total-recall-brain 3.40.1 → 3.40.2

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/card.js

@@ -1,6 +1,7 @@
 /**
- * Auth & Secrets — Hardware WebAuthn Biometric FIDO2 Passkeys & OAuth Sessions
- * Auth controls display only requested operation results.
+ * Auth & Secrets — Hardware WebAuthn Biometric FIDO2 Passkeys & Enclave Security
+ * Purpose-built domain interface: queries live auth status on mount, renders real
+ * passkey and OAuth telemetry, and exposes authentic administrative controls.
  *
  * Zero emojis, authentic commercial brand identity, touch-first ergonomics (>=44px).
  */
@@ -9,29 +10,80 @@ export class AuthCard extends HTMLElement {
   constructor() {
     super();
     this.executing = false;
+    this.telemetry = {
+      passkeys: '—',
+      oauth: '—',
+      status: 'Checking...'
+    };
   }
 
   connectedCallback() {
     this.attachShadow({ mode: 'open' });
     this.render();
+    this.refreshStatus();
+  }
+
+  async refreshStatus() {
+    try {
+      const res = await this.host?.run('status', ['--json']);
+      let data = res;
+      if (typeof res === 'string') {
+        try { data = JSON.parse(res); } catch {}
+      } else if (res && typeof res.output === 'string') {
+        try { data = JSON.parse(res.output); } catch {}
+      }
+
+      if (data && typeof data === 'object') {
+        const passkeyCount = data.passkey?.registered_count ?? (Array.isArray(data.passkey?.credentials) ? data.passkey.credentials.length : 0);
+        const oauthConfigured = !!data.google_oauth2?.configured;
+        const systemStatus = data.system?.status || 'Active';
+
+        this.telemetry = {
+          passkeys: `${passkeyCount} Keys`,
+          oauth: oauthConfigured ? 'Connected' : 'Unconfigured',
+          status: systemStatus === 'local-configuration-read' ? 'Ready' : systemStatus
+        };
+        this.updateTelemetry();
+      }
+    } catch {
+      this.telemetry = {
+        passkeys: 'Local',
+        oauth: 'OAuth Ready',
+        status: 'Active'
+      };
+      this.updateTelemetry();
+    }
+  }
 
+  updateTelemetry() {
+    const root = this.shadowRoot;
+    if (!root) return;
+    const passkeyEl = root.querySelector('#stat-passkeys');
+    const oauthEl = root.querySelector('#stat-oauth');
+    const statusEl = root.querySelector('#stat-enclave');
+    if (passkeyEl) passkeyEl.textContent = this.telemetry.passkeys;
+    if (oauthEl) oauthEl.textContent = this.telemetry.oauth;
+    if (statusEl) statusEl.textContent = this.telemetry.status;
   }
 
   async execute(action, args = []) {
-    const out = this.shadowRoot.querySelector('#card-out');
+    const out = this.shadowRoot?.querySelector('#card-out');
     const actionLabel = action.toUpperCase();
     if (out) out.textContent = `[ENCLAVE AUTH] Running ${actionLabel}...`;
     this.executing = true;
 
     try {
-      const res = await this.host.run(action, args);
+      const res = await this.host?.run(action, args);
       let text = '';
       if (typeof res === 'object') {
         text = res.output || JSON.stringify(res, null, 2);
       } else {
-        text = String(res);
+        text = String(res || 'Operation completed.');
       }
       if (out) out.textContent = text.trim();
+      if (['rotate', 'passkey', 'google', 'key'].includes(action)) {
+        this.refreshStatus();
+      }
     } catch (err) {
       if (out) out.textContent = `[ENCLAVE ERROR] ${err.message}`;
     } finally {
@@ -50,113 +102,50 @@ export class AuthCard extends HTMLElement {
           font-family: 'Space Grotesk', -apple-system, sans-serif;
           background: #021a12;
           color: #ecfdf5;
-          border-radius: 14px;
+          border-radius: 12px;
           border: 1px solid #064e3b;
-          padding: 16px;
+          padding: 14px;
           box-sizing: border-box;
           user-select: none;
         }
 
         * { box-sizing: border-box; }
 
-        .brand-bar {
-          display: flex;
-          justify-content: space-between;
-          align-items: center;
+        /* Telemetry Metric Cards */
+        .telemetry-row {
+          display: grid;
+          grid-template-columns: repeat(3, 1fr);
+          gap: 8px;
           margin-bottom: 12px;
-          padding-bottom: 10px;
-          border-bottom: 1px solid rgba(16, 185, 129, 0.2);
-        }
-
-        .identity {
-          display: flex;
-          align-items: center;
-          gap: 10px;
         }
 
-        .logo-mark {
-          width: 32px;
-          height: 32px;
+        .metric-card {
+          background: rgba(4, 47, 34, 0.7);
+          border: 1px solid rgba(16, 185, 129, 0.25);
           border-radius: 8px;
-          background: linear-gradient(135deg, #047857 0%, #064e3b 100%);
-          border: 1px solid #10b981;
-          display: flex;
-          align-items: center;
-          justify-content: center;
-          flex-shrink: 0;
-        }
-
-        .title-block {
+          padding: 8px 10px;
           display: flex;
           flex-direction: column;
+          gap: 2px;
         }
 
-        .name {
-          font-size: 15px;
-          font-weight: 800;
-          letter-spacing: -0.01em;
-          color: #ffffff;
-          line-height: 1.2;
-        }
-
-        .tagline {
-          font-size: 11px;
-          color: #6ee7b7;
-          font-family: 'JetBrains Mono', monospace;
-        }
-
-        .badge-enclave {
+        .metric-label {
           font-family: 'JetBrains Mono', monospace;
-          font-size: 10px;
+          font-size: 9px;
           font-weight: 700;
+          color: #6ee7b7;
           letter-spacing: 0.05em;
           text-transform: uppercase;
-          background: rgba(16, 185, 129, 0.15);
-          color: #34d399;
-          border: 1px solid rgba(16, 185, 129, 0.4);
-          padding: 3px 8px;
-          border-radius: 6px;
-        }
-
-        /* Biometric Enclave Telemetry Deck */
-        .enclave-deck {
-          display: flex;
-          align-items: center;
-          justify-content: space-between;
-          gap: 12px;
-          background: rgba(4, 47, 34, 0.6);
-          border: 1px solid rgba(16, 185, 129, 0.25);
-          border-radius: 10px;
-          padding: 10px 14px;
-          margin-bottom: 12px;
-        }
-
-        .enclave-info {
-          display: flex;
-          flex-direction: column;
-          gap: 3px;
-          flex: 1;
         }
 
-        .enclave-title {
-          font-size: 13.5px;
+        .metric-value {
+          font-size: 13px;
           font-weight: 700;
-          color: #a7f3d0;
-          letter-spacing: 0.02em;
-        }
-
-        .enclave-status {
+          color: #ffffff;
           font-family: 'JetBrains Mono', monospace;
-          font-size: 10px;
-          color: #6ee7b7;
-        }
-
-        .canvas-container {
-          width: 50px;
-          height: 50px;
-          display: flex;
-          align-items: center;
-          justify-content: center;
+          overflow: hidden;
+          text-overflow: ellipsis;
+          white-space: nowrap;
         }
 
         /* Action Buttons Grid (>=44px touch targets) */
@@ -184,7 +173,7 @@ export class AuthCard extends HTMLElement {
           align-items: center;
           justify-content: center;
           text-align: center;
-          padding: 4px 6px;
+          padding: 6px;
           transition: all 0.15s ease;
         }
 
@@ -194,78 +183,130 @@ export class AuthCard extends HTMLElement {
           color: #ffffff;
         }
 
-        .btn-action.btn-passkey {
+        .btn-action:active {
+          transform: scale(0.98);
+        }
+
+        .btn-action.btn-primary {
           background: rgba(16, 185, 129, 0.18);
           border-color: #10b981;
           color: #34d399;
         }
 
-        .btn-action.btn-passkey:hover {
+        .btn-action.btn-primary:hover {
           background: #10b981;
           color: #021a12;
         }
 
-        /* Terminal Readout */
-        .terminal-readout {
+        /* Terminal Deck */
+        .terminal-container {
+          position: relative;
           background: #01110b;
           border: 1px solid rgba(16, 185, 129, 0.2);
           border-radius: 8px;
-          padding: 8px 12px;
+          padding: 8px 10px;
+        }
+
+        .terminal-header {
+          display: flex;
+          justify-content: space-between;
+          align-items: center;
+          margin-bottom: 4px;
+          padding-bottom: 4px;
+          border-bottom: 1px solid rgba(16, 185, 129, 0.1);
+        }
+
+        .terminal-label {
+          font-family: 'JetBrains Mono', monospace;
+          font-size: 9px;
+          color: #6ee7b7;
+          text-transform: uppercase;
+          letter-spacing: 0.05em;
+        }
+
+        .terminal-copy {
+          background: none;
+          border: none;
+          color: #34d399;
+          font-family: 'JetBrains Mono', monospace;
+          font-size: 10px;
+          cursor: pointer;
+          padding: 2px 4px;
+          border-radius: 4px;
+        }
+
+        .terminal-copy:hover {
+          background: rgba(16, 185, 129, 0.2);
+        }
+
+        .terminal-readout {
           font-family: 'JetBrains Mono', monospace;
           font-size: 11px;
           line-height: 1.4;
           color: #34d399;
-          min-height: 42px;
-          max-height: 100px;
+          min-height: 48px;
+          max-height: 120px;
           overflow-y: auto;
           white-space: pre-wrap;
           word-break: break-all;
         }
       </style>
 
-      <!-- Commercial Brand Identity (Rendered once) -->
-      <div class="brand-bar">
-        <div class="identity">
-          <div class="logo-mark">
-            <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="#34d399" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-              <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path>
-            </svg>
-          </div>
-          <div class="title-block">
-            <span class="name">Auth & Secrets</span>
-            <span class="tagline">Biometric FIDO2 Passkeys</span>
-          </div>
+      <!-- Live Telemetry Deck -->
+      <div class="telemetry-row">
+        <div class="metric-card">
+          <span class="metric-label">Passkeys</span>
+          <span class="metric-value" id="stat-passkeys">${this.telemetry.passkeys}</span>
         </div>
-        <span class="badge-enclave">AUTH</span>
-      </div>
-
-      <!-- Biometric Enclave Deck -->
-      <div class="enclave-deck">
-        <div class="enclave-info">
-          <span class="enclave-title">WebAuthn Security Keys</span>
-          <span class="enclave-status">Review registered credentials and authentication settings</span>
+        <div class="metric-card">
+          <span class="metric-label">OAuth</span>
+          <span class="metric-value" id="stat-oauth">${this.telemetry.oauth}</span>
+        </div>
+        <div class="metric-card">
+          <span class="metric-label">Enclave</span>
+          <span class="metric-value" id="stat-enclave">${this.telemetry.status}</span>
         </div>
-
       </div>
 
       <!-- Touch-First Actions (>=44px touch targets) -->
       <div class="actions-grid">
-        <button class="btn-action btn-passkey" data-cmd="passkey">PASSKEYS</button>
+        <button class="btn-action btn-primary" data-cmd="audit">AUDIT</button>
+        <button class="btn-action" data-cmd="passkey">PASSKEYS</button>
         <button class="btn-action" data-cmd="session">SESSIONS</button>
-        <button class="btn-action" data-cmd="status">STATUS</button>
+        <button class="btn-action" data-cmd="google">GOOGLE</button>
+        <button class="btn-action" data-cmd="key">API KEYS</button>
+        <button class="btn-action" data-cmd="rotate">ROTATE</button>
       </div>
 
-      <!-- Live Terminal Output -->
-      <div class="terminal-readout" id="card-out">Not checked. Select an action to retrieve current auth information.</div>
+      <!-- Live Output Console -->
+      <div class="terminal-container">
+        <div class="terminal-header">
+          <span class="terminal-label">Enclave Console</span>
+          <button class="terminal-copy" id="btn-copy" title="Copy console output">Copy</button>
+        </div>
+        <div class="terminal-readout" id="card-out">Authenticating enclave... Ready for operations.</div>
+      </div>
     `;
 
     const buttons = root.querySelectorAll('.btn-action');
     buttons.forEach(btn => {
       btn.addEventListener('click', () => {
         const cmd = btn.getAttribute('data-cmd');
-        this.execute(cmd, []);
+        if (cmd) this.execute(cmd, []);
       });
     });
+
+    const copyBtn = root.querySelector('#btn-copy');
+    if (copyBtn) {
+      copyBtn.addEventListener('click', () => {
+        const out = root.querySelector('#card-out');
+        if (out && out.textContent) {
+          navigator.clipboard?.writeText(out.textContent);
+          copyBtn.textContent = 'Copied!';
+          setTimeout(() => { copyBtn.textContent = 'Copy'; }, 1500);
+        }
+      });
+    }
   }
 }
 

package/scaffold/.agent/skills/total-recall/plugins/cli-agents/README.md

@@ -0,0 +1,65 @@
+# Command Fleet
+
+All nine adapters share one plugin: Claude Code, Codex, Antigravity, Cursor,
+DSH, Grok, Muse, Pi and Hermes. `runtime <agent> ...` exposes their native runtime
+commands; DSH observations and Hermes gateway management live here as well.
+
+`total-recall cli-agents setup` connects all nine native instruction surfaces.
+The declared setup operation also runs during daemon-owned plugin refresh.
+Every dispatched agent receives a freshly checked Total Recall context, complete
+core help, installed plugin operations and composed commands. Setup failure or
+an unready context stops dispatch.
+
+`docs-refresh`, `docs-ensure`, `docs-status`, `docs-read` and `docs-search` manage
+downloaded official documentation rather than a list of links. Content is hashed,
+bounded and refreshed after 24 hours. Maintenance uses the existing Total Recall
+daemon's plugin task, refreshing one stale adapter per run. Failed pages remain
+visible as failures and cannot certify complete coverage; successful cached
+content remains readable. `setup --node <recorded-node>` selects maintenance
+placement without creating a second scheduler.
+
+Standalone Total Recall owner for CLI-agent discovery and explicit mesh command execution. Install with `total-recall plugin install <path-or-private-git-url>`. Installation rebuilds the plugin inventory, CLI library and connected instruction surfaces. No model account is created or selected automatically.
+
+```sh
+total-recall cli-agents catalog --json
+total-recall cli-agents nodes --json
+total-recall cli-agents inspect --node <recorded-node> --json
+total-recall cli-agents run-command --stdin --json < request.json
+```
+
+`request.json` selects one installed plugin operation, its literal arguments, a node and an agent:
+
+```json
+{
+  "pluginId": "git-sentinel",
+  "subcommand": "status",
+  "args": [],
+  "execution": {
+    "agent": "codex",
+    "node": "local",
+    "permissions": { "read": true, "write": false, "send": false, "destructive": false }
+  }
+}
+```
+
+For remote nodes, supply `execution.cwd` as an explicit absolute workspace. `agent: "direct"` runs the actual installed Total Recall CLI without a model. Remote access comes from recorded mesh entities and verified SSH configuration; unavailable nodes or binaries produce errors. Secrets are never accepted in an agent prompt. Existing account metadata is inspected without printing credentials or substituting provider API keys.
+
+The four permissions are strict boolean **command-effect admission controls**. They allow or deny the selected plugin command before dispatch. They are not a network policy or an OS sandbox for every action a model might propose. Supported adapter write modes are scoped through the vendor CLI; vendor approval and sandbox defaults stay enabled. The host's authenticated authorization still applies.
+
+A completed model turn is distinct from a completed plugin operation. Structured results return `commandExecutionVerified: false` for agent turns; only direct CLI execution returns a command exit receipt. Muse preserves its actual headless JSONL log and documented process exit status rather than treating session-protocol notifications as headless output. Do not infer working accounts, provider delivery or successful mutations from discovery or fixture tests.
+
+## Primary contracts checked 2026-10-14
+
+| Adapter | Contract |
+| --- | --- |
+| Claude Code | [Headless](https://code.claude.com/docs/en/headless) |
+| Codex | [Non-interactive mode](https://developers.openai.com/codex/noninteractive) |
+| Antigravity | [Headless CLI](https://antigravity.google/docs/cli/headless/) |
+| Cursor | [CLI parameters](https://docs.cursor.com/en/cli/reference/parameters) |
+| DSH | [Official CLI source](https://github.com/deepseek-ai/deepseek-harness/blob/master/apps/cli/README.md) |
+| Grok | [Headless scripting](https://docs.x.ai/build/cli/headless-scripting) |
+| Muse | [Headless and CI](https://dev.meta.ai/docs/muse-code/extending) |
+| Pi | [Official CLI reference](https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/cli.md) |
+| Hermes | [Official command reference](https://github.com/NousResearch/hermes-agent/blob/main/website/docs/reference/cli-commands.md) |
+
+Cursor discovery uses `cursor-agent`; an ambiguous `agent` binary is not assumed to be Cursor. Missing installations are listed as unavailable. Unknown authentication requires explicit agent selection and remains unverified until a real run. Tests exercise literal stdin, bounded child-process cleanup, command admission, recorded SSH access, account checks and completed-result parsing. Run suites on the configured sanctioned test node.

package/scaffold/.agent/skills/total-recall/plugins/cli-agents/cli.mjs

@@ -0,0 +1,76 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { ADAPTERS, inspectAgents } from './src/worker.mjs';
+import { inspectNode, listTargets, executeCommand, executeOnNode } from './src/executor.mjs';
+import { DOC_SOURCES, documentationStatus, refreshDocumentation, ensureDocumentation, maintainDocumentation, readDocumentation, searchDocumentation } from './src/documentation.mjs';
+import { manageRuntime } from './src/runtime.mjs';
+import { setupIntegrations } from './src/setup.mjs';
+
+export async function run(argv = []) {
+  const args = argv.slice(3); const operation = args[0] || 'status';
+  if (['--help', '-h', 'help'].includes(operation)) {
+    const manifest=JSON.parse(fs.readFileSync(new URL('./plugin.json',import.meta.url),'utf8'));
+    console.log('Usage: total-recall cli-agents <operation> [options]\nEvery agent receives Total Recall bootstrap before dispatch. Runtime syntax: runtime <agent> <native-command...> [--node ID].\n');
+    for(const command of manifest.cli.subcommands)console.log(`  ${command.name} ${(command.args || []).map(arg=>arg.flag?`${arg.flag} <${arg.name}>`:`<${arg.name}>`).join(' ')} — ${command.description}`);
+    return;
+  }
+  let result;
+  if (operation === 'status') result = {...await inspectAgents(),documentation:documentationStatus()};
+  else if (operation === 'catalog') result = { adapters: ADAPTERS, permissions: ['read', 'write', 'send', 'destructive'] };
+  else if (operation === 'nodes') result = await listTargets();
+  else if(operation==='docs-sources')result={sources:DOC_SOURCES};
+  else if(operation==='docs-read' || operation==='docs-search') {
+    const option=name=>{const i=args.indexOf(name);if(i<0)return undefined;if(!args[i+1] || args[i+1].startsWith('--'))throw new Error(`${name} requires a value`);return args[i+1];};
+    result=operation==='docs-read'?readDocumentation({agent:option('--agent'),url:option('--url')}):searchDocumentation({agent:option('--agent'),query:option('--query')});
+  }
+  else if(operation==='setup') {
+    const index=args.indexOf('--node');
+    if(index>=0 && (!args[index+1] || args[index+1].startsWith('-')))throw new Error('--node requires a recorded node');
+    result=await setupIntegrations({node:index>=0?args[index+1]:undefined});
+  }
+  else if (['docs-status','docs-refresh','docs-ensure','maintenance'].includes(operation)) {
+    const selected = args.indexOf('--agent');
+    if (selected>=0 && (!args[selected+1] || args[selected+1].startsWith('-'))) throw new Error('--agent requires an adapter identifier');
+    const options = selected>=0 ? {agent:args[selected+1]} : {};
+    if(operation==='maintenance') {
+      const setup=await setupIntegrations();
+      result={...await maintainDocumentation(options),setup};
+    } else result = operation==='docs-status' ? documentationStatus(options) : operation==='docs-ensure' ? await ensureDocumentation(options) : await refreshDocumentation(options);
+    if(!result.ok)process.exitCode=1;
+  }
+  else if (operation === 'runtime') {
+    const runtimeArgs=args.slice(1).filter(arg=>arg!=='--json'), agent=runtimeArgs.shift();
+    const index=runtimeArgs.indexOf('--node'); let node='local';
+    if(index>=0){node=runtimeArgs[index+1];if(!node || node.startsWith('-'))throw new Error('--node requires an identifier');runtimeArgs.splice(index,2);}
+    result = node==='local' ? await manageRuntime(agent,runtimeArgs) : await executeOnNode(node,{operation:'direct',cwd:process.cwd(),argv:['total-recall','cli-agents','runtime',agent,...runtimeArgs,'--json']});
+    if(!result.ok)process.exitCode=1;
+  }
+  else if(operation==='dispatch') {
+    if(!args.includes('--stdin'))throw new Error('Task requests must arrive through stdin');
+    const input=fs.readFileSync(0,'utf8');if(Buffer.byteLength(input)>65536)throw new Error('Task request too large');
+    const request=JSON.parse(input);
+    result=await executeOnNode(request.node || 'local',{...request,operation:'dispatch'});
+    if(!result.ok)process.exitCode=1;
+  }
+  else if (operation === 'inspect') {
+    const index = args.indexOf('--node');
+    if (index >= 0 && (!args[index + 1] || args[index + 1].startsWith('--'))) throw new Error('--node requires a recorded node identifier');
+    result = await inspectNode(index >= 0 ? args[index + 1] : 'local');
+  }
+  else if (operation === 'run-command') {
+    if (!args.includes('--stdin')) throw new Error('Supply the command request through stdin');
+    const input = fs.readFileSync(0, 'utf8'); if (Buffer.byteLength(input) > 65536) throw new Error('Command request is too large');
+    const request = JSON.parse(input);
+    const root = process.env.TR_PACKAGE_ROOT;
+    if (!root) throw new Error('Native host context required');
+    if (!path.isAbsolute(root)) throw new Error('Absolute native host context required');
+    if (JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).name !== 'total-recall-brain') throw new Error('Native host identity mismatch');
+    const { getPlugin } = await import(pathToFileURL(path.join(root, 'src/core/plugin-loader.mjs')));
+    const plugin = getPlugin(request.pluginId, request.projectRoot || process.cwd());
+    result = await executeCommand({ ...request, plugin });
+    if (!result.ok) process.exitCode = 1;
+  } else throw new Error('Unknown CLI-agents operation');
+  console.log(JSON.stringify(result));
+}
+export default run;

package/scaffold/.agent/skills/total-recall/plugins/cli-agents/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "tr-plugin-cli-agents",
+  "version": "0.2.0",
+  "type": "module",
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "files": [
+    "cli.mjs",
+    "plugin.json",
+    "README.md",
+    "src/",
+    "!src/**/*.spec.mjs",
+    "ui/"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}