total-recall-brain 3.41.1 → 3.41.3

package/scaffold/.agent/skills/total-recall/plugins/git-sentinel/package-lock.json

@@ -9,7 +9,7 @@
       "version": "1.1.2",
       "license": "MIT",
       "devDependencies": {
-        "total-recall-brain": "3.40.7",
+        "total-recall-brain": "3.41.2",
         "vitest": "^4.1.10"
       }
     },
@@ -3560,9 +3560,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.40.7",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.40.7.tgz",
-      "integrity": "sha512-G+sEWXVucI5Zs8uV1ie8P+mV/6cncWX76ES72T5dnPB3sFAwlcG9ous2SYTUaYUOETGB2vHTSo3cV4XWkHQ0Ww==",
+      "version": "3.41.2",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.2.tgz",
+      "integrity": "sha512-bwJFAFAyvk9ysf+5zhBzMxrKus1Hj1AygUWdBNt+vQbM2sfSEf6701sa30KwfGyU8+cMuN6YNT5Mn63mFZIi/w==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/git-sentinel/ui/card.js

@@ -410,14 +410,26 @@ export class GitSentinelCard extends HTMLElement {
           --face-ok: #047857;
           --face-warn: #b45309;
           --face-danger: #b91c1c;
+          --face-text-default: #111827;
+          --face-muted-default: #6b7280;
+          --face-line-default: #e5e7eb;
+          --face-surface-default: #f9fafb;
+          --face-accent-default: #b45309;
+          --face-dark-ok: #34d399;
+          --face-dark-warn: #fbbf24;
+          --face-dark-danger: #f87171;
+          --face-dark-text: #e8eaf0;
+          --face-dark-muted: #a2a8b8;
+          --face-dark-line: #2a3040;
+          --face-dark-surface: #171a23;
           --face-radius: 6px;
           --face-motion: 140ms ease-out;
           --face-mono: 'JetBrains Mono', ui-monospace, SFMono-Regular, Menlo, monospace;
-          --face-text: var(--text-primary, #111827);
-          --face-muted: var(--text-secondary, #6b7280);
-          --face-line: var(--border, #e5e7eb);
-          --face-surface: var(--bg-secondary, #f9fafb);
-          --face-accent: var(--card-color, #b45309);
+          --face-text: var(--text-primary, var(--face-text-default));
+          --face-muted: var(--text-secondary, var(--face-muted-default));
+          --face-line: var(--border, var(--face-line-default));
+          --face-surface: var(--bg-secondary, var(--face-surface-default));
+          --face-accent: var(--card-color, var(--face-accent-default));
           font-family: 'Space Grotesk', var(--font-sans, system-ui, sans-serif);
           color: var(--face-text);
         }
@@ -425,25 +437,25 @@ export class GitSentinelCard extends HTMLElement {
            verdict line, so they are retuned whenever the host is dark. */
         @media (prefers-color-scheme: dark) {
           :host {
-            --face-ok: #34d399;
-            --face-warn: #fbbf24;
-            --face-danger: #f87171;
-            --face-text: var(--text-primary, #e8eaf0);
-            --face-muted: var(--text-secondary, #a2a8b8);
-            --face-line: var(--border, #2a3040);
-            --face-surface: var(--bg-secondary, #171a23);
+            --face-ok: var(--face-dark-ok);
+            --face-warn: var(--face-dark-warn);
+            --face-danger: var(--face-dark-danger);
+            --face-text: var(--text-primary, var(--face-dark-text));
+            --face-muted: var(--text-secondary, var(--face-dark-muted));
+            --face-line: var(--border, var(--face-dark-line));
+            --face-surface: var(--bg-secondary, var(--face-dark-surface));
           }
         }
         :host-context([data-theme="dark"]),
         :host-context(.theme-dark),
         :host-context(.dark) {
-          --face-ok: #34d399;
-          --face-warn: #fbbf24;
-          --face-danger: #f87171;
-          --face-text: var(--text-primary, #e8eaf0);
-          --face-muted: var(--text-secondary, #a2a8b8);
-          --face-line: var(--border, #2a3040);
-          --face-surface: var(--bg-secondary, #171a23);
+          --face-ok: var(--face-dark-ok);
+          --face-warn: var(--face-dark-warn);
+          --face-danger: var(--face-dark-danger);
+          --face-text: var(--text-primary, var(--face-dark-text));
+          --face-muted: var(--text-secondary, var(--face-dark-muted));
+          --face-line: var(--border, var(--face-dark-line));
+          --face-surface: var(--bg-secondary, var(--face-dark-surface));
         }
         * { box-sizing: border-box; }
         .top { display: flex; align-items: center; justify-content: space-between; gap: 12px; flex-wrap: wrap; margin-bottom: 12px; }

package/scaffold/.agent/skills/total-recall/plugins/mesh/README.md

@@ -45,3 +45,13 @@ This copies the plugin's source, skills, tests and docs into `bricks/mesh` and r
 **Use it directly with Total Recall (for your own machines and workflow).** Install it with `total-recall plugin install https://github.com/gregiteen/tr-plugin-mesh.git` and run `total-recall mesh`. Manage its credentials with `total-recall auth secret` and its skills with `total-recall skill`.
 
 Native-only state: new installations use validated SSSS records and the shared auth owner. Legacy imports and compatibility fallback formats are not supported.
+
+## Mesh screens and integration declarations
+
+The card defines Machines, Flows, Placement, Boundary and Join. Machines separates control membership, path checks, recorded login and actual execution. Hardware cells retain their measurement dates; failed or untested runtime probes remain unknown. Placement filters confirmed capabilities and includes the integration matrix declared in `plugin.json.mesh`.
+
+`total-recall mesh view <machines|flows|placement|boundary|join> --json` reads fixed owner commands. Each source carries its command, attempt time and either data or an explicit error. `mesh.provides` references declared operations/runtime modules; `mesh.integrations` identifies each owner and the meaning of its evidence; `mesh.endpoints` identifies served peer routes. These are declarations, not primitive grants or proof every provider action works. Read-only views never perform enrollment, policy changes, grant edits, deployments or secret transfers.
+
+The dashboard supplies frozen `host.operations`. Read-only cards show CLI handoffs for login administration and re-enrollment. A writable host may expose those declared actions; re-enrollment then requires target-specific confirmation. Enrollment keys never enter the card.
+
+Auth's `host-secrets-store` runtime supplies the single host-store selector for control credentials and mesh-sync authentication. Project `AGENT_DIR`/`TR_BRAIN` cannot divert these reads. Native SSSS audit contention is serialized by the generic host; errors still fail closed. The corresponding source runtime must be installed; missing modules never select a fallback implementation.

package/scaffold/.agent/skills/total-recall/plugins/mesh/{src/core/headscale-server.mjs → capability/control-server.mjs}

@@ -117,9 +117,12 @@ export async function provisionHeadscale(target, { exec = sshExec(target), fetch
   await must(exec('headscale configtest'), 'headscale configtest');
 
   log('start');
-  await must(exec('systemctl enable --now headscale'), 'Starting Headscale');
+  // The package starts Headscale at install with the example config (loopback :8080);
+  // `enable --now` leaves that process running, so restart to load the written config.
+  await must(exec('systemctl enable headscale && systemctl restart headscale'), 'Starting Headscale');
   let healthy = false;
-  for (let i = 0; i < 20 && !healthy; i++) {
+  // The first start also obtains the Let's Encrypt certificate, so allow it about a minute.
+  for (let i = 0; i < 40 && !healthy; i++) {
     healthy = (await exec(`curl -fsS https://${target.domain}/health`)).code === 0;
     if (!healthy) await wait(1500);
   }

package/scaffold/.agent/skills/total-recall/plugins/mesh/capability/headscale-api.mjs

@@ -0,0 +1,192 @@
+/**
+ * Headscale control-server API, host-free.
+ *
+ * The caller supplies the control-server URL, the API key and the HTTP
+ * transport, so this module reads no credential store and no environment. The
+ * Total Recall host resolves the key from its auth plugin and passes it in;
+ * a vendored copy passes its own.
+ */
+
+const DEFAULT_TIMEOUT_MS = 10_000;
+
+/**
+ * Reject non-HTTPS control servers (loopback excepted for local development).
+ * Bearer tokens must never travel in cleartext over a network hop.
+ */
+export function assertSecureControlUrl(url) {
+  const parsed = new URL(url);
+  const isLoopback = ['localhost', '127.0.0.1', '::1'].includes(parsed.hostname);
+  if (parsed.protocol !== 'https:' && !(isLoopback && parsed.protocol === 'http:')) {
+    throw new Error('Headscale URL must use HTTPS (HTTP is allowed only for loopback development)');
+  }
+  return parsed;
+}
+
+/** Strip a trailing slash so path joining stays predictable. */
+export function normalizeControlUrl(url) {
+  const value = String(url || '').trim();
+  return value.endsWith('/') ? value.slice(0, -1) : value;
+}
+
+/** A fetch with a deadline, used when the caller supplies no transport. */
+function timedFetch(fetchImpl) {
+  return async (url, options = {}) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs || DEFAULT_TIMEOUT_MS);
+    try {
+      return await fetchImpl(url, { ...options, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+
+/**
+ * Bind a client to one control server.
+ * @param {{ url: string, token: string, fetch?: (url: string, options: object) => Promise<Response> }} options
+ *   `fetch` receives `timeoutMs` in its options and is responsible for honouring it.
+ */
+export function createHeadscaleApi({ url, token, fetch: transport } = {}) {
+  const base = normalizeControlUrl(url);
+  if (!base) throw new Error('A Headscale control server URL is required');
+  assertSecureControlUrl(base);
+  if (typeof token !== 'string' || !token) throw new Error('A Headscale API key is required');
+  const send = transport || timedFetch(globalThis.fetch);
+
+  /** Authenticated JSON request; a non-2xx answer throws with `status` and a bounded `detail`. */
+  async function request(path, options = {}) {
+    const cleanPath = path.startsWith('/') ? path : `/${path}`;
+    const res = await send(`${base}${cleanPath}`, {
+      ...options,
+      headers: {
+        ...options.headers,
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json',
+        'Content-Type': 'application/json',
+      },
+      timeoutMs: options.timeoutMs || DEFAULT_TIMEOUT_MS,
+    });
+    if (!res.ok) {
+      const errorText = await res.text().catch(() => '');
+      const error = new Error(`Headscale API error (${res.status} ${res.statusText})`);
+      error.status = res.status;
+      error.detail = errorText.slice(0, 500);
+      throw error;
+    }
+    const contentType = res.headers.get('content-type') || '';
+    if (contentType.includes('application/json')) return res.json();
+    throw new Error('Control server returned a non-JSON response');
+  }
+
+  /**
+   * Resolve a control-server user to both of its identifying forms.
+   * User-facing names resolve to the current API numeric ID.
+   */
+  async function resolveUser(requested) {
+    const data = await request('/api/v1/user');
+    const users = data?.users || [];
+    if (requested) {
+      const match = users.find(
+        (u) => String(u.id) === String(requested) || u.name === requested || (u.email && u.email === requested),
+      );
+      if (match) return { id: String(match.id), name: match.name };
+      // Unknown to us — pass it through and let the control server decide.
+      return { id: String(requested), name: String(requested) };
+    }
+    if (!users.length) return null;
+    return { id: String(users[0].id), name: users[0].name };
+  }
+
+  /** Mint using the current numeric-user API without older-version retries. */
+  async function createPreAuthKey(options = {}) {
+    const ttlMinutes = Number.isFinite(options.ttlMinutes) ? options.ttlMinutes : 10;
+    const expiration = options.expiration || new Date(Date.now() + ttlMinutes * 60_000).toISOString();
+    const ref = options.userRef || await resolveUser(options.user);
+    if (!ref?.id || !/^[0-9]+$/.test(String(ref.id))) throw new Error('Select a registered numeric control-server user');
+    const user = String(ref.id);
+    const data = await request('/api/v1/preauthkey', {
+      method: 'POST', body: JSON.stringify({ user, reusable: options.reusable === true,
+        ephemeral: options.ephemeral === true, expiration, aclTags: options.aclTags || [] }),
+    });
+    const key = data?.preAuthKey?.key;
+    if (typeof key !== 'string' || !key) throw new Error('Headscale did not return a pre-auth key');
+    return { key, expiration, user, raw: data };
+  }
+
+  /**
+   * Read the control server's ACL policy.
+   *
+   * Requires the server to run with `policy.mode: database` — in `file` mode the
+   * policy lives on the control server's disk and the API cannot manage it.
+   *
+   * Headscale returns a 500 (not a 404) when database mode is on but the policy
+   * table is still empty, so an unset policy is normalised to `policy: null`
+   * rather than thrown. That distinction matters: "no policy yet" is the expected
+   * first-run state, whereas a real transport or auth failure must still surface.
+   */
+  async function getPolicy() {
+    try {
+      const data = await request('/api/v1/policy');
+      return { policy: data?.policy ?? null, updatedAt: data?.updatedAt ?? null, configured: Boolean(data?.policy), raw: data };
+    } catch (err) {
+      const detail = String(err.detail || '');
+      const emptyPolicyTable = err.status === 404 || (err.status === 500 && /policy|not found|no such/i.test(detail));
+      if (emptyPolicyTable) return { policy: null, updatedAt: null, configured: false, unset: true, raw: null };
+      if (err.status === 400 && /database/i.test(detail)) {
+        const modeError = new Error('Headscale is running in file policy mode; set `policy.mode: database` to manage the policy over the API');
+        modeError.status = err.status;
+        modeError.detail = err.detail;
+        modeError.code = 'POLICY_MODE_FILE';
+        throw modeError;
+      }
+      throw err;
+    }
+  }
+
+  /**
+   * Replace the control server's ACL policy.
+   *
+   * `policy` may be an object (serialised here) or an already-formatted
+   * HuJSON/JSON string. Headscale validates server-side and rejects the write if
+   * the policy's own `tests` block fails, so a bad policy never lands.
+   */
+  async function setPolicy(policy) {
+    if (!policy) throw new Error('A policy is required');
+    const serialised = typeof policy === 'string' ? policy : JSON.stringify(policy, null, 2);
+    const data = await request('/api/v1/policy', { method: 'PUT', body: JSON.stringify({ policy: serialised }) });
+    return { policy: data?.policy ?? serialised, updatedAt: data?.updatedAt ?? null, raw: data };
+  }
+
+  return { url: base, request, resolveUser, createPreAuthKey, getPolicy, setPolicy };
+}
+
+/**
+ * Build a policy that lets every mesh member reach every other member, and use
+ * Tailscale SSH between them as any non-root user.
+ *
+ * This is deliberately the simple single-operator shape: one person's own
+ * machines, all equally trusted. It is NOT appropriate for a multi-tenant
+ * tailnet — headscale membership is the trust boundary, so anything admitted to
+ * the mesh inherits this access. Narrow `src`/`dst` before adding a node you do
+ * not control.
+ *
+ * root is excluded via `autogroup:nonroot`: SSH-ing straight to root over the
+ * mesh removes the audit trail that makes per-user access worth having.
+ */
+export function buildMeshSshPolicy({ allowRoot = false } = {}) {
+  return {
+    acls: [{ action: 'accept', src: ['*'], dst: ['*:*'] }],
+    ssh: [
+      {
+        action: 'accept',
+        // autogroup:member, not autogroup:self. 'self' limits a member to SSH on their own
+        // devices, so no node on the mesh could reach any other one and every cross-machine
+        // operation fell back to key auth that had never been set up — which reads as the peer
+        // being unreachable. The point of this policy is that members reach each other.
+        src: ['autogroup:member'],
+        dst: ['autogroup:member'],
+        users: allowRoot ? ['autogroup:nonroot', 'root'] : ['autogroup:nonroot'],
+      },
+    ],
+  };
+}

package/scaffold/.agent/skills/total-recall/plugins/mesh/capability/index.mjs

@@ -0,0 +1,46 @@
+/**
+ * Mesh control-server capability: the developer's own Headscale, host-free.
+ *
+ * A project that vendors this brick provisions, updates and administers its
+ * own control server without Total Recall. The caller supplies the target host,
+ * and may inject the command runner (`exec`), the release lookups and the HTTP
+ * transport; the defaults use only Node built-ins (`ssh` through
+ * child_process, global `fetch`). Credentials are never read from a store or
+ * the environment here: provisioning returns the new API key to the caller,
+ * and the API client takes the key as an argument.
+ */
+import {
+  meshTargetOf,
+  sshExec,
+  provisionHeadscale,
+  updateHeadscale,
+  installConsole,
+  updateConsole,
+} from './control-server.mjs';
+
+export { meshTargetOf, sshExec, shellQuote, patchConfig, parseChecksum, consoleConfig } from './control-server.mjs';
+export { createHeadscaleApi, buildMeshSshPolicy, assertSecureControlUrl, normalizeControlUrl } from './headscale-api.mjs';
+
+/**
+ * Bind the control-server lifecycle to one host.
+ * @param {{ target: { name?: string, host: string, user: string, port?: number, domain: string },
+ *   exec?: Function, fetchJson?: Function, fetchText?: Function, checkDns?: Function,
+ *   log?: Function, wait?: Function }} options
+ */
+export function createControlServer({ target, exec, ...deps } = {}) {
+  const resolved = meshTargetOf({ name: target?.name, ssh: { host: target?.host, user: target?.user, port: target?.port }, domain: target?.domain });
+  if (!resolved) throw new Error('A control-server target needs a valid SSH host, SSH user and a public domain pointing at that host');
+  const run = exec || sshExec(resolved);
+  const shared = Object.fromEntries(Object.entries(deps).filter(([, v]) => v !== undefined));
+  return {
+    target: resolved,
+    /** Install Headscale on a fresh Debian 12+/Ubuntu 22.04+ host; returns the control URL, API key and a 1-hour pre-auth key. */
+    provision: (opts = {}) => provisionHeadscale(resolved, { ...shared, ...opts, exec: run }),
+    /** Stage, trial, switch and roll back to the latest release; `checkOnly` reports without changing anything. */
+    update: (opts = {}) => updateHeadscale(resolved, { ...shared, ...opts, exec: run }),
+    /** Install the optional Headplane console, bound to loopback. */
+    installConsole: (opts = {}) => installConsole(resolved, { ...shared, ...opts, exec: run }),
+    /** Move the console to the latest release, restoring the previous image on failure. */
+    updateConsole: (opts = {}) => updateConsole(resolved, { ...shared, ...opts, exec: run }),
+  };
+}

package/scaffold/.agent/skills/total-recall/plugins/mesh/cli.mjs

@@ -18,7 +18,15 @@ export async function run(argv = []) {
     const at=args.indexOf('--mode');const mode=at<0?0o600:Number.parseInt(args[at+1],8);
     console.log(JSON.stringify(await putMeshFile({node:args[2],source:args[3],destination:args[4],mode})));return;
   }
-  if (sub === 'status' || sub === 'view' || sub === 'probe') {
+  if (sub === 'view') {
+    const { readMeshView } = await import('./src/core/screen-view.mjs');
+    if (args.slice(1).some(arg => arg.startsWith('-') && arg !== '--json')) throw new Error('view accepts a screen and --json only');
+    const names = args.slice(1).filter(arg => arg !== '--json');
+    if (names.length > 1) throw new Error('view accepts one screen');
+    console.log(JSON.stringify(await readMeshView(names[0])));
+    return;
+  }
+  if (sub === 'status' || sub === 'probe') {
     const result = await meshStatus();
     console.log(JSON.stringify(result));
     if (sub === 'probe' && !result.control.verified) process.exitCode = 1;

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-mesh",
-      "version": "0.2.2",
+      "version": "0.2.4",
       "license": "MIT",
       "dependencies": {
         "express": "^5.2.1"
       },
       "devDependencies": {
         "jsdom": "^29.1.1",
-        "supertest": "^7.2.2",
-        "total-recall-brain": "3.40.1",
-        "vitest": "^4.1.11"
+        "supertest": "^7.3.1",
+        "total-recall-brain": "3.41.2",
+        "vitest": "^4.1.12"
       }
     },
     "node_modules/@asamuzakjp/css-color": {
@@ -1259,18 +1259,18 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -4187,22 +4187,22 @@
       }
     },
     "node_modules/tldts": {
-      "version": "7.4.18",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.18.tgz",
-      "integrity": "sha512-somxA8xKAUzlAxl0TX/jMSYIbRNFIVGnI96pVGJPeMc5BsHmfVXn6mOJT6U++ELnl04eGfzpfcEuZe8WiASkXg==",
+      "version": "7.4.19",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.19.tgz",
+      "integrity": "sha512-48dH6aSpQnpbzDUc4vIQZ1VjB8tkK+e8c1yx05/SZK+rkssgjEOlxDd/yU8/a4vGYQ9vRgJr9dwMq9TJ0b3X2Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tldts-core": "^7.4.18"
+        "tldts-core": "^7.4.19"
       },
       "bin": {
         "tldts": "bin/cli.js"
       }
     },
     "node_modules/tldts-core": {
-      "version": "7.4.18",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.18.tgz",
-      "integrity": "sha512-KI2PKvCmvQI/xD6ypPqkU0i7oxNXR/O58RLRaHR4svsgVUQ2JE/XC8BtMbG6PSehD27I8sZJRcC1ASnCy6lp3g==",
+      "version": "7.4.19",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.19.tgz",
+      "integrity": "sha512-goNXV6Ho9TIOfpJZanTd6CKG5DyYgYAL+k+22T0SLh8l6+KHIfBUPFuePuSZv05UttIaaLmI9tb7TmGIdK5AkQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -4216,9 +4216,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.40.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.40.1.tgz",
-      "integrity": "sha512-tZMnDHXsMT1sa698oF26Np/G4k+Cn4ZXpTdo+BTNOvUMYEhxWR+7Tl+upHLMhcEEPuEM0EiAObL53a9JELzGag==",
+      "version": "3.41.2",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.2.tgz",
+      "integrity": "sha512-bwJFAFAyvk9ysf+5zhBzMxrKus1Hj1AygUWdBNt+vQbM2sfSEf6701sa30KwfGyU8+cMuN6YNT5Mn63mFZIi/w==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -4247,7 +4247,8 @@
       "bin": {
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
-        "total-recall-memory": "bin/total-recall-memory.mjs"
+        "total-recall-memory": "bin/total-recall-memory.mjs",
+        "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {
         "playwright": "^1.60.0"

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,10 +1,10 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs && vitest run"
   },
   "license": "MIT",
   "dependencies": {
@@ -16,6 +16,9 @@
     "README.md",
     "LICENSE",
     "ui/",
-    "src/"
+    "capability/",
+    "src/",
+    "!src/**/*.spec.mjs",
+    "!src/**/*.test.mjs"
   ]
 }