total-recall-brain 3.41.2 → 3.41.3

package/scaffold/.agent/skills/total-recall/plugins/auth/package-lock.json

@@ -18,7 +18,7 @@
       },
       "devDependencies": {
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.41.1",
+        "total-recall-brain": "3.41.2",
         "vitest": "^4.1.12"
       }
     },
@@ -3733,9 +3733,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.1.tgz",
-      "integrity": "sha512-QraXzcZpCTMssx1gaz8xjvSKf5KqirAaxzzER/ICBrWvawdNTLUDDMsVEYQUA/7thgwtL1QVIxU4dpfCGZwp+g==",
+      "version": "3.41.2",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.2.tgz",
+      "integrity": "sha512-bwJFAFAyvk9ysf+5zhBzMxrKus1Hj1AygUWdBNt+vQbM2sfSEf6701sa30KwfGyU8+cMuN6YNT5Mn63mFZIi/w==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "White-label Total Recall auth plugin: Passkey biometric FIDO2 and Google OAuth2 authentication.",
   "type": "module",
   "main": "cli.mjs",

package/scaffold/.agent/skills/total-recall/plugins/auth/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "auth",
   "name": "Auth & Secrets",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "Hardware WebAuthn biometric FIDO2 passkeys, OAuth session security, and access control.",
   "author": "Total Recall contributors",
   "license": "MIT",
@@ -154,6 +154,13 @@
         "tag": "tr-auth-card",
         "module": "ui/card.js",
         "description": "Gatepass Card Face"
+      },
+      {
+        "id": "panel",
+        "kind": "panel",
+        "tag": "tr-auth-panel",
+        "module": "ui/panel.js",
+        "description": "Gatepass Auth & Credentials Management Panel"
       }
     ]
   },

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/DESIGN.md

@@ -3,17 +3,65 @@
 ```yaml
 tokens:
   brand-name: "Auth & Secrets"
-  wordmark: "ENCLAVE AUTH"
+  wordmark: "AUTH & SECRETS"
   color-primary: "#10b981"
   color-background: "#064e3b"
   color-accent: "#34d399"
-  badge: "FIDO2 Enclave"
-  font-body: "system-ui, -apple-system, sans-serif"
-  font-mono: "'JetBrains Mono', monospace"
+  color-ok: "#059669"
+  color-warn: "#d97706"
+  color-danger: "#dc2626"
+  font-body: "Outfit, system-ui, sans-serif"
+  font-mono: "'JetBrains Mono', ui-monospace, monospace"
   border-radius: "8px"
+  density: "compact"
+  motion: "120ms ease-out"
 ```
 
-## Brand & Typographic Wordmark
-- **Name**: Auth & Secrets
-- **Wordmark Logo**: `ENCLAVE AUTH`
-- **Palette**: Deep Forest `#064e3b`, Emerald `#10b981`, Mint `#34d399`. Secure biometric FIDO2 WebAuthn & OAuth2 sessions.
+## Who this card is for
+
+The operator and autonomous agents managing access control, cryptographic secrets, and identities across the mesh.
+
+The operator opens this card during active administration: verifying biometric passkeys, checking Google OAuth token freshness, auditing 90-day secret rotation schedules, or inspecting active session integrity.
+
+## The four tasks, in the order the card presents them
+
+| Screen | Task Frequency | Operational Rationale |
+| :--- | :--- | :--- |
+| **Passkeys** | Daily / Routine | Biometric hardware authentication via WebAuthn FIDO2. The operator checks registered authenticators and manages credential devices. |
+| **Google OAuth** | Frequent | Identity bridge accounts. The operator monitors token expiration, executes manual refreshes, and reviews account scopes. |
+| **Secrets** | Continuous | Cryptographic credential vault. The operator audits key freshness, tracks rotation deadlines, and checks provider bindings. |
+| **Audit & Sessions** | Incident / Review | Security baseline verification. The operator inspects live access sessions and reviews policy findings. |
+
+Screen ordering follows task frequency and operational urgency rather than arbitrary command taxonomy.
+
+## The core tasks
+
+1. **Verify security posture instantly** — confirm that the secrets store is sealed, zero rotation schedules are overdue, and the security audit baseline passes.
+2. **Manage biometric hardware passkeys** — inspect registered platform authenticators (Face ID, Touch ID, Windows Hello) and security keys (YubiKey), register new authenticators, and safely revoke decommissioned hardware.
+3. **Supervise OAuth tokens** — verify Google OAuth connection status, monitor token lifetime, refresh expiring credentials, and safely disconnect accounts.
+4. **Audit secret hygiene** — review key expiration dates, inspect multi-repo bindings, verify remote deployment targets, and trigger rotation workflows without exposing secret values to the DOM.
+
+## What must be visible without a single click
+
+- **Security Verdict Line:** A clear verdict ("Secure" or the count of active warnings) and timestamp of the latest verification.
+- **Passkey Count:** Total active hardware authenticators registered on the system.
+- **OAuth Status:** Connected accounts and token health status.
+- **Secrets Store Telemetry:** Total stored keys and count of overdue rotations.
+- **Baseline Audit State:** System security verification status (Passed or Flagged).
+
+## Why the layout is this layout
+
+The card face provides a wide, responsive workspace rather than a narrow column.
+
+- **Security Verdict at the Top:** The operator requires an immediate assessment. A prominent verdict line answers whether the authentication system is healthy before secondary details appear.
+- **Horizontal Task Navigation:** Four dedicated domain screens (Passkeys, Google OAuth, Secrets, Audit & Sessions) organize operations by user intent rather than raw CLI syntax.
+- **Zero Raw Secrets in DOM:** Secret values are never rendered, logged, or accepted via input fields. The interface exposes only key names, providers, fingerprints, creation timestamps, and rotation schedules.
+- **Safe Revocation Guards:** Destructive actions such as credential revocation require explicit confirmation and display prominent warning styling. Deleting the final authentication method is blocked to prevent accidental administrative lockout.
+- **Real Telemetry Only:** All figures render em dashes (`—`) until returned by the host. Zero mock responses, zero seeded numbers, and zero reassuring default strings appear in error branches.
+
+## Responsive presentation and accessibility
+
+- **Breakpoints:** Verified across mobile (360 CSS px), tablet (768 CSS px), and desktop (1280 CSS px) viewports.
+- **Host Theme Adaptation:** Injected dark-dashboard variables (`--text-primary`, `--text-secondary`, `--bg-primary`, `--bg-secondary`, `--border`, `--accent`) govern surfaces and typography.
+- **Touch Targets:** All interactive controls declare a minimum height of 44 px.
+- **Reduced Motion:** All transitions and indicators respect `prefers-reduced-motion` settings.