total-recall-brain 3.30.0 → 3.30.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.30.0",
+  "version": "3.30.1",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [

package/scaffold/.agent/skills/total-recall/SKILL.md

@@ -181,6 +181,10 @@ npx total-recall compile
 ```
 Synchronously rebuild the entire memory index (derived embeddings) and regenerate prompt instruction shims (such as `INSTRUCTIONS.md`, `GEMINI.md`, `AGENTS.md`, etc.).
 
+*   **Rules are global + local.** Every project's shims carry the global brain's invariants, preferences and corrections plus the project's own; a project node with the same slug overrides the global one.
+*   `compile --global` (what `remember --global` runs) and `compile --all` also recompile every registered project, so a global rule reaches every repo at once.
+*   A client gets a shim only once it is connected (`total-recall connect claude-code|codex|antigravity|…` in that repo). No `CLAUDE.md` in a repo means Claude Code was never connected there.
+
 ### 5. Ingest OKF Bundle
 ```bash
 npx total-recall ingest okf <path> [options]
@@ -394,11 +398,23 @@ transcript. `set`, `rotate` and `rekey` all accept it.
 ### Master password and `rekey`
 
 The store is AES-256-GCM; the key is scrypt-derived (N=2^16, ~64 MB) from
-`TR_SECRETS_PASSWORD`. On macOS the password belongs in the **Keychain**
-(`security add-generic-password -s total-recall-secrets`), not in a dotfile —
-`rekey` picks the Keychain entry up automatically and rotates every carrier
-(LaunchAgent plist, env file, Keychain) in one transaction, verifying the
-retired password no longer decrypts before it commits.
+the master password, resolved in this order:
+
+1. `TR_SECRETS_PASSWORD` / `TR_MASTER_PASSWORD` in the environment (a
+   LaunchAgent plist injects it for launchd jobs);
+2. macOS: the **Keychain** entry `total-recall-secrets`
+   (`security add-generic-password -s total-recall-secrets`). An ssh or mesh
+   session cannot read a locked login Keychain;
+3. Linux and headless hosts: the env file `~/.agent/tr.env` (or `TR_ENV_FILE`)
+   containing `export TR_SECRETS_PASSWORD='…'`. It is used only when it is a
+   regular file, mode 0600, owned by you, in a directory (keep `~/.agent` 0700)
+   nobody else can write. Do not also export it from `.bashrc` — every process
+   started from the shell would inherit it.
+
+`rekey` rotates every carrier (LaunchAgent plist, `--env-file`, Keychain) in one
+transaction, verifying the retired password no longer decrypts before it
+commits. No carrier on a machine means every command fails with "Secrets file
+is not valid JSON" and `mesh` falls back to local discovery.
 
 > **Processes hold the old password until restarted.** After a rekey, anything
 > still running with the retired value fails with `Failed to decrypt secrets
@@ -584,7 +600,7 @@ npm test                    # vitest run — whole suite
 npx vitest run <path>       # one spec file
 ```
 
-Current baseline: **288 spec files / 1493 tests, ~160 s** on the Mac Mini.
+Current baseline (3.30.1): **349 spec files / 2024 tests, ~160 s** on the Mac Mini.
 
 > **Never run the full suite, a full typecheck, or a production build on the
 > laptop.** These go to the Mac Mini or the droplet — local runs cause slowdowns

package/src/cli/connect.mjs

@@ -369,10 +369,19 @@ function apiDetails(opts) {
     models_url: `${base}/v1/models`,
     ssss_manifest_url: `${base}/api/ssss`,
     discovery_url: `${base}/.well-known/total-recall.json`,
-    authorization_header: opts.token ? `Authorization: Bearer ${opts.token}` : 'Authorization: Bearer <PAT>'
+    // Never the token itself: this goes to stdout and --json, where it lands in
+    // terminal scrollback, CI logs and agent transcripts. Clients read the
+    // token from brain.json (0600).
+    authorization_header: opts.token ? `Authorization: Bearer ${maskToken(opts.token)}` : 'Authorization: Bearer <PAT>'
   };
 }
 
+export function maskToken(token) {
+  const value = String(token || '');
+  if (value.length <= 8) return '<PAT>';
+  return `${value.slice(0, 6)}… (full token in config/brain.json)`;
+}
+
 function detectObsidianVault() {
   // macOS: Obsidian stores vault paths in its app support config
   const obsidianConfig = path.join(

package/src/core/secrets-store.mjs

@@ -43,7 +43,8 @@ export function resolveUsagePath(brainDir) {
 /**
  * The master password: the environment first, then — on macOS — the Keychain
  * entry `secret rekey` already maintains (service `total-recall-secrets`,
- * overridable with TR_SECRETS_KEYCHAIN_SERVICE).
+ * overridable with TR_SECRETS_KEYCHAIN_SERVICE), then the host env file
+ * (see readTrEnvFilePassword).
  *
  * Only an interactive shell profile used to read the Keychain, so a
  * non-interactive process on the same Mac — a mesh `exec`, a release script —
@@ -52,13 +53,56 @@ export function resolveUsagePath(brainDir) {
  * disables the fallback.
  */
 let keychainPassword;
-export function secretsPassword({ env = process.env, readKeychain = readTrKeychainPassword } = {}) {
+export function secretsPassword({
+  env = process.env,
+  readKeychain = readTrKeychainPassword,
+  readEnvFile = readTrEnvFilePassword,
+} = {}) {
   const fromEnv = env.TR_SECRETS_PASSWORD || env.TR_MASTER_PASSWORD;
   if (fromEnv) return fromEnv;
-  if (env.TR_SECRETS_NO_KEYCHAIN === '1') return null;
-  if (readKeychain !== readTrKeychainPassword) return readKeychain(env) || null;
-  if (keychainPassword === undefined) keychainPassword = readKeychain(env) || null;
-  return keychainPassword;
+  if (env.TR_SECRETS_NO_KEYCHAIN !== '1') {
+    let fromKeychain;
+    if (readKeychain !== readTrKeychainPassword) fromKeychain = readKeychain(env) || null;
+    else {
+      if (keychainPassword === undefined) keychainPassword = readKeychain(env) || null;
+      fromKeychain = keychainPassword;
+    }
+    if (fromKeychain) return fromKeychain;
+  }
+  return readEnvFile(env) || null;
+}
+
+/**
+ * The host's env-file carrier: `TR_ENV_FILE`, else `~/.agent/tr.env` — the file
+ * `auto-pull.sh` sources and `secret rekey --env-file` rotates. Only a shell
+ * that sources it used to see the password, so a non-interactive process on a
+ * Linux host (an agent's tool shell, cron, a systemd unit) could not open the
+ * store its own user owns. The file is honoured only when it is a regular file
+ * (not a symlink) that this user owns and no one else can read or write, in a
+ * directory this user owns that no one else can write to.
+ */
+export function readTrEnvFilePassword(env = process.env) {
+  const file = env.TR_ENV_FILE || path.join(env.HOME || os.homedir(), '.agent', 'tr.env');
+  try {
+    // lstat: a symlink could point the carrier at a file someone else controls.
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || (stat.mode & 0o077) !== 0) return null;
+    // A directory others can write to lets them replace the file.
+    const dir = fs.statSync(path.dirname(file));
+    if ((dir.mode & 0o022) !== 0) return null;
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (uid !== null && (stat.uid !== uid || dir.uid !== uid)) return null;
+    const line = fs
+      .readFileSync(file, 'utf8')
+      .split(/\r?\n/)
+      .find((entry) => /^\s*(?:export\s+)?TR_SECRETS_PASSWORD\s*=/.test(entry));
+    if (!line) return null;
+    let value = line.slice(line.indexOf('=') + 1).trim();
+    if (value.length >= 2 && /^(['"]).*\1$/.test(value)) value = value.slice(1, -1);
+    return value || null;
+  } catch {
+    return null;
+  }
 }
 
 function readTrKeychainPassword(env) {