total-recall-brain 3.40.0 → 3.40.2

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "total-recall-brain",
-  "version": "3.40.0",
-  "description": "Portable SSSS memory, local retrieval and task instructions with explicit plugin loading.",
+  "version": "3.40.2",
+  "description": "The Vibe Coding Brain & Autonomous Software Factory: memory, rules, secrets, and 33 visual plugins automatically managed across all your devices.",
   "type": "module",
   "bin": {
     "total-recall": "bin/total-recall.mjs",
+    "vibebrain": "bin/total-recall.mjs",
     "antigravity": "bin/antigravity.mjs",
     "total-recall-memory": "bin/total-recall-memory.mjs"
   },
@@ -99,7 +100,8 @@
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@vitejs/plugin-react": "^6.0.3",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
+    "gray-matter": "^4.0.3",
     "jsdom": "^29.1.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -107,8 +109,7 @@
     "recharts": "^3.9.2",
     "skills": "^1.5.7",
     "supertest": "^7.2.2",
-    "vitest": "^4.1.11",
-    "gray-matter": "^4.0.3"
+    "vitest": "^4.1.12"
   },
   "workspaces": [
     "frontend"

package/scaffold/.agent/skills/meta-harness/references/optimized/original.md

@@ -86,7 +86,7 @@ npx total-recall agent spawn claude "Answer from memory only" --no-tools
 ```
 
 Claude Code authenticates headlessly with `CLAUDE_CODE_OAUTH_TOKEN` (create it with
-`claude setup-token`, store it with `total-recall secret set CLAUDE_CODE_OAUTH_TOKEN --stdin`).
+`claude setup-token`, store it with `total-recall auth secret set CLAUDE_CODE_OAUTH_TOKEN --stdin`).
 A spawn reads it from the secret store when the environment lacks it, so SSH and
 launchd sessions that cannot reach a login keychain still authenticate.
 

package/scaffold/.agent/skills/meta-harness/references/optimized/section-09.md

@@ -15,6 +15,6 @@ npx total-recall agent spawn claude "Answer from memory only" --no-tools
 ```
 
 Claude Code authenticates headlessly with `CLAUDE_CODE_OAUTH_TOKEN` (create it with
-`claude setup-token`, store it with `total-recall secret set CLAUDE_CODE_OAUTH_TOKEN --stdin`).
+`claude setup-token`, store it with `total-recall auth secret set CLAUDE_CODE_OAUTH_TOKEN --stdin`).
 A spawn reads it from the secret store when the environment lacks it, so SSH and
 launchd sessions that cannot reach a login keychain still authenticate.

package/scaffold/.agent/skills/total-recall/plugins/auth/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-auth",
-      "version": "1.0.0",
+      "version": "1.0.2",
       "license": "MIT",
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
@@ -14,7 +14,7 @@
         "express": "^5.2.1",
         "express-rate-limit": "^8.5.1",
         "jsonwebtoken": "^9.0.3",
-        "total-recall-brain": "^3.39.1",
+        "total-recall-brain": "3.40.1",
         "yaml": "^2.9.0"
       },
       "devDependencies": {
@@ -695,9 +695,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.10.3",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.10.3.tgz",
-      "integrity": "sha512-fCRZLrPSTALj/px5fHJNFZGOmC28FHKqEAWybxWHVARfMdo924RbGS70ax84w9QoCQ5NlnTe17cYmS0xXgwrVQ==",
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.11.2.tgz",
+      "integrity": "sha512-DTkBPCOv9uN79YoRtsa/GnXPbbeHOU5PQcQ995axHg+SLWdkL6xmrTRs5Xxshcje/Iv6+lKkYOc9UL+Arn9kHg==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -3578,16 +3578,16 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.39.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.39.1.tgz",
-      "integrity": "sha512-kZ3tN5vJBUUNUbgcqMOaoFjcsoSeg6KMNrn5LHCNjDm42j6bPtKYQZ8J5qMlX2guLVdKUn7+4Minxdchem1HTQ==",
+      "version": "3.40.1",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.40.1.tgz",
+      "integrity": "sha512-tZMnDHXsMT1sa698oF26Np/G4k+Cn4ZXpTdo+BTNOvUMYEhxWR+7Tl+upHLMhcEEPuEM0EiAObL53a9JELzGag==",
       "license": "MIT",
       "workspaces": [
         "frontend"
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.10.3",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.11.2",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/total-recall/plugins/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "White-label Total Recall auth plugin: Passkey biometric FIDO2 and Google OAuth2 authentication.",
   "type": "module",
   "main": "cli.mjs",
@@ -15,12 +15,7 @@
     "google"
   ],
   "license": "MIT",
-  "devDependencies": {
-    "vitest": "^5.0.3",
-    "supertest": "^7.2.2"
-  },
   "dependencies": {
-    "total-recall-brain": "^3.39.1",
     "yaml": "^2.9.0",
     "bcrypt": "^6.0.0",
     "jsonwebtoken": "^9.0.3",

package/scaffold/.agent/skills/total-recall/plugins/auth/plugin.json

@@ -17,7 +17,6 @@
     "font": "chivo-mono"
   },
   "card_face": {
-    "skin": "winamp-classic",
     "theme": "vibrant",
     "headline": "Passkey & Google OAuth2 Authentication Engine",
     "primary_color": "#6366f1",

package/scaffold/.agent/skills/total-recall/plugins/auth/src/browser-session.mjs

@@ -14,20 +14,297 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { execFileSync } from 'node:child_process';
 
 const PROFILE_DIRNAME = 'browser-profile';
 
 const PROFILE_README = `# TR browser profile — DO NOT SYNC, DO NOT COPY
 
 This directory holds live authenticated sessions (Stripe, GitHub, cloud consoles)
-used by \`total-recall secret rotate-auto\`.
+used by \`total-recall auth secret rotate-auto\`.
 
 Treat it as equivalent to secrets.enc:
   - never commit it
   - never include it in backups that leave this machine
-  - delete it with \`total-recall secret browser-logout\` when no longer needed
+  - delete it with \`total-recall auth secret browser-logout\` when no longer needed
 `;
 
+/**
+ * Check if Google Chrome is currently running on macOS.
+ * @returns {boolean}
+ */
+export function isMacChromeRunning() {
+  if (process.platform !== 'darwin') return false;
+  try {
+    const res = execFileSync('pgrep', ['-x', 'Google Chrome'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return !!res.trim();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Native macOS Chrome driver using AppleScript/JXA. Connects to the operator's
+ * already-running, authenticated Google Chrome instance so rotations can drive
+ * authenticated consoles without needing to re-login.
+ */
+export function createMacChromeContext(opts = {}) {
+  let activeUrl = '';
+
+  const runJxa = (js) => {
+    return execFileSync('osascript', ['-l', 'JavaScript', '-e', js], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  };
+
+  const page = {
+    async goto(url) {
+      activeUrl = url;
+      let host = '';
+      try {
+        host = new URL(url).hostname;
+      } catch {}
+      const script = `
+        const chrome = Application("Google Chrome");
+        let target = null;
+        for (const w of chrome.windows()) {
+          for (const t of w.tabs()) {
+            if (t.url().includes("${host}")) {
+              target = t;
+              w.activeTabIndex = w.tabs.indexOf(t) + 1;
+              break;
+            }
+          }
+          if (target) break;
+        }
+        if (!target) {
+          const w = chrome.windows()[0] || chrome.Window().make();
+          target = chrome.Tab({ url: "${url}" });
+          w.tabs.push(target);
+        } else if (target.url() !== "${url}") {
+          target.url = "${url}";
+        }
+        target.url();
+      `;
+      try {
+        runJxa(script);
+      } catch {}
+      await page.waitForTimeout(1500);
+    },
+
+    async url() {
+      let host = '';
+      try {
+        host = new URL(activeUrl || 'https://portal.telnyx.com').hostname;
+      } catch {}
+      const script = `
+        const chrome = Application("Google Chrome");
+        let u = "";
+        for (const w of chrome.windows()) {
+          for (const t of w.tabs()) {
+            if (t.url().includes("${host}")) {
+              u = t.url();
+              break;
+            }
+          }
+          if (u) break;
+        }
+        u;
+      `;
+      try {
+        const res = runJxa(script);
+        if (res) return res;
+      } catch {}
+      return activeUrl;
+    },
+
+    async waitForTimeout(ms) {
+      return new Promise((r) => setTimeout(r, ms));
+    },
+
+    async trustedKeystroke(text) {
+      if (process.platform === 'darwin') {
+        const escaped = String(text).replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+        const script = `
+          tell application "Google Chrome" to activate
+          delay 0.1
+          tell application "System Events"
+            keystroke "${escaped}"
+          end tell
+        `;
+        try {
+          execFileSync('osascript', ['-e', script], { stdio: 'ignore' });
+        } catch {}
+      }
+    },
+
+    async trustedPress(keyName) {
+      if (process.platform === 'darwin') {
+        let code = 'space';
+        if (keyName === 'Enter' || keyName === 'return') code = 'return';
+        else if (keyName === 'space' || keyName === 'Space') code = 'space';
+        const script = `
+          tell application "Google Chrome" to activate
+          delay 0.1
+          tell application "System Events"
+            keystroke ${code}
+          end tell
+        `;
+        try {
+          execFileSync('osascript', ['-e', script], { stdio: 'ignore' });
+        } catch {}
+      }
+    },
+
+    async evaluate(fn, ...args) {
+      let host = '';
+      try {
+        host = new URL(activeUrl || 'https://portal.telnyx.com').hostname;
+      } catch {}
+
+      const evalChrome = (code) => {
+        const script = `
+          const chrome = Application("Google Chrome");
+          let res = null;
+          for (const w of chrome.windows()) {
+            for (const t of w.tabs()) {
+              if (t.url().includes("${host}")) {
+                res = t.execute({ javascript: ${JSON.stringify(code)} });
+                break;
+              }
+            }
+            if (res !== null) break;
+          }
+          JSON.stringify(res);
+        `;
+        try {
+          const out = runJxa(script);
+          return out ? JSON.parse(out) : null;
+        } catch {
+          return null;
+        }
+      };
+
+      const fnStr = typeof fn === 'function' ? `(${fn.toString()})(${args.map((a) => JSON.stringify(a)).join(',')})` : String(fn);
+      const wrapped = `
+        (() => {
+          window.__tr_pending = true;
+          window.__tr_result = null;
+          window.__tr_error = null;
+          try {
+            const out = ${fnStr};
+            if (out && typeof out.then === 'function') {
+              out.then(
+                r => { window.__tr_result = r; window.__tr_pending = false; },
+                e => { window.__tr_error = String(e); window.__tr_pending = false; }
+              );
+            } else {
+              window.__tr_result = out;
+              window.__tr_pending = false;
+            }
+          } catch (err) {
+            window.__tr_error = String(err);
+            window.__tr_pending = false;
+          }
+        })()
+      `;
+
+      evalChrome(wrapped);
+
+      const deadline = Date.now() + 35_000;
+      while (Date.now() < deadline) {
+        const pending = evalChrome('window.__tr_pending');
+        if (pending === false) {
+          const err = evalChrome('window.__tr_error');
+          if (err) throw new Error(err);
+          return evalChrome('window.__tr_result');
+        }
+        await page.waitForTimeout(200);
+      }
+      return null;
+    },
+
+    locator(selector) {
+      return {
+        first() {
+          return this;
+        },
+        filter() {
+          return this;
+        },
+        async isVisible() {
+          return (
+            (await page.evaluate((sel) => {
+              const el = document.querySelector(sel);
+              return !!(el && (el.offsetWidth || el.offsetHeight || el.getClientRects().length));
+            }, selector)) || false
+          );
+        },
+        async waitFor(options = {}) {
+          const timeout = options.timeout ?? 10_000;
+          const started = Date.now();
+          while (Date.now() - started < timeout) {
+            const vis = await this.isVisible();
+            if (vis) return true;
+            await page.waitForTimeout(250);
+          }
+          return false;
+        },
+        async count() {
+          return (await page.evaluate((sel) => document.querySelectorAll(sel).length, selector)) || 0;
+        },
+        async click() {
+          return await page.evaluate((sel) => {
+            const el = document.querySelector(sel);
+            if (el) el.click();
+          }, selector);
+        },
+        async fill(text) {
+          return await page.evaluate(
+            ({ sel, text }) => {
+              const el = document.querySelector(sel);
+              if (el) {
+                el.focus();
+                const setter = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value')?.set;
+                if (setter) setter.call(el, text);
+                else el.value = text;
+                el.dispatchEvent(new Event('input', { bubbles: true }));
+                el.dispatchEvent(new Event('change', { bubbles: true }));
+              }
+            },
+            { sel: selector, text }
+          );
+        },
+        async press(key) {
+          return await page.evaluate(
+            ({ sel, key }) => {
+              const el = document.querySelector(sel);
+              if (el) {
+                el.dispatchEvent(new KeyboardEvent('keydown', { key, bubbles: true }));
+                el.dispatchEvent(new KeyboardEvent('keyup', { key, bubbles: true }));
+              }
+            },
+            { sel: selector, key }
+          );
+        },
+      };
+    },
+  };
+
+  return {
+    isMacChrome: true,
+    pages: () => [page],
+    newPage: async () => page,
+    grantPermissions: async () => {},
+    close: async () => {},
+    setDefaultTimeout: () => {},
+  };
+}
+
 /**
  * Load chromium if playwright is installed. Mirrors source-adapters.getPlaywright
  * so browser support stays an optional dependency.
@@ -76,6 +353,16 @@ export function ensureProfileDir(brainDir) {
  * @returns {Promise<{ ok: boolean, context?: any, error?: string, profileDir?: string }>}
  */
 export async function launchRotationContext(brainDir, opts = {}) {
+  // If Chrome is already running on macOS and not opted out, use the operator's active session
+  if (opts.useChrome !== false && (opts.chrome || isMacChromeRunning())) {
+    return {
+      ok: true,
+      context: createMacChromeContext(opts),
+      profileDir: 'running-google-chrome',
+      browser: 'running Google Chrome (macOS active session)',
+    };
+  }
+
   const chromium = await getChromium();
   if (!chromium) {
     return {
@@ -88,12 +375,30 @@ export async function launchRotationContext(brainDir, opts = {}) {
   const profileDir = ensureProfileDir(brainDir);
   // Headed by default: provider logins routinely require human 2FA, and a
   // headless first-run would simply hang on an invisible challenge.
-  const headless = opts.headless === true;
+  //
+  // But a headed launch needs a display, and a server usually has none: the window cannot open,
+  // Chromium exits at once, and launchPersistentContext reports only "Target page, context or
+  // browser has been closed" for every candidate browser. That reads as "no browser installed"
+  // and left the operator with a live, un-rotated credential. With no display there is nothing
+  // for a human to see anyway, so fall back to headless rather than fail.
+  const headless = opts.headless === true || (process.platform === 'linux' && !process.env.DISPLAY);
 
   const base = {
     headless,
     viewport: { width: 1440, height: 900 },
-    args: ['--disable-blink-features=AutomationControlled', '--no-first-run'],
+    // Chromium refuses to start as root with its sandbox on, and it dies so fast that
+    // launchPersistentContext reports only "Target page, context or browser has been closed" —
+    // the exact failure every rotation attempt hit on this host, from every candidate browser,
+    // which reads as "no browser installed" and is why the key was never rotated. Add the flags
+    // root needs, and keep /dev/shm out of it because it is small in a container and stalls the
+    // renderer.
+    args: [
+      '--disable-blink-features=AutomationControlled',
+      '--no-first-run',
+      ...(typeof process.getuid === 'function' && process.getuid() === 0
+        ? ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage']
+        : []),
+    ],
   };
 
   // Playwright's bundled Chromium is not available on every host — it has