total-recall-brain 3.43.1 → 3.43.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.43.1",
+  "version": "3.43.2",
   "description": "The Vibe Coding Brain & Autonomous Software Factory: memory, rules, secrets, and 33 visual plugins automatically managed across all your devices.",
   "type": "module",
   "bin": {

package/src/cli/release.mjs

@@ -197,11 +197,13 @@ export function consumerState(root, pkg, version = null) {
   const declaredFiles = [];
   const pkgFile = path.join(root, 'package.json');
   let declared = null;
+  let devOnly = false;
   if (fs.existsSync(pkgFile)) {
     try {
       const j = JSON.parse(fs.readFileSync(pkgFile, 'utf8'));
       const all = { ...(j.dependencies || {}), ...(j.devDependencies || {}), ...(j.optionalDependencies || {}) };
       declared = all[pkg] ?? null;
+      devOnly = Boolean(j.devDependencies?.[pkg]) && !j.dependencies?.[pkg] && !j.optionalDependencies?.[pkg];
       if (declared) declaredFiles.push(pkgFile);
     } catch {
       /* unreadable package.json is reported as unknown, not as satisfied */
@@ -243,6 +245,10 @@ export function consumerState(root, pkg, version = null) {
       /* keep looking */
     }
   }
+  // A checkout with no copy of a dev dependency runs under the shared install. Nothing there is stale.
+  if (!installed && devOnly) {
+    return { root, declared, want, range, installed: null, satisfied: true, pinBehind: false, devNotInstalled: true, reason: 'dev-not-installed' };
+  }
   // What a consumer runs is what counts, and the version named is the question. A pin can lag on
   // purpose, because `update` installs plugin copies with --no-save. Comparing against the pin
   // would fail those and pass a consumer whose pin and install both lag.
@@ -285,6 +291,7 @@ export function verifyConsumers(pkg, version, opts = {}) {
     failing: failing.length,
     failures: failing.map((s) => ({ root: s.root, declared: s.declared, installed: s.installed, reason: s.reason })),
     pin_behind: relevant.filter((s) => s.pinBehind).map((s) => ({ root: s.root, declared: s.declared, installed: s.installed })),
+    dev_not_installed: relevant.filter((s) => s.devNotInstalled).map((s) => s.root),
   };
 }
 
@@ -369,6 +376,7 @@ export async function run(argv = process.argv, deps = {}) {
       }
       log(`  ✓ ${pkg}@${version} verified: registry + ${consumers.consumers}/${consumers.consumers} consumers`);
       if (consumers.pin_behind.length) log(`    ${consumers.pin_behind.length} run it with an older pin in package.json, such as ${consumers.pin_behind[0].root}`);
+      if (consumers.dev_not_installed.length) log(`    ${consumers.dev_not_installed.length} keep no dev copy of it and run under the shared install`);
       continue;
     }
 

package/src/core/automatic-brain-updates.mjs

@@ -40,7 +40,9 @@ export async function runAutomaticBrainUpdates({brainDir,fleet=false,force=false
   if(!force && !isPackageAutoUpdateEnabled())return {skipped:true,reason:'disabled',results:[]};
   const file=path.join(brainDir,'memory-derived/automatic-brain-updates.json');
   let saved;try{saved=JSON.parse(fs.readFileSync(file,'utf8'));}catch{}
-  const delay=saved?.failed?Math.min(intervalMs,5*60*1000):intervalMs;
+  // Fast retry is for this machine's own failures. A peer with no update transport fails every
+  // run, and counting it made maintenance run back to back forever.
+  const delay=(saved?.local_failed??saved?.failed)?Math.min(intervalMs,5*60*1000):intervalMs;
   if(!force && !skipThrottle && saved?.checkedAt && now()>=saved.checkedAt && now()-saved.checkedAt<delay)return {skipped:true,reason:'throttled',results:[]};
   fs.mkdirSync(path.dirname(file),{recursive:true});
   const lock=`${file}.lock`;

package/src/core/brain-updates.mjs

@@ -185,6 +185,22 @@ function targetSpec(key, version) {
 }
 
 /** Dry by default. Resolve releases once; install independently; verify actual resolution. */
+/**
+ * A checkout that keeps no copy of a dev dependency runs under the shared install, so it has no
+ * old version to replace. Its pin stays current, and its dev tree is its owner's to install: one
+ * plugin's tree is about 460 MB, so restoring them all automatically could fill a disk.
+ */
+const absentDevDep = (dep) => dep.section === 'devDependencies' && !dep.file;
+
+/**
+ * The daemon runs with NODE_ENV=production, and under that npm and pnpm remove dev dependencies
+ * from whatever they install in. An install that wants a runtime tree says so with a flag.
+ */
+function installEnv(env = process.env) {
+  const { NODE_ENV, npm_config_omit, NPM_CONFIG_OMIT, npm_config_production, NPM_CONFIG_PRODUCTION, ...kept } = env;
+  return kept;
+}
+
 export async function updateAllBrains(opts = {}) {
   const dryRun = opts.dryRun !== false;
   const exec = opts.exec || spawnSync;
@@ -245,9 +261,12 @@ export async function updateAllBrains(opts = {}) {
       row.status = 'failed'; row.error = 'Newer local/preview package; refusing an implicit downgrade'; continue;
     }
     const shared = isLink(path.join(owner.owner, 'node_modules')) || isLink(path.join(consumer.root, 'node_modules'));
-    const needsChange = shared || consumer.deps.some(dep => dep.version !== versions[dep.package]
-      || (!consumer.runtimeOnly && dep.declared !== targetSpec(dep.key, versions[dep.package]))
-      || !dep.file?.startsWith(path.join(owner.owner, 'node_modules') + path.sep));
+    const needsChange = shared || consumer.deps.some(dep => {
+      const pinLags = !consumer.runtimeOnly && dep.declared !== targetSpec(dep.key, versions[dep.package]);
+      if (absentDevDep(dep)) return pinLags;
+      return pinLags || dep.version !== versions[dep.package]
+        || !dep.file?.startsWith(path.join(owner.owner, 'node_modules') + path.sep);
+    });
     if (!needsChange) continue;
     row.status = dryRun ? 'would_update' : 'pending';
     if (!groups.has(owner.owner)) groups.set(owner.owner, { ...owner, consumers: [] });
@@ -264,8 +283,8 @@ export async function updateAllBrains(opts = {}) {
     const runtimeOnly = group.consumers.every(({ consumer }) => consumer.runtimeOnly);
     const unpinned = runtimeOnly && group.manager === 'npm';
     const needsInstall = group.consumers.some(({ consumer }) =>
-      isLink(path.join(consumer.root, 'node_modules')) || consumer.deps.some(dep =>
-        dep.version !== versions[dep.package] || !dep.file?.startsWith(path.join(group.owner, 'node_modules') + path.sep)));
+      isLink(path.join(consumer.root, 'node_modules')) || consumer.deps.some(dep => !absentDevDep(dep)
+        && (dep.version !== versions[dep.package] || !dep.file?.startsWith(path.join(group.owner, 'node_modules') + path.sep))));
     try {
       lockFd = acquireBrainUpdateLock(lock, opts.lockWaitMs === undefined ? {} : { waitMs: opts.lockWaitMs });
       for (const name of ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml']) {
@@ -294,7 +313,7 @@ export async function updateAllBrains(opts = {}) {
       if (unpinned) args.push('--no-save', ...new Set(group.consumers.flatMap(({ consumer }) =>
         consumer.deps.map(dep => `${dep.key}@${targetSpec(dep.key, versions[dep.package])}`))));
       else if (!needsInstall) args.push(group.manager === 'pnpm' ? '--lockfile-only' : '--package-lock-only');
-      const install = exec(group.manager, args, { cwd: group.owner, encoding: 'utf8',
+      const install = exec(group.manager, args, { cwd: group.owner, env: installEnv(), encoding: 'utf8',
         timeout: 600000, maxBuffer: 8 * 1024 * 1024 });
       if (install.status !== 0) throw new Error(install.error?.message || install.stderr?.trim().slice(-1500) || `Install exited ${install.status}`);
       for (const { consumer, row } of group.consumers) {
@@ -309,6 +328,7 @@ export async function updateAllBrains(opts = {}) {
         const placed = (file) => Boolean(file) && allowedRoots.some((root) => file.startsWith(root));
         const bad = consumer.deps.find(dep => {
           const actual = installedBrainPackage(consumer.root, dep.key);
+          if (absentDevDep(dep) && !actual.file) return false;
           return actual.version !== versions[dep.package] || !placed(actual.file);
         });
         // A link is only a fault when it escapes every legitimate root; a self-contained one is fine.