total-recall-brain 3.45.0 → 3.46.0

package/scaffold/.agent/skills/total-recall/plugins/security/DESIGN.md

@@ -0,0 +1,84 @@
+---
+version: alpha
+name: Security evidence desk
+description: A paper field notebook for measured and manual security evidence.
+colors:
+  background: "#f4f0e6"
+  surface: "#fdfbf5"
+  text: "#22342d"
+  muted: "#4d6157"
+  border: "#aab6a8"
+  primary: "#31564b"
+  primary-soft: "#dce9dd"
+  notice: "#795117"
+typography:
+  title:
+    fontFamily: "Georgia, serif"
+    fontSize: 36px
+    fontWeight: 600
+    lineHeight: 1.05
+  body:
+    fontFamily: "system-ui, sans-serif"
+    fontSize: 15px
+    fontWeight: 400
+    lineHeight: 1.55
+  label:
+    fontFamily: "system-ui, sans-serif"
+    fontSize: 12px
+    fontWeight: 700
+    letterSpacing: 0.06em
+rounded:
+  sm: 4px
+  md: 8px
+spacing:
+  sm: 8px
+  md: 16px
+  lg: 22px
+  xl: 28px
+  touch: 44px
+components:
+  evidence-note:
+    backgroundColor: "{colors.surface}"
+    textColor: "{colors.text}"
+    typography: "{typography.body}"
+    padding: "{spacing.md}"
+    rounded: "{rounded.sm}"
+  section-marker:
+    textColor: "{colors.primary}"
+    typography: "{typography.label}"
+    padding: "{spacing.sm}"
+---
+
+# Security evidence desk
+
+## Overview
+
+The desk reads like an operator’s field notebook. It starts with the scope of a check and makes room for a clear result, partial coverage, and the next deliberate action.
+
+## Colors
+
+Use warm paper for the main surface and forest ink for headings, focus and separators. Keep secondary explanations muted with enough contrast to read beside evidence. Use notice ink for a review state with a visible label.
+
+## Typography
+
+Use the serif title for major sections and system sans for dense evidence. Give numbers and scope labels room to scan. Keep technical state labels readable without relying on color.
+
+## Layout
+
+Use one column on narrow screens. On wide screens place target controls on the left and the current evidence on the right. Long forms and permission repair belong in disclosed sections.
+
+## Elevation & Depth
+
+Use rules and background changes to distinguish regions. The evidence area is a single work surface with no floating layers.
+
+## Shapes
+
+Small radii keep fields and controls consistent. Aim for at least 44 pixels for action targets and a strong keyboard focus outline.
+
+## Components
+
+Use evidence notes for one selected scope and its measured limits. Use section markers for labels on local, mesh, device and website workflows.
+
+## Do's and Don'ts
+
+Write explicit status labels and identify what was observed. Keep measurement, manual review and unavailable state distinct. Use aggregate coverage in the browser and terminal entry points for private material. Start an assessment or repair after an explicit action.

package/scaffold/.agent/skills/total-recall/plugins/security/README.md

@@ -24,7 +24,9 @@ Auth owns credentials. Machine audits need no security master key. For signing/e
 
 Source scans report locations and rule IDs without matched secrets. Heuristic findings require source review; they are not proof of complete vulnerability coverage. Auth declarations alone do not establish runtime enforcement. Plugin audits never rewrite manifests to fabricate hardening.
 
-Exit 0 means the requested operation completed within its stated semantics; machine/fleet checks exit 1 for risks, review or incomplete coverage. `harden` without an apply flag returns a plan with zero applied changes. UI renders actual reports and failures.
+Exit 0 means the requested operation completed within its stated semantics. Machine and fleet checks exit 1 for risks, review or incomplete coverage. `harden` without an apply flag returns a plan with zero applied changes. Network inspection is read-only.
+
+The Security Home shows local capability metadata and gives you explicit controls for assessments. It displays coverage and finding counts, with raw reports available through the owner CLI. Envelope, credential and challenge operations use the terminal. The packaged SSSS blocks and [design tokens](DESIGN.md) support the workspace compositor.
 
 See [the operational skill](skills/security/SKILL.md). Official platform contracts: [OpenSSH](https://man.openbsd.org/sshd_config), [Ubuntu firewall administration](https://ubuntu.com/server/docs/how-to/security/firewalls/), [Apple platform protection](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web).
 
@@ -60,7 +62,7 @@ Mount the middleware after trusted session/proxy resolution and before applicati
 
 `security plugins` reads the installed host registry and assesses source coverage and security declarations. [OWASP CSRF guidance](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html), [Node HTTP](https://nodejs.org/api/http.html).
 
-The [Security project tracker](docs/projects/in-progress/SECURITY_CARD/SECURITY_CARD_PROJECT_TRACKER.md) records scanner coverage, runtime enforcement and card acceptance separately. The manifest does not declare a standalone application brick.
+The [Security project tracker](docs/projects/in-progress/SECURITY_CARD/SECURITY_CARD_PROJECT_TRACKER.md) records scanner coverage, runtime enforcement and Home acceptance separately.
 
 ## Using this from an agent
 

package/scaffold/.agent/skills/total-recall/plugins/security/cli.mjs

@@ -709,6 +709,10 @@ async function machineCommand(args) {
   console.log(JSON.stringify(result, null, 2));
   if (result.status !== 'passed' || remediation?.status === 'failed') process.exitCode = 1;
 }
+async function networkCommand(args) {
+  if (args.includes('--apply-permissions')) throw new Error('Network is read-only. Use machine --apply-permissions for an explicit repair');
+  return machineCommand([]);
+}
 function option(args, name) {
   const at = args.indexOf(name);
   if (at < 0) return undefined;
@@ -861,24 +865,8 @@ const IMPLEMENTED = {
     const json = args.includes("--json");
     const status = {
       plugin: "security",
-      active_suite: [
-        "platforms", "device", "android",
-        "machine",
-        "fleet",
-        "audit",
-        "scan",
-        "harden",
-        "plugins",
-        "secure-all",
-        "challenge",
-        "bot-mitigate",
-        "site-audit",
-        "site-shield",
-        "encrypt",
-        "decrypt",
-        "probe",
-        "token"
-      ],
+      host_platform: process.platform,
+      active_suite: Object.keys(IMPLEMENTED).filter(name => name !== 'status'),
       encryption_cipher: "AES-256-GCM (scrypt KDF)",
       proof_of_work: "SHA-256 PoW challenge engine",
       bot_mitigation: "Honeypot + velocity + token risk analyzer",
@@ -901,7 +889,7 @@ const IMPLEMENTED = {
   platforms: async () => console.log(JSON.stringify(platformInventory(), null, 2)),
   device: deviceCommand,
   android: androidCommand,
-  network: machineCommand,
+  network: networkCommand,
   fleet: fleetCommand,
   audit: auditCommand,
   scan: scanCommand,

package/scaffold/.agent/skills/total-recall/plugins/security/package-lock.json

@@ -1,19 +1,19 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-security",
-      "version": "0.3.7",
+      "version": "0.4.0",
       "license": "MIT",
       "dependencies": {
         "@gregiteen/ssss-cli": "0.14.5"
       },
       "devDependencies": {
         "jsdom": "^26.1.0",
-        "total-recall-brain": "3.44.0"
+        "total-recall-brain": "3.45.0"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5698,9 +5698,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.44.0",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.44.0.tgz",
-      "integrity": "sha512-VNPaIO9zsSwoxAsJ5ByIQBP9zPpLq4RiQO7Vrex4rBOHFQJT50P7utcZiLMSZTyZJU4C/m5uB8qTCSBMp6+l6Q==",
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.45.0.tgz",
+      "integrity": "sha512-HDYfROazZbsLHQsFPnlBcSpe1HL1QEi7JG8x/eNRUI06RxVQsZWl8LwBo2lTWjWRDrKmCy7BUmSXQDuWF3lrEw==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -1,23 +1,22 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "type": "module",
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {
     "test": "node --test test/*.test.mjs",
-    "build:ui": "node scripts/build-ui.mjs",
     "ssss": "ssss"
   },
   "license": "MIT",
   "files": [
     "cli.mjs",
     "plugin.json",
+    "DESIGN.md",
     "README.md",
     "LICENSE",
     "src/",
     "!src/**/*.spec.mjs",
     "skills/",
-    "scripts/",
     "ui/"
   ],
   "publishConfig": {

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -2,15 +2,14 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "security",
   "name": "Security Assessments",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
   "license": "MIT",
   "requires": [{ "id": "auth", "range": ">=1.2.1" }],
   "branding": {
     "name": "Security Assessments",
-    "color": "#f43f5e",
-    "badge": "Security Enclave",
-    "font": "chivo-mono"
+    "color": "#31564b",
+    "badge": "Evidence desk"
   },
   "auth": {
     "plugin": "auth",
@@ -20,29 +19,6 @@
     ],
     "session_verification": true
   },
-  "card_face": {
-    "headline": "Security & Hardening Suite",
-    "quick_actions": [
-      {
-        "subcommand": "machine",
-        "label": "THIS MACHINE"
-      },
-      {
-        "subcommand": "fleet",
-        "label": "MESH FLEET"
-      },
-      {
-        "subcommand": "plugins",
-        "label": "PLUGINS"
-      },
-      {
-        "subcommand": "harden",
-        "label": "HARDENING PLAN"
-      }
-    ],
-    "touch_layout": "comfortable",
-    "interactive": true
-  },
   "ssss_schemas": {
     "categories": [
       {
@@ -171,12 +147,14 @@
       {
         "name": "encrypt",
         "description": "Perform AES-256-GCM authenticated envelope encryption",
-        "effect": "write"
+        "effect": "write",
+        "sensitive_output": true
       },
       {
         "name": "decrypt",
         "description": "Decrypt an AES-256-GCM envelope and display plaintext in an interactive terminal",
         "effect": "read",
+        "sensitive_output": true,
         "output": "text"
       },
       {
@@ -187,17 +165,20 @@
       {
         "name": "token",
         "description": "Inspect or save the auth-managed security master key through stdin",
-        "effect": "write"
+        "effect": "write",
+        "sensitive_output": true
       },
       {
         "name": "challenge",
         "description": "Create, solve or verify authenticated proof-of-work challenges",
-        "effect": "write"
+        "effect": "write",
+        "sensitive_output": true
       },
       {
         "name": "bot-mitigate",
         "description": "Evaluate submission risk with optional provider challenge verification",
-        "effect": "read"
+        "effect": "read",
+        "sensitive_output": true
       },
       {
         "name": "site-audit",
@@ -212,36 +193,22 @@
     ]
   },
   "ui": {
-    "design_tokens": "ui/DESIGN.md",
+    "home": "home",
+    "design_tokens": "DESIGN.md",
     "elements": [
       {
-        "id": "panel",
+        "id": "home",
         "kind": "panel",
-        "tag": "security-panel",
-        "module": "ui/panel.js",
-        "description": "Machine, network and mesh security audit console",
-        "events": [],
+        "tag": "tr-security-home",
+        "module": "ui/home.js",
+        "description": "Security evidence desk with local coverage and deliberate assessments",
         "tokens": [
           "color-text",
           "color-surface",
           "color-border",
           "spacing-md",
           "radius-md"
-        ],
-        "optional_tokens": [],
-        "props": {
-          "view": {
-            "type": "object",
-            "description": "Printed by `total-recall security token status --json`: { present, secretKey }"
-          }
-        }
-      },
-      {
-        "id": "card",
-        "kind": "card",
-        "tag": "tr-security-card",
-        "module": "ui/card.js",
-        "description": "Fortress Card Face"
+        ]
       }
     ]
   },

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/device-evidence.md

@@ -0,0 +1,21 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: device-evidence
+title: Guided and measured device evidence
+description: Separate user-attested review counts from limited authorized Android property readings.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [review phone or tablet security, Chromebook or Windows device checklist, inspect authorized Android properties]
+surfaces: [page, right]
+operations: [device, android]
+data: ["device:/verification", "device:/coverage/reviewed", "device:/coverage/total", "android:/status", "android:/coverage/observed", "android:/coverage/total"]
+---
+<section data-design-component="evidence-note" aria-label="Device evidence modes">
+  <p data-design-component="section-marker">Device scope</p>
+  <h2>Guided review and property reads</h2>
+  <ul>
+    <li>Guided review records fresh observations you made on the named device.</li>
+    <li>Android property checks use an existing authorized connection and cover a limited set of properties.</li>
+  </ul>
+  <p>Use an ordinary label and check outcomes for manual review. Keep PINs, tokens and recovery keys in their owning systems.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/evidence-desk.md

@@ -0,0 +1,18 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: evidence-desk
+title: Security evidence desk
+description: Local runtime platform, assessment modes and bundled Auth session ownership.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [security home, local security tools, security assessment capabilities]
+surfaces: [page]
+panel: home
+operations: [status, platforms]
+data: ["status:/host_platform", "status:/auth_integration", "status:/device_coverage/platforms", "platforms:/platforms"]
+---
+<section data-design-component="evidence-note" aria-label="Security assessment scope">
+  <p data-design-component="section-marker">Scope first</p>
+  <h2>Security evidence desk</h2>
+  <p>Check the current runtime and available assessment modes. Start a machine, mesh, source or device review when you have chosen a target.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/guided-device-review.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: guided-device-review
+title: Record a guided device security review
+description: Open a guided review for a supported platform and capture observed outcomes without disclosing device settings or private identifiers.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [review iPhone security settings, record device security observations, start a guided device check]
+surfaces: [page]
+panel: home
+operations: [device, platforms]
+data: ["device:/verification", "device:/coverage/reviewed", "device:/coverage/total"]
+---
+<section>
+  <h2>Run a guided device review</h2>
+  <p>Open Device evidence in the Evidence desk, choose a platform and load the review with a short label. Record only what you observed, then evaluate the reviewed coverage.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/host-and-network.md

@@ -0,0 +1,21 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: host-and-network
+title: Host and network posture
+description: Observed check states and coverage for the local runtime.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [machine security posture, local network listeners, firewall and disk checks]
+surfaces: [page, right]
+operations: [machine, network]
+data: ["machine:/status", "machine:/coverage/observed", "machine:/coverage/total", "machine:/remediation/changed", "network:/status", "network:/coverage/observed", "network:/coverage/total"]
+---
+<section data-design-component="evidence-note" aria-label="Host and network scope">
+  <p data-design-component="section-marker">Local runtime</p>
+  <h2>Host and network posture</h2>
+  <dl>
+    <dt>Machine</dt><dd>Inspect firewall, disk protection and effective SSH settings.</dd>
+    <dt>Network</dt><dd>Inspect the listeners visible to the current runtime. External reachability requires a separate measurement.</dd>
+  </dl>
+  <p>Read the observed count against the available checks before judging the result.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/https-headers.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: https-headers
+title: HTTPS response evidence
+description: Observed response status, header coverage and middleware snippet installation state.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [audit authorized website headers, verify HTTPS response status, review header middleware coverage]
+surfaces: [page, right]
+operations: [probe, site-audit, site-shield]
+data: ["probe:/status", "probe:/ok", "probe:/latency_ms", "probe:/security_headers", "site-audit:/status", "site-audit:/grade", "site-audit:/score", "site-audit:/checks_count", "site-shield:/installed", "site-shield:/coverage"]
+---
+<section data-design-component="evidence-note" aria-label="HTTPS header evidence">
+  <p data-design-component="section-marker">Website scope</p>
+  <h2>Observe the HTTPS response</h2>
+  <p>For an authorized HTTPS URL, inspect the response and header presence. The site audit grades observed headers. Read the middleware snippet’s coverage before integrating and testing it in your application.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/mesh-coverage.md

@@ -0,0 +1,18 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: mesh-coverage
+title: Mesh assessment coverage
+description: Selected and observed fleet targets with incomplete coverage identified explicitly.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [fleet security audit, security assessment across mesh, find unobserved machines]
+surfaces: [page, right]
+operations: [fleet, secure-all]
+data: ["fleet:/status", "fleet:/coverage/discovered", "fleet:/coverage/selected", "fleet:/coverage/observed", "secure-all:/status", "secure-all:/coverage/selected", "secure-all:/coverage/observed"]
+---
+<section data-design-component="evidence-note" aria-label="Mesh assessment coverage">
+  <p data-design-component="section-marker">Mesh scope</p>
+  <h2>Account for each target</h2>
+  <p>Compare the number of selected machines with the number that returned observations. An offline or unsupported peer keeps the assessment incomplete.</p>
+  <p>Use a discovered machine name to inspect a single authorized target. Fleet-wide assessment returns evidence for review.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/private-security-tools.md

@@ -0,0 +1,16 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: private-security-tools
+title: Private security operations
+description: Terminal workflows for encrypted envelopes, Auth-managed keys, proof challenges and token-bearing risk checks.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [encrypt or decrypt securely, manage security key with Auth, verify proof challenge or bot risk]
+surfaces: [page, right]
+operations: [encrypt, decrypt, token, challenge, bot-mitigate]
+---
+<section data-design-component="evidence-note" aria-label="Private security operations">
+  <p data-design-component="section-marker">Terminal scope</p>
+  <h2>Use the owner CLI for private material</h2>
+  <p>Pass plaintext for envelope encryption through standard input and read decryption results in an interactive terminal. Use bundled Auth for key management. Run proof challenges and provider-token risk checks in the terminal.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/single-origin-header-check.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: single-origin-header-check
+title: Check HTTPS headers for one authorized URL
+description: Check an authorized HTTPS response and distinguish reachable endpoints from responses missing expected headers.
+timestamp: "2026-11-08T23:12:00Z"
+intents: [check response headers for one authorized HTTPS URL, verify expected security headers, diagnose missing response headers]
+surfaces: [page]
+panel: home
+operations: [probe]
+data: ["probe:/status", "probe:/ok", "probe:/latency_ms", "probe:/security_headers"]
+---
+<section>
+  <h2>Inspect one response</h2>
+  <p>Open Website headers and enter the authorized HTTPS URL without credentials or a query. Read the HTTP result and the observed header coverage before deciding what to change.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/source-review.md

@@ -0,0 +1,21 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: source-review
+title: Source and plugin review
+description: Count static findings, inspection scope and installed plugin coverage.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [scan source for security findings, inspect installed plugin security, baseline security review]
+surfaces: [page, right]
+operations: [scan, audit, plugins]
+data: ["scan:/total_findings", "scan:/critical", "scan:/high", "audit:/passed", "audit:/findings_count", "audit:/plugins_audited", "plugins:/status", "plugins:/total_plugins", "plugins:/total_findings"]
+---
+<section data-design-component="evidence-note" aria-label="Source review scope">
+  <p data-design-component="section-marker">Source scope</p>
+  <h2>Review findings by scope</h2>
+  <dl>
+    <dt>Source scan</dt><dd>Review high and critical findings in an authorized directory.</dd>
+    <dt>Plugin review</dt><dd>Compare findings and inspected packages across the installed registry.</dd>
+    <dt>Baseline audit</dt><dd>Read permission checks and source review together.</dd>
+  </dl>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/security/ui/chunks/ssh-permission-plan.md

@@ -0,0 +1,17 @@
+---
+type: ui-chunk:chunk
+plugin: security
+id: ssh-permission-plan
+title: SSH permission plan
+description: Review the observed local hardening plan before deliberately applying verified repairs.
+timestamp: "2026-11-08T09:30:00Z"
+intents: [preview SSH hardening, repair local SSH file permissions, check applied permission changes]
+surfaces: [page, right]
+operations: [harden, machine]
+data: ["harden:/status", "harden:/applied_count", "machine:/remediation/changed"]
+---
+<section data-design-component="evidence-note" aria-label="SSH permission plan">
+  <p data-design-component="section-marker">Local change</p>
+  <h2>Review, then repair</h2>
+  <p>The preview describes the observed state and reports zero applied changes. Confirm the separate repair action to change recognized local SSH file modes and verify the outcome.</p>
+</section>