total-recall-brain 3.41.2 → 3.41.4

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-carriers.mjs

@@ -0,0 +1,76 @@
+/**
+ * Where the secrets-store master password lives on this host.
+ *
+ * The sanctioned carriers are owner-only: the macOS Keychain, the launchd
+ * agent plist and `~/.agent/tr.env`. An `export TR_SECRETS_PASSWORD=…` in a
+ * shell profile or in /etc/environment is ambient: every process started from
+ * a shell (or, for /etc/environment, every login) inherits it, and a process
+ * manager such as pm2 then captures it into each app it starts. This module
+ * finds those exports and removes them once a sanctioned carrier holds the
+ * same password. It reports files and line numbers, never values.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { secretsPassword } from './secrets-gateway.mjs';
+
+const EXPORT = /^\s*(?:export\s+)?(?:TR_SECRETS_PASSWORD|TR_MASTER_PASSWORD)\s*=/;
+const PROFILES = ['.bashrc', '.bash_profile', '.profile', '.zshrc', '.zprofile', '.zshenv'];
+
+/** Shell and system files that can make the password ambient. */
+export function ambientCandidateFiles({ home = os.homedir(), etc = '/etc' } = {}) {
+  const files = PROFILES.map((name) => path.join(home, name));
+  files.push(path.join(etc, 'environment'), path.join(etc, 'profile'), path.join(etc, 'zshenv'));
+  try {
+    for (const name of fs.readdirSync(path.join(etc, 'profile.d'))) {
+      if (name.endsWith('.sh')) files.push(path.join(etc, 'profile.d', name));
+    }
+  } catch { /* no profile.d */ }
+  return files;
+}
+
+/** Lines that export the master password, by file. */
+export function findAmbientPasswordExports(files = ambientCandidateFiles()) {
+  const found = [];
+  for (const file of files) {
+    let text;
+    try { text = fs.readFileSync(file, 'utf8'); } catch { continue; }
+    const lines = text.split('\n').map((line, index) => (EXPORT.test(line) ? index + 1 : 0)).filter(Boolean);
+    if (lines.length) found.push({ file, lines });
+  }
+  return found;
+}
+
+/** The password a sanctioned carrier returns with the environment ignored. */
+export function carrierPassword(env = process.env, resolve = secretsPassword) {
+  const quiet = { ...env };
+  delete quiet.TR_SECRETS_PASSWORD;
+  delete quiet.TR_MASTER_PASSWORD;
+  return resolve({ env: quiet }) || null;
+}
+
+/**
+ * Remove ambient exports, only when a sanctioned carrier already returns the
+ * password this process was given; otherwise the store would be locked out.
+ *
+ * @param {{ files?: string[], env?: object, resolve?: Function }} [opts]
+ */
+export function removeAmbientPasswordExports({ files = ambientCandidateFiles(), env = process.env, resolve = secretsPassword } = {}) {
+  const exports = findAmbientPasswordExports(files);
+  if (!exports.length) return { removed: [], carrier: 'not-checked' };
+  const current = env.TR_SECRETS_PASSWORD || env.TR_MASTER_PASSWORD;
+  const carried = carrierPassword(env, resolve);
+  if (!carried) throw new Error('No owner-only carrier (Keychain, launchd agent or ~/.agent/tr.env) holds the master password; set one with `auth secret rekey --env-file|--keychain` before removing ambient exports');
+  if (current && carried !== current) throw new Error('The owner-only carrier holds a different password than this environment; reconcile them before removing ambient exports');
+  const removed = [];
+  for (const { file, lines } of exports) {
+    const text = fs.readFileSync(file, 'utf8');
+    const kept = text.split('\n').filter((line) => !EXPORT.test(line)).join('\n');
+    const mode = fs.statSync(file).mode & 0o777;
+    const tmp = `${file}.tr-tmp-${process.pid}`;
+    fs.writeFileSync(tmp, kept, { mode });
+    fs.renameSync(tmp, file);
+    removed.push({ file, lines });
+  }
+  return { removed, carrier: 'verified' };
+}

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-prune.mjs

@@ -0,0 +1,37 @@
+/**
+ * `auth secret prune`: a read-only report of secrets worth removing or consolidating.
+ *
+ * A key is a candidate when it is bound to no repository, its provider tracking reports an
+ * error (usually a dead key), or it shares a value with another key. Nothing is deleted;
+ * the report says why each key is listed so the owner decides.
+ */
+
+/** @param {Array<{key:string, repos?:string[], tracking_status?:string|null, tracking_exempt?:boolean, fingerprint_full?:string|null, set?:boolean}>} rows */
+export function pruneCandidates(rows) {
+  const byFingerprint = new Map();
+  for (const row of rows) {
+    if (!row.set || !row.fingerprint_full) continue;
+    if (!byFingerprint.has(row.fingerprint_full)) byFingerprint.set(row.fingerprint_full, []);
+    byFingerprint.get(row.fingerprint_full).push(row.key);
+  }
+  const out = [];
+  for (const row of rows) {
+    const reasons = [];
+    if (!(row.repos || []).length) reasons.push('unbound');
+    if (row.tracking_status === 'error' && !row.tracking_exempt) reasons.push('error');
+    const twins = (byFingerprint.get(row.fingerprint_full) || []).filter((key) => key !== row.key);
+    if (twins.length) reasons.push(`same value as ${twins.join(', ')}`);
+    if (reasons.length) out.push({ key: row.key, reasons, provider: row.provider || null });
+  }
+  return out.sort((a, b) => b.reasons.length - a.reasons.length || a.key.localeCompare(b.key));
+}
+
+export function pruneSummary(rows, candidates) {
+  return {
+    total: rows.length,
+    candidates: candidates.length,
+    unbound: candidates.filter((c) => c.reasons.includes('unbound')).length,
+    errored: candidates.filter((c) => c.reasons.includes('error')).length,
+    duplicated: candidates.filter((c) => c.reasons.some((r) => r.startsWith('same value'))).length,
+  };
+}

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-sync.mjs

@@ -4,20 +4,22 @@ import { getLeaderInfo, isLeader } from './leader-election.mjs';
 import { logger } from './logger.mjs';
 import { brainDir } from './config.mjs';
 import { resolveSecretsPath, loadSecrets, saveSecrets, ensureMeta, appendAudit, META_KEY } from './secrets-store.mjs';
+import { projectGithubLogin } from './login-projections.mjs';
 
 const REQUEST_TIMEOUT_MS = 10_000;
+const FETCH_CONCURRENCY = 8;
 
 function serverPort() {
   const value = Number(process.env.TR_SERVER_PORT || process.env.PORT || 3000);
   return Number.isInteger(value) && value > 0 && value <= 65535 ? value : 3000;
 }
 
-function meshUrl(ip, route) {
+function meshUrl(ip, route, port = serverPort()) {
   const octets = String(ip || '').split('.').map(Number);
   if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255) || octets[0] !== 100 || octets[1] < 64 || octets[1] > 127) {
     throw new Error('Leader IP is outside the Tailscale CGNAT range');
   }
-  return `http://${ip}:${serverPort()}${route}`;
+  return `http://${ip}:${port}${route}`;
 }
 
 export function getSecretsChecksum() {
@@ -39,23 +41,42 @@ export function secretsSyncMode(env = process.env) {
  * anything. The node's store is never replaced wholesale and the node keeps
  * its own master password.
  */
-export async function syncGrantedSecrets(leaderIp, { dir = brainDir, fetchImpl = fetch } = {}) {
-  const base = meshUrl(leaderIp, '/api/secrets/mesh');
-  const listResponse = await fetchImpl(base, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+export async function syncGrantedSecrets(leaderIp, { dir = brainDir, fetchImpl = fetch, port } = {}) {
+  // The leader's port, never this node's: the droplet serves on 3900 while devices
+  // default to 3000, and assuming our own port made every sync fail.
+  const base = meshUrl(leaderIp, '/api/secrets/mesh', port || serverPort());
+  let listResponse;
+  try {
+    listResponse = await fetchImpl(base, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+  } catch (err) {
+    // "fetch failed" alone named neither the address nor the reason.
+    throw new Error(`No Total Recall server answered at ${base}: ${err.cause?.code || err.message}`);
+  }
   if (!listResponse.ok) throw new Error(`Leader returned ${listResponse.status}`);
   const { keys } = await listResponse.json();
   if (!Array.isArray(keys)) throw new Error('Invalid grant list');
 
+  // Each key costs the leader a store decryption plus a mesh round trip (2-3 s from a laptop),
+  // so a few at a time keeps a full sync under a minute instead of several.
   const fetched = {};
-  for (const key of keys) {
-    const response = await fetchImpl(`${base}/${encodeURIComponent(key)}`, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
-    if (!response.ok) throw new Error(`Leader returned ${response.status} for ${key}`);
-    fetched[key] = (await response.json()).value;
-  }
+  let next = 0;
+  const worker = async () => {
+    while (next < keys.length) {
+      const key = keys[next++];
+      const response = await fetchImpl(`${base}/${encodeURIComponent(key)}`, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+      if (!response.ok) throw new Error(`Leader returned ${response.status} for ${key}`);
+      fetched[key] = (await response.json()).value;
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(FETCH_CONCURRENCY, keys.length) }, worker));
 
   const secrets = ensureMeta(await loadSecrets(dir));
-  const previous = Array.isArray(secrets[META_KEY].mesh_granted) ? secrets[META_KEY].mesh_granted : [];
-  const removed = previous.filter((key) => !(key in fetched) && key in secrets);
+  // Only keys this sync created may be removed when their grant is revoked. A key the node
+  // already held before it was ever granted is the node's own: revoking the grant must not
+  // delete it (on the node that owns the full store, that would wipe its secrets).
+  const previouslySynced = Array.isArray(secrets[META_KEY].mesh_synced) ? secrets[META_KEY].mesh_synced : [];
+  const created = Object.keys(fetched).filter((key) => !(key in secrets));
+  const removed = previouslySynced.filter((key) => !(key in fetched) && key in secrets);
   for (const key of removed) {
     delete secrets[key];
     delete secrets[META_KEY].keys?.[key];
@@ -66,16 +87,31 @@ export async function syncGrantedSecrets(leaderIp, { dir = brainDir, fetchImpl =
     secrets[key] = value;
   }
   secrets[META_KEY].mesh_granted = Object.keys(fetched);
+  secrets[META_KEY].mesh_synced = [...new Set([...previouslySynced.filter((key) => key in fetched), ...created])];
   await saveSecrets(dir, secrets);
   appendAudit(dir, { action: 'mesh_grant_sync', key: `(${keys.length} granted, ${removed.length} revoked)`, actor: 'mesh-sync' });
   return { granted: keys.length, updated, removed: removed.length };
 }
 
+/** Sign in the tools that use synced secrets (today: gh from github_token). */
+export async function projectLogins({ dir = brainDir, run } = {}) {
+  const secrets = await loadSecrets(dir);
+  const github = await projectGithubLogin({ token: secrets.github_token || secrets.GITHUB_TOKEN, run });
+  if (github.status === 'logged-in') appendAudit(dir, { action: 'login_projection', key: 'github_token -> gh', actor: 'mesh-sync' });
+  if (github.status === 'failed') logger.error('secrets-sync', 'gh login from github_token failed', { error: github.error });
+  return { github };
+}
+
 export async function syncLoop() {
   secretsSyncMode();
-  if (await isLeader()) return;
-  const leaderInfo = await getLeaderInfo();
-  if (!leaderInfo?.ip) return;
-  try { await syncGrantedSecrets(leaderInfo.ip); }
-  catch (err) { logger.error('secrets-sync', 'Failed to sync granted secrets', { error: err.message }); }
+  if (!(await isLeader())) {
+    const leaderInfo = await getLeaderInfo();
+    if (leaderInfo?.ip) {
+      try { await syncGrantedSecrets(leaderInfo.ip, { port: leaderInfo.port }); }
+      catch (err) { logger.error('secrets-sync', 'Failed to sync granted secrets', { error: err.message }); }
+    }
+  }
+  // Even when the leader is unreachable, the last synced token should still be signed in.
+  try { await projectLogins(); }
+  catch (err) { logger.error('secrets-sync', 'Login projection failed', { error: err.message }); }
 }

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/DESIGN.md

@@ -3,17 +3,65 @@
 ```yaml
 tokens:
   brand-name: "Auth & Secrets"
-  wordmark: "ENCLAVE AUTH"
+  wordmark: "AUTH & SECRETS"
   color-primary: "#10b981"
   color-background: "#064e3b"
   color-accent: "#34d399"
-  badge: "FIDO2 Enclave"
-  font-body: "system-ui, -apple-system, sans-serif"
-  font-mono: "'JetBrains Mono', monospace"
+  color-ok: "#059669"
+  color-warn: "#d97706"
+  color-danger: "#dc2626"
+  font-body: "Outfit, system-ui, sans-serif"
+  font-mono: "'JetBrains Mono', ui-monospace, monospace"
   border-radius: "8px"
+  density: "compact"
+  motion: "120ms ease-out"
 ```
 
-## Brand & Typographic Wordmark
-- **Name**: Auth & Secrets
-- **Wordmark Logo**: `ENCLAVE AUTH`
-- **Palette**: Deep Forest `#064e3b`, Emerald `#10b981`, Mint `#34d399`. Secure biometric FIDO2 WebAuthn & OAuth2 sessions.
+## Who this card is for
+
+The operator and autonomous agents managing access control, cryptographic secrets, and identities across the mesh.
+
+The operator opens this card during active administration: verifying biometric passkeys, checking Google OAuth token freshness, auditing 90-day secret rotation schedules, or inspecting active session integrity.
+
+## The four tasks, in the order the card presents them
+
+| Screen | Task Frequency | Operational Rationale |
+| :--- | :--- | :--- |
+| **Passkeys** | Daily / Routine | Biometric hardware authentication via WebAuthn FIDO2. The operator checks registered authenticators and manages credential devices. |
+| **Google OAuth** | Frequent | Identity bridge accounts. The operator monitors token expiration, executes manual refreshes, and reviews account scopes. |
+| **Secrets** | Continuous | Cryptographic credential vault. The operator audits key freshness, tracks rotation deadlines, and checks provider bindings. |
+| **Audit & Sessions** | Incident / Review | Security baseline verification. The operator inspects live access sessions and reviews policy findings. |
+
+Screen ordering follows task frequency and operational urgency rather than arbitrary command taxonomy.
+
+## The core tasks
+
+1. **Verify security posture instantly** — confirm that the secrets store is sealed, zero rotation schedules are overdue, and the security audit baseline passes.
+2. **Manage biometric hardware passkeys** — inspect registered platform authenticators (Face ID, Touch ID, Windows Hello) and security keys (YubiKey), register new authenticators, and safely revoke decommissioned hardware.
+3. **Supervise OAuth tokens** — verify Google OAuth connection status, monitor token lifetime, refresh expiring credentials, and safely disconnect accounts.
+4. **Audit secret hygiene** — review key expiration dates, inspect multi-repo bindings, verify remote deployment targets, and trigger rotation workflows without exposing secret values to the DOM.
+
+## What must be visible without a single click
+
+- **Security Verdict Line:** A clear verdict ("Secure" or the count of active warnings) and timestamp of the latest verification.
+- **Passkey Count:** Total active hardware authenticators registered on the system.
+- **OAuth Status:** Connected accounts and token health status.
+- **Secrets Store Telemetry:** Total stored keys and count of overdue rotations.
+- **Baseline Audit State:** System security verification status (Passed or Flagged).
+
+## Why the layout is this layout
+
+The card face provides a wide, responsive workspace rather than a narrow column.
+
+- **Security Verdict at the Top:** The operator requires an immediate assessment. A prominent verdict line answers whether the authentication system is healthy before secondary details appear.
+- **Horizontal Task Navigation:** Four dedicated domain screens (Passkeys, Google OAuth, Secrets, Audit & Sessions) organize operations by user intent rather than raw CLI syntax.
+- **Zero Raw Secrets in DOM:** Secret values are never rendered, logged, or accepted via input fields. The interface exposes only key names, providers, fingerprints, creation timestamps, and rotation schedules.
+- **Safe Revocation Guards:** Destructive actions such as credential revocation require explicit confirmation and display prominent warning styling. Deleting the final authentication method is blocked to prevent accidental administrative lockout.
+- **Real Telemetry Only:** All figures render em dashes (`—`) until returned by the host. Zero mock responses, zero seeded numbers, and zero reassuring default strings appear in error branches.
+
+## Responsive presentation and accessibility
+
+- **Breakpoints:** Verified across mobile (360 CSS px), tablet (768 CSS px), and desktop (1280 CSS px) viewports.
+- **Host Theme Adaptation:** Injected dark-dashboard variables (`--text-primary`, `--text-secondary`, `--bg-primary`, `--bg-secondary`, `--border`, `--accent`) govern surfaces and typography.
+- **Touch Targets:** All interactive controls declare a minimum height of 44 px.
+- **Reduced Motion:** All transitions and indicators respect `prefers-reduced-motion` settings.