total-recall-brain 3.41.2 → 3.41.3

package/frontend/dist/index.html

@@ -17,8 +17,8 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,600;12..96,800&family=Cabinet+Grotesk:wght@700;800&family=Chivo+Mono:wght@500;700&family=Cinzel:wght@600;700;900&family=Cormorant+Garamond:ital,wght@0,600;0,700;1,600;1,700&family=DM+Mono:wght@500&family=DM+Sans:wght@500;700&family=Fraunces:opsz,wght@9..144,600;9..144,800&family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&family=Lexend:wght@600;800&family=Newsreader:ital,opsz,wght@0,6..72,600;1,6..72,600&family=Orbitron:wght@700;900&family=Outfit:wght@500;700;800&family=Plus+Jakarta+Sans:wght@600;700;800&family=Space+Grotesk:wght@600;700&family=Syne:wght@700;800&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-BtuiZqwP.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BG9NkVUy.css">
+    <script type="module" crossorigin src="/assets/index-DFenQQEQ.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BIQmqDKP.css">
   </head>
   <body>
     <div id="root"></div>

package/frontend/dist/sw.js

@@ -124,12 +124,15 @@ async function staleWhileRevalidate(request) {
 // ─── Cache-First ──────────────────────────────────────────────────────────────
 
 async function cacheFirst(request) {
-  const cached = await caches.match(request);
-  if (cached) return cached;
+  try {
+    const cached = await caches.match(request);
+    if (cached) return cached;
+  } catch {
+    // unreadable cache entry: fall through to the network
+  }
   const response = await fetch(request);
-  if (response && response.ok && response.status === 200) {
-    const cache = await caches.open(CACHE_NAME);
-    cache.put(request, response.clone()).catch(() => {});
+  if (response && response.ok && response.status === 200 && response.type === 'basic') {
+    caches.open(CACHE_NAME).then((cache) => cache.put(request, response.clone())).catch(() => {});
   }
   return response;
 }

package/frontend/src/api/auth.ts

@@ -75,7 +75,6 @@ export async function logout(): Promise<void> {
 export interface AuthProvidersResponse {
   password: { configured: boolean }
   passkey: { enabled: boolean; has_passkeys: boolean; count: number }
-  google: { configured: boolean; client_id: string | null }
 }
 
 export async function getAuthProviders(): Promise<AuthProvidersResponse> {
@@ -85,13 +84,11 @@ export async function getAuthProviders(): Promise<AuthProvidersResponse> {
     return {
       password: { configured: true },
       passkey: { enabled: false, has_passkeys: false, count: 0 },
-      google: { configured: false, client_id: null },
     }
   } catch {
     return {
       password: { configured: true },
       passkey: { enabled: false, has_passkeys: false, count: 0 },
-      google: { configured: false, client_id: null },
     }
   }
 }

package/frontend/src/components/plugins/PluginPanel.tsx

@@ -20,7 +20,8 @@ export function pluginElements(plugin: PluginInfo): PluginElement[] {
 /** Loads owner code; no plugin identities or provider behavior belong here. */
 export function PluginPanel({ plugin, elementId, readOnly = false }: { plugin: PluginInfo; elementId?: string; readOnly?: boolean }) {
   const elements = pluginElements(plugin).filter(element => element.kind !== 'settings' && (!elementId || element.id === elementId))
-  const [selected, setSelected] = useState(elements[0]?.id || '')
+  const cardElement = elements.find(item => item.kind === 'card')
+  const [selected, setSelected] = useState(elementId || cardElement?.id || elements[0]?.id || '')
   const [error, setError] = useState('')
   const frame = useRef<HTMLIFrameElement>(null)
   const [document, setDocument] = useState('')
@@ -67,7 +68,7 @@ export function PluginPanel({ plugin, elementId, readOnly = false }: { plugin: P
       if (data.type !== 'run') return
       const target = event.source as Window
       const reply = (result?: unknown, error?: string) => { if (!disposed) target.postMessage({ channel, type: 'result', requestId: data.requestId, result, error }, '*') }
-      if (!allowedFrameCommand(data, allowed, secretCommands) || active >= 4) { reply(undefined, 'Operation is not available'); return }
+      if (!allowedFrameCommand(data, allowed, secretCommands) || active >= 12) { reply(undefined, 'Operation is not available'); return }
       active++
       window.dispatchEvent(new CustomEvent('plugin-command-activity', { detail: { pluginId: plugin.id, requestId: data.requestId, command: data.subcommand, running: true } }))
       try {
@@ -106,8 +107,11 @@ export function PluginPanel({ plugin, elementId, readOnly = false }: { plugin: P
     return dispose
   }, [plugin.id, selected, plugin.sha256, elementId, readOnly])
 
+  const currentElement = elements.find(item => item.id === selected) || elements[0]
+  const showNav = elements.length > 1 && currentElement?.kind !== 'card'
+
   return <section>
-    {elements.length > 1 && <nav style={{ display: 'flex', gap: 8 }}>
+    {showNav && <nav style={{ display: 'flex', gap: 8 }}>
       {elements.map(element => <button key={element.id} className="btn btn-sm" onClick={() => setSelected(element.id)} aria-pressed={selected === element.id}>{element.description || element.id}</button>)}
     </nav>}
     {error && <div role="alert" className="alert alert-error">{error}</div>}

package/frontend/src/components/plugins/card/CardEngine.tsx

@@ -98,7 +98,7 @@ export function CardEngine({ plugin }: { plugin: PluginInfo }) {
       {card.description && <p className="card-muted card-description">{card.description}</p>}
       <CardScenes plugin={plugin}>
         {card.face
-          ? <PluginPanel plugin={plugin} elementId={card.face.id} readOnly />
+          ? <PluginPanel plugin={plugin} elementId={card.face.id} />
           : <p className="card-error" role="alert">{plugin.name} has not supplied its card face.</p>}
       </CardScenes>
       {card.branding.provider && <footer className="card-footer">{card.branding.provider.url ? <a href={card.branding.provider.url} target="_blank" rel="noreferrer noopener">{card.branding.provider.name}</a> : card.branding.provider.name} is a trademark of its owner. This plugin connects to the service with your own account.</footer>}

package/frontend/src/pages/LoginPage.tsx

@@ -88,14 +88,6 @@ export default function LoginPage({ onAuthenticated }: Props) {
     }
   }
 
-  function handleGoogleLogin() {
-    if (providers?.google && !providers.google.configured) {
-      setError("Google OAuth2 is not configured. Provide GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in the Auth Plugin.")
-      return
-    }
-    window.location.href = "/auth/google"
-  }
-
   useEffect(() => {
     inputRef.current?.focus()
   }, [needsReset, isFirstTime])
@@ -324,7 +316,7 @@ export default function LoginPage({ onAuthenticated }: Props) {
           </button>
         </form>
 
-        {(!needsReset && !isFirstTime && (providers?.passkey?.has_passkeys || providers?.google?.configured)) && (
+        {(!needsReset && !isFirstTime && providers?.passkey?.has_passkeys) && (
           <div style={{ display: "flex", flexDirection: "column", gap: 10, marginTop: -4 }}>
             <div style={{ display: "flex", alignItems: "center", gap: 12, margin: "6px 0" }}>
               <div style={{ flex: 1, height: 1, background: "var(--border)" }} />
@@ -376,38 +368,6 @@ export default function LoginPage({ onAuthenticated }: Props) {
                 )}
               </button>
             )}
-
-            {providers?.google?.configured && (
-              <button
-                type="button"
-                id="btn-google-login"
-                onClick={handleGoogleLogin}
-                disabled={loading || passkeyLoading}
-                className="btn btn-secondary"
-                style={{
-                  width: "100%",
-                  minHeight: 44,
-                  justifyContent: "center",
-                  fontSize: 13.5,
-                  borderRadius: 12,
-                  display: "flex",
-                  alignItems: "center",
-                  gap: 8,
-                  background: "rgba(255, 255, 255, 0.05)",
-                  borderColor: "rgba(255, 255, 255, 0.15)",
-                  color: "var(--text-primary)",
-                  cursor: loading || passkeyLoading ? "not-allowed" : "pointer",
-                }}
-              >
-                <svg width="16" height="16" viewBox="0 0 24 24">
-                  <path fill="#4285F4" d="M23.745 12.27c0-.7-.06-1.4-.19-2.07H12v4.51h6.6c-.29 1.52-1.14 2.82-2.4 3.68v3.05h3.88c2.27-2.09 3.665-5.17 3.665-9.17z"/>
-                  <path fill="#34A853" d="M12 24c3.24 0 5.95-1.08 7.93-2.91l-3.88-3.05c-1.08.72-2.45 1.16-4.05 1.16-3.12 0-5.77-2.1-6.72-4.93H1.25v3.15C3.26 21.36 7.33 24 12 24z"/>
-                  <path fill="#FBBC05" d="M5.28 14.27c-.25-.72-.38-1.49-.38-2.27s.13-1.55.38-2.27V6.58H1.25C.45 8.18 0 9.99 0 12s.45 3.82 1.25 5.42l4.03-3.15z"/>
-                  <path fill="#EA4335" d="M12 4.75c1.77 0 3.35.61 4.6 1.8l3.42-3.42C17.95 1.19 15.24 0 12 0 7.33 0 3.26 2.64 1.25 6.58l4.03 3.15c.95-2.83 3.6-4.98 6.72-4.98z"/>
-                </svg>
-                Sign in with Google
-              </button>
-            )}
           </div>
         )}
 

package/frontend/src/pages/PluginsPage.tsx

@@ -22,7 +22,6 @@ import {
 import { renderMarkdown } from "../components/MarkdownUtils"
 import { PluginPanel, pluginElements } from "../components/plugins/PluginPanel"
 import { PluginSettings } from "../components/plugins/PluginSettings"
-import { CardEngine } from "../components/plugins/card/CardEngine"
 
 interface PluginsPageProps {
   activeBrainId?: string | null
@@ -76,8 +75,8 @@ const AGENT_RECIPE_PROMPT = `You are my coding agent. Author a bespoke Total Rec
    - Real interactive controls executing plugin subcommands via host.run(subcommand, args)
 
 4. Distribution:
-   - Private: keep in .agent/skills/total-recall/plugins/<id>
-   - Store: publish via total-recall deploy-store <id>`
+   - Private: keep in .agent/plugins/<id>
+   - Mesh: share peer-to-peer via total-recall plugin share <id>`
 
 function resolvePluginBranding(p: { id: string; branding?: { icon?: string | null; color?: string | null; badge?: string | null } }) {
   const custom = p.branding || {}
@@ -499,7 +498,7 @@ export default function PluginsPage({ activeBrainId }: PluginsPageProps) {
       setWorkspaceActiveIds(next)
       try { localStorage.setItem("tr_workspace_plugins", JSON.stringify([...next])) } catch {}
       await setPluginActivation(p.id, false)
-      setAlert({ type: "success", message: `Moved ${p.name} from workspace to Plugin Store` })
+      setAlert({ type: "success", message: `Deactivated card for ${p.name}` })
       await loadLocal()
     } catch (err: any) {
       setAlert({ type: "error", message: err?.message || `Could not deactivate ${p.name}` })
@@ -772,7 +771,7 @@ export default function PluginsPage({ activeBrainId }: PluginsPageProps) {
       <div style={{ display: "flex", justifyContent: "space-between", gap: "12px", flexWrap: "wrap", marginBottom: "20px" }}>
         <div role="tablist" style={{ display: "flex", gap: "8px" }}>
           {tabButton("installed", "My Cards", myCards.length)}
-          {tabButton("bundled", "Plugin Store (Bundled)", filteredStoreCatalog.length)}
+          {tabButton("bundled", "Plugin Catalog", filteredStoreCatalog.length)}
           {tabButton("mesh", "On the mesh")}
         </div>
         <div style={{ display: "flex", gap: "8px", flexWrap: "wrap" }}>
@@ -795,7 +794,7 @@ export default function PluginsPage({ activeBrainId }: PluginsPageProps) {
                 </div>
                 <div style={muted}>
                   {viewMode === "workspace"
-                    ? "Core runtime foundation and activated repository cards. Optional tools live in the Plugin Store."
+                    ? "Core runtime foundation and activated repository cards. Standalone tools live in the Plugin Catalog."
                     : "All plugin packages installed on this host."}
                 </div>
               </div>
@@ -839,7 +838,7 @@ export default function PluginsPage({ activeBrainId }: PluginsPageProps) {
                       onTouchEnd={cancelLongPress}
                       style={{ display: "flex", flexDirection: "column", gap: "8px", minWidth: 0 }}
                     >
-                      <CardEngine plugin={p} />
+                      <PluginPanel plugin={p} />
                       <div style={{ display: "flex", justifyContent: "space-between", alignItems: "center", padding: "0 4px", fontSize: "11px", color: "var(--text-tertiary)", flexWrap: "wrap", gap: "6px" }}>
                         <div style={{ display: "flex", gap: "6px", alignItems: "center", flexWrap: "wrap" }}>
                           <span className="badge">{p.scope}</span>
@@ -848,6 +847,14 @@ export default function PluginsPage({ activeBrainId }: PluginsPageProps) {
                           {!p.valid && <span className="badge badge-error">invalid manifest</span>}
                           {p.modified_since_install && <span className="badge badge-warning">changed since install</span>}
                         </div>
+                        <button
+                          type="button"
+                          className="btn btn-ghost btn-xs"
+                          onClick={() => openDetail(p, "details")}
+                          style={{ fontSize: "11px", color: "var(--text-secondary)" }}
+                        >
+                          Settings &amp; usage
+                        </button>
                         {!DEFAULT_CORE_PLUGINS.has(p.id) && (
                           <button
                             type="button"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.41.2",
+  "version": "3.41.3",
   "description": "The Vibe Coding Brain & Autonomous Software Factory: memory, rules, secrets, and 33 visual plugins automatically managed across all your devices.",
   "type": "module",
   "bin": {
@@ -76,7 +76,7 @@
   "homepage": "https://github.com/gregiteen/total-recall#readme",
   "dependencies": {
     "@simplewebauthn/server": "^13.3.2",
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.11.2",
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.12.1",
     "bcrypt": "^6.0.0",
     "better-sqlite3": "^12.11.1",
     "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/plugin/scripts/record.mjs

@@ -47,7 +47,9 @@ function walk(dir, out = [], base = root) {
 /* ── manifest ────────────────────────────────────────────────────────────── */
 
 let manifest = null;
-if (want('--manifest')) {
+// Every selected section depends on manifest facts. Section filtering must not
+// skip prerequisite loading and then report a vacuous successful check run.
+{
   const file = path.join(root, 'plugin.json');
   if (!fs.existsSync(file)) {
     record('manifest', 'FAIL', 'plugin.json exists', 'no plugin.json in ' + root);
@@ -62,7 +64,7 @@ if (want('--manifest')) {
 }
 
 // Validate with the real contract when this skill is inside a Total Recall checkout.
-if (manifest) {
+if (manifest && want('--manifest')) {
   const loaderPath = path.resolve(import.meta.dirname, '../../../../src/core/plugin-loader.mjs');
   if (fs.existsSync(loaderPath)) {
     try {
@@ -82,7 +84,8 @@ if (manifest) {
 
   // Card declaration
   const elements = manifest.ui?.elements || [];
-  const faces = elements.filter((e) => e && (e.kind === 'card' || e.kind === 'panel'));
+  // One face (kind 'card') plus any number of screens (kind 'panel'); a panel is never the face.
+  const faces = elements.filter((e) => e && e.kind === 'card');
   if (manifest.card_layout !== undefined) {
     record('manifest', 'FAIL', 'no template', "'card_layout' is declared; a face is bespoke owner code");
   } else {

package/scaffold/.agent/skills/total-recall/plugins/auth/cli.mjs

@@ -9,6 +9,7 @@
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { hostSecretsBrainDir } from './src/host-secrets-store.mjs';
 
 function resolveTrPath() {
   const localTr = path.join(process.cwd(), 'bin', 'total-recall.mjs');
@@ -19,13 +20,13 @@ function resolveTrPath() {
 }
 
 async function resolveSecret(key) {
-  const { getSecret, defaultBrainDir } = await import('./src/secrets-store.mjs');
-  const result = await getSecret(process.env.TR_SECRETS_BRAIN || defaultBrainDir(), key, { actor: 'auth-cli', action: 'use' });
+  const { getSecret } = await import('./src/secrets-store.mjs');
+  const result = await getSecret(hostSecretsBrainDir(), key, { actor: 'auth-cli', action: 'use' });
   return result.found ? result.value : null;
 }
 
 function resolveBrainDir() {
-  return process.env.TR_SECRETS_BRAIN || process.env.TR_BRAIN || path.join(process.env.HOME || '', '.agent', 'skills', 'total-recall');
+  return hostSecretsBrainDir();
 }
 
 async function listStoredPasskeys() {
@@ -33,7 +34,11 @@ async function listStoredPasskeys() {
   return listPasskeys(resolveBrainDir());
 }
 
-async function handleStatus(json) {
+async function handleStatus(subArgs, json) {
+  if (Array.isArray(subArgs) && (subArgs.includes('--help') || subArgs.includes('-h') || subArgs[0] === 'help')) {
+    console.log('Usage: total-recall auth status [--json]');
+    return;
+  }
   const passkeys = await listStoredPasskeys();
   const googleClientId = await resolveSecret('GOOGLE_CLIENT_ID');
   const googleClientSecret = await resolveSecret('GOOGLE_CLIENT_SECRET');
@@ -87,9 +92,15 @@ async function handleStatus(json) {
 }
 
 async function handlePasskey(subArgs, json) {
-  const passkeys = await listStoredPasskeys();
   const action = subArgs[0] || 'list';
 
+  if (action === 'help' || action === '--help' || action === '-h') {
+    console.log('Usage: total-recall auth passkey [list|status|delete <id>] [--json]');
+    return;
+  }
+
+  const passkeys = await listStoredPasskeys();
+
   if (action === 'list') {
     if (json) {
       console.log(JSON.stringify({ count: passkeys.length, passkeys }, null, 2));
@@ -112,25 +123,80 @@ async function handlePasskey(subArgs, json) {
     return;
   }
 
+  if (action === 'delete' || action === 'remove' || action === 'rm') {
+    const id = subArgs[1];
+    if (!id) {
+      console.error('Credential ID required: total-recall auth passkey delete <id>');
+      process.exitCode = 1;
+      return;
+    }
+    const { deletePasskey } = await import('./src/webauthn-store.mjs');
+    const result = deletePasskey(resolveBrainDir(), id);
+    if (!result.found) {
+      console.error(`Passkey not found: ${id}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (json) {
+      console.log(JSON.stringify({ success: true, deleted: id }));
+    } else {
+      console.log(`Passkey removed: ${id}`);
+    }
+    return;
+  }
+
   console.error(`Unknown passkey action: ${action}`);
   process.exitCode = 1;
 }
 
 async function handleGoogle(subArgs, json) {
+  const action = subArgs[0] || 'status';
+  if (action === 'help' || action === '--help' || action === '-h') {
+    console.log('Usage: total-recall auth google [status|connect|accounts|refresh <id>|disconnect <id>] [--json]');
+    return;
+  }
   const { createGoogleOAuth } = await import('./src/google-oauth.mjs');
   const google = createGoogleOAuth({ brainDir: resolveBrainDir() });
-  const action = subArgs[0] || 'status';
-  if (action === 'accounts') { console.log(JSON.stringify({ accounts: google.status() })); return; }
+  if (action === 'accounts') {
+    const accounts = google.status();
+    if (json) {
+      console.log(JSON.stringify({ accounts }));
+    } else {
+      console.log(`Google Connected Accounts: ${accounts.length}`);
+      for (const a of accounts) {
+        console.log(`  • [${a.status}] ${a.email || a.account_id} (Expires: ${a.expiry || 'never'})`);
+      }
+    }
+    return;
+  }
   if (action === 'refresh' || action === 'disconnect') {
-    if (!subArgs[1]) throw new Error('Google account identifier required');
-    if (action === 'refresh') { await google.access(subArgs[1]); console.log(JSON.stringify({ accounts: google.status() })); }
-    else console.log(JSON.stringify(await google.disconnect(subArgs[1])));
+    if (!subArgs[1]) {
+      console.error(`Google account identifier required: total-recall auth google ${action} <id>`);
+      process.exitCode = 1;
+      return;
+    }
+    if (action === 'refresh') {
+      await google.access(subArgs[1]);
+      const accounts = google.status();
+      if (json) console.log(JSON.stringify({ accounts }));
+      else console.log(`Account ${subArgs[1]} refreshed.`);
+    } else {
+      const res = await google.disconnect(subArgs[1]);
+      if (json) console.log(JSON.stringify(res));
+      else console.log(`Account ${subArgs[1]} disconnected.`);
+    }
+    return;
+  }
+  if (!['status', 'connect'].includes(action)) {
+    console.error(`Unknown action: ${action}. Use: total-recall auth google [status|connect|accounts|refresh|disconnect]`);
+    process.exitCode = 1;
     return;
   }
-  if (!['status', 'connect'].includes(action)) throw new Error('Use google status|connect|accounts|refresh|disconnect');
   let cfg;
   try { cfg = google.config(); } catch {
-    console.log(JSON.stringify({ configured: false, error: 'Configure GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and GOOGLE_REDIRECT_URI in auth' })); process.exitCode = 2; return;
+    console.log(JSON.stringify({ configured: false, error: 'Configure GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and GOOGLE_REDIRECT_URI in auth' }));
+    process.exitCode = 2;
+    return;
   }
   // Browser initiation sets its own HttpOnly state cookie; never manufacture a state-less consent URL in the CLI.
   const authUrl = new URL('/auth/google', cfg.redirectUri).href;
@@ -138,7 +204,11 @@ async function handleGoogle(subArgs, json) {
   console.log(json ? JSON.stringify(out) : `Open sign-in: ${authUrl}`);
 }
 
-async function handleProbe(json) {
+async function handleProbe(subArgs, json) {
+  if (Array.isArray(subArgs) && (subArgs.includes('--help') || subArgs.includes('-h') || subArgs[0] === 'help')) {
+    console.log('Usage: total-recall auth probe [--json]');
+    return;
+  }
   const host = process.env.TR_HOST || 'http://localhost:3000';
   const endpoints = ['/auth/status', '/auth/providers', '/health'];
   const results = [];
@@ -182,7 +252,11 @@ async function handleProbe(json) {
   if (!allOk) process.exitCode = 1;
 }
 
-async function handleSession(json) {
+async function handleSession(subArgs, json) {
+  if (Array.isArray(subArgs) && (subArgs.includes('--help') || subArgs.includes('-h') || subArgs[0] === 'help')) {
+    console.log('Usage: total-recall auth session [--json]');
+    return;
+  }
   const brain = resolveBrainDir();
   const secretExists = Boolean(await resolveSecret('SESSION_SECRET'));
 
@@ -208,7 +282,11 @@ async function handleSecret(subArgs, json) {
   await secretCli(forwarded);
 }
 
-async function handleAudit(json) {
+async function handleAudit(subArgs, json) {
+  if (Array.isArray(subArgs) && (subArgs.includes('--help') || subArgs.includes('-h') || subArgs[0] === 'help')) {
+    console.log('Usage: total-recall auth audit [--json]');
+    return;
+  }
   const brain = resolveBrainDir();
   const webauthnPath = path.join(brain, 'config', 'webauthn.json');
   const findings = [];
@@ -284,16 +362,41 @@ async function handleAudit(json) {
 }
 
 async function handleRotate(subArgs, json) {
+  if (Array.isArray(subArgs) && (subArgs.includes('--help') || subArgs.includes('-h') || subArgs[0] === 'help')) {
+    console.log('Usage: total-recall auth rotate [--collaboration] [--json]');
+    return;
+  }
   const { createSessionCredentials } = await import('./src/session-credentials.mjs');
   const { defaultBrainDir } = await import('./src/secrets-store.mjs');
   const purpose = subArgs.includes('--collaboration') ? 'collaboration' : 'dashboard';
   const result = createSessionCredentials({ brainDir: process.env.TR_SECRETS_BRAIN || defaultBrainDir() }).rotateSession(purpose);
   console.log(json ? JSON.stringify(result) : 'Auth signing credential rotated; existing sessions are invalidated.');
 }
+
 async function handlePassword(args, json) {
-  if (args[0] !== 'set' || !args.includes('--stdin') || args.slice(1).some(value => !['--stdin', '--force-reset'].includes(value))) throw new Error('Use auth password set --stdin');
+  if (!Array.isArray(args) || args.includes('--help') || args.includes('-h') || args[0] === 'help') {
+    console.log('Usage: total-recall auth password set --stdin [--force-reset]');
+    console.log('       total-recall auth password status [--json]');
+    return;
+  }
+  if (args[0] === 'status') {
+    const { createSessionCredentials } = await import('./src/session-credentials.mjs');
+    const state = createSessionCredentials({ brainDir: resolveBrainDir() }).dashboardState();
+    if (json) {
+      console.log(JSON.stringify(state));
+    } else {
+      console.log(`Dashboard Password: ${state.configured ? 'Configured' : 'Not configured'}`);
+      if (state.forcePasswordReset) console.log('  • Password reset is currently enforced');
+    }
+    return;
+  }
+  if (args[0] !== 'set' || !args.includes('--stdin') || args.slice(1).some(value => !['--stdin', '--force-reset'].includes(value))) {
+    console.error('Use: total-recall auth password set --stdin [--force-reset]');
+    process.exitCode = 1;
+    return;
+  }
   const chunks = []; let size = 0;
-  for await (const chunk of process.stdin) { size += chunk.length; if (size > 8192) throw new Error('Password input exceeds limit'); chunks.push(chunk); }
+  for await (const chunk of process.stdin) { size += chunk.length; if (size > 8192) { console.error('Password input exceeds limit'); process.exitCode = 1; return; } chunks.push(chunk); }
   const password = Buffer.concat(chunks).toString('utf8').replace(/\r?\n$/, '');
   const { createSessionCredentials } = await import('./src/session-credentials.mjs');
   const result = await createSessionCredentials({ brainDir: resolveBrainDir() }).setDashboardPassword(password, { forcePasswordReset: args.includes('--force-reset') });
@@ -313,10 +416,10 @@ export async function run(argv = []) {
 
   switch (command) {
     case 'status':
-      await handleStatus(isJson);
+      await handleStatus(rest, isJson);
       break;
     case 'audit':
-      await handleAudit(isJson);
+      await handleAudit(rest, isJson);
       break;
     case 'rotate':
       await handleRotate(rest, isJson);
@@ -328,32 +431,95 @@ export async function run(argv = []) {
       await handlePasskey(rest, isJson);
       break;
     case 'key': {
+      if (rest.includes('--help') || rest.includes('-h') || rest[0] === 'help') {
+        console.log('Usage: total-recall auth key list [--json]');
+        console.log('       total-recall auth key issue <name> --scopes <csv> [--role <role>] [--kind <kind>] [--expires <date>] [--json]');
+        console.log('       total-recall auth key revoke <id> [--json]');
+        console.log('       total-recall auth key usage [id] [--json]');
+        console.log('       total-recall auth key roles [--json]');
+        console.log('       total-recall auth key role-set <name> --scopes <csv> [--json]');
+        break;
+      }
       const { createKeyStore } = await import('./src/access-keys.mjs');
       const store = createKeyStore({ brainDir: resolveBrainDir() });
       const [action = 'list', id] = rest;
       const flag = name => { const at = rest.indexOf(name); return at < 0 ? undefined : rest[at + 1]; };
       let result;
-      if (action === 'list') result = store.loadKeys().map(({ token_hash, ...key }) => key);
-      else if (action === 'issue') result = store.issueKey(id, { scopes: flag('--scopes')?.split(','), role: flag('--role'), kind: flag('--kind'), expires_at: flag('--expires') });
-      else if (action === 'revoke') result = store.revokeKey(id);
-      else if (action === 'usage') result = store.listKeyUsage(id);
-      else if (action === 'roles') result = store.loadRoles();
-      else if (action === 'role-set') result = store.setRole(id, flag('--scopes')?.split(','));
-      else throw new Error('Use auth key list|issue <name> --scopes <csv> [--role role] [--expires date]|revoke <id>|usage [id]|roles|role-set <name> --scopes <csv>');
-      console.log(JSON.stringify(result)); break;
+      if (action === 'list') {
+        const keys = store.loadKeys().map(({ token_hash, ...key }) => key);
+        if (isJson) {
+          console.log(JSON.stringify(keys));
+        } else {
+          console.log(`Access Keys: ${keys.length}`);
+          for (const k of keys) {
+            const status = k.revoked ? '[REVOKED]' : '[ACTIVE]';
+            console.log(`  • ${status} ${k.name} (${k.token_prefix}…)`);
+            console.log(`    ID: ${k.id}`);
+            console.log(`    Scopes: ${(k.scopes || []).join(', ') || 'none'}`);
+            if (k.expires_at) console.log(`    Expires: ${k.expires_at}`);
+            if (k.last_used_at) console.log(`    Last used: ${k.last_used_at} (${k.hit_count} hits)`);
+          }
+        }
+        break;
+      } else if (action === 'issue') {
+        result = store.issueKey(id, { scopes: flag('--scopes')?.split(','), role: flag('--role'), kind: flag('--kind'), expires_at: flag('--expires') });
+      } else if (action === 'revoke') {
+        result = store.revokeKey(id);
+      } else if (action === 'usage') {
+        result = store.listKeyUsage(id);
+      } else if (action === 'roles') {
+        result = store.loadRoles();
+      } else if (action === 'role-set') {
+        result = store.setRole(id, flag('--scopes')?.split(','));
+      } else {
+        console.error('Use: total-recall auth key list|issue|revoke|usage|roles|role-set');
+        process.exitCode = 1;
+        break;
+      }
+      if (isJson) {
+        console.log(JSON.stringify(result));
+      } else {
+        if (action === 'issue') {
+          console.log(`Key issued: ${result.name} (${result.id})`);
+          console.log(`Token: ${result.token}`);
+          console.log('Store this token now; it will not be displayed again.');
+        } else if (action === 'revoke') {
+          console.log(`Key revoked: ${id}`);
+        } else {
+          console.log(JSON.stringify(result, null, 2));
+        }
+      }
+      break;
     }
     case 'agent': {
       // Sign in an agent CLI that authenticates on its own terminal. The pty lives in
       // scripts/agent-login-pty.py because Node has none and this plugin carries no pty library;
       // this routes the plugin's own surface to it.
+      if (rest.includes('--help') || rest.includes('-h') || rest[0] === 'help') {
+        console.log('Usage: total-recall auth agent list [--json]');
+        console.log('       total-recall auth agent login <agent> [--code <code>] [--code-file <path>] [--url-file <path>] [--json]');
+        break;
+      }
       const { loginAgent, AGENT_LOGIN_PROFILES } = await import('./src/agent-login.mjs');
       const [action = 'list', name] = rest;
       const flag = (n) => { const at = rest.indexOf(n); return at < 0 ? undefined : rest[at + 1]; };
       if (action === 'list') {
-        console.log(JSON.stringify(Object.keys(AGENT_LOGIN_PROFILES).map((id) => ({ id, ...AGENT_LOGIN_PROFILES[id] }))));
+        const list = Object.keys(AGENT_LOGIN_PROFILES).map((id) => ({ id, ...AGENT_LOGIN_PROFILES[id] }));
+        if (isJson) {
+          console.log(JSON.stringify(list));
+        } else {
+          console.log('Supported Agent Profiles:');
+          for (const item of list) {
+            console.log(`  • ${item.id}: ${item.name || item.id}`);
+          }
+        }
+        break;
+      }
+      if (action !== 'login') {
+        console.error('Use: total-recall auth agent list | total-recall auth agent login <agent>');
+        process.exitCode = 1;
         break;
       }
-      if (action !== 'login') throw new Error('Use auth agent list | auth agent login <agent> [--code <code>] [--code-file <path>] [--url-file <path>]');
       const result = await loginAgent({
         agent: name,
         code: flag('--code'),
@@ -371,10 +537,10 @@ export async function run(argv = []) {
       await handleGoogle(rest, isJson);
       break;
     case 'probe':
-      await handleProbe(isJson);
+      await handleProbe(rest, isJson);
       break;
     case 'session':
-      await handleSession(isJson);
+      await handleSession(rest, isJson);
       break;
     case 'secret':
     case 'secrets':