total-recall-brain 3.41.2 → 3.41.4

package/src/core/preflight-receipt.mjs

@@ -0,0 +1,123 @@
+/**
+ * Preflight receipt: the attestation that an agent read the mandatory skills and
+ * received a ready capsule for one repository. It is an ephemeral per-machine
+ * file (mode 0600), not application state: every hook reads it on every tool
+ * call, so it stays a plain file. Gate decisions are what go to the event log.
+ *
+ * The file location and fields are unchanged from the original `tr-preflight`
+ * command, so receipts written before this module remain valid.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+export const SKILLS = ['.agent/skills/total-recall/SKILL.md', '.agent/skills/ssss/SKILL.md'];
+export const DEFAULT_MAX_AGE_MS = 30 * 60 * 1000;
+export const ACK_COMMAND = 'total-recall tr-preflight --ack --task "<task>" --action read,edit,test';
+
+const BIN = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'total-recall.mjs');
+
+/**
+ * The nearest ancestor holding `.agent`, else the directory itself, with symlinks
+ * resolved. A harness may report a symlinked path (`/var` for `/private/var`)
+ * where the shell reports the real one; both must find the same receipt.
+ */
+export function findRoot(cwd = process.cwd()) {
+  const resolve = (p) => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
+  const start = resolve(cwd);
+  let dir = start;
+  for (let i = 0; i < 40; i += 1) {
+    if (fs.existsSync(path.join(dir, '.agent'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return start;
+}
+
+const rootKey = (root) => crypto.createHash('sha256').update(root).digest('hex').slice(0, 16);
+const stateDir = (home) => path.join(home, '.agent', 'tr-preflight');
+export const receiptPath = (root, home = os.homedir()) => path.join(stateDir(home), `${rootKey(root)}.json`);
+export const consultPath = (root, home = os.homedir()) => path.join(stateDir(home), `consult-${rootKey(root)}.stamp`);
+
+const sha256 = (file) => crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+
+/** Hashes of the mandatory skills, or the list of ones that are missing. */
+export function skillHashes(root) {
+  const hashes = {};
+  const missing = [];
+  for (const rel of SKILLS) {
+    const full = path.join(root, rel);
+    if (fs.existsSync(full)) hashes[rel] = sha256(full);
+    else missing.push(rel);
+  }
+  return { hashes, missing };
+}
+
+export function readReceipt(root, home = os.homedir()) {
+  try { return JSON.parse(fs.readFileSync(receiptPath(root, home), 'utf8')); } catch { return null; }
+}
+
+/**
+ * @returns {{ ok: boolean, problems: string[], receipt: object|null, ageMs: number|null }}
+ * `problems` read the same as the original command so existing guidance still fits.
+ */
+export function checkReceipt(root, { now = Date.now(), maxAgeMs, home = os.homedir() } = {}) {
+  const { hashes, missing } = skillHashes(root);
+  if (missing.length) return { ok: false, problems: missing.map((rel) => `missing mandatory skill: ${rel}`), receipt: null, ageMs: null };
+  const receipt = readReceipt(root, home);
+  if (!receipt) return { ok: false, problems: ['no preflight receipt for this repository'], receipt: null, ageMs: null };
+  const problems = [];
+  const ageMs = now - Date.parse(receipt.at || 0);
+  // The window is decided when the receipt is written, so the hot path never loads configuration.
+  const limit = maxAgeMs ?? (Number.isFinite(receipt.max_age_ms) && receipt.max_age_ms > 0 ? receipt.max_age_ms : DEFAULT_MAX_AGE_MS);
+  if (!Number.isFinite(ageMs) || ageMs > limit) problems.push('preflight receipt is stale; re-run --ack');
+  for (const [rel, hash] of Object.entries(hashes)) {
+    if (!receipt.skills || receipt.skills[rel] !== hash) problems.push(`${rel} changed since the receipt; re-read and re-run --ack`);
+  }
+  if (receipt.ready !== true) problems.push('receipt does not record ready:true');
+  return { ok: problems.length === 0, problems, receipt, ageMs: Number.isFinite(ageMs) ? ageMs : null };
+}
+
+/** Run this package's own CLI, so `ack` uses exactly the semantics every caller gets. */
+function runSelf(args, cwd) {
+  const r = spawnSync(process.execPath, [BIN, ...args], { cwd, encoding: 'utf8', timeout: 60000 });
+  return { ok: r.status === 0, out: r.stdout || '', err: r.stderr || '', code: r.status };
+}
+
+/**
+ * Record a receipt after proving the capsule is ready and the rules verify.
+ * `run` is injectable so the specs need no child process.
+ */
+export function acknowledge({ root, task = '', actions = 'read,edit,test', maxAgeMs, run = runSelf, now = Date.now(), home = os.homedir() }) {
+  const { hashes, missing } = skillHashes(root);
+  if (missing.length) return { ok: false, problems: missing.map((rel) => `missing mandatory skill: ${rel}`) };
+  const context = run(['context', task || '(no task given)', '--action', actions], root);
+  if (!/ready:true/.test(context.out)) {
+    return { ok: false, problems: ['total-recall context did not return ready:true',
+      context.code === 2 ? 'exit 2: capsule overflow; raise --budget or curate applicability, then retry' : `context exit=${context.code ?? '?'}`] };
+  }
+  const version = (context.out.match(/version:([0-9a-f]+)/) || [])[1] || null;
+  const rules = run(['rules', 'verify'], root);
+  if (!rules.ok) return { ok: false, problems: ['total-recall rules verify failed', (rules.out || rules.err).trim().split('\n').slice(-3).join(' | ')] };
+  const receipt = { at: new Date(now).toISOString(), repo: root, task, actions, ready: true, capsule_version: version, skills: hashes, rules_verify: 'ok',
+    ...(Number.isFinite(maxAgeMs) && maxAgeMs > 0 ? { max_age_ms: maxAgeMs } : {}) };
+  const file = receiptPath(root, home);
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(file, `${JSON.stringify(receipt, null, 2)}\n`, { mode: 0o600 });
+  return { ok: true, problems: [], receipt, file };
+}
+
+/** Marks that Total Recall was consulted just now; read by the repository-sweep policy. */
+export function touchConsult(root, { now = Date.now(), home = os.homedir() } = {}) {
+  const file = consultPath(root, home);
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(file, String(now), { mode: 0o600 });
+}
+
+export function lastConsultMs(root, { home = os.homedir() } = {}) {
+  try { return Number(fs.readFileSync(consultPath(root, home), 'utf8')) || 0; } catch { return 0; }
+}

package/src/core/required-plugins.mjs

@@ -152,6 +152,13 @@ export function auditProjectPluginCopies(projectRoot, { sharedDir = globalPlugin
     row.sourceVersion = row.sourceDir ? version(row.sourceDir) : null;
     row.sharedVersion = row.sharedDir ? version(row.sharedDir) : null;
     row.edited = row.sourceDir ? !sameTree(copyDir, row.sourceDir) : null;
+    // A copy declaring an older release than the shared install cannot be a deliberate local edit —
+    // it predates the shared plugin. It is a leftover from the release that vendored the defaults into
+    // every brain, and because discovery prefers a brain's own copy it SHADOWS the shared install and
+    // breaks the repository: a stale auth manifest fails validation, so every total-recall command in
+    // that repo dies with "Required plugin auth is missing or invalid". Same staleness rule the updater
+    // already applies when it refreshes a vendored copy.
+    row.stale = Boolean(row.version && row.sharedVersion && comparePackageVersions(row.version, row.sharedVersion) < 0);
     copies.push(row);
   }
   return { copies, count: copies.length, sourceDir };

package/src/core/runtime.mjs

@@ -162,10 +162,8 @@ export function loadRuntimeConfig(_configPath) {
       const checkPaths = [
         instructionsFilePath(),
         path.join(surfaceDir(), 'AGENTS.md'),
-        path.join(surfaceDir(), 'GEMINI.md'),
         path.join(agentDir, 'INSTRUCTIONS.md'),
         path.join(agentDir, 'AGENTS.md'),
-        path.join(agentDir, 'GEMINI.md'),
         path.join(path.dirname(agentDir), 'INSTRUCTIONS.md'),
         path.join(path.dirname(agentDir), 'AGENTS.md'),
         path.join(process.cwd(), 'INSTRUCTIONS.md'),
@@ -173,7 +171,6 @@ export function loadRuntimeConfig(_configPath) {
         path.join(process.cwd(), 'Claude.md'),
         // legacy mistaken brainDir locations (kept as last resort)
         path.join(brainDir, 'INSTRUCTIONS.md'),
-        path.join(brainDir, 'GEMINI.md'),
         path.join(brainDir, 'AGENTS.md'),
       ];
       for (const p of checkPaths) {

package/src/core/skills-registry.mjs

@@ -456,6 +456,11 @@ export function deploySkill(brainDir, skillIdOrPath, opts = {}) {
   if (layered && fs.existsSync(destDir) && fs.lstatSync(destDir).isSymbolicLink()) {
     throw new Error(`Refusing layered deploy into symlink: ${destDir}`);
   }
+  if (opts.dryRun) return { success: true, dryRun: true, skillId: resolved.id, destDir,
+    sourcePath: resolved.sourcePath, layered, existed, routeCore: Boolean(opts.routeCore), actions: [
+      { op: 'replace-managed', from: layered && existed ? path.join(resolved.sourcePath, 'core') : resolved.sourcePath, to: layered && existed ? path.join(destDir, 'core') : destDir },
+      ...(opts.routeCore && layered ? [{ op: 'route-core', path: path.join(destDir, 'SKILL.md') }] : []),
+    ] };
   const replacement = layered && existed
     ? replaceSkillDir(path.join(resolved.sourcePath, 'core'), path.join(destDir, 'core'), {
         requiredFile: null,
@@ -463,6 +468,14 @@ export function deploySkill(brainDir, skillIdOrPath, opts = {}) {
       })
     : replaceSkillDir(resolved.sourcePath, destDir, { managedFiles: priorInstall?.managed_files || [] });
 
+  if (opts.routeCore && layered) {
+    const wrapper = path.join(destDir, 'SKILL.md');
+    const current = fs.readFileSync(wrapper, 'utf8');
+    const marker = '<!-- total-recall:managed-core-route:v1 -->';
+    if (!current.includes(marker)) fs.writeFileSync(wrapper, current.replace(/\s*$/, '') +
+      `\n\n${marker}\nRead the [maintained portable core](core/SKILL.md) for current protocol contracts; preserve repository-specific instructions above.\n`);
+  }
+
   let adaptResult = { adapted: false };
   if (opts.adapt && (!layered || !existed)) {
     const openwikiDir =
@@ -536,7 +549,7 @@ function installDetail(entry, inst) {
   const liveHash = exists ? hashSkillContent(inst.path) : null;
   const liveCoreHash = layered && exists ? hashSkillLayer(inst.path, 'core') : null;
   const liveRepoHash = layered && exists ? hashSkillLayer(inst.path, 'repo') : null;
-  const drift = layered
+  const drift = !exists ? true : layered
     ? liveCoreHash !== (entry?.core_hash || inst.core_hash)
     : legacyUnderLayered
       ? false
@@ -548,7 +561,9 @@ function installDetail(entry, inst) {
   return {
     ...inst,
     exists,
+    required: !inst.obsolete,
     live_hash: liveHash,
+    verification: !exists ? 'missing' : legacyUnderLayered ? 'not_adopted' : drift ? 'drifted' : 'verified',
     ...(layered ? {
       core_hash: liveCoreHash,
       repo_hash: liveRepoHash,
@@ -576,7 +591,7 @@ export function skillStatus(brainDir, skillId) {
     } catch (err) {
       // One unreadable install (a symlinked layer, a moved repo) must not hide
       // the status of every other install.
-      return { ...inst, exists: fs.existsSync(inst.path), error: err.message, drift: false };
+      return { ...inst, exists: fs.existsSync(inst.path), error: err.message, drift: true, verification: 'error' };
     }
   });
 
@@ -593,7 +608,11 @@ export function skillStatus(brainDir, skillId) {
     localPath,
     installs: installDetails,
     install_count: installDetails.length,
-    any_drift: installDetails.some((i) => i.drift),
+    any_drift: installDetails.some((i) => !i.obsolete && i.drift),
+    verified: Boolean(entry && localPath) && installDetails.every((i) => i.obsolete || (i.verification === 'verified' && (!i.contract || i.contract.ok))),
+    missing_count: installDetails.filter((i) => !i.obsolete && !i.exists).length,
+    obsolete_count: installDetails.filter((i) => i.obsolete).length,
+    error_count: installDetails.filter((i) => i.error).length,
     any_contract_failure: installDetails.some((i) => i.contract && !i.contract.ok),
   };
 }
@@ -1269,6 +1288,17 @@ export function syncSkillTwoWay(brainDir, skillId, opts = {}) {
   }
 
   const { entry, locations } = collectSkillLocations(brainDir, skillId);
+  const missingInstalls = loadRegistry(brainDir).installs.filter((inst) =>
+    inst.skill_id === skillId && !inst.obsolete && !fs.existsSync(path.join(inst.path, 'SKILL.md')),
+  );
+  if (missingInstalls.length) {
+    return {
+      skillId, in_sync: false, dryRun,
+      error: 'Recorded skill destinations are missing; reconcile existing repositories and deploy explicitly before synchronization',
+      missing: missingInstalls.map((inst) => ({ path: inst.path, repo: inst.repo, repository_exists: Boolean(inst.repo && fs.existsSync(inst.repo)) })),
+      locations: locations.length, actions: [],
+    };
+  }
   if (!locations.length) {
     return { skillId, skipped: true, reason: 'no live copies found' };
   }

package/src/core/surface.mjs

@@ -500,6 +500,30 @@ async function writeShim(shimPath, skillsDir, nodes = [], { vaultDir, derivedDir
   const fullContent = prependDirectives(`${mdcHeader}${baseline}`, rulesBlock);
 
   try {
+    const normShim = path.normalize(shimPath);
+    // Antigravity rules deduplication: .agents/rules/AGENTS.md should be a relative
+    // symlink to ../../AGENTS.md so Antigravity resolves realpath and loads it once.
+    if (normShim.endsWith(path.normalize('.agents/rules/AGENTS.md'))) {
+      if (!fs.existsSync(shimDir)) {
+        fs.mkdirSync(shimDir, { recursive: true });
+      }
+      const relTarget = path.join('..', '..', 'AGENTS.md');
+      try {
+        const stat = fs.lstatSync(shimPath, { throwIfNoEntry: false });
+        if (stat) {
+          if (!stat.isSymbolicLink() || fs.readlinkSync(shimPath) !== relTarget) {
+            fs.unlinkSync(shimPath);
+            fs.symlinkSync(relTarget, shimPath);
+          }
+        } else {
+          fs.symlinkSync(relTarget, shimPath);
+        }
+        return true;
+      } catch {
+        // Fall through to regular write if symlink cannot be created
+      }
+    }
+
     const stat = fs.lstatSync(shimPath, { throwIfNoEntry: false });
     if (stat) {
       if (stat.isSymbolicLink()) {
@@ -552,7 +576,6 @@ const CLIENT_SHIMS = {
   roo:                ['.roo/rules/total-recall.md', '.clinerules/total-recall.md'],
   'roo-code':         ['.roo/rules/total-recall.md', '.clinerules/total-recall.md'],
   antigravity:        ['AGENTS.md', '.agents/rules/AGENTS.md'],
-  gemini:             ['GEMINI.md', '.agents/rules/GEMINI.md'],
   codex:              ['AGENTS.md'],
   grok:               ['AGENTS.md'],
   replit:             ['replit.md'],
@@ -647,6 +670,20 @@ async function compilePointers(instructionsFile, skillsDir, nodes = [], { vaultD
   // plugin-store.mjs likewise), so the peel was never correct for either.
   const baseDir = agentDir;
 
+  // Eradicate deprecated Gemini shims so they do not consume context budgets or inject obsolete rules
+  const deprecatedGeminiPaths = [
+    path.join(baseDir, 'GEMINI.md'),
+    path.join(baseDir, '.agent', 'GEMINI.md'),
+    path.join(baseDir, '.agents', 'rules', 'GEMINI.md')
+  ];
+  for (const depPath of deprecatedGeminiPaths) {
+    try {
+      if (fs.existsSync(depPath)) {
+        fs.unlinkSync(depPath);
+      }
+    } catch {}
+  }
+
   // Determine which client shims to write.
   // `baseDir/.agent/skills/...` only holds for a PROJECT brain. For the global
   // brain baseDir already IS the agent dir, so that path became

package/src/server/auth.mjs

@@ -6,4 +6,44 @@ import { findValidKeyByToken, keyHasAnyScope, recordKeyUsage, recordKeyOutcome }
 import { logger } from '../core/logger.mjs';
 const owner = await loadPluginModule('auth', 'server-auth');
 export const BCRYPT_COST = owner.BCRYPT_COST;
-export const { loadSecurityConfig, apiRateLimiter, authRateLimiter, sandboxRateLimiter, ingestRateLimiter, isLoopbackIp, isMeshIp, isLocalRequest, requireHttps, requireAuthOrLocal, corsOptions, requireAuth, requireScope, requireSandboxEnabled, sessionCookieOptions, loginHandler, changePasswordHandler, mintStepUpToken, verifyStepUpToken, verifyDashboardPassword, logoutHandler, signSessionToken, dashboardAuthState } = owner.createServerAuth({ brainDir, authBrainDir: process.env.TR_SECRETS_BRAIN || brainDir, nodeEnv, watchdog, findValidKeyByToken, keyHasAnyScope, recordKeyUsage, recordKeyOutcome, logger });
+const base = owner.createServerAuth({ brainDir, authBrainDir: process.env.TR_SECRETS_BRAIN || brainDir, nodeEnv, watchdog, findValidKeyByToken, keyHasAnyScope, recordKeyUsage, recordKeyOutcome, logger });
+export const { loadSecurityConfig, apiRateLimiter, authRateLimiter, sandboxRateLimiter, ingestRateLimiter, isLoopbackIp, isMeshIp, isLocalRequest, requireHttps, requireAuthOrLocal, corsOptions, requireScope, requireSandboxEnabled, sessionCookieOptions, loginHandler, changePasswordHandler, mintStepUpToken, verifyStepUpToken, verifyDashboardPassword, logoutHandler, signSessionToken, dashboardAuthState } = base;
+
+const hostName = (value) => String(value || '').replace(/^https?:\/\//, '').replace(/[/?#].*$/, '').replace(/:\d+$/, '').replace(/^\[(.*)\]$/, '$1');
+
+let alwaysRequired = false;
+
+/** Headless hosts (the memory-only runtime) never offer the open-local mode. */
+export function enforceLogin() {
+  alwaysRequired = true;
+}
+
+/**
+ * Dashboard login is optional for a local install. It is required when
+ * `dashboard.require_login` is true, or, when unset, once a dashboard password
+ * exists. When not required, only a genuinely local browser or CLI is let in:
+ * loopback socket, loopback Host header and no foreign Origin (which blocks DNS
+ * rebinding and cross-site requests). Bearer tokens and every other client
+ * (mesh, tunnel, remote) still authenticate normally.
+ */
+export function loginRequired() {
+  if (alwaysRequired) return true;
+  const configured = loadSecurityConfig().dashboard?.require_login;
+  return typeof configured === 'boolean' ? configured : dashboardAuthState().configured;
+}
+
+function isOpenLocalRequest(req) {
+  if (req.headers.authorization) return false;
+  if (!isLocalRequest(req)) return false;
+  if (!isLoopbackIp(hostName(req.headers.host))) return false;
+  const origin = req.headers.origin;
+  return !origin || isLoopbackIp(hostName(origin));
+}
+
+export function requireAuth(req, res, next) {
+  if (!loginRequired() && isOpenLocalRequest(req)) {
+    req.auth = { type: 'dashboard_session', local: true };
+    return next();
+  }
+  return base.requireAuth(req, res, next);
+}

package/src/server/memory-app.mjs

@@ -4,7 +4,7 @@ import cors from 'cors';
 import cookieParser from 'cookie-parser';
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { requireHttps, corsOptions, apiRateLimiter, requireAuthOrLocal } from './auth.mjs';
+import { requireHttps, corsOptions, apiRateLimiter, requireAuthOrLocal, enforceLogin } from './auth.mjs';
 import { memoryRouter } from './routes/memory.mjs';
 import { authRouter } from './routes/auth.mjs';
 import { keysRouter } from './routes/keys.mjs';
@@ -17,6 +17,7 @@ import { getNodes } from '../core/vault-cache.mjs';
 const { version } = JSON.parse(fs.readFileSync(fileURLToPath(new URL('../../package.json', import.meta.url)), 'utf8'));
 
 export function createMemoryApp() {
+  enforceLogin();
   const app = express();
   app.disable('x-powered-by');
   app.set('trust proxy', 'loopback');

package/src/server/routes/auth.mjs

@@ -1,7 +1,31 @@
 /** Required auth plugin adapter for dashboard authentication routes. */
+import express from 'express';
 import * as auth from '../auth.mjs';
 import { logger } from '../../core/logger.mjs';
 import { BRAIN_DIR } from './_shared.mjs';
 import { loadPluginModule } from '../../core/plugin-runtime.mjs';
 const { createAuthRouter } = await loadPluginModule('auth', 'auth-router');
-export const authRouter = createAuthRouter({ auth, logger, BRAIN_DIR });
+const pluginRouter = createAuthRouter({ auth, logger, BRAIN_DIR });
+
+/**
+ * Total Recall has no Google sign-in: the plugin serves it for apps that do,
+ * so this router refuses those routes and drops Google from provider discovery.
+ */
+export const authRouter = express.Router();
+authRouter.use('/auth/google', (_req, res) => res.status(404).json({ error: 'Google sign-in is not available in Total Recall' }));
+authRouter.use('/auth/providers', (req, res, next) => {
+  if (req.method !== 'GET') return next();
+  const json = res.json.bind(res);
+  res.json = (body) => {
+    if (body && typeof body === 'object') delete body.google;
+    return json(body);
+  };
+  next();
+});
+authRouter.use('/auth/status', (req, res, next) => {
+  if (req.method !== 'GET') return next();
+  const json = res.json.bind(res);
+  res.json = (body) => json({ ...body, login_required: auth.loginRequired() });
+  next();
+});
+authRouter.use(pluginRouter);

package/src/server/routes/plugins.mjs

@@ -307,15 +307,28 @@ router.patch("/api/plugins/:id/card-face", requireAuth, requireScope("config:wri
 /**
  * POST /api/plugins/:id/run  body: { subcommand?, args? }
  * Runs the plugin's CLI handler in a child process. Executing plugin code is a
- * write-level action.
+ * write-level action unless the installed manifest explicitly declares the
+ * exact operation read-only. Alternate execution and credential input remain
+ * write-level regardless of that declaration.
  */
-router.post("/api/plugins/:id/run", requireAuth, requireScope("config:write"), async (req, res) => {
+router.post("/api/plugins/:id/run", requireAuth, (req, res, next) => {
+  const { subcommand, args = [], stdin, execution } = req.body || {};
+  try {
+    const plugin = getPluginById(req.params.id, projectRoot());
+    const operation = plugin?.valid && plugin.manifest?.cli?.subcommands?.find(item => item.name === subcommand);
+    res.locals.executionPlugin = plugin;
+    const read = typeof subcommand === 'string' && Array.isArray(args) && args.every(arg => typeof arg === 'string') &&
+      operation?.effect === 'read' && stdin === undefined && !execution &&
+      !operation.args?.some(arg => arg.secret);
+    return requireScope(read ? 'config:read' : 'config:write')(req, res, next);
+  } catch (error) { badRequest(res, error.message); }
+}, async (req, res) => {
   try {
     const { subcommand = "", args = [], stdin, execution } = req.body || {};
     if (typeof subcommand !== "string" || !Array.isArray(args) || args.some((a) => typeof a !== "string")) {
       return badRequest(res, "subcommand must be a string and args an array of strings");
     }
-    const plugin = getPluginById(req.params.id, projectRoot());
+    const plugin = res.locals.executionPlugin;
     if (!plugin) return res.status(404).json({ success: false, error: `Plugin ${req.params.id} not found` });
     if (!plugin.valid) return badRequest(res, `Plugin ${plugin.id} has an invalid manifest: ${plugin.errors.join("; ")}`);
     if (!plugin.manifest?.cli?.handler) return badRequest(res, `Plugin ${plugin.id} does not declare a CLI handler`);
@@ -330,7 +343,7 @@ router.post("/api/plugins/:id/run", requireAuth, requireScope("config:write"), a
       return res.json({ success: result.ok, pluginId: plugin.id, ...result });
     }
 
-    const result = await runPluginCommand(plugin, { subcommand, args, ...(stdin !== undefined ? { stdinText: stdin } : {}), cwd: projectRoot(), secretsBrainDir: process.env.TR_SECRETS_BRAIN || globalBrainDir || BRAIN_DIR });
+    const result = await runPluginCommand(plugin, { subcommand, args, ...(stdin !== undefined ? { stdinText: stdin } : {}), cwd: projectRoot(), secretsBrainDir: process.env.TR_SECRETS_BRAIN || globalBrainDir || BRAIN_DIR, maxOutputBytes: 4 * 1024 * 1024 });
     res.json({ success: result.ok, pluginId: plugin.id, ...result });
   } catch (err) {
     badRequest(res, err.message);