total-recall-brain 3.44.0 → 3.46.0

package/scaffold/.agent/skills/total-recall/plugins/auth/plugin.json

@@ -2,8 +2,8 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "auth",
   "name": "Auth & Secrets",
-  "version": "1.2.9",
-  "description": "Hardware WebAuthn biometric FIDO2 passkeys, OAuth session security, and access control.",
+  "version": "1.3.0",
+  "description": "Encrypted credentials, repository bindings, dashboard sign-in and access across brains and machines.",
   "author": "Total Recall contributors",
   "license": "MIT",
   "use_cases": [
@@ -16,41 +16,6 @@
     "badge": "FIDO2 Vault",
     "font": "chivo-mono"
   },
-  "card_face": {
-    "theme": "vibrant",
-    "headline": "Passkey & Google OAuth2 Authentication Engine",
-    "primary_color": "#6366f1",
-    "secondary_color": "#312e81",
-    "accent_color": "#818cf8",
-    "touch_layout": "comfortable",
-    "interactive": true,
-    "quick_actions": [
-      {
-        "subcommand": "status",
-        "label": "STATUS"
-      },
-      {
-        "subcommand": "audit",
-        "label": "AUDIT"
-      },
-      {
-        "subcommand": "passkey",
-        "label": "PASSKEY"
-      },
-      {
-        "subcommand": "google",
-        "label": "GOOGLE"
-      },
-      {
-        "subcommand": "rotate",
-        "label": "ROTATE"
-      },
-      {
-        "subcommand": "probe",
-        "label": "CHECK ENDPOINT"
-      }
-    ]
-  },
   "secrets": [
     {
       "key": "GOOGLE_CLIENT_ID",
@@ -132,12 +97,14 @@
       {
         "name": "agent",
         "description": "Sign in an agent CLI that authenticates on its own terminal",
-        "effect": "destructive"
+        "effect": "destructive",
+        "sensitive_output": true
       },
       {
         "name": "secret",
         "description": "Manage and inspect auth secrets in the Total Recall store",
-        "effect": "write"
+        "effect": "write",
+        "sensitive_output": true
       },
       {
         "name": "password",
@@ -153,21 +120,16 @@
     ]
   },
   "ui": {
-    "design_tokens": "ui/DESIGN.md",
+    "home": "home",
+    "design_tokens": "DESIGN.md",
     "elements": [
       {
-        "id": "card",
-        "kind": "card",
-        "tag": "tr-auth-card",
-        "module": "ui/card.js",
-        "description": "Gatepass Card Face"
-      },
-      {
-        "id": "panel",
+        "id": "home",
         "kind": "panel",
-        "tag": "tr-auth-panel",
-        "module": "ui/panel.js",
-        "description": "Gatepass Auth & Credentials Management Panel"
+        "tag": "tr-auth-home",
+        "module": "ui/home.js",
+        "description": "Credential inventory, brains, machines and sign-in checks",
+        "events": ["auth-inventory", "auth-credential-mutate"]
       }
     ]
   },

package/scaffold/.agent/skills/total-recall/plugins/auth/src/cli-secret.mjs

@@ -294,6 +294,8 @@ function printHelp() {
     carriers              Find shell profiles and /etc files that export the master
                            password to every process; --remove-ambient deletes them
                            once an owner-only carrier holds the same password.
+    scan --stdin          Name the keys whose stored values occur in the text on stdin
+                           (values are never printed; exit 1 when one occurs)
     fingerprint           Identify a credential without printing it: length, type
                            prefix, fingerprint and the store keys holding the same
                            value. --from-clipboard | --stdin; --expect-prefix <p>
@@ -773,7 +775,7 @@ export default async function secretCli(argv) {
   }
   const brainDir = secretsStoreDir();
 
-  if (opts.stdin && opts.command !== 'fingerprint') {
+  if (opts.stdin && opts.command !== 'fingerprint' && opts.command !== 'scan') {
     if (!['set', 'rotate', 'rekey'].includes(opts.command)) {
       console.error('❌ --stdin is only valid with `set`, `rotate`, `rekey`, or `fingerprint`');
       await exitAfterFlush(1);
@@ -1292,6 +1294,23 @@ export default async function secretCli(argv) {
       return;
     }
 
+    if (opts.command === 'scan') {
+      // Name every store key whose value occurs in the text on stdin. Values never leave this
+      // process: callers (the git plugin's secret firewall) get key names only. One call per scan.
+      if (!opts.stdin) {
+        console.error('Usage: total-recall auth secret scan --stdin [--json]   (exit 1 when a stored value occurs)');
+        await exitAfterFlush(2);
+      }
+      // Diffs and staged files are large; one value check is not, so scan alone gets 64 MB.
+      const text = readAllStdinSync({ maxBytes: 64 * 1024 * 1024 }).toString();
+      const { textContainsSecrets } = await import('./secrets-store.mjs');
+      const result = await textContainsSecrets(brainDir, text);
+      if (opts.json) console.log(JSON.stringify({ ok: !result.leak, leak: result.leak, keys: result.keys, scanned_bytes: Buffer.byteLength(text) }));
+      else console.log(result.leak ? `  ❌ stored values found for: ${result.keys.join(', ')}` : '  ✅ no stored value found');
+      if (result.leak) process.exitCode = 1;
+      return;
+    }
+
     if (opts.command === 'fingerprint') {
       // Identify a credential without seeing it: which store keys hold the same
       // value, its length and its non-secret type prefix. Lets an operator check

package/scaffold/.agent/skills/total-recall/plugins/auth/src/secrets-store.mjs

@@ -771,13 +771,24 @@ export function listUsageEvents(brainDir, { limit = 100, key_ref = null, days =
 /**
  * True if any secret value appears in text (for surface/openwiki conformance).
  */
+export function isSettingValue(val) {
+  if (/^[a-z]+$/.test(val)) return true;
+  if (/^(?=.{4,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(val)) return true;
+  if (/^[^\s@:/]+@([a-z0-9-]+\.)+[a-z]{2,63}$/i.test(val)) return true;
+  if (/^https?:\/\/[^\s@/]+(\/[^\s@]*)?$/i.test(val)) return true;
+  return false;
+}
+
 export async function textContainsSecrets(brainDir, text) {
   if (!text) return { leak: false, keys: [] };
   const secrets = await loadSecrets(brainDir);
   const leaked = [];
   for (const [key, val] of Object.entries(secrets)) {
     if (key === META_KEY) continue;
-    if (typeof val === 'string' && val.length >= 8 && text.includes(val)) {
+    // Settings, not credentials: a single lowercase word (DEPLOY_ENV=production), a hostname
+    // (MAILCOW_HOST), an email address, or a URL without user info. Matching them would refuse
+    // ordinary text. A URL that carries user:password@ is still checked, as is every other value.
+    if (typeof val === 'string' && val.length >= 8 && !isSettingValue(val) && text.includes(val)) {
       leaked.push(key);
     }
   }

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/access-overview.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+title: Credentials and access inventory
+description: Browse the encrypted credential inventory, registered brains, and Mesh machines, then inspect dashboard sign-in and the host baseline.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: access-overview
+intents: [find all stored secrets, inspect repository credential bindings, see registered brains, see mesh machines, check dashboard sign-in]
+surfaces: [page]
+panel: home
+operations: [status]
+data: ["status:/passkey/registered_count", "status:/google_oauth2/configured"]
+---
+
+<aside aria-label="Credential handling">
+  <p>Repository bindings show where each stored credential is available. Use the rotation column to find credentials that need review.</p>
+</aside>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/agent-login.md

@@ -0,0 +1,20 @@
+---
+type: ui-chunk:chunk
+title: Agent sign-in
+description: Check supported agent profiles and complete an approved terminal sign-in.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: agent-login
+intents: [sign in Codex CLI, check agent sign-in profiles, approve terminal sign-in]
+surfaces: [page, right]
+operations: [agent]
+---
+
+<section style="border-block-start:1px solid var(--color-outline,#3f6350)">
+  <h2>Agent sign-in</h2>
+  <ol>
+    <li>Find the supported profiles with <code>total-recall auth agent list</code>.</li>
+    <li>Start the selected sign-in with <code>total-recall auth agent login &lt;profile&gt;</code> in the owner terminal.</li>
+    <li>Complete browser approval in the browser session where you intend to sign in. Enter any approval code in the owner flow.</li>
+  </ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/baseline-audit.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Security baseline
+description: Review Auth checks for passkey file permissions, session signing, and Google credentials.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: baseline-audit
+intents: [run auth audit, check sign-in security baseline, investigate authentication warnings]
+surfaces: [page, right]
+operations: [audit]
+data: ["audit:/passed", "audit:/findings_count"]
+---
+
+<section style="border-block-start:1px solid var(--color-outline,#3f6350)">
+  <h2>Security baseline</h2>
+  <dl>
+    <dt><strong>Passkey storage</strong></dt><dd>Checks that Auth can read its active passkey state and that the document has private permissions.</dd>
+    <dt><strong>Session signing</strong></dt><dd>Checks that the dashboard signing credential is present and long enough.</dd>
+    <dt><strong>Google credentials</strong></dt><dd>Flags a configured client ID with a missing client secret.</dd>
+  </dl>
+  <p>Run the baseline in Auth Home or use <code>total-recall auth audit</code> to inspect individual findings.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/credential-repository-binding.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: auth
+id: credential-repository-binding
+title: Edit a credential's repository binding
+description: Filter real encrypted credential records by their repository and edit, replace or clear a stored binding through Auth.
+timestamp: '2026-11-08T23:23:00Z'
+intents: [fix a credential repository binding, edit repository access for a key, see which credentials a repo uses]
+surfaces: [page]
+operations: [secret]
+panel: home
+---
+
+<section data-design-component="access-overview">
+  <h2>Repository binding</h2>
+  <p>Filter the Secrets inventory by repository, select Edit for the credential, then choose one repository or clear the binding. Save details to apply the change.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/credential-store-maintenance.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: auth
+id: credential-store-maintenance
+title: Replace or remove a stored credential
+description: Update a credential value in the encrypted Auth store or explicitly delete its stored record.
+timestamp: '2026-11-08T23:23:00Z'
+intents: [replace a stored credential value, delete an obsolete credential, remove a stored secret from this host]
+surfaces: [page]
+operations: [secret]
+panel: home
+---
+
+<section data-design-component="access-overview">
+  <h2>Stored credential maintenance</h2>
+  <p>Use Edit and Replace value to save a new value. Use Delete and enter the credential name to remove it from the host store. Provider revocation is a separate Auth operation.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/dashboard-password.md

@@ -0,0 +1,18 @@
+---
+type: ui-chunk:chunk
+title: Dashboard password
+description: Inspect password configuration and follow the protected dashboard reset flow.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: dashboard-password
+intents: [check dashboard password, force a password reset, change dashboard sign-in password]
+surfaces: [page, right]
+operations: [password]
+data: ["password:/configured", "password:/forcePasswordReset"]
+---
+
+<section>
+  <h2>Dashboard password</h2>
+  <p>Use <code>total-recall auth password status --json</code> to see whether a password is configured and whether a reset is required.</p>
+  <p>Change the password in the signed-in dashboard flow or use <code>total-recall auth password set --stdin</code> in the owner terminal. Auth invalidates existing dashboard sessions after the change.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/dashboard-sessions.md

@@ -0,0 +1,18 @@
+---
+type: ui-chunk:chunk
+title: Dashboard session signing
+description: Check whether this host has a dashboard signing credential.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: dashboard-sessions
+intents: [check dashboard session signing, inspect cookie security, diagnose missing session secret]
+surfaces: [page, right]
+operations: [session]
+data: ["session:/session_secret_configured"]
+---
+
+<section>
+  <h2>Dashboard session signing</h2>
+  <p>Auth signs dashboard sessions and sets an HttpOnly cookie. Check whether signing is configured in Auth Home or with <code>total-recall auth session</code>.</p>
+  <p style="color:var(--color-muted,#b1c9ba)">This check reports signing setup. Review a specific sign-in in the browser session that performed it.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/endpoint-probe.md

@@ -0,0 +1,23 @@
+---
+type: ui-chunk:chunk
+title: Probe Auth endpoints
+description: Check whether the configured host serves Auth discovery, status, and health.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: endpoint-probe
+intents: [probe auth endpoints, diagnose dashboard connection, check auth route health]
+surfaces: [page, right]
+operations: [probe]
+data: ["probe:/success"]
+---
+
+<section>
+  <h2>Probe Auth endpoints</h2>
+  <p>Run <code>total-recall auth probe</code> to check the configured host.</p>
+  <dl style="border-inline-start:2px solid var(--color-outline,#3f6350);padding-inline-start:1rem">
+    <dt><code>/auth/status</code></dt><dd>Dashboard Auth discovery</dd>
+    <dt><code>/auth/providers</code></dt><dd>Sign-in method discovery</dd>
+    <dt><code>/health</code></dt><dd>Host reachability</dd>
+  </dl>
+  <p>The probe reports HTTP status and latency. Verify the account sign-in separately in the browser.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/google-sign-in.md

@@ -0,0 +1,21 @@
+---
+type: ui-chunk:chunk
+title: Google sign-in
+description: Inspect local Google OAuth setup and use the browser-owned sign-in flow.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: google-sign-in
+intents: [check Google OAuth setup, connect Google account, review Google sign-in]
+surfaces: [page, right]
+operations: [google]
+data: ["google:/configured"]
+---
+
+<article>
+  <h2>Google sign-in</h2>
+  <p>Check the dashboard's client configuration and allowlist with <code>total-recall auth google status</code>. To connect, open the sign-in URL from <code>total-recall auth google connect</code> in your browser.</p>
+  <details>
+    <summary>Review a connected account</summary>
+    <p>Use <code>total-recall auth google accounts</code> to review account status. Refresh or disconnect the selected account through the same Auth command group.</p>
+  </details>
+</article>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/mesh-machines.md

@@ -0,0 +1,16 @@
+---
+type: ui-chunk:chunk
+plugin: auth
+id: mesh-machines
+title: Mesh machines
+description: Inspect the Mesh owner’s inventory with machine name, operating system, assigned role, and reported connectivity.
+timestamp: '2026-11-08T23:10:00Z'
+intents: [find all machines, list mesh machines, check device connectivity, see the current host]
+surfaces: [page]
+panel: home
+---
+
+<section data-design-component="access-overview">
+  <h2>Mesh machines</h2>
+  <p>Open Machines in the Auth console to distinguish online peers, offline peers, and machines registered in the vault.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/passkey-enrollment.md

@@ -0,0 +1,21 @@
+---
+type: ui-chunk:chunk
+title: Passkey enrollment and review
+description: Inspect registered authenticators and follow the Auth WebAuthn flow.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: passkey-enrollment
+intents: [check passkeys, register an authenticator, remove a retired security key]
+surfaces: [page, right]
+operations: [passkey]
+data: ["passkey:/count"]
+---
+
+<section>
+  <h2>Passkey enrollment and review</h2>
+  <ol>
+    <li>Check the registered count with <code>total-recall auth passkey status</code>.</li>
+    <li>Enroll through the dashboard's authenticated WebAuthn flow. Approve the request with a device or security key.</li>
+    <li>Use <code>total-recall auth passkey list</code> to identify a retired authenticator before removing it through Auth.</li>
+  </ol>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/registered-brains.md

@@ -0,0 +1,16 @@
+---
+type: ui-chunk:chunk
+plugin: auth
+id: registered-brains
+title: Registered brains
+description: Inspect the live brain registry with brain name, layer, memory node count, and availability.
+timestamp: '2026-11-08T23:10:00Z'
+intents: [show registered brains, find a project brain, inspect brain inventory, check which brains are present]
+surfaces: [page]
+panel: home
+---
+
+<section data-design-component="access-overview">
+  <h2>Registered brains</h2>
+  <p>Open Brains in the Auth console to see the dashboard’s registered brains and their current memory counts.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/scoped-access-keys.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+title: Scoped access keys
+description: Review access key scope and use the owner terminal for issue and revocation.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: scoped-access-keys
+intents: [issue scoped access key, review PAT permissions, revoke a dashboard API key]
+surfaces: [page, right]
+operations: [key]
+---
+
+<section style="border-inline-start:3px solid var(--color-primary,#64e3a4);padding-inline-start:1rem">
+  <h2>Scoped access keys</h2>
+  <p>Review key IDs, scopes and expiry with <code>total-recall auth key list</code>. Check available roles with <code>total-recall auth key roles</code>.</p>
+  <p>Issue keys with only the scopes the client needs. The owner terminal displays the new value once. Revoke retired keys by ID after checking the client has moved to its replacement.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/secret-inventory.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Credential inventory
+description: Review saved credential metadata, repository bindings, and rotation due dates. Open a credential to edit its metadata, replace the stored value or delete it.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+panel: home
+id: secret-inventory
+intents: [inspect credential inventory, check secret repository bindings, review rotation due dates]
+surfaces: [page, right]
+operations: [secret]
+---
+
+<section>
+  <h2>Credential inventory</h2>
+  <dl>
+    <dt><code>total-recall auth secret list --json</code></dt>
+    <dd>Read repository bindings, tags, provider and verification metadata.</dd>
+    <dt><code>total-recall auth secret catalog</code></dt>
+    <dd>Review the credentials known to the host.</dd>
+    <dt><code>total-recall auth secret rotation-due</code></dt>
+    <dd>Review due dates before selecting credentials to rotate.</dd>
+  </dl>
+  <p>Use Edit to save a label or repository binding, or replace the stored value. Use Delete and confirm the credential name to remove it from this host.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/auth/ui/chunks/signing-key-rotation.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Rotate a session signing key
+description: Replace the signing credential for dashboard or collaboration sessions.
+timestamp: "2026-11-08T08:53:21Z"
+plugin: auth
+id: signing-key-rotation
+intents: [rotate session signing key, invalidate dashboard sessions, rotate collaboration signing]
+surfaces: [page, right]
+operations: [rotate]
+data: ["rotate:/rotated"]
+---
+
+<section style="border-inline-start:3px solid var(--color-warning,#f4d18c);padding-inline-start:1rem">
+  <h2>Rotate a session signing key</h2>
+  <p>Rotation invalidates existing sessions for the selected purpose. Make sure you can sign back in before rotating.</p>
+  <ul>
+    <li><strong>Dashboard</strong> <code>total-recall auth rotate</code></li>
+    <li><strong>Collaboration</strong> <code>total-recall auth rotate --collaboration</code></li>
+  </ul>
+  <p>Run the selected command in the owner terminal.</p>
+</section>