total-recall-brain 3.41.3 → 3.41.5

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -5,7 +5,8 @@
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {
     "test": "node --test test/*.test.mjs",
-    "build:ui": "node scripts/build-ui.mjs"
+    "build:ui": "node scripts/build-ui.mjs",
+    "ssss": "ssss"
   },
   "license": "MIT",
   "files": [
@@ -21,5 +22,8 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "@gregiteen/ssss-cli": "0.14.4"
   }
 }

package/src/cli/compact.mjs

@@ -0,0 +1,108 @@
+import { parseLayerFlag } from './agent-dir.mjs';
+import { loadContextNodes } from './context.mjs';
+import { curatedRules, selectRules } from '../core/context-policy.mjs';
+import { compactRules } from '../core/context-compactor.mjs';
+import { cosineSimilarity, getEmbedding, loadEmbeddingsIndex } from '../core/embeddings.mjs';
+import { legacyRuleContributions } from '../core/surface.mjs';
+
+const DEFAULT_BUDGET = 4000;
+const EMBED_TIMEOUT_MS = 8000;
+
+const USAGE = `Usage: total-recall compact "task" [--budget 4000] [--action edit,test] [--expand slug,slug] [--format text|json] [--project|--global]
+Fits the applicable rules into --budget estimated tokens, ranked against the task. Rules keep their own words: full text, a leading excerpt, or a slug under Referenced. Read any of them in full with --expand. The output is partial by design; \`total-recall context\` prints the complete capsule.`;
+
+function parseArgs(args) {
+  const options = { budget: DEFAULT_BUDGET, actions: [], expand: [], format: 'text' };
+  for (let i = 1; i < args.length; i++) {
+    const flag = args[i];
+    const value = args[++i];
+    if (flag === '--budget') options.budget = Number(value);
+    else if (flag === '--action') options.actions = value?.split(',').filter(Boolean) || [];
+    else if (flag === '--expand') options.expand = value?.split(',').filter(Boolean) || [];
+    else if (flag === '--format' && ['json', 'text'].includes(value)) options.format = value;
+    else throw new Error(`Unknown compact option: ${flag}`);
+  }
+  if (!Number.isFinite(options.budget) || options.budget < 1) throw new Error('--budget must be a positive number of tokens');
+  return options;
+}
+
+function loadVectors(derivedDirs) {
+  const vectors = {};
+  for (const dir of derivedDirs) {
+    try {
+      for (const [slug, entry] of Object.entries(loadEmbeddingsIndex(dir))) vectors[slug] ??= entry.embedding;
+    } catch { /* a brain without an index simply contributes no vectors */ }
+  }
+  return vectors;
+}
+
+async function embedTask(task) {
+  let timer;
+  const timeout = new Promise(resolve => { timer = setTimeout(() => resolve(null), EMBED_TIMEOUT_MS); });
+  try {
+    return await Promise.race([getEmbedding(task), timeout]);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function lexicalScore(terms, text) {
+  if (!terms.length) return 0;
+  const haystack = text.toLowerCase();
+  return terms.filter(term => haystack.includes(term)).length / terms.length;
+}
+
+/** Rank the applicable rules against the task and fit them into `budget`. Shared by `compact` and `context`. */
+export async function compactNodes({ task, actions = [], budget, expand = [], complete = false, nodes, skillsDir, derivedDirs, header }) {
+  const rules = selectRules(curatedRules(nodes), { actions, projectRoot: process.cwd() });
+  const vectors = loadVectors(derivedDirs);
+  const taskVector = await embedTask(task);
+  const terms = String(task).toLowerCase().match(/[\p{L}\p{N}_-]{3,}/gu) || [];
+  const semantic = Boolean(taskVector);
+
+  const score = (slug, text) => semantic && vectors[slug] ? cosineSimilarity(taskVector, vectors[slug]) : lexicalScore(terms, text);
+  const items = rules.map(node => {
+    const body = (node._directive || node.body || node.content || '').trim();
+    return {
+      slug: node.slug, body, priority: node.priority, importance: node.importance,
+      text: node._directive ? `[${node.slug}] ${node._directive}` : `## ${node.title || node.slug} [${node.slug}]\n\n${body}`,
+      vector: vectors[node.slug], score: score(node.slug, `${node.title || ''} ${body}`),
+    };
+  });
+  for (const { id, text } of legacyRuleContributions(skillsDir)) {
+    items.push({ slug: id, body: text, text, score: lexicalScore(terms, text) });
+  }
+
+  const ranking = semantic ? 'semantic' : 'lexical';
+  return { ranking, ...compactRules(items, { budget, expand, complete, header: (counts, tokens) => header(counts, tokens, ranking) }) };
+}
+
+export default async function compact(args = []) {
+  if (!args.length || args.includes('--help') || args.includes('-h')) {
+    console.log(USAGE);
+    return;
+  }
+  const { layer, remainingArgs } = parseLayerFlag(args);
+  const task = remainingArgs[0];
+  const { budget, actions, expand, format } = parseArgs(remainingArgs);
+  const { nodes, skillsDir, derivedDirs } = loadContextNodes(layer);
+  const header = (counts, tokens, ranking) => [
+    `compacted:true tokens:${tokens} budget:${budget} rules:${counts.rules} full:${counts.full} summarized:${counts.summarized} referenced:${counts.referenced} duplicate:${counts.duplicate} omitted:${counts.omitted} ranking:${ranking}`,
+    'PARTIAL: read any rule in full with --expand <slug>; total-recall context prints the complete capsule.',
+  ].join('\n');
+
+  let result;
+  try {
+    result = await compactNodes({ task, actions, budget, expand, nodes, skillsDir, derivedDirs, header });
+  } catch (error) {
+    console.log(error.requiredBudget ? `compacted:false reason:budget-too-small budget:${budget} required_budget:${error.requiredBudget}` : `compacted:false reason:${error.message}`);
+    process.exitCode = 2;
+    return;
+  }
+  const { context, counts, tokens, tiers, ranking } = result;
+  console.log(format === 'json'
+    ? JSON.stringify({ compacted: true, ranking, budget, tokens, counts, tiers, context })
+    : context);
+}

package/src/cli/config.mjs

@@ -17,6 +17,9 @@ const KEY_MAP = {
   'public_health': { file: 'security', path: 'network.public_health', type: 'boolean' },
   'allowed_origins': { file: 'security', path: 'network.allowed_origins', type: 'array' },
 
+  // How long a `total-recall preflight ack` receipt stays fresh. Recorded in the receipt when it is written.
+  'preflight_max_age_minutes': { file: 'preflight', path: 'preflight.max_age_minutes', type: 'number' },
+
   'daily_cap_usd': { file: 'budget', path: 'budget.daily_cap_usd', type: 'number' },
   'weekly_cap_usd': { file: 'budget', path: 'budget.weekly_cap_usd', type: 'number' },
   'budget_enabled': { file: 'budget', path: 'budget.enabled', type: 'boolean' },

package/src/cli/connect.mjs

@@ -151,17 +151,7 @@ export const CLIENTS = {
     label: 'Antigravity',
     mode: 'symlink',
     target: '.agents/rules/AGENTS.md',
-    // Antigravity reads workspace skills from .agents/skills and exposes
-    // native /name invocation; Gemini TOML commands are a separate surface.
-    skillsProjection: { scope: 'project', dir: path.join('.agents', 'skills') }
-  },
-  gemini: {
-    label: 'Gemini',
-    mode: 'symlink',
-    target: '.agents/rules/GEMINI.md',
-    writeSlashCommands: true,
-    // Gemini CLI activates workspace skills from .agents/skills via /skills;
-    // explicit /name commands require separate .gemini/commands/*.toml files.
+    // Antigravity reads workspace skills from .agents/skills and exposes native /name invocation
     skillsProjection: { scope: 'project', dir: path.join('.agents', 'skills') }
   },
   aider: {
@@ -233,7 +223,6 @@ function printHelp() {
     claude-code
     codex
     antigravity
-    gemini
     grok
     replit
     lovable
@@ -643,94 +632,6 @@ $ARGUMENTS`
   return written;
 }
 
-function writeGeminiSlashCommands(opts) {
-  const globalDir = path.join(os.homedir(), '.gemini', 'commands');
-  const localDir = path.join(process.cwd(), '.gemini', 'commands');
-
-  fs.mkdirSync(globalDir, { recursive: true });
-  fs.mkdirSync(localDir, { recursive: true });
-
-  const base = (opts.brain || 'http://127.0.0.1:3000').replace(/\/$/, '');
-  const token = '<YOUR_PAT_TOKEN>';
-
-  const commands = {
-    'memory.toml': {
-      description: 'Search or manage Total Recall memory',
-      prompt: `You are Antigravity, an AI assistant with the Total Recall SSSS v2 memory vault.
-Search the semantic memory vault or fetch nodes using the following query:
-{{args}}
-
-Instructions:
-Perform a POST request to \`${base}/api/memory/search/semantic\` with the body \`{"query": "{{args}}", "top_k": 5}\` and Authorization: Bearer ${token}.`
-    },
-    'brain.toml': {
-      description: 'Show Total Recall brain status and health',
-      prompt: `Show the health, loaded model status, and statistics of the local Total Recall Total Recall System brain.
-
-Instructions:
-Query the health of the local brain by sending a GET request to \`${base}/health\` with Authorization: Bearer ${token}.`
-    },
-    'vault.toml': {
-      description: 'Compile or inspect the Total Recall SSSS memory vault',
-      prompt: `Compile, rebuild, or inspect the Structured Semantic Syntax System (SSSS) memory vault.
-
-Instructions:
-1. If the argument is "compile", send a POST request to \`${base}/api/vault/compile\` with Authorization: Bearer ${token} or run \`npx total-recall compile\`.
-2. If the argument is "nodes", send a GET request to \`${base}/api/memory\` with Authorization: Bearer ${token}.
-3. Summarize the changes and verify rule propagation across the workspace.`
-    },
-    'ssss.toml': {
-      description: 'Explore SSSS cognitive graph, backlinks, and network statistics',
-      prompt: `You are Antigravity, an AI assistant with the Total Recall SSSS v2 memory vault.
-Explore the SSSS cognitive graph, backlinks, and network topology using the query:
-{{args}}
-
-Instructions:
-1. Parse the arguments.
-2. If "stats", run \`npx total-recall map --relations\` to retrieve and summarize cognitive graph metrics, Highly Connected Hubs, and unlinked Orphans.
-3. If "map <slug>", print the inbound backlinks and outbound relations for the specified memory node slug using \`npx total-recall map --relations\`.
-4. If "compile", send a POST request to \`${base}/api/vault/compile\` with Authorization: Bearer ${token} or run \`npx total-recall compile\`.
-5. If "help", explain the SSSS v2 specification, categories (invariants, preferences, anti-patterns, patterns, decisions, concepts, facts, lore) and the bidirectional backlink structure.`
-    },
-    'recall.toml': {
-      description: 'Ask Total Recall brain a question or run a specialized agent task',
-      prompt: `Send a direct conversational query or task instruction to the Total Recall local brain.
-Query: {{args}}
-
-Instructions:
-1. Query the memory vault for relevant context by sending a POST request to \`${base}/api/memory/search/semantic\` with the body \`{"query": "{{args}}", "top_k": 5}\` and Authorization: Bearer ${token}.
-2. Address the user's inquiry thoroughly, referencing active memory nodes where applicable.`
-    }
-  };
-
-  const written = [];
-  for (const [filename, cmd] of Object.entries(commands)) {
-    const tomlContent = `description = "${cmd.description}"\nprompt = """\n${cmd.prompt}\n"""\n`;
-
-    // Write global command
-    const globalPath = path.join(globalDir, filename);
-    const globalExisted = fs.existsSync(globalPath);
-    if (!globalExisted || opts.force) {
-      fs.writeFileSync(globalPath, tomlContent, 'utf8');
-      written.push({ file: `global/${filename}`, action: globalExisted ? 'updated' : 'created' });
-    } else {
-      written.push({ file: `global/${filename}`, action: 'exists' });
-    }
-
-    // Write local command
-    const localPath = path.join(localDir, filename);
-    const localExisted = fs.existsSync(localPath);
-    if (!localExisted || opts.force) {
-      fs.writeFileSync(localPath, tomlContent, 'utf8');
-      written.push({ file: `local/${filename}`, action: localExisted ? 'updated' : 'created' });
-    } else {
-      written.push({ file: `local/${filename}`, action: 'exists' });
-    }
-  }
-
-  return written;
-}
-
 
 export default async function connect(args) {
   const opts = parseArgs(args);
@@ -739,6 +640,11 @@ export default async function connect(args) {
     return;
   }
 
+  if (opts.client === 'gemini') {
+    console.error("Gemini CLI was deprecated by Google; Antigravity (agy) is the official Google agent harness. Run 'total-recall connect antigravity' instead.");
+    process.exit(1);
+  }
+
   const preset = CLIENTS[opts.client];
   if (!preset) {
     console.error(`Unknown client: ${opts.client}`);
@@ -967,22 +873,12 @@ export default async function connect(args) {
 
   // Write slash commands
   if (preset.writeSlashCommands) {
-    if (opts.client === 'gemini') {
-      const slashResults = writeGeminiSlashCommands(opts);
-      result.slash_commands = slashResults;
-      const created = slashResults.filter(r => r.action !== 'exists');
-      if (created.length > 0) {
-        result.notes.push(`  Slash commands written to ~/.gemini/commands/ and .gemini/commands/:\n` +
-          created.map(r => `    ${r.file} (${r.action})`).join('\n'));
-      }
-    } else {
-      const slashResults = writeClaudeCodeSlashCommands(opts);
-      result.slash_commands = slashResults;
-      const created = slashResults.filter(r => r.action !== 'exists');
-      if (created.length > 0) {
-        result.notes.push(`  Slash commands written to ~/.claude/commands/:\n` +
-          created.map(r => `    /${r.file.replace('.md', '')} (${r.action})`).join('\n'));
-      }
+    const slashResults = writeClaudeCodeSlashCommands(opts);
+    result.slash_commands = slashResults;
+    const created = slashResults.filter(r => r.action !== 'exists');
+    if (created.length > 0) {
+      result.notes.push(`  Slash commands written to ~/.claude/commands/:\n` +
+        created.map(r => `    /${r.file.replace('.md', '')} (${r.action})`).join('\n'));
     }
   }
 

package/src/cli/context.mjs

@@ -2,15 +2,61 @@ import path from 'node:path';
 import { getBothBrains, parseLayerFlag } from './agent-dir.mjs';
 import { getNodes } from '../core/vault-cache.mjs';
 import { mergeGlobalRuleNodes, legacyRuleContributions } from '../core/surface.mjs';
-import { compileContext, capsuleResponse, renderCapsule } from '../core/context-compiler.mjs';
+import { compileContext, capsuleResponse, renderCapsule, PREFLIGHT_NOTICE } from '../core/context-compiler.mjs';
 import { isBrainEnabled } from '../core/brain-registry.mjs';
 import { surfaceInputsHash } from '../core/command-surface.mjs';
 import { readConfigValue } from './config.mjs';
 import { recordCapsule } from '../core/context-telemetry.mjs';
 
+/** About 28 KB: harnesses save output over about 30 KB to a file instead of showing it, which agents then cannot read (audit C-005, F-019). */
+export const CAPSULE_LIMIT = 7000;
+const JSON_ESCAPE_SHARE = 0.97;
+const JSON_WRAPPER_TOKENS = 128;
+
+/** The merged rule nodes a capsule draws from, for the selected layer. */
+export function loadContextNodes(layer) {
+  const brains = getBothBrains();
+  const own = layer !== 'global' && brains.project && isBrainEnabled(brains.project.brainDir) ? brains.project.brainDir : null;
+  const global = layer !== 'project' && brains.global && isBrainEnabled(brains.global.brainDir) ? brains.global.brainDir : null;
+  if (!own && !global) throw new Error('No enabled brain in selected scope');
+  const nodes = own ? mergeGlobalRuleNodes(getNodes(path.join(own, 'memory-vault')), global ? getNodes(path.join(global, 'memory-vault')) : []) :
+    getNodes(path.join(global, 'memory-vault')).map(n => ({ ...n, _layer: 'global' }));
+  return { nodes, skillsDir: path.dirname(own || global),
+    derivedDirs: [own, global].filter(Boolean).map(dir => path.join(dir, 'memory-derived')) };
+}
+
+/** Compact the over-budget capsule, or explain the budget it needs. `fullRequired` is what the uncompacted capsule would take. */
+async function printCompacted({ query, actions, budget, format, version, fullRequired, nodes, skillsDir, derivedDirs }) {
+  const { compactNodes } = await import('./compact.mjs');
+  // JSON escaping and its wrapper count against the budget too.
+  const target = format === 'json' ? Math.floor(budget * JSON_ESCAPE_SHARE) - JSON_WRAPPER_TOKENS : budget;
+  const header = (counts, tokens, ranking) => [
+    `ready:true compacted:true tokens:${tokens} budget:${budget} version:${version} rules:${counts.rules} full:${counts.full} summarized:${counts.summarized} referenced:${counts.referenced} duplicate:${counts.duplicate} ranking:${ranking}`,
+    PREFLIGHT_NOTICE,
+    `COMPACTED: every rule below still applies. Read a referenced rule with: total-recall compact "<task>" --expand <slug>`,
+  ].join('\n');
+  let result;
+  try {
+    result = await compactNodes({ task: query, actions, budget: Math.max(target, 1), complete: true, nodes, skillsDir, derivedDirs, header });
+  } catch (error) {
+    if (!error.requiredBudget) throw error;
+    const floor = format === 'json' ? Math.ceil((error.requiredBudget + JSON_WRAPPER_TOKENS) / JSON_ESCAPE_SHARE) : error.requiredBudget;
+    const requiredBudget = Math.min(fullRequired, floor);
+    console.log(format === 'json'
+      ? JSON.stringify({ ready: false, reason: 'budget-overflow', context: '', stats: { version, budget, required_budget: requiredBudget, token_measurement: 'estimated_chars_divided_by_four' } })
+      : `ready:false reason:budget-overflow budget:${budget} required_budget:${requiredBudget} version:${version}\nThis budget cannot hold every rule even compacted. Retry with --budget ${requiredBudget}; do not act until ready:true.`);
+    process.exitCode = 2;
+    return;
+  }
+  console.log(format === 'json'
+    ? JSON.stringify({ ready: true, compacted: true, ranking: result.ranking, context: result.context, counts: result.counts,
+      stats: { version, budget, total_tokens: result.tokens, token_measurement: 'estimated_chars_divided_by_four' } })
+    : result.context);
+}
+
 export default async function context(args = []) {
   if (!args.length || args.includes('--help')) {
-    console.log('Usage: total-recall context "task" [--action edit,test,publish] [--budget 4000] [--format text|json] [--knowledge] [--debug] [--project|--global]\nLocal rules only by default. Unknown applicability is required. Overflow exits 2; do not act until the complete output fits. --knowledge adds supporting documents; --debug exposes inventories within the same budget. Refresh on task/action/project or policy changes.');
+    console.log(`Usage: total-recall context "task" [--action edit,test,publish] [--budget ${CAPSULE_LIMIT}] [--format text|json] [--knowledge] [--debug] [--project|--global]\nLocal rules only by default. Unknown applicability is required. Over budget, the capsule compacts automatically: absolute rules keep at least a summary and every other rule keeps at least its slug. Configured budgets are capped at ${CAPSULE_LIMIT}; pass a larger --budget to print the full capsule. Exit 2 means the budget cannot hold every rule; do not act until ready:true. --knowledge adds supporting documents; --debug exposes inventories within the same budget. Refresh on task/action/project or policy changes.`);
     return;
   }
   const { layer, remainingArgs } = parseLayerFlag(args);
@@ -24,7 +70,7 @@ export default async function context(args = []) {
     }
     return undefined;
   })();
-  let actions = [], budget = configuredBudget ?? 4000, format = 'text', includeKnowledge = false, debug = false;
+  let actions = [], budget = Math.min(configuredBudget ?? CAPSULE_LIMIT, CAPSULE_LIMIT), format = 'text', includeKnowledge = false, debug = false;
   for (let i = 1; i < remainingArgs.length; i++) {
     const flag = remainingArgs[i];
     if (flag === '--knowledge') { includeKnowledge = true; continue; }
@@ -35,14 +81,8 @@ export default async function context(args = []) {
     else if (flag === '--format' && ['json', 'text'].includes(value)) format = value;
     else throw new Error(`Unknown context option: ${flag}`);
   }
-  const brains = getBothBrains();
-  const own = layer !== 'global' && brains.project && isBrainEnabled(brains.project.brainDir) ? brains.project.brainDir : null;
-  const global = layer !== 'project' && brains.global && isBrainEnabled(brains.global.brainDir) ? brains.global.brainDir : null;
-  if (!own && !global) throw new Error('No enabled brain in selected scope');
-  const nodes = own ? mergeGlobalRuleNodes(getNodes(path.join(own, 'memory-vault')), global ? getNodes(path.join(global, 'memory-vault')) : []) :
-    getNodes(path.join(global, 'memory-vault')).map(n => ({ ...n, _layer: 'global' }));
-  const skillsDir = path.dirname(own || global);
-  const derivedDir = own ? path.join(own, 'memory-derived') : (global ? path.join(global, 'memory-derived') : null);
+  const { nodes, skillsDir, derivedDirs } = loadContextNodes(layer);
+  const derivedDir = derivedDirs[0];
   const result = await compileContext({ query, actions, nodes, includeKnowledge, budget: { total: budget }, projectRoot: process.cwd(),
     derivedDir, contributions: legacyRuleContributions(skillsDir), versionInputs: surfaceInputsHash({ skillsDir }) });
   if (debug && format === 'text') throw new Error('--debug requires --format json');
@@ -55,18 +95,7 @@ export default async function context(args = []) {
     derivedDir, action: actions, query, consumer: 'cli',
   });
   if (!response.ready && !debug) {
-    // Admission failed: emitting bodies here makes each budget retry load the
-    // same rules again. Keep the full set in the compiler/API, and admit it only
-    // after the caller explicitly raises the budget or curates applicability.
-    const requiredBudget = response.stats.total_tokens + 32;
-    const diagnostic = { ready: false, reason: 'budget-overflow', context: '', stats: {
-      version: response.stats.version, required_count: response.stats.required_count,
-      budget, required_budget: requiredBudget,
-      token_measurement: 'estimated_chars_divided_by_four',
-    } };
-    console.log(format === 'json' ? JSON.stringify(diagnostic) :
-      `ready:false reason:budget-overflow budget:${budget} required_budget:${requiredBudget} required_rules:${response.stats.required_count} version:${response.stats.version}\nRetry with --budget ${requiredBudget}; do not act until ready:true.\nTo shorten the rules for good: total-recall rules audit, then rules draft/apply.`);
-    process.exitCode = 2;
+    await printCompacted({ query, actions, budget, format, version: response.stats.version, fullRequired: response.stats.total_tokens + 32, nodes, skillsDir, derivedDirs });
     return;
   }
   console.log(renderCapsule(response, format));

package/src/cli/forget.mjs

@@ -33,6 +33,8 @@ function printHelp() {
 }
 
 export default async function forget(args) {
+  // Checked first: a destructive command must never act on a request for help.
+  if (args.includes('--help') || args.includes('-h')) { printHelp(); return; }
   const { layer: explicitLayer, remainingArgs } = parseLayerFlag(args);
 
   // Check for --project-all

package/src/cli/harness.mjs

@@ -21,7 +21,6 @@ Available Harness IDs:
   claude                    Claude Code CLI (Deep codebase refactoring & Unix execution)
   codex                     OpenAI Codex CLI (Program synthesis & sandbox execution)
   grok                      xAI Grok Build CLI (Autonomous coding, inspection, shell execution)
-  gemini                    Google Gemini CLI (Fast utilities & completion chaining)
   ollama                    Ollama Local LLM (Local neural reasoning, zero API cost)
   hermes                    Hermes Agent Runtime (Autonomous supervisor & messaging gateway)
   dsh                       DeepSeek Harness DSH (High-throughput reasoning engine)

package/src/cli/plugin/create.mjs

@@ -289,6 +289,17 @@ export async function createPlugin(args = []) {
         { name: "status", description: `Show which ${pluginName} subcommands are implemented`, effect: "read", output: "json" }
       ]
     };
+    if (apiKeys.length) {
+      manifest.cli.subcommands.push({
+        name: "token",
+        description: `Manage ${pluginName} API credentials in the secrets store`,
+        effect: "write",
+        args: [
+          { name: "action", positional: true, type: "choice", options: ["status", "set"], label: "Action" },
+          { name: "value", secret: true, type: "string", label: "Secret value passed over stdin" }
+        ]
+      });
+    }
     // The card contract reads the plugin's real state through a declared read
     // command; a scaffold without this shows no live status.
     manifest.status = { command: "status", refresh_seconds: 60 };
@@ -433,6 +444,10 @@ export default generateContext;
     fs.writeFileSync(path.join(pluginDir, "generator.mjs"), generatorContent, "utf8");
   }
 
+  manifest.capability = {
+    entry: "capability/index.mjs",
+    exports: ["getCapabilityStatus"]
+  };
 
   const validation = validatePluginManifest(manifest);
   if (!validation.valid) {
@@ -490,13 +505,51 @@ export default generateContext;
     private: true,
     type: 'module',
     description: pluginDesc,
-    scripts: { test: 'node --test test/*.test.mjs' },
-    devDependencies: { 'total-recall-brain': '^3.35.0' },
+    scripts: {
+      test: 'node --test test/*.test.mjs',
+      ssss: 'ssss',
+      export: 'ssss export vault --profile sale --out dist/bundle.ucw.json',
+      validate: 'ssss conformance --engine'
+    },
+    dependencies: {
+      '@gregiteen/ssss-cli': '0.14.3'
+    },
+    devDependencies: {
+      'total-recall-brain': '3.41.3'
+    },
     license: 'MIT'
   }, null, 2) + '\n', 'utf8');
-  fs.writeFileSync(path.join(pluginDir, '.gitignore'), 'node_modules/\n.env*\n.agent/skills/total-recall/\ndist/\nreports/\n.DS_Store\nINSTRUCTIONS.md\nAGENTS.md\nGEMINI.md\n', 'utf8');
+  fs.writeFileSync(path.join(pluginDir, '.gitignore'), 'node_modules/\n.env*\n.agent/skills/total-recall/\ndist/\nreports/\n.DS_Store\nINSTRUCTIONS.md\nAGENTS.md\n', 'utf8');
   fs.writeFileSync(path.join(pluginDir, 'LICENSE'), mitLicense(holder), 'utf8');
+
+  // Capability brick
+  fs.mkdirSync(path.join(pluginDir, 'capability'), { recursive: true });
+  fs.writeFileSync(path.join(pluginDir, 'capability', 'index.mjs'), `/**
+ * Portable capability brick for ${pluginName}.
+ * Zero host dependencies; pure portable JavaScript.
+ */
+export async function getCapabilityStatus() {
+  return { ready: true, initialized: true };
+}
+`, 'utf8');
+  fs.writeFileSync(path.join(pluginDir, 'capability', 'BRICK.md'), `# ${pluginName} — Capability Brick
+
+Portable core capability for ${pluginName}.
+
+## Exported Functions
+- \`getCapabilityStatus()\`: Returns capability readiness and initialization status.
+`, 'utf8');
+
   fs.mkdirSync(path.join(pluginDir, 'test'), { recursive: true });
+  fs.writeFileSync(path.join(pluginDir, 'test', 'capability.test.mjs'), `import test from 'node:test';
+import assert from 'node:assert/strict';
+import { getCapabilityStatus } from '../capability/index.mjs';
+
+test('capability brick loads and exports status', async () => {
+  const status = await getCapabilityStatus();
+  assert.equal(status.ready, true);
+});
+`, 'utf8');
   fs.writeFileSync(path.join(pluginDir, 'test', 'manifest.test.mjs'), `import test from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';

package/src/cli/plugin/index.mjs

@@ -5,7 +5,7 @@ import { listAvailable, listPeers, searchPlugins } from './search.mjs';
 import { createPlugin } from './create.mjs';
 import { vendorPlugin, listProjectBricks } from './vendor.mjs';
 import { manageProjectPluginCopies } from './copies.mjs';
-import { managePluginLicense } from './monetization.mjs';
+import { managePluginLicense, monetizePlugin, publishPluginToStore } from './monetization.mjs';
 import { getPlugin, getPluginMonetization, globalPluginsDir, projectPluginsDir } from '../../core/plugin-loader.mjs';
 import { describePlugin, pruneReplacementArchives, replacementArchiveDir } from '../../core/plugin-store.mjs';
 import { buildPluginCatalog } from '../../core/plugin-catalog.mjs';
@@ -55,8 +55,10 @@ Commands:
                             in 'update --automatic')
    share <id>                Offer an installed plugin by direct link and mesh
   unshare <id>              Stop offering it
+  publish <id>              Publish plugin to the Store and lock release (--no-lock)
+  monetize <id>             Configure plugin pricing, period, and payout recipient
   remove <id>               Uninstall (--global for the machine-wide copy)
-  license <id> [cmd]        Check or activate plugin license (status, activate, verify)
+  license <id> [cmd]        Check or activate plugin license (status, activate, checkout, verify)
   info <id>                 Manifest, provenance, hash and task history
   vendor <source> [dir]     Add a plugin to this project as a brick (default bricks/<id>); the
                             project then owns the code. <source>: bundled id, git URL or path.
@@ -244,7 +246,17 @@ export async function run(argv = []) {
     return;
   }
 
-  if (command === 'license' || command === 'lic' || command === 'monetize') {
+  if (command === 'publish' || command === 'deploy-store') {
+    await publishPluginToStore(rest);
+    return;
+  }
+
+  if (command === 'monetize') {
+    await monetizePlugin(rest);
+    return;
+  }
+
+  if (command === 'license' || command === 'lic') {
     await managePluginLicense(rest);
     return;
   }