total-recall-brain 3.41.2 → 3.41.4

package/scaffold/.agent/skills/total-recall/plugins/security/cli.mjs

@@ -907,7 +907,13 @@ export async function run(argv = []) {
   }
   if (IMPLEMENTED[sub]) {
     try { return await IMPLEMENTED[sub](args.slice(1)); }
-    catch { console.log(JSON.stringify({ status: 'failed', operation: sub, error: 'Security operation failed; verify arguments, owning plugin availability and authorization. No success was established.' })); process.exitCode = 1; return; }
+    catch (error) {
+      // Say what failed. The generic text hid every cause, including a scan that
+      // simply hit its coverage limit. Messages are paths and limits, never matched content.
+      console.log(JSON.stringify({ status: 'failed', operation: sub, error: `Security operation failed: ${String(error?.message || error).slice(0, 300)}. No success was established.` }));
+      process.exitCode = 1;
+      return;
+    }
   }
   console.error(`Security: "${sub}" is not implemented.`);
   process.exitCode = 2;

package/scaffold/.agent/skills/total-recall/plugins/security/package-lock.json

@@ -1,16 +1,19 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-security",
-      "version": "0.3.2",
+      "version": "0.3.3",
       "license": "MIT",
+      "dependencies": {
+        "@gregiteen/ssss-cli": "0.14.3"
+      },
       "devDependencies": {
         "jsdom": "^26.1.0",
-        "total-recall-brain": "3.41.1"
+        "total-recall-brain": "3.41.3"
       }
     },
     "node_modules/@asamuzakjp/css-color": {
@@ -142,6 +145,18 @@
         "node": ">=18"
       }
     },
+    "node_modules/@gregiteen/ssss-cli": {
+      "version": "0.14.3",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.3.tgz",
+      "integrity": "sha512-vvGgiNLjus3/xp+iotiGqbSG0R7+Q/bP5cP2Psa7Rhtm/vrMuM5B4LebYu7bPf3TzgCyTbv96PcxGWf6gxbW0Q==",
+      "license": "ISC",
+      "bin": {
+        "ssss": "scripts/ssss.mjs"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@hexagon/base64": {
       "version": "1.1.28",
       "resolved": "https://registry.npmjs.org/@hexagon/base64/-/base64-1.1.28.tgz",
@@ -479,9 +494,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.11.2.tgz",
-      "integrity": "sha512-DTkBPCOv9uN79YoRtsa/GnXPbbeHOU5PQcQ995axHg+SLWdkL6xmrTRs5Xxshcje/Iv6+lKkYOc9UL+Arn9kHg==",
+      "version": "0.12.1",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.12.1.tgz",
+      "integrity": "sha512-ff0L2LV4db1CfD4W3VmIJwT9fvrpuKDGDfhe6gtjrrgtRmo7BP7jYjRtH7yuQipKikyiP9LIvmVIaxvbjLTwkA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -2916,9 +2931,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.41.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.1.tgz",
-      "integrity": "sha512-QraXzcZpCTMssx1gaz8xjvSKf5KqirAaxzzER/ICBrWvawdNTLUDDMsVEYQUA/7thgwtL1QVIxU4dpfCGZwp+g==",
+      "version": "3.41.3",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.41.3.tgz",
+      "integrity": "sha512-0uIh3WZE3dHxrKFTtRMxvSBLx7aV3j7ry9H9NxRShtCycwQ38T7+70Q/GJAqsdpwt894h8B6AAmWJnHwsFG3XQ==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -2926,7 +2941,7 @@
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.11.2",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.12.1",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -1,11 +1,12 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "type": "module",
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {
     "test": "node --test test/*.test.mjs",
-    "build:ui": "node scripts/build-ui.mjs"
+    "build:ui": "node scripts/build-ui.mjs",
+    "ssss": "ssss"
   },
   "license": "MIT",
   "files": [
@@ -21,5 +22,8 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "@gregiteen/ssss-cli": "0.14.3"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "security",
   "name": "Security Assessments",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
   "license": "MIT",
   "branding": {

package/scaffold/.agent/skills/total-recall/plugins/security/src/scanner.mjs

@@ -5,8 +5,12 @@ import path from 'node:path';
 export function scanSource(targetPath) {
   const root = fs.realpathSync(path.resolve(targetPath));
   const findings = [];
-  const skipped = new Set(['node_modules', '.git', 'dist', 'coverage', 'memory-vault', '.cache', '.venv', '__pycache__']);
+  // Generated brain data (indexes, sessions, logs) is not source; scanning it
+  // only hit the size limit and aborted the whole scan.
+  const skipped = new Set(['node_modules', '.git', 'dist', 'coverage', 'memory-vault', 'memory-derived', 'sessions', '.cache', '.venv', '__pycache__']);
+  const MAX_FILES = 20000, MAX_BYTES = 2097152;
   let count = 0;
+  let limited = false;
   function visit(file) {
     const stat = fs.lstatSync(file);
     if (stat.isSymbolicLink()) {
@@ -14,11 +18,21 @@ export function scanSource(targetPath) {
       return;
     }
     if (stat.isDirectory()) {
-      for (const name of fs.readdirSync(file)) if (!skipped.has(name)) visit(path.join(file, name));
+      for (const name of fs.readdirSync(file)) { if (limited) return; if (!skipped.has(name)) visit(path.join(file, name)); }
       return;
     }
     if (!stat.isFile() || !/\.(?:[cm]?js|tsx?|py|sh|bash|ps1|json|env|ya?ml)$|(?:^|\/)\.env(?:\.|$)/.test(file)) return;
-    if (++count > 20000 || stat.size > 2097152) throw new Error('Scan coverage limit exceeded; narrow the target');
+    // Report incomplete coverage as a finding instead of aborting: an aborted
+    // scan returned nothing, which callers could not tell apart from a failure.
+    if (stat.size > MAX_BYTES) {
+      findings.push({ file: path.relative(root, file), line: 0, rule: 'oversized-file-unscanned', severity: 'HIGH', detail: `Larger than ${MAX_BYTES} bytes; not inspected, coverage incomplete` });
+      return;
+    }
+    if (++count > MAX_FILES) {
+      limited = true;
+      findings.push({ file: '.', line: 0, rule: 'coverage-limit-reached', severity: 'HIGH', detail: `Stopped after ${MAX_FILES} files; narrow the target, coverage incomplete` });
+      return;
+    }
     const testFile = /(?:^|\/)(?:test|tests|fixtures)(?:\/|$)|\.(?:test|spec)\./.test(file);
     fs.readFileSync(file, 'utf8').split('\n').forEach((line, index) => {
       const rules = [];

package/scaffold/.agent/skills/total-recall/plugins/security/ui/DESIGN.md

@@ -1,18 +1,41 @@
-# DESIGN.md — Tin Foil
+# DESIGN.md — Security Plugin (Tin Foil)
 
-```yaml
-tokens:
-  brand-name: "Tin Foil"
-  wordmark: "[TIN//FOIL]"
-  color-primary: "#f59e0b"
-  color-background: "#0a0a0c"
-  color-accent: "#e2e8f0"
-  badge: "Hardening"
-  font-mono: "'JetBrains Mono', 'Fira Code', monospace"
-  border-radius: "8px"
+## Brand Identity & Aesthetic
+- **Brand Name**: Tin Foil
+- **Wordmark**: `[TIN//FOIL]`
+- **Theme**: Crimson and Obsidian Host Hardening Console
+- **Tone**: Deterministic, vigilant, fail-closed, precise
+
+## Design Tokens
+
+The card face defines and consumes these custom properties:
+
+```css
+:host {
+  --face-bg: #180d11;
+  --face-bg-subtle: #251017;
+  --face-bg-surface: #11070a;
+  --face-bg-table: #0d0508;
+  --face-bg-code: #0a0406;
+  --face-accent: #f43f5e;
+  --face-accent-hover: rgba(244, 63, 94, 0.22);
+  --face-accent-glow: rgba(244, 63, 94, 0.35);
+  --face-border-subtle: rgba(244, 63, 94, 0.28);
+  --face-border-faint: rgba(244, 63, 94, 0.2);
+  --face-border-cell: rgba(244, 63, 94, 0.15);
+  --face-border-alert: rgba(244, 63, 94, 0.25);
+  --face-text: #f1f5f9;
+  --face-text-heading: #fecdd3;
+  --face-text-muted: #fda4af;
+  --face-text-cell: #f8fafc;
+  --face-text-desc: #cbd5e1;
+  --face-danger: #fb7185;
+  --face-warning: #fca5a5;
+}
 ```
 
-## Brand & Typographic Wordmark
-- **Name**: Tin Foil
-- **Wordmark Logo**: `[TIN//FOIL]` (custom typographic badge, no generic icons)
-- **Palette**: Primary `#f59e0b`, Surface `#0a0a0c`, Accent `#e2e8f0`.
+## System Integration
+- The face binds `--text-primary` with fallback to `var(--face-text)`.
+- The face binds `--border` with fallback to `var(--face-accent-glow)`.
+- All clickable elements enforce a minimum height of 44px for touch ergonomics.
+- Reduced motion styles suppress animation when requested by system settings.

package/scaffold/.agent/skills/total-recall/plugins/security/ui/card.js

@@ -5,11 +5,31 @@ export class SecuritySecurityCard extends HTMLElement {
     root.innerHTML = `
       <style>
         :host {
+          --face-bg: #180d11;
+          --face-bg-subtle: #251017;
+          --face-bg-surface: #11070a;
+          --face-bg-table: #0d0508;
+          --face-bg-code: #0a0406;
+          --face-accent: #f43f5e;
+          --face-accent-hover: rgba(244, 63, 94, 0.22);
+          --face-accent-glow: rgba(244, 63, 94, 0.35);
+          --face-border-subtle: rgba(244, 63, 94, 0.28);
+          --face-border-faint: rgba(244, 63, 94, 0.2);
+          --face-border-cell: rgba(244, 63, 94, 0.15);
+          --face-border-alert: rgba(244, 63, 94, 0.25);
+          --face-text: #f1f5f9;
+          --face-text-heading: #fecdd3;
+          --face-text-muted: #fda4af;
+          --face-text-cell: #f8fafc;
+          --face-text-desc: #cbd5e1;
+          --face-danger: #fb7185;
+          --face-warning: #fca5a5;
+
           display: block;
           font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-          color: #f1f5f9;
-          background: #180d11;
-          border: 1px solid rgba(244, 63, 94, 0.35);
+          color: var(--text-primary, var(--face-text));
+          background: var(--face-bg);
+          border: 1px solid var(--border, var(--face-accent-glow));
           border-radius: 10px;
           padding: 18px;
           box-shadow: 0 10px 28px rgba(0, 0, 0, 0.45);
@@ -27,7 +47,7 @@ export class SecuritySecurityCard extends HTMLElement {
         .brand-icon {
           width: 32px;
           height: 38px;
-          color: #f43f5e;
+          color: var(--face-accent);
           flex-shrink: 0;
         }
 
@@ -43,12 +63,12 @@ export class SecuritySecurityCard extends HTMLElement {
           font-weight: 700;
           letter-spacing: 0.03em;
           text-transform: uppercase;
-          color: #fecdd3;
+          color: var(--face-text-heading);
         }
 
         p.desc {
           margin: 0 0 14px 0;
-          color: #fda4af;
+          color: var(--face-text-muted);
           font-size: 12px;
           line-height: 1.5;
         }
@@ -66,11 +86,11 @@ export class SecuritySecurityCard extends HTMLElement {
 
         button, input, select {
           min-height: 44px;
-          border: 1px solid rgba(244, 63, 94, 0.28);
+          border: 1px solid var(--face-border-subtle);
           border-radius: 6px;
           padding: 8px 12px;
-          background: #251017;
-          color: #f1f5f9;
+          background: var(--face-bg-subtle);
+          color: var(--face-text);
           font-size: 11px;
           font-weight: 600;
           letter-spacing: 0.02em;
@@ -84,8 +104,8 @@ export class SecuritySecurityCard extends HTMLElement {
         }
 
         button:hover {
-          background: rgba(244, 63, 94, 0.22);
-          border-color: #f43f5e;
+          background: var(--face-accent-hover);
+          border-color: var(--face-accent);
         }
 
         button:active {
@@ -101,17 +121,17 @@ export class SecuritySecurityCard extends HTMLElement {
           min-width: 0;
           flex: 1;
           font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
-          background: #11070a;
+          background: var(--face-bg-surface);
         }
 
         input:focus, select:focus {
-          border-color: #f43f5e;
+          border-color: var(--face-accent);
           outline: none;
-          box-shadow: 0 0 0 1px rgba(244, 63, 94, 0.3);
+          box-shadow: 0 0 0 1px var(--face-accent-glow);
         }
 
         select {
-          background: #11070a;
+          background: var(--face-bg-surface);
           cursor: pointer;
         }
 
@@ -120,66 +140,66 @@ export class SecuritySecurityCard extends HTMLElement {
           font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
           font-size: 11px;
           font-weight: 700;
-          color: #fb7185;
-          background: #11070a;
+          color: var(--face-danger);
+          background: var(--face-bg-surface);
           padding: 6px 10px;
           border-radius: 4px;
-          border: 1px solid rgba(244, 63, 94, 0.2);
+          border: 1px solid var(--face-border-faint);
         }
 
         .scroll {
           overflow-x: auto;
           margin-bottom: 10px;
           border-radius: 6px;
-          border: 1px solid rgba(244, 63, 94, 0.2);
+          border: 1px solid var(--face-border-faint);
         }
 
         table {
           width: 100%;
           border-collapse: collapse;
           font-size: 11px;
-          background: #0d0508;
+          background: var(--face-bg-table);
         }
 
         th {
-          background: #251017;
-          color: #fecdd3;
+          background: var(--face-bg-subtle);
+          color: var(--face-text-heading);
           font-weight: 700;
           text-transform: uppercase;
           letter-spacing: 0.04em;
           padding: 8px 10px;
-          border-bottom: 1px solid rgba(244, 63, 94, 0.3);
+          border-bottom: 1px solid var(--face-border-subtle);
           text-align: left;
         }
 
         td {
           padding: 8px 10px;
           text-align: left;
-          border-bottom: 1px solid rgba(244, 63, 94, 0.15);
+          border-bottom: 1px solid var(--face-border-cell);
           vertical-align: top;
-          color: #f8fafc;
+          color: var(--face-text-cell);
         }
 
         td:first-child {
           font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
           font-weight: 600;
-          color: #fda4af;
+          color: var(--face-text-muted);
         }
 
         td:last-child {
           line-height: 1.45;
-          color: #cbd5e1;
+          color: var(--face-text-desc);
         }
 
         pre {
-          background: #0a0406;
-          border: 1px solid rgba(244, 63, 94, 0.2);
+          background: var(--face-bg-code);
+          border: 1px solid var(--face-border-faint);
           border-radius: 6px;
           padding: 8px 10px;
           font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
           font-size: 10.5px;
           line-height: 1.45;
-          color: #fb7185;
+          color: var(--face-danger);
           white-space: pre-wrap;
           overflow-wrap: anywhere;
           max-height: 160px;
@@ -188,8 +208,8 @@ export class SecuritySecurityCard extends HTMLElement {
         }
 
         #device-review {
-          background: #11070a;
-          border: 1px solid rgba(244, 63, 94, 0.25);
+          background: var(--face-bg-surface);
+          border: 1px solid var(--face-border-alert);
           border-radius: 6px;
           padding: 10px;
           margin-top: 10px;
@@ -198,7 +218,7 @@ export class SecuritySecurityCard extends HTMLElement {
         #device-review p {
           margin: 0 0 8px 0;
           font-size: 11px;
-          color: #fca5a5;
+          color: var(--face-warning);
         }
 
         #device-checks label {
@@ -209,9 +229,15 @@ export class SecuritySecurityCard extends HTMLElement {
         #device-checks label p {
           margin: 0 0 4px 0;
           font-size: 11px;
-          color: #fecdd3;
+          color: var(--face-text-heading);
           font-weight: 600;
         }
+
+        @media (prefers-reduced-motion: reduce) {
+          button, input, select {
+            transition: none !important;
+          }
+        }
       </style>
 
       <header>

package/src/cli/command.mjs

@@ -222,6 +222,27 @@ function headerTags(description, risk) {
   return (description ? `// @description ${one(description)}\n` : '') + (risk ? `// @risk ${risk}\n` : '');
 }
 
+/**
+ * Build a custom command's file from author-supplied source.
+ *
+ * The source may be a BODY for run(argv) or a complete module. Blindly wrapping it failed two ways:
+ * a module produced "Unexpected identifier 'fs'", and a body that declared its own `args` produced
+ * "Identifier 'args' has already been declared". Detect the shape instead of assuming it, and declare
+ * `args` only when the body does not. The default export delegates so the body is written once.
+ */
+function buildCommandFile(name, description, risk, code) {
+  const source = String(code ?? '');
+  const header = `// Auto-generated custom CLI command: ${name}\n${headerTags(description, risk)}`;
+  if (/^\s*(?:import|export)\s/m.test(source)) {
+    return `${header}// Supplied as a complete module; used as written.\n${source}\n`;
+  }
+  const declaresArgs = /(?:^|\n)\s*(?:const|let|var)\s+args\b/.test(source);
+  const argsLine = declaresArgs ? '' : 'const args = Array.isArray(argv) ? argv.slice(3) : [];\n';
+  return `${header}// Your source is the BODY of run(argv). \`argv\` is in scope${declaresArgs ? '' : ', and so is `args` (argv minus the command name)'}.\n`
+    + "// Use `await import('node:module')`; write no import/export statements here.\n"
+    + `export async function run(argv = []) {\n${argsLine}${source}\n}\nexport default function (argv = []) {\n  return run(argv);\n}\n`;
+}
+
 function existingTag(file, key) {
   try { return fs.readFileSync(file, 'utf8').match(new RegExp(`^// @${key} (.+)$`, 'm'))?.[1] || undefined; } catch { return undefined; }
 }
@@ -373,15 +394,7 @@ export default async function commandCmd(rawArgs = []) {
     }
     
     // Wrap code in an exported run/default function for composable CLI execution
-    const fileContent = `// Auto-generated custom CLI command: ${name}
-${headerTags(description, risk)}export async function run(argv = []) {
-  const args = Array.isArray(argv) ? argv.slice(3) : [];
-  ${code}
-}
-export default async function (args = []) {
-  ${code}
-}
-`;
+    const fileContent = buildCommandFile(name, description, risk, code);
 
     fs.writeFileSync(commandPath, fileContent, 'utf8');
     console.log(`\x1b[32m✔ Successfully created custom command: \x1b[1mnpx total-recall ${name}\x1b[0m`);
@@ -413,15 +426,7 @@ export default async function (args = []) {
     // Keep the declared description/risk unless the update replaces them.
     const keptDescription = description ?? existingTag(commandPath, 'description');
     const keptRisk = risk ?? existingTag(commandPath, 'risk');
-    const fileContent = `// Auto-generated custom CLI command: ${name}
-${headerTags(keptDescription, keptRisk)}export async function run(argv = []) {
-  const args = Array.isArray(argv) ? argv.slice(3) : [];
-  ${code}
-}
-export default async function (args = []) {
-  ${code}
-}
-`;
+    const fileContent = buildCommandFile(name, keptDescription, keptRisk, code);
 
     fs.writeFileSync(commandPath, fileContent, 'utf8');
     console.log(`\x1b[32m✔ Successfully updated custom command: \x1b[1m${name}\x1b[0m`);

package/src/cli/config.mjs

@@ -17,6 +17,9 @@ const KEY_MAP = {
   'public_health': { file: 'security', path: 'network.public_health', type: 'boolean' },
   'allowed_origins': { file: 'security', path: 'network.allowed_origins', type: 'array' },
 
+  // How long a `total-recall preflight ack` receipt stays fresh. Recorded in the receipt when it is written.
+  'preflight_max_age_minutes': { file: 'preflight', path: 'preflight.max_age_minutes', type: 'number' },
+
   'daily_cap_usd': { file: 'budget', path: 'budget.daily_cap_usd', type: 'number' },
   'weekly_cap_usd': { file: 'budget', path: 'budget.weekly_cap_usd', type: 'number' },
   'budget_enabled': { file: 'budget', path: 'budget.enabled', type: 'boolean' },