total-recall-brain 3.43.3 → 3.45.0

package/frontend/dist/index.html

@@ -17,7 +17,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,600;12..96,800&family=Cabinet+Grotesk:wght@700;800&family=Chivo+Mono:wght@500;700&family=Cinzel:wght@600;700;900&family=Cormorant+Garamond:ital,wght@0,600;0,700;1,600;1,700&family=DM+Mono:wght@500&family=DM+Sans:wght@500;700&family=Fraunces:opsz,wght@9..144,600;9..144,800&family=Inter:wght@300;400;500;600;700&family=JetBrains+Mono:wght@400;500;700&family=Lexend:wght@600;800&family=Newsreader:ital,opsz,wght@0,6..72,600;1,6..72,600&family=Orbitron:wght@700;900&family=Outfit:wght@500;700;800&family=Plus+Jakarta+Sans:wght@600;700;800&family=Space+Grotesk:wght@600;700&family=Syne:wght@700;800&display=swap" rel="stylesheet" />
     <title>Total Recall — Portable Memory</title>
-    <script type="module" crossorigin src="/assets/index-DD4qONvH.js"></script>
+    <script type="module" crossorigin src="/assets/index-DACh1dhx.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DtwsDyFM.css">
   </head>
   <body>

package/frontend/src/App.tsx

@@ -323,7 +323,7 @@ function MainContent({ activeBrainId }: { activeBrainId: string }) {
           <Route path="/memory" element={<MemoryPage activeBrainId={activeBrainId} />} />
           <Route path="/rules" element={<RulesPage activeBrainId={activeBrainId} />} />
           <Route path="/graph" element={<GraphPage activeBrainId={activeBrainId} />} />
-          <Route path="/tasks" element={<Navigate to="/plugins?id=user-automations" replace />} />
+          <Route path="/tasks" element={<Navigate to="/plugins?id=automations" replace />} />
           <Route path="/skills" element={<Navigate to="/plugins?id=skill-manager" replace />} />
           <Route path="/openwiki" element={<Navigate to="/plugins?id=openwiki" replace />} />
           <Route path="/plugins" element={<PluginsPage activeBrainId={activeBrainId} />} />
@@ -339,7 +339,7 @@ function MainContent({ activeBrainId }: { activeBrainId: string }) {
           {/* Legacy OS-control-plane routes → core product */}
           <Route path="/vault" element={<Navigate to="/memory" replace />} />
           <Route path="/inbox" element={<Navigate to="/tasks" replace />} />
-          <Route path="/automations" element={<Navigate to="/plugins?id=user-automations" replace />} />
+          <Route path="/automations" element={<Navigate to="/plugins?id=automations" replace />} />
           <Route path="/files" element={<Navigate to="/memory" replace />} />
           <Route path="/sandbox" element={<Navigate to="/memory" replace />} />
           <Route path="/models" element={<Navigate to="/settings" replace />} />

package/frontend/src/pages/PluginsPage.tsx

@@ -52,7 +52,7 @@ const DEFAULT_CORE_PLUGINS = new Set([
   "code-quality",
   "security",
   "embeddings",
-  "git-sentinel"
+  "git"
 ])
 
 const AGENT_RECIPE_PROMPT = `You are my coding agent. Author a bespoke Total Recall plugin for [DOMAIN] following the Total Recall Plugin Recipe:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "total-recall-brain",
-  "version": "3.43.3",
+  "version": "3.45.0",
   "description": "The Vibe Coding Brain & Autonomous Software Factory: memory, rules, secrets, and 33 visual plugins automatically managed across all your devices.",
   "type": "module",
   "bin": {
@@ -54,7 +54,7 @@
     "sync:scaffold-plugins": "node scripts/sync-scaffold-plugins.mjs",
     "clean": "rm -rf scratch/* .remember/* *.log",
     "check:dist": "node scripts/check-dist-freshness.mjs",
-    "prepublishOnly": "npm run check:package && npm run check:dist && npm run check:ssss-registry && node scripts/check-scaffold-state.mjs && npm run check:plugin-versions && npm run check:help && npm run check:harness-install",
+    "prepublishOnly": "node scripts/check-publish-source.mjs && npm run check:package && npm run check:dist && npm run check:ssss-registry && node scripts/check-scaffold-state.mjs && npm run check:plugin-versions && npm run check:help && npm run check:harness-install",
     "check:ssss-registry": "node scripts/check-ssss-registry.mjs",
     "check:plugin-versions": "node scripts/check-plugin-versions.mjs",
     "check:help": "node scripts/audit-help.mjs --builtins",
@@ -81,7 +81,7 @@
   "homepage": "https://github.com/gregiteen/total-recall#readme",
   "dependencies": {
     "@simplewebauthn/server": "^13.3.2",
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4",
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5",
     "bcrypt": "^6.0.0",
     "better-sqlite3": "^12.11.1",
     "cookie-parser": "^1.4.7",

package/scaffold/.agent/skills/plugin/SKILL.md

@@ -13,6 +13,10 @@ A recipe for agents: prompts with exact specifications, executed in order. Each
 
 A plugin adds **one capability** to Total Recall. Core holds portable memory and generic loading; everything else is a plugin.
 
+## Reuse the ecosystem first
+
+Before designing or writing a plugin, inventory `total-recall plugin library --json`, `total-recall plugin available --json` and `total-recall plugin bricks --json`. Match each dependency to an existing owner. Call installed plugins for shared services and vendor existing bricks for code the project needs to own. Document the verified gaps that need new code. Run `record.mjs --reuse` after drafting the manifest and before implementing the capability.
+
 **A plugin is not one shape.** It declares the surfaces its capability needs, and a capability can need almost any combination — memory, context, a CLI, skills, scheduled work, runtime behaviour, a face, deployment, distribution, composition. Some plugins are only a memory category. Some are only a generator. Some are a CLI. Some are several at once. What it is, is decided by what it does.
 
 ```
@@ -29,7 +33,7 @@ evals/        proof that the recipe produces correct plugins
 
 True of every plugin, whatever it turns out to be. Check every one before calling it done.
 
-1. **Everything is declared.** If the plugin can do it, the manifest says so. An undeclared operation does not exist to the host or to an agent.
+1. **Everything is declared.** If the plugin can do it, the manifest says so. Record its reused operations and brick dependencies as well.
 2. **Every executable operation declares an effect** — `read`, `write`, `destructive`, `send`. The host uses it to decide what may run read-only; an agent uses it to know what needs confirmation.
 3. **Machine-facing output is structured.** A command emits JSON under `--json` and exits non-zero on failure, so an agent acts on a result instead of scraping prose.
 4. **Credentials are declared, never held.** Resolved only through `total-recall auth secret`. Never a second store, never `argv`, never an ambient environment variable, never a log.
@@ -45,7 +49,7 @@ True of every plugin, whatever it turns out to be. Check every one before callin
 
 | # | Prompt | Produce | Check |
 | --- | --- | --- | --- |
-| 1 | [Establish the function](prompts/01-function.md) | the users, the tasks, the dependencies | you can name them |
+| 1 | [Establish the function](prompts/01-function.md) | the users, the tasks, the reused plugins and bricks | owner interfaces and gaps are identified |
 | 2 | [Choose the surfaces](prompts/02-surfaces.md) | the manifest's surface set | each declared surface is used |
 | 3 | [Scaffold, then stop generating](prompts/03-scaffold.md) | repository skeleton | it exists, tests run |
 | 4 | [Write the CLI as an agent interface](prompts/04-cli.md) | operations, args, effects, JSON | `record.mjs` passes |
@@ -68,6 +72,7 @@ node <skill>/scripts/record.mjs . --manifest   # manifest only
 node <skill>/scripts/record.mjs . --card       # face only
 node <skill>/scripts/record.mjs . --secrets    # credential safety only
 node <skill>/scripts/record.mjs . --scaffold   # standalone scaffold only
+node <skill>/scripts/record.mjs . --reuse      # installed owner commands and required bricks
 node <skill>/scripts/record.mjs . --json       # machine-readable result
 ```
 

package/scaffold/.agent/skills/plugin/evals/README.md

@@ -31,6 +31,11 @@ A case declares the failures it expects. It passes when `scripts/record.mjs` rep
 | [`card-collects-credential`](cases/04-card-collects-credential.mjs) | a card collecting an API key in a password field and dispatching the raw value — generated by the old scaffolder | `never collects a credential`, `never transmits a credential` |
 | [`host-leak-in-scaffold`](cases/05-host-leak-in-scaffold.mjs) | a capability calling the `total-recall` binary for credentials and shipping `https://example.com/checkout/success` | `no Total Recall dependency`, `no placeholder values` |
 | [`correct-plugin`](cases/06-correct-plugin.mjs) | a plugin that follows the recipe: one bespoke face, real data only, credentials resolved through auth in the CLI, and a host-free capability | no failures |
+| [`missing-reuse`](cases/07-missing-reuse.mjs) | an otherwise valid plugin without a reuse decision | `reuse declared` |
+| [`unresolved-owner-command`](cases/08-unresolved-owner-command.mjs) | a reference to an operation absent from its installed owner | `owner commands resolve` |
+| [`missing-brick`](cases/09-missing-brick.mjs) | a declared brick without a project-owned copy | `required bricks present` |
+
+Reuse cases resolve Auth against an installed Total Recall plugin catalog. Run them from a machine with Total Recall and Auth available.
 
 ## Adding a case
 

package/scaffold/.agent/skills/plugin/evals/cases/01-fabricated-seed.mjs

@@ -28,6 +28,7 @@ export default {
   files: {
     'plugin.json': JSON.stringify({
       id: 'seeded', name: 'Seeded', version: '1.0.0', description: 'A plugin that fabricates a reading.',
+      reuse: { commands: [], owned: 'Displays its own telemetry reading.' },
       cli: { command: 'seeded', handler: './cli.mjs', subcommands: [{ name: 'sample', effect: 'read' }] },
       status: { command: 'sample', refresh_seconds: 30 },
       branding: { color: '#059669' },

package/scaffold/.agent/skills/plugin/evals/cases/02-reassuring-default.mjs

@@ -25,6 +25,7 @@ export default {
   files: {
     'plugin.json': JSON.stringify({
       id: 'reassuring', name: 'Reassuring', version: '1.0.0', description: 'A plugin that reassures without checking.',
+      reuse: { commands: [], owned: 'Displays the status returned by its own command.' },
       cli: { command: 'reassuring', handler: './cli.mjs', subcommands: [{ name: 'audit', effect: 'read' }] },
       status: { command: 'audit', refresh_seconds: 30 },
       branding: { color: '#b45309' },

package/scaffold/.agent/skills/plugin/evals/cases/03-declared-template.mjs

@@ -17,6 +17,7 @@ export default {
   files: {
     'plugin.json': JSON.stringify({
       id: 'templated', name: 'Templated', version: '1.0.0', description: 'A plugin that declares a layout template.',
+      reuse: { commands: [], owned: 'Displays the plugin-specific view.' },
       cli: { command: 'templated', handler: './cli.mjs', subcommands: [{ name: 'status', effect: 'read' }] },
       status: { command: 'status', refresh_seconds: 30 },
       branding: { color: '#475569' },

package/scaffold/.agent/skills/plugin/evals/cases/04-card-collects-credential.mjs

@@ -28,6 +28,7 @@ export default {
   files: {
     'plugin.json': JSON.stringify({
       id: 'collecting', name: 'Collecting', version: '1.0.0', description: 'A plugin whose card collects a key.',
+      reuse: { commands: ['total-recall auth secret'], owned: 'Provides the service connection screen.' },
       cli: { command: 'collecting', handler: './cli.mjs', subcommands: [
         { name: 'status', effect: 'read' },
         { name: 'token', effect: 'write', args: [{ name: 'key', label: 'Key', type: 'string', secret: true }] },

package/scaffold/.agent/skills/plugin/evals/cases/05-host-leak-in-scaffold.mjs

@@ -38,6 +38,7 @@ export default {
   files: {
     'plugin.json': JSON.stringify({
       id: 'leaky', name: 'Leaky', version: '1.0.0', description: 'A plugin whose capability depends on the host.',
+      reuse: { commands: ['total-recall auth secret'], owned: 'Submits a checkout request to the service.' },
       cli: { command: 'leaky', handler: './cli.mjs', subcommands: [{ name: 'status', effect: 'read' }] },
       capability: { entry: 'capability/index.mjs', exports: ['createCheckout'] },
       secrets: [{ key: 'LEAKY_API_KEY', description: 'Service key', required: true }],

package/scaffold/.agent/skills/plugin/evals/cases/06-correct-plugin.mjs

@@ -68,6 +68,7 @@ export default {
   files: {
     'plugin.json': JSON.stringify({
       id: 'example', name: 'Example', version: '1.0.0', description: 'A plugin that follows the recipe exactly.',
+      reuse: { commands: ['total-recall auth secret'], owned: 'Reads the service-specific status endpoint.' },
       cli: { command: 'example', handler: './cli.mjs', subcommands: [
         { name: 'status', description: 'Read current status', effect: 'read', output: 'json' },
         { name: 'set-key', description: 'Store the service key', effect: 'write',

package/scaffold/.agent/skills/plugin/evals/cases/07-missing-reuse.mjs

@@ -0,0 +1,11 @@
+import correct from './06-correct-plugin.mjs';
+
+const { reuse, ...manifest } = JSON.parse(correct.files['plugin.json']);
+
+export default {
+  ...correct,
+  name: 'missing-reuse',
+  why: 'A plugin can otherwise pass authoring verification without identifying existing owners.',
+  files: { ...correct.files, 'plugin.json': JSON.stringify(manifest) },
+  expect: { fail: ['reuse declared'] },
+};

package/scaffold/.agent/skills/plugin/evals/cases/08-unresolved-owner-command.mjs

@@ -0,0 +1,12 @@
+import correct from './06-correct-plugin.mjs';
+
+const manifest = JSON.parse(correct.files['plugin.json']);
+manifest.reuse.commands.push('total-recall auth nonexistent-operation');
+
+export default {
+  ...correct,
+  name: 'unresolved-owner-command',
+  why: 'A declared operation must exist in the installed owner catalog.',
+  files: { ...correct.files, 'plugin.json': JSON.stringify(manifest) },
+  expect: { fail: ['owner commands resolve'] },
+};

package/scaffold/.agent/skills/plugin/evals/cases/09-missing-brick.mjs

@@ -0,0 +1,12 @@
+import correct from './06-correct-plugin.mjs';
+
+const manifest = JSON.parse(correct.files['plugin.json']);
+manifest.requires = ['mesh'];
+
+export default {
+  ...correct,
+  name: 'missing-brick',
+  why: 'An installed plugin is insufficient when a project declares its brick as a code dependency.',
+  files: { ...correct.files, 'plugin.json': JSON.stringify(manifest) },
+  expect: { fail: ['required bricks present'] },
+};

package/scaffold/.agent/skills/plugin/prompts/01-function.md

@@ -9,7 +9,7 @@ Answer all five, concretely:
 1. **What capability does this add?** One sentence. If it needs "and" to hold together, it is two plugins.
 2. **Who uses it, and what two or three things do they actually do with it?** Name the tasks, not the features.
 3. **What must be visible without a single click?** This decides the hierarchy later.
-4. **What does it depend on outside itself?** A provider's API, a local service, other machines on the mesh, another plugin, or nothing.
+4. **What does it depend on outside itself, and who owns each dependency?** Read the installed plugin library, available plugins and project bricks. Use the owning plugin's supported interface wherever it covers the need. Vendor an existing brick when the project needs to own the code.
 5. **Could another application want this capability?** If yes, part of this plugin is the capability and part is Total Recall presentation, and they must be separable from the first line of code.
 
 ## Correct means
@@ -17,13 +17,14 @@ Answer all five, concretely:
 - You can name the users and their tasks in plain words.
 - You know whether a scaffold is in scope (Prompt 7), because that changes where the domain logic lives.
 - The capability is one thing, not a bundle.
+- You can identify what the plugin reuses, how to call or vendor it, and the specific capability gap that needs new code.
 
 If you cannot answer 1 and 2, you are not ready to write code. Stop and find out.
 
 ## Record it
 
-Write the answers into `ui/DESIGN.md` when you reach Prompt 6 — they are the basis of the face. Keep the scaffold answer for Prompt 7.
+Record the owners and reuse decisions in the project plan before implementation. Carry the exact installed operations and the plugin's own responsibility into the manifest using the [composition contract](../references/surfaces.md#composition). Write the user and task answers into `ui/DESIGN.md` for Prompt 6. Keep the scaffold answer for Prompt 7.
 
 ## Check
 
-None mechanical. The check is that you can state the answers without hedging.
+Once the manifest is drafted, run `node <skill>/scripts/record.mjs . --reuse`. Resolve any failures before implementing the capability.

package/scaffold/.agent/skills/plugin/prompts/08-verify.md

@@ -12,6 +12,7 @@ Then work the list, and record the actual outcome of each. Do not tick a box you
 
 - [ ] `total-recall plugin info <id>` reports no errors and no warnings.
 - [ ] Every surface the function needs is declared, and nothing unused.
+- [ ] Each shared dependency uses its existing owner command or a vendored brick. The reuse gate passes and the workflow tests exercise the declared interfaces.
 - [ ] Every operation has typed arguments and an effect.
 - [ ] `--json` works on every subcommand; failures exit non-zero; `--help` works without credentials.
 - [ ] No secret value appears in `argv`, stdout, stderr, a log or the card state.

package/scaffold/.agent/skills/plugin/references/surfaces.md

@@ -145,10 +145,20 @@ Use when the capability is deployed into other applications.
 ## Composition
 
 ```json
-"requires": [ { "id": "auth", "range": "^1.0.0" } ]
+"reuse": {
+  "commands": ["total-recall auth secret"],
+  "owned": "Connects to the service and translates its records into the plugin's read model."
+},
+"requires": [ { "id": "mesh", "version": "^0.2.0" } ]
 ```
 
-Builds on other bricks instead of starting from zero.
+Copy exact command strings from `total-recall plugin library --json` for the installed owners this project uses. In `owned`, explain the capability the plugin supplies after the ecosystem inventory. Use an empty command list when the inventory supports that decision.
+
+A plugin that declares secrets names `total-recall auth secret` as its credential interface. Auth itself owns that interface.
+
+Declare portable dependencies with `requires`. Use the supported source with `total-recall plugin vendor` and inspect `total-recall plugin bricks --json` for the project-owned copy. Use `requires` only for bricks the capability actually imports. The vendor resolver checks the version constraint when it assembles a consuming project.
+
+The full Creator check verifies these declarations against the installed commands and recorded brick payloads. Verify actual reuse through the plugin and fresh-project workflow tests.
 
 ## Credentials
 

package/scaffold/.agent/skills/plugin/scripts/record.mjs

@@ -6,7 +6,7 @@
  * non-zero on any failure and prints the real reason. Nothing here trusts a
  * declaration: every check reads the actual files or runs the actual command.
  *
- *   node record.mjs <pluginDir> [--manifest|--card|--secrets|--scaffold|--json]
+ *   node record.mjs <pluginDir> [--manifest|--card|--secrets|--scaffold|--reuse|--json]
  *
  * Checks are marked PASS, FAIL or WARN. A WARN is a judgement call the agent
  * must resolve; a FAIL is a rejection.
@@ -18,7 +18,7 @@ import { pathToFileURL } from 'node:url';
 
 const args = process.argv.slice(2);
 const json = args.includes('--json');
-const only = ['--manifest', '--card', '--secrets', '--scaffold'].filter((f) => args.includes(f));
+const only = ['--manifest', '--card', '--secrets', '--scaffold', '--reuse'].filter((f) => args.includes(f));
 const root = path.resolve(args.find((a) => !a.startsWith('-')) || '.');
 const want = (section) => only.length === 0 || only.includes(section);
 
@@ -124,6 +124,63 @@ if (manifest && want('--manifest')) {
   }
 }
 
+/* ── reuse ───────────────────────────────────────────────────────────────── */
+
+function pluginInventory(command) {
+  const binary = process.env.TOTAL_RECALL_BIN || 'total-recall';
+  const output = execFileSync(binary, ['plugin', command, '--json'], {
+    cwd: root, encoding: 'utf8', timeout: 15000, maxBuffer: 8 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return JSON.parse(output);
+}
+
+if (want('--reuse') && manifest) {
+  const { reuse } = manifest;
+  const commands = reuse?.commands;
+  const validCommands = Array.isArray(commands) &&
+    commands.every((command) => typeof command === 'string' && command.startsWith('total-recall '));
+  if (typeof reuse?.owned !== 'string' || !reuse.owned.trim() || !validCommands) {
+    record('reuse', 'FAIL', 'reuse declared', 'Record reuse.commands and reuse.owned after inspecting the plugin library and project bricks');
+  } else {
+    record('reuse', 'PASS', 'reuse declared', 'Installed operations and plugin responsibility are documented');
+    if (manifest.id !== 'auth' && manifest.secrets?.length && !commands.includes('total-recall auth secret')) {
+      record('reuse', 'FAIL', 'Auth owner declared', 'Declare total-recall auth secret for the credential interface');
+    }
+    if (commands.length) {
+      try {
+        const library = pluginInventory('library');
+        const owners = new Set(library.plugins.filter((plugin) =>
+          plugin.valid && plugin.callable && plugin.id !== manifest.id).map((plugin) => plugin.id));
+        const available = new Set(library.commands.filter((entry) => owners.has(entry.plugin)).map((entry) => entry.command));
+        const unresolved = commands.flatMap((command, index) => available.has(command) ? [] : [`reuse.commands[${index}]`]);
+        const detail = unresolved.length ? `Resolve ${unresolved.join(', ')} against the installed plugin library` : `${commands.length} owner operations verified`;
+        record('reuse', unresolved.length ? 'FAIL' : 'PASS', 'owner commands resolve', detail);
+      } catch {
+        record('reuse', 'FAIL', 'owner commands resolve', 'Could not read total-recall plugin library --json');
+      }
+    }
+  }
+
+  const requires = manifest.requires === undefined ? [] : manifest.requires;
+  const brickIds = Array.isArray(requires) && requires.map((entry) => typeof entry === 'string' ? entry : entry?.id);
+  const invalidVersion = Array.isArray(requires) && requires.some((entry) =>
+    entry?.range !== undefined || (entry?.version !== undefined && typeof entry.version !== 'string'));
+  if (!brickIds || invalidVersion || brickIds.some((id) => typeof id !== 'string' || !/^[a-z][a-z0-9-]*$/.test(id) || id === manifest.id)) {
+    record('reuse', 'FAIL', 'required bricks present', 'Declare other brick IDs in requires and use version for version constraints');
+  } else if (brickIds.length) {
+    try {
+      const bricks = pluginInventory('bricks');
+      const present = new Set(bricks.filter((brick) => ['unchanged', 'modified'].includes(brick.status)).map((brick) => brick.id));
+      const missing = brickIds.filter((id) => !present.has(id));
+      const detail = missing.length ? `Vendor required bricks through the plugin manager: ${missing.join(', ')}` : `${brickIds.length} project-owned bricks verified`;
+      record('reuse', missing.length ? 'FAIL' : 'PASS', 'required bricks present', detail);
+    } catch {
+      record('reuse', 'FAIL', 'required bricks present', 'Could not read total-recall plugin bricks --json');
+    }
+  }
+}
+
 /* ── card ────────────────────────────────────────────────────────────────── */
 
 if (want('--card') && manifest) {

package/scaffold/.agent/skills/total-recall/plugins/auth/README.md

@@ -50,6 +50,14 @@ override; `_TR_TEST_BRAIN_DIR` and `_TR_TEST_AGENT_DIR` preserve disposable test
 isolation. Resolving this path performs no credential read or initialization.
 Explicit low-level store APIs retain their existing selected-store semantics.
 
+## Changing `gh` scopes
+
+`gh` signs in from `github_token` on every machine that receives it, so a rotated token lands everywhere. A login changed on the machine itself stays, and the sync reports it once.
+
+- One machine: `gh auth refresh -h github.com -s <scope>`. Remove it with `--remove-scopes <scope>`, and the next sync returns `gh` to the store's token.
+- Every machine: refresh on one, then `total-recall auth secret gh-login adopt`. It shows the scope change and writes nothing until `--yes`. `--revoke-old` also ends the previous token at GitHub.
+- Compare or go back: `total-recall auth secret gh-login status` and `use-store`.
+
 ## Using this from an agent
 
 Send anything involving a credential here: reading, storing or rotating a secret, issuing API keys, passkeys, passwords and sign-in sessions. There is one store per machine, so search it before asking anyone for a key, and never print a value.

package/scaffold/.agent/skills/total-recall/plugins/auth/package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-auth",
-      "version": "1.2.8",
+      "version": "1.2.10",
       "license": "MIT",
       "dependencies": {
-        "@gregiteen/ssss-cli": "0.14.4",
+        "@gregiteen/ssss-cli": "0.14.5",
         "@simplewebauthn/server": "^13.3.2",
         "bcrypt": "^6.0.0",
         "express": "^5.2.1",
@@ -19,7 +19,7 @@
       },
       "devDependencies": {
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.42.1",
+        "total-recall-brain": "3.44.0",
         "vitest": "^4.1.12"
       }
     },
@@ -723,9 +723,9 @@
       "license": "MIT"
     },
     "node_modules/@gregiteen/ssss-cli": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "license": "ISC",
       "bin": {
         "ssss": "scripts/ssss.mjs"
@@ -1902,9 +1902,9 @@
     },
     "node_modules/@ssss/cli": {
       "name": "@gregiteen/ssss-cli",
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.4.tgz",
-      "integrity": "sha512-R6JIgPRvS9xXp0xb6BYO3rauv+72r35GIiDrJcvbjPdTSHFZXr8/jRxFOgoF8yTed/5xyGFF3ey3DI9bOjmHVA==",
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/@gregiteen/ssss-cli/-/ssss-cli-0.14.5.tgz",
+      "integrity": "sha512-qVEYOocnwn97uJ0eDzmuwN06CYsYWr2t3+iKylpisBHX4wlLWk7P8EmFFdBlx7NyKVIZDDeYT164Gd7/T8UGgw==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -6704,9 +6704,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.42.1",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.42.1.tgz",
-      "integrity": "sha512-woH7mdkGwPFYlKPZurhE8L3BPe+cSeIruNGaPOjGZJm/O8C92Bbr1gsdOY0tTLg5QHlgPHcXG1GMtsm9lPDz8w==",
+      "version": "3.44.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.44.0.tgz",
+      "integrity": "sha512-VNPaIO9zsSwoxAsJ5ByIQBP9zPpLq4RiQO7Vrex4rBOHFQJT50P7utcZiLMSZTyZJU4C/m5uB8qTCSBMp6+l6Q==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -6714,7 +6714,7 @@
       ],
       "dependencies": {
         "@simplewebauthn/server": "^13.3.2",
-        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4",
+        "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5",
         "bcrypt": "^6.0.0",
         "better-sqlite3": "^12.11.1",
         "cookie-parser": "^1.4.7",
@@ -6737,6 +6737,7 @@
         "antigravity": "bin/antigravity.mjs",
         "total-recall": "bin/total-recall.mjs",
         "total-recall-memory": "bin/total-recall-memory.mjs",
+        "total-recall-server-release": "bin/total-recall-server-release.mjs",
         "vibebrain": "bin/total-recall.mjs"
       },
       "optionalDependencies": {

package/scaffold/.agent/skills/total-recall/plugins/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-auth",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "description": "White-label Total Recall auth plugin: Passkey biometric FIDO2 and Google OAuth2 authentication.",
   "type": "module",
   "main": "cli.mjs",
@@ -23,7 +23,7 @@
     "express-rate-limit": "^8.5.1",
     "jsonwebtoken": "^9.0.3",
     "yaml": "^2.9.0",
-    "@gregiteen/ssss-cli": "0.14.4"
+    "@gregiteen/ssss-cli": "0.14.5"
   },
   "files": [
     "cli.mjs",
@@ -39,6 +39,6 @@
     "access": "public"
   },
   "overrides": {
-    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.4"
+    "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"
   }
 }

package/scaffold/.agent/skills/total-recall/plugins/auth/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "auth",
   "name": "Auth & Secrets",
-  "version": "1.2.8",
+  "version": "1.2.10",
   "description": "Hardware WebAuthn biometric FIDO2 passkeys, OAuth session security, and access control.",
   "author": "Total Recall contributors",
   "license": "MIT",

package/scaffold/.agent/skills/total-recall/plugins/auth/src/cli-gh-login.mjs

@@ -0,0 +1,102 @@
+/**
+ * `auth secret gh-login`: see how this machine's `gh` login compares with `github_token`,
+ * share it with the mesh, or return to the store's token. Prints fingerprints, never values.
+ */
+import { adoptGithubLogin, githubLoginStatus, useStoreGithubLogin } from './secrets-sync.mjs';
+
+const USAGE = 'Usage: total-recall auth secret gh-login <status|adopt [--yes] [--revoke-old]|use-store [--yes]> [--json]';
+const COMMAND = 'total-recall auth secret gh-login';
+
+const scopeList = (scopes) => (scopes?.length ? scopes.join(', ') : 'no classic scopes');
+
+function tokenLine(label, token) {
+  if (token.state === 'rejected') return `    ${label}  ${token.fingerprint}  rejected by GitHub`;
+  if (token.state !== 'ok') return `    ${label}  ${token.fingerprint}  could not be checked with GitHub`;
+  return `    ${label}  ${token.fingerprint}  ${token.login}  ${scopeList(token.scopes)}`;
+}
+
+function scopeChange({ added = [], removed = [], store }) {
+  if (store && store.state !== 'ok') return ['    the stored token is already rejected by GitHub, so there is no scope change to compare'];
+  const lines = [];
+  if (added.length) lines.push(`    gains: ${added.join(', ')}`);
+  if (removed.length) lines.push(`    loses: ${removed.join(', ')}`);
+  return lines.length ? lines : ['    scopes unchanged'];
+}
+
+function statusText(status) {
+  if (status.state === 'no-token') return ['', '  The store holds no github_token.', ''];
+  if (status.state === 'gh-missing') return ['', '  gh is not installed on this machine.', ''];
+  if (status.state === 'unreadable') return ['', `  Could not read gh's login: ${status.error}`, ''];
+  if (status.state === 'no-login') return ['', '  gh holds no login here. The next sync signs it in from github_token.', tokenLine('store', status.store), ''];
+  if (status.state === 'same') return ['', '  gh on this machine uses github_token.', tokenLine('store', status.store), ''];
+  return [
+    '',
+    '  gh on this machine differs from github_token.',
+    tokenLine('gh   ', status.gh),
+    tokenLine('store', status.store),
+    '',
+    '  The sync leaves this login alone until github_token is rotated.',
+    `    Share it with every machine:   ${COMMAND} adopt`,
+    `    Go back to the store's token:  ${COMMAND} use-store`,
+    '',
+  ];
+}
+
+function adoptText(result) {
+  if (result.state === 'same') return ['', `  gh already uses ${result.key} (${result.fingerprint}).`, ''];
+  const where = result.target === 'this machine' ? 'this machine (the leader)' : `the leader (${result.target})`;
+  if (result.planned) {
+    return [
+      '',
+      `  Would save gh's token (${result.gh.fingerprint}) as ${result.key} on ${where}, replacing ${result.store.fingerprint}.`,
+      '  Every machine granted this key receives it on its next sync, with these scopes:',
+      `    ${scopeList(result.gh.scopes)}`,
+      ...scopeChange(result),
+      ...(result.revoke_old && result.store.state === 'ok' ? ['  Then ends the old token at GitHub. That cannot be undone.'] : []),
+      '  Run again with --yes to do it.',
+      '',
+    ];
+  }
+  const lines = ['', `  ✅ ${result.key} is now gh's token (${result.gh.fingerprint}), saved on ${where}.`, ...scopeChange(result)];
+  if (result.leader_gh === 'failed') lines.push("  ❌ The leader's gh did not sign in, so it still uses the old token.");
+  if (result.revocation?.skipped) lines.push(`  ❌ The old token still works: ${result.revocation.skipped}.`);
+  else if (result.revocation?.revoked) lines.push(`  ✅ GitHub now rejects the old token (${result.store.fingerprint}).`);
+  else if (result.revocation) lines.push(`  ❌ The old token (${result.store.fingerprint}) still works (revoke request ${result.revocation.request_status ?? 'failed'}).`);
+  if (result.revocation && !result.revocation.skipped && !result.revocation.new_token_works) lines.push('  ❌ GitHub no longer accepts the new token. Sign in with gh again, then adopt again.');
+  lines.push('');
+  return lines;
+}
+
+function useStoreText(result) {
+  if (result.error) return ['', `  ❌ gh did not sign in: ${result.error}`, ''];
+  if (result.changed === false) return ['', '  gh already uses github_token.', ''];
+  if (result.planned) {
+    const local = result.gh ? tokenLine('gh   ', result.gh) : '    gh     holds no login';
+    return ['', "  Would sign gh in from github_token, giving up this machine's own login.", local, tokenLine('store', result.store), '  Getting a broader login back takes a new browser approval. Run again with --yes to do it.', ''];
+  }
+  return ['', '  ✅ gh now uses github_token.', tokenLine('store', result.store), ''];
+}
+
+/** @returns {Promise<number>} the exit code */
+export async function runGhLogin(brainDir, opts) {
+  const action = opts.key;
+  if (opts.unknownOption || opts.value || !['status', 'adopt', 'use-store'].includes(action)) {
+    console.error(opts.unknownOption ? `  Unknown option for gh-login: ${opts.unknownOption}` : USAGE);
+    return 1;
+  }
+  let result;
+  let text;
+  if (action === 'status') {
+    result = await githubLoginStatus({ dir: brainDir });
+    text = statusText;
+  } else if (action === 'adopt') {
+    result = await adoptGithubLogin({ dir: brainDir, yes: opts.yes === true, revokeOld: opts.revokeOld === true });
+    text = adoptText;
+  } else {
+    result = await useStoreGithubLogin({ dir: brainDir, yes: opts.yes === true });
+    text = useStoreText;
+  }
+  if (opts.json) console.log(JSON.stringify(result, null, 2));
+  else console.log(text(result).join('\n'));
+  return result.ok === false ? 1 : 0;
+}