total-recall-brain 3.33.1 → 3.34.0

package/bin/total-recall.mjs

@@ -266,7 +266,7 @@ async function main() {
       }
 
       // Check installed plugins for custom CLI commands declared in manifest
-      const { discoverPlugins } = await import('../src/core/plugin-loader.mjs');
+      const { discoverPlugins, PACKAGE_ROOT } = await import('../src/core/plugin-loader.mjs');
       const plugins = discoverPlugins(process.cwd());
       for (const p of plugins) {
         if (p.valid && p.manifest.cli?.command === command) {
@@ -274,6 +274,10 @@ async function main() {
           if (handlerRel) {
             const absHandler = path.resolve(p.dir, handlerRel);
             if (fs.existsSync(absHandler)) {
+              // Match the host context supplied to dashboard/daemon handlers.
+              process.env.TR_PACKAGE_ROOT = PACKAGE_ROOT;
+              process.env.TR_PLUGIN_ID = p.id;
+              process.env.TR_PLUGIN_DIR = p.dir;
               const handler = await import(absHandler);
               if (handler.run) {
                 await handler.run(process.argv);

package/docs/reference/cli-reference.md

@@ -441,6 +441,17 @@ Search, install, security audit, and remove packages from the skills.sh registry
   - `scan <skill-name>`: Trigger a static security vulnerability audit.
   - `list` (or `ls`): Enumerate all active parent skills and sub-skills.
   - `remove <name>` (or `rm`): Safely delete a skill and re-compile rules.
+  - `optimize [paths...]`: Audit skill ownership and entrypoint size. Explicit
+    `--apply` performs verified lossless extraction; original instructions and
+    references are retained. Ambiguous ownership requires review.
+
+### `skill-manager` (installed plugin)
+
+`configure <file>` selects a mesh node and authorized roots from JSON on that
+node. `status` reports configuration and the last SSSS report; `audit` inspects
+without applying; `optimize` follows the configured `autoApply` preference.
+The daemon runs daily at 03:00 local time and processes changed packages only.
+See the bundled skill-manager README for global and repository configuration.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.33.1",
+  "version": "3.34.0",
   "description": "Personal AI system — database-free, SSSS-powered intelligence engine deployable to any POSIX host.",
   "type": "module",
   "workspaces": [
@@ -68,7 +68,7 @@
   "homepage": "https://github.com/gregiteen/total-recall#readme",
   "dependencies": {
     "@simplewebauthn/server": "^13.3.2",
-    "@ssss/cli": "github:gregiteen/ssss#v0.10.1",
+    "@ssss/cli": "github:gregiteen/ssss#v0.10.3",
     "bcrypt": "^6.0.0",
     "better-sqlite3": "^12.11.1",
     "cookie-parser": "^1.4.7",

package/plugins/creative-search/README.md

@@ -4,7 +4,10 @@ SearXNG metasearch plugin. Its manifest registers query, categories, deep, remem
 
 ## Configuration and commands
 
-Provide `SEARXNG_URL` explicitly. The CLI currently has a personal mesh fallback, which violates generic configuration and is scheduled for removal. `TR_CLI` can select a host CLI file; its derived default is unreliable after installation.
+Set `total-recall csearch config set searxngUrl <instance-url>` or override with
+`SEARXNG_URL`. There is no default host. Settings validate and persist in the
+owning SSSS plugin record. The CLI and generator consume that configuration;
+compilation does not probe external engines. `TR_CLI` may override the host CLI.
 
 ```bash
 npx total-recall plugin install creative-search
@@ -17,7 +20,11 @@ npx total-recall csearch engines
 npx total-recall csearch stats
 ```
 
-There is no registered `csearch config` or `csearch-config` command. CLI settings load loose JSON selected by `AGENT_DIR` or a user-config path; UI settings use localStorage. They are disconnected and some controls are ignored. The correction requires one validated SSSS configuration consumed by every surface.
+`csearch config show|set <key> <value>|reset` manages canonical settings. Legacy
+loose JSON is not automatically imported. The overview panel accepts the host's
+canonical `config` property and shows an unset state without a request. The
+standalone settings panel's localStorage controls remain disconnected; host
+settings persistence and a functioning UI mount still require correction.
 
 ## Current verified limitations
 

package/plugins/creative-search/cli.mjs

@@ -6,11 +6,9 @@
 
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
-import fs from 'node:fs';
-import os from 'node:os';
+import { loadConfig, run as configure } from './config.mjs';
 
-const SEARXNG_URL = process.env.SEARXNG_URL || 'http://100.64.0.1:8888';
-const TR_CLI = process.env.TR_CLI || new URL('../../bin/total-recall.mjs', import.meta.url).pathname;
+const TR_CLI = process.env.TR_CLI || (process.env.TR_PACKAGE_ROOT && path.join(process.env.TR_PACKAGE_ROOT, 'bin/total-recall.mjs'));
 
 // Stop words for keyword extraction
 const STOP_WORDS = new Set([
@@ -25,31 +23,25 @@ const STOP_WORDS = new Set([
   'more','most','some','any','new','using','based'
 ]);
 
-/** Load config; returns defaults if file not found */
-function loadConfig() {
-  const CONFIG_PATH = process.env.AGENT_DIR
-    ? path.join(process.env.AGENT_DIR, 'skills', 'total-recall', 'plugins', 'creative-search', 'config.json')
-    : path.join(os.homedir(), '.config', 'total-recall', 'creative-search', 'config.json');
-  try { return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')); }
-  catch { return {}; }
-}
-
 /** Search SearXNG with query + optional category */
-async function searchSearXNG(query, { categories, lang, limit } = {}) {
+export async function searchSearXNG(query, { categories, lang, limit, config } = {}) {
+  const cfg = config || await loadConfig();
+  if (!cfg.searxngUrl) throw new Error('Configure your instance with csearch config set searxngUrl <URL>, or SEARXNG_URL');
   const params = new URLSearchParams({ q: query, format: 'json' });
   if (lang) params.set('language', lang);
   else params.set('language', 'en');
   if (categories) {
     // Categories can be a comma-separated string or an array
     const cats = Array.isArray(categories) ? categories : categories.split(',');
-    for (const c of cats) params.append('categories', c.trim());
+    params.set('categories', cats.map(c => c.trim()).join(','));
   }
   // Limit results on SearXNG side if possible (SearXNG doesn't support this parameter directly)
-  const url = `${SEARXNG_URL}/search?${params.toString()}`;
-  const res = await fetch(url);
+  const url = `${cfg.searxngUrl}/search?${params.toString()}`;
+  const res = await fetch(url, { signal: AbortSignal.timeout(cfg.timeoutMs) });
   if (!res.ok) throw new Error(`SearXNG returned HTTP ${res.status}`);
   const data = await res.json();
-  const results = (data.results || []).slice(0, limit || 15);
+  if (!Array.isArray(data.results)) throw new Error('SearXNG JSON results missing; enable JSON output on the instance');
+  const results = data.results.slice(0, limit || cfg.maxResults);
   return { results, unresponsive: data.unresponsive_engines || [] };
 }
 
@@ -104,10 +96,12 @@ export async function run(argv) {
   const args = argv.slice(4);
 
   switch (subcommand) {
+    case 'config':
+      return configure([argv[0], argv[1], argv[2], ...argv.slice(4)]);
 
     // ── query ──
     case 'query': {
-      const cfg = loadConfig();
+      const cfg = await loadConfig();
       let categories = (cfg.categories || ['general']).join(',');
 
       // Extract --categories flag from args (can appear anywhere)
@@ -277,7 +271,7 @@ export async function run(argv) {
       const query = args.join(' ');
       if (!query) { console.error('Usage: total-recall csearch remember <search terms>'); process.exitCode = 1; return; }
 
-      const cfg = loadConfig();
+      const cfg = await loadConfig();
       const categories = (cfg.categories || ['general', 'science']).join(',');
 
       const { results } = await searchSearXNG(query, {
@@ -414,8 +408,8 @@ export async function run(argv) {
       console.log('  health                    Check SearXNG health');
       console.log('  engines                   List active engines across categories');
       console.log('\nEnvironment:');
-      console.log('  SEARXNG_URL  (default: http://100.64.0.1:8888)');
-      console.log('\nConfig: total-recall csearch-config show');
+      console.log('  SEARXNG_URL  (optional instance URL override; no default host)');
+      console.log('\nConfig: total-recall csearch config show|set <key> <value>|reset');
       return;
   }
-}
+}

package/plugins/creative-search/config.mjs

@@ -2,15 +2,10 @@
  * Creative Search config — view and update plugin settings.
  */
 import path from 'node:path';
-import fs from 'node:fs';
-import os from 'node:os';
-
-const CONFIG_PATH = process.env.AGENT_DIR
-  ? path.join(process.env.AGENT_DIR, 'skills', 'total-recall', 'plugins', 'creative-search', 'config.json')
-  : path.join(os.homedir(), '.config', 'total-recall', 'creative-search', 'config.json');
+import { pathToFileURL } from 'node:url';
 
 const DEFAULTS = {
-  searxngUrl: 'http://100.64.0.1:8888',
+  searxngUrl: '',
   defaultLang: 'en',
   maxResults: 15,
   categories: ['general', 'science'],
@@ -33,21 +28,50 @@ const CATEGORY_DESCRIPTIONS = {
   timeoutMs: 'Request timeout in milliseconds',
 };
 
-function loadConfig() {
-  try { return { ...DEFAULTS, ...JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8')) }; }
-  catch { return { ...DEFAULTS }; }
+export function validateConfig(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Configuration must be an object');
+  for (const key of Object.keys(input)) if (!Object.hasOwn(DEFAULTS, key)) throw new Error(`Unsupported setting: ${key}`);
+  const config = { ...DEFAULTS, ...input };
+  if (typeof config.searxngUrl !== 'string') throw new Error('Instance URL must be a string');
+  if (config.searxngUrl) {
+    const url = new URL(config.searxngUrl);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error('Use HTTP(S) without URL credentials, query or fragment');
+    config.searxngUrl = url.href.replace(/\/$/, '');
+  }
+  for (const [key, min, max] of [['maxResults', 1, 100], ['timeoutMs', 100, 60000], ['deepResearchSteps', 1, 5]]) {
+    if (!Number.isInteger(config[key]) || config[key] < min || config[key] > max) throw new Error(`${key} must be ${min}..${max}`);
+  }
+  for (const key of ['categories', 'engineGroups']) if (!Array.isArray(config[key]) || config[key].some(v => typeof v !== 'string' || !v.trim())) throw new Error(`${key} must contain strings`);
+  for (const key of ['autoSave', 'includeSnippets']) if (typeof config[key] !== 'boolean') throw new Error(`${key} must be boolean`);
+  if (typeof config.defaultLang !== 'string' || !config.defaultLang.trim()) throw new Error('Language must be nonempty');
+  return config;
+}
+
+async function hostApi({ packageRoot = process.env.TR_PACKAGE_ROOT, projectRoot = process.cwd(), plugin } = {}) {
+  if (!packageRoot) throw new Error('Run through the Total Recall plugin host');
+  const load = name => import(pathToFileURL(path.join(packageRoot, 'src/core', name)).href);
+  const [{ getPlugin }, store] = await Promise.all([load('plugin-loader.mjs'), load('plugin-store.mjs')]);
+  const installed = plugin || getPlugin('creative-search', projectRoot);
+  if (!installed?.valid) throw new Error('Install Creative Search first');
+  return { plugin: installed, store };
+}
+
+export async function loadConfig(host) {
+  const { plugin, store } = await hostApi(host);
+  const config = store.readPluginRecord(plugin)?.search_config || {};
+  return validateConfig({ ...config, ...(process.env.SEARXNG_URL ? { searxngUrl: process.env.SEARXNG_URL } : {}) });
 }
 
-function saveConfig(config) {
-  fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+async function saveConfig(config) {
+  const { plugin, store } = await hostApi();
+  await store.patchPluginRecord(plugin, { search_config: validateConfig(config) });
 }
 
 export async function run(argv) {
   const sub = argv[3] || 'show';
   switch (sub) {
     case 'show': {
-      const c = loadConfig();
+      const c = await loadConfig();
       console.log('\n⚙️  Creative Search — Configuration\n');
       for (const [k, v] of Object.entries(c)) {
         const desc = CATEGORY_DESCRIPTIONS[k];
@@ -55,7 +79,7 @@ export async function run(argv) {
         if (desc) console.log(`       ${desc}`);
         console.log();
       }
-      console.log(`  Config file: ${CONFIG_PATH}\n`);
+      console.log('  Storage: SSSS plugin record\n');
       return { data: c };
     }
     case 'set': {
@@ -69,12 +93,14 @@ export async function run(argv) {
         process.exitCode = 1;
         return;
       }
-      const c = loadConfig();
+      if (!Object.hasOwn(DEFAULTS, key)) throw new Error(`Unsupported setting: ${key}`);
+      const { plugin, store } = await hostApi();
+      const c = validateConfig(store.readPluginRecord(plugin)?.search_config || {});
       // Parse numbers, booleans, and arrays
       if (key === 'categories' || key === 'engineGroups') {
         c[key] = value.split(',').map(s => s.trim());
       } else if (key === 'deepResearchSteps' || key === 'maxResults' || key === 'timeoutMs') {
-        c[key] = parseInt(value, 10);
+        c[key] = Number(value);
       } else if (value === 'true') {
         c[key] = true;
       } else if (value === 'false') {
@@ -84,12 +110,12 @@ export async function run(argv) {
       } else {
         c[key] = value;
       }
-      saveConfig(c);
+      await saveConfig(c);
       console.log(`✅ Set ${key} = ${JSON.stringify(c[key])}`);
       return { data: { [key]: c[key] } };
     }
     case 'reset':
-      saveConfig({ ...DEFAULTS });
+      await saveConfig({ ...DEFAULTS });
       console.log('✅ Config reset to defaults');
       return { data: { ...DEFAULTS } };
     default:
@@ -100,4 +126,4 @@ export async function run(argv) {
       }
       return { data: { keys: Object.keys(CATEGORY_DESCRIPTIONS) } };
   }
-}
+}

package/plugins/creative-search/generator.mjs

@@ -1,44 +1,13 @@
-/**
- * Creative Search — compiled agent context generator.
- * Called during `total-recall compile` to inject search status into agent surfaces.
- * @module @total-recall/plugin-creative-search/generator
- */
+import { loadConfig } from './config.mjs';
 
-const SEARXNG_URL = process.env.SEARXNG_URL || 'http://100.64.0.1:8888';
-
-export async function generateContext() {
+// Compilation reads settings only; external health probes are explicit CLI work.
+export async function generateContext(host) {
   try {
-    // Multi-category health check
-    const cats = ['general', 'science', 'news', 'it'];
-    const results = [];
-    for (const cat of cats) {
-      const start = Date.now();
-      const res = await fetch(`${SEARXNG_URL}/search?q=health+check&format=json&language=en&categories=${cat}`);
-      const ms = Date.now() - start;
-      if (res.ok) {
-        const data = await res.json();
-        const engines = new Set();
-        for (const r of data.results || []) {
-          for (const e of r.engines || []) engines.add(e);
-        }
-        results.push({ category: cat, ms, count: data.results?.length || 0, engines: engines.size });
-      } else {
-        results.push({ category: cat, ms, count: 0, engines: 0 });
-      }
-    }
-
-    const avgMs = Math.round(results.reduce((s, r) => s + r.ms, 0) / results.length);
-    const totalEngines = results.reduce((s, r) => s + r.engines, 0);
-    const online = results.filter(r => r.count > 0).length;
-
-    return {
-      section: 'creative-search',
-      text: `Creative Search (SearXNG metasearch): online (${online}/${cats.length} categories, ~${avgMs}ms avg), ` +
-        `~${totalEngines} engines available across ${cats.length} categories. ` +
-        `Search: total-recall csearch query <terms> | Deep research: total-recall csearch deep <topic> | ` +
-        `Save to TR memory: total-recall csearch remember <terms>.`,
-    };
+    const config = await loadConfig(host);
+    return config.searxngUrl
+      ? 'Creative Search: configured SearXNG metasearch. Query: total-recall csearch query <terms>. Health: total-recall csearch health.'
+      : 'Creative Search: instance URL unset. Configure with total-recall csearch config set searxngUrl <URL>.';
   } catch {
-    return { section: 'creative-search', text: '⚠️ Creative Search: SearXNG health check failed.' };
+    return 'Creative Search: configuration unavailable; inspect total-recall csearch config show.';
   }
-}
+}

package/plugins/creative-search/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "creative-search",
   "name": "Creative Search",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "SearXNG-powered creative metasearch with categories, deep research, TR memory integration, engine stats, and health monitoring.",
   "author": "Total Recall",
   "license": "MIT",
@@ -11,6 +11,7 @@
     "command": "csearch",
     "handler": "./cli.mjs",
     "subcommands": [
+      { "name": "config", "description": "Validated instance settings in SSSS" },
       { "name": "query", "description": "Search for terms" },
       { "name": "health", "description": "Check SearXNG health" },
       { "name": "engines", "description": "List active engines" },
@@ -41,6 +42,7 @@
         "module": "ui/csearch-main.js",
         "description": "Creative Search overview with branding, engine health, and quick commands",
         "events": [],
+        "props": { "config": { "type": "object", "description": "Host-supplied canonical search settings" } },
         "tokens": ["color-primary", "color-accent", "color-secondary", "color-success", "color-error", "color-warning", "color-text", "color-text-secondary", "color-text-tertiary", "color-surface", "color-surface-secondary", "color-border", "color-on-primary", "radius-sm", "radius-md", "radius-full", "spacing-xs", "spacing-sm", "spacing-md", "spacing-lg", "spacing-xl", "typography-body-size", "typography-h2-size", "typography-h3-size", "typography-caption-size", "font-family-ui", "font-family-mono"],
         "optional_tokens": []
       },
@@ -56,4 +58,4 @@
       }
     ]
   }
-}
+}

package/plugins/creative-search/ui/csearch-main.js

@@ -236,7 +236,6 @@ const ENGINE_GROUPS = {
   'Multimedia': ['flickr', 'unsplash'],
 };
 
-const STORAGE_KEY = 'csearch-settings';
 
 export class CSearchMain extends HTMLElement {
   constructor() {
@@ -256,29 +255,33 @@ export class CSearchMain extends HTMLElement {
   }
 
   _loadSettings() {
-    let categories = ['general', 'science'];
-    try {
-      const raw = localStorage.getItem(STORAGE_KEY);
-      if (raw) {
-        const parsed = JSON.parse(raw);
-        if (parsed.categories && parsed.categories.length) categories = parsed.categories;
-      }
-    } catch {}
+    const categories = this.config.categories || ['general', 'science'];
     const container = this.shadowRoot.getElementById('categoriesList');
     container.innerHTML = categories.map(c => `<span class="tag">${c}</span>`).join('');
   }
 
+  set config(value) {
+    this._config = value || {};
+    if (this.isConnected) { this._loadSettings(); this._checkHealth(); }
+  }
+
+  get config() { return this._config || {}; }
+
   async _checkHealth() {
     const indicator = this.shadowRoot.getElementById('healthIndicator');
+    const base = this.config.searxngUrl;
+    if (!base) { indicator.textContent = 'Not configured'; this.shadowRoot.getElementById('engineCount').textContent = '—'; return; }
     try {
-      const res = await fetch('http://100.64.0.1:8888/search?q=health&format=json&categories=general&engines=duckduckgo', {
+      const url = new URL(base);
+      if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) throw new Error('Invalid instance URL');
+      const res = await fetch(`${url.href.replace(/\/$/, '')}/search?q=health&format=json&categories=general`, {
         signal: AbortSignal.timeout(5000),
       });
       if (res.ok) {
         const data = await res.json();
-        const engineCount = data.engines ? Object.keys(data.engines).length : 0;
+        const engineCount = new Set((data.results || []).flatMap(result => result.engines || (result.engine ? [result.engine] : []))).size;
         indicator.textContent = engineCount > 0 ? `${engineCount} engines` : '✓ Online';
-        this.shadowRoot.getElementById('engineCount').textContent = engineCount || '25+';
+        this.shadowRoot.getElementById('engineCount').textContent = engineCount || '—';
       } else {
         indicator.textContent = '⚠ Error';
       }
@@ -308,4 +311,4 @@ export class CSearchMain extends HTMLElement {
 }
 
 customElements.define('csearch-main', CSearchMain);
-export default CSearchMain;
+export default CSearchMain;

package/plugins/skill-manager/README.md

@@ -0,0 +1,30 @@
+# Skill Manager
+
+The Total Recall daemon runs this plugin daily at 03:00 in the node's local time. A task stays idle until its
+SSSS plugin record explicitly selects the current mesh node. Node identities,
+skill roots and repository ownership are instance configuration.
+
+Install on the intended node with `total-recall plugin install skill-manager`.
+Create a configuration file on that node:
+
+```json
+{
+  "node": "build-box",
+  "autoApply": false,
+  "maxTokens": 900,
+  "roots": [{ "path": "/absolute/skills/root", "scope": "global" }]
+}
+```
+
+For a repository skill root use `scope: "repository"` and an explicit
+`repoRoot`. Run `total-recall skill-manager configure <file>` there, using
+`total-recall mesh exec <node> '<command>'` for remote control. Configuration,
+last results and schedule slots persist through SSSS operations. `status`
+reports them; `audit` inspects without applying; `optimize` follows autoApply.
+
+Only changed packages are reprocessed; changes to references or configuration
+invalidate cached results. Automatic application is lossless: retained source,
+reference hashes and essential rules remain available. Ambiguous boundaries,
+ownership mismatch, symlinks or changed optimized instructions need review.
+There is no model-generated rewrite or implicit traversal of other repositories.
+The daemon records actual command exits, including review (2) and errors (1).

package/plugins/skill-manager/cli.mjs

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+
+const digest = value => crypto.createHash('sha256').update(value).digest('hex');
+
+export function validateConfig(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Configuration must be an object');
+  if (typeof input.node !== 'string' || !input.node.trim()) throw new Error('Select a mesh node');
+  if (typeof input.autoApply !== 'boolean') throw new Error('autoApply must be explicitly true or false');
+  if (!Number.isInteger(input.maxTokens) || input.maxTokens < 100 || input.maxTokens > 10000) throw new Error('maxTokens must be 100..10000');
+  if (!Array.isArray(input.roots) || !input.roots.length) throw new Error('Authorize at least one skill root');
+  const roots = input.roots.map(root => {
+    if (!root || !path.isAbsolute(root.path || '')) throw new Error('Skill root must be an absolute path on the selected node');
+    if (!['global', 'repository'].includes(root.scope)) throw new Error('Root scope must be global or repository');
+    const physical = fs.realpathSync(root.path);
+    if (!fs.statSync(physical).isDirectory()) throw new Error('Skill root must be a directory');
+    if (physical.split(path.sep).some(part => ['node_modules', 'memory-vault', 'memory-derived', '.git'].includes(part))) throw new Error('Unauthorized skill root');
+    if (root.scope === 'global') return { path: physical, scope: 'global' };
+    if (!path.isAbsolute(root.repoRoot || '')) throw new Error('Repository root must be explicit');
+    const repoRoot = fs.realpathSync(root.repoRoot);
+    if (!physical.startsWith(repoRoot + path.sep)) throw new Error('Skill root must belong to its repository');
+    return { path: physical, scope: 'repository', repoRoot };
+  });
+  return { node: input.node.trim(), autoApply: input.autoApply, maxTokens: input.maxTokens, roots };
+}
+
+// Include supporting references: a changed requirement invalidates the cached audit.
+export function packageHash(dir) {
+  const entries = [];
+  function visit(folder) {
+    for (const entry of fs.readdirSync(folder, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (entry.name.startsWith('.') || ['node_modules', 'memory-vault', 'memory-derived'].includes(entry.name)) continue;
+      const target = path.join(folder, entry.name);
+      if (entry.isSymbolicLink()) throw new Error('Skill package contains a symlink; review required');
+      if (entry.isDirectory()) visit(target);
+      else if (entry.isFile()) entries.push([path.relative(dir, target), digest(fs.readFileSync(target))]);
+    }
+  }
+  visit(dir);
+  return digest(JSON.stringify(entries));
+}
+
+export async function inspect(config, previous, api, { apply = false } = {}) {
+  const configHash = digest(JSON.stringify(config));
+  const cached = previous?.configHash === configHash && previous?.applied === apply ? previous.packages || {} : {};
+  const packages = {}, results = [];
+  for (const root of config.roots) {
+    const options = { maxTokens: config.maxTokens, apply, ...(root.scope === 'global' ? { globalRoot: root.path } : { repoRoot: root.repoRoot }) };
+    for (const dir of api.skillDirectories(root.path)) {
+      try {
+        const before = packageHash(dir);
+        if (cached[dir]?.hash === before) {
+          packages[dir] = cached[dir];
+          results.push({ ...cached[dir].result, cached: true });
+          continue;
+        }
+        const result = api.optimizeSkills([dir], options)[0];
+        results.push(result);
+        packages[dir] = { hash: packageHash(dir), result: result.status === 'applied' ? { ...result, status: 'current', reason: 'previously-applied', saved: 0 } : result };
+      } catch (err) { results.push({ path: dir, status: 'error', reason: err.message }); }
+    }
+  }
+  return { at: new Date().toISOString(), configHash, applied: apply, packages, results,
+    counts: results.reduce((counts, result) => ({ ...counts, [result.status]: (counts[result.status] || 0) + 1 }), {}) };
+}
+
+export async function run(argv) {
+  const packageRoot = process.env.TR_PACKAGE_ROOT;
+  if (!packageRoot) throw new Error('Run through total-recall skill-manager');
+  const load = module => import(pathToFileURL(path.join(packageRoot, 'src/core', module)).href);
+  const [{ getPlugin }, store, mesh, optimizer, { taskRunsOnNode }] = await Promise.all([
+    load('plugin-loader.mjs'), load('plugin-store.mjs'), load('mesh.mjs'), load('skill-optimizer.mjs'), load('plugin-tasks.mjs')
+  ]);
+  const plugin = getPlugin('skill-manager');
+  if (!plugin?.valid) throw new Error('Install a valid skill-manager plugin first');
+  const command = argv[3] || 'status';
+  let record = store.readPluginRecord(plugin);
+  if (command === 'configure') {
+    if (argv.length !== 5) throw new Error('Usage: skill-manager configure <JSON file on selected node>');
+    const config = validateConfig(JSON.parse(fs.readFileSync(argv[4], 'utf8')));
+    if (!taskRunsOnNode({ command: 'optimize', placement: 'selected-node' }, { task_nodes: { optimize: config.node } }, mesh.getMeshSelf())) {
+      throw new Error('Configure on the selected node using mesh exec <node>; no remote paths are guessed');
+    }
+    await store.patchPluginRecord(plugin, { optimizer_config: config, task_nodes: { ...record?.task_nodes, optimize: config.node } });
+    console.log(JSON.stringify({ configured: true, ...config }));
+    return;
+  }
+  if (command === 'status') {
+    console.log(JSON.stringify({ configured: !!record?.optimizer_config, node: record?.task_nodes?.optimize || null,
+      config: record?.optimizer_config || null, lastReport: record?.optimizer_report || null }));
+    return;
+  }
+  if (!['audit', 'optimize'].includes(command)) throw new Error('Unknown skill-manager command');
+  if (!record?.optimizer_config) throw new Error('Configure authorized roots and a selected node first');
+  if (!taskRunsOnNode({ command: 'optimize', placement: 'selected-node' }, record, mesh.getMeshSelf())) throw new Error('This is not the selected mesh node');
+  const config = validateConfig(record.optimizer_config);
+  const report = await inspect(config, record.optimizer_report, optimizer, { apply: command === 'optimize' && config.autoApply });
+  await store.patchPluginRecord(plugin, { optimizer_report: report });
+  console.log(JSON.stringify(report));
+  if (report.counts.error) process.exitCode = 1;
+  else if (report.counts.review) process.exitCode = 2;
+}

package/plugins/skill-manager/plugin.json

@@ -0,0 +1,24 @@
+{
+  "id": "skill-manager",
+  "name": "Skill Manager",
+  "version": "1.0.0",
+  "description": "Conservative skill optimization on an explicitly selected daemon node and authorized roots.",
+  "license": "MIT",
+  "use_cases": ["skills", "automation"],
+  "cli": {
+    "command": "skill-manager",
+    "handler": "./cli.mjs",
+    "subcommands": [
+      { "name": "configure", "description": "Select a mesh node and authorized skill roots from a JSON configuration" },
+      { "name": "status", "description": "Show selection, configuration and last report" },
+      { "name": "audit", "description": "Inspect changed skill packages without applying changes" },
+      { "name": "optimize", "description": "Run configured conservative optimization on the selected node" }
+    ]
+  },
+  "tasks": [{
+    "intent": "Inspect changed skills and apply only authorized lossless optimization",
+    "schedule": "0 3 * * *",
+    "command": "optimize",
+    "placement": "selected-node"
+  }]
+}

package/scaffold/.agent/skills/decision/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: decision
+description: Design and use typed decisions for routing, classification, ranking and verification; configure Jev through the existing decision capability.
+repo_scoped: false
+---
+
+# Decision
+
+Use one decision capability for closed choices, yes/no probabilities and ordered scores. Jev is a configurable engine; use a generative model when the task needs prose. Typed output still needs validation and domain evaluation.
+
+Discover the current repository's decision plugin, configuration, credential resolver and local overlay. Confirm installed commands before invoking them. Resolve model, endpoint, timeout, budget and gates from config or flags; keep credentials in the existing secret store. Public skills contain portable methods, not repository or account instances.
+
+Validate typed answers before branching. Choice/Score confidence differs from Noul's probability of yes; never default missing certainty to success. Calibrate outcome gates using representative cases. Missing config, invalid output, timeout or provider failure takes the deterministic fallback. Required instructions, scope and permissions stay enforced in code; model advice cannot override them.
+
+Read only the reference needed now:
+
+- [Integration and typed response contract](references/integration.md)
+- [Skill routing and use cases](references/use-cases.md)
+
+Keep shared state small; batch independent questions and compute arithmetic in code. Test synthetic success, abstention and failure cases before integration. Live provider evidence is separate from mocks. Record model/version, decision and measured outcome without secrets or unnecessary state. Preserve existing human approval requirements.