total-recall-brain 3.40.1 → 3.40.2

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,32 +1,14 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.1",
+  "version": "0.2.2",
+  "private": true,
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
-    "test": "node --test test/*.test.mjs",
-    "test:runtime": "vitest run"
-  },
-  "devDependencies": {
-    "total-recall-brain": "^3.39.1",
-    "vitest": "^4.1.11",
-    "supertest": "^7.2.2",
-    "jsdom": "^29.1.1"
+    "test": "node --test test/*.test.mjs"
   },
   "license": "MIT",
   "dependencies": {
     "express": "^5.2.1"
-  },
-  "files": [
-    "cli.mjs",
-    "plugin.json",
-    "README.md",
-    "LICENSE",
-    "src/",
-    "!src/**/*.spec.mjs",
-    "ui/"
-  ],
-  "publishConfig": {
-    "access": "public"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
   "branding": {
@@ -81,6 +81,18 @@
     "command": "mesh",
     "handler": "./cli.mjs",
     "subcommands": [
+      {
+        "name": "file",
+        "description": "Transfer a file through authenticated mesh access and verify its destination hash",
+        "effect": "write",
+        "output": "json",
+        "args": [
+          {"name":"operation","label":"Operation","type":"string","positional":true,"required":true},
+          {"name":"node","label":"Node","type":"string","positional":true,"required":true},
+          {"name":"source","label":"Source","type":"string","positional":true,"required":true},
+          {"name":"destination","label":"Destination","type":"string","positional":true,"required":true}
+        ]
+      },
       {
         "name": "status",
         "description": "Inspect live mesh state",
@@ -113,6 +125,7 @@
       },
       {
         "name": "access",
+        "timeout_ms": 180000,
         "description": "Mesh access operation",
         "effect": "write"
       },

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/cli/mesh.mjs

@@ -19,6 +19,7 @@ import { spawnSync } from 'node:child_process';
 import { resolveBrainDir, parseLayerFlag } from './agent-dir.mjs';
 import {
   describeHeadscaleAvailability,
+  headscaleFetch,
   createHeadscalePreAuthKey,
   getHeadscalePolicy,
   setHeadscalePolicy,
@@ -54,6 +55,10 @@ function printHelp() {
                            Record how to reach a node
     access import          Propose access from ~/.ssh/config (--apply to save)
     access sync            Learn login accounts from every peer already reachable
+    access verify [--all-pairs] [--json]
+                           Prove execution from each configured machine to every other
+    file put <node> <source> <destination> [--mode 600]
+                           Atomically transfer a file and verify its SHA-256
     access discover [node] Find a working login with this machine's keys and record it
     ping [node]            Measure round-trip latency to a node (or all nodes) (--json)
     leader                 Show cluster leader election status and current leader (--json)
@@ -427,6 +432,11 @@ export default async function meshCli(argv = []) {
 
     if (command === 'access') {
       const target = args.shift();
+      if(target==='verify'){
+        const {verifyMeshAccess}=await import('../core/mesh-access-verify.mjs');
+        const report=await verifyMeshAccess({allPairs:args.includes('--all-pairs')});
+        console.log(JSON.stringify(report,null,2));if(!report.ok)process.exitCode=1;return;
+      }
       if (!target) {
         fail('`access` requires a node name, or `import`.');
         return;

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/core/headscale-client.mjs

@@ -272,8 +272,12 @@ export function buildMeshSshPolicy({ allowRoot = false } = {}) {
     ssh: [
       {
         action: 'accept',
+        // autogroup:member, not autogroup:self. 'self' limits a member to SSH on their own
+        // devices, so no node on the mesh could reach any other one and every cross-machine
+        // operation fell back to key auth that had never been set up — which reads as the peer
+        // being unreachable. The point of this policy is that members reach each other.
         src: ['autogroup:member'],
-        dst: ['autogroup:self'],
+        dst: ['autogroup:member'],
         users: allowRoot ? ['autogroup:nonroot', 'root'] : ['autogroup:nonroot'],
       },
     ],

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/core/leader-election.mjs

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { getMeshPeers, getMeshSelf, listEnrichedMeshNodes } from './mesh.mjs';
+import { getMeshPeers, getMeshSelf } from './mesh.mjs';
 import { brainDir } from './config.mjs';
 
 /**
@@ -70,27 +70,18 @@ function compareNodes(a, b) {
  * each node wrote a private, node-local lease document and could elect itself.
  */
 export async function getLeaderInfo() {
-  // Use the ENTITY-ENRICHED node list, not getMeshPeers(). `brain_port` is an
-  // entity variable: it lives in the vault's mesh-node document and is absent
-  // from raw Tailscale status. getMeshPeers() reads only that status, so its
-  // `brain_port` was always null and every caller fell back to port 3000 --
-  // while the leader was reachable the whole time on its real port.
-  const nodes = listEnrichedMeshNodes().filter((node) => node.online);
+  const nodes = getMeshPeers({ includeSelf: true }).filter((node) => node.online);
   if (nodes.length === 0) return null;
 
   const pin = leaderPin();
   if (pin) {
     const pinned = nodes.find((node) => node.ip === pin);
     if (!pinned) return null;
-    return { hostname: pinned.hostname, ip: pinned.ip, brain_port: pinned.brain_port ?? null, strategy: 'pinned-mesh-ip' };
+    return { hostname: pinned.hostname, ip: pinned.ip, strategy: 'pinned-mesh-ip' };
   }
 
   const leader = [...nodes].sort(compareNodes)[0];
-  // `brain_port` is carried through because the leader does not necessarily
-  // serve on the default port. It was dropped here, so callers such as
-  // secrets-sync fell back to 3000 and reported "fetch failed" against a leader
-  // that was up and reachable the whole time on a different port.
-  return { hostname: leader.hostname, ip: leader.ip, brain_port: leader.brain_port ?? null, strategy: 'lowest-mesh-ip' };
+  return { hostname: leader.hostname, ip: leader.ip, strategy: 'lowest-mesh-ip' };
 }
 
 /**

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/core/mesh-access-verify.mjs

@@ -0,0 +1,22 @@
+/** Prove execution from every configured online machine; metadata is not access proof. */
+const quote=value=>"'"+String(value).replaceAll("'","'\\''")+"'";
+export async function verifyMeshAccess({allPairs=false,listNodes,exec}={}){
+  if(!listNodes || !exec){const mesh=await import('./mesh.mjs');listNodes ||= ()=>mesh.listEnrichedMeshNodes();exec ||= mesh.execMeshCommand;}
+  const nodes=listNodes();const machines=nodes.filter(node=>node.ip && node.access?.ssh_user);
+  const self=nodes.find(node=>node.self);
+  if(!self)throw new Error('Local mesh identity is unavailable');
+  const sources=allPairs?machines:[self];const results=[];
+  for(const source of sources)for(const destination of machines){
+    if(source.ip===destination.ip)continue;
+    const row={source:source.ip,destination:destination.ip,status:'unverified'};results.push(row);
+    if(source.online===false || destination.online===false){row.status='offline';continue;}
+    try{
+      const command=source.self?'id -un':`cd "$HOME" && total-recall mesh exec ${quote(destination.ip)} ${quote('id -un')}`;
+      const result=await exec(source.self?destination.ip:source.ip,command,{timeoutMs:20000});
+      const actual=result.stdout?.trim();
+      row.status=result.success && actual===destination.access.ssh_user?'verified':'failed';
+      if(row.status==='failed')row.error=result.stderr || `Expected recorded login ${destination.access.ssh_user}, received ${actual || 'no identity'}`;
+    }catch(error){row.status='failed';row.error=error.message;}
+  }
+  return {ok:results.length>0 && results.every(row=>row.status==='verified'),observedAt:new Date().toISOString(),results,unconfigured:nodes.filter(node=>node.ip && !node.access?.ssh_user).map(node=>({node:node.ip,online:node.online,reason:'No SSH account is configured; execution not verified'}))};
+}

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/core/mesh-files.mjs

@@ -0,0 +1,18 @@
+/** Bounded atomic file transfer over the authenticated mesh execution owner. */
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+export async function putMeshFile({node,source,destination,mode=0o600,exec}={}){
+  if(!node || !source || typeof destination!=='string' || !destination || destination.includes('\0'))throw new Error('Node, source and destination are required');
+  if(!Number.isInteger(mode) || mode<0 || mode>0o777)throw new Error('Invalid file mode');
+  const bytes=fs.readFileSync(source);if(bytes.length>256*1024)throw new Error('Mesh file exceeds 256 KiB transfer budget');
+  const sha256=crypto.createHash('sha256').update(bytes).digest('hex');
+  exec ||= (await import('./mesh.mjs')).execMeshCommand;
+  const payload=JSON.stringify({destination,mode,data:bytes.toString('base64'),sha256});
+  const program=`const fs=require('node:fs'),path=require('node:path'),os=require('node:os'),crypto=require('node:crypto');let input='';for await(const chunk of process.stdin)input+=chunk;const p=JSON.parse(input);const f=p.destination.startsWith('~/')?path.join(os.homedir(),p.destination.slice(2)):path.resolve(p.destination);const b=Buffer.from(p.data,'base64');if(crypto.createHash('sha256').update(b).digest('hex')!==p.sha256)throw Error('Transfer hash mismatch');fs.mkdirSync(path.dirname(f),{recursive:true,mode:448});const t=f+'.tr-transfer-'+process.pid;fs.writeFileSync(t,b,{mode:p.mode,flag:'wx'});fs.renameSync(t,f);const actual=crypto.createHash('sha256').update(fs.readFileSync(f)).digest('hex');if(actual!==p.sha256)throw Error('Destination verification failed');console.log(JSON.stringify({path:f,bytes:b.length,sha256:actual}));`;
+  const command=`node --input-type=commonjs -e '${('(async()=>{'+program+'})().catch(()=>{console.error("Mesh transfer failed");process.exitCode=1;});').replaceAll("'","'\\''")}'`;
+  const result=await exec(node,command,{timeoutMs:20000,input:payload});
+  if(!result.success)throw new Error(result.stderr || 'Mesh file transfer failed');
+  let observed;try{observed=JSON.parse(result.stdout);}catch{throw new Error('Invalid mesh file verification response');}
+  if(observed.sha256!==sha256 || observed.bytes!==bytes.length)throw new Error('Remote file verification mismatch');
+  return {ok:true,node,...observed};
+}

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/core/mesh.mjs

@@ -701,6 +701,8 @@ export async function execMeshCommand(target, command, options = {}) {
 
   return new Promise((resolve, reject) => {
     const proc = spawn('ssh', sshArgs);
+    proc.stdin.on('error', error => { if(error.code!=='EPIPE') logger.error('mesh', 'Mesh stdin transport failed'); });
+    proc.stdin.end(options.input || '');
     let stdout = '';
     let stderr = '';
     let timedOut = false;

package/scaffold/.agent/skills/total-recall/plugins/mesh/test-support/memory-root.mjs

@@ -0,0 +1,14 @@
+/** Per-worker isolation must exist before modules initialize config or logging. */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { afterAll } from 'vitest';
+
+const previous = process.env._TR_TEST_AGENT_DIR;
+const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'tr-suite-brain-'));
+process.env._TR_TEST_AGENT_DIR = fixture;
+afterAll(() => {
+  if (previous === undefined) delete process.env._TR_TEST_AGENT_DIR;
+  else process.env._TR_TEST_AGENT_DIR = previous;
+  fs.rmSync(fixture, { recursive: true, force: true });
+});

package/scaffold/.agent/skills/total-recall/plugins/openwiki/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Greg Iteen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/scaffold/.agent/skills/total-recall/plugins/openwiki/README.md

@@ -0,0 +1,35 @@
+# OpenWiki
+
+> Multi-repo knowledge graph and documentation wiki engine for Total Recall
+
+## Sharing
+
+Offer it to your other Total Recall nodes over the mesh:
+
+```bash
+npx total-recall plugin share openwiki
+```
+
+Peers install it with `npx total-recall plugin install peer:<this-node>/openwiki`.
+
+## Features
+
+- **Identifier**: `openwiki`
+- **Version**: 0.1.0
+- **SSSS Category**: `openwiki-hubs`
+- **CLI Command**: `npx total-recall openwiki`
+- **UI**: `ui/panel.js` custom element with DESIGN.md tokens
+
+## Use it two ways
+
+This plugin is a reusable brick, so a new project does not start from zero.
+
+**Add it to a project (for apps you build and ship).** From the project directory:
+
+```sh
+total-recall plugin vendor https://github.com/gregiteen/tr-plugin-openwiki.git 
+```
+
+This copies the plugin's source, skills, tests and docs into `bricks/openwiki` and records it in `tr-bricks.json`. Your project then owns that code: edit it, test it in your own gates, and ship it with no runtime dependency on this plugin or on Total Recall. Combine as many bricks as the project needs. List them with `total-recall plugin bricks`.
+
+**Use it directly with Total Recall (for your own machines and workflow).** Install it with `total-recall plugin install https://github.com/gregiteen/tr-plugin-openwiki.git` and run `total-recall openwiki`. Manage its credentials with `total-recall auth secret` and its skills with `total-recall skill`.

package/scaffold/.agent/skills/total-recall/plugins/openwiki/cli.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+/**
+ * OpenWiki CLI Handler
+ * Executed via: npx total-recall openwiki <subcommand>
+ */
+// Scaffold: report honestly what exists. Add each real subcommand to
+// IMPLEMENTED and to plugin.json "cli.subcommands" as it is built.
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+
+const TR = process.env.TOTAL_RECALL_BIN || "total-recall";
+
+async function probeCommand(args) {
+  const json = args.includes("--json");
+  const host = process.env.TOTAL_RECALL_URL || "http://127.0.0.1:3000";
+  const start = Date.now();
+  try {
+    const res = await fetch(`${host}/health`, { signal: AbortSignal.timeout(3000) });
+    const latency_ms = Date.now() - start;
+    const ok = res.ok;
+    const status = res.status;
+    const result = { status, ok, latency_ms, endpoint: "/health" };
+    if (json) console.log(JSON.stringify(result));
+    else console.log(`Health probe: HTTP ${status} (${latency_ms}ms) from ${host}`);
+  } catch (err) {
+    const latency_ms = Date.now() - start;
+    const result = { status: 503, ok: false, latency_ms, error: err.message };
+    if (json) console.log(JSON.stringify(result));
+    else console.error(`Health probe failure: ${err.message} (${latency_ms}ms)`);
+    process.exitCode = 1;
+  }
+}
+
+async function hubsCommand(args) {
+  const json = args.includes("--json");
+  const targetDir = path.resolve(process.cwd(), "openwiki");
+  const hubs = [];
+
+  if (fs.existsSync(targetDir)) {
+    const entries = fs.readdirSync(targetDir, { withFileTypes: true });
+    for (const ent of entries) {
+      if (ent.isFile() && ent.name.endsWith(".md")) {
+        const fullPath = path.join(targetDir, ent.name);
+        const content = fs.readFileSync(fullPath, "utf8");
+        const titleMatch = content.match(/^#\s+(.+)$/m);
+        const title = titleMatch ? titleMatch[1].trim() : ent.name.replace(/\.md$/, "");
+        const lines = content.split("\n").length;
+        hubs.push({
+          title,
+          path: path.relative(process.cwd(), fullPath),
+          lines,
+          size_bytes: content.length
+        });
+      }
+    }
+  }
+
+  if (json) {
+    console.log(JSON.stringify({ hubs, count: hubs.length, directory: targetDir }));
+  } else {
+    if (hubs.length === 0) {
+      console.log(`No markdown hubs found in ${targetDir}`);
+    } else {
+      console.log(`Discovered ${hubs.length} OpenWiki Hub(s) in ${targetDir}:`);
+      for (const h of hubs) {
+        console.log(`  - ${h.title}: ${h.path} (${h.lines} lines, ${h.size_bytes} bytes)`);
+      }
+    }
+  }
+}
+
+import { runOpenWikiIngest } from "./src/ingest.mjs";
+
+async function ingestCommand(args) {
+  const result = await runOpenWikiIngest(args);
+  if (!result.ok) {
+    process.exitCode = 1;
+  }
+}
+
+const IMPLEMENTED = {};
+IMPLEMENTED.probe = probeCommand;
+IMPLEMENTED.hubs = hubsCommand;
+IMPLEMENTED.ingest = ingestCommand;
+
+
+export async function run(argv = []) {
+  const args = Array.isArray(argv) ? argv.slice(3) : [];
+  const sub = args[0] || "status";
+  const json = args.includes("--json");
+
+  if (sub === "status") {
+    const status = { plugin: "openwiki", implemented: Object.keys(IMPLEMENTED) };
+    if (json) console.log(JSON.stringify(status));
+    else console.log(status.implemented.length
+      ? `OpenWiki: implemented subcommands: ${status.implemented.join(", ")}`
+      : `OpenWiki: scaffold only — no subcommands implemented yet.`);
+    return;
+  }
+
+  if (sub === "help" || sub === "--help" || sub === "-h") {
+    console.log(`
+  OpenWiki — Multi-repo knowledge graph and documentation wiki engine
+
+  Usage:
+    total-recall openwiki <subcommand> [options]
+
+  Subcommands:
+    status                    Show OpenWiki plugin status
+    probe [--json]            Check subsystem health
+    hubs [--json]             List indexed documentation hubs
+    ingest <path> [options]   Ingest Markdown files into knowledge graph
+`);
+    return;
+  }
+
+  if (IMPLEMENTED[sub]) return IMPLEMENTED[sub](args.slice(1));
+
+  console.error(`OpenWiki: "${sub}" is not implemented.`);
+  process.exitCode = 2;
+}
+export default run;