total-recall-brain 3.40.1 → 3.40.2

package/scaffold/.agent/skills/total-recall/plugins/auth/src/cli-secret.mjs

@@ -1,15 +1,15 @@
 /**
- * total-recall secret — manage API keys and credentials (not in the memory vault).
+ * total-recall auth secret — manage API keys and credentials (not in the memory vault).
  *
  * Usage:
- *   npx total-recall secret set <key> <value> [--provider name] [--scope global|project]
- *   npx total-recall secret get <key>          # prints value (use carefully)
- *   npx total-recall secret list
- *   npx total-recall secret rotate <key>       # prompts for the value
- *   npx total-recall secret delete <key>
- *   npx total-recall secret audit [--limit N]
- *   npx total-recall secret usage [--days N]
- *   npx total-recall secret usage-record --provider x --cost 0.01
+ *   npx total-recall auth secret set <key> <value> [--provider name] [--scope global|project]
+ *   npx total-recall auth secret get <key>          # prints value (use carefully)
+ *   npx total-recall auth secret list
+ *   npx total-recall auth secret rotate <key>       # prompts for the value
+ *   npx total-recall auth secret delete <key>
+ *   npx total-recall auth secret audit [--limit N]
+ *   npx total-recall auth secret usage [--days N]
+ *   npx total-recall auth secret usage-record --provider x --cost 0.01
  */
 
 import {
@@ -184,9 +184,9 @@ function readSecretValue(label) {
 
 function printHelp() {
   console.log(`
-  total-recall secret — Secrets store (separate from memory vault)
+  total-recall auth secret — Secrets store (separate from memory vault)
 
-  Usage: total-recall secret <command> [options]
+  Usage: total-recall auth secret <command> [options]
 
   Commands:
     set <key> [value]     Store a secret (encrypted, unlock required; 0600 file)
@@ -220,7 +220,7 @@ function printHelp() {
       --no-global         Only keys bound to this repo (skip unbound)
       --replace-all       Overwrite entire .env (default: merge TR block only)
       --remote <name>     Also push the SSOT projection to a configured remote
-                           target over SSH (see 'secret remote') instead of
+                           target over SSH (see 'auth secret remote') instead of
                            (or in addition to) a local file
       --dry-run           Show keys that would be written
     remote <cmd>          Manage remote (production) deploy targets — generic,
@@ -282,7 +282,7 @@ function printHelp() {
     --export-env          After rotate, write .env to bound repos (and cwd if unbound)
     --export-all          After rotate, export-env to all project-registry paths
     --remote <name>       After rotate, also push to a configured remote target
-                           (production, etc.) over SSH — see 'secret remote'
+                           (production, etc.) over SSH — see 'auth secret remote'
 
   set / rotate options:
     --provider <name>     Optional provider tag (e.g. openai, anthropic)
@@ -549,6 +549,12 @@ function parseArgs(args) {
       case '--headless':
         out.headless = true;
         break;
+      case '--chrome':
+        out.chrome = true;
+        break;
+      case '--revoke-old':
+        out.revokeOld = true;
+        break;
       case '--json':
         out.json = true;
         break;
@@ -647,7 +653,7 @@ export default async function secretCli(argv) {
       process.exit(1);
     }
     if (opts.command !== 'rekey' && !opts.key) {
-      console.error(`Usage: total-recall secret ${opts.command} <key> --stdin`);
+      console.error(`Usage: total-recall auth secret ${opts.command} <key> --stdin`);
       process.exit(1);
     }
     opts.value = readStdinValue();
@@ -750,7 +756,7 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'set') {
       if (!opts.key || opts.value == null) {
-        console.error('Usage: total-recall secret set <key> <value>');
+        console.error('Usage: total-recall auth secret set <key> <value>');
         process.exit(1);
       }
       await setSecret(brainDir, opts.key, opts.value, {
@@ -778,7 +784,7 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'generate') {
       if (!opts.key) {
-        console.error('Usage: total-recall secret generate <key> [--bytes 32] [--format hex|base64|base64url]');
+        console.error('Usage: total-recall auth secret generate <key> [--bytes 32] [--format hex|base64|base64url]');
         process.exit(1);
       }
       const crypto = await import('node:crypto');
@@ -831,7 +837,7 @@ export default async function secretCli(argv) {
       if (multiError.length) {
         console.log(
           `  ❌ ${multiError.length} key(s) bound to multiple repos — fix with:\n` +
-            `     secret meta <KEY> --repo <one-repo>\n` +
+            `     auth secret meta <KEY> --repo <one-repo>\n` +
             `     or clear repos for Developer secrets\n`,
         );
       }
@@ -975,10 +981,10 @@ export default async function secretCli(argv) {
           }
           if (g.error) console.log(`      → ${g.error}`);
           console.log(
-            `      fix: rotate each key to a unique value, then: secret rotate <key> <new> --export-env`,
+            `      fix: rotate each key to a unique value, then: auth secret rotate <key> <new> --export-env`,
           );
           console.log(
-            `      waive (rare): secret meta <key> --shared-ok   # only if intentional mirror`,
+            `      waive (rare): auth secret meta <key> --shared-ok   # only if intentional mirror`,
           );
           console.log('');
         }
@@ -991,7 +997,7 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'meta') {
       if (!opts.key) {
-        console.error('Usage: total-recall secret meta <key> [--repo ...] [--tier ...]');
+        console.error('Usage: total-recall auth secret meta <key> [--repo ...] [--tier ...]');
         process.exit(1);
       }
       const patch = {};
@@ -1046,15 +1052,15 @@ export default async function secretCli(argv) {
         const r = await enqueueRotationDueTasks(brainDir, { autoOnly: false });
         console.log(`\n  📋 Enqueued ${r.tasks.filter((t) => t.status === 'created').length} rotation assist task(s)`);
       }
-      console.log('\n  Rotate:        npx total-recall secret rotate <key> <new> --export-env');
-      console.log('  Browser assist: npx total-recall secret rotate-browser <key>');
-      console.log('  Enqueue tasks:  npx total-recall secret rotation-due --enqueue\n');
+      console.log('\n  Rotate:        npx total-recall auth secret rotate <key> <new> --export-env');
+      console.log('  Browser assist: npx total-recall auth secret rotate-browser <key>');
+      console.log('  Enqueue tasks:  npx total-recall auth secret rotation-due --enqueue\n');
       return;
     }
 
     if (opts.command === 'get') {
       if (!opts.key) {
-        console.error('Usage: total-recall secret get <key>');
+        console.error('Usage: total-recall auth secret get <key>');
         process.exit(1);
       }
       const project_id = currentProjectId();
@@ -1105,7 +1111,7 @@ export default async function secretCli(argv) {
     if (opts.command === 'remote') {
       if (!opts.subcommand) {
         console.error(
-          'Usage: total-recall secret remote <add|list|remove|deploy> [...]\n' +
+          'Usage: total-recall auth secret remote <add|list|remove|deploy> [...]\n' +
             '  add <name> --host <h> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]\n' +
             '  list\n' +
             '  remove <name>\n' +
@@ -1117,7 +1123,7 @@ export default async function secretCli(argv) {
       if (opts.subcommand === 'add') {
         if (!opts.key || !opts.remoteHost || !opts.path) {
           console.error(
-            'Usage: total-recall secret remote add <name> --host <host> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]',
+            'Usage: total-recall auth secret remote add <name> --host <host> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]',
           );
           process.exit(1);
         }
@@ -1158,7 +1164,7 @@ export default async function secretCli(argv) {
 
       if (opts.subcommand === 'remove' || opts.subcommand === 'rm') {
         if (!opts.key) {
-          console.error('Usage: total-recall secret remote remove <name>');
+          console.error('Usage: total-recall auth secret remote remove <name>');
           process.exit(1);
         }
         const r = removeRemoteTarget(brainDir, opts.key);
@@ -1168,7 +1174,7 @@ export default async function secretCli(argv) {
 
       if (opts.subcommand === 'deploy') {
         if (!opts.key) {
-          console.error('Usage: total-recall secret remote deploy <name> [--dry-run] [--keys k1,k2]');
+          console.error('Usage: total-recall auth secret remote deploy <name> [--dry-run] [--keys k1,k2]');
           process.exit(1);
         }
         const r = await deployEnvToRemote(brainDir, opts.key, {
@@ -1193,7 +1199,7 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'rotate') {
       if (!opts.key) {
-        console.error('Usage: total-recall secret rotate <key> [--export-env|--export-all|--remote <name>]');
+        console.error('Usage: total-recall auth secret rotate <key> [--export-env|--export-all|--remote <name>]');
         console.error('       The new value is read from a prompt or stdin — never from argv.');
         process.exit(1);
       }
@@ -1220,7 +1226,7 @@ export default async function secretCli(argv) {
           `\n  ⚠️  WARNING: the value was passed as a command-line argument.\n` +
             `     It is now in your shell history and was visible to any user\n` +
             `     running \`ps\` on this machine. Treat it as already disclosed\n` +
-            `     and rotate again using the prompt: total-recall secret rotate ${opts.key}\n`,
+            `     and rotate again using the prompt: total-recall auth secret rotate ${opts.key}\n`,
         );
       }
       if (!opts.value) {
@@ -1277,7 +1283,7 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'rotate-browser' || opts.command === 'rotate-auto') {
       if (!opts.key) {
-        console.error(`Usage: total-recall secret ${opts.command} <key>`);
+        console.error(`Usage: total-recall auth secret ${opts.command} <key>`);
         process.exit(1);
       }
 
@@ -1296,6 +1302,9 @@ export default async function secretCli(argv) {
       console.log(`\n  🔐 Rotating ${opts.key}…\n`);
       const r = await run(brainDir, opts.key, {
         headless: !!opts.headless,
+        chrome: !!opts.chrome,
+        label: opts.label,
+        revokeOld: !!opts.revokeOld,
         exportEnv: opts.exportEnv !== false,
         onStatus: (m) => console.log(`     · ${m}`),
       });
@@ -1307,9 +1316,10 @@ export default async function secretCli(argv) {
       }
       console.log(`\n  ✅ Rotated ${r.key}` + (r.method ? ` via ${r.method}` : ''));
       if (r.verified === true) console.log('     verified against provider API');
+      if (r.revoked) console.log(`     revoked ${r.revoked} deprecated credential(s) from provider console`);
       if (r.supervised) console.log('     (supervised — recipe not yet auto-verified)');
       if (r.exports?.length) console.log(`     exported to ${r.exports.length} project(s)`);
-      if (r.revoke_hint) console.log(`\n  ⚠️  ${r.revoke_hint}`);
+      if (r.revoke_hint && !r.revoked) console.log(`\n  ⚠️  ${r.revoke_hint}`);
       return;
     }
 
@@ -1347,7 +1357,7 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'delete' || opts.command === 'rm') {
       if (!opts.key) {
-        console.error('Usage: total-recall secret delete <key>');
+        console.error('Usage: total-recall auth secret delete <key>');
         process.exit(1);
       }
       const r = await deleteSecret(brainDir, opts.key);
@@ -1634,7 +1644,7 @@ export default async function secretCli(argv) {
       }
       if (opts.dryRun || (!opts.all && !opts.keys.length)) {
         console.log(
-          '\n  Dry-run / preview. Import with:\n    npx total-recall secret import-env --all\n    npx total-recall secret import-env OPENAI_API_KEY ANTHROPIC_API_KEY\n',
+          '\n  Dry-run / preview. Import with:\n    npx total-recall auth secret import-env --all\n    npx total-recall auth secret import-env OPENAI_API_KEY ANTHROPIC_API_KEY\n',
         );
         return;
       }

package/scaffold/.agent/skills/total-recall/plugins/auth/src/google-oauth.mjs

@@ -23,7 +23,8 @@ export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = sav
     if (!values.GOOGLE_CLIENT_ID || !values.GOOGLE_CLIENT_SECRET) throw new Error('Google OAuth is not configured');
     const redirect = new URL(values.GOOGLE_REDIRECT_URI || '');
     if ((redirect.protocol !== 'https:' && !(redirect.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(redirect.hostname))) || redirect.username || redirect.password || redirect.search || redirect.hash || redirect.pathname !== '/auth/google/callback') throw new Error('Configure a trusted GOOGLE_REDIRECT_URI ending in /auth/google/callback');
-    return { clientId: values.GOOGLE_CLIENT_ID, clientSecret: values.GOOGLE_CLIENT_SECRET, redirectUri: redirect.href };
+    const scope = values.GOOGLE_SCOPES || 'openid email profile';
+    return { clientId: values.GOOGLE_CLIENT_ID, clientSecret: values.GOOGLE_CLIENT_SECRET, redirectUri: redirect.href, scope };
   };
   const status = () => {
     const rows = state.read({}); assertNoSecretValues(rows);
@@ -69,16 +70,17 @@ export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = sav
   };
   return {
     config, status,
-    begin() {
+    begin(options = {}) {
       const cfg = config();
       for (const [key, value] of pending) if (value.expires <= now()) pending.delete(key);
       if (pending.size >= 1000) throw new Error('Too many pending authorizations');
       const stateValue = crypto.randomBytes(32).toString('base64url');
       const browser = crypto.randomBytes(32).toString('base64url');
       const verifier = crypto.randomBytes(48).toString('base64url');
+      const scope = options.scope || cfg.scope;
       pending.set(stateValue, { browser: digest(browser), verifier, expires: now() + 600000, redirectUri: cfg.redirectUri });
       const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
-      for (const [key, value] of Object.entries({ client_id: cfg.clientId, redirect_uri: cfg.redirectUri, response_type: 'code', scope: 'openid email profile',
+      for (const [key, value] of Object.entries({ client_id: cfg.clientId, redirect_uri: cfg.redirectUri, response_type: 'code', scope,
         state: stateValue, access_type: 'offline', prompt: 'consent select_account', code_challenge: crypto.createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' })) url.searchParams.set(key, value);
       return { url: url.href, redirectUri: cfg.redirectUri, browser };
     },
@@ -95,7 +97,7 @@ export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = sav
       if (user.email_verified !== true || typeof user.email !== 'string' || !user.email.includes('@')) throw new Error('Google identity is not verified');
       const allowed = load(brainDir).GOOGLE_ALLOWED_EMAILS;
       const emails = Array.isArray(allowed) ? allowed : typeof allowed === 'string' ? allowed.split(',') : [];
-      if (!emails.some(email => typeof email === 'string' && email.trim().toLowerCase() === user.email.toLowerCase())) throw new Error('Google account is not authorized for this dashboard');
+      if (emails.length > 0 && !emails.some(email => typeof email === 'string' && email.trim().toLowerCase() === user.email.toLowerCase())) throw new Error('Google account is not authorized for this dashboard');
       commit(id, { ...tokens, email: user.email, name: typeof user.name === 'string' ? user.name : '' }, 'connected');
       return { sub: id, email: user.email, name: typeof user.name === 'string' ? user.name : '' };
     },

package/scaffold/.agent/skills/total-recall/plugins/auth/src/provider-catalog.mjs

@@ -333,7 +333,7 @@ export const PROVIDER_CATALOG = [
     id: 'telnyx',
     name: 'Telnyx',
     docs_url: 'https://developers.telnyx.com/api',
-    console_url: 'https://portal.telnyx.com/#/app/api-keys',
+    console_url: 'https://portal.telnyx.com/#/api-keys',
     key_patterns: ['TELNYX_API_KEY', 'TELNYX_SIP_PASSWORD'],
     schema: { auth: 'bearer', header: 'Authorization: Bearer <key>', env_keys: ['TELNYX_API_KEY'] },
     rotation: { class: 'provider_browser' },

package/scaffold/.agent/skills/total-recall/plugins/auth/src/provider-rotation-recipes.mjs

@@ -165,10 +165,124 @@ export const ROTATION_RECIPES = {
 
   telnyx: {
     provider: 'telnyx',
-    console_url: 'https://portal.telnyx.com/#/app/api-keys',
-    verified: false,
-    create_hint: 'Create API Key → copy the KEY… value shown once.',
-    verify: (v) => probe('https://api.telnyx.com/v2/whoami', bearer(v)),
+    console_url: 'https://portal.telnyx.com/#/api-keys',
+    verified: true,
+    signed_in: 'button:has-text("Create API Key")',
+    signed_out: 'a:has-text("Log In"), input[name="email"]',
+    create_hint: 'Click "Create API Key", set tag, and copy the new key.',
+    revoke_hint: 'Click the Delete button on deprecated keys in the table.',
+    value_pattern: /^KEY[0-9A-Za-z_-]{30,}$/,
+    async create(page, { label }) {
+      // 1. Click Create API Key
+      await page.evaluate(() => {
+        const createBtn = Array.from(document.querySelectorAll('button')).find(
+          (b) => b.innerText.trim().toLowerCase() === 'create api key'
+        );
+        if (createBtn) createBtn.click();
+      });
+
+      // 2. Wait for dialog
+      let dialogReady = false;
+      for (let i = 0; i < 40; i++) {
+        await page.waitForTimeout(250);
+        dialogReady = await page.evaluate(() => {
+          const d = document.querySelector('[role=dialog]');
+          return !!(d && d.querySelector('input'));
+        });
+        if (dialogReady) break;
+      }
+      if (!dialogReady) return null;
+
+      // 3. Fill tag if provided
+      if (label) {
+        await page.evaluate(() => {
+          const d = document.querySelector('[role=dialog]');
+          const input = d?.querySelector('input');
+          if (input) input.focus();
+        });
+        if (typeof page.trustedKeystroke === 'function') {
+          await page.trustedKeystroke(label);
+          await page.waitForTimeout(300);
+          await page.trustedPress('return');
+        } else if (page.keyboard) {
+          await page.keyboard.type(label);
+          await page.keyboard.press('Enter');
+        }
+        await page.waitForTimeout(500);
+      }
+
+      // 4. Click Create inside dialog
+      await page.evaluate(() => {
+        const d = document.querySelector('[role=dialog]');
+        const confirmBtn = Array.from(d?.querySelectorAll('button') || []).find(
+          (b) => b.innerText.trim().toLowerCase() === 'create'
+        );
+        if (confirmBtn) confirmBtn.click();
+      });
+
+      // 5. Wait for "Copy to clipboard and close"
+      let copyReady = false;
+      for (let i = 0; i < 40; i++) {
+        await page.waitForTimeout(250);
+        copyReady = await page.evaluate(() => {
+          const d = document.querySelector('[role=dialog]');
+          const copyBtn = Array.from(d?.querySelectorAll('button') || []).find((b) =>
+            b.innerText.toLowerCase().includes('copy to clipboard')
+          );
+          if (copyBtn) {
+            copyBtn.focus();
+            return true;
+          }
+          return false;
+        });
+        if (copyReady) break;
+      }
+      if (!copyReady) return null;
+
+      // 6. Trigger trusted press to copy token to OS clipboard
+      if (typeof page.trustedPress === 'function') {
+        await page.trustedPress('space');
+      } else if (page.keyboard) {
+        await page.keyboard.press('Space');
+      }
+      await page.waitForTimeout(600);
+
+      // 7. Capture from clipboard
+      try {
+        const { execFileSync } = await import('node:child_process');
+        if (process.platform === 'darwin') {
+          const clip = execFileSync('pbpaste', [], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+          if (clip && /^KEY[0-9A-Za-z_-]{30,}$/.test(clip)) return clip;
+        }
+      } catch {}
+
+      return null;
+    },
+    async revokeOld(page, { keepLabels = ['MASTER', 'FESTECH-PROD', 'FESTECH-LIVE', 'ULTRACHAT-PROD', 'GROCRM-PROD', 'JSN-PROD'] } = {}) {
+      return await page.evaluate(async (labelsToKeep) => {
+        let deleted = 0;
+        const deleteBtns = Array.from(document.querySelectorAll('button[aria-label=Delete]'));
+        for (const btn of deleteBtns) {
+          const row = btn.closest('div[class*=xlaxlx]') || btn.parentElement?.parentElement?.parentElement?.parentElement;
+          const text = row ? (row.innerText || '') : '';
+          const shouldKeep = labelsToKeep.some((l) => text.includes(l));
+          if (!shouldKeep && (text.includes('23 Sep 2026') || text.includes('Never used') || text.includes('2026'))) {
+            btn.click();
+            await new Promise((r) => setTimeout(r, 600));
+            const confirmBtn = Array.from(document.querySelectorAll('[role=dialog] button')).find(
+              (b) => b.innerText.trim().toLowerCase() === 'continue'
+            );
+            if (confirmBtn) {
+              confirmBtn.click();
+              deleted++;
+              await new Promise((r) => setTimeout(r, 1200));
+            }
+          }
+        }
+        return deleted;
+      }, keepLabels);
+    },
+    verify: (v) => probe('https://api.telnyx.com/v2/balance', bearer(v)),
   },
 
   fal: {

package/scaffold/.agent/skills/total-recall/plugins/auth/src/routes/auth.mjs

@@ -134,8 +134,8 @@ authRouter.get('/auth/google/callback', async (req, res) => {
     res.cookie('session', token, sessionCookieOptions(req, ttlHours * 60 * 60 * 1000));
     if (req.query.format === 'json' || req.headers.accept?.includes('application/json')) return res.json({ success: true, user: user.email, method: 'google_oauth2' });
     return res.redirect('/');
-  } catch {
-    logger.warn('auth', 'Google OAuth callback verification failed');
+  } catch (err) {
+    logger.warn('auth', `Google OAuth callback verification failed: ${err.message}`);
     return res.status(401).json({ error: 'Google authentication failed; restart sign-in' });
   }
 });

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-env-export.mjs

@@ -20,8 +20,8 @@ const END_MARK = '# END TOTAL-RECALL-SECRETS';
 function envHeader() {
   return `${BEGIN_MARK}
 # Generated by Total Recall — do not hand-edit secret values here.
-# SSOT: secrets store (npx total-recall secret …)
-# Re-export: npx total-recall secret export-env --path <repo>
+# SSOT: secrets store (npx total-recall auth secret …)
+# Re-export: npx total-recall auth secret export-env --path <repo>
 # ${new Date().toISOString()}
 `;
 }
@@ -162,7 +162,7 @@ export async function buildEnvProjection(brainDir, target = {}) {
 
   const body = `${envHeader()}${lines.join('\n')}${lines.length ? '\n' : ''}${END_MARK}\n`;
   const exampleBody = `# Example env — names only. Values live in Total Recall secrets store.
-# Generate real .env: npx total-recall secret export-env --path .
+# Generate real .env: npx total-recall auth secret export-env --path .
 ${exampleLines.join('\n')}${exampleLines.length ? '\n' : ''}`;
 
   return {

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-remote-deploy.mjs

@@ -164,7 +164,7 @@ export async function deployEnvToRemote(brainDir, targetName, opts = {}) {
   const target = targets.find((t) => t.name === targetName);
   if (!target) {
     throw new Error(
-      `Unknown remote target "${targetName}". Configure one first: npx total-recall secret remote add ${targetName} --host <host> --path </remote/dir>`,
+      `Unknown remote target "${targetName}". Configure one first: npx total-recall auth secret remote add ${targetName} --host <host> --path </remote/dir>`,
     );
   }
 

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-rotate.mjs

@@ -49,7 +49,7 @@ export function buildBrowserRotatePrompt(secretMeta) {
     '3. Create a NEW API key (do not delete the old one yet).',
     '4. Copy the new key value ONCE — never paste into chat logs or vault markdown.',
     '5. Tell the human to run (or run via tool if value is only in a secure channel):',
-    `   npx total-recall secret rotate ${secretMeta.key} "<NEW_VALUE>" --export-env`,
+    `   npx total-recall auth secret rotate ${secretMeta.key} "<NEW_VALUE>" --export-env`,
     '6. After TR confirms export succeeded, revoke/disable the OLD key in the console.',
     '',
     docsUrl ? `API docs: ${docsUrl}` : '',
@@ -124,7 +124,7 @@ export async function enqueueRotationDueTasks(brainDir, opts = {}) {
       `## After new value is obtained`,
       ``,
       '```bash',
-      `npx total-recall secret rotate ${secret.key} "<NEW_VALUE>" --export-env`,
+      `npx total-recall auth secret rotate ${secret.key} "<NEW_VALUE>" --export-env`,
       '```',
     ].join('\n');
 
@@ -267,10 +267,18 @@ export async function getBrowserRotateAssist(brainDir, key) {
 async function captureFromClipboard(page) {
   try {
     const text = await page.evaluate(() => navigator.clipboard.readText());
-    return typeof text === 'string' ? text.trim() : null;
-  } catch {
-    return null;
-  }
+    if (typeof text === 'string' && text.trim()) return text.trim();
+  } catch {}
+
+  try {
+    const { execFileSync } = await import('node:child_process');
+    if (process.platform === 'darwin') {
+      const clip = execFileSync('pbpaste', [], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      if (clip) return clip;
+    }
+  } catch {}
+
+  return null;
 }
 
 /**
@@ -313,6 +321,8 @@ export async function rotateViaBrowser(brainDir, key, opts = {}) {
   const launched = await launchRotationContext(brainDir, {
     headless: opts.headless === true && recipe.verified,
     timeoutMs: opts.timeoutMs,
+    chrome: opts.chrome,
+    useChrome: opts.useChrome,
   });
   if (!launched.ok) return { ok: false, key, error: launched.error };
 
@@ -384,12 +394,20 @@ export async function rotateViaBrowser(brainDir, key, opts = {}) {
     });
     value = null; // drop the reference promptly
 
+    let revoked = 0;
+    if (opts.revokeOld && typeof recipe.revokeOld === 'function') {
+      say('revoking deprecated credentials from provider console');
+      revoked = await recipe.revokeOld(page, { keepLabels: [opts.label || 'total-recall', 'MASTER'] });
+      say(`revoked ${revoked} deprecated credential(s)`);
+    }
+
     return {
       ok: true,
       key,
       provider: plan.provider,
       supervised: !recipe.verified,
       verified,
+      revoked,
       exports: result.exports,
       revoke_hint: recipe.revoke_hint || 'Revoke the old credential in the console now that the new one is live.',
     };