total-recall-brain 3.40.1 → 3.40.2

package/scaffold/.agent/skills/total-recall/plugins/composable-cli/src/command.mjs

@@ -0,0 +1,313 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { spawn } from 'node:child_process';
+import { EXIT_CODES } from './contract.mjs';
+
+const COMMAND_NAME = /^[a-z][a-z0-9-]{0,63}$/;
+export const RISKS = new Set(['read', 'write', 'money', 'dns-cert', 'production-deploy', 'secret-revoke']);
+
+export function safeCommandName(name) {
+  if (!COMMAND_NAME.test(name || '')) {
+    throw new Error('Command name must be lowercase kebab-case (1–64 characters)');
+  }
+  return name;
+}
+
+export function isSafeRelativePath(p) {
+  if (typeof p !== 'string' || !p.trim() || p.includes('\0')) return false;
+  if (path.isAbsolute(p)) return false;
+  const normalized = path.normalize(p);
+  if (normalized.startsWith(`..${path.sep}`) || normalized === '..') return false;
+  return true;
+}
+
+export function builtinCommandNames() {
+  return new Set([
+    'help',
+    'version',
+    'status',
+    'recall',
+    'remember',
+    'compile',
+    'resolve',
+    'secret',
+    'secrets',
+    'harness',
+    'agent',
+    'mesh',
+    'brief',
+    'group',
+    'groups',
+    'project-id',
+    'skill',
+    'skills',
+    'plugin',
+    'plugins',
+    'app',
+    'command',
+    'start',
+  ]);
+}
+
+function headerTags(description, risk) {
+  const one = (v) => String(v).replace(/[\r\n]+/g, ' ').trim();
+  return (description ? `// @description ${one(description)}\n` : '') + (risk ? `// @risk ${risk}\n` : '');
+}
+
+function existingTag(file, key) {
+  try {
+    return fs.readFileSync(file, 'utf8').match(new RegExp(`^// @${key} (.+)$`, 'm'))?.[1] || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function generatePluginCommand(pluginDir, name, commandsDir) {
+  safeCommandName(name);
+  const root = fs.realpathSync(pluginDir);
+  const manifestPath = path.join(root, 'plugin.json');
+  if (!fs.existsSync(manifestPath) || !fs.statSync(manifestPath).isFile()) {
+    throw new Error('Plugin manifest must be a regular file');
+  }
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const spec = (manifest.commands || []).find((entry) => entry.name === name);
+  if (!spec) throw new Error(`Plugin '${manifest.id}' has no command '${name}'`);
+  if (!isSafeRelativePath(spec.handler) || spec.handler.includes('\\') || !spec.handler.endsWith('.mjs')) {
+    throw new Error(`Command '${name}' needs a safe .mjs handler path`);
+  }
+  const handlerPath = path.resolve(root, spec.handler);
+  const relative = path.relative(root, handlerPath);
+  if (!relative || relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative)
+      || !fs.statSync(handlerPath).isFile() || fs.realpathSync(handlerPath) !== handlerPath) {
+    throw new Error(`Command '${name}' handler must be a regular file inside the plugin`);
+  }
+  fs.mkdirSync(commandsDir, { recursive: true });
+  const commandPath = path.join(commandsDir, `${name}.mjs`);
+  if (fs.existsSync(commandPath)) throw new Error(`Command '${name}' already exists`);
+  const handlerUrl = pathToFileURL(handlerPath).href;
+
+  const content = `// Generated from plugin ${manifest.id}; edit the plugin manifest/handler, then regenerate.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const name = ${JSON.stringify(name)};
+const description = ${JSON.stringify(spec.description || '')};
+const handlerUrl = ${JSON.stringify(handlerUrl)};
+const backgroundAllowed = ${spec.background === true};
+
+export async function run(argv = process.argv, direct = false) {
+  const args = argv.slice(direct ? 2 : 3);
+  const json = args.includes('--json');
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log('Usage: total-recall ' + name + ' [args…] [--json]' + (backgroundAllowed ? ' [--background]' : '') + '\\n\\n' + description);
+    return;
+  }
+  try {
+    if (args.includes('--background')) {
+      if (!backgroundAllowed) throw Object.assign(new Error('Background execution is not enabled for this command'), { exitCode: 2 });
+      const reports = path.join(path.dirname(fileURLToPath(import.meta.url)), 'reports');
+      fs.mkdirSync(reports, { recursive: true, mode: 0o700 });
+      const report = path.join(reports, name + '-' + crypto.randomUUID() + '.log');
+      const fd = fs.openSync(report, 'wx', 0o600);
+      const child = spawn(process.execPath, [fileURLToPath(import.meta.url), ...args.filter((a) => a !== '--background')], {
+        detached: true, stdio: ['ignore', fd, fd]
+      });
+      fs.closeSync(fd);
+      child.unref();
+      const status = { ok: true, pid: child.pid, report };
+      if (json) console.log(JSON.stringify(status));
+      else console.log('Started ' + name + ' in background (pid ' + child.pid + '); report: ' + report);
+      return status;
+    }
+    const handler = await import(handlerUrl);
+    const entry = handler.run || handler.default;
+    if (typeof entry !== 'function') throw new Error('Plugin command handler must export run() or default function');
+    const handlerArgs = args.filter((arg) => arg !== '--json');
+    const result = await entry(handler.run ? [process.execPath, 'total-recall', name, ...handlerArgs] : handlerArgs);
+    const exitCode = Number.isInteger(result?.exitCode) ? result.exitCode : 0;
+    if (json) console.log(JSON.stringify({ ok: exitCode === 0, exit_code: exitCode, result: result?.data ?? result ?? null }));
+    process.exitCode = exitCode;
+    return result;
+  } catch (error) {
+    const exitCode = Number.isInteger(error?.exitCode) ? error.exitCode : 1;
+    if (json) console.log(JSON.stringify({ ok: false, exit_code: exitCode, error: error.message }));
+    else console.error(error.message);
+    process.exitCode = exitCode;
+  }
+}
+
+if (process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await run(process.argv, true);
+}
+`;
+  fs.writeFileSync(commandPath, content, { encoding: 'utf8', flag: 'wx', mode: 0o644 });
+  return commandPath;
+}
+
+export function generateSkillConfigCommand(skillId, name, commandsDir, options = {}) {
+  safeCommandName(name);
+  safeCommandName(skillId);
+  const repoRoot = options.repoRoot || path.resolve(commandsDir, '..', '..');
+  const schemaPath = path.join(repoRoot, '.agent', 'skills', skillId, 'core', 'config.schema.json');
+  if (!fs.existsSync(schemaPath) || !fs.statSync(schemaPath).isFile()) {
+    throw new Error(`Skill '${skillId}' in ${repoRoot} has no core/config.schema.json; deploy the layered skill first`);
+  }
+  fs.mkdirSync(commandsDir, { recursive: true });
+  const commandPath = path.join(commandsDir, `${name}.mjs`);
+  if (fs.existsSync(commandPath)) throw new Error(`Command '${name}' already exists`);
+
+  const content = `// Generated repo-layer config command for skill ${skillId}; the contract is .agent/skills/${skillId}/core/config.schema.json.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const skillId = ${JSON.stringify(skillId)};
+const name = ${JSON.stringify(name)};
+
+export async function run(argv = process.argv) {
+  const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+  const candidate = path.join(repoRoot, '.agent', 'skills', 'total-recall', 'src', 'cli', 'skill-config.mjs');
+  const { runSkillConfig } = await import(pathToFileURL(candidate).href);
+  return runSkillConfig(skillId, argv.slice(3), { repoRoot, prefix: 'total-recall ' + name });
+}
+`;
+  fs.writeFileSync(commandPath, content, { encoding: 'utf8', flag: 'wx', mode: 0o644 });
+  return commandPath;
+}
+
+export function commandCreate(options = {}) {
+  const {
+    name,
+    code,
+    description,
+    risk,
+    commandsDir,
+    fromPlugin,
+    configForSkill,
+    repoRoot,
+  } = options;
+
+  safeCommandName(name);
+
+  if (builtinCommandNames().has(name)) {
+    const err = new Error(`'${name}' is a built-in Total Recall command; a custom command with that name could never run.`);
+    err.exitCode = EXIT_CODES.USAGE;
+    throw err;
+  }
+
+  if (configForSkill) {
+    return generateSkillConfigCommand(configForSkill, name, commandsDir, { repoRoot });
+  }
+
+  if (fromPlugin) {
+    return generatePluginCommand(fromPlugin, name, commandsDir);
+  }
+
+  if (!code) {
+    const err = new Error('Missing code snippet for the command');
+    err.exitCode = EXIT_CODES.USAGE;
+    throw err;
+  }
+
+  fs.mkdirSync(commandsDir, { recursive: true });
+  const commandPath = path.join(commandsDir, `${name}.mjs`);
+  if (fs.existsSync(commandPath)) {
+    const err = new Error(`Custom command '${name}' already exists.`);
+    err.exitCode = EXIT_CODES.ERROR;
+    throw err;
+  }
+
+  const fileContent = `// Auto-generated custom CLI command: ${name}
+${headerTags(description, risk)}export async function run(argv = []) {
+  const args = Array.isArray(argv) ? argv.slice(3) : [];
+  ${code}
+}
+export default async function (args = []) {
+  ${code}
+}
+`;
+
+  fs.writeFileSync(commandPath, fileContent, 'utf8');
+  return commandPath;
+}
+
+export function commandRead(name, commandsDir) {
+  safeCommandName(name);
+  const commandPath = path.join(commandsDir, `${name}.mjs`);
+  if (!fs.existsSync(commandPath)) {
+    const err = new Error(`Custom command '${name}' does not exist in ${commandsDir}.`);
+    err.exitCode = EXIT_CODES.ERROR;
+    throw err;
+  }
+  return fs.readFileSync(commandPath, 'utf8');
+}
+
+export function commandUpdate(options = {}) {
+  const {
+    name,
+    code,
+    description,
+    risk,
+    commandsDir,
+  } = options;
+
+  safeCommandName(name);
+  const commandPath = path.join(commandsDir, `${name}.mjs`);
+  if (!fs.existsSync(commandPath)) {
+    const err = new Error(`Custom command '${name}' does not exist in ${commandsDir}.`);
+    err.exitCode = EXIT_CODES.ERROR;
+    throw err;
+  }
+
+  const keptDescription = description ?? existingTag(commandPath, 'description');
+  const keptRisk = risk ?? existingTag(commandPath, 'risk');
+  const fileContent = `// Auto-generated custom CLI command: ${name}
+${headerTags(keptDescription, keptRisk)}export async function run(argv = []) {
+  const args = Array.isArray(argv) ? argv.slice(3) : [];
+  ${code}
+}
+export default async function (args = []) {
+  ${code}
+}
+`;
+
+  fs.writeFileSync(commandPath, fileContent, 'utf8');
+  return commandPath;
+}
+
+export function commandRemove(name, commandsDir) {
+  safeCommandName(name);
+  const commandPath = path.join(commandsDir, `${name}.mjs`);
+  if (!fs.existsSync(commandPath)) {
+    const err = new Error(`Custom command '${name}' does not exist.`);
+    err.exitCode = EXIT_CODES.ERROR;
+    throw err;
+  }
+  fs.unlinkSync(commandPath);
+  return true;
+}
+
+export function commandList(targets = []) {
+  const results = [];
+  for (const t of targets) {
+    if (fs.existsSync(t.dir)) {
+      const files = fs.readdirSync(t.dir).filter((f) => f.endsWith('.mjs'));
+      for (const f of files) {
+        const fullPath = path.join(t.dir, f);
+        const name = f.replace(/\.mjs$/, '');
+        results.push({
+          name,
+          scope: t.scope || 'project',
+          path: fullPath,
+          description: existingTag(fullPath, 'description') || null,
+          risk: existingTag(fullPath, 'risk') || null,
+        });
+      }
+    }
+  }
+  return results;
+}

package/scaffold/.agent/skills/total-recall/plugins/composable-cli/src/compile.mjs

@@ -0,0 +1,19 @@
+/** Rebuild host projections after an owned command mutation. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export const MUTATIONS = new Set(['create', 'update', 'remove', 'rollback', 'promote']);
+
+export async function compileCommandMutation(args, { projectRoot = process.cwd(), packageRoot = process.env.TR_PACKAGE_ROOT, compile } = {}) {
+  if (!compile) {
+    if (!packageRoot || !path.isAbsolute(packageRoot)) throw new Error('Verified Total Recall host package context required for automatic compilation');
+    const root = fs.realpathSync(packageRoot);
+    if (JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).name !== 'total-recall-brain') throw new Error('Selected host is not a Total Recall package');
+    const host = await import(pathToFileURL(path.join(root, 'src/core/plugin-store.mjs')).href);
+    compile = host.recompileAfterPluginMutation;
+  }
+  const result = await compile(projectRoot, args.includes('--global') || args.includes('--group'));
+  if (!result?.ok) throw new Error(`Command changed but automatic compilation failed: ${result?.error || 'compiler returned no success'}; run total-recall compile`);
+  return result;
+}

package/scaffold/.agent/skills/total-recall/plugins/composable-cli/src/compose.mjs

@@ -0,0 +1,144 @@
+/**
+ * tr() — Composable CLI Composition Helper
+ *
+ * Calls a verb (subcommand, custom command, or built-in) and returns
+ * a standard envelope { ok, exitCode, data }.
+ *
+ * v2 commands (export default function main(args, { tr, json, dryRun, log }))
+ * run in-process with an isolated argv and no subprocess overhead.
+ * Built-ins run as subprocesses with --json. Custom commands require native metadata.
+ *
+ * Secrets are passed only through stdin, never on argv.
+ * Nested calls inherit dryRun from the parent; a nested risky call
+ * without --yes fails the parent with exit 3.
+ */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import fs from 'node:fs';
+import { isV2Command } from './contract.mjs';
+import { hasRiskGate, dryRunResult } from './risk.mjs';
+
+const CLI_PATH = process.argv[1]; // total-recall bin
+
+/**
+ * Resolve a verb to find its source module.
+ * Follows the same resolution order as the core dispatcher:
+ * built-in → project custom → global custom → plugin.
+ * Returns { source: 'builtin'|'project'|'global'|'plugin', path: string|null }
+ */
+function resolveVerb(verb) {
+  // Try built-in resolution: the bin has a COMMANDS map
+  // For now, we treat anything not found locally as needing subprocess
+
+  // Project custom commands
+  const projectCmdPath = path.join(process.cwd(), '.agent', 'commands', `${verb}.mjs`);
+  if (fs.existsSync(projectCmdPath)) {
+    return { source: 'project', path: projectCmdPath };
+  }
+
+  // Global custom commands
+  const homeDir = process.env.HOME || process.env.USERPROFILE;
+  if (homeDir) {
+    const globalCmdPath = path.join(homeDir, '.agent', 'commands', `${verb}.mjs`);
+    if (fs.existsSync(globalCmdPath)) {
+      return { source: 'global', path: globalCmdPath };
+    }
+  }
+
+  // Not found locally — use subprocess via the CLI itself
+  return { source: 'builtin', path: null };
+}
+
+/**
+ * Call a verb and return the envelope.
+ *
+ * @param {string} verb - The command to call (e.g. 'project-id')
+ * @param {string[]} args - Arguments to pass
+ * @param {object} [options]
+ * @param {boolean} [options.dryRun] - Inherited dry-run mode
+ * @param {boolean} [options.json] - Force JSON output
+ * @param {string} [options.stdin] - Piped stdin content (secrets only)
+ * @param {object} [options.log] - Optional logger
+ * @returns {Promise<{ok: boolean, exitCode: number, data: any}>}
+ */
+export async function tr(verb, args = [], options = {}) {
+  const { dryRun = false, json = true, stdin, log } = options;
+
+  const resolved = resolveVerb(verb);
+
+  if (resolved.path && !isV2Command(resolved.path)) return { ok: false, exitCode: 1, error: `Command ${verb} requires native metadata; recreate it with composable-cli create` };
+
+  // Execute native custom commands in process
+  if (resolved.path && isV2Command(resolved.path)) {
+    try {
+      const mod = await import(resolved.path);
+      const handler = mod.default || mod.main;
+      if (typeof handler !== 'function') {
+        throw new Error(`Command '${verb}' has no default/main export`);
+      }
+
+      // Check risk gate for nested calls
+      let meta = {};
+      try {
+        const metaSrc = fs.readFileSync(resolved.path, 'utf8');
+        const metaMatch = metaSrc.match(/export\s+const\s+meta\s*=\s*({[\s\S]*?});/);
+        if (metaMatch) {
+          meta = Function(`"use strict"; return (${metaMatch[1]})`)();
+        }
+      } catch { /* ignore parse errors */ }
+
+      if (meta.risk && hasRiskGate(meta.risk) && !args.includes('--yes')) {
+        // Dry run: return the plan
+        const plan = await dryRunResult(handler, args, { verb, json, dryRun: true, log });
+        return { ok: false, exitCode: 3, data: plan, _riskGated: true };
+      }
+
+      const result = await handler(args, { tr: (...a) => tr(...a, { ...options, dryRun }), json, dryRun, log });
+      const exitCode = result?.exitCode ?? 0;
+      return { ok: exitCode === 0, exitCode, data: result?.data ?? result ?? null };
+    } catch (err) {
+      return { ok: false, exitCode: err.exitCode ?? 1, error: err.message };
+    }
+  }
+
+  // Fallback: subprocess with --json envelope
+  const allArgs = [CLI_PATH, verb, ...args];
+  if (json && !args.includes('--json')) {
+    allArgs.push('--json');
+  }
+
+  const spawnOpts = {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    env: { ...process.env },
+  };
+
+  if (stdin) {
+    spawnOpts.input = stdin;
+  }
+
+  const child = spawnSync(process.execPath, allArgs, spawnOpts);
+  const stdout = (child.stdout || '').toString().trim();
+  const stderr = (child.stderr || '').toString().trim();
+
+  if (child.error) {
+    return { ok: false, exitCode: 1, error: child.error.message };
+  }
+
+  const exitCode = child.status ?? 1;
+
+  if (json) {
+    // Try to parse JSON envelope; last JSON line wins
+    const lines = stdout.split('\n').filter(Boolean);
+    const jsonLines = lines.filter((l) => {
+      try { JSON.parse(l); return true; } catch { return false; }
+    });
+    if (jsonLines.length > 0) {
+      const parsed = JSON.parse(jsonLines[jsonLines.length - 1]);
+      return { ok: parsed.ok ?? exitCode === 0, exitCode, data: parsed.result ?? parsed.data ?? parsed, ...(parsed.error ? { error: parsed.error } : {}) };
+    }
+  }
+
+  return { ok: exitCode === 0, exitCode, data: stdout || null, stderr: stderr || null };
+}
+
+export default tr;

package/scaffold/.agent/skills/total-recall/plugins/composable-cli/src/contract.mjs

@@ -0,0 +1,110 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+/**
+ * Standard Composable CLI v2 Command Contract
+ *
+ * Exit codes:
+ * 0: Success
+ * 1: Failure / Error
+ * 2: Usage / Bad arguments
+ * 3: Risk gate abstained / Dry-run
+ */
+export const EXIT_CODES = {
+  OK: 0,
+  ERROR: 1,
+  USAGE: 2,
+  ABSTAIN: 3,
+};
+
+export function wrapCommandExecution(options = {}) {
+  const {
+    name,
+    description = '',
+    handler,
+    backgroundAllowed = false,
+  } = options;
+
+  return async function run(argv = process.argv, direct = false) {
+    const args = argv.slice(direct ? 2 : 3);
+    const json = args.includes('--json');
+
+    if (args.includes('--help') || args.includes('-h')) {
+      const usage = `Usage: total-recall ${name} [args…] [--json]${backgroundAllowed ? ' [--background]' : ''}\n\n${description}`;
+      if (json) {
+        console.log(JSON.stringify({ ok: true, name, description, usage, background_allowed: backgroundAllowed }));
+      } else {
+        console.log(usage);
+      }
+      return;
+    }
+
+    try {
+      if (args.includes('--background')) {
+        if (!backgroundAllowed) {
+          const err = new Error('Background execution is not enabled for this command');
+          err.exitCode = EXIT_CODES.USAGE;
+          throw err;
+        }
+
+        const reportsDir = path.join(process.cwd(), '.agent', 'reports');
+        fs.mkdirSync(reportsDir, { recursive: true, mode: 0o700 });
+        const report = path.join(reportsDir, `${name}-${crypto.randomUUID()}.log`);
+        const fd = fs.openSync(report, 'wx', 0o600);
+
+        const cleanArgs = args.filter((a) => a !== '--background');
+        const child = spawn(process.execPath, [fileURLToPath(import.meta.url), ...cleanArgs], {
+          detached: true,
+          stdio: ['ignore', fd, fd],
+        });
+        fs.closeSync(fd);
+        child.unref();
+
+        const status = { ok: true, pid: child.pid, report };
+        if (json) console.log(JSON.stringify(status));
+        else console.log(`Started ${name} in background (pid ${child.pid}); report: ${report}`);
+        return status;
+      }
+
+      const handlerArgs = args.filter((arg) => arg !== '--json');
+      const result = await handler(handlerArgs, { json, rawArgv: argv });
+      const exitCode = Number.isInteger(result?.exitCode) ? result.exitCode : EXIT_CODES.OK;
+
+      if (json) {
+        console.log(JSON.stringify({
+          ok: exitCode === EXIT_CODES.OK,
+          exit_code: exitCode,
+          result: result?.data ?? result ?? null,
+        }));
+      }
+      process.exitCode = exitCode;
+      return result;
+    } catch (error) {
+      const exitCode = Number.isInteger(error?.exitCode) ? error.exitCode : EXIT_CODES.ERROR;
+      if (json) {
+        console.log(JSON.stringify({ ok: false, exit_code: exitCode, error: error.message }));
+      } else {
+        console.error(`Error: ${error.message}`);
+      }
+      process.exitCode = exitCode;
+    }
+  };
+}
+
+/**
+ * Detect whether a command file is v2 (export const meta present).
+ *
+ * @param {string} filePath
+ * @returns {boolean}
+ */
+export function isV2Command(filePath) {
+  try {
+    const content = fs.readFileSync(filePath, 'utf8');
+    return /export\s+const\s+meta\s*=/.test(content);
+  } catch {
+    return false;
+  }
+}

package/scaffold/.agent/skills/total-recall/plugins/composable-cli/src/library.mjs

@@ -0,0 +1,23 @@
+/** One CLI discovery view: installed plugin operations plus owned composed commands. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { commandList } from './command.mjs';
+import { getCommandTargets } from './resolve.mjs';
+
+export async function buildCliLibrary({ projectRoot = process.cwd(), packageRoot = process.env.TR_PACKAGE_ROOT, loadCatalog } = {}) {
+  if (!loadCatalog) {
+    if (!packageRoot || !path.isAbsolute(packageRoot)) throw new Error('Verified Total Recall host package context required for CLI library');
+    const root = fs.realpathSync(packageRoot);
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    if (pkg.name !== 'total-recall-brain') throw new Error('Selected host is not a Total Recall package');
+    const module = await import(pathToFileURL(path.join(root, 'src/core/plugin-catalog.mjs')).href);
+    loadCatalog = module.buildPluginCatalog;
+  }
+  const catalog = await loadCatalog(projectRoot);
+  const composedCommands = commandList(getCommandTargets({ cwd: projectRoot })).map(item => ({
+    name: item.name, scope: item.scope, description: item.description || '', risk: item.risk || null,
+    command: `total-recall ${item.name}`,
+  }));
+  return { ...catalog, composedCommands, evidence: 'Declared local capabilities; provider readiness requires execution verification' };
+}