total-recall-brain 3.45.0 → 3.46.1

package/scaffold/.agent/skills/total-recall/plugins/git/ui/home.js

@@ -0,0 +1,273 @@
+const UPSTREAM = {
+  tracking: 'Tracking local upstream',
+  none: 'No upstream configured',
+  gone: 'Upstream missing',
+  detached: 'Detached HEAD',
+  unborn: 'No commits yet',
+  unknown: 'Upstream unknown',
+  error: 'Upstream check failed'
+};
+const AUDIT_COUNTS = {
+  unpushed: 'unpushedCommits', behind: 'behindCommits', conflicts: 'conflictedFiles',
+  staged: 'stagedFiles', unstaged: 'unstagedFiles', untracked: 'untrackedFiles',
+  dirty: 'totalDirty', stashes: 'stashCount'
+};
+
+function commandError(error) {
+  try {
+    const result = JSON.parse(error.message);
+    if (typeof result.error === 'string') return result.error;
+  } catch {}
+  return error?.message || 'The owner command failed.';
+}
+
+class GitHome extends HTMLElement {
+  connectedCallback() {
+    if (this.shadowRoot) return;
+    const root = this.attachShadow({ mode: 'open' });
+    root.innerHTML = `
+      <style>
+        :host {
+          display:block; padding:var(--spacing-md,16px); color:var(--color-text,CanvasText);
+          background:var(--color-background,Canvas); border:1px solid var(--color-border,currentColor);
+          border-radius:var(--radius-md,6px); font:14px/1.55 var(--typography-body-font-family,system-ui,sans-serif);
+        }
+        * { box-sizing:border-box; min-width:0; }
+        h2,h3,p,dl { margin:0; }
+        h2 { font:600 clamp(1.55rem,5vw,2.1rem)/1.15 var(--typography-heading-font-family,Georgia,serif); }
+        h3 { font-size:1.05rem; }
+        .kicker { color:var(--color-accent,currentColor); letter-spacing:.1em; text-transform:uppercase; }
+        section { margin-top:var(--spacing-md,16px); padding-top:12px; border-top:1px solid var(--color-border,currentColor); }
+        .bar,.actions { display:flex; align-items:center; flex-wrap:wrap; gap:8px 16px; }
+        .bar { justify-content:space-between; }
+        .metrics { display:grid; grid-template-columns:repeat(auto-fit,minmax(min(100%,7rem),1fr)); gap:8px; margin:10px 0; }
+        .metrics div { padding:8px; background:var(--color-surface,Canvas); border-radius:var(--radius-md,6px); }
+        dd { margin:0; font:600 1.05rem var(--typography-mono-font-family,ui-monospace,monospace); font-variant-numeric:tabular-nums; }
+        dt,.note { color:var(--color-muted,currentColor); }
+        #conflicts[data-alert],#unpushed[data-alert],.error { color:var(--color-danger,currentColor); }
+        #last-commit,#audit-time { overflow-wrap:anywhere; }
+        #worktrees { padding:0; list-style:none; margin:8px 0; }
+        #worktrees li {
+          border-bottom:1px solid var(--color-border,currentColor); padding:8px 0;
+          display:flex; flex-wrap:wrap; align-items:center; gap:8px; justify-content:space-between;
+        }
+        #worktrees code { display:block; overflow-wrap:anywhere; }
+        button,input,select {
+          min-height:44px; border:1px solid var(--color-border,currentColor); border-radius:var(--radius-md,6px);
+          padding:6px 10px; font:inherit; color:inherit; background:var(--color-background,Canvas);
+        }
+        button { cursor:pointer; }
+        button:disabled { opacity:.65; cursor:default; }
+        button:focus-visible,input:focus-visible,select:focus-visible {
+          outline:2px solid var(--color-accent,currentColor); outline-offset:3px;
+        }
+        label { display:grid; gap:4px; }
+        .fields { display:grid; grid-template-columns:repeat(auto-fit,minmax(min(100%,10rem),1fr)); gap:8px; margin:8px 0; }
+        fieldset { margin:12px 0 0; padding:12px; background:var(--color-surface,Canvas); border:1px solid var(--color-border,currentColor); }
+        #confirm-text { overflow-wrap:anywhere; margin-bottom:8px; }
+        pre { overflow:auto; max-height:16rem; white-space:pre-wrap; overflow-wrap:anywhere; }
+      </style>
+      <header class="bar">
+        <div><p class="kicker">Git</p><h2>Repository ledger</h2></div>
+        <button type="button" id="refresh">Refresh repository</button>
+      </header>
+      <section aria-labelledby="audit-heading">
+        <h3 id="audit-heading">Working tree audit</h3>
+        <p id="audit-state" role="status">Reading the repository…</p>
+        <dl class="metrics">
+          <div><dt>Unpushed</dt><dd id="unpushed">—</dd></div>
+          <div><dt>Behind</dt><dd id="behind">—</dd></div>
+          <div><dt>Conflicted</dt><dd id="conflicts">—</dd></div>
+          <div><dt>Staged</dt><dd id="staged">—</dd></div>
+          <div><dt>Unstaged</dt><dd id="unstaged">—</dd></div>
+          <div><dt>Untracked</dt><dd id="untracked">—</dd></div>
+          <div><dt>Dirty files</dt><dd id="dirty">—</dd></div>
+          <div><dt>Stashes</dt><dd id="stashes">—</dd></div>
+        </dl>
+        <p id="upstream" class="note"></p>
+        <p id="last-commit"></p>
+        <p id="audit-time" class="note"></p>
+      </section>
+      <section aria-labelledby="worktree-heading">
+        <h3 id="worktree-heading">Registered worktrees</h3>
+        <p id="worktree-state" role="status">Reading worktree registrations…</p>
+        <ul id="worktrees"></ul>
+        <div id="create" hidden>
+          <div class="fields">
+            <label>New worktree path<input id="path" required></label>
+            <label>Base ref<input id="base" placeholder="HEAD"></label>
+          </div>
+          <button type="button" id="plan-create">Review detached worktree</button>
+        </div>
+        <fieldset id="confirmation" hidden>
+          <legend id="confirm-title"></legend>
+          <p id="confirm-text"></p>
+          <div class="actions">
+            <button type="button" id="confirm"></button>
+            <button type="button" id="cancel">Cancel</button>
+          </div>
+        </fieldset>
+        <p id="action-status" role="status"></p>
+      </section>
+      <section id="changes" hidden aria-label="Diff statistics">
+        <button type="button" id="show-diff" aria-expanded="false" aria-controls="diff">Inspect changed files</button>
+        <div id="diff" hidden>
+          <div class="fields">
+            <label>Comparison<select id="diff-mode"><option value="working">Working tree</option><option value="staged">Staged changes</option></select></label>
+            <label>Base ref<input id="diff-base" placeholder="Default comparison"></label>
+          </div>
+          <button type="button" id="read-diff">Read diff stats</button>
+          <p id="diff-status" role="status"></p>
+          <pre id="diff-stat"></pre>
+        </div>
+      </section>`;
+
+    const field = id => root.getElementById(id);
+    const set = (id, text) => { field(id).textContent = text; };
+    const canRun = command => this.host?.operations?.includes(command);
+    const run = async (command, args = []) => {
+      if (!this.host?.run) throw new Error('The repository command runner is unavailable.');
+      return this.host.run(command, args);
+    };
+    let busy = false;
+    let pending;
+
+    field('create').hidden = !canRun('worktree-create');
+    field('changes').hidden = !canRun('diff');
+
+    const setBusy = value => {
+      busy = value;
+      for (const control of root.querySelectorAll('#refresh, #plan-create, #worktrees button')) control.disabled = value;
+    };
+
+    const ask = (command, args, target, base = '') => {
+      if (busy || !canRun(command)) return;
+      const creating = command === 'worktree-create';
+      pending = { command, args, trigger: root.activeElement };
+      set('confirm-title', creating ? 'Create a detached worktree?' : 'Remove this linked worktree?');
+      set('confirm-text', creating ? `${target} from ${base}` : `${target}. Git will refuse removal if it contains local changes.`);
+      set('confirm', creating ? 'Confirm creation' : 'Confirm removal');
+      field('confirmation').hidden = false;
+      field('confirm').focus();
+    };
+
+    const paintAudit = report => {
+      for (const [id, key] of Object.entries(AUDIT_COUNTS)) {
+        const value = report?.[key];
+        set(id, Number.isSafeInteger(value) ? String(value) : '—');
+        field(id).toggleAttribute('data-alert', value > 0);
+      }
+      if (!report) {
+        set('audit-state', 'Repository audit unavailable.');
+        for (const id of ['upstream', 'last-commit', 'audit-time']) set(id, '');
+        return;
+      }
+      const branch = report.branch || UPSTREAM[report.headState] || 'Branch unknown';
+      const state = report.isClean === true ? 'Clean working tree' : report.isClean === false ? 'Changes in working tree' : 'Working tree state unknown';
+      const incomplete = Array.isArray(report.errors) && report.errors.length ? ' Some audit checks failed.' : '';
+      set('audit-state', `${branch} · ${state}.${incomplete}`);
+      const upstream = UPSTREAM[report.upstreamStatus] || 'Upstream unknown';
+      set('upstream', report.upstream ? `${upstream} ${report.upstream}.` : upstream);
+      set('last-commit', report.lastCommit || 'Latest commit unavailable.');
+      set('audit-time', report.timestamp ? `Observed ${report.timestamp}` : '');
+    };
+
+    const paintWorktrees = result => {
+      field('worktrees').replaceChildren();
+      if (!result) { set('worktree-state', 'Worktree inventory unavailable.'); return; }
+      set('worktree-state', `${result.worktrees.length} registered.`);
+      result.worktrees.forEach((tree, index) => {
+        const row = document.createElement('li');
+        const label = document.createElement('div');
+        const name = document.createElement('strong');
+        const path = document.createElement('code');
+        const current = tree.path === result.current;
+        const branch = tree.branch?.replace(/^refs\/heads\//, '') || (tree.detached ? 'Detached' : 'Branch unknown');
+        const markers = [index === 0 && 'Main', current && 'Current', tree.locked && 'Locked', tree.prunable && 'Prunable'].filter(Boolean);
+        name.textContent = [branch, ...markers, tree.head?.slice(0, 12)].filter(Boolean).join(' · ');
+        path.textContent = tree.path;
+        label.append(name, path);
+        row.append(label);
+        if (canRun('worktree-remove') && index > 0 && !current && !tree.locked && !tree.prunable) {
+          const remove = document.createElement('button');
+          remove.type = 'button';
+          remove.textContent = 'Review removal';
+          remove.setAttribute('aria-label', `Review removal of ${tree.path}`);
+          remove.addEventListener('click', () => ask('worktree-remove', ['--', tree.path], tree.path));
+          row.append(remove);
+        }
+        field('worktrees').append(row);
+      });
+    };
+
+    const refresh = async () => {
+      if (busy) return;
+      pending = undefined;
+      field('confirmation').hidden = true;
+      setBusy(true);
+      set('audit-state', 'Reading the repository…');
+      set('worktree-state', 'Reading worktree registrations…');
+      try {
+        await Promise.all([
+          run('audit').then(result => paintAudit(typeof result?.headState === 'string' ? result : null), () => paintAudit(null)),
+          run('worktree-list').then(result => paintWorktrees(result?.ok === true && Array.isArray(result.worktrees) ? result : null), () => paintWorktrees(null))
+        ]);
+      } finally { setBusy(false); }
+    };
+
+    field('refresh').addEventListener('click', () => void refresh());
+    field('plan-create').addEventListener('click', () => {
+      const target = field('path').value;
+      if (!target.trim()) return;
+      const base = field('base').value.trim() || 'HEAD';
+      ask('worktree-create', ['--base', base, '--', target], target, base);
+    });
+    field('cancel').addEventListener('click', () => {
+      const trigger = pending?.trigger;
+      pending = undefined;
+      field('confirmation').hidden = true;
+      trigger?.focus();
+    });
+    field('confirm').addEventListener('click', async () => {
+      if (busy || !pending || !canRun(pending.command)) return;
+      const { command, args } = pending;
+      pending = undefined;
+      field('confirmation').hidden = true;
+      setBusy(true);
+      set('action-status', 'Running the confirmed worktree action…');
+      try {
+        const result = await run(command, args);
+        if (result?.ok !== true) throw new Error('Git did not confirm the requested worktree change.');
+        set('action-status', result.removed ? 'Linked worktree removed.' : 'Detached worktree created.');
+        if (command === 'worktree-create') {
+          field('path').value = '';
+          field('base').value = '';
+        }
+      } catch (error) { set('action-status', commandError(error)); }
+      finally { setBusy(false); await refresh(); field('refresh').focus(); }
+    });
+    field('show-diff').addEventListener('click', event => {
+      field('diff').hidden = !field('diff').hidden;
+      event.currentTarget.setAttribute('aria-expanded', String(!field('diff').hidden));
+    });
+    field('read-diff').addEventListener('click', async () => {
+      if (!canRun('diff') || field('read-diff').disabled) return;
+      const base = field('diff-base').value.trim();
+      const args = [...(field('diff-mode').value === 'staged' ? ['--cached'] : []), ...(base ? ['--base', base] : [])];
+      field('read-diff').disabled = true;
+      set('diff-status', 'Reading diff stats…');
+      set('diff-stat', '');
+      try {
+        const result = await run('diff', args);
+        if (typeof result?.diffStat !== 'string') throw new Error('Diff statistics unavailable.');
+        const outcome = result.diffStat ? 'Comparison complete.' : 'The selected comparison has no changes.';
+        set('diff-status', result.timestamp ? `${outcome} Observed ${result.timestamp}.` : outcome);
+        set('diff-stat', result.diffStat);
+      } catch (error) { set('diff-status', commandError(error)); }
+      finally { field('read-diff').disabled = false; }
+    });
+    void refresh();
+  }
+}
+
+if (!customElements.get('tr-git-home')) customElements.define('tr-git-home', GitHome);

package/scaffold/.agent/skills/total-recall/plugins/mesh/DESIGN.md

@@ -0,0 +1,35 @@
+---
+name: Mesh Network Atlas
+description: A pine and slate field atlas for reading a private fleet.
+colors:
+  background: "#14221e"
+  surface: "#1f322b"
+  text: "#edf8f0"
+  border: "#617e70"
+  muted: "#bfdbcc"
+  accent: "#bbefd2"
+  ok: "#a3e8b9"
+  warn: "#ffdf99"
+  danger: "#ffbcb2"
+typography:
+  body:
+    fontFamily: "system-ui, sans-serif"
+  heading:
+    fontFamily: "Georgia, serif"
+  mono:
+    fontFamily: "ui-monospace, monospace"
+spacing:
+  md: 16px
+rounded:
+  md: 8px
+---
+
+# Mesh Network Atlas
+
+Use the tone of a field atlas. The ink surface holds a persistent control strip and a quiet roster of machines. Use a serif title, plain sans-serif labels, and monospace for a verified address, command, or timing. Use warm warning colors only when an observation needs attention.
+
+In Machines, let the roster and reachability ladder share a row at wide widths and stack in that order in a drawer. The ladder keeps control membership, path, login, and execution distinct. State words accompany any color or border changes. Separate recorded facts and their timestamps from current observations. A sleeping or offline device is different from a peer whose path failed a probe.
+
+Flows, Placement, Boundary, and Join use the same map vocabulary. Give each source its own timestamp and unavailable state. The control strip distinguishes credential presence in Auth from a verified control API. Request fleet execution explicitly. The enrollment workflow hands key issuance to an interactive terminal.
+
+Keep targets at least 44 pixels tall. Preserve keyboard focus on refresh, use a visible outline, and announce read failures through the status region. Layout changes need no animation. The [platform map](docs/MESH_PLATFORM.md) records what the current owner commands can observe.

package/scaffold/.agent/skills/total-recall/plugins/mesh/README.md

@@ -24,25 +24,24 @@ Peers install it with `npx total-recall plugin install peer:<this-node>/mesh`.
 ## Features
 
 - **Identifier**: `mesh`
-- **Version**: 0.1.0
 - **SSSS Category**: `mesh-nodes`
 - **CLI Command**: `npx total-recall mesh`
-- **UI**: `ui/card.js` is the declared card component and uses `ui/DESIGN.md` tokens.
+- **UI**: native Mesh Home, [owner design](DESIGN.md), and SSSS blocks under `ui/chunks/`.
 - **API key**: paste it in the plugin UI (`save-token` event) or pipe it to `npx total-recall mesh token set --stdin`; stored as `HEADSCALE_API_KEY` in the secrets store
 
 ## Install and vendor
 
-Install the full integration with `total-recall plugin install <git URL of this repository>`. The declared standalone artifact is the control and SSH helper capability under `capability/`. The manifest lists its exports and [the capability entry](capability/index.mjs) exposes them. A consumer integration guide and independent proof remain open. The Total Recall card, host routes and auth/grant integration belong to the installed plugin.
+Install the full integration with `total-recall plugin install <git URL of this repository>`. The declared standalone artifact is the control and SSH helper capability under `capability/`. The manifest lists its exports and [the capability entry](capability/index.mjs) exposes them. A consumer integration guide and independent proof remain open. Mesh Home, host routes, and Auth and grant integration belong to the installed plugin.
 
 The [Mesh project tracker](docs/projects/in-progress/MESH_CARD/MESH_CARD_PROJECT_TRACKER.md) separates runtime transport and authorization work from card checks.
 
 ## Mesh screens and integration declarations
 
-The card defines Machines, Flows, Placement, Boundary and Join. Machines separates control membership, path checks, recorded login and actual execution. Hardware cells retain their measurement dates; failed or untested runtime probes remain unknown. Placement filters confirmed capabilities and includes the integration matrix declared in `plugin.json.mesh`.
+Mesh Home defines Machines, Flows, Placement, Boundary, and Join. Machines separates control membership, path checks, recorded login, and actual execution. Hardware cells retain their measurement dates. Failed or untested runtime probes remain unknown. Select **Verify fleet execution** to run `doctor`. Placement filters confirmed capabilities and includes the integration matrix declared in `plugin.json.mesh`.
 
 `total-recall mesh view <machines|flows|placement|boundary|join> --json` reads fixed owner commands. Each source carries its command, attempt time and either data or an explicit error. `mesh.provides` references declared operations/runtime modules; `mesh.integrations` identifies each owner and the meaning of its evidence; `mesh.endpoints` identifies served peer routes. These are declarations, not primitive grants or proof every provider action works. Read-only views never perform enrollment, policy changes, grant edits, deployments or secret transfers.
 
-The dashboard supplies frozen `host.operations`. Read-only cards show CLI handoffs for login administration and re-enrollment. A writable host may expose those declared actions; re-enrollment then requires target-specific confirmation. Enrollment keys never enter the card.
+The dashboard supplies frozen `host.operations`. A read-only Home shows CLI handoffs for login administration and re-enrollment. A writable host can expose those declared actions with target-specific confirmation for re-enrollment. Enrollment key issuance stays in the interactive terminal. `mesh token-status --json` reports credential presence from Auth.
 
 Auth's `host-secrets-store` runtime supplies the single host-store selector for control credentials and mesh-sync authentication. Project `AGENT_DIR`/`TR_BRAIN` cannot divert these reads. Native SSSS audit contention is serialized by the generic host; errors still fail closed. The corresponding source runtime must be installed; missing modules never select a fallback implementation.
 

package/scaffold/.agent/skills/total-recall/plugins/mesh/cli.mjs

@@ -46,15 +46,21 @@ export async function run(argv = []) {
     if (!result.success) process.exitCode = 1;
     return;
   }
+  if (sub === 'token-status' || (sub === 'token' && (!args[1] || args[1] === 'status'))) {
+    if (sub === 'token-status' && args.slice(1).some(arg => arg !== '--json')) {
+      throw new Error('token-status accepts only --json');
+    }
+    const meta = await findHeadscaleKeyMeta(brainDir);
+    const present = Boolean(meta?.set);
+    console.log(JSON.stringify(sub === 'token-status' ? { present } : { present, secretKey: 'HEADSCALE_API_KEY' }));
+    return;
+  }
   if (sub === 'token') {
     if (args[1] === 'set' && args.includes('--stdin')) {
       const chunks = []; for await (const chunk of process.stdin) chunks.push(chunk);
       const config = JSON.parse(process.env.TR_PLUGIN_CONFIG || '{}');
       const at = args.indexOf('--url'); if (at >= 0) config.controlUrl = args[at + 1];
       console.log(JSON.stringify(await saveCredential({ key: 'HEADSCALE_API_KEY', value: Buffer.concat(chunks).toString('utf8').trim(), configuration: config, brainDir: process.env.TR_SECRETS_BRAIN || brainDir })));
-    } else if (!args[1] || args[1] === 'status') {
-      const meta = await findHeadscaleKeyMeta(brainDir);
-      console.log(JSON.stringify({ present: !!meta?.set, secretKey: 'HEADSCALE_API_KEY' }));
     } else throw new Error('token <status|set --stdin [--url URL]>');
     return;
   }

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.10",
+  "version": "0.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tr-plugin-mesh",
-      "version": "0.2.10",
+      "version": "0.3.0",
       "license": "MIT",
       "dependencies": {
         "@gregiteen/ssss-cli": "0.14.5",
@@ -15,7 +15,7 @@
       "devDependencies": {
         "jsdom": "^29.1.1",
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.44.0",
+        "total-recall-brain": "3.45.0",
         "vitest": "^4.1.12"
       }
     },
@@ -7177,9 +7177,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.44.0",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.44.0.tgz",
-      "integrity": "sha512-VNPaIO9zsSwoxAsJ5ByIQBP9zPpLq4RiQO7Vrex4rBOHFQJT50P7utcZiLMSZTyZJU4C/m5uB8qTCSBMp6+l6Q==",
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.45.0.tgz",
+      "integrity": "sha512-HDYfROazZbsLHQsFPnlBcSpe1HL1QEi7JG8x/eNRUI06RxVQsZWl8LwBo2lTWjWRDrKmCy7BUmSXQDuWF3lrEw==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.2.10",
+  "version": "0.3.0",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
@@ -15,6 +15,7 @@
   "files": [
     "cli.mjs",
     "plugin.json",
+    "DESIGN.md",
     "README.md",
     "LICENSE",
     "ui/",

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.2.10",
+  "version": "0.3.0",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
   "requires": [
@@ -22,34 +22,6 @@
       "url": "https://headscale.net"
     }
   },
-  "card_face": {
-    "skin": "mesh-telemetry",
-    "theme": "vibrant",
-    "headline": "Mesh Control Deck",
-    "primary_color": "#2563eb",
-    "secondary_color": "#1e3a8a",
-    "accent_color": "#3b82f6",
-    "quick_actions": [
-      {
-        "subcommand": "status",
-        "label": "STATUS"
-      },
-      {
-        "subcommand": "nodes",
-        "label": "NODES"
-      },
-      {
-        "subcommand": "doctor",
-        "label": "DOCTOR"
-      },
-      {
-        "subcommand": "leader",
-        "label": "LEADER"
-      }
-    ],
-    "touch_layout": "comfortable",
-    "interactive": true
-  },
   "ssss_schemas": {
     "categories": [
       {
@@ -222,7 +194,8 @@
         "name": "preauthkey",
         "description": "Issue a secret enrollment key to an interactive terminal",
         "effect": "write",
-        "output": "text"
+        "output": "text",
+        "sensitive_output": true
       },
       {
         "name": "policy",
@@ -234,6 +207,12 @@
         "description": "Mesh probe operation",
         "effect": "read"
       },
+      {
+        "name": "token-status",
+        "description": "Check whether Auth has a saved mesh credential",
+        "effect": "read",
+        "output": "json"
+      },
       {
         "name": "token",
         "description": "Mesh token operation",
@@ -262,14 +241,40 @@
     ]
   },
   "ui": {
-    "design_tokens": "ui/DESIGN.md",
+    "design_tokens": "DESIGN.md",
+    "home": "network",
     "elements": [
+      {
+        "id": "network",
+        "kind": "panel",
+        "tag": "mesh-home",
+        "module": "ui/home.js",
+        "description": "Mesh network atlas",
+        "tokens": [
+          "color-background",
+          "color-surface",
+          "color-text",
+          "color-border",
+          "spacing-md",
+          "radius-md"
+        ],
+        "optional_tokens": [
+          "color-muted",
+          "color-accent",
+          "color-ok",
+          "color-warn",
+          "color-danger",
+          "typography-body-font-family",
+          "typography-heading-font-family",
+          "typography-mono-font-family"
+        ]
+      },
       {
         "id": "panel",
         "kind": "panel",
         "tag": "mesh-panel",
         "module": "ui/panel.js",
-        "description": "Mesh panel",
+        "description": "Mesh credential setup through Auth",
         "events": [
           "save-token"
         ],
@@ -287,13 +292,6 @@
             "description": "Printed by `total-recall mesh token status --json`: { present, secretKey }"
           }
         }
-      },
-      {
-        "id": "card",
-        "kind": "card",
-        "tag": "tr-mesh-card",
-        "module": "ui/card.js",
-        "description": "Meshlink Card Face"
       }
     ]
   },

package/scaffold/.agent/skills/total-recall/plugins/mesh/src/cli/mesh.mjs

@@ -50,6 +50,8 @@ function printHelp() {
     view <screen>          Read Machines, Flows, Placement, Boundary or Join sources (--json)
     doctor                 Probe reachability & compute capabilities across all nodes
     nodes                  List mesh nodes and how to reach each one
+    token-status           Read whether Auth has a saved mesh credential (--json)
+    token status           Show credential presence and its Auth binding
     ssh <node> [cmd…]      Open a session using the node's recorded access
     exec <node> <cmd…>     Execute a command on a node non-interactively (--json)
     leader [--json]        Show the elected leader and its server port
@@ -226,7 +228,7 @@ export default async function meshCli(argv = []) {
           error: null
         };
         nodeInfo.tested_runtimes = ['ollama', 'docker', 'node', 'git'];
-        nodeInfo.tested_harnesses = ['agy', 'claude', 'codex', 'gemini'];
+        nodeInfo.tested_harnesses = ['agy', 'claude', 'codex'];
 
         if (node.self) {
           try {
@@ -239,7 +241,7 @@ export default async function meshCli(argv = []) {
           nodeInfo.reachable = true;
         } else if (resolved.complete) {
           try {
-            const probeCmd = 'echo "agy=$(which agy 2>/dev/null) claude=$(which claude 2>/dev/null) codex=$(which codex 2>/dev/null) gemini=$(which gemini 2>/dev/null) ollama=$(which ollama 2>/dev/null) docker=$(which docker 2>/dev/null) node=$(which node 2>/dev/null) git=$(which git 2>/dev/null)"';
+            const probeCmd = 'echo "agy=$(which agy 2>/dev/null) claude=$(which claude 2>/dev/null) codex=$(which codex 2>/dev/null) ollama=$(which ollama 2>/dev/null) docker=$(which docker 2>/dev/null) node=$(which node 2>/dev/null) git=$(which git 2>/dev/null)"';
             const { execMeshCommand } = await import('../core/mesh.mjs');
             // Cloud peers routinely need several seconds; a 4 s budget reported
             // reachable machines as down.
@@ -250,7 +252,7 @@ export default async function meshCli(argv = []) {
               for (const part of parts) {
                 const [k, v] = part.split('=');
                 if (v && v.trim()) {
-                  if (['agy', 'claude', 'codex', 'gemini'].includes(k)) {
+                  if (nodeInfo.tested_harnesses.includes(k)) {
                     nodeInfo.harnesses.push(k);
                   } else {
                     nodeInfo.runtimes.push(k);

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/active-device-dispatch.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Mesh dispatch receipt
+description: Send a command to an explicit or freshly active device and inspect whether dispatch succeeded.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: active-device-dispatch
+intents: [send command to active device, dispatch mesh task, inspect dispatch result, run on selected machine]
+surfaces: [page]
+operations: [dispatch]
+data: ["dispatch:/dispatched", "dispatch:/is_local", "dispatch:/timestamp"]
+---
+
+<style>
+  .mesh-dispatch { padding:var(--spacing-md); border-inline-start:3px solid var(--color-accent); background:var(--color-surface); }
+  .mesh-dispatch h2 { margin-top:0; }
+  .mesh-dispatch strong { color:var(--color-accent); }
+</style>
+<section class="mesh-dispatch">
+  <h2>Read where dispatch ran</h2>
+  <p>Supply an explicit target or let Mesh resolve a device from fresh presence. The receipt records whether the command dispatched and whether it ran <strong>locally or on a peer</strong>.</p>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/control-probe.md

@@ -0,0 +1,25 @@
+---
+type: ui-chunk:chunk
+title: Mesh control verification
+description: Check the control API and local mesh network as independent observations.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: control-probe
+intents: [verify mesh control API, probe control server, troubleshoot Headscale API, check control plane health]
+surfaces: [page, right]
+operations: [probe]
+data: ["probe:/control/verified", "probe:/control/state", "probe:/network_available"]
+---
+
+<style>
+  .mesh-probe { padding:var(--spacing-md); background:var(--color-surface); border-inline-start:3px solid var(--color-accent); }
+  .mesh-probe h2 { margin-top:0; }
+  .mesh-probe li + li { margin-top:.4em; }
+</style>
+<section class="mesh-probe">
+  <h2>Test the control API</h2>
+  <ul>
+    <li>Read whether the authenticated control API was verified.</li>
+    <li>Check local mesh network availability separately.</li>
+  </ul>
+</section>

package/scaffold/.agent/skills/total-recall/plugins/mesh/ui/chunks/control-server.md

@@ -0,0 +1,22 @@
+---
+type: ui-chunk:chunk
+title: Recorded mesh control server
+description: Check whether the local owner has a recorded provisioning target for the control server.
+timestamp: "2026-11-08T09:10:00Z"
+plugin: mesh
+id: control-server
+intents: [inspect mesh server provisioning, manage Headscale control server, check recorded server target, mesh server update]
+surfaces: [page]
+operations: [server]
+data: ["server:/provisioned"]
+---
+
+<style>
+  .mesh-server { padding:var(--spacing-md); background:var(--color-surface); border:1px solid var(--color-border); }
+  .mesh-server h2 { margin-top:0; }
+  .mesh-server code { color:var(--color-accent); }
+</style>
+<section class="mesh-server">
+  <h2>Inspect the provisioning record</h2>
+  <p>Run <code>server status</code> for the recorded control-server target. Use the control probe to verify the service that is answering now.</p>
+</section>