total-recall-brain 3.41.1 → 3.41.3

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-merge.mjs

@@ -0,0 +1,131 @@
+/**
+ * Merge a stray secrets store into the host's single store.
+ *
+ * Per-repo stores grew when the CLI resolved its store from the cwd. This
+ * folds one of them back in without losing or silently replacing anything:
+ * a key the target lacks is imported with its metadata; a key with the same
+ * value only gains the source's repo binding and tags; a key whose value
+ * differs is a conflict and is never overwritten unless the operator names it,
+ * either taking the source value (`take`) or importing it under a new,
+ * app-specific name (`rename`). Values are never returned or logged.
+ */
+import crypto from 'node:crypto';
+import { loadSecrets, saveSecrets, ensureMeta, appendAudit, META_KEY } from './secrets-gateway.mjs';
+import { mergeSecretMeta, normalizeReposBinding, normalizeTags } from './secrets-store.mjs';
+
+const KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_.-]*$/;
+
+/** Values can be strings or JSON (account lists); compare by content, not reference. */
+const sameValue = (a, b) => (typeof a === 'string' || typeof b === 'string' ? a === b : JSON.stringify(a) === JSON.stringify(b));
+
+function fingerprint(value) {
+  return crypto.createHash('sha256').update(typeof value === 'string' ? value : JSON.stringify(value)).digest('hex').slice(0, 12);
+}
+
+/** The metadata worth showing an operator to decide a conflict. */
+function summary(meta = {}, value) {
+  return {
+    fingerprint: value ? fingerprint(value) : null,
+    provider: meta.provider || null,
+    repos: Array.isArray(meta.repos) ? meta.repos : [],
+    tags: Array.isArray(meta.tags) ? meta.tags : [],
+    created_at: meta.created_at || null,
+    updated_at: meta.updated_at || null,
+    rotated_at: meta.rotated_at || null,
+    tracking_status: meta.tracking_status || null,
+    tracking_synced_at: meta.tracking_synced_at || null,
+    key_valid: meta.key_valid ?? null,
+  };
+}
+
+/**
+ * @param {string} targetDir  brain dir of the single store
+ * @param {string} sourceDir  brain dir of the stray store
+ * @param {{ apply?: boolean, bindSame?: boolean, datesFromSource?: boolean, repo?: string, tags?: string[]|string, rename?: Record<string,string>,
+ *   take?: string[], actor?: string }} [opts]
+ * @returns {Promise<{ applied: boolean, imported: object[], same: object[], conflicts: object[], renamed: object[], taken: object[] }>}
+ */
+export async function mergeStore(targetDir, sourceDir, opts = {}) {
+  if (!targetDir || !sourceDir) throw new Error('merge-store needs a target and a source store');
+  if (targetDir === sourceDir) throw new Error('The source store is the target store');
+  const rename = opts.rename || {};
+  const take = new Set(opts.take || []);
+  for (const [from, to] of Object.entries(rename)) {
+    if (!KEY_PATTERN.test(from) || !KEY_PATTERN.test(to)) throw new Error(`Invalid rename ${from}=${to}`);
+    if (take.has(from)) throw new Error(`${from} cannot be both renamed and taken`);
+  }
+  const bindRepo = opts.repo ? normalizeReposBinding(opts.repo) : [];
+  const extraTags = opts.tags ? normalizeTags(opts.tags) : [];
+
+  const source = ensureMeta(await loadSecrets(sourceDir));
+  const target = ensureMeta(await loadSecrets(targetDir));
+  const sourceKeys = Object.keys(source).filter((k) => k !== META_KEY);
+  for (const k of [...Object.keys(rename), ...take]) {
+    if (!sourceKeys.includes(k)) throw new Error(`${k} is not in the source store`);
+  }
+
+  const report = { applied: false, imported: [], same: [], conflicts: [], renamed: [], taken: [] };
+  const now = new Date().toISOString();
+  const withBinding = (meta) => ({
+    repos: [...new Set([...(meta.repos || []), ...bindRepo])],
+    tags: [...new Set([...(meta.tags || []), ...extraTags])],
+  });
+
+  for (const key of sourceKeys) {
+    const value = source[key];
+    if (value === undefined || value === null || value === '') continue;
+    const sMeta = source[META_KEY].keys[key] || {};
+    const name = rename[key] || key;
+    const exists = name in target && target[name] !== '' && target[name] != null;
+    const tMeta = target[META_KEY].keys[name] || {};
+
+    if (rename[key]) {
+      if (exists && !sameValue(target[name], value)) throw new Error(`Rename target ${name} already holds a different value`);
+      target[name] = value;
+      target[META_KEY].keys[name] = mergeSecretMeta({ ...sMeta, ...tMeta }, { ...withBinding(sMeta), scope: 'global', created_at: sMeta.created_at || now, updated_at: now, notes: sMeta.notes || `merged from ${key}`, provides: key });
+      report.renamed.push({ from: key, to: name, ...summary(sMeta, value) });
+      continue;
+    }
+    if (!exists) {
+      target[name] = value;
+      target[META_KEY].keys[name] = mergeSecretMeta(sMeta, { ...withBinding(sMeta), scope: 'global', created_at: sMeta.created_at || now, updated_at: sMeta.updated_at || now });
+      report.imported.push({ key: name, ...summary(sMeta, value) });
+      continue;
+    }
+    if (sameValue(target[name], value)) {
+      // A store that was a copy of the global one says nothing about which keys
+      // the repo uses, so equal keys gain its binding only when asked.
+      if (opts.bindSame) target[META_KEY].keys[name] = mergeSecretMeta(tMeta, {
+        repos: [...new Set([...(tMeta.repos || []), ...(sMeta.repos || []), ...bindRepo])],
+        tags: [...new Set([...(tMeta.tags || []), ...(sMeta.tags || []), ...extraTags])],
+      });
+      // The value dates belong to the value: when it is identical, an older
+      // source date is the true one (repairs a date a label edit bumped).
+      if (opts.datesFromSource) {
+        const cur = target[META_KEY].keys[name] || {};
+        const fix = {};
+        for (const f of ['updated_at', 'rotated_at']) if (sMeta[f] && (!cur[f] || sMeta[f] < cur[f])) fix[f] = sMeta[f];
+        if (Object.keys(fix).length) { target[META_KEY].keys[name] = { ...cur, ...fix }; report.redated = (report.redated || 0) + 1; }
+      }
+      report.same.push({ key: name });
+      continue;
+    }
+    if (take.has(key)) {
+      const replaced = summary(tMeta, target[name]);
+      target[name] = value;
+      target[META_KEY].keys[name] = mergeSecretMeta(tMeta, { ...withBinding(tMeta), updated_at: now, notes: tMeta.notes || 'value taken from a merged store' });
+      report.taken.push({ key: name, replaced, with: summary(sMeta, value) });
+      continue;
+    }
+    report.conflicts.push({ key: name, target: summary(tMeta, target[name]), source: summary(sMeta, value) });
+  }
+
+  if (opts.apply) {
+    await saveSecrets(targetDir, target);
+    for (const row of [...report.imported, ...report.renamed, ...report.taken]) {
+      appendAudit(targetDir, { action: 'merge', key: row.key || row.to, from_key: row.from || null, actor: opts.actor || 'cli' });
+    }
+    report.applied = true;
+  }
+  return report;
+}

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-remote-deploy.mjs

@@ -18,7 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { buildEnvProjection, mergeEnvManagedBlock, projectSlugFromPath } from './secrets-env-export.mjs';
-import { resolveSecretsPath } from './secrets-store.mjs';
+import { resolveSecretsPath, loadSecrets, setSecret, secretValueFingerprint } from './secrets-store.mjs';
 import { authState } from './metadata-state.mjs';
 
 /**
@@ -114,6 +114,7 @@ function runSsh(target, remoteCommand, { input } = {}) {
     input: input != null ? input : undefined,
     encoding: 'utf8',
     timeout: 20000,
+    maxBuffer: 16 * 1024 * 1024,
   });
   return result;
 }
@@ -128,6 +129,7 @@ function quoteRemotePath(p) {
  */
 function fetchRemoteFile(target, remoteFile) {
   const r = runSsh(target, `cat ${quoteRemotePath(remoteFile)} 2>/dev/null || true`);
+  if (r.error || r.status !== 0) throw new Error(`SSH read failed for target "${target.name}": ${r.error?.message || (r.stderr || '').slice(0, 300)}`);
   if (r.error) throw new Error(`SSH connect failed for target "${target.name}": ${r.error.message}`);
   return r.stdout || '';
 }
@@ -209,7 +211,7 @@ export async function deployEnvToRemote(brainDir, targetName, opts = {}) {
   }
 
   const existing = fetchRemoteFile(target, remoteFile);
-  const merged = mergeEnvManagedBlock(existing, projection.body);
+  const merged = mergeEnvManagedBlock(existing, projection.body, { partial: Boolean(opts.keys?.length) });
   writeRemoteFile(target, remoteFile, merged);
 
   let restarted = false;
@@ -232,6 +234,113 @@ export async function deployEnvToRemote(brainDir, targetName, opts = {}) {
   };
 }
 
+/**
+ * Parse dotenv text into key -> { value, count }. The last assignment wins, as
+ * in dotenv; `count` exposes duplicates, which loaders resolve differently.
+ */
+export function parseDotenv(text) {
+  const out = new Map();
+  for (const raw of String(text || '').split(/\r?\n/)) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
+    if (!m) continue;
+    let value = m[2].trim();
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      try { value = JSON.parse(value); } catch { value = value.slice(1, -1); }
+    } else if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    } else {
+      value = value.replace(/\s+#.*$/, '');
+    }
+    out.set(m[1], { value, count: (out.get(m[1])?.count || 0) + 1 });
+  }
+  return out;
+}
+
+function findTarget(brainDir, targetName) {
+  const target = loadRemoteTargets(brainDir).find((t) => t.name === targetName);
+  if (!target) throw new Error(`Unknown remote target "${targetName}". List them with: total-recall auth secret remote list`);
+  return target;
+}
+
+/**
+ * Compare a deployed remote file with what the store would project there, key
+ * by key, by value fingerprint. Values never leave this process.
+ *
+ * @param {string} brainDir
+ * @param {string} targetName
+ * @param {{ keys?: string[], projectPath?: string }} opts
+ */
+export async function verifyRemote(brainDir, targetName, opts = {}) {
+  const target = findTarget(brainDir, targetName);
+  const projectPath = opts.projectPath || process.cwd();
+  const projection = await buildEnvProjection(brainDir, {
+    includeGlobal: target.includeGlobal !== false,
+    keys: opts.keys?.length ? opts.keys : target.keys,
+    projectPath,
+    projectSlug: projectSlugFromPath(projectPath),
+  });
+  const remoteFile = path.posix.join(target.remotePath, target.filename || '.env');
+  const remote = parseDotenv(fetchRemoteFile(target, remoteFile));
+  const projected = new Set(projection.entries.map(([key]) => key));
+  const rows = projection.entries.map(([key, value]) => {
+    const found = remote.get(key);
+    const status = !found ? 'missing'
+      : secretValueFingerprint(found.value) === secretValueFingerprint(value) ? 'match' : 'differs';
+    return { key, status, duplicates: found ? found.count - 1 : 0 };
+  });
+  return {
+    target: target.name,
+    host: target.host,
+    remoteFile,
+    rows,
+    remoteOnly: [...remote.keys()].filter((key) => !projected.has(key)),
+    ok: rows.every((row) => row.status === 'match' && !row.duplicates),
+  };
+}
+
+/**
+ * Move named keys out of a pm2 app's captured environment into the store, so
+ * the app can run from the store's projection instead. pm2 keeps the
+ * environment a process was first started with and lets it override the
+ * app's env file, which hides stale and unneeded credentials from the store.
+ * Only the keys asked for are read; nothing is printed.
+ *
+ * @param {string} brainDir
+ * @param {string} targetName
+ * @param {{ app: string, keys: string[], apply?: boolean, overwrite?: boolean, repos?: string[] }} opts
+ */
+export async function importFromPm2(brainDir, targetName, opts = {}) {
+  if (!opts.app) throw new Error('import-pm2 requires --app <pm2 process name>');
+  if (!opts.keys?.length) throw new Error('import-pm2 requires --keys: import only what the app needs');
+  const target = findTarget(brainDir, targetName);
+  const r = runSsh(target, 'pm2 jlist');
+  if (r.error || r.status !== 0) throw new Error(`pm2 jlist failed on "${target.name}": ${r.error?.message || (r.stderr || '').slice(0, 300)}`);
+  const raw = r.stdout || '';
+  let list;
+  // pm2 may print "[PM2] …" notices before the JSON array; start where the array does.
+  const start = raw.search(/^\[\s*(?:\{|\])/m);
+  try { list = JSON.parse(raw.slice(start)); } catch { throw new Error('pm2 jlist did not return JSON'); }
+  if (start === -1 || !Array.isArray(list)) throw new Error('pm2 jlist did not return JSON');
+  const proc = list.find((p) => p.name === opts.app);
+  if (!proc) throw new Error(`pm2 process "${opts.app}" not found on "${target.name}"`);
+  const env = proc.pm2_env?.env || {};
+  const secrets = await loadSecrets(brainDir);
+  const rows = [];
+  for (const key of opts.keys) {
+    const value = env[key] ?? proc.pm2_env?.[key];
+    if (value == null || value === '') { rows.push({ key, status: 'absent', applied: false }); continue; }
+    const stored = secrets[key];
+    const status = stored == null || stored === '' ? 'new' : String(stored) === String(value) ? 'same' : 'conflict';
+    let applied = false;
+    if (opts.apply && (status === 'new' || (status === 'conflict' && opts.overwrite))) {
+      await setSecret(brainDir, key, String(value), opts.repos?.length ? { repos: opts.repos } : {});
+      applied = true;
+    }
+    rows.push({ key, status, applied });
+  }
+  return { target: target.name, app: opts.app, rows };
+}
+
 /**
  * Deploy to every remote target that has this key bound via `keys`, or to
  * every target when the key list is unset (target opts into "all keys").

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-store.mjs

@@ -80,6 +80,9 @@ export function mergeSecretMeta(prev = {}, patch = {}) {
   });
   assign('auto_rotate', (v) => !!v);
   assign('notes', (v) => (v == null || v === '' ? null : String(v)));
+  // The app-facing name a production key stands in for: GRO_CRM_TICKETS_SIGNING_SECRET
+  // provides TICKETS_SIGNING_SECRET to the repos it is bound to (see resolveSecretKey).
+  assign('provides', (v) => (v == null || v === '' ? null : String(v)));
   assign('project_path', (v) => (v == null || v === '' ? null : String(v)));
   assign('headscale_url', (v) => (v == null || v === '' ? null : String(v)));
   // Command that prints the headscale server log. Watch mode needs it because
@@ -478,11 +481,13 @@ export async function updateSecretMeta(brainDir, key, patch = {}, opts = {}) {
     throw new Error(`Secret not found: ${key}`);
   }
   const prev = secrets[META_KEY].keys[key] || {};
-  secrets[META_KEY].keys[key] = mergeSecretMeta(prev, {
-    ...patch,
-    updated_at: new Date().toISOString(),
-    created_at: prev.created_at || new Date().toISOString(),
-  });
+  // updated_at dates the value (set, rotate). A metadata write — labels, account
+  // sync, tracking — records meta_updated_at instead, so it never makes a stale
+  // value look fresh or pushes back its rotation.
+  secrets[META_KEY].keys[key] = {
+    ...mergeSecretMeta(prev, { ...patch, created_at: prev.created_at || new Date().toISOString() }),
+    meta_updated_at: new Date().toISOString(),
+  };
   await saveSecrets(brainDir, secrets);
   appendAudit(brainDir, {
     action: 'meta',
@@ -555,6 +560,22 @@ export async function setSecret(brainDir, key, value, opts = {}) {
   return { key, set: true };
 }
 
+/**
+ * The store key that answers `key` for one repo. Production services own
+ * distinct credentials under app-specific names; a key bound to the repo whose
+ * `provides` is `key` wins over the plain (developer) key. Two such keys for the
+ * same repo and name are ambiguous and refused, never guessed between.
+ */
+export async function resolveSecretKey(brainDir, key, repo) {
+  if (!repo) return key;
+  const secrets = ensureMeta(await loadSecrets(brainDir));
+  const meta = secrets[META_KEY].keys;
+  const hits = Object.keys(meta).filter((k) => k !== key && meta[k]?.provides === key
+    && Array.isArray(meta[k].repos) && meta[k].repos.includes(repo) && secrets[k] != null && secrets[k] !== '');
+  if (hits.length > 1) throw new Error(`${hits.join(' and ')} both provide ${key} for ${repo}; keep one`);
+  return hits[0] || key;
+}
+
 /**
  * Get a secret value (CLI only — do not inject into surfaces).
  */

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/DESIGN.md

@@ -3,17 +3,65 @@
 ```yaml
 tokens:
   brand-name: "Auth & Secrets"
-  wordmark: "ENCLAVE AUTH"
+  wordmark: "AUTH & SECRETS"
   color-primary: "#10b981"
   color-background: "#064e3b"
   color-accent: "#34d399"
-  badge: "FIDO2 Enclave"
-  font-body: "system-ui, -apple-system, sans-serif"
-  font-mono: "'JetBrains Mono', monospace"
+  color-ok: "#059669"
+  color-warn: "#d97706"
+  color-danger: "#dc2626"
+  font-body: "Outfit, system-ui, sans-serif"
+  font-mono: "'JetBrains Mono', ui-monospace, monospace"
   border-radius: "8px"
+  density: "compact"
+  motion: "120ms ease-out"
 ```
 
-## Brand & Typographic Wordmark
-- **Name**: Auth & Secrets
-- **Wordmark Logo**: `ENCLAVE AUTH`
-- **Palette**: Deep Forest `#064e3b`, Emerald `#10b981`, Mint `#34d399`. Secure biometric FIDO2 WebAuthn & OAuth2 sessions.
+## Who this card is for
+
+The operator and autonomous agents managing access control, cryptographic secrets, and identities across the mesh.
+
+The operator opens this card during active administration: verifying biometric passkeys, checking Google OAuth token freshness, auditing 90-day secret rotation schedules, or inspecting active session integrity.
+
+## The four tasks, in the order the card presents them
+
+| Screen | Task Frequency | Operational Rationale |
+| :--- | :--- | :--- |
+| **Passkeys** | Daily / Routine | Biometric hardware authentication via WebAuthn FIDO2. The operator checks registered authenticators and manages credential devices. |
+| **Google OAuth** | Frequent | Identity bridge accounts. The operator monitors token expiration, executes manual refreshes, and reviews account scopes. |
+| **Secrets** | Continuous | Cryptographic credential vault. The operator audits key freshness, tracks rotation deadlines, and checks provider bindings. |
+| **Audit & Sessions** | Incident / Review | Security baseline verification. The operator inspects live access sessions and reviews policy findings. |
+
+Screen ordering follows task frequency and operational urgency rather than arbitrary command taxonomy.
+
+## The core tasks
+
+1. **Verify security posture instantly** — confirm that the secrets store is sealed, zero rotation schedules are overdue, and the security audit baseline passes.
+2. **Manage biometric hardware passkeys** — inspect registered platform authenticators (Face ID, Touch ID, Windows Hello) and security keys (YubiKey), register new authenticators, and safely revoke decommissioned hardware.
+3. **Supervise OAuth tokens** — verify Google OAuth connection status, monitor token lifetime, refresh expiring credentials, and safely disconnect accounts.
+4. **Audit secret hygiene** — review key expiration dates, inspect multi-repo bindings, verify remote deployment targets, and trigger rotation workflows without exposing secret values to the DOM.
+
+## What must be visible without a single click
+
+- **Security Verdict Line:** A clear verdict ("Secure" or the count of active warnings) and timestamp of the latest verification.
+- **Passkey Count:** Total active hardware authenticators registered on the system.
+- **OAuth Status:** Connected accounts and token health status.
+- **Secrets Store Telemetry:** Total stored keys and count of overdue rotations.
+- **Baseline Audit State:** System security verification status (Passed or Flagged).
+
+## Why the layout is this layout
+
+The card face provides a wide, responsive workspace rather than a narrow column.
+
+- **Security Verdict at the Top:** The operator requires an immediate assessment. A prominent verdict line answers whether the authentication system is healthy before secondary details appear.
+- **Horizontal Task Navigation:** Four dedicated domain screens (Passkeys, Google OAuth, Secrets, Audit & Sessions) organize operations by user intent rather than raw CLI syntax.
+- **Zero Raw Secrets in DOM:** Secret values are never rendered, logged, or accepted via input fields. The interface exposes only key names, providers, fingerprints, creation timestamps, and rotation schedules.
+- **Safe Revocation Guards:** Destructive actions such as credential revocation require explicit confirmation and display prominent warning styling. Deleting the final authentication method is blocked to prevent accidental administrative lockout.
+- **Real Telemetry Only:** All figures render em dashes (`—`) until returned by the host. Zero mock responses, zero seeded numbers, and zero reassuring default strings appear in error branches.
+
+## Responsive presentation and accessibility
+
+- **Breakpoints:** Verified across mobile (360 CSS px), tablet (768 CSS px), and desktop (1280 CSS px) viewports.
+- **Host Theme Adaptation:** Injected dark-dashboard variables (`--text-primary`, `--text-secondary`, `--bg-primary`, `--bg-secondary`, `--border`, `--accent`) govern surfaces and typography.
+- **Touch Targets:** All interactive controls declare a minimum height of 44 px.
+- **Reduced Motion:** All transitions and indicators respect `prefers-reduced-motion` settings.