total-recall-brain 3.31.2 → 3.32.1

package/src/core/daemon-control.mjs

@@ -9,7 +9,11 @@ import { agentDir, brainDir } from './config.mjs';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.join(__dirname, '..', '..');
 
-const PID_FILE = path.join(brainDir, 'logs', 'daemon.pid');
+// The daemon's own lockfile (daemon-loop acquirePidLock). start/stop/status read the
+// same file: a separate logs/daemon.pid let `daemon stop` miss the live daemon and
+// leave it running old code alongside a newly started one.
+export const DAEMON_PID_FILE = path.join(brainDir, 'daemon.pid');
+const PID_FILE = DAEMON_PID_FILE;
 const LOG_FILE = path.join(brainDir, 'logs', 'daemon.log');
 
 /**
@@ -104,8 +108,8 @@ export function startDaemon() {
 
   child.unref();
   
-  // Write the PID file
-  fs.writeFileSync(PID_FILE, String(child.pid), 'utf8');
+  // The daemon writes DAEMON_PID_FILE itself when it acquires its lock;
+  // pre-writing the child's pid here made the child see a live lock and exit.
   fs.closeSync(logFd);
 
   logger.info('daemon-control', `Active Intelligence Daemon started detached (PID ${child.pid}).`);
@@ -113,10 +117,13 @@ export function startDaemon() {
 }
 
 /**
- * Stops the running background daemon.
- * @returns {boolean} True if successfully stopped, false otherwise.
+ * Stops the running background daemon and waits for the process to exit.
+ * The daemon owns its lockfile and removes it on exit, so a start issued right
+ * after stop can never run alongside a daemon that is still finishing work.
+ * @param {{ graceMs?: number, pollMs?: number }} [opts]
+ * @returns {Promise<boolean>} True if a daemon was running and has exited.
  */
-export function stopDaemon() {
+export async function stopDaemon({ graceMs = 35_000, pollMs = 250 } = {}) {
   const pid = readPid();
   if (!pid) {
     // Clear PID file in case it was a stale/dead record
@@ -126,19 +133,31 @@ export function stopDaemon() {
     return false;
   }
 
+  const alive = () => { try { process.kill(pid, 0); return true; } catch { return false; } };
   try {
     process.kill(pid, 'SIGTERM');
     logger.info('daemon-control', `Sent SIGTERM to daemon PID ${pid}.`);
-    
-    // Wait briefly and verify cleanup
-    try {
-      if (fs.existsSync(PID_FILE)) fs.unlinkSync(PID_FILE);
-    } catch {}
-    return true;
   } catch (err) {
     logger.error('daemon-control', `Failed to terminate daemon PID ${pid}: ${err.message}`);
     return false;
   }
+
+  const deadline = Date.now() + graceMs;
+  while (alive() && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+  }
+  if (alive()) {
+    logger.warn('daemon-control', `Daemon PID ${pid} still running after ${graceMs}ms — sending SIGKILL.`);
+    try { process.kill(pid, 'SIGKILL'); } catch {}
+  }
+
+  // A SIGKILLed daemon cannot run its exit handler; drop its lock if still ours.
+  try {
+    if (fs.existsSync(PID_FILE) && parseInt(fs.readFileSync(PID_FILE, 'utf8').trim(), 10) === pid) {
+      fs.unlinkSync(PID_FILE);
+    }
+  } catch {}
+  return true;
 }
 
 /**

package/src/core/daemon-loop.mjs

@@ -12,6 +12,7 @@
  */
 
 import path from 'path';
+import { DAEMON_PID_FILE } from './daemon-control.mjs';
 import fs from 'fs';
 import { fileURLToPath } from 'node:url';
 import { readProcessCommand, entryPathHint, shouldHonorPidLock } from './pid-lock.mjs';
@@ -102,7 +103,7 @@ export function writeInterrupt(message) {
 
 // ─── PID Lockfile ───────────────────────────────────────────────────────────────
 
-const PID_FILE = path.join(BRAIN_DIR, 'daemon.pid');
+const PID_FILE = DAEMON_PID_FILE;
 
 /**
  * Attempt to acquire the PID lockfile. If another daemon is alive, exit.
@@ -112,7 +113,7 @@ export function acquirePidLock() {
   try {
     if (fs.existsSync(PID_FILE)) {
       const existingPid = parseInt(fs.readFileSync(PID_FILE, 'utf8').trim(), 10);
-      if (existingPid && !isNaN(existingPid)) {
+      if (existingPid && !isNaN(existingPid) && existingPid !== process.pid) {
         // Liveness alone cannot tell our daemon from whatever else inherited
         // the number after a reboot — observed here holding a PID that had
         // since been handed to an unrelated desktop app, which would refuse
@@ -218,14 +219,20 @@ function shutdown(signal) {
       });
     })
     .finally(() => {
-      try {
-        releasePidLock();
-      } catch {
-        // Lock already gone — nothing to release.
-      }
+      // Keep the PID lock until the process really exits (see the 'exit'
+      // handler): releasing it here let a new daemon start while this one was
+      // still finishing its current task.
     });
 }
 
+process.on('exit', () => {
+  try {
+    releasePidLock();
+  } catch {
+    // Lock already gone — nothing to release.
+  }
+});
+
 process.on('SIGTERM', () => shutdown('SIGTERM'));
 process.on('SIGINT', () => shutdown('SIGINT'));
 

package/src/core/plugin-loader.mjs

@@ -2,6 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { validateAppCliSpec } from './app-deploy/runtime-cli.mjs';
+import { validateUiSpec } from './app-deploy/ui-elements.mjs';
 
 const ID_PATTERN = /^[a-z][a-z0-9-]{1,63}$/;
 const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
@@ -226,27 +228,25 @@ export function validatePluginManifest(manifest) {
           errors.push("Each entry in 'commands' must be an object");
           continue;
         }
-        if (!c.name || typeof c.name !== 'string') {
-          errors.push("Each command entry must have a string 'name'");
+        if (typeof c.name !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(c.name)) {
+          errors.push("Each command entry must have a safe lowercase kebab-case 'name'");
         }
         if (!c.handler || !isSafeRelativePath(c.handler)) {
           errors.push(`Command '${c.name || 'unknown'}' has invalid or unsafe 'handler': must be safe relative path`);
         }
+        if (c.background !== undefined && typeof c.background !== 'boolean') {
+          errors.push(`Command '${c.name || 'unknown'}' background must be boolean`);
+        }
       }
     }
   }
 
   if (manifest.ui !== undefined) {
-    if (typeof manifest.ui !== 'object' || manifest.ui === null) {
-      errors.push("'ui' must be an object");
-    } else {
-      if (manifest.ui.design_tokens !== undefined && !isSafeRelativePath(manifest.ui.design_tokens)) {
-        errors.push("'ui.design_tokens' must be a safe relative path");
-      }
-      if (manifest.ui.elements !== undefined && !Array.isArray(manifest.ui.elements)) {
-        errors.push("'ui.elements' must be an array");
-      }
-    }
+    errors.push(...validateUiSpec(manifest.ui));
+  }
+
+  if (manifest.app_cli !== undefined) {
+    errors.push(...validateAppCliSpec(manifest.app_cli));
   }
 
   if (manifest.openwiki_hubs !== undefined) {

package/src/core/project-id.mjs

@@ -0,0 +1,72 @@
+/**
+ * Stable per-project identity: a random UUID kept in the project brain's
+ * config/brain.json (`project_id`) and mirrored into the project registry.
+ * Never derived from names or paths.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+function brainJsonPath(brainDir) {
+  return path.join(brainDir, 'config', 'brain.json');
+}
+
+function readJson(file, fallback) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJsonAtomic(file, data) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+/** The project id stored for a project brain, or null. */
+export function readProjectId(brainDir) {
+  return readJson(brainJsonPath(brainDir), {}).project_id || null;
+}
+
+/**
+ * Return the project's id, creating a random UUID on first use.
+ * @returns {{ project_id: string, created: boolean }}
+ */
+export function ensureProjectId(brainDir) {
+  const file = brainJsonPath(brainDir);
+  const cfg = readJson(file, {});
+  if (cfg.project_id) return { project_id: cfg.project_id, created: false };
+  cfg.project_id = randomUUID();
+  writeJsonAtomic(file, cfg);
+  return { project_id: cfg.project_id, created: true };
+}
+
+/**
+ * Give every registered project an id and make the registry agree with each
+ * project's brain.json (the brain.json id wins).
+ * @returns {{ total: number, created: number, synced: number, missing_brain: number }}
+ */
+export function repairProjectIds(globalBrainDir) {
+  const registryPath = path.join(globalBrainDir, 'config', 'project-registry.json');
+  const list = readJson(registryPath, []);
+  const out = { total: 0, created: 0, synced: 0, missing_brain: 0 };
+  if (!Array.isArray(list)) return out;
+  for (const row of list) {
+    out.total++;
+    if (!row?.brainDir || !fs.existsSync(row.brainDir)) {
+      out.missing_brain++;
+      continue;
+    }
+    const { project_id, created } = ensureProjectId(row.brainDir);
+    if (created) out.created++;
+    if (row.project_id !== project_id) {
+      row.project_id = project_id;
+      out.synced++;
+    }
+  }
+  if (out.synced) writeJsonAtomic(registryPath, list);
+  return out;
+}

package/src/core/provider-catalog.mjs

@@ -464,7 +464,7 @@ function matchesOnTokenBoundary(k, stem) {
 export function providerForKeyName(keyName) {
   // Strip packaging prefixes so DEVELOPER_BRAVE_SEARCH_API_KEY → BRAVE_SEARCH_API_KEY
   let k = String(keyName || '').toUpperCase();
-  k = k.replace(/^(DEVELOPER_|VITE_|NEXT_PUBLIC_|PUBLIC_|NUXT_PUBLIC_|PORTFOLIO_|ULTRACHAT_)+/g, '');
+  k = k.replace(/^(DEVELOPER_|VITE_|NEXT_PUBLIC_|PUBLIC_|NUXT_PUBLIC_)+/g, '');
 
   // Tier 1 — exact pattern match.
   for (const p of PROVIDER_CATALOG) {

package/src/core/schema.mjs

@@ -231,6 +231,63 @@ export const ConversationSchema = z.object({
   created_at: ssssDatetime().optional(),
 });
 
+// SSSS 0.10 core primitives (spec §5.4). `role` and `thread` are the canonical
+// forms of `security_role` and `conversation`, which stay for existing vaults.
+export const AssetSchema = z.object({
+  type: z.literal('asset'),
+  name: z.string(),
+  mime_type: z.string(),
+  encoding: z.enum(['base64', 'utf-8', 'none']),
+  slug: z.string().optional(),
+  hash: z.string().optional(),
+  size_bytes: z.number().int().nonnegative().optional(),
+  description: z.string().optional(),
+});
+
+export const ResourceSchema = z.object({
+  type: z.literal('resource'),
+  name: z.string(),
+  kind: z.string(),
+  status: z.enum(['bound', 'unbound', 'pending', 'error']),
+  slug: z.string().optional(),
+  description: z.string().optional(),
+  binds: z.unknown().optional(),
+  provisioning: z.unknown().optional(),
+});
+
+export const RoleSchema = z.object({
+  type: z.literal('role'),
+  name: z.string(),
+  permissions: z.array(z.string()),
+  description: z.string().optional(),
+});
+
+export const TriggerSchema = z.object({
+  type: z.literal('trigger'),
+  name: z.string(),
+  source: z.enum(['cron', 'interval', 'webhook', 'event', 'file_change', 'condition', 'manual']),
+  status: z.enum(['active', 'paused', 'disabled']),
+  slug: z.string().optional(),
+  description: z.string().optional(),
+  cron: z.string().optional(),
+  interval: z.union([z.string(), z.number()]).optional(),
+  timezone: z.string().optional(),
+  target_workflow: z.string().optional(),
+  target_params: z.record(z.unknown()).optional(),
+  concurrency: z.enum(['allow_parallel', 'skip_if_running', 'enqueue', 'replace']).optional(),
+  misfire_policy: z.enum(['skip', 'run_once', 'catch_up']).optional(),
+});
+
+export const ThreadSchema = z.object({
+  type: z.literal('thread'),
+  thread_id: z.string(),
+  workspace_id: z.string().optional(),
+  user_id: z.string().optional(),
+  status: z.enum(['active', 'archived', 'closed']).optional(),
+  turn_count: z.number().int().optional(),
+  created_at: ssssDatetime().optional(),
+});
+
 export const RunSchema = z.object({
   type: z.literal('run'),
   run_id: z.string(),
@@ -1162,25 +1219,22 @@ export const AccessGrantSchema = z.object({
 }).passthrough();
 
 /**
- * Canonical repo-layer skill configuration record.
- * Persisted as an SSSS document in the project vault (e.g. `system/skills/<id>.md`).
- * Controls gate commands, tier rules, and repo customizations.
- * Projected into `config.json` for skill scripts to read.
+ * Canonical repo-layer configuration for a layered skill, stored in the repo's
+ * project vault at `system/skills/<skill_id>.md` and written only through the
+ * operation service (`src/core/skill-config.mjs`). The shape of `config` is the
+ * skill core's contract (`core/config.schema.json`), not this host type, so no
+ * skill-specific fields belong here. `config.json` beside the skill is a
+ * projection of `config`, rebuilt after every write.
  */
 export const SkillConfigSchema = z.object({
   type: z.literal('skill_config'),
   title: z.string().min(1),
   description: z.string().min(1),
   timestamp: ssssDatetime(),
-  skill_id: z.string().regex(/^[a-z][a-z0-9-]{1,63}$/),
-  version: z.string().min(1),
-  config: z.record(z.any()).default({}),
-  tiers: z.record(z.any()).optional().default({}),
-  gates: z.array(z.object({
-    name: z.string(),
-    command: z.string(),
-    tier: z.string().optional()
-  })).optional().default([]),
+  skill_id: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/),
+  config: z.record(z.string(), z.any()),
+  /** SHA-256 of the core/config.schema.json the config was validated against. */
+  schema_sha256: z.string().regex(/^[0-9a-f]{64}$/),
   created_at: ssssDatetime(),
   updated_at: ssssDatetime().optional()
 }).passthrough();
@@ -1221,6 +1275,11 @@ export const SSSS_SCHEMAS = {
   security_role: SecurityRoleSchema,
   model: ModelSchema,
   conversation: ConversationSchema,
+  asset: AssetSchema,
+  resource: ResourceSchema,
+  role: RoleSchema,
+  trigger: TriggerSchema,
+  thread: ThreadSchema,
   run: RunSchema,
   primitive: PrimitiveSchema,
   proposal: ProposalSchema,

package/src/core/secrets-env-export.mjs

@@ -67,7 +67,8 @@ export function mergeEnvManagedBlock(existing, managedBody) {
 export function projectSlugFromPath(projectPath) {
   if (!projectPath) return null;
   const abs = path.resolve(projectPath);
-  return path.basename(abs);
+  // Bindings are stored trimmed, so a directory name with stray whitespace must match.
+  return path.basename(abs).trim();
 }
 
 /**
@@ -107,9 +108,7 @@ export function secretMatchesTarget(metaRow, target = {}) {
   // Explicit key list mode
   if (target.keys?.length) return true;
 
-  // Bound to this repo by slug or path (policy: at most one product repo per key)
-  // Multi-repo keys are invalid — do not project them until fixed
-  if (repos.length > 1) return false;
+  // Bound to this repo by slug or path (a key may be bound to several repos)
   if (slug && repos.some((r) => r === slug || r === '*' || r.endsWith(`/${slug}`))) {
     return true;
   }

package/src/core/secrets-store.mjs

@@ -319,15 +319,14 @@ function appendAudit(brainDir, event) {
 }
 
 /**
- * Parse repos field. Policy: 0 (developer/tooling) or exactly 1 product repo.
- * Never allow multi-repo binding — each key is unique to one repo or to developer scope.
+ * Parse repos field. A credential may be bound to zero (developer/tooling),
+ * one, or several repos; uniqueness per repo is not required.
  *
  * @param {string|string[]|null|undefined} v
- * @param {{ strict?: boolean }} opts - strict throws if >1; false collapses for read-only display
+ * @param {object} [_opts] - accepted for compatibility; there is no limit
  * @returns {string[]}
  */
-export function normalizeReposBinding(v, opts = {}) {
-  const strict = opts.strict !== false;
+export function normalizeReposBinding(v, _opts = {}) {
   let list = [];
   if (Array.isArray(v)) {
     list = [...new Set(v.map(String).map((s) => s.trim()).filter(Boolean))];
@@ -341,18 +340,21 @@ export function normalizeReposBinding(v, opts = {}) {
       ),
     ];
   }
-  if (strict && list.length > 1) {
-    throw new Error(`A credential can be bound to at most ONE repo. Got ${list.length}: ${list.join(', ')}`);
-  }
   return list;
 }
 
 /**
- * True when meta has multi-repo violation (legacy data).
+ * Multi-repo binding is allowed, so this is never a violation. Kept because
+ * callers still read the field.
  */
-export function isMultiRepoViolation(meta = {}) {
-  const repos = Array.isArray(meta.repos) ? meta.repos.filter(Boolean) : [];
-  return repos.length > 1;
+export function isMultiRepoViolation(_meta = {}) {
+  return false;
+}
+
+/** Lowercase, de-duplicated tag list from an array or comma/space separated string. */
+export function normalizeTags(v) {
+  const raw = Array.isArray(v) ? v : String(v ?? '').split(/[,;\s]+/);
+  return [...new Set(raw.map((t) => String(t).trim().toLowerCase()).filter(Boolean))];
 }
 
 /**
@@ -370,8 +372,9 @@ export function mergeSecretMeta(prev = {}, patch = {}) {
   assign('scope', (v) => (v === 'project' ? 'project' : 'global'));
   assign('provider', (v) => (v ? String(v).toLowerCase() : null));
   assign('label', (v) => (v == null ? null : String(v)));
-  // Writes only — at most one product repo; empty = Developer secrets
-  assign('repos', (v) => normalizeReposBinding(v, { strict: true }));
+  // empty = Developer secrets
+  assign('repos', (v) => normalizeReposBinding(v));
+  assign('tags', normalizeTags);
   assign('subscription_tier', (v) => (v == null || v === '' ? null : String(v)));
   assign('monthly_cost_usd', (v) => (v == null || v === '' ? null : Number(v)));
   assign('monthly_cap_usd', (v) => (v == null || v === '' ? null : Number(v)));
@@ -478,19 +481,13 @@ export function buildSharedValueIndex(rows = []) {
     const multiKey = keys.length > 1;
     // Error unless every member is operator-waived
     const allOk = members.every((m) => m.shared_value_ok === true);
-    let severity = 'error';
-    let error = null;
-    if (allOk) {
-      severity = 'ok';
-      error = null;
-    } else if (multiApp) {
-      severity = 'error';
-      error = `SHARED CREDENTIAL across apps/repos [${apps.join(', ')}] as keys [${keys.join(', ')}]. Issue a unique API key per app and re-bind.`;
-    } else {
-      // Same app/developer but duplicated under multiple secret names — still force unique
-      severity = 'error';
-      error = `SHARED CREDENTIAL value stored under ${keys.length} secret names [${keys.join(', ')}] (app=${apps[0]}). Use one key name or issue distinct values per purpose.`;
-    }
+    // Sharing a value across keys or repos is allowed; it is reported for
+    // information only and never counts as unhealthy.
+    void allOk;
+    const severity = 'info';
+    const error = multiApp
+      ? `Shared value across [${apps.join(', ')}] as keys [${keys.join(', ')}] (allowed).`
+      : `Same value stored under ${keys.length} secret names [${keys.join(', ')}] (allowed).`;
 
     const group = {
       fingerprint: fp.slice(0, 12),
@@ -582,8 +579,9 @@ export async function listSecretsMeta(brainDir) {
       label: m.label || null,
       repos,
       repo: repos.length === 1 ? repos[0] : null,
-      multi_repo_error: isMultiRepoViolation(m),
-      binding_error: isMultiRepoViolation(m) ? `Legacy data error: Bound to ${repos.length} repos. Must be resolved to 1 or 0.` : null,
+      multi_repo_error: false,
+      binding_error: null,
+      tags: Array.isArray(m.tags) ? m.tags : [],
       project_path: m.project_path || null,
       subscription_tier: m.subscription_tier || null,
       monthly_cost_usd: m.monthly_cost_usd ?? null,
@@ -838,6 +836,7 @@ export async function setSecret(brainDir, key, value, opts = {}) {
     scope: opts.scope || prev.scope || 'global',
     provider: opts.provider || prev.provider || null,
     repos: opts.repos !== undefined ? opts.repos : prev.repos,
+    tags: opts.tags !== undefined ? opts.tags : prev.tags,
     subscription_tier: opts.subscription_tier !== undefined ? opts.subscription_tier : prev.subscription_tier,
     monthly_cost_usd: opts.monthly_cost_usd !== undefined ? opts.monthly_cost_usd : prev.monthly_cost_usd,
     monthly_cap_usd: opts.monthly_cap_usd !== undefined ? opts.monthly_cap_usd : prev.monthly_cap_usd,
@@ -860,6 +859,7 @@ export async function setSecret(brainDir, key, value, opts = {}) {
     scope: secrets[META_KEY].keys[key].scope,
     provider: secrets[META_KEY].keys[key].provider,
     actor: opts.actor || 'cli',
+    project_id: opts.project_id || null,
   });
 
   // First-time set only: optionally queue product-level API research (not raw key-name scraping).
@@ -907,6 +907,7 @@ export async function getSecret(brainDir, key, opts = {}) {
     action: opts.action || 'get',
     key,
     actor: opts.actor || 'cli',
+    project_id: opts.project_id || null,
   });
   return { found: true, key, value: secrets[key] };
 }