total-recall-brain 3.28.2 → 3.30.0

package/src/core/mesh-access-sync.mjs

@@ -0,0 +1,134 @@
+/**
+ * Sharing mesh login accounts between nodes.
+ *
+ * A node is only as reachable as its login account is known, and that account
+ * used to be typed in by hand, per brain, per machine. Every node now records
+ * its own account on its own entity (see `patchOwnMeshNode`), and this module
+ * spreads those records: it reads the node entities of each peer this machine
+ * can already reach and fills in accounts it does not know yet. One reachable
+ * peer is enough to learn the rest.
+ *
+ * Only accounts and ports travel. Key paths are local facts and are never
+ * copied: a path that exists here means nothing anywhere else. Nothing here
+ * guesses — an account is only ever taken from a node's own record or from a
+ * record another node verified.
+ *
+ * Portability (open source): no hostname, account or path is hardcoded.
+ */
+
+import matter from 'gray-matter';
+
+const DOC_MARKER = '@@TR-MESH-NODE-DOC@@';
+
+/** Shell command that prints a peer's global-brain node entities, one per marker. */
+export function remoteNodeDocsCommand() {
+  const dir = '"$HOME/.agent/skills/total-recall/memory-vault/system/mesh-nodes"';
+  return `for f in ${dir}/*.md; do [ -f "$f" ] && printf '\\n${DOC_MARKER}\\n' && cat "$f"; done; true`;
+}
+
+/** Parse the output of `remoteNodeDocsCommand` into node entity objects. */
+export function parseRemoteNodeDocs(output = '') {
+  return String(output)
+    .split(DOC_MARKER)
+    .map((chunk) => chunk.trim())
+    .filter(Boolean)
+    .map((chunk) => {
+      try {
+        return matter(chunk).data;
+      } catch {
+        return null;
+      }
+    })
+    .filter((doc) => doc && doc.type === 'mesh_node' && doc.hostname);
+}
+
+function hostKey(value) {
+  return String(value || '').toLowerCase().split('.')[0].replace(/[^a-z0-9]/g, '');
+}
+
+/**
+ * Decide which accounts a peer's entities can teach this machine.
+ *
+ * A peer's record fills a gap; it never overrides an account this machine has
+ * already verified. The one exception is a node describing itself
+ * (`source: 'self'`), which is authoritative over any unverified entry.
+ */
+export function planAccessFromPeerDocs(localNodes, peerDocs, peerName) {
+  const selfFirst = [...peerDocs].sort(
+    (a, b) =>
+      Number(hostKey(b.hostname) === hostKey(peerName)) -
+      Number(hostKey(a.hostname) === hostKey(peerName)),
+  );
+  const byHost = new Map();
+  for (const doc of selfFirst) {
+    const remote = doc.access || {};
+    if (!remote.ssh_user) continue;
+    const describesItself = hostKey(doc.hostname) === hostKey(peerName);
+    // A third party's entry is only worth copying if someone verified it.
+    if (!describesItself && !remote.verified_at && remote.source !== 'self') continue;
+
+    const local = localNodes.find(
+      (n) => hostKey(n.hostname) === hostKey(doc.hostname) || (doc.ip && String(n.ip) === String(doc.ip)),
+    );
+    if (!local || local.self || byHost.has(local.hostname)) continue;
+
+    const current = local.access || {};
+    const fillsGap = !current.ssh_user;
+    const correctsEntry =
+      describesItself && remote.source === 'self' && !current.verified_at && current.ssh_user !== remote.ssh_user;
+    if (!fillsGap && !correctsEntry) continue;
+
+    byHost.set(local.hostname, {
+      hostname: local.hostname,
+      access: {
+        ssh_user: remote.ssh_user,
+        ...(remote.ssh_port ? { ssh_port: remote.ssh_port } : {}),
+        source: `mesh:${hostKey(peerName) || 'peer'}`,
+      },
+    });
+  }
+  return [...byHost.values()];
+}
+
+/**
+ * Learn login accounts from every peer this machine can already reach.
+ *
+ * @returns {Promise<{ peers: object[], learned: object[] }>}
+ */
+export async function syncAccessFromPeers(options = {}) {
+  const { vaultRoot } = options;
+  const mesh = await import('./mesh.mjs');
+  const { resolveNodeAccess } = await import('./mesh-access.mjs');
+  const exec = options.exec || mesh.execMeshCommand;
+  const list = options.listNodes || (() => mesh.listEnrichedMeshNodes(vaultRoot));
+  const save =
+    options.save || ((hostname, patch) => mesh.setMeshNodeAccess(hostname, patch, { vaultRoot }));
+
+  const peers = [];
+  const learned = [];
+  for (const node of list().filter((n) => !n.self && n.online !== false)) {
+    if (!resolveNodeAccess(node).complete) {
+      peers.push({ hostname: node.hostname, read: false, reason: 'no login recorded' });
+      continue;
+    }
+    let res;
+    try {
+      res = await exec(node.hostname, remoteNodeDocsCommand(), { vaultRoot, timeoutMs: 15_000 });
+    } catch (err) {
+      peers.push({ hostname: node.hostname, read: false, reason: err.message });
+      continue;
+    }
+    if (!res?.success) {
+      peers.push({ hostname: node.hostname, read: false, reason: res?.stderr || 'failed' });
+      continue;
+    }
+    const docs = parseRemoteNodeDocs(res.stdout);
+    peers.push({ hostname: node.hostname, read: true, documents: docs.length });
+
+    for (const update of planAccessFromPeerDocs(list(), docs, node.hostname)) {
+      const result = await save(update.hostname, update.access);
+      learned.push({ ...update, from: node.hostname, written: !!result?.written });
+    }
+  }
+  return { peers, learned };
+}

package/src/core/mesh-access.mjs

@@ -83,7 +83,7 @@ export function readSshConfig(configPath = path.join(os.homedir(), '.ssh', 'conf
   }
 }
 
-/** Loose host comparison: `mac-mini`, `Mac_Mini` and `macmini` name one machine. */
+/** Loose host comparison: `build-box`, `Build_Box` and `buildbox` name one machine. */
 function hostKey(value) {
   if (value == null) return '';
   return String(value).toLowerCase().replace(/\.$/, '').replace(/[^a-z0-9]/g, '');
@@ -183,7 +183,7 @@ export function meshSshFromVariant(variant) {
  * anywhere, while a LAN address is only correct when both ends happen to sit on
  * the same network.
  */
-export function resolveNodeAccess(node, { fallbackUser = null } = {}) {
+export function resolveNodeAccess(node, { fallbackUser = null, fileExists = fs.existsSync } = {}) {
   const access = node?.access || {};
   const host = access.ssh_host || node?.ip || node?.lan_ip || node?.hostname || null;
   const user = access.ssh_user || fallbackUser || null;
@@ -192,7 +192,7 @@ export function resolveNodeAccess(node, { fallbackUser = null } = {}) {
     user,
     host,
     port: access.ssh_port || DEFAULT_SSH_PORT,
-    identity_file: access.identity_file || null,
+    identity_file: localIdentityFile(access.identity_file, fileExists),
     mesh_ssh: access.mesh_ssh || 'unknown',
     tailscale_variant: access.tailscale_variant || TAILSCALE_VARIANTS.UNKNOWN,
     source: access.source || 'unknown',
@@ -204,6 +204,21 @@ export function resolveNodeAccess(node, { fallbackUser = null } = {}) {
   };
 }
 
+/**
+ * A recorded key path, but only when this machine actually has that file.
+ *
+ * Access records are shared across the mesh, while a key path is only true on
+ * the machine that wrote it. Passing another machine's path with
+ * IdentitiesOnly makes ssh refuse to try any key at all, so a record that
+ * works from one node would block the same login from every other one.
+ * Without it, ssh falls back to this machine's own keys and agent.
+ */
+export function localIdentityFile(identityFile, fileExists = fs.existsSync) {
+  if (!identityFile) return null;
+  const expanded = String(identityFile).replace(/^~(?=$|\/)/, os.homedir());
+  return fileExists(expanded) ? expanded : null;
+}
+
 /** Human-readable `user@host[:port]`, or a clear marker of what is missing. */
 export function formatAccessTarget(resolved) {
   if (!resolved?.host) return '(no address)';

package/src/core/mesh-discover.mjs

@@ -0,0 +1,173 @@
+/**
+ * Finding a working mesh login with this machine's own keys.
+ *
+ * `mesh access sync` learns accounts other nodes already know. This covers the
+ * case where nobody knows yet: it tries the plausible accounts with the keys
+ * this machine holds and records the first one that logs in, verified.
+ *
+ * It stops early when the failure is not about credentials. An untrusted host
+ * key or an unreachable host fails identically for every account and key, so
+ * trying the rest would only add delay and noise to the far end's auth log.
+ * Host keys are never auto-accepted; that case is reported with the command
+ * that confirms the key.
+ *
+ * Portability (open source): candidates come from the node entity, the
+ * operator's ssh config and the local account — nothing is hardcoded.
+ */
+
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {
+  DEFAULT_SSH_PORT,
+  findSshConfigEntryForNode,
+  localIdentityFile,
+  parseSshConfig,
+  readSshConfig,
+} from './mesh-access.mjs';
+
+/** Accounts worth trying for a node, most likely first, without duplicates. */
+export function candidateUsers(node, { sshConfigText = '', localUser = safeLocalUser() } = {}) {
+  const entry = findSshConfigEntryForNode(parseSshConfig(sshConfigText), node);
+  return [...new Set([node?.access?.ssh_user, entry?.user, localUser].filter(Boolean))];
+}
+
+/**
+ * Private keys this machine holds in `~/.ssh`: every file with a matching
+ * `.pub` beside it. `null` comes last and means "ssh defaults and agent".
+ */
+export function localPrivateKeys(sshDir = path.join(os.homedir(), '.ssh')) {
+  let names = [];
+  try {
+    names = fs.readdirSync(sshDir);
+  } catch {
+    return [null];
+  }
+  const keys = names
+    .filter((name) => name.endsWith('.pub'))
+    .map((name) => path.join(sshDir, name.slice(0, -4)))
+    .filter((file) => {
+      try {
+        return fs.statSync(file).isFile();
+      } catch {
+        return false;
+      }
+    })
+    .sort();
+  return [...keys, null];
+}
+
+/** Why a login attempt failed, from ssh's stderr. */
+export function classifyProbeFailure(stderr = '') {
+  const text = String(stderr);
+  if (/Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(text)) {
+    return 'host-key';
+  }
+  if (/Permission denied|Too many authentication failures/i.test(text)) return 'auth';
+  if (/timed out|No route to host|Connection refused|Could not resolve/i.test(text)) {
+    return 'unreachable';
+  }
+  return 'unknown';
+}
+
+/** One non-interactive login attempt. Resolves `{ ok, reason, stderr }`. */
+export function probeLogin({ user, host, port = DEFAULT_SSH_PORT, identity = null }, options = {}) {
+  const { timeoutMs = 12_000, spawnImpl = spawn } = options;
+  const args = ['-o', 'BatchMode=yes', '-o', `ConnectTimeout=${Math.ceil(timeoutMs / 1000)}`];
+  if (port && port !== DEFAULT_SSH_PORT) args.push('-p', String(port));
+  if (identity) args.push('-i', identity, '-o', 'IdentitiesOnly=yes');
+  args.push(`${user}@${host}`, 'true');
+
+  return new Promise((resolve) => {
+    let stderr = '';
+    let settled = false;
+    let timer = null;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    const proc = spawnImpl('ssh', args, { stdio: ['ignore', 'ignore', 'pipe'] });
+    timer = setTimeout(() => {
+      proc.kill('SIGTERM');
+      done({ ok: false, reason: 'unreachable', stderr: 'timed out' });
+    }, timeoutMs + 2_000);
+    proc.stderr?.on('data', (chunk) => {
+      stderr += chunk.toString();
+    });
+    proc.on('error', (err) => done({ ok: false, reason: 'unknown', stderr: err.message }));
+    proc.on('close', (code) =>
+      done(
+        code === 0
+          ? { ok: true, reason: null, stderr: '' }
+          : { ok: false, reason: classifyProbeFailure(stderr), stderr: stderr.trim() },
+      ),
+    );
+  });
+}
+
+/**
+ * Find a working login for one node and record it.
+ *
+ * @returns {Promise<{ hostname: string, found: boolean, access?: object,
+ *   reason?: string, attempts: number, written?: boolean }>}
+ */
+export async function discoverNodeAccess(node, options = {}) {
+  const {
+    vaultRoot,
+    sshConfigText = readSshConfig(),
+    keys = localPrivateKeys(),
+    probe = probeLogin,
+    save = null,
+    timeoutMs = 12_000,
+  } = options;
+
+  const host = node?.access?.ssh_host || node?.ip || node?.lan_ip || null;
+  if (!host) return { hostname: node?.hostname, found: false, reason: 'no-address', attempts: 0 };
+
+  const port = node?.access?.ssh_port || DEFAULT_SSH_PORT;
+  const recordedKey = localIdentityFile(node?.access?.identity_file);
+  const identities = [...new Set([recordedKey, ...keys].filter((k) => k !== undefined))];
+  if (!identities.includes(null)) identities.push(null);
+  const users = candidateUsers(node, { sshConfigText });
+
+  let attempts = 0;
+  let lastReason = users.length ? 'auth' : 'no-candidate-user';
+  for (const user of users) {
+    for (const identity of identities) {
+      attempts += 1;
+      const result = await probe({ user, host, port, identity }, { timeoutMs });
+      if (result.ok) {
+        const access = {
+          ssh_user: user,
+          ...(identity ? { identity_file: identity } : {}),
+          source: 'discovered',
+          verified_at: new Date().toISOString(),
+        };
+        const writer =
+          save ||
+          (async (hostname, patch) => {
+            const { setMeshNodeAccess } = await import('./mesh.mjs');
+            return setMeshNodeAccess(hostname, patch, { vaultRoot });
+          });
+        const written = await writer(node.hostname, access);
+        return { hostname: node.hostname, found: true, access, attempts, written: !!written?.written };
+      }
+      lastReason = result.reason;
+      if (result.reason === 'host-key' || result.reason === 'unreachable') {
+        return { hostname: node.hostname, found: false, reason: result.reason, attempts };
+      }
+    }
+  }
+  return { hostname: node.hostname, found: false, reason: lastReason, attempts };
+}
+
+function safeLocalUser() {
+  try {
+    return os.userInfo().username || null;
+  } catch {
+    return process.env.USER || process.env.USERNAME || null;
+  }
+}

package/src/core/mesh.mjs

@@ -1,4 +1,6 @@
 import { spawn, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import {
@@ -9,6 +11,7 @@ import {
 import { logger } from './logger.mjs';
 import { STATUS_TIMEOUT_MS, resolveTailscaleBinary } from './tailscale-cli.mjs';
 import { buildSshArgs, resolveNodeAccess } from './mesh-access.mjs';
+import { port as configuredBrainPort, detectProjectBrain, globalBrainDir } from './config.mjs';
 
 const CACHE_MS = 2_000;
 
@@ -120,30 +123,99 @@ export function getMeshPeers({ includeSelf = false } = {}) {
   return peers.filter((peer) => peer.hostname && peer.ip);
 }
 
-/** Read vault mesh_node entity documents (install-specific variables). */
-export function listMeshNodeEntities(vaultRoot = defaultVaultRoot()) {
-  return listVfsDocumentsUnder('system/mesh-nodes', vaultRoot).filter(
-    (doc) => doc.type === 'mesh_node',
-  );
+/**
+ * Where mesh node entities live: the machine's global brain.
+ *
+ * How to reach a machine is a fact about the machine, not about whichever
+ * repository a command happened to run in. Resolving it from the active
+ * (usually project) brain meant a login recorded in one repo was invisible from
+ * every other repo on the same machine, so each one rediscovered it from
+ * scratch. `AGENT_DIR` still pins the root, matching `resolveBrainDir`.
+ */
+export function meshVaultRoot() {
+  if (process.env.AGENT_DIR) {
+    return path.join(process.env.AGENT_DIR, 'skills', 'total-recall', 'memory-vault');
+  }
+  return path.join(globalBrainDir, 'memory-vault');
+}
+
+function readMeshNodeDocs(vaultRoot) {
+  return listVfsDocumentsUnder('system/mesh-nodes', vaultRoot)
+    .filter((doc) => doc.type === 'mesh_node')
+    .map((doc) => ({ ...doc, _vault_root: vaultRoot }));
+}
+
+/**
+ * Read vault mesh_node entity documents (install-specific variables).
+ *
+ * Reads the mesh root and, when it differs, the active brain too, so access
+ * recorded before entities moved to the global brain is still honoured. The
+ * mesh root wins per field; the other layer only fills gaps in `access`.
+ */
+export function listMeshNodeEntities(vaultRoot = meshVaultRoot()) {
+  const primary = readMeshNodeDocs(vaultRoot);
+  const project = detectProjectBrain();
+  const legacyRoots = [
+    ...new Set(
+      [defaultVaultRoot(), project && path.join(project.brainDir, 'memory-vault')]
+        .filter(Boolean)
+        .map((root) => path.resolve(root)),
+    ),
+  ].filter((root) => root !== path.resolve(vaultRoot));
+  if (!legacyRoots.length) return primary;
+
+  const merged = [...primary];
+  for (const doc of legacyRoots.flatMap((root) => readMeshNodeDocs(root))) {
+    const match = merged.find(
+      (e) =>
+        meshNodeKey(e.hostname) === meshNodeKey(doc.hostname) ||
+        (e.ip && doc.ip && String(e.ip) === String(doc.ip)),
+    );
+    if (!match) {
+      merged.push(doc);
+    } else if (doc.access && typeof doc.access === 'object') {
+      match.access = { ...doc.access, ...(match.access || {}) };
+    }
+  }
+  return merged;
 }
 
 /**
  * Merge live control-plane peers with vault mesh_node entity variables.
  * Live online/ip always win; role/labels/capabilities/notes come from the entity.
  */
-export function mergeLivePeersWithEntities(peers, entities = []) {
-  const byHost = new Map();
-  const byIp = new Map();
-  for (const ent of entities) {
-    const host = meshNodeKey(ent.hostname);
-    if (host) byHost.set(host, ent);
-    if (ent.ip) byIp.set(String(ent.ip), ent);
+/**
+ * The entity describing a peer: by hostname first, then by mesh address.
+ *
+ * The address fallback exists for a machine whose hostname changed. It must
+ * not claim an entity whose hostname is a DIFFERENT machine: Headscale hands a
+ * freed address to the next node that enrolls, so a stale entity at that
+ * address belongs to whoever held it before. Matching it attached a new
+ * Chromebook to an old MacBook's record, login included.
+ */
+export function entityForPeer(peer, entities = [], otherHosts = new Set()) {
+  const host = meshNodeKey(peer?.hostname);
+  if (host) {
+    const byName = entities.find((e) => meshNodeKey(e.hostname) === host);
+    if (byName) return byName;
   }
+  if (!peer?.ip) return null;
+  return (
+    entities.find((e) => {
+      if (!e.ip || String(e.ip) !== String(peer.ip)) return false;
+      const entHost = meshNodeKey(e.hostname);
+      return !entHost || !otherHosts.has(entHost);
+    }) || null
+  );
+}
+
+export function mergeLivePeersWithEntities(peers, entities = []) {
+  const liveHosts = new Set(peers.map((p) => meshNodeKey(p.hostname)).filter(Boolean));
 
   const merged = peers.map((peer) => {
     const host = meshNodeKey(peer.hostname);
-    const ent = (host && byHost.get(host)) || (peer.ip && byIp.get(String(peer.ip))) || null;
-    return enrichPeerWithEntity(peer, ent);
+    const others = new Set([...liveHosts].filter((h) => h !== host));
+    return enrichPeerWithEntity(peer, entityForPeer(peer, entities, others));
   });
 
   const seen = new Set(
@@ -185,6 +257,7 @@ function enrichPeerWithEntity(peer, ent, extra = {}) {
     hostname: peer.hostname,
     ip: peer.ip || ent?.ip || null,
     lan_ip: peer.lan_ip || ent?.lan_ip || null,
+    brain_port: ent?.brain_port || null,
     online: !!peer.online,
     self: !!peer.self,
     os: peer.os || ent?.os || null,
@@ -212,7 +285,7 @@ function enrichPeerWithEntity(peer, ent, extra = {}) {
 }
 
 /** Live peers + vault entity variables for API/UI. */
-export function listEnrichedMeshNodes(vaultRoot = defaultVaultRoot()) {
+export function listEnrichedMeshNodes(vaultRoot = meshVaultRoot()) {
   const live = getMeshPeers({ includeSelf: true }).map((p) => ({
     ...p,
     transports: p.ip ? ['mesh'] : [],
@@ -249,18 +322,23 @@ export function attachSelfInterfaces(nodes, interfacesSummary = null) {
   });
 }
 
+function isInVault(doc, vaultRoot) {
+  return !doc?._vault_root || path.resolve(doc._vault_root) === path.resolve(vaultRoot);
+}
+
 function findEntityForSelf(self, vaultRoot) {
   const entities = listMeshNodeEntities(vaultRoot);
   const host = meshNodeKey(self.hostname);
-  return (
-    entities.find((e) => meshNodeKey(e.hostname) === host) ||
-    entities.find((e) => e.ip && self.ip && String(e.ip) === String(self.ip)) ||
-    null
+  const otherHosts = new Set(
+    getMeshPeers({ includeSelf: true })
+      .map((p) => meshNodeKey(p.hostname))
+      .filter((h) => h && h !== host),
   );
+  return entityForPeer(self, entities, otherHosts);
 }
 
 /** Find an enriched node (live + vault) by hostname or address. */
-export function findMeshNode(nameOrAddress, vaultRoot = defaultVaultRoot()) {
+export function findMeshNode(nameOrAddress, vaultRoot = meshVaultRoot()) {
   const wanted = String(nameOrAddress || '').trim();
   if (!wanted) return null;
   const key = meshNodeKey(wanted);
@@ -281,18 +359,24 @@ export function findMeshNode(nameOrAddress, vaultRoot = defaultVaultRoot()) {
  * thing anyone knows about a machine they did not install Total Recall on.
  */
 export async function setMeshNodeAccess(nameOrAddress, accessPatch, options = {}) {
-  const vaultRoot = options.vaultRoot || defaultVaultRoot();
+  const vaultRoot = options.vaultRoot || meshVaultRoot();
   const node = findMeshNode(nameOrAddress, vaultRoot);
   if (!node) return { written: false, reason: 'node-not-found' };
 
   const entities = listMeshNodeEntities(vaultRoot);
-  const existing =
-    entities.find((e) => meshNodeKey(e.hostname) === meshNodeKey(node.hostname)) ||
-    entities.find((e) => e.ip && node.ip && String(e.ip) === String(node.ip)) ||
-    null;
+  const otherHosts = new Set(
+    listEnrichedMeshNodes(vaultRoot)
+      .filter((n) => !n.vault_only)
+      .map((n) => meshNodeKey(n.hostname))
+      .filter((h) => h && h !== meshNodeKey(node.hostname)),
+  );
+  const known = entityForPeer(node, entities, otherHosts);
+  // A record read from another brain layer is merged, but the write always
+  // lands in this vault, so only a document that lives here can be patched.
+  const existing = known && isInVault(known, vaultRoot) ? known : null;
 
   // Merge rather than replace: setting only a port must not erase the user.
-  const merged = { ...(existing?.access || {}), ...accessPatch };
+  const merged = { ...(known?.access || {}), ...accessPatch };
   for (const [key, value] of Object.entries(merged)) {
     if (value === null || value === undefined) delete merged[key];
   }
@@ -382,7 +466,7 @@ export async function setMeshNodeAccess(nameOrAddress, accessPatch, options = {}
  * @returns {Promise<{created: string[], skipped_offline: string[], existing: number}>}
  */
 export async function ensureMeshNodeEntities(options = {}) {
-  const vaultRoot = options.vaultRoot || defaultVaultRoot();
+  const vaultRoot = options.vaultRoot || meshVaultRoot();
   const peers = options.peers || getMeshPeers({ includeSelf: true });
   const entities = options.entities || listMeshNodeEntities(vaultRoot);
   const write = options.write || ((host) => setMeshNodeAccess(host, {}, { vaultRoot }));
@@ -422,14 +506,23 @@ export async function ensureMeshNodeEntities(options = {}) {
  * Does not hardcode device names — slug and fields come from Tailscale self.
  * Preserves existing entity variables (role, labels, capabilities, notes, body).
  */
+function localLoginUser() {
+  try {
+    return os.userInfo().username || null;
+  } catch {
+    return process.env.USER || process.env.USERNAME || null;
+  }
+}
+
 export async function patchOwnMeshNode(options = {}) {
   const self = getMeshSelf();
   if (!self?.hostname) {
     return { self: null, written: false, reason: 'mesh-unavailable' };
   }
 
-  const vaultRoot = options.vaultRoot || defaultVaultRoot();
-  const existing = findEntityForSelf(self, vaultRoot);
+  const vaultRoot = options.vaultRoot || meshVaultRoot();
+  const known = findEntityForSelf(self, vaultRoot);
+  const existing = known && isInVault(known, vaultRoot) ? known : null;
   const slug = existing
     ? path.basename(existing.vfs_path, '.md')
     : meshNodeKey(self.hostname);
@@ -484,8 +577,14 @@ export async function patchOwnMeshNode(options = {}) {
     hasClient: true,
     hasDaemon: hasTailscaleDaemon(),
   });
+  // This machine is the one authority on its own login account. Recording it
+  // here is what lets every other node reach it without guessing: the account
+  // is a property of the host that the control server cannot supply. An
+  // account an operator set deliberately (a dedicated ssh user) is kept.
+  const priorAccess = known?.access || {};
   const access = {
-    ...(existing?.access || {}),
+    ...priorAccess,
+    ...(priorAccess.ssh_user ? {} : { ssh_user: localLoginUser(), source: 'self' }),
     tailscale_variant: variant,
     mesh_ssh: meshSshFromVariant(variant),
   };
@@ -498,6 +597,7 @@ export async function patchOwnMeshNode(options = {}) {
     os: self.os,
     interfaces: interfacesSummary,
     lan_ip: lanIp,
+    brain_port: options.brainPort || configuredBrainPort,
     transports: [...new Set(['mesh', ...(lanIp ? ['lan'] : [])])],
     io: ioProfile,
     capabilities,
@@ -582,7 +682,7 @@ export async function patchOwnMeshNode(options = {}) {
  * @returns {Promise<{ node: string, hostname: string, ip: string, exitCode: number, success: boolean, stdout: string, stderr: string }>}
  */
 export async function execMeshCommand(target, command, options = {}) {
-  const { vaultRoot = defaultVaultRoot(), timeoutMs = 60_000, loginShell = true } = options;
+  const { vaultRoot = meshVaultRoot(), timeoutMs = 60_000, loginShell = true } = options;
   const node = findMeshNode(target, vaultRoot);
   if (!node) {
     throw new Error(`No mesh node matches "${target}".`);
@@ -679,4 +779,3 @@ export function resolveMeshControlUrl(options = {}) {
 
   return { url: null, source: 'none', is_fallback: false };
 }
-

package/src/core/optimizer.mjs

@@ -311,47 +311,10 @@ export function findStaleNodes(vaultDir, { days = 30, minImportance = 4 } = {})
 }
 
 /**
- * Hand stale high-importance memories to the research daemon, which can actually
- * re-verify them and commit the result — instead of filing a ticket asking
- * someone else to.
- *
- * Rate-limited per cycle: re-researching hundreds of nodes at once would swamp
- * the daemon and burn provider budget. Most-stale-first means the backlog drains
- * in a sensible order across cycles. `addToQueue` dedupes by topic, so a node
- * already queued is never enqueued twice.
- *
- * @returns {{ enqueued: string[], stale: number }}
- */
-export async function refreshStaleKnowledge(vaultDir, { limit = 3, days = 30, minImportance = 4 } = {}) {
-  const { addToQueue } = await import('./research-queue.mjs');
-  const stale = findStaleNodes(vaultDir, { days, minImportance });
-  const enqueued = [];
-
-  for (const node of stale.slice(0, limit)) {
-    const ageDays = Math.floor((Date.now() - new Date(node.last_accessed).getTime()) / 86400000);
-    try {
-      addToQueue({
-        topic: `Verify still-current: ${node.title}`,
-        priority: node.importance >= 5 ? 'high' : 'medium',
-        notes: `Memory node "${node.slug}" (importance ${node.importance}) has not been accessed in ${ageDays} days. Re-verify its claim against current sources and update or archive it.`,
-      });
-      enqueued.push(node.slug);
-    } catch (err) {
-      logger.warn('optimizer', `Could not enqueue staleness research for ${node.slug}: ${err.message}`);
-    }
-  }
-
-  if (stale.length > enqueued.length) {
-    logger.info('optimizer', `${stale.length - enqueued.length} stale nodes deferred to a later cycle (limit ${limit}).`);
-  }
-  return { enqueued, stale: stale.length };
-}
-
-/**
- * @deprecated Superseded by {@link refreshStaleKnowledge}, which queues real work
- * instead of writing tickets nothing reads. Retained because the dream cycle's
- * master switch still references it and because removing it would silently change
- * behavior for anyone who flips that switch back on.
+ * @deprecated Wrote tickets nothing reads. Retained because the dream cycle's
+ * master switch (ENABLE_STALE_KNOWLEDGE_REFRESH, off) still references it.
+ * Stale nodes are surfaced to a human via findStaleNodes instead; nothing
+ * re-researches them automatically (RESEARCH_SYSTEM2).
  */
 export async function generateStaleKnowledgeRefreshProposals(vaultDir) {
   return findStaleNodes(vaultDir, { days: 30, minImportance: 4 }).map(node => createProposal(