total-recall-brain 3.4.0 → 3.5.0

package/bin/antigravity.mjs

@@ -83,10 +83,9 @@ if (!process.env.GOOGLE_API_KEY) {
   }
 }
 
-const apiKey = process.env.GOOGLE_API_KEY;
+const apiKey = process.env.GOOGLE_API_KEY || '';
 if (!apiKey) {
-  console.error('Error: GOOGLE_API_KEY environment variable is not configured.');
-  process.exit(1);
+  console.warn('Warning: GOOGLE_API_KEY environment variable is not configured. Attempting connection via GCP Application Default Credentials or ambient environment...');
 }
 
 // Resolve the model dynamically from the API registry based on the category/alias selected
@@ -109,7 +108,13 @@ async function resolveGenerativeModel(selectedModel) {
   }
 
   try {
-    const res = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${apiKey}`, {
+    const keyParam = apiKey ? `key=${apiKey}` : '';
+    const headers = {};
+    if (!apiKey && process.env.GCLOUD_TOKEN) {
+      headers['Authorization'] = `Bearer ${process.env.GCLOUD_TOKEN}`;
+    }
+    const res = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?${keyParam}`, {
+      headers,
       signal: AbortSignal.timeout(5000)
     });
     if (res.ok) {
@@ -154,13 +159,19 @@ async function resolveGenerativeModel(selectedModel) {
 async function main() {
   try {
     const resolvedModel = await resolveGenerativeModel(requestedModel);
-    const url = `https://generativelanguage.googleapis.com/v1beta/models/${resolvedModel}:generateContent?key=${apiKey}`;
+    const keyParam = apiKey ? `?key=${apiKey}` : '';
+    const url = `https://generativelanguage.googleapis.com/v1beta/models/${resolvedModel}:generateContent${keyParam}`;
+
+    const headers = {
+      'Content-Type': 'application/json',
+    };
+    if (!apiKey && process.env.GCLOUD_TOKEN) {
+      headers['Authorization'] = `Bearer ${process.env.GCLOUD_TOKEN}`;
+    }
 
     const res = await fetch(url, {
       method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
+      headers,
       body: JSON.stringify({
         contents: [{
           parts: [{ text: prompt }]

package/frontend/src/api.ts

@@ -685,3 +685,23 @@ export async function fetchExtensionStatus(): Promise<{ available: boolean; conn
   if (!res.ok) return { available: false, connected: false }
   return res.json()
 }
+
+// ─── Auto-Update APIs ──────────────────────────────────────────────────────────
+
+export interface UpdateCheckResult {
+  currentVersion: string
+  latestVersion: string
+  updateAvailable: boolean
+}
+
+export async function checkUpdate(): Promise<UpdateCheckResult> {
+  const res = await apiFetch(`${API_BASE}/api/update/check`)
+  if (!res.ok) throw new Error(`Check update API error: ${res.status}`)
+  return res.json()
+}
+
+export async function runUpdate(): Promise<{ success: boolean; message: string }> {
+  const res = await apiFetch(`${API_BASE}/api/update/run`, { method: 'POST' })
+  if (!res.ok) throw new Error(`Run update API error: ${res.status}`)
+  return res.json()
+}

package/frontend/src/pages/HealthPage.tsx

@@ -1,6 +1,6 @@
 import { useState, useEffect } from 'react'
-import { fetchHealth } from '../api'
-import type { HealthData } from '../types'
+import { fetchHealth, checkUpdate, runUpdate } from '../api'
+import type { HealthData, UpdateCheckResult } from '../types'
 
 function formatUptime(seconds: number): string {
   const d = Math.floor(seconds / 86400)
@@ -15,6 +15,12 @@ export default function HealthPage() {
   const [health, setHealth] = useState<HealthData | null>(null)
   const [error, setError] = useState('')
   const [lastPoll, setLastPoll] = useState<Date | null>(null)
+  
+  // Auto-Update States
+  const [updateInfo, setUpdateInfo] = useState<UpdateCheckResult | null>(null)
+  const [isUpdating, setIsUpdating] = useState(false)
+  const [showConfirmModal, setShowConfirmModal] = useState(false)
+  const [updateError, setUpdateError] = useState('')
 
   useEffect(() => {
     let active = true
@@ -33,17 +39,166 @@ export default function HealthPage() {
 
     poll()
     const interval = setInterval(poll, 5000)
+
+    // Check for updates
+    const checkVersion = async () => {
+      try {
+        const data = await checkUpdate()
+        if (active) setUpdateInfo(data)
+      } catch (e) {
+        console.error('Failed to check updates', e)
+      }
+    }
+    checkVersion()
+
     return () => { active = false; clearInterval(interval) }
   }, [])
 
+  const handleStartUpdate = async () => {
+    setShowConfirmModal(false)
+    setIsUpdating(true)
+    setUpdateError('')
+    
+    try {
+      await runUpdate()
+      
+      // Keep polling health to check when it goes down and recovers
+      let serverDown = false
+      const pollInterval = setInterval(async () => {
+        try {
+          const res = await fetchHealth()
+          if (serverDown && res.status === 'healthy') {
+            clearInterval(pollInterval)
+            window.location.reload()
+          }
+        } catch {
+          // Connection failed = server is offline / restarting
+          serverDown = true
+        }
+      }, 2000)
+
+    } catch (e) {
+      setUpdateError((e as Error).message)
+      setIsUpdating(false)
+    }
+  }
+
   return (
-    <div className="page">
-      <div className="page-header">
-        <h1>System Health</h1>
-        <p>Live monitoring of your sovereign brain {lastPoll && <span>· Last poll: {lastPoll.toLocaleTimeString()}</span>}</p>
+    <div className="page" style={{ position: 'relative' }}>
+      {isUpdating && (
+        <div style={{
+          position: 'fixed',
+          inset: 0,
+          background: 'rgba(13, 17, 23, 0.9)',
+          zIndex: 1000,
+          display: 'flex',
+          flexDirection: 'column',
+          alignItems: 'center',
+          justifyContent: 'center',
+          backdropFilter: 'blur(8px)',
+          animation: 'fadeIn 0.3s ease'
+        }}>
+          <div className="spinner" style={{
+            width: 50,
+            height: 50,
+            border: '4px solid var(--border)',
+            borderTopColor: 'var(--accent)',
+            borderRadius: '50%',
+            animation: 'spin 1s linear infinite',
+            marginBottom: 20
+          }} />
+          <h2 style={{ color: 'var(--text-primary)', marginBottom: 8 }}>Updating Total Recall...</h2>
+          <p style={{ color: 'var(--text-muted)', fontSize: 14 }}>Applying git changes, installing npm modules, and restarting daemon.</p>
+          <p style={{ color: 'var(--accent)', fontSize: 13, marginTop: 10 }}>Please do not close this window.</p>
+        </div>
+      )}
+
+      {showConfirmModal && (
+        <div style={{
+          position: 'fixed',
+          inset: 0,
+          background: 'rgba(0, 0, 0, 0.7)',
+          zIndex: 900,
+          display: 'flex',
+          alignItems: 'center',
+          justifyContent: 'center',
+          backdropFilter: 'blur(4px)',
+          padding: 20
+        }}>
+          <div className="card" style={{
+            maxWidth: 450,
+            width: '100%',
+            backgroundColor: 'var(--bg-surface)',
+            border: '1px solid var(--border)',
+            borderRadius: 12,
+            padding: 24,
+            boxShadow: '0 20px 40px rgba(0, 0, 0, 0.5)'
+          }}>
+            <h3 style={{ marginBottom: 12, color: 'var(--text-primary)' }}>Confirm Core Self-Update</h3>
+            <p style={{ color: 'var(--text-muted)', marginBottom: 20, fontSize: 14, lineHeight: 1.5 }}>
+              This will pull the latest version of Total Recall ({updateInfo?.latestVersion}) from the git repository, reinstall dependencies, rebuild frontend bundles, and reboot the system kernel.
+            </p>
+            <div style={{ display: 'flex', gap: 12, justifyContent: 'flex-end' }}>
+              <button 
+                className="btn btn-secondary" 
+                onClick={() => setShowConfirmModal(false)}
+                style={{ padding: '8px 16px', borderRadius: 8 }}
+              >
+                Cancel
+              </button>
+              <button 
+                className="btn btn-primary" 
+                onClick={handleStartUpdate}
+                style={{ padding: '8px 16px', borderRadius: 8, background: 'var(--accent)' }}
+              >
+                Update Now
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      <div className="page-header" style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
+        <div>
+          <h1>System Health</h1>
+          <p>Live monitoring of your sovereign brain {lastPoll && <span>· Last poll: {lastPoll.toLocaleTimeString()}</span>}</p>
+        </div>
+        {updateInfo?.updateAvailable && (
+          <div className="badge badge-success" style={{
+            display: 'flex',
+            alignItems: 'center',
+            gap: 12,
+            padding: '12px 18px',
+            borderRadius: 12,
+            background: 'rgba(63, 185, 80, 0.1)',
+            border: '1px solid rgba(63, 185, 80, 0.3)',
+            animation: 'pulse 2s infinite'
+          }}>
+            <span style={{ fontSize: 14, color: 'var(--text-primary)', fontWeight: 600 }}>
+              New version available: {updateInfo.latestVersion}
+            </span>
+            <button 
+              className="btn btn-primary" 
+              onClick={() => setShowConfirmModal(true)}
+              style={{
+                fontSize: 12,
+                padding: '6px 12px',
+                borderRadius: 6,
+                backgroundColor: '#3fb950',
+                color: '#fff',
+                border: 'none',
+                cursor: 'pointer',
+                fontWeight: 600
+              }}
+            >
+              Update Now
+            </button>
+          </div>
+        )}
       </div>
 
       {error && <div className="badge badge-error" style={{ marginBottom: 16 }}>⚠️ {error}</div>}
+      {updateError && <div className="badge badge-error" style={{ marginBottom: 16 }}>⚠️ Update failed: {updateError}</div>}
 
       {health ? (
         <>
@@ -55,7 +210,9 @@ export default function HealthPage() {
               <div className="label">Status</div>
             </div>
             <div className="stat-card">
-              <div className="value" style={{ color: 'var(--accent)' }}>{health.version}</div>
+              <div className="value" style={{ color: 'var(--accent)' }}>
+                {health.version} {updateInfo && !updateInfo.updateAvailable && <span style={{ fontSize: 12, color: 'var(--text-muted)' }}>(Latest)</span>}
+              </div>
               <div className="label">Version</div>
             </div>
             <div className="stat-card">
@@ -76,6 +233,10 @@ export default function HealthPage() {
                 <tr><th>Version</th><td>{health.version}</td></tr>
                 <tr><th>Uptime</th><td>{formatUptime(health.uptime_seconds)}</td></tr>
                 <tr><th>Timestamp</th><td>{health.timestamp}</td></tr>
+                <tr><th>Daemon Status</th><td>{health.daemon || 'unknown'}</td></tr>
+                {health.cli_agents && (
+                  <tr><th>CLI Agents</th><td>{health.cli_agents.join(', ')}</td></tr>
+                )}
                 <tr><th>Polling</th><td>Every 5 seconds</td></tr>
               </tbody>
             </table>
@@ -86,6 +247,17 @@ export default function HealthPage() {
           {[1, 2, 3, 4].map(i => <div key={i} className="skeleton" style={{ height: 100 }} />)}
         </div>
       ) : null}
+
+      <style>{`
+        @keyframes spin {
+          0% { transform: rotate(0deg); }
+          100% { transform: rotate(360deg); }
+        }
+        @keyframes fadeIn {
+          from { opacity: 0; }
+          to { opacity: 1; }
+        }
+      `}</style>
     </div>
   )
 }

package/frontend/src/pages/SettingsPage.tsx

@@ -35,6 +35,7 @@ export default function SettingsPage() {
       if (!data.budget.budget) data.budget.budget = { daily_cap_usd: 5.0, weekly_cap_usd: 25.0, enabled: true };
       if (!data.brain) data.brain = {};
       if (!data.brain.preferred_agent) data.brain.preferred_agent = 'auto';
+      if (!data.secrets) data.secrets = {};
       
       setConfigData(data);
     } catch (err: unknown) {
@@ -152,6 +153,17 @@ export default function SettingsPage() {
     });
   };
 
+  const updateSecretsProp = (prop: string, value: string) => {
+    if (!configData) return;
+    setConfigData({
+      ...configData,
+      secrets: {
+        ...configData.secrets,
+        [prop]: value
+      }
+    });
+  };
+
   return (
     <div className="page" style={{ display: 'flex', flexDirection: 'column', height: '100%' }}>
       <div className="page-header" style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', flexWrap: 'wrap', gap: 16 }}>
@@ -209,7 +221,7 @@ export default function SettingsPage() {
         </div>
       ) : viewMode === 'visual' && configData ? (
         /* ==================== VISUAL CONTROL PANEL UI ==================== */
-        <div style={{ display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(360px, 1fr))', gap: 24, flex: 1, minHeight: 0, overflowY: 'auto', paddingBottom: 24 }}>
+        <form onSubmit={(e) => { e.preventDefault(); handleSaveVisual(); }} style={{ display: 'grid', gridTemplateColumns: 'repeat(auto-fit, minmax(360px, 1fr))', gap: 24, flex: 1, minHeight: 0, overflowY: 'auto', paddingBottom: 24 }}>
           
           {/* Card 1: AI Reasoning & Autonomy */}
           <div className="card" style={{ padding: 24, display: 'flex', flexDirection: 'column', gap: 20, background: 'rgba(18, 18, 26, 0.6)', backdropFilter: 'blur(8px)', border: '1px solid var(--border)' }}>
@@ -537,7 +549,190 @@ export default function SettingsPage() {
             </div>
           </div>
 
-        </div>
+          {/* Card 5: API Keys & Integrations */}
+          <div className="card" style={{ padding: 24, display: 'flex', flexDirection: 'column', gap: 20, background: 'rgba(18, 18, 26, 0.6)', backdropFilter: 'blur(8px)', border: '1px solid var(--border)' }}>
+            <div style={{ display: 'flex', alignItems: 'center', gap: 10, borderBottom: '1px solid var(--border)', paddingBottom: 12 }}>
+              <span style={{ fontSize: 20 }}>🔑</span>
+              <div>
+                <h3 style={{ fontSize: 15, fontWeight: 600 }}>API Keys & Integrations</h3>
+                <p style={{ fontSize: 11, color: 'var(--text-tertiary)' }}>Manage access keys and tokens for AI models and search providers</p>
+              </div>
+            </div>
+
+            {/* Google Gemini API Key */}
+            <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+              <label htmlFor="google_api_key" style={{ fontSize: 13, fontWeight: 500 }}>Google Gemini API Key</label>
+              <input
+                id="google_api_key"
+                type="password"
+                placeholder="AIzaSy..."
+                value={configData.secrets?.google_api_key || ''}
+                onChange={(e) => updateSecretsProp('google_api_key', e.target.value)}
+                style={{
+                  background: 'var(--bg-tertiary)',
+                  color: 'var(--text-primary)',
+                  border: '1px solid var(--border)',
+                  padding: '8px 12px',
+                  borderRadius: 6,
+                  outline: 'none',
+                  fontSize: 13
+                }}
+              />
+            </div>
+
+            {/* Anthropic API Key */}
+            <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+              <label htmlFor="anthropic_api_key" style={{ fontSize: 13, fontWeight: 500 }}>Anthropic API Key (Claude Code)</label>
+              <input
+                id="anthropic_api_key"
+                type="password"
+                placeholder="sk-ant-..."
+                value={configData.secrets?.anthropic_api_key || ''}
+                onChange={(e) => updateSecretsProp('anthropic_api_key', e.target.value)}
+                style={{
+                  background: 'var(--bg-tertiary)',
+                  color: 'var(--text-primary)',
+                  border: '1px solid var(--border)',
+                  padding: '8px 12px',
+                  borderRadius: 6,
+                  outline: 'none',
+                  fontSize: 13
+                }}
+              />
+              <span style={{ fontSize: 10, color: 'var(--text-tertiary)' }}>Configuring this allows Claude Code CLI to run without prompting for OAuth login.</span>
+            </div>
+
+            {/* OpenAI API Key */}
+            <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+              <label htmlFor="openai_api_key" style={{ fontSize: 13, fontWeight: 500 }}>OpenAI API Key (Codex)</label>
+              <input
+                id="openai_api_key"
+                type="password"
+                placeholder="sk-proj-..."
+                value={configData.secrets?.openai_api_key || ''}
+                onChange={(e) => updateSecretsProp('openai_api_key', e.target.value)}
+                style={{
+                  background: 'var(--bg-tertiary)',
+                  color: 'var(--text-primary)',
+                  border: '1px solid var(--border)',
+                  padding: '8px 12px',
+                  borderRadius: 6,
+                  outline: 'none',
+                  fontSize: 13
+                }}
+              />
+            </div>
+
+            {/* Tavily API Key */}
+            <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+              <label htmlFor="tavily_api_key" style={{ fontSize: 13, fontWeight: 500 }}>Tavily Search API Key</label>
+              <input
+                id="tavily_api_key"
+                type="password"
+                placeholder="tvly-..."
+                value={configData.secrets?.tavily_api_key || ''}
+                onChange={(e) => updateSecretsProp('tavily_api_key', e.target.value)}
+                style={{
+                  background: 'var(--bg-tertiary)',
+                  color: 'var(--text-primary)',
+                  border: '1px solid var(--border)',
+                  padding: '8px 12px',
+                  borderRadius: 6,
+                  outline: 'none',
+                  fontSize: 13
+                }}
+              />
+            </div>
+
+            {/* Other Search Keys (Brave, Exa, Serper) */}
+            <details style={{ fontSize: 13, color: 'var(--text-secondary)' }}>
+              <summary style={{ cursor: 'pointer', fontWeight: 500, outline: 'none', padding: '4px 0' }}>More Provider Keys (Brave, Exa, Serper, GitHub)</summary>
+              <div style={{ display: 'flex', flexDirection: 'column', gap: 16, marginTop: 12, paddingLeft: 8, borderLeft: '2px solid var(--border)' }}>
+                {/* Brave Search Key */}
+                <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+                  <label htmlFor="brave_api_key" style={{ fontSize: 12, fontWeight: 500 }}>Brave Search API Key</label>
+                  <input
+                    id="brave_api_key"
+                    type="password"
+                    value={configData.secrets?.brave_api_key || ''}
+                    onChange={(e) => updateSecretsProp('brave_api_key', e.target.value)}
+                    style={{
+                      background: 'var(--bg-tertiary)',
+                      color: 'var(--text-primary)',
+                      border: '1px solid var(--border)',
+                      padding: '8px 12px',
+                      borderRadius: 6,
+                      outline: 'none',
+                      fontSize: 13
+                    }}
+                  />
+                </div>
+
+                {/* Exa Search Key */}
+                <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+                  <label htmlFor="exa_api_key" style={{ fontSize: 12, fontWeight: 500 }}>Exa API Key</label>
+                  <input
+                    id="exa_api_key"
+                    type="password"
+                    value={configData.secrets?.exa_api_key || ''}
+                    onChange={(e) => updateSecretsProp('exa_api_key', e.target.value)}
+                    style={{
+                      background: 'var(--bg-tertiary)',
+                      color: 'var(--text-primary)',
+                      border: '1px solid var(--border)',
+                      padding: '8px 12px',
+                      borderRadius: 6,
+                      outline: 'none',
+                      fontSize: 13
+                    }}
+                  />
+                </div>
+
+                {/* Serper API Key */}
+                <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+                  <label htmlFor="serper_api_key" style={{ fontSize: 12, fontWeight: 500 }}>Serper (Google Search API) Key</label>
+                  <input
+                    id="serper_api_key"
+                    type="password"
+                    value={configData.secrets?.serper_api_key || ''}
+                    onChange={(e) => updateSecretsProp('serper_api_key', e.target.value)}
+                    style={{
+                      background: 'var(--bg-tertiary)',
+                      color: 'var(--text-primary)',
+                      border: '1px solid var(--border)',
+                      padding: '8px 12px',
+                      borderRadius: 6,
+                      outline: 'none',
+                      fontSize: 13
+                    }}
+                  />
+                </div>
+
+                {/* GitHub Token */}
+                <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+                  <label htmlFor="github_token" style={{ fontSize: 12, fontWeight: 500 }}>GitHub Personal Access Token</label>
+                  <input
+                    id="github_token"
+                    type="password"
+                    placeholder="ghp_..."
+                    value={configData.secrets?.github_token || ''}
+                    onChange={(e) => updateSecretsProp('github_token', e.target.value)}
+                    style={{
+                      background: 'var(--bg-tertiary)',
+                      color: 'var(--text-primary)',
+                      border: '1px solid var(--border)',
+                      padding: '8px 12px',
+                      borderRadius: 6,
+                      outline: 'none',
+                      fontSize: 13
+                    }}
+                  />
+                </div>
+              </div>
+            </details>
+          </div>
+
+        </form>
       ) : (
         /* ==================== RAW YAML EDITOR UI ==================== */
         <div style={{ display: 'flex', flexDirection: 'column', flex: 1, minHeight: 0 }}>

package/frontend/src/types.ts

@@ -159,5 +159,21 @@ export interface ConfigJson {
   brain?: {
     preferred_agent?: string
   }
+  secrets?: {
+    google_api_key?: string
+    anthropic_api_key?: string
+    openai_api_key?: string
+    tavily_api_key?: string
+    brave_api_key?: string
+    exa_api_key?: string
+    serper_api_key?: string
+    github_token?: string
+  }
+}
+
+export interface UpdateCheckResult {
+  currentVersion: string
+  latestVersion: string
+  updateAvailable: boolean
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Sovereign AI system — database-free, SSSS-powered personal intelligence engine deployable to any POSIX host.",
   "type": "module",
   "bin": {

package/scaffold/.agent/skills/total-recall/research-queue.jsonl

@@ -0,0 +1 @@
+{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","priority":"high","notes":"Queued from repo-wide analysis request on 2026-06-01. Focus on current best practices and meta-patterns for filesystem-native memory OS, validated operation envelopes, append-only logs, cache invalidation, research queue architecture, and secure local-first AI tools.","node_slug":null,"research_phase":"acquisition","created_at":"2026-06-01T06:07:40.102Z","updated_at":"2026-06-01T06:07:40.126Z","completed_at":null,"summary":{"id":"0efa65c2-0231-4267-a304-e0285e50011e","topic":"Total Recall repository improvement research: SSSS validated write pipeline, filesystem-native memory engines, local-first semantic indexing, Express 5 API hardening, 2026 agent memory architecture patterns","status":"pending","phase":"acquisition","last_updated":"2026-06-01T06:07:40.126Z","conclusions":[],"ongoing_directions":["Research project is enqueued / in progress in phase: acquisition"],"sources_count":0}}

package/src/core/runtime.mjs

@@ -254,6 +254,27 @@ export async function callLocalRuntime(prompt, system, config) {
 
   let lastError;
 
+  // Load dynamic secrets from secrets.enc to ensure changes take effect immediately without server restart
+  let dynamicSecrets = {};
+  try {
+    const pathsToCheck = [
+      path.join(process.cwd(), '.agent', 'secrets.enc'),
+      path.join(agentDir, 'secrets.enc'),
+      path.join(os.homedir(), '.agent', 'skills', 'total-recall', 'config', 'secrets.enc'),
+      path.join(agentDir, 'skills', 'total-recall', 'config', 'secrets.enc'),
+    ];
+    for (const p of pathsToCheck) {
+      if (fs.existsSync(p)) {
+        try {
+          dynamicSecrets = JSON.parse(fs.readFileSync(p, 'utf8') || '{}');
+          if (Object.keys(dynamicSecrets).length > 0) {
+            break;
+          }
+        } catch {}
+      }
+    }
+  } catch {}
+
   // Try agents in priority order with retry budget
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     const agent = attempt === 0 ? resolveAgent(config) : resolveAgent({
@@ -289,13 +310,15 @@ export async function callLocalRuntime(prompt, system, config) {
       maxBuffer: 10 * 1024 * 1024,
       env: {
         ...process.env,
-        GOOGLE_API_KEY: process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY || googleApiKey,
-        GEMINI_API_KEY: process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || googleApiKey,
-        TAVILY_API_KEY: process.env.TAVILY_API_KEY || tavilyApiKey,
-        BRAVE_API_KEY: process.env.BRAVE_API_KEY || braveApiKey,
-        EXA_API_KEY: process.env.EXA_API_KEY || exaApiKey,
-        SERPER_API_KEY: process.env.SERPER_API_KEY || serperApiKey,
-        GITHUB_TOKEN: process.env.GITHUB_TOKEN || githubToken,
+        GOOGLE_API_KEY: process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY || dynamicSecrets.google_api_key || googleApiKey,
+        GEMINI_API_KEY: process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY || dynamicSecrets.google_api_key || googleApiKey,
+        ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY || dynamicSecrets.anthropic_api_key,
+        OPENAI_API_KEY: process.env.OPENAI_API_KEY || dynamicSecrets.openai_api_key,
+        TAVILY_API_KEY: process.env.TAVILY_API_KEY || dynamicSecrets.tavily_api_key || tavilyApiKey,
+        BRAVE_API_KEY: process.env.BRAVE_API_KEY || dynamicSecrets.brave_api_key || braveApiKey,
+        EXA_API_KEY: process.env.EXA_API_KEY || dynamicSecrets.exa_api_key || exaApiKey,
+        SERPER_API_KEY: process.env.SERPER_API_KEY || dynamicSecrets.serper_api_key || serperApiKey,
+        GITHUB_TOKEN: process.env.GITHUB_TOKEN || dynamicSecrets.github_token || githubToken,
       },
       cwd: process.cwd(),
     });

package/src/core/schema.mjs

@@ -312,6 +312,458 @@ export const SubQuerySchema = z.object({
   reasoning: z.string().describe("Explanation for why these sub-queries are necessary")
 });
 
+// ─── Document Primitives (§5.1 of the SSSS spec) ───────────────────────────
+
+export const ContactSchema = z.object({
+  type: z.literal('contact'),
+  name: z.string(),
+  first_name: z.string().optional().nullable(),
+  last_name: z.string().optional().nullable(),
+  email: z.string().optional().nullable(),
+  phone: z.string().optional().nullable(),
+  company: z.string().optional().nullable(),
+  job_title: z.string().optional().nullable(),
+  tags: z.array(z.unknown()).optional().nullable(),
+  notes: z.string().optional().nullable(),
+  source: z.string().optional().nullable(),
+  contact_type: z.string().optional().nullable(),
+  priority: z.string().optional().nullable(),
+  relationship_strength: z.number().optional().nullable(),
+  custom_fields: z.record(z.unknown()).optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  owner_user_id: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+});
+
+export const CompanySchema = z.object({
+  type: z.literal('company'),
+  name: z.string(),
+  domain: z.string().optional().nullable(),
+  industry: z.string().optional().nullable(),
+  website: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+});
+
+export const DealSchema = z.object({
+  type: z.literal('deal'),
+  name: z.string(),
+  value: z.number(),
+  stage: z.string(),
+  contact_id: z.string().optional().nullable(),
+  company_id: z.string().optional().nullable(),
+  currency: z.string().optional().nullable(),
+  probability: z.number().optional().nullable(),
+  expected_close_date: z.string().optional().nullable(),
+  is_archived: z.boolean().optional().nullable(),
+  description: z.string().optional().nullable(),
+  source: z.string().optional().nullable(),
+  tags: z.array(z.unknown()).optional().nullable(),
+  custom_fields: z.record(z.unknown()).optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+});
+
+export const BrandSchema = z.object({
+  type: z.literal('brand'),
+  name: z.string(),
+  version: z.string().optional().nullable(),
+  description: z.string().optional().nullable(),
+  colors: z.record(z.unknown()).optional().nullable(),
+  typography: z.record(z.unknown()).optional().nullable(),
+  rounded: z.record(z.unknown()).optional().nullable(),
+  spacing: z.record(z.unknown()).optional().nullable(),
+  components: z.record(z.unknown()).optional().nullable(),
+  vibe: z.string().optional().nullable(),
+  locale: z.string().optional().nullable(),
+  assets: z.record(z.unknown()).optional().nullable(),
+  brand_voice: z.array(z.unknown()).optional().nullable(),
+  accessibility_palettes: z.record(z.unknown()).optional().nullable(),
+  tagline: z.string().optional().nullable(),
+});
+
+export const DeploymentSchema = z.object({
+  type: z.literal('deployment'),
+  name: z.string(),
+  slug: z.string(),
+  status: z.string().optional().nullable(),
+  runtime_url: z.string().optional().nullable(),
+  mcp_config: z.record(z.unknown()).optional().nullable(),
+  container_settings: z.record(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const ListingSchema = z.object({
+  type: z.literal('listing'),
+  name: z.string(),
+  pricing_model: z.string(),
+  credits_charge_rate: z.number().optional().nullable(),
+  connected_stripe_account: z.string().optional().nullable(),
+  is_published: z.boolean().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const KnowledgeSchema = z.object({
+  type: z.literal('knowledge'),
+  name: z.string(),
+  slug: z.string(),
+  description: z.string().optional().nullable(),
+  category: z.string().optional().nullable(),
+  is_public: z.boolean().optional().nullable(),
+  is_active: z.boolean().optional().nullable(),
+  is_system_managed: z.boolean().optional().nullable(),
+  shared_across_workspaces: z.boolean().optional().nullable(),
+  settings: z.record(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  user_id: z.string().optional().nullable(),
+});
+
+export const KnowledgeSourceSchema = z.object({
+  type: z.literal('knowledge_source'),
+  title: z.string(),
+  knowledge_base_slug: z.string(),
+  content: z.string().optional().nullable(),
+  content_type: z.string().optional().nullable(),
+  source_url: z.string().optional().nullable(),
+  metadata: z.record(z.unknown()).optional().nullable(),
+  embedding_vector: z.array(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const CalendarEventSchema = z.object({
+  type: z.literal('calendar_event'),
+  title: z.string().optional().nullable(),
+  description: z.string().optional().nullable(),
+  start_time: z.string(),
+  end_time: z.string().optional().nullable(),
+  timezone: z.string().optional().nullable(),
+  all_day: z.boolean().optional().nullable(),
+  event_type: z.string(),
+  calendar_id: z.string().optional().nullable(),
+  location: z.string().optional().nullable(),
+  meeting_url: z.string().optional().nullable(),
+  attendees: z.array(z.unknown()).optional().nullable(),
+  location_context: z.record(z.unknown()).optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  user_id: z.string().optional().nullable(),
+  created_at: z.string().optional().nullable(),
+  updated_at: z.string().optional().nullable(),
+});
+
+export const EventSchema = z.object({
+  type: z.literal('event'),
+  event_type: z.string(),
+  thread_id: z.string().optional().nullable(),
+  turn_index: z.number().optional().nullable(),
+  rating: z.number().optional().nullable(),
+  comment: z.string().optional().nullable(),
+  comment_lang: z.string().optional().nullable(),
+  timestamp: z.string().optional().nullable(),
+});
+
+export const LanguageConventionSchema = z.object({
+  type: z.literal('language_convention'),
+  locale: z.string(),
+  language_name: z.string(),
+  keys: z.record(z.unknown()),
+});
+
+export const ProfileSchema = z.object({
+  type: z.literal('profile'),
+  user_id: z.string(),
+  locale: z.string(),
+  display_name: z.string().optional().nullable(),
+  timezone: z.string().optional().nullable(),
+  workspaces: z.array(z.unknown()).optional().nullable(),
+  notification_preferences: z.record(z.unknown()).optional().nullable(),
+});
+
+export const SharingGroupSchema = z.object({
+  type: z.literal('sharing_group'),
+  name: z.string(),
+  color: z.string(),
+  description: z.string().optional().nullable(),
+  owner_user_id: z.string(),
+  members: z.array(z.unknown()).optional().nullable(),
+  share_credits: z.boolean().optional().nullable(),
+  share_skills: z.boolean().optional().nullable(),
+  share_assistants: z.boolean().optional().nullable(),
+  share_email_accounts: z.boolean().optional().nullable(),
+  share_email_domains: z.boolean().optional().nullable(),
+  share_phone_numbers: z.boolean().optional().nullable(),
+  share_api_keys: z.boolean().optional().nullable(),
+  share_knowledge_base: z.boolean().optional().nullable(),
+  share_credentials: z.boolean().optional().nullable(),
+  share_team_members: z.boolean().optional().nullable(),
+  share_workflows: z.boolean().optional().nullable(),
+  share_templates: z.boolean().optional().nullable(),
+  share_branding: z.boolean().optional().nullable(),
+  share_crm: z.boolean().optional().nullable(),
+  share_integrations: z.boolean().optional().nullable(),
+  share_notifications: z.boolean().optional().nullable(),
+  share_deployments: z.boolean().optional().nullable(),
+});
+
+export const PageSchema = z.object({
+  type: z.literal('page'),
+  slug: z.string(),
+  name: z.string(),
+  icon: z.string().optional().nullable(),
+  layout: z.string().optional().nullable(),
+  sandbox_entry: z.string(),
+  is_active: z.boolean().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const VoicemailSchema = z.object({
+  type: z.literal('voicemail'),
+  mailbox_id: z.string(),
+  caller_id: z.string().optional().nullable(),
+  caller_name: z.string().optional().nullable(),
+  duration_seconds: z.number(),
+  recording_url: z.string(),
+  recording_path: z.string().optional().nullable(),
+  recording_size_bytes: z.number().optional().nullable(),
+  transcript: z.string().optional().nullable(),
+  transcript_confidence: z.number().optional().nullable(),
+  transcription_status: z.string().optional().nullable(),
+  is_urgent: z.boolean().optional().nullable(),
+  is_read: z.boolean().optional().nullable(),
+  is_deleted: z.boolean().optional().nullable(),
+  folder: z.string().optional().nullable(),
+  callback_number: z.string().optional().nullable(),
+  inbox_item_id: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  user_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  created_at: z.string().optional().nullable(),
+});
+
+export const PersonalizationProfileSchema = z.object({
+  type: z.literal('personalization_profile'),
+  name: z.string(),
+  slug: z.string(),
+  user_id: z.string(),
+  profile_type: z.string(),
+  description: z.string().optional().nullable(),
+  personalization_text: z.string().optional().nullable(),
+  is_default: z.boolean().optional().nullable(),
+  is_active: z.boolean().optional().nullable(),
+  scope: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  attached_files: z.array(z.unknown()).optional().nullable(),
+  active_times: z.array(z.unknown()).optional().nullable(),
+});
+
+export const AccountAssistantSchema = z.object({
+  type: z.literal('account_assistant'),
+  name: z.string(),
+  user_id: z.string(),
+  scope: z.string(),
+  enabled: z.boolean(),
+  description: z.string().optional().nullable(),
+  system_message: z.string().optional().nullable(),
+  avatar_url: z.string().optional().nullable(),
+  color_theme: z.string().optional().nullable(),
+  voice_id: z.string().optional().nullable(),
+  is_receptionist_enabled: z.boolean().optional().nullable(),
+  auto_answer_calls: z.boolean().optional().nullable(),
+  verification_pin: z.string().optional().nullable(),
+  greeting_known: z.string().optional().nullable(),
+  greeting_unknown: z.string().optional().nullable(),
+  routing_rules: z.array(z.unknown()).optional().nullable(),
+  enabled_tabs: z.array(z.unknown()).optional().nullable(),
+});
+
+export const AccountMemorySchema = z.object({
+  type: z.literal('account_memory'),
+  title: z.string(),
+  user_id: z.string(),
+  category: z.string(),
+  confidence: z.number().optional().nullable(),
+  source: z.string().optional().nullable(),
+});
+
+export const AccountWorkflowSchema = z.object({
+  type: z.literal('account_workflow'),
+  name: z.string(),
+  slug: z.string(),
+  user_id: z.string(),
+  scope: z.string(),
+  description: z.string().optional().nullable(),
+  enabled: z.boolean().optional().nullable(),
+  trigger_type: z.string().optional().nullable(),
+  trigger_config: z.record(z.unknown()).optional().nullable(),
+  steps: z.array(z.unknown()).optional().nullable(),
+  actions: z.array(z.unknown()).optional().nullable(),
+  target_workspaces: z.array(z.unknown()).optional().nullable(),
+  last_run: z.string().optional().nullable(),
+  run_count: z.number().optional().nullable(),
+});
+
+export const WorkspaceTransferSchema = z.object({
+  type: z.literal('workspace_transfer'),
+  transfer_id: z.string(),
+  source_user_id: z.string(),
+  target_email: z.string(),
+  workspace_id: z.string(),
+  status: z.string(),
+  initiated_at: z.string(),
+  target_user_id: z.string().optional().nullable(),
+  workspace_name: z.string().optional().nullable(),
+  resolved_at: z.string().optional().nullable(),
+  expires_at: z.string().optional().nullable(),
+});
+
+export const ExtensionSchema = z.object({
+  type: z.literal('extension'),
+  extension: z.string(),
+  display_name: z.string(),
+  owner_user_id: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  assistant_id: z.string().optional().nullable(),
+  status: z.string(),
+  voicemail_enabled: z.boolean().optional().nullable(),
+  metadata: z.record(z.unknown()).optional().nullable(),
+});
+
+export const PhoneNumberSchema = z.object({
+  type: z.literal('phone_number'),
+  phone_number: z.string(),
+  provider: z.string(),
+  provider_number_id: z.string().optional().nullable(),
+  receptionist_id: z.string().optional().nullable(),
+  status: z.string(),
+  workspace_id: z.string().optional().nullable(),
+  user_id: z.string().optional().nullable(),
+});
+
+export const WorkspaceSchema = z.object({
+  type: z.literal('workspace'),
+  name: z.string(),
+  slug: z.string().optional().nullable(),
+  description: z.string().optional().nullable(),
+  business_type: z.string().optional().nullable(),
+  domain: z.string().optional().nullable(),
+  provisioning_mode: z.string().optional().nullable(),
+  canonical_version: z.number().optional().nullable(),
+  content_hash: z.string().optional().nullable(),
+  brand_ref: z.string().optional().nullable(),
+  page_refs: z.array(z.unknown()).optional().nullable(),
+  assistant_refs: z.array(z.unknown()).optional().nullable(),
+  workflow_refs: z.array(z.unknown()).optional().nullable(),
+  knowledge_refs: z.array(z.unknown()).optional().nullable(),
+  commerce_ref: z.string().optional().nullable(),
+  cms_refs: z.array(z.unknown()).optional().nullable(),
+  social_refs: z.array(z.unknown()).optional().nullable(),
+  ticketing_refs: z.array(z.unknown()).optional().nullable(),
+  comms_refs: z.array(z.unknown()).optional().nullable(),
+  economy: z.record(z.unknown()).optional().nullable(),
+  demo_fixtures_ref: z.string().optional().nullable(),
+  capabilities: z.array(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+  created_at: z.string().optional().nullable(),
+  updated_at: z.string().optional().nullable(),
+});
+
+export const CommerceCatalogSchema = z.object({
+  type: z.literal('commerce_catalog'),
+  name: z.string(),
+  currency: z.string().optional().nullable(),
+  tax_behavior: z.string().optional().nullable(),
+  shipping_zones: z.array(z.unknown()).optional().nullable(),
+  collections: z.array(z.unknown()).optional().nullable(),
+  fulfillment: z.record(z.unknown()).optional().nullable(),
+  stripe_account_ref: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const ProductSchema = z.object({
+  type: z.literal('product'),
+  name: z.string(),
+  slug: z.string(),
+  description: z.string().optional().nullable(),
+  product_type: z.string().optional().nullable(),
+  status: z.string().optional().nullable(),
+  variants: z.array(z.unknown()).optional().nullable(),
+  prices: z.array(z.unknown()).optional().nullable(),
+  subscription: z.record(z.unknown()).optional().nullable(),
+  collection: z.string().optional().nullable(),
+  media_refs: z.array(z.unknown()).optional().nullable(),
+  inventory: z.record(z.unknown()).optional().nullable(),
+  metadata: z.record(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const CmsCollectionSchema = z.object({
+  type: z.literal('cms_collection'),
+  name: z.string(),
+  slug: z.string(),
+  description: z.string().optional().nullable(),
+  fields: z.array(z.unknown()).optional().nullable(),
+  ordering: z.string().optional().nullable(),
+  is_published: z.boolean().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const CmsEntrySchema = z.object({
+  type: z.literal('cms_entry'),
+  title: z.string(),
+  slug: z.string(),
+  collection_slug: z.string(),
+  status: z.string().optional().nullable(),
+  publish_at: z.string().optional().nullable(),
+  order: z.number().optional().nullable(),
+  fields: z.record(z.unknown()).optional().nullable(),
+  media_refs: z.array(z.unknown()).optional().nullable(),
+  excerpt: z.string().optional().nullable(),
+  seo: z.record(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const SocialSchema = z.object({
+  type: z.literal('social'),
+  name: z.string(),
+  platform: z.string().optional().nullable(),
+  handle: z.string().optional().nullable(),
+  connection_ref: z.string().optional().nullable(),
+  posting_calendar: z.array(z.unknown()).optional().nullable(),
+  creative_refs: z.array(z.unknown()).optional().nullable(),
+  status: z.string().optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
+export const TicketedEventSchema = z.object({
+  type: z.literal('ticketed_event'),
+  name: z.string(),
+  slug: z.string(),
+  start_time: z.string(),
+  description: z.string().optional().nullable(),
+  status: z.string().optional().nullable(),
+  end_time: z.string().optional().nullable(),
+  timezone: z.string().optional().nullable(),
+  venue: z.record(z.unknown()).optional().nullable(),
+  sessions: z.array(z.unknown()).optional().nullable(),
+  ticket_tiers: z.array(z.unknown()).optional().nullable(),
+  capacity: z.number().optional().nullable(),
+  stripe_account_ref: z.string().optional().nullable(),
+  media_refs: z.array(z.unknown()).optional().nullable(),
+  workspace_id: z.string().optional().nullable(),
+  db_id: z.string().optional().nullable(),
+});
+
 // ─── Schema Registry (§5 of the SSSS spec) ─────────────────────────────────
 
 /** Map from SSSS `type` value to its Zod schema. Used by the operation validator. */
@@ -330,4 +782,33 @@ export const SSSS_SCHEMAS = {
   'schema-proposal': SchemaProposalSchema,
   migration: MigrationSchema,
   release: ReleaseSchema,
+  contact: ContactSchema,
+  company: CompanySchema,
+  deal: DealSchema,
+  brand: BrandSchema,
+  deployment: DeploymentSchema,
+  listing: ListingSchema,
+  knowledge: KnowledgeSchema,
+  knowledge_source: KnowledgeSourceSchema,
+  calendar_event: CalendarEventSchema,
+  event: EventSchema,
+  language_convention: LanguageConventionSchema,
+  profile: ProfileSchema,
+  sharing_group: SharingGroupSchema,
+  page: PageSchema,
+  voicemail: VoicemailSchema,
+  personalization_profile: PersonalizationProfileSchema,
+  account_assistant: AccountAssistantSchema,
+  account_memory: AccountMemorySchema,
+  account_workflow: AccountWorkflowSchema,
+  workspace_transfer: WorkspaceTransferSchema,
+  extension: ExtensionSchema,
+  phone_number: PhoneNumberSchema,
+  workspace: WorkspaceSchema,
+  commerce_catalog: CommerceCatalogSchema,
+  product: ProductSchema,
+  cms_collection: CmsCollectionSchema,
+  cms_entry: CmsEntrySchema,
+  social: SocialSchema,
+  ticketed_event: TicketedEventSchema,
 };

package/src/server/rest.mjs

@@ -1371,10 +1371,12 @@ router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, r
     const securityPath = path.join(CONFIG_DIR, 'security.yml');
     const budgetPath = path.join(CONFIG_DIR, 'budget.yml');
     const brainPath = path.join(CONFIG_DIR, 'brain.json');
+    const secretsPath = path.join(AGENT_DIR, 'secrets.enc');
 
     let security = {};
     let budget = {};
     let brain = {};
+    let secrets = {};
 
     if (fs.existsSync(securityPath)) {
       try {
@@ -1391,6 +1393,11 @@ router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, r
         brain = JSON.parse(fs.readFileSync(brainPath, 'utf8')) || {};
       } catch {}
     }
+    if (fs.existsSync(secretsPath)) {
+      try {
+        secrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')) || {};
+      } catch {}
+    }
 
     const safeBrain = { ...brain };
     if (safeBrain.token) {
@@ -1398,16 +1405,25 @@ router.get('/api/config-json', requireAuth, requireScope('config:read'), (req, r
       delete safeBrain.token;
     }
 
-    res.json({ security, budget, brain: safeBrain });
+    const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
+    const safeSecrets = {};
+    for (const key of allowedKeys) {
+      if (secrets[key] !== undefined) {
+        safeSecrets[key] = secrets[key];
+      }
+    }
+
+    res.json({ security, budget, brain: safeBrain, secrets: safeSecrets });
   } catch (err) { serverError(res, err); }
 });
 
 router.post('/api/config-json', requireAuth, requireScope('config:write'), (req, res) => {
   try {
-    const { security, budget, brain } = req.body;
+    const { security, budget, brain, secrets } = req.body;
     const securityPath = path.join(CONFIG_DIR, 'security.yml');
     const budgetPath = path.join(CONFIG_DIR, 'budget.yml');
     const brainPath = path.join(CONFIG_DIR, 'brain.json');
+    const secretsPath = path.join(AGENT_DIR, 'secrets.enc');
 
     if (!fs.existsSync(CONFIG_DIR)) {
       fs.mkdirSync(CONFIG_DIR, { recursive: true });
@@ -1433,6 +1449,25 @@ router.post('/api/config-json', requireAuth, requireScope('config:write'), (req,
       delete nextBrain.has_token;
       fs.writeFileSync(brainPath, JSON.stringify(nextBrain, null, 2), { encoding: 'utf8', mode: 0o600 });
     }
+    if (secrets) {
+      let existingSecrets = {};
+      if (fs.existsSync(secretsPath)) {
+        try {
+          existingSecrets = JSON.parse(fs.readFileSync(secretsPath, 'utf8')) || {};
+        } catch {}
+      }
+      const allowedKeys = ['google_api_key', 'anthropic_api_key', 'openai_api_key', 'tavily_api_key', 'brave_api_key', 'exa_api_key', 'serper_api_key', 'github_token'];
+      for (const key of allowedKeys) {
+        if (secrets[key] !== undefined) {
+          if (secrets[key] === '') {
+            delete existingSecrets[key];
+          } else {
+            existingSecrets[key] = secrets[key];
+          }
+        }
+      }
+      fs.writeFileSync(secretsPath, JSON.stringify(existingSecrets, null, 2), { encoding: 'utf8', mode: 0o600 });
+    }
 
     res.json({ success: true });
   } catch (err) { serverError(res, err); }
@@ -1960,4 +1995,76 @@ function getLastModified(filePath) {
   return null;
 }
 
+/**
+ * GET /api/update/check
+ */
+router.get('/api/update/check', requireAuth, async (req, res) => {
+  try {
+    const localPkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+    const currentVersion = localPkg.version || '0.0.0';
+
+    const registryRes = await fetch('https://registry.npmjs.org/total-recall-brain/latest');
+    if (!registryRes.ok) {
+      throw new Error(`Failed to fetch latest version from npm: ${registryRes.status}`);
+    }
+    const registryData = await registryRes.json();
+    const latestVersion = registryData.version || '0.0.0';
+
+    const updateAvailable = latestVersion !== currentVersion;
+
+    res.json({
+      currentVersion,
+      latestVersion,
+      updateAvailable
+    });
+  } catch (err) {
+    serverError(res, err);
+  }
+});
+
+/**
+ * POST /api/update/run
+ */
+router.post('/api/update/run', requireAuth, async (req, res) => {
+  try {
+    res.json({ success: true, message: 'Update started. Server is updating and will restart shortly.' });
+
+    setImmediate(async () => {
+      logger.info('update', 'Starting auto-update process...');
+      try {
+        const { exec } = await import('node:child_process');
+        
+        const runCmd = (cmd, cwd) => new Promise((resolve, reject) => {
+          logger.info('update', `Running: ${cmd} in ${cwd}`);
+          exec(cmd, { cwd }, (err, stdout, stderr) => {
+            if (err) {
+              logger.error('update', `Command failed: ${cmd}. Error: ${err.message}`);
+              return reject(err);
+            }
+            resolve({ stdout, stderr });
+          });
+        });
+
+        // 1. git pull
+        await runCmd('git pull', ROOT);
+        // 2. npm install
+        await runCmd('npm install', ROOT);
+        // 3. build/install frontend if package.json exists
+        const frontendPath = path.join(ROOT, 'frontend');
+        if (fs.existsSync(path.join(frontendPath, 'package.json'))) {
+          await runCmd('npm install', frontendPath);
+          await runCmd('npm run build', frontendPath);
+        }
+
+        logger.info('update', 'Update successfully applied. Restarting server...');
+        process.exit(0);
+      } catch (err) {
+        logger.error('update', `Auto-update failed: ${err.message}`);
+      }
+    });
+  } catch (err) {
+    serverError(res, err);
+  }
+});
+
 export { router as restRouter };

package/src/server/route-manifest.json

@@ -295,6 +295,14 @@
     "method": "GET",
     "path": "/api/tts/status"
   },
+  {
+    "method": "GET",
+    "path": "/api/update/check"
+  },
+  {
+    "method": "POST",
+    "path": "/api/update/run"
+  },
   {
     "method": "GET",
     "path": "/api/usage"