total-recall-brain 3.40.1 → 3.40.3

package/src/core/required-plugins.mjs

@@ -0,0 +1,46 @@
+/** Required native capability installation checks; never opens credential state. */
+import fs from 'node:fs';
+import path from 'node:path';
+import { readPluginsDir, PACKAGE_ROOT, resolvePluginFile } from './plugin-loader.mjs';
+import { DEFAULT_PLUGIN_IDS } from './default-plugins.mjs';
+import { preparePluginDependencies } from './plugin-dependencies.mjs';
+
+export function inspectRequiredPlugins(brainDir) {
+  const plugins = readPluginsDir(path.join(brainDir, 'plugins'), 'required');
+  const errors = [];
+  const auth = plugins.find(plugin => plugin.id === 'auth');
+  if (!auth?.valid) errors.push('Required auth plugin is missing or invalid');
+  else {
+    if (auth.manifest.cli?.command !== 'auth') errors.push('Required auth namespace is missing');
+    for (const name of ['commands', 'secrets-store', 'runtime-credentials']) {
+      const file = auth.manifest.runtime?.modules?.[name];
+      if (!file) errors.push(`Required auth runtime module ${name} is missing`);
+    }
+    const files = [auth.manifest.cli?.handler, ...Object.values(auth.manifest.runtime?.modules || {})];
+    for (const file of files) {
+      try {
+        if (!file || !fs.statSync(resolvePluginFile(auth.dir, file)).isFile()) throw new Error();
+      } catch { errors.push(`Required auth file is missing or unsafe: ${file || 'CLI handler'}`); }
+    }
+  }
+  return { status: errors.length ? 'failed' : 'ready', errors };
+}
+
+export function ensureRequiredPlugins(brainDir, { sourceDir = path.join(PACKAGE_ROOT, 'scaffold', '.agent', 'skills', 'total-recall', 'plugins') } = {}) {
+  // Validate the complete package before changing any installation.
+  for (const id of DEFAULT_PLUGIN_IDS) {
+    if (!fs.existsSync(path.join(sourceDir, id, 'plugin.json'))) throw new Error(`Required bundled ${id} plugin is missing`);
+  }
+  for (const id of DEFAULT_PLUGIN_IDS) {
+  const target = path.join(brainDir, 'plugins', id);
+  if (!fs.existsSync(target)) {
+    const source = path.join(sourceDir, id);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.cpSync(source, target, { recursive: true, force: false, errorOnExist: true });
+  }
+  preparePluginDependencies(target);
+  }
+  const report = inspectRequiredPlugins(brainDir);
+  if (report.status !== 'ready') throw new Error(report.errors.join('; '));
+  return report;
+}

package/src/core/scaffold-plugins.mjs

@@ -10,6 +10,7 @@ import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { isBrainState } from './brain-state.mjs';
+import { discoverPlugins } from './plugin-loader.mjs';
 
 export const TEST_PATTERNS = [/^test\//, /^tests\//, /(^|\/)[^/]+\.(spec|test)\.[cm]?[jt]sx?$/, /^vitest\.config\.[cm]?[jt]s$/];
 
@@ -35,6 +36,15 @@ export function releaseFiles(pluginDir, run = spawnSync) {
 }
 
 const digest = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+function releaseContent(file,rel) {
+  const raw=fs.readFileSync(file);
+  if(rel!=='package.json')return raw;
+  const pkg=JSON.parse(raw);
+  // Runtime bundles exclude tests and development installs; do not install a
+  // complete extra host package merely to satisfy a stripped test dependency.
+  delete pkg.devDependencies;
+  return Buffer.from(JSON.stringify(pkg,null,2)+'\n');
+}
 
 /** Compare (and with write:true, update) the scaffold copies and the pin. */
 export function syncScaffoldPlugins({ root, ids, write = false, run = spawnSync }) {
@@ -43,7 +53,10 @@ export function syncScaffoldPlugins({ root, ids, write = false, run = spawnSync
   const changes = [];
   // Validate every owner before copying any source or replacing the release pin.
   const plans = ids.map(id => {
-    const source = fs.realpathSync(path.join(root, '.agent', 'skills', 'total-recall', 'plugins', id));
+    const local = path.join(root, '.agent', 'skills', 'total-recall', 'plugins', id);
+    const selected = fs.existsSync(local) ? local : discoverPlugins(root).find(plugin => plugin.id === id && plugin.valid)?.dir;
+    if (!selected) throw new Error(`Required default plugin ${id} is not installed`);
+    const source = fs.realpathSync(selected);
     const files = releaseFiles(source, run);
     return { id, source, files };
   });
@@ -52,11 +65,12 @@ export function syncScaffoldPlugins({ root, ids, write = false, run = spawnSync
     for (const rel of files) {
       const from = path.join(source, rel);
       const to = path.join(target, rel);
-      const sha = digest(from);
+      const content=releaseContent(from,rel);
+      const sha = crypto.createHash('sha256').update(content).digest('hex');
       lock[`${id}/${rel}`] = sha;
       if (!fs.existsSync(to)) changes.push({ file: `${id}/${rel}`, change: 'added' });
       else if (digest(to) !== sha) changes.push({ file: `${id}/${rel}`, change: 'updated' });
-      if (write) { fs.mkdirSync(path.dirname(to), { recursive: true }); fs.copyFileSync(from, to); }
+      if (write) { fs.mkdirSync(path.dirname(to), { recursive: true }); fs.writeFileSync(to,content); }
     }
     const keep = new Set(files);
     const walk = (dir) => {

package/src/core/source-brain-updates.mjs

@@ -0,0 +1,47 @@
+/** Fast-forward a clean source-linked CLI to the registry's exact release commit. */
+import fs from 'node:fs';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {listUpdateRoots} from './package-auto-update.mjs';
+import {PACKAGE_ROOT} from './plugin-loader.mjs';
+import {comparePackageVersions} from './package-version.mjs';
+
+export function updateSourceBrainPackages({brainDir,versions,roots,update=updateSourceBrainPackage}={}) {
+  const results=[];
+  for(const directory of new Set(roots || [PACKAGE_ROOT,...listUpdateRoots({brainDir}).map(item=>item.root)])) {
+    if(!fs.existsSync(path.join(directory,'.git')))continue;
+    let pkg;try{pkg=JSON.parse(fs.readFileSync(path.join(directory,'package.json'),'utf8'));}catch{continue;}
+    if(!Object.hasOwn(versions,pkg.name))continue;
+    const latest=versions[pkg.name],row={root:directory,package:pkg.name,installed:pkg.version,latest,status:'up_to_date'};results.push(row);
+    if(pkg.version===latest)continue;
+    if(comparePackageVersions(pkg.version,latest)===1){row.status='failed';row.error='Newer source preview; refusing implicit downgrade';continue;}
+    const result=update({directory,name:pkg.name,version:latest});
+    row.status=result.ok?'updated':'failed';
+    if(result.ok){row.installed=result.installed;row.commit=result.commit;}else row.error=result.error;
+  }
+  return {failed:results.filter(row=>row.status==='failed').length,results};
+}
+
+export function updateSourceBrainPackage({directory,name,version,exec=spawnSync}={}) {
+  const run=(binary,args,timeout=30000)=>{
+    const result=exec(binary,args,{cwd:directory,encoding:'utf8',timeout,maxBuffer:8*1024*1024});
+    if(result.status!==0)throw new Error(result.error?.message || result.stderr?.trim().slice(-1000) || `${binary} failed`);
+    return result.stdout?.trim() || '';
+  };
+  const read=()=>JSON.parse(fs.readFileSync(path.join(directory,'package.json'),'utf8'));
+  try {
+    if(read().name!==name)throw new Error('Source package identity mismatch');
+    if(run('git',['status','--porcelain']))throw new Error('Source checkout has uncommitted changes');
+    const commit=JSON.parse(run('npm',['view',`${name}@${version}`,'gitHead','--json']));
+    if(!/^[a-f0-9]{40}$/.test(commit))throw new Error('Published package has no verified source commit');
+    const remote=run('git',['remote','get-url','origin']);
+    if(!remote.startsWith('https://'))throw new Error('Source update requires an HTTPS origin');
+    run('git',['fetch','origin',commit],120000);
+    const candidate=JSON.parse(run('git',['show',`${commit}:package.json`]));
+    if(candidate.name!==name || candidate.version!==version)throw new Error('Published source commit does not match the package version');
+    run('git',['merge','--ff-only',commit]);
+    run('npm',['ci','--no-audit','--no-fund'],600000);
+    if(read().version!==version || run('git',['rev-parse','HEAD'])!==commit)throw new Error('Source release readback failed');
+    return {ok:true,installed:version,commit};
+  }catch(error){return {ok:false,error:error.message};}
+}

package/src/core/startup-health.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { readProcessCommand } from './pid-lock.mjs';
+import { CLI_COMMANDS } from './cli-commands.mjs';
 
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 export const cliEntry = path.join(packageRoot, 'bin/total-recall.mjs');
@@ -63,8 +64,7 @@ export function appVerdict(result) {
 }
 
 function projectCommand(cwd, name) {
-  const dispatcher = fs.readFileSync(cliEntry, 'utf8').match(/^const COMMANDS = \{([\s\S]*?)^\};/m)?.[1] || '';
-  const reserved = new Set([...dispatcher.matchAll(/^\s+'?([a-z][a-z0-9-]*)'?\s*:/gm)].map(m => m[1]));
+  const reserved = new Set(Object.keys(CLI_COMMANDS));
   if (reserved.has(name) || !/^[a-z][a-z0-9-]{0,63}$/.test(name || '')) return false;
   const file = path.join(cwd, '.agent', 'commands', name + '.mjs');
   try { return fs.statSync(file).isFile() && fs.realpathSync(file).startsWith(fs.realpathSync(cwd) + path.sep) ? file : false; } catch { return false; }
@@ -167,7 +167,9 @@ export async function startupHealth({ cwd = process.cwd(), brainDir, brainUrl =
       }
     }
   }
-  report.shared_ready = report.server.status === 'ready' && report.brain.status === 'ready' && report.daemon.status === 'running' && report.ssss.status === 'available';
+  const { inspectRequiredPlugins } = await import('./required-plugins.mjs');
+  report.required_plugins = inspectRequiredPlugins(brainDir);
+  report.shared_ready = report.required_plugins.status === 'ready' && report.server.status === 'ready' && report.brain.status === 'ready' && report.daemon.status === 'running' && report.ssss.status === 'available';
   report.ready_scope = appCheck ? 'shared-and-declared-current-repo-app' : 'shared-runtime-only';
   report.ready = report.shared_ready && (!appCheck || report.app.status === 'ready');
   return report;

package/src/core/surface.mjs

@@ -20,6 +20,7 @@ import { selectRules, assembleContext, curatedRules } from './context-policy.mjs
 import { discoverPlugins } from './plugin-loader.mjs';
 import { refreshPluginCatalog } from './plugin-catalog.mjs';
 import { pluginActivation } from './plugin-state.mjs';
+import { CLI_QUICK_REFERENCE } from './cli-quick-reference.mjs';
 
 // Long-lived processes (server, daemon, vault watcher) import this module once.
 // If the rule builder is edited or upgraded after they start, their in-memory
@@ -343,7 +344,7 @@ export function readRuleBudgets(skillsDir) {
   return out;
 }
 
-const DEFAULT_CONTEXT_BUDGET = { total_tokens: 4000, bootstrap_total_tokens: 2500 };
+const DEFAULT_CONTEXT_BUDGET = { total_tokens: 4000, bootstrap_total_tokens: 16000 };
 
 /**
  * Instruction-surface token budget from surface.yml files and the environment.
@@ -396,7 +397,9 @@ export function buildInstalledPluginsSummary(projectRoot = process.cwd()) {
     for (const p of plugins) {
       const cmd = p.manifest.cli?.command || p.id;
       const desc = (p.manifest.description || 'Plugin capability').replace(/\s+/g, ' ').slice(0, 30).trimEnd();
-      lines.push(`- **${p.id}** v${p.manifest.version || 'unknown'} · ${pluginActivation(p).state} · \`${cmd}\` · ${p.manifest.cli?.subcommands?.length || 0} operations: ${desc}`);
+      const ops = (p.manifest.cli?.subcommands || []).map(sub => sub.name).filter(Boolean);
+      const shown = ops.join(' | ');
+      lines.push(`- **${p.id}** v${p.manifest.version || 'unknown'} · ${pluginActivation(p).state} · \`total-recall ${cmd}\` ${shown ? `[${shown}]` : '(no operations)'}: ${desc}`);
     }
     return lines.join('\n') + '\n';
   } catch {
@@ -413,7 +416,8 @@ export async function buildRulesBlock(skillsDir, nodes = [], {
   const rules = selectRules(curatedRules(nodes), { actions, projectRoot: root, bootstrap });
   const contributions = [];
   const counts = category => rules.filter(n => n.category === category).length;
-  const header = bootstrap ? `# 🔴 MANDATORY FIRST STEP: TOTAL RECALL CLI & TASK ROUTING
+  const commands = buildCommandsSection(listSurfaceCommands(commandDirsFor(skillsDir)));
+  const header = bootstrap ? `${CLI_QUICK_REFERENCE}\n${buildInstalledPluginsSummary(root)}\n${commands}\n# 🔴 MANDATORY FIRST STEP: TOTAL RECALL CLI & TASK ROUTING
 
 1. RUN TOTAL RECALL CLI HELP FIRST:
 \`total-recall --help\`
@@ -427,16 +431,17 @@ Read the complete returned capsule and require ready:true. Unknown rule applicab
 Total Recall is the agent's working memory, toolset, and single source of truth across all decisions. Refresh at every changed task, action or project, and after a memory/skill edit. Do not infer applicability from semantic similarity. CLI retrieval is local and works without the server. Skills have compact entrypoints; load only relevant references. Canonical vault writes use the validated CLI.
 
 DO NOT SKIP THIS. Run Total Recall CLI help and context first before doing anything else.
+
 ` :
     `## Active Rules: ${counts('invariants')} invariants, ${counts('preferences')} preferences, ${counts('anti-patterns')} corrections`;
   contributions.push({ id: 'routing', text: header, required: true });
-  for (const node of rules) contributions.push({ id: `${node._layer || 'project'}:${node.slug}`, required: true,
-    text: node._directive ? `[${node.slug}] ${node._directive}` : `### ${node.title || node.slug} [${node.slug}]\n\n${node.body || node.content || ''}` });
   const pluginsSummary = buildInstalledPluginsSummary(root);
-  if (pluginsSummary) {
+  if (pluginsSummary && !bootstrap) {
     contributions.push({ id: 'installed-plugins', text: pluginsSummary, required: true });
   }
-  contributions.push({ id: 'commands', text: buildCommandsSection(listSurfaceCommands(commandDirsFor(skillsDir))) });
+  for (const node of rules) contributions.push({ id: `${node._layer || 'project'}:${node.slug}`, required: true,
+    text: node._directive ? `[${node.slug}] ${node._directive}` : `### ${node.title || node.slug} [${node.slug}]\n\n${node.body || node.content || ''}` });
+  if (!bootstrap) contributions.push({ id: 'commands', text: commands });
   if (!bootstrap) {
     if (skillsDir) {
       contributions.push(...legacyRuleContributions(skillsDir));
@@ -460,7 +465,8 @@ function injectDirectives(fileContent, rulesBlock) {
   const endIdx = fileContent.indexOf(DIRECTIVES_END);
   
   if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
-    return fileContent.slice(0, beginIdx) + DIRECTIVES_BEGIN + '\n' + rulesBlock + '\n' + DIRECTIVES_END + fileContent.slice(endIdx + DIRECTIVES_END.length);
+    const authored = fileContent.slice(0, beginIdx) + fileContent.slice(endIdx + DIRECTIVES_END.length);
+    return prependDirectives(authored, rulesBlock);
   }
   
   let content = fileContent.trimEnd();
@@ -469,7 +475,15 @@ function injectDirectives(fileContent, rulesBlock) {
     content = baseline + '\n\n' + content;
   }
   
-  return content.trimEnd() + '\n\n' + DIRECTIVES_BEGIN + '\n' + rulesBlock + '\n' + DIRECTIVES_END + '\n';
+  return prependDirectives(content, rulesBlock);
+}
+
+function prependDirectives(authored, rulesBlock) {
+  // YAML metadata must remain first for clients that parse .mdc frontmatter.
+  const frontmatter = authored.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n/);
+  const prefix = frontmatter?.[0] || '';
+  const body = authored.slice(prefix.length).trim();
+  return `${prefix}${DIRECTIVES_BEGIN}\n${rulesBlock}\n${DIRECTIVES_END}\n\n${body}\n`;
 }
 
 /**
@@ -482,7 +496,7 @@ async function writeShim(shimPath, skillsDir, nodes = [], { vaultDir, derivedDir
   const mdcHeader = shimPath.endsWith('.mdc')
     ? '---\ndescription: "Total Recall — Auto-generated behavioral memory surface."\nglobs:\nalwaysApply: true\n---\n\n'
     : '';
-  const fullContent = `${mdcHeader}${baseline}\n${DIRECTIVES_BEGIN}\n${rulesBlock}\n${DIRECTIVES_END}\n`;
+  const fullContent = prependDirectives(`${mdcHeader}${baseline}`, rulesBlock);
 
   try {
     const stat = fs.lstatSync(shimPath, { throwIfNoEntry: false });
@@ -778,6 +792,25 @@ export async function compileSurface({ vaultDir, skillsDir, derivedDir, instruct
     semanticResult = { indexed: 0, skipped: nodes.length, unavailable: true, error: err.message };
   }
 
+  // 3b. Build or update the CLI semantic index.
+  let cliIndexResult = { built: 0, skipped: 0, failed: 0 };
+  try {
+    const { buildCliSemanticIndex } = await import('./cli-semantic-index.mjs');
+    const projectRoot = skillsDir ? path.dirname(path.dirname(skillsDir)) : process.cwd();
+    cliIndexResult = await buildCliSemanticIndex({
+      derivedDir,
+      skillsDir,
+      projectRoot,
+      force,
+      semantic: semantic && process.env.TR_EMBEDDINGS_DISABLED !== '1',
+    });
+    if (cliIndexResult.built > 0) {
+      logger.info('surface', `CLI semantic index: ${cliIndexResult.built} indexed, ${cliIndexResult.skipped} skipped.`, { derivedDir });
+    }
+  } catch (err) {
+    logger.warn('surface', `CLI semantic index build non-fatal warning: ${err.message}`, { derivedDir });
+  }
+
   // 4. Generate Obsidian Canvas
   try {
     generateCanvas(nodes, vaultDir);
@@ -841,6 +874,7 @@ function writeProjectionManifest(derivedDir, vaultHash) {
       { file: 'memory-layers.jsonl', disposable: true },
       { file: 'local-search.json', disposable: true },
       { file: 'embeddings.jsonl', disposable: true },
+      { file: 'cli-semantic-index.json', disposable: true },
       { file: 'vault-hash.txt', disposable: true }
     ],
     rebuild_command: 'npx total-recall compile'

package/src/server/routes/extension.mjs

@@ -8,18 +8,22 @@
 import { Router } from 'express';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { requireAuth, requireScope } from '../auth.mjs';
 import { BRAIN_DIR, serverError } from './_shared.mjs';
+import { issueKey } from '../keys.mjs';
 
 const router = Router();
 
 /**
  * GET /api/extension/download
- * Streams the Chrome extension directory as a .zip (or .tar.gz fallback).
+ * Streams the Chrome extension directory as a .zip (or .tar.gz fallback)
+ * with an automatically provisioned access token and brain URL baked into config.js/config.json.
  */
-router.get('/api/extension/download', requireAuth, requireScope('config:read'), async (_req, res) => {
+router.get('/api/extension/download', requireAuth, requireScope('config:read'), async (req, res) => {
+  let tmpDir = null;
   try {
     // Extension lives at <package-root>/extension/
     const extDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../extension');
@@ -27,31 +31,72 @@ router.get('/api/extension/download', requireAuth, requireScope('config:read'),
       return res.status(404).json({ error: 'Chrome extension not found in this installation.' });
     }
 
-    // Never inject PATs into packaged extension source. Pair from the extension
-    // options page so secrets stay in extension-local storage.
+    // Determine the brain URL from request headers/host
+    const proto = req.get('x-forwarded-proto') || req.protocol || 'http';
+    const host = req.get('x-forwarded-host') || req.get('host') || '127.0.0.1:3000';
+    const brainUrl = `${proto}://${host}`;
+
+    // Automatically issue a dedicated access token for this extension package
+    let token = '';
+    try {
+      const key = issueKey(`Chrome Extension (${host})`, { scopes: ['*'] });
+      token = (key && key.token) || '';
+    } catch {
+      token = '';
+    }
+
+    // Create a temporary staging directory so git working copy remains untouched
+    tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'tr-ext-'));
+    await fs.promises.cp(extDir, tmpDir, { recursive: true });
+
+    // Bake pre-configured credentials directly into config.js and config.json inside the package
+    const configData = {
+      brainUrl,
+      pat: token,
+      generatedAt: new Date().toISOString(),
+      activeBrainId: req.headers['x-total-recall-brain'] || 'global',
+    };
+
+    const configJsContent = `// Automatically generated by Total Recall Brain\nself.TOTAL_RECALL_CONFIG = ${JSON.stringify(configData, null, 2)};\n`;
+    await fs.promises.writeFile(path.join(tmpDir, 'config.js'), configJsContent, 'utf8');
+    await fs.promises.writeFile(path.join(tmpDir, 'config.json'), JSON.stringify(configData, null, 2), 'utf8');
 
     res.setHeader('Content-Type', 'application/zip');
     res.setHeader('Content-Disposition', 'attachment; filename="total-recall-extension.zip"');
 
+    const cleanup = () => {
+      if (tmpDir) {
+        fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+        tmpDir = null;
+      }
+    };
+
+    res.on('finish', cleanup);
+    res.on('close', cleanup);
+
     // Use zip if available, fall back to tar
     // Unit specs live beside the extension sources but are not part of the product.
-    const zip = spawn('zip', ['-r', '-', '.', '-x', '*.spec.mjs'], { cwd: extDir, stdio: ['ignore', 'pipe', 'ignore'] });
+    const zip = spawn('zip', ['-r', '-', '.', '-x', '*.spec.mjs'], { cwd: tmpDir, stdio: ['ignore', 'pipe', 'ignore'] });
     zip.stdout.pipe(res);
     zip.on('error', () => {
       // zip not available — try tar
       if (!res.headersSent) {
         res.setHeader('Content-Type', 'application/gzip');
         res.setHeader('Content-Disposition', 'attachment; filename="total-recall-extension.tar.gz"');
-        const tar = spawn('tar', ['czf', '-', '--exclude=*.spec.mjs', '-C', path.dirname(extDir), 'extension'], { stdio: ['ignore', 'pipe', 'ignore'] });
+        const tar = spawn('tar', ['czf', '-', '--exclude=*.spec.mjs', '-C', tmpDir, '.'], { stdio: ['ignore', 'pipe', 'ignore'] });
         tar.stdout.pipe(res);
-        tar.on('error', err => { if (!res.headersSent) serverError(res, err); });
-        tar.on('close', () => { if (!res.writableEnded) res.end(); });
+        tar.on('error', err => { cleanup(); if (!res.headersSent) serverError(res, err); });
+        tar.on('close', () => { cleanup(); if (!res.writableEnded) res.end(); });
       }
     });
     zip.on('close', code => {
+      cleanup();
       if (code !== 0 && !res.writableEnded) res.end();
     });
   } catch (err) {
+    if (tmpDir) {
+      fs.promises.rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+    }
     serverError(res, err);
   }
 });

package/templates/onboarding-interview.md

@@ -37,7 +37,7 @@ npx total-recall remember preference "..." --tags "user,profile,onboarding" --im
 
 6. **Background work** — "Want dream consolidation and optional daemon tasks running in the background, or on-demand only?"
 
-7. **Secrets** — "API keys never go in the vault. Use `npx total-recall secret set`. Any keys you want to set up next?"
+7. **Secrets** — "API keys never go in the vault. Use `npx total-recall auth secret set`. Any keys you want to set up next?"
 
 8. **Notifications (optional)** — "Want Telegram pings when background tasks finish? If yes, BotFather token + chat ID."