total-recall-brain 3.43.3 → 3.45.0

package/scaffold/.agent/skills/total-recall/plugins/openwiki/src/refresh.mjs

@@ -30,6 +30,19 @@ const PLUGIN_ROOT = fileURLToPath(new URL('..', import.meta.url));
 const RETENTION_NOTE = 'pages are a projection, not canonical memory';
 const DEFAULT_LOCK_MS = 6 * 60 * 60 * 1000;
 
+const gitRun = (_command, args, options) => spawnSync('total-recall', ['git', ...args], options);
+
+function readJson(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+/** An unfinished init must resume as init, even after it has written pages. */
+export function generationMode(root) {
+  const state = readJson(path.join(root, 'openwiki', '.run.json'));
+  if (state?.mode === 'init' && state.phase && !['complete', 'idle'].includes(state.phase)) return 'init';
+  return hasWiki(root) ? 'update' : 'init';
+}
+
 export function registryPath(home = os.homedir()) {
   return path.join(home, '.agent', 'skills', 'total-recall', 'config', 'project-registry.json');
 }
@@ -69,7 +82,7 @@ export function readProjects({ registry = registryPath() } = {}) {
   });
 }
 
-/** Does this project carry generated pages at all? A repo with no openwiki/ is skipped, never created. */
+/** Does this project carry generated Markdown pages? */
 export function hasWiki(root) {
   const dir = path.join(root, 'openwiki');
   const stat = fs.lstatSync(dir, { throwIfNoEntry: false });
@@ -82,15 +95,18 @@ export function hasWiki(root) {
  * since the recorded generation, which is the same measure the per-repo driver
  * used. Uncommitted work is not counted, so an open edit does not read as drift.
  */
-export function isGitRepo(root, { git = spawnSync } = {}) {
+export function isGitRepo(root, { git = gitRun } = {}) {
   if (fs.existsSync(path.join(root, '.git'))) return true;
   const res = git('git', ['-C', root, 'rev-parse', '--is-inside-work-tree'], { encoding: 'utf8' });
-  return !res.error && res.status === 0;
+  if (res.error || res.status !== 0 || String(res.stdout).trim() !== 'true') return false;
+  const top = git('git', ['-C', root, 'rev-parse', '--show-toplevel'], { encoding: 'utf8' });
+  if (top.error || top.status !== 0) return false;
+  return fs.realpathSync(root) === fs.realpathSync(String(top.stdout).trim());
 }
 
-export function staleness(root, { git = spawnSync } = {}) {
+export function staleness(root, { git = gitRun } = {}) {
   if (!isGitRepo(root, { git })) {
-    return { root, head: '', generatedAt: null, generatedStatus: null, files: null, lastCodeChange: null, commitsSince: 0, stale: false };
+    return { root, head: '', generationCommit: null, generationTime: null, generatedAt: null, generatedStatus: null, files: null, lastCodeChange: null, commitsSince: 0, stale: false };
   }
   const marker = path.join(root, 'openwiki', '.last-update.json');
   let head = '';
@@ -104,6 +120,11 @@ export function staleness(root, { git = spawnSync } = {}) {
     generatedAt = typeof parsed.updatedAt === 'string' ? parsed.updatedAt : null;
     generatedStatus = typeof parsed.status === 'string' ? parsed.status : null;
   } catch { /* no marker: never generated, or unreadable */ }
+  const receipt = readJson(path.join(root, 'openwiki', '.generation.json'));
+  const validReceipt = typeof receipt?.commit === 'string' && /^[a-f0-9]{7,64}$/i.test(receipt.commit)
+    && typeof receipt.completedAt === 'string' && Number.isFinite(Date.parse(receipt.completedAt));
+  const generationCommit = validReceipt ? receipt.commit : null;
+  const generationTime = validReceipt ? receipt.completedAt : null;
 
   // The page contents, so a refresh can be judged on what it actually rewrote.
   // openwiki writes its marker when generation begins, so the marker alone
@@ -122,12 +143,15 @@ export function staleness(root, { git = spawnSync } = {}) {
   const lastCodeChange = !log.error && log.status === 0 ? String(log.stdout || '').trim() || null : null;
 
   let commitsSince = null;
-  if (generatedAt) {
-    const count = git('git', ['-C', root, 'rev-list', '--count', `--since=${generatedAt}`, 'HEAD', '--', '.', ':!openwiki'], { encoding: 'utf8' });
-    if (!count.error && count.status === 0) commitsSince = Number(String(count.stdout || '').trim());
-  }
-  const stale = generatedAt === null || (Number.isFinite(commitsSince) && commitsSince > 0);
-  return { root, head, generatedAt, generatedStatus, files, lastCodeChange, commitsSince, stale };
+  if (generationCommit || generatedAt) {
+    const range = generationCommit ? [`${generationCommit}..HEAD`] : [`--since=${generatedAt}`, 'HEAD'];
+    const count = git('git', ['-C', root, 'rev-list', '--count', ...range, '--', '.', ':!openwiki'], { encoding: 'utf8' });
+    const value = String(count.stdout || '').trim();
+    if (!count.error && count.status === 0 && /^\d+$/.test(value)) commitsSince = Number(value);
+  }
+  const incomplete = generatedStatus === 'interrupted' || stillGenerating(root);
+  const stale = incomplete || generatedAt === null || commitsSince === null || commitsSince > 0;
+  return { root, head, generationCommit, generationTime, generatedAt, generatedStatus, files, lastCodeChange, commitsSince, stale, mode: generationMode(root) };
 }
 
 /**
@@ -250,14 +274,81 @@ export function stillGenerating(root) {
   }
 }
 
+function writeReceipt(root, name, value) {
+  const dir = path.join(root, 'openwiki');
+  fs.mkdirSync(dir, { recursive: true });
+  const target = path.join(dir, name);
+  const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    fs.renameSync(tmp, target);
+  } finally {
+    fs.rmSync(tmp, { force: true });
+  }
+}
+
+function redact(value, key) {
+  let text = String(value || '');
+  if (key) text = text.split(key).join('[REDACTED]');
+  return text.replace(/\bBearer\s+\S+/gi, 'Bearer [REDACTED]').replace(/\bsk-[\w-]+/g, '[REDACTED]');
+}
+
+function finishRefresh(project, { before, result, git, key, mode, startedAt, via, clock }) {
+  const after = staleness(project.root, { git });
+  const exitCode = result.error ? (result.error.code || 1) : result.signal ? 1 : result.status;
+  const completedAt = new Date(clock()).toISOString();
+  const stdout = redact(result.stdout, key), stderr = redact(result.stderr, key);
+  const error = redact(result.error?.message, key);
+  const lines = `${stderr}\n${stdout}`.replace(/\x1b\[[0-9;]*m/g, '').split('\n').map(line => line.trim()).filter(Boolean);
+  const diagnostic = lines.find(line => /context_length_exceeded|Provider returned error|exited without|Could not restore|interrupted OpenWiki|fetch failed/.test(line));
+  const reason = error || (result.signal ? `terminated by ${result.signal}` : diagnostic || lines.filter(line => !/^(\[ERR\]\s*)?Error Diagnostics$/.test(line)).at(-1) || `exit ${exitCode}`);
+  const wrote = pagesWritten(before, after) || (!before.files && hasWiki(project.root) ? 1 : 0);
+  const advanced = after.generatedAt !== before.generatedAt;
+  let action, failureReason;
+  if (after.generatedStatus === 'interrupted' || stillGenerating(project.root)) {
+    action = 'partial';
+    failureReason = `${wrote} page(s) rewritten, but the run did not finish; it resumes on the next refresh (${reason})`;
+  } else if (exitCode !== 0) {
+    action = 'failed'; failureReason = reason;
+  } else if (!advanced && !wrote) {
+    action = 'failed'; failureReason = 'command exited 0 and no page changed';
+  } else if (!before.head) {
+    action = 'failed'; failureReason = 'Cannot record generation without a source commit';
+  } else {
+    action = mode === 'init' ? 'initialized' : 'refreshed';
+  }
+  const logPath = path.join(project.root, 'openwiki', '.refresh-attempt.json');
+  const report = { ...project, ...after, action, reason: failureReason, exitCode, signal: result.signal || null, from: before.generatedAt, to: after.generatedAt, durationMs: clock() - startedAt, via, mode, logPath };
+  try {
+    writeReceipt(project.root, '.refresh-attempt.json', { startedAt: new Date(startedAt).toISOString(), completedAt, sourceCommit: before.head || null, action, mode, exitCode, signal: result.signal || null, error, stdout, stderr });
+    if (action === 'initialized' || action === 'refreshed') {
+      writeReceipt(project.root, '.generation.json', { commit: before.head, completedAt });
+      report.generationCommit = before.head;
+      report.generationTime = completedAt;
+      report.commitsSince = after.head === before.head ? 0 : null;
+      report.stale = after.head !== before.head;
+    } else if (before.generationCommit && before.generationTime) {
+      // Init can replace openwiki/ before it fails. Retain the last success.
+      writeReceipt(project.root, '.generation.json', { commit: before.generationCommit, completedAt: before.generationTime });
+      report.generationCommit = before.generationCommit;
+      report.generationTime = before.generationTime;
+    }
+  } catch (error) {
+    report.action = 'failed'; report.reason = `Could not save refresh receipt: ${error.message}`;
+  }
+  return report;
+}
+
 export function refreshProject(project, {
-  key, model = null, provider = null, binary = null, binaryArgs = [], timeoutMs = 30 * 60 * 1000, run = spawnSync, now = Date.now(), targetVersion = null, pluginRoot = PLUGIN_ROOT,
+  key, model = null, provider = null, binary = null, binaryArgs = [], timeoutMs = 30 * 60 * 1000, run = spawnSync, now = Date.now(), clock = Date.now, targetVersion = null, pluginRoot = PLUGIN_ROOT,
 } = {}) {
-  if (!isGitRepo(project.root, { git: run })) {
+  const git = run === spawnSync ? gitRun : run;
+  if (!isGitRepo(project.root, { git })) {
     return { ...project, action: 'skipped', reason: 'not a git repository' };
   }
-  const before = staleness(project.root, { git: run });
+  const before = staleness(project.root, { git });
   const uninitialized = !hasWiki(project.root);
+  const mode = generationMode(project.root);
 
   let command = binary, args = binaryArgs, via = binary ? 'explicit' : null;
   if (!command) {
@@ -273,19 +364,12 @@ export function refreshProject(project, {
   const selectedModel = model || config.model;
   const selectedProvider = provider || config.provider;
 
-  const modeFlag = uninitialized ? '--init' : '--update';
+  const modeFlag = `--${mode}`;
   const cmdArgs = [...args, modeFlag, '-p'];
   if (selectedModel) {
     cmdArgs.push('--modelId', selectedModel);
   }
 
-  if (uninitialized) {
-    const runFile = path.join(project.root, 'openwiki', '.run.json');
-    if (fs.existsSync(runFile)) {
-      try { fs.unlinkSync(runFile); } catch {}
-    }
-  }
-
   const childEnv = { ...process.env };
   if (selectedProvider === 'google') {
     childEnv.GOOGLE_API_KEY = key;
@@ -312,47 +396,18 @@ export function refreshProject(project, {
     timeout: timeoutMs,
   });
 
-  const after = staleness(project.root, { git: run });
-  const exitCode = result.error ? (result.error.code || 1) : result.status;
-  const advanced = after.generatedAt !== before.generatedAt || (uninitialized && hasWiki(project.root));
-  const wrote = pagesWritten(before, after) || (uninitialized && hasWiki(project.root) ? 1 : 0);
-
-  const outcome = after.generatedStatus === 'interrupted' || stillGenerating(project.root)
-    ? 'partial'
-    : (advanced ? (uninitialized ? 'initialized' : 'refreshed') : 'unchanged');
-
-  if (exitCode !== 0 && !wrote) {
-    return { ...project, action: 'failed', reason: result.error?.message || `exit ${exitCode}`, exitCode, ...after };
-  }
-  if (!advanced && !wrote) {
-    return { ...project, action: 'failed', reason: `command exited ${exitCode} and no page changed`, exitCode, ...after };
-  }
-  if (outcome === 'partial') {
-    return {
-      ...project,
-      action: 'partial',
-      reason: `${wrote} page(s) rewritten, but the run did not finish (the generator was cut off); it resumes on the next refresh`,
-      exitCode,
-      from: before.generatedAt,
-      to: after.generatedAt,
-      via,
-      ...after,
-    };
-  }
-  if (exitCode !== 0) {
-    return { ...project, action: 'failed', reason: result.error?.message || `exit ${exitCode}`, exitCode, ...after };
-  }
-  return { ...project, action: uninitialized ? 'initialized' : 'refreshed', from: before.generatedAt, to: after.generatedAt, durationMs: Date.now() - startedAt, via, ...after };
+  return finishRefresh(project, { before, result, git, key, mode, startedAt, via, clock });
 }
 
 export async function refreshProjectAsync(project, {
-  key, model = null, provider = null, binary = null, binaryArgs = [], timeoutMs = 30 * 60 * 1000, now = Date.now(), targetVersion = null, pluginRoot = PLUGIN_ROOT,
+  key, model = null, provider = null, binary = null, binaryArgs = [], timeoutMs = 30 * 60 * 1000, now = Date.now(), clock = Date.now, targetVersion = null, pluginRoot = PLUGIN_ROOT, git = gitRun, spawnProcess = spawn,
 } = {}) {
-  if (!isGitRepo(project.root, { git: spawnSync })) {
+  if (!isGitRepo(project.root, { git })) {
     return { ...project, action: 'skipped', reason: 'not a git repository' };
   }
-  const before = staleness(project.root, { git: spawnSync });
+  const before = staleness(project.root, { git });
   const uninitialized = !hasWiki(project.root);
+  const mode = generationMode(project.root);
   let command = binary, args = binaryArgs, via = binary ? 'explicit' : null;
   if (!command) {
     const resolved = resolveGenerator({ run: spawnSync, targetVersion, pluginRoot, requireBundled: uninitialized });
@@ -367,19 +422,12 @@ export async function refreshProjectAsync(project, {
   const selectedModel = model || config.model;
   const selectedProvider = provider || config.provider;
 
-  const modeFlag = uninitialized ? '--init' : '--update';
+  const modeFlag = `--${mode}`;
   const cmdArgs = [...args, modeFlag, '-p'];
   if (selectedModel) {
     cmdArgs.push('--modelId', selectedModel);
   }
 
-  if (uninitialized) {
-    const runFile = path.join(project.root, 'openwiki', '.run.json');
-    if (fs.existsSync(runFile)) {
-      try { fs.unlinkSync(runFile); } catch {}
-    }
-  }
-
   const childEnv = { ...process.env };
   if (selectedProvider === 'google') {
     childEnv.GOOGLE_API_KEY = key;
@@ -399,74 +447,33 @@ export async function refreshProjectAsync(project, {
 
   const startedAt = now;
   const result = await new Promise((resolve) => {
-    const proc = spawn(command, cmdArgs, {
+    const proc = spawnProcess(command, cmdArgs, {
       cwd: project.root,
       env: childEnv,
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: timeoutMs,
     });
-    let stdout = '', stderr = '';
+    let stdout = '', stderr = '', error = null;
     proc.stdout?.on('data', (d) => { stdout += d; });
     proc.stderr?.on('data', (d) => { stderr += d; });
-    proc.on('error', (err) => resolve({ error: err, status: 1, stdout, stderr }));
-    proc.on('close', (status) => resolve({ status: status ?? 0, stdout, stderr }));
+    proc.on('error', (err) => { error = err; });
+    proc.on('close', (status, signal) => resolve({ error, status, signal, stdout, stderr }));
   });
-
-  const after = staleness(project.root, { git: spawnSync });
-  const exitCode = result.error ? (result.error.code || 1) : result.status;
-  const advanced = after.generatedAt !== before.generatedAt || (uninitialized && hasWiki(project.root));
-  const wrote = pagesWritten(before, after) || (uninitialized && hasWiki(project.root) ? 1 : 0);
-
-  const outcome = after.generatedStatus === 'interrupted' || stillGenerating(project.root)
-    ? 'partial'
-    : (advanced ? (uninitialized ? 'initialized' : 'refreshed') : 'unchanged');
-
-  const extractReason = (rawErr, rawOut) => {
-    if (result.error?.message) return result.error.message;
-    const combined = `${rawErr || ''}\n${rawOut || ''}`.trim();
-    if (!combined) return `exit ${exitCode}`;
-    const lines = combined.split('\n').map((l) => l.trim()).filter(Boolean);
-    const diag = lines.find((l) => l.includes('Error Diagnostics') || l.includes('exited without') || l.includes('Could not restore') || l.includes('Provider returned error') || l.includes('fetch failed'));
-    if (diag) return diag.replace(/^\[ERR\]\s*/, '');
-    const last = lines[lines.length - 1];
-    return last ? last.replace(/^\[ERR\]\s*/, '') : `exit ${exitCode}`;
-  };
-  const failReason = extractReason(result.stderr, result.stdout);
-
-  if (exitCode !== 0 && !wrote) {
-    return { ...project, action: 'failed', reason: failReason, exitCode, ...after };
-  }
-  if (!advanced && !wrote) {
-    return { ...project, action: 'failed', reason: failReason || `command exited ${exitCode} and no page changed`, exitCode, ...after };
-  }
-  if (outcome === 'partial') {
-    return {
-      ...project,
-      action: 'partial',
-      reason: `${wrote} page(s) rewritten, but the run did not finish (the generator was cut off); it resumes on the next refresh`,
-      exitCode,
-      from: before.generatedAt,
-      to: after.generatedAt,
-      via,
-      ...after,
-    };
-  }
-  if (exitCode !== 0) {
-    return { ...project, action: 'failed', reason: failReason, exitCode, ...after };
-  }
-  return { ...project, action: uninitialized ? 'initialized' : 'refreshed', from: before.generatedAt, to: after.generatedAt, durationMs: Date.now() - startedAt, via, ...after };
+  return finishRefresh(project, { before, result, git, key, mode, startedAt, via, clock });
 }
 
 /** Is a refresh due for this project under the configured interval? */
-export function isDue(project, { lockMs = DEFAULT_LOCK_MS, now = Date.now(), git = spawnSync } = {}) {
+export function isDue(project, { lockMs = DEFAULT_LOCK_MS, now = Date.now(), git = gitRun, force = false } = {}) {
   if (!isGitRepo(project.root, { git })) {
     return { due: false, skipped: true, reason: 'not a git repository' };
   }
   const state = staleness(project.root, { git });
+  if (force) return { due: true, uninitialized: !hasWiki(project.root), ...state };
   if (!hasWiki(project.root)) {
     return { due: true, uninitialized: true, reason: 'uninitialized (missing openwiki/ pages)', ...state };
   }
   if (!state.stale) return { due: false, ...state };
+  if (state.generatedStatus === 'interrupted' || stillGenerating(project.root)) return { due: true, reason: 'resume incomplete generation', ...state };
   if (state.generatedAt) {
     const at = Date.parse(state.generatedAt);
     if (Number.isFinite(at) && now - at < lockMs) return { due: false, reason: 'refreshed recently', ...state };

package/scaffold/.agent/skills/total-recall/plugins/security/package-lock.json

@@ -1,19 +1,19 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-security",
-      "version": "0.3.5",
+      "version": "0.3.7",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
         "jsdom": "^26.1.0",
-        "total-recall-brain": "3.42.1"
+        "total-recall-brain": "3.44.0"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -845,9 +845,9 @@
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1686,9 +1686,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -5698,9 +5698,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.44.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.44.0.tgz",
+      "integrity": "sha512-VNPaIO9zsSwoxAsJ5ByIQBP9zPpLq4RiQO7Vrex4rBOHFQJT50P7utcZiLMSZTyZJU4C/m5uB8qTCSBMp6+l6Q==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -5708,7 +5708,7 @@
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",
@@ -5731,6 +5731,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "type": "module",
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {
@@ -24,9 +24,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "security",
   "name": "Security Assessments",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
   "license": "MIT",
   "requires": [{ "id": "auth", "range": ">=1.2.1" }],

package/scaffold/.agent/skills/total-recall/plugins/ssss/assets/scaffold.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.14.4",
+  "version": "0.14.5",
   "files": {
     ".gitignore": {
       "sha256": "0d6c69a5cbd2270c9163d8e1563976b6d15131d0ef599e6fbc413ee287a86da0",
@@ -18,8 +18,8 @@
       "content": "# ssss-project — System Architecture & Design\n\n> Technical design and architecture specification for ssss-project.\n\n## Overview\n\n<High-level summary of the system and its primary goals.>\n\n## Component Architecture\n\n- **Vault Structure**: Typed Markdown documents under `vault/` serving as the source of truth.\n- **Workflows & Execution**: Automated procedures defined in `vault/workflows/` triggered by operational events.\n- **Capabilities & Resources**: Tools and external service integrations required for execution.\n\n## Data & Schema Contracts\n\n<Core entities, external dependencies, and integration interfaces.>\n\n## Open Decisions & Invariants\n\n- SSSS VFS is the single source of truth for application state.\n- Structural business logic is strictly decoupled from private tenant operational data.\n- App-specific primitives reside in `registry/extensions/` within this repository and extend `core`.\n- Core SSSS library (`@gregiteen/ssss-cli`) remains vendor-neutral and dependency-free.\n"
     },
     "package.json": {
-      "sha256": "18389bfc91857c6d5917a3ac1af9da8a992c99b013f42f2843921cdc7b41bdfe",
-      "content": "{\n  \"name\": \"ssss-project\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"An SSSS-native project — Markdown vault as source of truth.\",\n  \"scripts\": {\n    \"ssss\": \"ssss\",\n    \"test\": \"node --test\",\n    \"export\": \"ssss export vault --profile sale --out dist/bundle.ucw.json\",\n    \"validate\": \"ssss conformance --engine\"\n  },\n  \"dependencies\": {\n    \"@gregiteen/ssss-cli\": \"github:gregiteen/ssss#v0.14.4\"\n  }\n}\n"
+      "sha256": "ea77c2944b853999741a8e603de257604048c63b5db8754a0e8b92f383ff973b",
+      "content": "{\n  \"name\": \"ssss-project\",\n  \"version\": \"0.1.0\",\n  \"private\": true,\n  \"type\": \"module\",\n  \"description\": \"An SSSS-native project — Markdown vault as source of truth.\",\n  \"scripts\": {\n    \"ssss\": \"ssss\",\n    \"test\": \"node --test\",\n    \"export\": \"ssss export vault --profile sale --out dist/bundle.ucw.json\",\n    \"validate\": \"ssss conformance --engine\"\n  },\n  \"dependencies\": {\n    \"@gregiteen/ssss-cli\": \"github:gregiteen/ssss#v0.14.5\"\n  }\n}\n"
     },
     "test/ssss-conformance.test.mjs": {
       "sha256": "f626d2f56799fcfda74375d3ddf546cc181a10caf2df08b72b7f2e36782c9bc1",
@@ -43,8 +43,8 @@
     }
   },
   "skill": {
-    "SKILL.md": "4976c9615482f257fd023761dd3ef36b5aa278305ff22ae110295fe4945f5d4c",
-    "core/SKILL.md": "96c6479ad06b84c5f7ffd8bb05bff414dbb8c22a040ec1f1c05d8fa4fdbd976e",
+    "SKILL.md": "e5c2c0aa2c0fb5480c1f7bdb37928f935e1160bff18fd6b63366a04f3e281938",
+    "core/SKILL.md": "12543720135f13650efcd7afd751e3253996692c6ab805fd7da99788b6fc4af9",
     "core/references/core-registry.json": "16831aa3b6be3f561a9ca7abdc36065a4843ff595aa3acf5c3fb8af2d733b7e3",
     "core/references/ssss-spec.md": "cc319e78b1b568651d5717695348363349d502c0e20663da9858369022ddfc3b",
     "core/scripts/maintain.mjs": "eebcae898f2ce0cf3f0059c6f6737bee8877409de2d370d54a4015a9a82414e9",

package/scaffold/.agent/skills/total-recall/plugins/ssss/package-lock.json

@@ -1,21 +1,21 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-ssss",
-      "version": "0.1.2",
+      "version": "0.1.3",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4"
+        "@gregiteen/ssss-cli": "0.14.5"
       }
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"

package/scaffold/.agent/skills/total-recall/plugins/ssss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": true,
   "type": "module",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
@@ -19,7 +19,7 @@
     "check:ssss-conformance": "node cli.mjs conformance"
   },
   "dependencies": {
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "license": "MIT"
 }

package/scaffold/.agent/skills/total-recall/plugins/ssss/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "ssss",
   "name": "SSSS",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
   "license": "MIT",
   "use_cases": ["software-development", "state-conformance"],

package/scaffold/.agent/skills/total-recall/references/operations.md

@@ -16,7 +16,7 @@ Publication/deployment use the owning push/deploy procedures when authorized. Sh
 
 Use `brain status` to check the current project and physical global storage. Preview `brain relocate-global <dir>` before adding `--apply`. The destination must be a new private directory outside Git on the same filesystem as home. The home skills path links to the relocated tree. Keep repository brains in their own directories.
 
-Run normal preflight from home for global orchestration. Pass a repository working directory when routing repository work through Meta Harness. Use `plugin copies` to audit old project copies of shared defaults. `--apply` deletes verified bundled matches. Add `--archive-stale` to retain differing older copies in the replacement archive and use the shared versions.
+Run normal preflight from home for global orchestration. Pass a repository working directory when routing repository work through Metaharness. Use `plugin copies` to audit old project copies of shared defaults. `--apply` deletes verified bundled matches. Add `--archive-stale` to retain differing older copies in the replacement archive and use the shared versions.
 
 ## Optional developer API
 

package/src/cli/agent.mjs

@@ -31,7 +31,7 @@ Options:
   --allow-unknown-auth     Explicitly permit a harness without a verified login probe
 
 Auth:
-  The Meta Harness owner probes login and resolves only adapter-declared credentials through auth.
+  The Metaharness owner probes login and resolves only adapter-declared credentials through auth.
 
 Available Harnesses:
   agy, claude, codex, dsh, hermes, openclaw

package/src/cli/command.mjs

@@ -247,21 +247,59 @@ function existingTag(file, key) {
   try { return fs.readFileSync(file, 'utf8').match(new RegExp(`^// @${key} (.+)$`, 'm'))?.[1] || undefined; } catch { return undefined; }
 }
 
+/** Where the background recompile records its outcome: <agentDir>/state and <agentDir>/logs. */
+export function compileRecordPaths(isGlobal) {
+  const agentDir = path.dirname(resolveTargetDir(isGlobal));
+  return {
+    status: path.join(agentDir, 'state', 'command-compile.json'),
+    log: path.join(agentDir, 'logs', 'command-compile.log'),
+  };
+}
+
+// Runs in the detached child: compile, then record the exit code and output.
+const COMPILE_RECORDER = `
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const [cli, layer, statusFile, logFile] = process.argv.slice(1);
+const startedAt = new Date().toISOString();
+const r = spawnSync(process.execPath, [cli, 'compile', layer], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+const code = r.status === null ? 1 : r.status;
+fs.writeFileSync(logFile, (r.stdout || '') + (r.stderr || '') + (r.error ? String(r.error) + '\\n' : ''));
+const record = { ok: code === 0, code, signal: r.signal || null, layer, startedAt, finishedAt: new Date().toISOString(), log: logFile };
+fs.writeFileSync(statusFile + '.tmp', JSON.stringify(record, null, 2));
+fs.renameSync(statusFile + '.tmp', statusFile);
+`;
+
 /**
  * Composable instructions: the surfaces list every command, so any change to
  * the command set recompiles them (project layer, or every project for global).
+ * A global compile takes minutes, so it runs in the background; its exit code and
+ * output are recorded, and the next `command` call reports a failure.
  */
 export function recompileSurfaces(isGlobal) {
   if (process.env.TR_COMMAND_NO_COMPILE === '1' || !process.argv[1]) return;
   try {
-    const child = spawn(process.execPath, [process.argv[1], 'compile', isGlobal ? '--global' : '--project'], { detached: true, stdio: 'ignore' });
+    const { status, log } = compileRecordPaths(isGlobal);
+    fs.mkdirSync(path.dirname(status), { recursive: true });
+    fs.mkdirSync(path.dirname(log), { recursive: true });
+    const child = spawn(process.execPath, ['-e', COMPILE_RECORDER, process.argv[1], isGlobal ? '--global' : '--project', status, log], { detached: true, stdio: 'ignore' });
     child.unref();
-    console.log('  ⏳ Instruction surfaces recompiling in the background (command list updated).');
+    console.log(`  ⏳ Instruction surfaces recompiling in the background (command list updated). Outcome: ${status}`);
   } catch (error) {
     console.warn(`  ⚠️  Command saved, but surface recompile failed to start: ${error.message}`);
+    process.exitCode = 1;
   }
 }
 
+/** Report a failed background recompile; returns the record when it failed. */
+export function reportFailedCompile(isGlobal, out = console.warn) {
+  let record;
+  try { record = JSON.parse(fs.readFileSync(compileRecordPaths(isGlobal).status, 'utf8')); } catch { return null; }
+  if (record.ok) return null;
+  out(`  ❌ The last instruction-surface recompile (${record.layer}, ${record.finishedAt}) failed with exit ${record.code}. Surfaces may not list current commands. Log: ${record.log}. Run 'total-recall compile ${record.layer}' to retry.`);
+  return record;
+}
+
 /**
  * Register every `commands` entry of an installed plugin as a composable command.
  * A command that already exists and was generated from this plugin is refreshed;
@@ -319,6 +357,7 @@ export default async function commandCmd(rawArgs = []) {
 
   const action = cleanArgs[0];
   const name = cleanArgs[1];
+  if (process.env.TR_COMMAND_NO_COMPILE !== '1') reportFailedCompile(isGlobal);
 
   if (!action || action === '--help' || action === '-h') {
     printHelp();