total-recall-brain 3.41.0 → 3.41.2

package/scaffold/.agent/skills/total-recall/plugins/auth/package.json

@@ -1,11 +1,11 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "White-label Total Recall auth plugin: Passkey biometric FIDO2 and Google OAuth2 authentication.",
   "type": "module",
   "main": "cli.mjs",
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs && vitest run test"
   },
   "keywords": [
     "total-recall-plugin",
@@ -28,10 +28,10 @@
     "plugin.json",
     "README.md",
     "src/",
-    "test/",
     "scripts/",
     "!src/**/*.spec.mjs",
-    "ui/"
+    "ui/",
+    "!src/**/*.test.mjs"
   ],
   "publishConfig": {
     "access": "public"

package/scaffold/.agent/skills/total-recall/plugins/auth/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "auth",
   "name": "Auth & Secrets",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Hardware WebAuthn biometric FIDO2 passkeys, OAuth session security, and access control.",
   "author": "Total Recall contributors",
   "license": "MIT",

package/scaffold/.agent/skills/total-recall/plugins/auth/src/cli-secret.mjs

@@ -15,6 +15,8 @@
 import {
   setSecret,
   getSecret,
+  secretValueFingerprint,
+  resolveSecretKey,
   listSecretsMeta,
   rotateSecret,
   deleteSecret,
@@ -55,9 +57,11 @@ import {
   removeRemoteTarget,
   deployEnvToRemote,
   deployKeyToRemotes,
+  verifyRemote,
+  importFromPm2,
 } from './secrets-remote-deploy.mjs';
 import { listProviders, getProvider } from './provider-catalog.mjs';
-import { resolveBrainDir, parseLayerFlag, detectProjectBrain } from './agent-dir.mjs';
+import { parseLayerFlag, detectProjectBrain } from './agent-dir.mjs';
 import { hostSecretsBrainDir } from './host-secrets-store.mjs';
 import fs from 'node:fs';
 import { ensureProjectId } from './project-id.mjs';
@@ -233,12 +237,21 @@ function printHelp() {
       list                 Show configured targets (no secret values)
       remove <name>        Delete a target
       deploy <name>        Push the SSOT projection to that target now
-                            [--dry-run] [--keys k1,k2]
+                            [--dry-run] [--keys k1,k2] [--path <repo>]
+      verify <name>        Compare the deployed file with the store by fingerprint
+                            (match/differs/missing/duplicate; no values) [--keys] [--path]
+      import-pm2 <name>    Move named keys from a pm2 app's captured env into the store
+                            --app <pm2 name> --keys k1,k2 [--apply] [--overwrite] [--repo r]
+    merge-store <dir>     Fold a stray per-repo store into this one (dry run unless --apply).
+                           Missing keys are imported, equal keys gain the binding, differing
+                           keys are conflicts: settle with --take K or --rename SRC=DEST
+      --repo <name>       Bind imported keys to this repo
+      --bind-same         Also bind keys whose value already matches (only for an app's own store)
+      --dates-from-source Restore an older value date for keys whose value is identical
     diff-env              Compare repo .env files against the store (no values printed)
       --path <dir>        Single repo (default: every project-registry path)
       --filename .env     File to compare (default .env; server/<name> also checked)
       --strict            Exit 1 on any drift or unadopted key
-      --layer project     Compare against the project-local store (default: global)
     import-env            Import selected local .env credentials into auth
       --all / --file / --overwrite / --dry-run
     catalog               Full catalog: keys, providers, usage, rotation, cost, tracking
@@ -258,6 +271,7 @@ function printHelp() {
       --shared-ok         Allow this key to share its value with other secret names
       --no-shared-ok
       --repo <name>       Bind to exactly ONE product repo (not multi)
+      --unbind <repo>     Remove a repo binding (comma separated for several)
       --repos <name>      Same as --repo (single name only; multi rejected)
       --tier <id>         Subscription tier
       --monthly-cost <n>  Planned monthly $ 
@@ -272,6 +286,10 @@ function printHelp() {
     --headscale-url <https-url>
     rotation-due          List keys overdue for rotation
       --enqueue           Create daemon tasks + browser-use prompts for each due key
+    fingerprint           Identify a credential without printing it: length, type
+                           prefix, fingerprint and the store keys holding the same
+                           value. --from-clipboard | --stdin; --expect-prefix <p>
+                           and --not <KEY> fail (exit 1) on a wrong value.
     rotate-browser <key>  Drive the provider console in TR's browser and rotate
       --print-only        Only print instructions
       --headless          Allow headless for verified recipes
@@ -379,7 +397,7 @@ function parseArgs(args) {
   let i = 1;
   if (out.command === 'remote') {
     if (args[i] && !args[i].startsWith('--')) out.subcommand = args[i++];
-    if (['add', 'remove', 'rm', 'deploy'].includes(out.subcommand) && args[i] && !args[i].startsWith('--')) {
+    if (['add', 'remove', 'rm', 'deploy', 'verify', 'import-pm2'].includes(out.subcommand) && args[i] && !args[i].startsWith('--')) {
       out.key = args[i++]; // reused as the remote target name
     }
   }
@@ -395,6 +413,7 @@ function parseArgs(args) {
       'rm',
       'generate',
       'account-sync',
+      'merge-store',
     ].includes(out.command) &&
     args[i] &&
     !args[i].startsWith('--')
@@ -458,6 +477,21 @@ function parseArgs(args) {
       case '--dry-run':
         out.dryRun = true;
         break;
+      case '--apply':
+        out.apply = true;
+        break;
+      case '--bind-same':
+        out.bindSame = true;
+        break;
+      case '--dates-from-source':
+        out.datesFromSource = true;
+        break;
+      case '--unbind':
+        out.unbind = (out.unbind || []).concat(String(args[++i] || '').split(',').map((v) => v.trim()).filter(Boolean));
+        break;
+      case '--take':
+        out.take = String(args[++i] || '').split(',').map((v) => v.trim()).filter(Boolean);
+        break;
       case '--overwrite':
         out.overwrite = true;
         break;
@@ -507,6 +541,9 @@ function parseArgs(args) {
       case '--label':
         out.label = args[++i];
         break;
+      case '--provides':
+        out.provides = args[++i];
+        break;
       case '--project':
         out.project = args[++i];
         break;
@@ -517,8 +554,7 @@ function parseArgs(args) {
         out.path = args[++i];
         break;
       case '--layer':
-        out.layer = args[++i];
-        break;
+        throw new Error('Secrets have one store; --layer does not apply');
       case '--all-projects':
         out.allProjects = true;
         break;
@@ -607,6 +643,15 @@ function parseArgs(args) {
       case '--stdin':
         out.stdin = true;
         break;
+      case '--app':
+        out.app = args[++i];
+        break;
+      case '--expect-prefix':
+        out.expectPrefix = args[++i];
+        break;
+      case '--not':
+        out.notKey = args[++i];
+        break;
       case '--launch-agent':
         out.launchAgents.push(args[++i]);
         break;
@@ -637,6 +682,21 @@ function parseArgs(args) {
   return out;
 }
 
+/** The host's single secrets store; TR_SECRETS_BRAIN is the only override (deploy/ops/tests). */
+export function secretsStoreDir() {
+  return hostSecretsBrainDir();
+}
+
+/** Name of the repo the command runs in (its project root's directory name), or null outside one. */
+function currentRepoName() {
+  try {
+    const project = detectProjectBrain(process.cwd());
+    return project ? path.basename(project.projectRoot || path.dirname(path.dirname(project.agentDir))) : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Id of the project the command runs in (created on first use), or null outside a project. */
 function currentProjectId() {
   try {
@@ -649,24 +709,30 @@ function currentProjectId() {
 
 export default async function secretCli(argv) {
   const { layer, remainingArgs } = parseLayerFlag(argv);
-  const opts = parseArgs(remainingArgs);
+  let opts;
+  try {
+    opts = parseArgs(remainingArgs);
+  } catch (err) {
+    console.error(`❌ ${err.message}`);
+    process.exit(1);
+  }
   if (opts.help || !opts.command) {
     printHelp();
     return;
   }
 
-  let brainDir;
-  try {
-    if (layer === 'project') throw new Error('Secrets have one host store; --project does not apply.');
-    brainDir = hostSecretsBrainDir();
-  } catch (err) {
-    console.error(`❌ ${err.message}`);
+  // One store per host. A project brain in the cwd never selects a different
+  // secrets.enc: that is how per-repo stores appeared and drifted from the real
+  // one. Repo binding lives in each key's metadata (`meta <key> --repo`).
+  if (layer === 'project') {
+    console.error('❌ Secrets have one store; --project does not apply. Bind a key to a repo with `auth secret meta <key> --repo <name>`.');
     process.exit(1);
   }
+  const brainDir = secretsStoreDir();
 
-  if (opts.stdin) {
+  if (opts.stdin && opts.command !== 'fingerprint') {
     if (!['set', 'rotate', 'rekey'].includes(opts.command)) {
-      console.error('❌ --stdin is only valid with `set`, `rotate`, or `rekey`');
+      console.error('❌ --stdin is only valid with `set`, `rotate`, `rekey`, or `fingerprint`');
       process.exit(1);
     }
     if (opts.command !== 'rekey' && !opts.key) {
@@ -776,7 +842,8 @@ export default async function secretCli(argv) {
         console.error('Usage: total-recall auth secret set <key> <value>');
         process.exit(1);
       }
-      await setSecret(brainDir, opts.key, opts.value, {
+      const setKey = await resolveSecretKey(brainDir, opts.key, currentRepoName());
+      await setSecret(brainDir, setKey, opts.value, {
         tags: opts.tags != null ? opts.tags : undefined,
         project_id: currentProjectId(),
         provider: opts.provider || inferProvider(opts.key),
@@ -793,7 +860,7 @@ export default async function secretCli(argv) {
         project_path: opts.project,
         headscale_url: opts.headscale_url,
       });
-      console.log(`\n  ✅ Secret set: ${opts.key}`);
+      console.log(`\n  ✅ Secret set: ${setKey}${setKey !== opts.key ? ` (provides ${opts.key} for this repo)` : ''}`);
       console.log(`     store: ${resolveSecretsPath(brainDir)}`);
       console.log(`     (value not printed)\n`);
       return;
@@ -1019,6 +1086,14 @@ export default async function secretCli(argv) {
       }
       const patch = {};
       if (opts.repos.length) patch.repos = opts.repos;
+      if (opts.unbind?.length) {
+        const row = (await listSecretsMeta(brainDir)).find((r) => r.key === opts.key);
+        if (!row) {
+          console.error(`❌ Secret not found: ${opts.key}`);
+          process.exit(1);
+        }
+        patch.repos = (patch.repos || row.repos || []).filter((r) => !opts.unbind.includes(r));
+      }
       if (opts.tier != null) patch.subscription_tier = opts.tier;
       if (opts.monthly_cost != null) patch.monthly_cost_usd = opts.monthly_cost;
       if (opts.monthly_cap != null) patch.monthly_cap_usd = opts.monthly_cap;
@@ -1028,6 +1103,7 @@ export default async function secretCli(argv) {
       if (opts.notes) patch.notes = opts.notes;
       if (opts.tags != null) patch.tags = opts.tags;
       if (opts.label) patch.label = opts.label;
+      if (opts.provides !== undefined) patch.provides = opts.provides;
       if (opts.project) patch.project_path = opts.project;
       if (opts.provider) patch.provider = opts.provider;
       if (opts.scope) patch.scope = opts.scope;
@@ -1081,7 +1157,8 @@ export default async function secretCli(argv) {
         process.exit(1);
       }
       const project_id = currentProjectId();
-      const r = await getSecret(brainDir, opts.key, { project_id });
+      const resolved = await resolveSecretKey(brainDir, opts.key, currentRepoName());
+      const r = await getSecret(brainDir, resolved, { project_id });
       if (opts.json) {
         console.log(JSON.stringify(r.found ? { found: true, value: r.value } : { found: false }));
         return;
@@ -1097,6 +1174,13 @@ export default async function secretCli(argv) {
 
     if (opts.command === 'list') {
       const rows = await listSecretsMeta(brainDir);
+      if (opts.json) {
+        // Metadata for monitoring: bindings, tags, provides, provider and
+        // verification. Never the value, its full hash or a masked preview.
+        const safe = rows.map(({ masked, fingerprint_full, value, ...row }) => row);
+        console.log(JSON.stringify({ store: resolveSecretsPath(brainDir), keys: safe }, null, 2));
+        return;
+      }
       if (!rows.length) {
         console.log(`\n  No secrets in ${resolveSecretsPath(brainDir)}\n`);
         return;
@@ -1125,6 +1209,33 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'fingerprint') {
+      // Identify a credential without seeing it: which store keys hold the same
+      // value, its length and its non-secret type prefix. Lets an operator check
+      // the clipboard holds the new key before `rotate --from-clipboard`.
+      const value = opts.fromClipboard ? readSystemClipboard() : opts.stdin ? readStdinValue() : '';
+      if (!value) {
+        console.error('Usage: total-recall auth secret fingerprint --from-clipboard|--stdin [--expect-prefix <p>] [--not <KEY>] [--json]');
+        process.exit(1);
+      }
+      const fp = secretValueFingerprint(value);
+      const matches = (await listSecretsMeta(brainDir)).filter((row) => row.fingerprint_full === fp).map((row) => row.key);
+      const prefix = (value.match(/^(?:(?:sk|rk|pk)_(?:live|test)_|whsec_|ghp_|github_pat_|npm_|dop_v1_|sk-or-v1-|sk-ant-|AIza|tr_)/) || [null])[0];
+      const r = { length: value.length, prefix, fingerprint: fp.slice(0, 12), whitespace: /\s/.test(value), store_matches: matches };
+      const problems = [];
+      if (opts.expectPrefix && !value.startsWith(opts.expectPrefix)) problems.push(`does not start with ${opts.expectPrefix}`);
+      if (opts.notKey && matches.includes(opts.notKey)) problems.push(`equals the current ${opts.notKey}`);
+      if (opts.json) console.log(JSON.stringify({ ...r, ok: !problems.length, problems }, null, 2));
+      else {
+        console.log(`\n  🔏 length ${r.length}  prefix ${r.prefix || '(none)'}  fingerprint ${r.fingerprint}${r.whitespace ? '  CONTAINS WHITESPACE' : ''}`);
+        console.log(`     store keys with this value: ${matches.join(', ') || 'none'}`);
+        for (const p of problems) console.log(`  ❌ ${p}`);
+        console.log('');
+      }
+      if (problems.length) process.exitCode = 1;
+      return;
+    }
+
     if (opts.command === 'remote') {
       if (!opts.subcommand) {
         console.error(
@@ -1132,7 +1243,9 @@ export default async function secretCli(argv) {
             '  add <name> --host <h> --path </remote/dir> [--user root] [--port 22] [--filename .env] [--restart-cmd "..."]\n' +
             '  list\n' +
             '  remove <name>\n' +
-            '  deploy <name> [--dry-run] [--keys k1,k2]',
+            '  deploy <name> [--dry-run] [--keys k1,k2] [--path <repo>]\n' +
+            '  verify <name> [--keys k1,k2] [--path <repo>] [--json]\n' +
+            '  import-pm2 <name> --app <pm2 name> --keys k1,k2 [--apply] [--overwrite] [--repo r] [--json]',
         );
         process.exit(1);
       }
@@ -1198,6 +1311,7 @@ export default async function secretCli(argv) {
           dryRun: opts.dryRun,
           keys: opts.keys.length ? opts.keys : undefined,
           rename: opts.rename,
+          projectPath: opts.path ? path.resolve(opts.path) : undefined,
         });
         if (r.dryRun) {
           console.log(`\n  📤 dry-run remote deploy → ${r.target} (${r.host})`);
@@ -1211,6 +1325,50 @@ export default async function secretCli(argv) {
         return;
       }
 
+      if (opts.subcommand === 'verify') {
+        if (!opts.key) {
+          console.error('Usage: total-recall auth secret remote verify <name> [--keys k1,k2] [--path <repo>] [--json]');
+          process.exit(1);
+        }
+        const r = await verifyRemote(brainDir, opts.key, {
+          keys: opts.keys.length ? opts.keys : undefined,
+          projectPath: opts.path ? path.resolve(opts.path) : undefined,
+        });
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else {
+          console.log(`\n  🔎 ${r.target} (${r.host}:${r.remoteFile})`);
+          for (const row of r.rows) {
+            const mark = row.status === 'match' && !row.duplicates ? '✅' : '❌';
+            console.log(`  ${mark} ${row.key.padEnd(36)} ${row.status}${row.duplicates ? ` (+${row.duplicates} duplicate)` : ''}`);
+          }
+          console.log(`     ${r.remoteOnly.length} key(s) on the remote are not in the projection`);
+          console.log(`     ${r.ok ? 'in sync' : 'DRIFT'} (values compared by fingerprint; none printed)\n`);
+        }
+        if (!r.ok) process.exitCode = 1;
+        return;
+      }
+
+      if (opts.subcommand === 'import-pm2') {
+        if (!opts.key || !opts.app || !opts.keys.length) {
+          console.error('Usage: total-recall auth secret remote import-pm2 <name> --app <pm2 name> --keys k1,k2 [--apply] [--overwrite] [--repo r] [--json]');
+          process.exit(1);
+        }
+        const r = await importFromPm2(brainDir, opts.key, {
+          app: opts.app,
+          keys: opts.keys,
+          apply: opts.apply,
+          overwrite: opts.overwrite,
+          repos: opts.repos,
+        });
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else {
+          console.log(`\n  📥 pm2 ${r.app} on ${r.target}${opts.apply ? '' : ' (dry run; add --apply to store)'}`);
+          for (const row of r.rows) console.log(`  • ${row.key.padEnd(36)} ${row.status}${row.applied ? ' → stored' : ''}`);
+          console.log('     (values read in-process; none printed)\n');
+        }
+        return;
+      }
+
       console.error(`Unknown remote subcommand: ${opts.subcommand}`);
       process.exit(1);
     }
@@ -1515,17 +1673,42 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'merge-store') {
+      if (!opts.key) {
+        console.error('❌ Usage: auth secret merge-store <source brain dir> [--repo <name>] [--tags a,b] [--rename SRC=DEST] [--take K1,K2] [--apply] [--json]');
+        process.exit(1);
+      }
+      const { mergeStore } = await import('./secrets-merge.mjs');
+      const report = await mergeStore(brainDir, path.resolve(opts.key), {
+        apply: opts.apply === true,
+        bindSame: opts.bindSame === true,
+        datesFromSource: opts.datesFromSource === true,
+        repo: opts.repos.length ? opts.repos : undefined,
+        tags: opts.tags,
+        rename: opts.rename,
+        take: opts.take,
+        actor: 'cli',
+      });
+      if (opts.json) {
+        console.log(JSON.stringify(report, null, 2));
+      } else {
+        console.log(`\n  merge-store ${report.applied ? 'applied' : 'dry run (add --apply to write)'} → ${resolveSecretsPath(brainDir)}`);
+        console.log(`  imported ${report.imported.length} · renamed ${report.renamed.length} · taken ${report.taken.length} · same ${report.same.length}${report.redated ? ` (${report.redated} redated)` : ''} · conflicts ${report.conflicts.length}`);
+        for (const c of report.conflicts) {
+          console.log(`  ⚠️  ${c.key}: target ${c.target.fingerprint} (updated ${c.target.updated_at || '?'}, ${c.target.tracking_status || 'unverified'}) vs source ${c.source.fingerprint} (updated ${c.source.updated_at || '?'}, ${c.source.tracking_status || 'unverified'})`);
+        }
+        console.log('');
+      }
+      if (report.conflicts.length) process.exitCode = 2;
+      return;
+    }
+
     if (opts.command === 'diff-env') {
       const { diffEnvAgainstStore, resolveEnvFiles } = await import('./secrets-env-diff.mjs');
       const { loadProjectRegistry } = await import('./secrets-env-export.mjs');
-      const { globalBrainDir } = await import('./config.mjs');
-
-      // Compare against the GLOBAL store, not whichever layer the cwd resolves
-      // to. A repo with its own .agent/ shadows the global store, so running
-      // this from inside one would diff .env files against a project-local
-      // store and report drift that is really just two different stores —
-      // which is how the real drift stayed invisible. --layer project opts in.
-      const compareBrainDir = opts.layer === 'project' ? brainDir : globalBrainDir;
+
+      // Always the single store: a repo's own .agent/ never selects another one.
+      const compareBrainDir = brainDir;
 
       const roots = opts.path
         ? [path.resolve(opts.path)]

package/scaffold/.agent/skills/total-recall/plugins/auth/src/provider-catalog.mjs

@@ -15,6 +15,10 @@
  *     class?: 'provider_api' | 'provider_browser' | 'self_generated' | 'manual',
  *     high_risk?: boolean,
  *     manual_keys?: string[],
+ *     // Keys the provider issues that a name pattern would otherwise class as self-minted
+ *     // (a Stripe webhook signing secret ends in _WEBHOOK_SECRET but only Stripe can issue it),
+ *     // with the console page where each is rolled.
+ *     issued_keys?: { [key: string]: string },
  *     // A provider that lets the account mint and revoke its own keys over its API. The management
  *     // credential is a separate stored secret; without it the provider cannot rotate itself, which
  *     // is what made 'provider_api' a class with no implementation.
@@ -345,7 +349,12 @@ export const PROVIDER_CATALOG = [
       notes: 'Live keys are payment-critical. Roll with a grace window; never revoke before export confirms.',
     },
     // Stripe exposes no API to mint or roll secret keys — dashboard only, by design.
-    rotation: { class: 'provider_browser', high_risk: true },
+    rotation: {
+      class: 'provider_browser',
+      high_risk: true,
+      // Signing secrets are issued per webhook endpoint; a self-minted value fails every signature check.
+      issued_keys: { STRIPE_WEBHOOK_SECRET: 'https://dashboard.stripe.com/webhooks' },
+    },
     default_monthly_cap_usd: null,
     tiers: [{ id: 'payg', label: 'Pay as you go', monthly_usd: null }],
   },

package/scaffold/.agent/skills/total-recall/plugins/auth/src/rotation-capability.mjs

@@ -115,6 +115,21 @@ export function getRotationPlan(key, meta = {}) {
     };
   }
 
+  const issuer = meta.provider ? getProvider(meta.provider) : providerForKeyName(k);
+  const issuedConsole = Object.entries(issuer?.rotation?.issued_keys || {})
+    .find(([name]) => name.toUpperCase() === k.toUpperCase())?.[1];
+  if (issuedConsole) {
+    return {
+      ...base,
+      class: 'provider_browser',
+      provider: issuer.id,
+      console_url: issuedConsole,
+      high_risk: !!issuer.rotation.high_risk,
+      automatable: true,
+      reason: `${issuer.name} issues this value; roll it in the console, never mint it locally`,
+    };
+  }
+
   if (matchesAny(k, SELF_GENERATED_PATTERNS)) {
     return {
       ...base,

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-env-export.mjs

@@ -26,26 +26,58 @@ function envHeader() {
 `;
 }
 
+const ASSIGNMENT = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+
+function assignedKey(line) {
+  const m = ASSIGNMENT.exec(line);
+  return m ? m[1] : null;
+}
+
+/** Drop assignments of `keys` from hand-managed text so the managed block is the only definition. */
+function withoutKeys(text, keys) {
+  if (!keys.size) return text;
+  return text.split('\n').filter((line) => !keys.has(assignedKey(line))).join('\n');
+}
+
 /**
  * Merge a managed TR secrets block into an existing .env without wiping
  * non-secret / hand-managed keys outside the BEGIN/END markers.
  *
+ * A key the block defines is removed from the text outside the block: dotenv
+ * loaders disagree on whether the first or last assignment wins, so a stale
+ * copy left outside would shadow the rotated value under some of them.
+ * With `partial`, the block carries only some keys (a `--keys` deploy), so the
+ * previous block's other entries are kept rather than dropped.
+ *
  * @param {string} existing - current file contents (or '')
  * @param {string} managedBody - full block including BEGIN/END marks
+ * @param {{ partial?: boolean }} [opts]
  * @returns {string}
  */
-export function mergeEnvManagedBlock(existing, managedBody) {
-  const managed = String(managedBody || '').trimEnd() + '\n';
+export function mergeEnvManagedBlock(existing, managedBody, { partial = false } = {}) {
+  let managed = String(managedBody || '').trimEnd() + '\n';
   const text = existing == null ? '' : String(existing);
 
   if (!text.trim()) return managed;
 
   const beginIdx = text.indexOf(BEGIN_MARK);
   const endIdx = text.indexOf(END_MARK);
+  const hasBlock = beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx;
+
+  if (partial && hasBlock) {
+    const fresh = new Set(managed.split('\n').map(assignedKey).filter(Boolean));
+    const kept = text.slice(beginIdx, endIdx).split('\n')
+      .filter((line) => { const key = assignedKey(line); return key && !fresh.has(key); });
+    if (kept.length) {
+      const end = managed.lastIndexOf(END_MARK);
+      managed = `${managed.slice(0, end)}${kept.join('\n')}\n${managed.slice(end)}`;
+    }
+  }
+  const managedKeys = new Set(managed.split('\n').map(assignedKey).filter(Boolean));
 
-  if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
-    const before = text.slice(0, beginIdx).replace(/\s+$/, '');
-    const after = text.slice(endIdx + END_MARK.length).replace(/^\r?\n?/, '');
+  if (hasBlock) {
+    const before = withoutKeys(text.slice(0, beginIdx), managedKeys).replace(/\s+$/, '');
+    const after = withoutKeys(text.slice(endIdx + END_MARK.length).replace(/^\r?\n?/, ''), managedKeys);
     const parts = [];
     if (before) parts.push(before.endsWith('\n') ? before : `${before}\n`);
     parts.push(managed.endsWith('\n') ? managed : `${managed}\n`);
@@ -56,10 +88,43 @@ export function mergeEnvManagedBlock(existing, managedBody) {
   }
 
   // No prior TR block — append managed section after existing content
-  const base = text.endsWith('\n') ? text : `${text}\n`;
+  const rest = withoutKeys(text, managedKeys);
+  const base = rest.endsWith('\n') ? rest : `${rest}\n`;
   return `${base}\n${managed}`;
 }
 
+/**
+ * Refuse a shared plugin path as a secret-projection target.
+ *
+ * The shared plugin folder lives at `<agentDir>/skills/total-recall/plugins` and
+ * normally holds one symlink per plugin pointing at that plugin's owner
+ * checkout. A projection written there lands in a plugin repository, which is
+ * not an application and must never hold an application's secrets.
+ *
+ * @param {string} abs absolute, existing directory
+ */
+export function assertNotSharedPluginPath(abs) {
+  const agentDir = process.env.AGENT_DIR || process.env._TR_TEST_AGENT_DIR || path.join(os.homedir(), '.agent');
+  const pluginsRoot = path.join(agentDir, 'skills', 'total-recall', 'plugins');
+  const candidates = new Set([path.resolve(abs)]);
+  try { candidates.add(fs.realpathSync(abs)); } catch { /* unreadable path */ }
+  for (const candidate of candidates) {
+    if (candidate === pluginsRoot || candidate.startsWith(pluginsRoot + path.sep)) {
+      throw new Error(`Refusing to write secrets into the shared plugin folder: ${abs}. Name the application repository with --path.`);
+    }
+    let entries = [];
+    try { entries = fs.readdirSync(pluginsRoot, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      if (!entry.isSymbolicLink()) continue;
+      let target;
+      try { target = fs.realpathSync(path.join(pluginsRoot, entry.name)); } catch { continue; }
+      if (candidate === target || candidate.startsWith(target + path.sep)) {
+        throw new Error(`Refusing to write secrets into the plugin checkout ${target} (reached as ${abs}). Name the application repository with --path.`);
+      }
+    }
+  }
+}
+
 /**
  * Resolve a project slug from a filesystem path (last segment).
  * @param {string} projectPath
@@ -172,6 +237,8 @@ ${exampleLines.join('\n')}${exampleLines.length ? '\n' : ''}`;
     keys: selected.map((s) => s.key),
     count: selected.length,
     store: resolveSecretsPath(brainDir),
+    // [outKey, value] pairs for in-process comparison (remote verify). Never log them.
+    entries: selected.map(({ outKey, value }) => [outKey, value]),
   };
 }
 
@@ -194,6 +261,11 @@ export async function exportEnvToProject(brainDir, projectPath, opts = {}) {
   if (!fs.existsSync(abs) || !fs.statSync(abs).isDirectory()) {
     throw new Error(`Project path is not a directory: ${abs}`);
   }
+  // A secret projection belongs to a repository. The shared plugin folder links
+  // every plugin to its owner checkout, so exporting with the default cwd —
+  // inside a plugin — wrote a plaintext .env of the whole store into 30 plugin
+  // repositories. Refuse that target rather than requiring a flag to avoid it.
+  assertNotSharedPluginPath(abs);
 
   const filename = opts.filename || '.env';
   const target = {