
+  }
+}
+
 const STATUS_RANK = { pending: 0, in_progress: 1, done: 2, failed: 3 };
 
 // ─── Summary Compiler ─────────────────────────────────────────────────────────
@@ -278,6 +299,7 @@ export function loadQueue(overrideBrainDir) {
 
 export function saveQueue(items, overrideBrainDir) {
   const queueFile = getQueueFile(overrideBrainDir);
+  assertNotRealBrainInTest(path.dirname(queueFile), 'research queue');
   fs.mkdirSync(path.dirname(queueFile), { recursive: true });
   fs.writeFileSync(queueFile, items.map(i => JSON.stringify(i)).join('\n') + '\n', 'utf8');
 }

package/src/core/research.mjs

@@ -92,6 +92,17 @@ export async function handleProactiveResearch(task, context = {}) {
     draftSlug = saveSynthesizedReportToDraft(task.target, finalReport, inboxDir) || draftSlug;
   }
 
+  // Phase 4b: Promote the finished report into the vault. The deliberation phase
+  // resolves its target from the vault, not the inbox, so without this the
+  // five-phase pipeline always stalls at step 2 with "Target node not found".
+  if (draftSlug) {
+    await promoteDraftToVault(
+      task.target,
+      inboxDir,
+      context.vaultDir || path.join(BRAIN_DIR, 'memory-vault'),
+    );
+  }
+
   // Phase 5: Also add topic to the Research Agenda for ongoing tracking
   addToAgenda({
     topic: task.target,
@@ -514,6 +525,66 @@ export function saveSynthesizedReportToDraft(parentTopic, finalReport, inboxDir)
   return slug;
 }
 
+/**
+ * Promote a synthesized report out of the inbox into the vault.
+ *
+ * Acquisition stages every report as `status: draft` under
+ * `memory-inbox/pending`, but the Phase 2/5 deliberation cycle resolves its
+ * target with `getNodes(vaultDir).find(n => n.slug === nodeSlug)`. A draft that
+ * never leaves the inbox therefore made every deliberation task fail with
+ * "Target node not found for slug: …", so the five-phase pipeline stalled at
+ * step 2 on every topic no matter how good the report was.
+ *
+ * The documented flow gates on confidence: >= 0.7 is a "Direct Vault Write &
+ * Immediate Surface Recompile", below that stays staged for review. Synthesized
+ * reports carry confidence 0.9, so they take the fast path.
+ */
+export const VAULT_PROMOTION_MIN_CONFIDENCE = 0.7;
+
+export async function promoteDraftToVault(parentTopic, inboxDir, vaultDir) {
+  const slug = `research-report-${slugify(parentTopic)}`;
+  const filePath = path.join(inboxDir, `${slug}.md`);
+  if (!fs.existsSync(filePath)) return null;
+
+  let parsed;
+  try {
+    parsed = matter(fs.readFileSync(filePath, 'utf8'));
+  } catch (err) {
+    logger.warn({ subsystem: 'deep-research', message: `Cannot read draft ${slug}: ${err.message}` });
+    return null;
+  }
+
+  const confidence = Number(parsed.data?.confidence);
+  if (!Number.isFinite(confidence) || confidence < VAULT_PROMOTION_MIN_CONFIDENCE) {
+    logger.info({
+      subsystem: 'deep-research',
+      message: `Report ${slug} stays in the inbox (confidence ${parsed.data?.confidence ?? 'unset'} < ${VAULT_PROMOTION_MIN_CONFIDENCE})`,
+    });
+    return null;
+  }
+
+  // The draft already carries the full SSSS frontmatter; promotion only flips it
+  // from staged-for-review to a live vault node.
+  const node = { ...parsed.data, slug, status: 'active', body: parsed.content.trim() };
+
+  try {
+    const { writeNode } = await import('./vault.mjs');
+    await writeNode(node, vaultDir || path.join(BRAIN_DIR, 'memory-vault'));
+  } catch (err) {
+    logger.warn({
+      subsystem: 'deep-research',
+      message: `Vault promotion failed for ${slug}: ${err.message}`,
+    });
+    return null;
+  }
+
+  logger.info({
+    subsystem: 'deep-research',
+    message: `Promoted ${slug} to the vault (confidence ${confidence}) — deliberation can now resolve it`,
+  });
+  return slug;
+}
+
 // ─── Synthesis ───────────────────────────────────────────────────────────────────
 
 async function synthesizeLocally(task, results, runtimeConfig) {

package/src/core/runtime.mjs

@@ -277,6 +277,64 @@ function resolveAgent(config) {
  * @param {object} config - Runtime config from loadRuntimeConfig()
  * @returns {string} The agent's text response
  */
+/**
+ * Merge every secrets layer the runtime can see.
+ *
+ * Precedence, lowest first (each later layer overrides the earlier ones):
+ *   1. <agentRoot>/secrets.enc                                   legacy flat store
+ *   2. <cwd>/.agent/secrets.enc                                  legacy flat store
+ *   3. ~/.agent/skills/total-recall/config/secrets.enc           global brain
+ *   4. <agentRoot>/skills/total-recall/config/secrets.enc        project brain
+ *
+ * Project-over-global matches `resolveBrainDir('auto')`, which every other TR
+ * component already uses: the project store is the more specific answer. The
+ * legacy flat stores are leftovers from older installs — they may still hold
+ * keys nothing else has, but they must never mask a canonical brain store.
+ *
+ * The previous implementation took the first path that held ANY keys and
+ * stopped, in legacy-first order. A stale 12-key <cwd>/.agent/secrets.enc
+ * therefore shadowed the 100-key brain store completely, and its dead
+ * `google_api_key` (AIza…, HTTP 400 from generativelanguage) overrode the
+ * working one — so every spawned agent received a key that cannot call Gemini
+ * while the good key sat unreachable one layer down.
+ *
+ * Exported for tests; callers use the defaults.
+ *
+ * @param {{ cwd?: string, agentRoot?: string, home?: string }} [opts]
+ * @returns {Promise<Record<string, string>>}
+ */
+export async function loadDynamicSecrets(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const agentRoot = opts.agentRoot ?? agentDir;
+  const home = opts.home ?? os.homedir();
+
+  const { loadSecretsSync } = await import('./secrets-store.mjs');
+  const layers = [
+    path.join(agentRoot, 'secrets.enc'),
+    path.join(cwd, '.agent', 'secrets.enc'),
+    path.join(home, '.agent', 'skills', 'total-recall', 'config', 'secrets.enc'),
+    path.join(agentRoot, 'skills', 'total-recall', 'config', 'secrets.enc'),
+  ];
+
+  const merged = {};
+  for (const p of layers) {
+    if (!fs.existsSync(p)) continue;
+    try {
+      const isConfigPath = p.includes(path.join('config', 'secrets.enc'));
+      const dir = isConfigPath ? path.dirname(path.dirname(p)) : path.dirname(p);
+      const loaded = loadSecretsSync(dir);
+      for (const [k, v] of Object.entries(loaded)) {
+        if (k === '__tr_secrets_meta') continue;
+        if (v) merged[k] = v;
+      }
+    } catch {
+      // An unreadable or undecryptable layer must not break dispatch; the
+      // remaining layers still apply.
+    }
+  }
+  return merged;
+}
+
 export async function callLocalRuntime(prompt, system, config) {
   // Pre-flight budget watchdog safety check
   checkBudgetSafety();
@@ -292,29 +350,8 @@ export async function callLocalRuntime(prompt, system, config) {
 
   let lastError;
 
-  // Load dynamic secrets from secrets.enc to ensure changes take effect immediately without server restart
-  let dynamicSecrets = {};
-  try {
-    const pathsToCheck = [
-      path.join(process.cwd(), '.agent', 'secrets.enc'),
-      path.join(agentDir, 'secrets.enc'),
-      path.join(os.homedir(), '.agent', 'skills', 'total-recall', 'config', 'secrets.enc'),
-      path.join(agentDir, 'skills', 'total-recall', 'config', 'secrets.enc'),
-    ];
-    for (const p of pathsToCheck) {
-      if (fs.existsSync(p)) {
-        try {
-          const { loadSecretsSync } = await import('./secrets-store.mjs');
-          const isConfigPath = p.includes(path.join('config', 'secrets.enc'));
-          const brainDir = isConfigPath ? path.dirname(path.dirname(p)) : path.dirname(p);
-          dynamicSecrets = loadSecretsSync(brainDir);
-          if (Object.keys(dynamicSecrets).length > 0) {
-            break;
-          }
-        } catch {}
-      }
-    }
-  } catch {}
+  // Loaded on every dispatch so a store edit takes effect without a restart.
+  const dynamicSecrets = await loadDynamicSecrets();
 
   // Try agents in priority order, never re-trying one that already failed.
   //
@@ -397,8 +434,11 @@ export async function callLocalRuntime(prompt, system, config) {
       promptLength: fullPrompt.length,
     });
 
-    // Pre-flight command execution validation
-    validateCommand(cmd);
+    // Pre-flight command execution validation. The spawn below passes an argv
+    // array (no shell), so a prompt payload is one inert argument — scan only the
+    // unquoted part, or any vault fact quoting a `curl … | bash` install line
+    // trips a false "piping download tool to shell" exception on every dispatch.
+    validateCommand(cmd, { argvSpawn: true });
 
     const xaiKey =
       process.env.XAI_API_KEY ||