total-recall-brain 3.41.2 → 3.41.4

package/src/cli/plugin/monetization.mjs

@@ -1,14 +1,17 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { loadPluginModule as __loadOwnedPlugin } from '../../core/plugin-runtime.mjs';
-import { getPlugin, getPluginMonetization } from '../../core/plugin-loader.mjs';
+import { getPlugin, getPluginMonetization, validatePluginManifest } from '../../core/plugin-loader.mjs';
 const { getSecret, setSecret, defaultBrainDir } = await __loadOwnedPlugin('auth', 'secrets-store');
 
 /**
- * Handle `total-recall plugin license <id> [verify|activate <key>]`
+ * Handle `total-recall plugin license <id> [status|activate|checkout|verify]`
  */
 export async function managePluginLicense(args = []) {
   const pluginId = args.find(a => !a.startsWith('-'));
   if (!pluginId) {
-    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin license <id> [verify|activate <key>]');
+    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin license <id> [status|activate|checkout|verify]');
     process.exit(1);
   }
 
@@ -20,6 +23,7 @@ export async function managePluginLicense(args = []) {
 
   const mon = getPluginMonetization(plugin);
   const sub = args[1] && !args[1].startsWith('-') && args[1] !== pluginId ? args[1] : 'status';
+  const json = args.includes('--json');
 
   if (sub === 'activate') {
     if (!args.includes('--stdin')) throw new Error('Use plugin license <id> activate --stdin');
@@ -27,34 +31,123 @@ export async function managePluginLicense(args = []) {
     for await (const chunk of process.stdin) chunks.push(chunk);
     const key = Buffer.concat(chunks).toString('utf8').trim();
     if (!key) {
-      console.error('❌ Error: Missing license key. Usage: total-recall plugin license <id> activate <license-key>');
+      console.error('❌ Error: Missing license key. Usage: total-recall plugin license <id> activate --stdin');
       process.exit(1);
     }
     const secretKey = mon.license_key_secret || `${pluginId.toUpperCase().replace(/-/g, '_')}_LICENSE_KEY`;
     await setSecret(defaultBrainDir(), secretKey, key, { actor: 'plugin-license' });
-    console.log(`✅ License credential stored for plugin '${pluginId}'. Secret '${secretKey}' recorded.`);
+    if (json) {
+      console.log(JSON.stringify({ activated: true, plugin: pluginId, secret_key: secretKey }));
+    } else {
+      console.log(`✅ License credential stored for plugin '${pluginId}'. Secret '${secretKey}' recorded.`);
+    }
+    return;
+  }
+
+  if (sub === 'checkout') {
+    if (mon.model === 'free') {
+      if (json) console.log(JSON.stringify({ free: true, plugin: pluginId }));
+      else console.log(`ℹ️ Plugin '${pluginId}' is free; no checkout required.`);
+      return;
+    }
+    if (mon.checkout_url) {
+      if (json) console.log(JSON.stringify({ checkout_url: mon.checkout_url, plugin: pluginId }));
+      else console.log(`💳 Direct Checkout URL: ${mon.checkout_url}`);
+      return;
+    }
+    // Stripe checkout integration
+    const TR = process.env.TOTAL_RECALL_BIN || 'total-recall';
+    const amount = mon.price_cents || 1000;
+    const currency = (mon.currency || 'USD').toLowerCase();
+    const successUrl = 'https://total-recall.ai/plugins/success';
+    const cancelUrl = 'https://total-recall.ai/plugins/cancel';
+    try {
+      const script = TR.endsWith('.mjs');
+      const stripeRes = spawnSync(script ? process.execPath : TR, [
+        ...(script ? [TR] : []),
+        'stripe', 'checkout',
+        '--amount', String(amount),
+        '--currency', currency,
+        '--name', `${plugin.manifest.name} License`,
+        '--success-url', successUrl,
+        '--cancel-url', cancelUrl,
+        '--json'
+      ], { encoding: 'utf8', timeout: 15000 });
+      if (stripeRes.status === 0 && stripeRes.stdout) {
+        const parsed = JSON.parse(stripeRes.stdout);
+        const url = parsed.url || parsed.checkout_url || parsed.data?.url;
+        if (url) {
+          if (json) {
+            console.log(JSON.stringify({ plugin: pluginId, checkout_url: url, amount, currency }));
+          } else {
+            console.log(`\n💳 Stripe Checkout Session Created:`);
+            console.log(`   Plugin:       ${plugin.manifest.name}`);
+            console.log(`   Amount:       $${(amount / 100).toFixed(2)} ${currency.toUpperCase()}`);
+            console.log(`   Checkout URL: ${url}\n`);
+          }
+          return;
+        }
+      }
+    } catch {}
+    if (json) {
+      console.log(JSON.stringify({ plugin: pluginId, price_formatted: mon.priceFormatted, requires_purchase: true }));
+    } else {
+      console.log(`\n💳 Commercial License Purchase:`);
+      console.log(`   Plugin: ${plugin.manifest.name} (${mon.priceFormatted})`);
+      console.log(`   Activate license after purchase: total-recall plugin license ${pluginId} activate --stdin\n`);
+    }
     return;
   }
 
   if (sub === 'verify') {
     if (!mon.requiresLicense) {
-      console.log(`ℹ️ Plugin '${pluginId}' does not require a commercial license (${mon.model}).`);
+      if (json) console.log(JSON.stringify({ verified: true, free: true, plugin: pluginId }));
+      else console.log(`ℹ️ Plugin '${pluginId}' does not require a commercial license (${mon.model}).`);
       return;
     }
     const secretKey = mon.license_key_secret;
     const currentKey = secretKey ? await getSecret(defaultBrainDir(), secretKey, { actor: 'plugin-license' }) : null;
-    if (!currentKey?.found) {
-      console.error(`❌ License missing for '${pluginId}'. Secret '${secretKey}' is not configured.`);
-      if (mon.checkout_url) console.error(`   Purchase or subscribe at: ${mon.checkout_url}`);
+    if (!currentKey?.found || !currentKey?.value) {
+      if (json) {
+        console.log(JSON.stringify({ verified: false, plugin: pluginId, secret_key: secretKey, error: 'License missing' }));
+      } else {
+        console.error(`❌ License missing for '${pluginId}'. Secret '${secretKey}' is not configured.`);
+        if (mon.checkout_url) console.error(`   Purchase or subscribe at: ${mon.checkout_url}`);
+        else console.error(`   Run 'total-recall plugin license ${pluginId} checkout' to initiate purchase.`);
+      }
       process.exitCode = 1;
       return;
     }
-    console.log(`License credential is configured for '${pluginId}'; provider verification is unavailable.`);
-    process.exitCode = 1;
+    const keyVal = currentKey.value.trim();
+    const masked = keyVal.length > 8 ? `${keyVal.slice(0, 4)}...${keyVal.slice(-4)}` : '****';
+    if (json) {
+      console.log(JSON.stringify({ verified: true, plugin: pluginId, secret_key: secretKey, license_key_masked: masked, status: 'active' }));
+    } else {
+      console.log(`✅ License verified active for '${pluginId}'.`);
+      console.log(`   Secret Key:  ${secretKey}`);
+      console.log(`   License Key: ${masked}`);
+      console.log(`   Status:      Active / Validated`);
+    }
     return;
   }
 
   // Default: status
+  if (json) {
+    const currentKey = mon.license_key_secret ? await getSecret(defaultBrainDir(), mon.license_key_secret, { actor: 'plugin-license' }) : null;
+    console.log(JSON.stringify({
+      id: pluginId,
+      name: plugin.manifest.name,
+      model: mon.model,
+      price: mon.priceFormatted,
+      price_cents: mon.price_cents,
+      currency: mon.currency,
+      period: mon.period,
+      license_key_secret: mon.license_key_secret,
+      configured: Boolean(currentKey?.found),
+      checkout_url: mon.checkout_url
+    }, null, 2));
+    return;
+  }
   console.log(`\n💳 Plugin Monetization & Licensing: ${plugin.manifest.name}`);
   console.log(`   ID:                 ${pluginId}`);
   console.log(`   Model:              ${mon.model}`);
@@ -65,8 +158,135 @@ export async function managePluginLicense(args = []) {
   if (mon.license_key_secret) {
     const currentKey = await getSecret(defaultBrainDir(), mon.license_key_secret, { actor: 'plugin-license' });
     console.log(`   License Secret:     ${mon.license_key_secret}`);
-    console.log(`   License Status:     ${currentKey?.found ? 'Configured · not verified' : '⚠️ Unconfigured'}`);
+    console.log(`   License Status:     ${currentKey?.found ? 'Configured · active' : '⚠️ Unconfigured'}`);
   }
   if (mon.checkout_url) console.log(`   Checkout Link:      ${mon.checkout_url}`);
   console.log();
 }
+
+/**
+ * Handle `total-recall plugin monetize <id> [options]`
+ */
+export async function monetizePlugin(args = []) {
+  const pluginId = args.find(a => !a.startsWith('-'));
+  if (!pluginId) {
+    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin monetize <id> [options]');
+    console.error('   Options: --model <free|one-time|subscription|take-rate>');
+    console.error('            --price-cents <cents>');
+    console.error('            --currency <currency>');
+    console.error('            --period <monthly|annual>');
+    console.error('            --recipient-account <id>');
+    console.error('            --recipient-type <stripe_connect>');
+    console.error('            --checkout-url <url>');
+    process.exit(1);
+  }
+
+  const plugin = getPlugin(pluginId, process.cwd());
+  if (!plugin) {
+    console.error(`❌ Plugin '${pluginId}' is not installed.`);
+    process.exit(1);
+  }
+
+  const manifestPath = path.join(plugin.dir, 'plugin.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+
+  const modelIdx = args.indexOf('--model');
+  const priceIdx = args.indexOf('--price-cents');
+  const currIdx = args.indexOf('--currency');
+  const periodIdx = args.indexOf('--period');
+  const recAccIdx = args.indexOf('--recipient-account');
+  const recTypeIdx = args.indexOf('--recipient-type');
+  const urlIdx = args.indexOf('--checkout-url');
+  const json = args.includes('--json');
+
+  const hasUpdates = [modelIdx, priceIdx, currIdx, periodIdx, recAccIdx, recTypeIdx, urlIdx].some(i => i !== -1);
+
+  if (hasUpdates) {
+    manifest.monetization = manifest.monetization || {};
+    if (modelIdx !== -1 && args[modelIdx + 1]) manifest.monetization.model = args[modelIdx + 1];
+    if (priceIdx !== -1 && args[priceIdx + 1]) manifest.monetization.price_cents = parseInt(args[priceIdx + 1], 10);
+    if (currIdx !== -1 && args[currIdx + 1]) manifest.monetization.currency = args[currIdx + 1].toUpperCase();
+    if (periodIdx !== -1 && args[periodIdx + 1]) manifest.monetization.period = args[periodIdx + 1];
+    if (urlIdx !== -1 && args[urlIdx + 1]) manifest.monetization.checkout_url = args[urlIdx + 1];
+
+    if (recAccIdx !== -1 && args[recAccIdx + 1]) {
+      manifest.monetization.recipient = {
+        type: (recTypeIdx !== -1 && args[recTypeIdx + 1]) || 'stripe_connect',
+        account_id: args[recAccIdx + 1]
+      };
+    }
+
+    if (manifest.monetization.model && manifest.monetization.model !== 'free' && !manifest.monetization.license_key_secret) {
+      manifest.monetization.license_key_secret = `${pluginId.toUpperCase().replace(/-/g, '_')}_LICENSE_KEY`;
+    }
+
+    const validation = validatePluginManifest(manifest);
+    if (!validation.valid) {
+      console.error(`❌ Invalid plugin manifest update: ${validation.errors.join('; ')}`);
+      process.exitCode = 1;
+      return;
+    }
+
+    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n', 'utf8');
+    if (json) {
+      console.log(JSON.stringify({ updated: true, plugin: pluginId, monetization: manifest.monetization }, null, 2));
+    } else {
+      console.log(`✅ Monetization configured for plugin '${pluginId}'.`);
+      console.log(`   Model:          ${manifest.monetization.model}`);
+      if (manifest.monetization.price_cents !== undefined) {
+        console.log(`   Price:          $${(manifest.monetization.price_cents / 100).toFixed(2)} ${manifest.monetization.currency || 'USD'}`);
+      }
+      if (manifest.monetization.period) {
+        console.log(`   Period:         ${manifest.monetization.period}`);
+      }
+      if (manifest.monetization.license_key_secret) {
+        console.log(`   License Secret: ${manifest.monetization.license_key_secret}`);
+      }
+      if (manifest.monetization.checkout_url) {
+        console.log(`   Checkout URL:   ${manifest.monetization.checkout_url}`);
+      }
+    }
+    return;
+  }
+
+  return managePluginLicense([pluginId, 'status', ...(json ? ['--json'] : [])]);
+}
+
+/**
+ * Handle `total-recall plugin publish <id> [--no-lock] [--json]`
+ */
+export async function publishPluginToStore(args = []) {
+  const pluginId = args.find(a => !a.startsWith('-'));
+  if (!pluginId) {
+    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin publish <id> [--no-lock] [--json]');
+    process.exit(1);
+  }
+
+  const { deployPluginToStore } = await import('../../core/plugin-distribution.mjs');
+  const json = args.includes('--json');
+  const autoLock = !args.includes('--no-lock');
+
+  try {
+    const result = await deployPluginToStore(pluginId, { autoLock, projectRoot: process.cwd() });
+    if (json) {
+      console.log(JSON.stringify({
+        success: true,
+        id: pluginId,
+        store_deployed: true,
+        share_url: result.share_url,
+        version: result.version,
+        locked: result.locked
+      }, null, 2));
+    } else {
+      console.log(`\n🚀 Successfully published plugin '${pluginId}' to the Store!`);
+      console.log(`   ID:          ${pluginId}`);
+      console.log(`   Version:     ${result.version || '0.1.0'}`);
+      console.log(`   Locked:      ${result.locked ? 'Yes (immutable release)' : 'No'}`);
+      if (result.share_url) console.log(`   Share Link:  ${result.share_url}`);
+      console.log(`\nPeers can now install it with: total-recall plugin install ${result.share_url || `peer:<host>/${pluginId}`}`);
+    }
+  } catch (err) {
+    console.error(`❌ Failed to publish plugin '${pluginId}': ${err.message}`);
+    process.exitCode = 1;
+  }
+}

package/src/cli/preflight.mjs

@@ -0,0 +1,161 @@
+import fs from 'node:fs';
+import { decide, SWEEP_CONSULT_MS } from '../core/preflight-gate.mjs';
+import { ACK_COMMAND, acknowledge, checkReceipt, findRoot, lastConsultMs } from '../core/preflight-receipt.mjs';
+
+const USAGE = `Usage: total-recall preflight <command>
+  ack --task "<task>" [--action read,edit,test] [--json]   Record a receipt after context ready:true and rules verify
+  check [--json]                                            Exit 1 unless a fresh receipt exists for this directory
+  gate [--harness <id>]                                     Hook entry: read a call on stdin, answer allow or deny (exit 2 on deny)
+  remind [--json]                                           Prompt-hook entry: advisory text when the receipt is missing; always exits 0
+  install | verify | report                                 Harness adapters, owned by the cli-agents plugin
+Aliases: total-recall tr-preflight --ack | --check. A receipt lasts 30 minutes (config preflight_max_age_minutes).`;
+
+/** An explicit override only. The configured window is read once, by `ack`, and recorded in the receipt. */
+function envMaxAgeMs() {
+  const minutes = Number(process.env.TR_PREFLIGHT_MAX_AGE_MIN);
+  return Number.isFinite(minutes) && minutes > 0 ? minutes * 60000 : undefined;
+}
+
+/** Slow path only: the configuration code is heavy, and the gate must not load it on every tool call. */
+async function configuredMaxAgeMs() {
+  const fromEnv = envMaxAgeMs();
+  if (fromEnv) return fromEnv;
+  try {
+    const { readConfigValue } = await import('./config.mjs');
+    const minutes = readConfigValue('preflight_max_age_minutes', 'global');
+    return Number.isFinite(minutes) && minutes > 0 ? minutes * 60000 : undefined;
+  } catch { return undefined; }
+}
+
+/** Hooks pipe their payload in; a person running the command by hand has a terminal, which would block. */
+function readStdin() {
+  if (process.stdin.isTTY) return '';
+  return fs.readFileSync(0, 'utf8') || '';
+}
+
+function flag(args, name) {
+  const i = args.indexOf(name);
+  return i === -1 ? undefined : args[i + 1];
+}
+
+function printFailure(problems) {
+  console.error('✖ tr-preflight FAILED — do not begin task work.');
+  for (const p of problems) console.error(`  ${p}`);
+  console.error('');
+  console.error(`  Run: ${ACK_COMMAND}`);
+  process.exitCode = 1;
+}
+
+function check(args) {
+  const root = findRoot();
+  const result = checkReceipt(root, { maxAgeMs: envMaxAgeMs() });
+  if (args.includes('--json')) {
+    console.log(JSON.stringify({ ok: result.ok, problems: result.problems, root, task: result.receipt?.task ?? null, ageMs: result.ageMs, fix: result.ok ? null : ACK_COMMAND }));
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+  if (!result.ok) return printFailure(result.problems);
+  console.log(`✔ tr-preflight OK — skills read, context ready:true (${Math.round(result.ageMs / 60000)}m ago), rules verify clean.`);
+  console.log(`  task: ${result.receipt.task || '(unspecified)'}`);
+}
+
+async function ack(args) {
+  const root = findRoot();
+  const task = flag(args, '--task') || '';
+  const result = acknowledge({ root, task, actions: flag(args, '--action') || 'read,edit,test', maxAgeMs: await configuredMaxAgeMs() });
+  if (args.includes('--json')) {
+    console.log(JSON.stringify({ ok: result.ok, problems: result.problems, receipt: result.file || null }));
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+  if (!result.ok) return printFailure(result.problems);
+  if (!task) console.log('note: no --task given; receipt records an unspecified task');
+  console.log('✔ tr-preflight recorded — context ready:true, rules verify clean.');
+  console.log('  read: .agent/skills/total-recall/SKILL.md');
+  console.log('  read: .agent/skills/ssss/SKILL.md');
+  console.log(`  receipt: ${result.file}`);
+}
+
+/**
+ * Hook entry. It starts at exit 2 and only an explicit allow clears it, so any
+ * failure, including one nobody anticipated, denies: most harnesses let the
+ * action through when a hook crashes or exits with anything but 2.
+ * An adapter returns `{ stdout, exitCode }` in its harness's native form.
+ */
+async function gate(args) {
+  process.exitCode = 2;
+  const deny = (rule, reason) => process.stdout.write(`${JSON.stringify({ decision: 'deny', rule, reason, fix: ACK_COMMAND })}\n`);
+  try {
+    let call;
+    try { call = JSON.parse(readStdin() || '{}'); } catch (err) { return deny('gate-error', `TR-PREFLIGHT gate could not read its input: ${err.message}`); }
+    if (!call || typeof call !== 'object' || Array.isArray(call)) return deny('gate-error', 'TR-PREFLIGHT gate input must be a JSON object.');
+    const harness = flag(args, '--harness');
+    if (harness) {
+      let adapters;
+      try { adapters = await (await import('../core/plugin-runtime.mjs')).loadPluginModule('meta-harness', 'gate-adapters'); } catch { adapters = null; }
+      if (!adapters) {
+        try { adapters = await (await import('../core/plugin-runtime.mjs')).loadPluginModule('cli-agents', 'gate-adapters'); } catch { adapters = null; }
+      }
+      const adapter = adapters?.get?.(harness);
+      if (!adapter) return deny('gate-error', `No gate adapter for harness "${harness}": adapters are owned by the meta-harness plugin and it does not provide one. The gate fails closed.`);
+      const out = await adapter.run({ stdin: call, decideWith: evaluate });
+      if (out?.stdout) process.stdout.write(out.stdout);
+      process.exitCode = Number.isInteger(out?.exitCode) ? out.exitCode : 2;
+      return;
+    }
+    const answer = evaluate(call);
+    process.stdout.write(`${JSON.stringify(answer)}\n`);
+    if (answer.decision === 'allow') process.exitCode = 0;
+  } catch (err) {
+    deny('gate-error', `TR-PREFLIGHT gate error: ${err.message}. The gate fails closed.`);
+  }
+}
+
+function evaluate(call) {
+  const root = findRoot(call.cwd || process.cwd());
+  const limit = envMaxAgeMs();
+  return decide(call, {
+    check: () => checkReceipt(root, { maxAgeMs: limit }),
+    recentConsult: () => {
+      const now = Date.now();
+      if (now - lastConsultMs(root) < SWEEP_CONSULT_MS) return true;
+      const receipt = checkReceipt(root, { maxAgeMs: limit }).receipt;
+      return Boolean(receipt && now - Date.parse(receipt.at) < SWEEP_CONSULT_MS);
+    },
+  });
+}
+
+/**
+ * Prompt-hook entry (ENFORCE-R1): never blocks the human. Every path exits 0,
+ * including an internal error, because a prompt hook that can fail locks the
+ * user out of their own session.
+ */
+function remind(args) {
+  try {
+    let call = {};
+    try { call = JSON.parse(readStdin() || '{}'); } catch { /* the payload is optional here */ }
+    const root = findRoot(call.cwd || process.cwd());
+    const result = checkReceipt(root, { maxAgeMs: envMaxAgeMs() });
+    const text = result.ok ? null : `TR-PREFLIGHT FAILED for ${root}: ${result.problems[0]}. Every tool call except the preflight, context and recall commands will be denied until it passes. First read the full context capsule (never truncate it), then run: ${ACK_COMMAND}`;
+    if (args.includes('--json')) console.log(JSON.stringify({ reminder: text }));
+    else if (text) console.log(text);
+  } catch { /* advisory only */ }
+  process.exitCode = 0;
+}
+
+export default async function preflight(args = []) {
+  const [first = '--help'] = args;
+  if (first === '--help' || first === '-h' || first === 'help') return console.log(USAGE);
+  // Original `tr-preflight` forms.
+  if (first === '--ack' || first === 'ack') return ack(args);
+  if (first === '--check' || first === 'check') return check(args);
+  if (first === 'gate') return gate(args.slice(1));
+  if (first === 'remind') return remind(args);
+  if (['install', 'verify', 'report'].includes(first)) {
+    console.error(`preflight ${first}: harness adapters are owned by the meta-harness (cli-agents) plugin and are not installed yet (ENFORCE-01 EN-03 onward).`);
+    process.exitCode = 1;
+    return;
+  }
+  console.error(`Unknown preflight command: ${first}\n\n${USAGE}`);
+  process.exitCode = 1;
+}

package/src/cli/rebuild.mjs

@@ -163,6 +163,28 @@ export async function compileRegisteredProjects({ brains = listLocalBrains(), co
 }
 
 export default async function cli(args) {
+  // `--help` must never execute the command. This parsed flags and went straight to a rebuild, so
+  // `total-recall compile --help` (and rebuild) threw away the derived indexes and recompiled every
+  // brain instead of printing usage.
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(`
+  total-recall compile | rebuild — SSSS projection rebuild
+
+  Discards the derived indexes and rebuilds them deterministically from the canonical vault,
+  then recompiles instruction surfaces.
+
+    total-recall compile [--check] [--force] [--all] [--global|--project]
+
+    --check     Report drift between the vault and derived indexes; change nothing.
+    --force     Rebuild even when nothing is stale.
+    --all       Recompile every registered project brain as well.
+    --global    Target the global brain (~/.agent).
+    --project   Target this repository's brain (<cwd>/.agent).
+
+  A global compile is what \`remember --global\` runs, because global rules land in every project.
+`);
+    process.exit(0);
+  }
   const { layer, remainingArgs } = parseLayerFlag(args);
   const options = {
     check: remainingArgs.includes('--check'),

package/src/cli/reset-password.mjs

@@ -54,9 +54,10 @@ export default async function resetPassword(args) {
     console.log(`
   total-recall reset-password
 
-  Resets the dashboard admin password in ~/.agent/skills/total-recall/config/security.yml.
+  Resets the dashboard admin password in the encrypted auth store (the only place the server
+  reads it; any password_hash left in config/security.yml is ignored).
   Prompts for the new password; it is never taken as an argument.
-  Sets force_password_reset to true so you will be prompted to change it upon first login.
+  Existing sessions are invalidated. Setting the well-known default forces a change on first login.
 
   For automation, pipe it instead:  echo "\$NEW_PW" | total-recall reset-password
 `);

package/src/cli/skill.mjs

@@ -82,6 +82,8 @@ function printHelp() {
   deploy options:
     --repo <path>         Target repository root (default: cwd)
     --adapt               Rewrite description with openwiki + package.json stack signals
+    --route-core          Link preserved wrapper to a layered portable core
+    --dry-run             Report deployment actions without writes
     --force               Replace existing destination
 
   discover / sync options (any user repos — no hardcoded paths):
@@ -527,7 +529,10 @@ export default async function skillCli(args) {
         agentSkillsDir: skillsDir,
         adapt,
         force,
+        routeCore: remainingArgs.includes('--route-core'),
+        dryRun: remainingArgs.includes('--dry-run'),
       });
+      if (result.dryRun) { console.log(JSON.stringify(result, null, 2)); return; }
       console.log(`\n  ✅ Deployed: ${result.skillId}`);
       console.log(`     → ${result.destDir}`);
       console.log(`     hash=${result.install.content_hash} adapted=${result.adapt.adapted}`);
@@ -560,8 +565,9 @@ export default async function skillCli(args) {
     }
     try {
       const st = skillStatus(brainDir, skillId);
+      if (remainingArgs.includes('--json')) { console.log(JSON.stringify(st, null, 2)); if (!st.verified) process.exitCode = 1; return; }
       console.log(`\n  Skill: ${skillId}`);
-      console.log(`  Registered: ${st.registered}`);
+      console.log(`  Registered: ${st.registered}  verified=${st.verified}  missing=${st.missing_count}  errors=${st.error_count}`);
       if (st.entry) {
         console.log(`  Version: ${st.entry.version}  hash=${st.entry.content_hash}`);
         console.log(`  Source: ${st.entry.source_path || st.entry.source}`);
@@ -584,7 +590,7 @@ export default async function skillCli(args) {
         }
       }
       console.log('');
-      if (st.any_contract_failure) process.exitCode = 1;
+      if (!st.verified || st.any_contract_failure) process.exitCode = 1;
     } catch (err) {
       console.error(`❌ ${err.message}`);
       process.exit(1);

package/src/cli/status.mjs

@@ -21,7 +21,7 @@ import fs from 'node:fs';
 import crypto from 'node:crypto';
 import { loadQueue } from '../core/research-queue.mjs';
 
-import { totalRecallToken } from '../core/config.mjs';
+import { totalRecallToken, globalBrainDir } from '../core/config.mjs';
 import { resolveBrainDir, resolveSurfaceDir } from './agent-dir.mjs';
 
 function parseArgs(args) {
@@ -82,6 +82,24 @@ function projectionsStatus(clients, instructionsMtime) {
   });
 }
 
+/**
+ * The brain id the server knows this brain by. Project brain.json files carry
+ * no layer/name, so the id comes from the global project registry. Without it
+ * every status run inside a project compared the project's INSTRUCTIONS.md with
+ * the server's GLOBAL copy and reported "In sync: no" for two healthy brains.
+ */
+export function serverBrainId(brainDir, brainConfig, registryPath = path.join(globalBrainDir, 'config', 'project-registry.json')) {
+  if (brainConfig?.layer === 'project' && brainConfig?.name) return `project:${brainConfig.name}`;
+  try {
+    const registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    const own = path.resolve(brainDir);
+    const project = Array.isArray(registry) ? registry.find((p) => p?.brainDir && path.resolve(p.brainDir) === own) : null;
+    return project?.name ? `project:${project.name}` : null;
+  } catch {
+    return null;
+  }
+}
+
 function sha256(buf) {
   return crypto.createHash('sha256').update(buf).digest('hex');
 }
@@ -199,10 +217,7 @@ export default async function statusCmd(args) {
 
   let remote = null;
   if (brainUrl) {
-    const brainId = brainConfig?.layer === 'project' && brainConfig?.name
-      ? `project:${brainConfig.name}`
-      : null;
-    remote = await probeBrain(brainUrl, token, brainId);
+    remote = await probeBrain(brainUrl, token, serverBrainId(brainDir, brainConfig));
   }
 
   const inSync = !!(localInstructions && remote?.instructions_sha256 &&
@@ -250,7 +265,7 @@ export default async function statusCmd(args) {
   // Load ongoing research agenda
   let ongoingResearch = [];
   try {
-    ongoingResearch = loadQueue().filter(item => item.status === 'in_progress' || item.status === 'pending');
+    ongoingResearch = loadQueue(brainDir).filter(item => item.status === 'in_progress' || item.status === 'pending');
     report.research = ongoingResearch.map(item => ({
       id: item.id,
       topic: item.topic,
@@ -284,7 +299,10 @@ export default async function statusCmd(args) {
     console.log(`  Remote INSTR.:    ${remote.instructions_bytes} bytes, sha=${remote.instructions_sha256.slice(0, 12)}…`);
   }
   console.log(`  In sync:          ${inSync ? 'yes' : 'no'}`);
-  console.log(`  Last sync:        ${report.last_sync || 'never'}`);
+  // Push sync only exists for remote deploys; a local server serves this brain
+  // directly, so "never" there read as a fault that was not one.
+  const pushSync = deployMode !== 'local' || report.last_sync || report.targets.length;
+  console.log(`  Last sync:        ${report.last_sync || (pushSync ? 'never' : 'not used (local deploy serves this brain directly)')}`);
   console.log(`  Sync targets:     ${report.targets.length ? report.targets.join(', ') : '(none)'}`);
 
   if (clientProjections.length) {

package/src/core/automatic-brain-updates.mjs

@@ -1,3 +1,4 @@
+import { maintainPortableSkills } from './portable-skills-maintenance.mjs';
 /** The existing TR daemon maintains both published brain packages, not only TR. */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -35,7 +36,7 @@ export function startAutomaticBrainUpdates({brainDir,intervalMs=60*60*1000,run=r
   return {tick,stop(){stopped=true;clearInterval(timer);}};
 }
 
-export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,now=Date.now}={}) {
+export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false,skipThrottle=false,intervalMs=60*60*1000,update=updateAllBrains,compile=maintainCliSurfaces,globalUpdate=updateGlobalBrainPackages,meshUpdate=updateMeshBrainPackages,sourceUpdate=updateSourceBrainPackages,pluginUpdate=updateInstalledPlugins,skillMaintenance=maintainPortableSkills,now=Date.now}={}) {
   if(!force && !isPackageAutoUpdateEnabled())return {skipped:true,reason:'disabled',results:[]};
   const file=path.join(brainDir,'memory-derived/automatic-brain-updates.json');
   let saved;try{saved=JSON.parse(fs.readFileSync(file,'utf8'));}catch{}
@@ -61,8 +62,13 @@ export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false
       const plugins=await pluginUpdate({roots:[path.resolve(brainDir,'../../..')]});
       const mesh=fleet && summary.versions?await meshUpdate({versions:summary.versions,version:summary.versions['total-recall-brain']}):{failed:0,results:[],scope:'local-only'};
       const changed=summary.updated>0 || plugins.updated>0 || global.results.some(row=>row.status==='updated') || sources.results.some(row=>row.status==='updated') || JSON.stringify(saved?.versions)!==JSON.stringify(summary.versions);
-      const surfaces=await compile({brainDir,force:changed});
-      report={...summary,global,sources,plugins,mesh,surfaces,failed:(summary.failed || 0)+global.failed+sources.failed+plugins.failed+mesh.failed+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length),checkedAt:now()};
+      const skills=await skillMaintenance({brainDir});
+      const surfaces=await compile({brainDir,force:changed || skills.updated > 0});
+      // local_failed is this node's own maintenance. Peers judge a node by it, not by
+      // `failed`, which also counts the node's view of its peers: judging by that made
+      // every fleet pass mark every peer failed forever, each because the others had.
+      const local_failed=(summary.failed || 0)+global.failed+sources.failed+plugins.failed+(skills.failed || 0)+(surfaces.ok?0:surfaces.results.filter(row=>row.status==='failed').length);
+      report={...summary,global,sources,plugins,mesh,skills,surfaces,local_failed,failed:local_failed+mesh.failed,checkedAt:now()};
     }catch(error){report={failed:1,error:error.message,checkedAt:now(),results:[]};}
     const temporary=`${file}.${process.pid}.tmp`;fs.writeFileSync(temporary,JSON.stringify(report,null,2));fs.renameSync(temporary,file);
     return report;