total-recall-brain 3.41.1 → 3.41.2

package/scaffold/.agent/skills/total-recall/plugins/mesh/capability/index.mjs

@@ -0,0 +1,46 @@
+/**
+ * Mesh control-server capability: the developer's own Headscale, host-free.
+ *
+ * A project that vendors this brick provisions, updates and administers its
+ * own control server without Total Recall. The caller supplies the target host,
+ * and may inject the command runner (`exec`), the release lookups and the HTTP
+ * transport; the defaults use only Node built-ins (`ssh` through
+ * child_process, global `fetch`). Credentials are never read from a store or
+ * the environment here: provisioning returns the new API key to the caller,
+ * and the API client takes the key as an argument.
+ */
+import {
+  meshTargetOf,
+  sshExec,
+  provisionHeadscale,
+  updateHeadscale,
+  installConsole,
+  updateConsole,
+} from './control-server.mjs';
+
+export { meshTargetOf, sshExec, shellQuote, patchConfig, parseChecksum, consoleConfig } from './control-server.mjs';
+export { createHeadscaleApi, buildMeshSshPolicy, assertSecureControlUrl, normalizeControlUrl } from './headscale-api.mjs';
+
+/**
+ * Bind the control-server lifecycle to one host.
+ * @param {{ target: { name?: string, host: string, user: string, port?: number, domain: string },
+ *   exec?: Function, fetchJson?: Function, fetchText?: Function, checkDns?: Function,
+ *   log?: Function, wait?: Function }} options
+ */
+export function createControlServer({ target, exec, ...deps } = {}) {
+  const resolved = meshTargetOf({ name: target?.name, ssh: { host: target?.host, user: target?.user, port: target?.port }, domain: target?.domain });
+  if (!resolved) throw new Error('A control-server target needs a valid SSH host, SSH user and a public domain pointing at that host');
+  const run = exec || sshExec(resolved);
+  const shared = Object.fromEntries(Object.entries(deps).filter(([, v]) => v !== undefined));
+  return {
+    target: resolved,
+    /** Install Headscale on a fresh Debian 12+/Ubuntu 22.04+ host; returns the control URL, API key and a 1-hour pre-auth key. */
+    provision: (opts = {}) => provisionHeadscale(resolved, { ...shared, ...opts, exec: run }),
+    /** Stage, trial, switch and roll back to the latest release; `checkOnly` reports without changing anything. */
+    update: (opts = {}) => updateHeadscale(resolved, { ...shared, ...opts, exec: run }),
+    /** Install the optional Headplane console, bound to loopback. */
+    installConsole: (opts = {}) => installConsole(resolved, { ...shared, ...opts, exec: run }),
+    /** Move the console to the latest release, restoring the previous image on failure. */
+    updateConsole: (opts = {}) => updateConsole(resolved, { ...shared, ...opts, exec: run }),
+  };
+}

package/scaffold/.agent/skills/total-recall/plugins/mesh/cli.mjs

@@ -18,7 +18,15 @@ export async function run(argv = []) {
     const at=args.indexOf('--mode');const mode=at<0?0o600:Number.parseInt(args[at+1],8);
     console.log(JSON.stringify(await putMeshFile({node:args[2],source:args[3],destination:args[4],mode})));return;
   }
-  if (sub === 'status' || sub === 'view' || sub === 'probe') {
+  if (sub === 'view') {
+    const { readMeshView } = await import('./src/core/screen-view.mjs');
+    if (args.slice(1).some(arg => arg.startsWith('-') && arg !== '--json')) throw new Error('view accepts a screen and --json only');
+    const names = args.slice(1).filter(arg => arg !== '--json');
+    if (names.length > 1) throw new Error('view accepts one screen');
+    console.log(JSON.stringify(await readMeshView(names[0])));
+    return;
+  }
+  if (sub === 'status' || sub === 'probe') {
     const result = await meshStatus();
     console.log(JSON.stringify(result));
     if (sub === 'probe' && !result.control.verified) process.exitCode = 1;

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-mesh",
-      "version": "0.2.2",
+      "version": "0.2.4",
       "license": "MIT",
       "dependencies": {
         "express": "^5.2.1"
       },
       "devDependencies": {
         "jsdom": "^29.1.1",
-        "supertest": "^7.2.2",
-        "total-recall-brain": "3.40.1",
-        "vitest": "^4.1.11"
+        "supertest": "^7.3.1",
+        "total-recall-brain": "3.41.1",
+        "vitest": "^4.1.12"
       }
     },
     "node_modules/@asamuzakjp/css-color": {
@@ -1259,18 +1259,18 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -4187,22 +4187,22 @@
       }
     },
     "node_modules/tldts": {
-      "version": "7.4.18",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.18.tgz",
-      "integrity": "sha512-somxA8xKAUzlAxl0TX/jMSYIbRNFIVGnI96pVGJPeMc5BsHmfVXn6mOJT6U++ELnl04eGfzpfcEuZe8WiASkXg==",
+      "version": "7.4.19",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.19.tgz",
+      "integrity": "sha512-48dH6aSpQnpbzDUc4vIQZ1VjB8tkK+e8c1yx05/SZK+rkssgjEOlxDd/yU8/a4vGYQ9vRgJr9dwMq9TJ0b3X2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.4.18"
+        "tldts-core": "^7.4.19"
       },
       "bin": {
         "tldts": "bin/cli.js"
       }
     },
     "node_modules/tldts-core": {
-      "version": "7.4.18",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.18.tgz",
-      "integrity": "sha512-KI2PKvCmvQI/xD6ypPqkU0i7oxNXR/O58RLRaHR4svsgVUQ2JE/XC8BtMbG6PSehD27I8sZJRcC1ASnCy6lp3g==",
+      "version": "7.4.19",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.19.tgz",
+      "integrity": "sha512-goNXV6Ho9TIOfpJZanTd6CKG5DyYgYAL+k+22T0SLh8l6+KHIfBUPFuePuSZv05UttIaaLmI9tb7TmGIdK5AkQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -4216,9 +4216,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.40.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.40.1.tgz",
-      "integrity": "sha512-tZMnDHXsMT1sa698oF26Np/G4k+Cn4ZXpTdo+BTNOvUMYEhxWR+7Tl+upHLMhcEEPuEM0EiAObL53a9JELzGag==",
+      "version": "3.41.1",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.1.tgz",
+      "integrity": "sha512-QraXzcZpCTMssx1gaz8xjvSKf5KqirAaxzzER/ICBrWvawdNTLUDDMsVEYQUA/7thgwtL1QVIxU4dpfCGZwp+g==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -4247,7 +4247,8 @@
       "bin": {
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
-        "total-recall-memory": "bin/total-recall-memory.mjs"
+        "total-recall-memory": "bin/total-recall-memory.mjs",
+        "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {
         "playwright": "^1.60.0"

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,10 +1,10 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs && vitest run"
   },
   "license": "MIT",
   "dependencies": {
@@ -16,6 +16,9 @@
     "README.md",
     "LICENSE",
     "ui/",
-    "src/"
+    "capability/",
+    "src/",
+    "!src/**/*.spec.mjs",
+    "!src/**/*.test.mjs"
   ]
 }

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,9 +2,15 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
+  "requires": [
+    {
+      "id": "auth",
+      "range": ">=1.2.1"
+    }
+  ],
   "branding": {
     "name": "Headscale",
     "color": "#818cf8",
@@ -90,10 +96,34 @@
         "effect": "write",
         "output": "json",
         "args": [
-          {"name":"operation","label":"Operation","type":"string","positional":true,"required":true},
-          {"name":"node","label":"Node","type":"string","positional":true,"required":true},
-          {"name":"source","label":"Source","type":"string","positional":true,"required":true},
-          {"name":"destination","label":"Destination","type":"string","positional":true,"required":true}
+          {
+            "name": "operation",
+            "label": "Operation",
+            "type": "string",
+            "positional": true,
+            "required": true
+          },
+          {
+            "name": "node",
+            "label": "Node",
+            "type": "string",
+            "positional": true,
+            "required": true
+          },
+          {
+            "name": "source",
+            "label": "Source",
+            "type": "string",
+            "positional": true,
+            "required": true
+          },
+          {
+            "name": "destination",
+            "label": "Destination",
+            "type": "string",
+            "positional": true,
+            "required": true
+          }
         ]
       },
       {
@@ -103,8 +133,30 @@
       },
       {
         "name": "view",
-        "description": "Inspect live mesh state",
-        "effect": "read"
+        "description": "Read independent owner observations for mesh screens",
+        "effect": "read",
+        "timeout_ms": 60000,
+        "args": [
+          {
+            "name": "screen",
+            "label": "Screen",
+            "type": "choice",
+            "positional": true,
+            "options": [
+              "machines",
+              "flows",
+              "placement",
+              "boundary",
+              "join"
+            ]
+          },
+          {
+            "name": "json",
+            "label": "JSON output",
+            "type": "boolean",
+            "flag": "--json"
+          }
+        ]
       },
       {
         "name": "nodes",
@@ -145,7 +197,7 @@
       {
         "name": "enroll",
         "description": "Mesh enroll operation",
-        "effect": "write"
+        "effect": "destructive"
       },
       {
         "name": "preauthkey",
@@ -292,5 +344,187 @@
   "distribution": {
     "tier": "official",
     "license": "open"
+  },
+  "mesh": {
+    "version": 1,
+    "description": "Declared support and observation contracts; declarations are not live readiness or primitive grants.",
+    "provides": [
+      {
+        "id": "node-inventory",
+        "operation": "status",
+        "runtime": "mesh",
+        "observation": "machines.status"
+      },
+      {
+        "id": "execution-probe",
+        "operation": "doctor",
+        "runtime": "mesh",
+        "observation": "doctor"
+      },
+      {
+        "id": "remote-execution",
+        "operation": "exec",
+        "runtime": "mesh",
+        "observation": "doctor"
+      },
+      {
+        "id": "path-probe",
+        "operation": "ping",
+        "runtime": "mesh",
+        "observation": "ping"
+      },
+      {
+        "id": "presence",
+        "operation": "presence",
+        "runtime": "presence",
+        "observation": "machines.presence"
+      },
+      {
+        "id": "file-push",
+        "operation": "file",
+        "runtime": "mesh",
+        "observation": null
+      },
+      {
+        "id": "secret-grants",
+        "operation": "grants",
+        "runtime": "mesh-identity",
+        "observation": "flows.grants"
+      },
+      {
+        "id": "control-policy",
+        "operation": "policy",
+        "runtime": "headscale-client",
+        "observation": "boundary.policy"
+      },
+      {
+        "id": "enrollment",
+        "operation": "enroll",
+        "runtime": "mesh-enroll",
+        "observation": "join.status"
+      }
+    ],
+    "integrations": [
+      {
+        "id": "auth",
+        "owner": "auth",
+        "purpose": "One host credential store; no values in views",
+        "observation": "machines.status",
+        "evidence": "control.verified"
+      },
+      {
+        "id": "headscale",
+        "owner": "mesh",
+        "purpose": "Control server authentication and membership",
+        "observation": "machines.status",
+        "evidence": "control.verified"
+      },
+      {
+        "id": "tailscale",
+        "owner": "mesh",
+        "purpose": "Client enrollment and mesh network state",
+        "observation": "machines.status",
+        "evidence": "network_available"
+      },
+      {
+        "id": "ssh",
+        "owner": "mesh",
+        "purpose": "Per-machine execution probes",
+        "observation": "doctor",
+        "evidence": "reachable per machine"
+      },
+      {
+        "id": "presence",
+        "owner": "mesh",
+        "purpose": "Authenticated fresh activity observations",
+        "observation": "machines.presence",
+        "evidence": "peer states and timestamps"
+      },
+      {
+        "id": "plugin-sharing",
+        "owner": "mesh",
+        "purpose": "Peer plugin inventories",
+        "observation": "flows.plugins",
+        "evidence": "peer status"
+      },
+      {
+        "id": "updates",
+        "owner": "core",
+        "purpose": "Last automatic maintenance report",
+        "observation": "flows.updates",
+        "evidence": "recorded last result"
+      },
+      {
+        "id": "schedules",
+        "owner": "user-automations",
+        "purpose": "Task declarations and node placement",
+        "observation": "flows.tasks",
+        "evidence": "node inventory; no execution inferred"
+      },
+      {
+        "id": "agents",
+        "owner": "core",
+        "purpose": "Running and recent process inventory",
+        "observation": "flows.agents",
+        "evidence": "process records"
+      },
+      {
+        "id": "alerts",
+        "owner": "operator-alerts",
+        "purpose": "Recorded delivery attempts",
+        "observation": "flows.alerts",
+        "evidence": "ledger result; no recipient view inferred"
+      },
+      {
+        "id": "deployments",
+        "owner": "deploy",
+        "purpose": "Selected project release state",
+        "observation": "flows.deployments",
+        "evidence": "configured slot; no fleet-wide inference"
+      }
+    ],
+    "endpoints": [
+      {
+        "path": "/api/mesh/presence/local",
+        "method": "GET",
+        "runtime": "route-mesh-presence",
+        "authentication": "mesh peer"
+      },
+      {
+        "path": "/api/mesh/plugins",
+        "method": "GET",
+        "runtime": "route-plugins-mesh",
+        "authentication": "mesh peer"
+      }
+    ],
+    "task_placement": "Declared task placement is selected-node or per-node; actual execution requires a verified daemon report.",
+    "unavailable": [
+      "transfer-history",
+      "service-health-cli",
+      "exit-node-management",
+      "subnet-route-management",
+      "tunnel-inventory",
+      "public-exposure-inventory",
+      "speed-measurement",
+      "messages",
+      "shared-file-spaces"
+    ]
+  },
+  "capability": {
+    "entry": "capability/index.mjs",
+    "dependencies": [],
+    "exports": [
+      "createControlServer",
+      "createHeadscaleApi",
+      "buildMeshSshPolicy",
+      "meshTargetOf",
+      "sshExec",
+      "assertSecureControlUrl",
+      "normalizeControlUrl",
+      "shellQuote",
+      "patchConfig",
+      "parseChecksum",
+      "consoleConfig"
+    ]
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/cli/mesh.mjs

@@ -46,6 +46,7 @@ function printHelp() {
   Usage: total-recall mesh <command> [options]
 
     status                 Control-server reachability and credential state
+    view <screen>          Read Machines, Flows, Placement, Boundary or Join sources (--json)
     doctor                 Probe reachability & compute capabilities across all nodes
     nodes                  List mesh nodes and how to reach each one
     ssh <node> [cmd…]      Open a session using the node's recorded access
@@ -194,9 +195,9 @@ export default async function meshCli(argv = []) {
     }
 
     if (command === 'doctor' || command === 'diagnostics') {
-      console.log('\n🩺 Total Recall — Mesh Diagnostics & Compute Capability Audit\n');
       const enriched = listEnrichedMeshNodes(vaultRoot);
       const isJson = args.includes('--json');
+      if (!isJson) console.log('\n🩺 Total Recall — Mesh Diagnostics & Compute Capability Audit\n');
 
       const stripAnsi = (s) => String(s || '').replace(/\x1b\[[0-9;]*m/g, '');
       const pad = (s, l) => String(s || '') + ' '.repeat(Math.max(0, l - stripAnsi(s).length));
@@ -217,13 +218,17 @@ export default async function meshCli(argv = []) {
           reachable: false,
           error: null
         };
+        nodeInfo.tested_runtimes = ['ollama', 'docker', 'node', 'git'];
+        nodeInfo.tested_harnesses = ['agy', 'claude', 'codex', 'gemini'];
 
         if (node.self) {
           try {
             const { detectHarnesses } = await import('../core/meta-harness.mjs');
-            nodeInfo.harnesses = detectHarnesses().filter(h => h.available).map(h => h.id);
-          } catch {}
-          nodeInfo.runtimes = ['node', 'git'];
+            const detected = detectHarnesses();
+            nodeInfo.harnesses = detected.filter(h => h.available).map(h => h.id);
+            nodeInfo.tested_harnesses = detected.map(h => h.id);
+          } catch { nodeInfo.tested_harnesses = []; }
+          nodeInfo.runtimes = nodeInfo.tested_runtimes.filter(tool => spawnSync('/bin/sh', ['-c', 'command -v "$1"', 'mesh-probe', tool], { encoding: 'utf8', timeout: 3000 }).status === 0);
           nodeInfo.reachable = true;
         } else if (resolved.complete) {
           try {
@@ -233,16 +238,12 @@ export default async function meshCli(argv = []) {
             // reachable machines as down.
             const res = await execMeshCommand(node.hostname, probeCmd, { vaultRoot, timeoutMs: 15000 });
             nodeInfo.reachable = res.success;
-            if (res.success && !node.access?.verified_at) {
-              // A login that just worked is the only kind worth sharing with peers.
-              await setMeshNodeAccess(node.hostname, { verified_at: new Date().toISOString() }, { vaultRoot });
-            }
             if (res.success) {
               const parts = res.stdout.split(/\s+/);
               for (const part of parts) {
                 const [k, v] = part.split('=');
                 if (v && v.trim()) {
-                  if (['agy', 'claude', 'codex', 'gemini', 'ollama'].includes(k)) {
+                  if (['agy', 'claude', 'codex', 'gemini'].includes(k)) {
                     nodeInfo.harnesses.push(k);
                   } else {
                     nodeInfo.runtimes.push(k);
@@ -770,6 +771,10 @@ export default async function meshCli(argv = []) {
         if (reportPolicyModeError(err)) return;
         throw err;
       }
+      if (args.includes('--json')) {
+        console.log(JSON.stringify({ configured: current.configured, policy: current.policy, updatedAt: current.updatedAt || null }));
+        return;
+      }
       if (!current.configured) {
         console.log('No policy is set on the control server.');
         console.log('Run `total-recall mesh policy init-ssh` to enable Tailscale SSH.');

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/cli/server.mjs

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { meshTargetOf, provisionHeadscale, updateHeadscale, updateConsole, sshExec } from '../core/headscale-server.mjs';
+import { meshTargetOf, provisionHeadscale, updateHeadscale, updateConsole, sshExec } from '../../capability/control-server.mjs';
 import { saveCredential } from '../core/credentials.mjs';
 import { brainDir } from '../core/config.mjs';
 import { PluginStateStore } from '../ssss-store.mjs';

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/core/credentials.mjs

@@ -1,7 +1,8 @@
 import { importHostModule } from '../host-runtime.mjs';
 const { loadPluginModule: __loadOwnedPlugin } = await importHostModule('src/core/plugin-runtime.mjs');
 import { assertSecureControlUrl, normalizeControlUrl, headscaleUrlFromEnv, findHeadscaleKeyMeta } from './headscale-client.mjs';
-const { setSecret, defaultBrainDir } = await __loadOwnedPlugin('auth', 'secrets-store');
+const { setSecret } = await __loadOwnedPlugin('auth', 'secrets-store');
+const { hostSecretsBrainDir } = await __loadOwnedPlugin('auth', 'host-secrets-store');
 
 export async function verifyCredential(value, url, fetchImpl = fetch) {
   if (typeof value !== 'string' || !value.trim()) throw new Error('A credential is required');
@@ -18,8 +19,9 @@ export async function verifyCredential(value, url, fetchImpl = fetch) {
   return { verified: true, url: normalizeControlUrl(url) };
 }
 
-export async function saveCredential({ key, value, configuration = {}, brainDir = defaultBrainDir() }, dependencies = {}) {
+export async function saveCredential({ key, value, configuration = {} }, dependencies = {}) {
   if (key !== 'HEADSCALE_API_KEY') throw new Error('Unsupported mesh credential');
+  const brainDir = hostSecretsBrainDir();
   const meta = await findHeadscaleKeyMeta(brainDir);
   const url = configuration.controlUrl || headscaleUrlFromEnv() || meta?.headscale_url;
   if (!url) throw new Error('Set the control server URL before saving the credential');