total-recall-brain 3.47.0 → 3.47.2

package/scaffold/.agent/skills/total-recall/plugins/openwiki/src/refresh.mjs

@@ -165,7 +165,7 @@ export function registryPath(home = os.homedir()) {
  * Read the registered projects. The registry is the same source the updater
  * uses to reach every consumer, so fleet scope is defined in exactly one place.
  */
-export function readProjects({ registry = registryPath() } = {}) {
+export function readProjects({ registry = registryPath(), exclude = null } = {}) {
   let raw;
   try {
     raw = fs.readFileSync(registry, 'utf8');
@@ -188,14 +188,18 @@ export function readProjects({ registry = registryPath() } = {}) {
   }
   // One project per root: the registry has historically held duplicates.
   const seen = new Set();
+  const excluded = new Set((exclude ?? loadOpenWikiConfig().exclude ?? []).map((root) => path.resolve(root)));
   return projects.filter((p) => {
     const key = path.resolve(p.root);
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
-  });
+  }).map((p) => ({ ...p, excluded: excluded.has(path.resolve(p.root)) }));
 }
 
+export const EXCLUDED = "excluded from OpenWiki (total-recall openwiki exclude --remove <name> to include it)";
+export const NO_WIKI = "no finished wiki; the nightly refresh only updates existing wikis. Create one with: total-recall openwiki generate --repo <name>";
+
 /** Does this project carry generated Markdown pages? */
 export function hasWiki(root) {
   const dir = path.join(root, 'openwiki');
@@ -608,17 +612,21 @@ export function lastAttemptStart(root, generatedAt = null) {
  * runner killed the same generations every 30 minutes and they never finished.
  */
 export function isDue(project, { lockMs = DEFAULT_LOCK_MS, now = Date.now(), git = gitRun, force = false } = {}) {
+  if (project.excluded) return { due: false, excluded: true, reason: EXCLUDED };
   if (!isGitRepo(project.root, { git })) {
     return { due: false, skipped: true, reason: 'not a git repository' };
   }
   const state = staleness(project.root, { git });
-  if (force) return { due: true, uninitialized: !hasWiki(project.root), ...state };
+  // Creating a wiki is the most expensive run there is, and a registered
+  // repository may be someone else's code. Only an explicit `openwiki generate`
+  // creates one or finishes an interrupted creation; refresh, --force included,
+  // only updates finished wikis.
+  if (generationMode(project.root) === 'init') {
+    return { due: false, uninitialized: true, ...state, reason: NO_WIKI };
+  }
+  if (force) return { due: true, uninitialized: false, ...state };
   const last = lastAttemptStart(project.root, state.generatedAt);
   const retryAt = Number.isFinite(last) && now - last < lockMs ? new Date(last + lockMs).toISOString() : null;
-  if (!hasWiki(project.root)) {
-    if (retryAt) return { due: false, held: true, uninitialized: true, reason: `initialization attempted recently; next attempt after ${retryAt}`, ...state };
-    return { due: true, uninitialized: true, reason: 'uninitialized (missing openwiki/ pages)', ...state };
-  }
   if (!state.stale) return { due: false, ...state };
   const incomplete = state.generatedStatus === 'interrupted' || stillGenerating(project.root);
   if (retryAt) {

package/scaffold/.agent/skills/total-recall/plugins/openwiki/src/upstream-watcher.mjs

@@ -10,7 +10,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { compareSemanticVersions, formatPropagationReceipt } from '../capability/index.mjs';
-import { CREDIT_REFUSAL, hasWiki, readProjects, refreshProject, resolveKey } from './refresh.mjs';
+import { CREDIT_REFUSAL, generationMode, readProjects, refreshProject, resolveKey } from './refresh.mjs';
 
 export const UPSTREAM_NPM_URL = 'https://registry.npmjs.org/openwiki/latest';
 export const UPSTREAM_GITHUB_URL = 'https://api.github.com/repos/langchain-ai/openwiki/releases/latest';
@@ -338,8 +338,9 @@ export async function propagateUpdates({
     }
   }
 
-  // Filter to repositories with existing openwiki directories
-  const eligible = projects.filter(p => hasWiki(p.root));
+  // Only finished wikis outside the exclude list: propagation updates pages,
+  // it never creates a wiki or documents an excluded clone, fork or backup.
+  const eligible = projects.filter(p => !p.excluded && generationMode(p.root) === 'update');
   if (eligible.length === 0) {
     return {
       ok: true,

package/scaffold/.agent/skills/total-recall/plugins/security/package-lock.json

@@ -13,7 +13,7 @@
       },
       "devDependencies": {
         "jsdom": "^26.1.0",
-        "total-recall-brain": "3.45.0"
+        "total-recall-brain": "3.47.0"
       }
     },
     "node_modules/@alcalzone/ansi-tokenize": {
@@ -5698,9 +5698,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.45.0",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.45.0.tgz",
-      "integrity": "sha512-HDYfROazZbsLHQsFPnlBcSpe1HL1QEi7JG8x/eNRUI06RxVQsZWl8LwBo2lTWjWRDrKmCy7BUmSXQDuWF3lrEw==",
+      "version": "3.47.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.47.0.tgz",
+      "integrity": "sha512-S4UIdbbTyxw7C4+rix+7oHMm/6gYkcxwNBcP6kRDySX40p5IgqVTKgHk1n8rmaKiyYFoIX/HZHlHSjNrHgn0Gw==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/security/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-security",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Standalone security suite for Total Recall: static analysis, file and permission hardening schemes, AES-256-GCM encryption tools, and egress audit controls",
   "scripts": {

package/scaffold/.agent/skills/total-recall/plugins/security/plugin.json

@@ -2,10 +2,16 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "security",
   "name": "Security Assessments",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Machine and device security assessments for macOS, Linux, Windows, Android, Chromebook, iPhone and iPad, with explicit measured and manual coverage.",
   "license": "MIT",
-  "requires": [{ "id": "auth", "range": ">=1.2.1" }],
+  "reuse": {
+    "commands": [
+      "total-recall auth secret",
+      "total-recall ssss status"
+    ],
+    "owned": "Machine and device security assessments, header probes, and security evidence audits across platforms."
+  },
   "branding": {
     "name": "Security Assessments",
     "color": "#31564b",
@@ -66,10 +72,21 @@
     }
   ],
   "gate": {
-    "tasks": ["Audit a machine, network or the fleet", "Scan installed plugins or a source folder", "Harden SSH permissions", "Audit or protect a website you are authorized to test"],
+    "tasks": [
+      "Audit a machine, network or the fleet",
+      "Scan installed plugins or a source folder",
+      "Harden SSH permissions",
+      "Audit or protect a website you are authorized to test"
+    ],
     "owned_commands": [
-      { "pattern": "nmap\\s", "use": "total-recall security network --json" },
-      { "pattern": "lynis\\s", "use": "total-recall security machine --json" }
+      {
+        "pattern": "nmap\\s",
+        "use": "total-recall security network --json"
+      },
+      {
+        "pattern": "lynis\\s",
+        "use": "total-recall security machine --json"
+      }
     ]
   },
   "cli": {

package/scaffold/.agent/skills/total-recall/plugins/ssss/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-ssss",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "type": "module",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
@@ -12,7 +12,8 @@
     "scripts/",
     "cli.mjs",
     "DESIGN.md",
-    "plugin.json"
+    "plugin.json",
+    "skills/"
   ],
   "scripts": {
     "test": "node scripts/refresh-scaffold.mjs --check && node --test test/*.test.mjs",

package/scaffold/.agent/skills/total-recall/plugins/ssss/plugin.json

@@ -2,15 +2,29 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "ssss",
   "name": "SSSS",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations.",
   "license": "MIT",
-  "use_cases": ["software-development", "state-conformance"],
-  "distribution": { "tier": "core", "license": "open" },
+  "use_cases": [
+    "software-development",
+    "state-conformance"
+  ],
+  "distribution": {
+    "tier": "core",
+    "license": "open"
+  },
   "gate": {
-    "tasks": ["Validate SSSS documents and registries", "Scaffold a standalone SSSS project", "Run the SSSS conformance suites", "Restore a missing SSSS skill or scaffold"],
+    "tasks": [
+      "Validate SSSS documents and registries",
+      "Scaffold a standalone SSSS project",
+      "Run the SSSS conformance suites",
+      "Restore a missing SSSS skill or scaffold"
+    ],
     "owned_commands": [
-      { "pattern": "npx\\s+(--yes\\s+)?@gregiteen/ssss-cli\\s+new\\b", "use": "total-recall ssss scaffold --directory <folder> --json" }
+      {
+        "pattern": "npx\\s+(--yes\\s+)?@gregiteen/ssss-cli\\s+new\\b",
+        "use": "total-recall ssss scaffold --directory <folder> --json"
+      }
     ]
   },
   "cli": {
@@ -19,65 +33,183 @@
     "handler": "cli.mjs",
     "subcommands": [
       {
-        "name": "status", "description": "Inspect the installed engine, skill and full scaffold",
-        "effect": "read", "output": "json",
-        "args": [{"name":"scope","flag":"--scope","label":"Brain scope","type":"choice","options":["auto","project","global"]}]
+        "name": "status",
+        "description": "Inspect the installed engine, skill and full scaffold",
+        "effect": "read",
+        "output": "json",
+        "args": [
+          {
+            "name": "scope",
+            "flag": "--scope",
+            "label": "Brain scope",
+            "type": "choice",
+            "options": [
+              "auto",
+              "project",
+              "global"
+            ]
+          }
+        ]
       },
       {
-        "name": "repair", "description": "Restore missing or previously repinned managed SSSS installation files",
-        "effect": "write", "output": "json",
-        "args": [{"name":"scope","flag":"--scope","label":"Brain scope","type":"choice","options":["auto","project","global"]}]
+        "name": "repair",
+        "description": "Restore missing or previously repinned managed SSSS installation files",
+        "effect": "write",
+        "output": "json",
+        "args": [
+          {
+            "name": "scope",
+            "flag": "--scope",
+            "label": "Brain scope",
+            "type": "choice",
+            "options": [
+              "auto",
+              "project",
+              "global"
+            ]
+          }
+        ]
       },
       {
-        "name": "validate", "description": "Validate a document against the effective SSSS registry",
-        "effect": "read", "output": "json",
+        "name": "validate",
+        "description": "Validate a document against the effective SSSS registry",
+        "effect": "read",
+        "output": "json",
         "args": [
-          {"name":"file","flag":"--file","label":"Document path","type":"string","required":true},
-          {"name":"extension","flag":"--extension","label":"Extension registry path","type":"string"}
+          {
+            "name": "file",
+            "flag": "--file",
+            "label": "Document path",
+            "type": "string",
+            "required": true
+          },
+          {
+            "name": "extension",
+            "flag": "--extension",
+            "label": "Extension registry path",
+            "type": "string"
+          }
         ]
       },
       {
-        "name": "registry", "description": "Verify the effective registry against a lock file",
-        "effect": "read", "output": "json",
+        "name": "registry",
+        "description": "Verify the effective registry against a lock file",
+        "effect": "read",
+        "output": "json",
         "args": [
-          {"name":"lock","flag":"--lock","label":"Registry lock path","type":"string","required":true},
-          {"name":"extension","flag":"--extension","label":"Extension registry path","type":"string"}
+          {
+            "name": "lock",
+            "flag": "--lock",
+            "label": "Registry lock path",
+            "type": "string",
+            "required": true
+          },
+          {
+            "name": "extension",
+            "flag": "--extension",
+            "label": "Extension registry path",
+            "type": "string"
+          }
         ]
       },
       {
-        "name": "scaffold", "description": "Create a complete canonical SSSS project",
-        "effect": "write", "output": "json",
+        "name": "scaffold",
+        "description": "Create a complete canonical SSSS project",
+        "effect": "write",
+        "output": "json",
         "args": [
-          {"name":"directory","flag":"--directory","label":"New project directory","type":"string","required":true},
-          {"name":"extension","flag":"--extension","label":"Extension registry name","type":"string"},
-          {"name":"withTotalRecall","flag":"--with-total-recall","label":"Include Total Recall wiring","type":"boolean"}
+          {
+            "name": "directory",
+            "flag": "--directory",
+            "label": "New project directory",
+            "type": "string",
+            "required": true
+          },
+          {
+            "name": "extension",
+            "flag": "--extension",
+            "label": "Extension registry name",
+            "type": "string"
+          },
+          {
+            "name": "withTotalRecall",
+            "flag": "--with-total-recall",
+            "label": "Include Total Recall wiring",
+            "type": "boolean"
+          }
         ]
       },
       {
-        "name": "conformance", "description": "Run the canonical reference engine conformance suite",
-        "effect": "read", "output": "json"
+        "name": "conformance",
+        "description": "Run the canonical reference engine conformance suite",
+        "effect": "read",
+        "output": "json"
       }
     ]
   },
-  "status": { "command": "status", "refresh_seconds": 60 },
-  "runtime": { "modules": {
-    "installation": "runtime/installation.cjs",
-    "project-scaffold": "runtime/project-scaffold.mjs"
-  } },
+  "status": {
+    "command": "status",
+    "refresh_seconds": 60
+  },
+  "runtime": {
+    "modules": {
+      "installation": "runtime/installation.cjs",
+      "project-scaffold": "runtime/project-scaffold.mjs"
+    }
+  },
   "capability": {
     "entry": "capability/index.mjs",
-    "exports": ["canonicalToolchain", "scaffoldProject", "validateDocument", "verifyRegistry", "runConformance"]
+    "exports": [
+      "canonicalToolchain",
+      "scaffoldProject",
+      "validateDocument",
+      "verifyRegistry",
+      "runConformance"
+    ]
   },
   "branding": {
-    "name": "SSSS", "color": "#b98439", "accent": "#f4c97a", "font": "ibm-plex",
-    "density": "compact", "radius": "sm", "header": "ledger-rule", "logo": "ui/logo.svg"
+    "name": "SSSS",
+    "color": "#b98439",
+    "accent": "#f4c97a",
+    "font": "ibm-plex",
+    "density": "compact",
+    "radius": "sm",
+    "header": "ledger-rule",
+    "logo": "ui/logo.svg"
+  },
+  "auth": {
+    "plugin": "auth",
+    "methods": [
+      "passkey",
+      "google-oauth2"
+    ],
+    "session_verification": true
   },
-  "auth": { "plugin": "auth", "methods": ["passkey", "google-oauth2"], "session_verification": true },
   "ui": {
     "design_tokens": "DESIGN.md",
     "home": "home",
     "elements": [
-      {"id":"home","kind":"panel","tag":"tr-ssss-home","module":"ui/home.js","description":"SSSS installation ledger with document, registry, scaffold and conformance checks"}
+      {
+        "id": "home",
+        "kind": "panel",
+        "tag": "tr-ssss-home",
+        "module": "ui/home.js",
+        "description": "SSSS installation ledger with document, registry, scaffold and conformance checks"
+      }
     ]
-  }
+  },
+  "reuse": {
+    "commands": [
+      "total-recall auth session",
+      "total-recall decision status"
+    ],
+    "owned": "SSSS canonical toolchain, schema/document validation, registry verification, project scaffolding, and conformance checks."
+  },
+  "skills": [
+    {
+      "id": "ssss",
+      "path": "./skills/ssss/SKILL.md",
+      "description": "Canonical SSSS distribution, scaffolding and validation for Total Recall installations."
+    }
+  ]
 }

package/scaffold/.agent/skills/total-recall/plugins/ssss/skills/ssss/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: ssss
+description: "Canonical SSSS distribution, scaffolding and validation for Total Recall installations."
+version: 0.2.0
+repo_scoped: false
+---
+
+# SSSS
+
+Canonical SSSS distribution, scaffolding and validation for Total Recall installations.
+
+## When to Use
+
+Use the `ssss` Total Recall plugin (`total-recall ssss`) instead of ad-hoc scripts or raw commands whenever working on ssss tasks.
+
+## Commands
+
+```bash
+total-recall ssss --help
+total-recall ssss status  # Inspect the installed engine, skill and full scaffold
+total-recall ssss repair  # Restore missing or previously repinned managed SSSS installation files
+total-recall ssss validate  # Validate a document against the effective SSSS registry
+total-recall ssss registry  # Verify the effective registry against a lock file
+total-recall ssss scaffold  # Create a complete canonical SSSS project
+total-recall ssss conformance  # Run the canonical reference engine conformance suite
+```
+
+## Owned Raw Commands
+
+This plugin owns: `npx\s+(--yes\s+)?@gregiteen/ssss-cli\s+new\b`.

package/src/cli/plugin/create.mjs

@@ -274,7 +274,7 @@ export async function createPlugin(args = []) {
     };
   }
 
-  const withSkill = args.includes("--with-skill") || args.includes("--capability") || Boolean(fromSkillPath);
+  const withSkill = !args.includes("--no-skill");
   const isCapability = args.includes("--capability") || Boolean(fromSkillPath);
 
   if (withCli || isCapability || withTask) {
@@ -386,6 +386,7 @@ export default run;
 name: ${id}
 description: "${pluginDesc}"
 version: 0.1.0
+repo_scoped: false
 ---
 
 # ${pluginName}

package/src/cli/plugin/monetization.mjs

@@ -59,43 +59,50 @@ export async function managePluginLicense(args = []) {
     const TR = process.env.TOTAL_RECALL_BIN || 'total-recall';
     const amount = mon.price_cents || 1000;
     const currency = (mon.currency || 'USD').toLowerCase();
-    const successUrl = 'https://total-recall.ai/plugins/success';
-    const cancelUrl = 'https://total-recall.ai/plugins/cancel';
-    try {
-      const script = TR.endsWith('.mjs');
-      const stripeRes = spawnSync(script ? process.execPath : TR, [
-        ...(script ? [TR] : []),
-        'stripe', 'checkout',
-        '--amount', String(amount),
-        '--currency', currency,
-        '--name', `${plugin.manifest.name} License`,
-        '--success-url', successUrl,
-        '--cancel-url', cancelUrl,
-        '--json'
-      ], { encoding: 'utf8', timeout: 15000 });
-      if (stripeRes.status === 0 && stripeRes.stdout) {
-        const parsed = JSON.parse(stripeRes.stdout);
-        const url = parsed.url || parsed.checkout_url || parsed.data?.url;
-        if (url) {
-          if (json) {
-            console.log(JSON.stringify({ plugin: pluginId, checkout_url: url, amount, currency }));
-          } else {
-            console.log(`\n💳 Stripe Checkout Session Created:`);
-            console.log(`   Plugin:       ${plugin.manifest.name}`);
-            console.log(`   Amount:       $${(amount / 100).toFixed(2)} ${currency.toUpperCase()}`);
-            console.log(`   Checkout URL: ${url}\n`);
-          }
-          return;
+    const baseUrl = (process.env.TR_STORE_BASE_URL || 'http://127.0.0.1:3000').replace(/\/+$/, '');
+    const sIdx = args.indexOf('--success-url');
+    const cIdx = args.indexOf('--cancel-url');
+    const successUrl = (sIdx !== -1 && args[sIdx + 1]) || `${baseUrl}/plugins/success?plugin=${encodeURIComponent(pluginId)}`;
+    const cancelUrl = (cIdx !== -1 && args[cIdx + 1]) || `${baseUrl}/plugins/cancel?plugin=${encodeURIComponent(pluginId)}`;
+    const stripeArgs = [
+      'stripe', 'checkout',
+      '--amount', String(amount),
+      '--currency', currency,
+      '--name', `${plugin.manifest.name} License`,
+      '--success-url', successUrl,
+      '--cancel-url', cancelUrl,
+      '--json'
+    ];
+    if (mon.recipient?.account_id) stripeArgs.push('--account', mon.recipient.account_id);
+    const script = TR.endsWith('.mjs');
+    const stripeRes = spawnSync(script ? process.execPath : TR, [
+      ...(script ? [TR] : []),
+      ...stripeArgs
+    ], { encoding: 'utf8', timeout: 15000 });
+    if (stripeRes.status === 0 && stripeRes.stdout) {
+      let parsed = {};
+      try { parsed = JSON.parse(stripeRes.stdout); } catch {}
+      const url = parsed.url || parsed.checkout_url || parsed.data?.url;
+      if (url) {
+        if (json) {
+          console.log(JSON.stringify({ plugin: pluginId, checkout_url: url, session_id: parsed.id || parsed.session_id || null, amount, currency }));
+        } else {
+          console.log(`\n💳 Stripe Checkout Session Created:`);
+          console.log(`   Plugin:       ${plugin.manifest.name}`);
+          console.log(`   Amount:       $${(amount / 100).toFixed(2)} ${currency.toUpperCase()}`);
+          console.log(`   Checkout URL: ${url}\n`);
         }
+        return;
       }
-    } catch {}
+    }
+    const errDetail = (stripeRes.stderr || stripeRes.stdout || stripeRes.error?.message || 'Stripe checkout failed').trim();
     if (json) {
-      console.log(JSON.stringify({ plugin: pluginId, price_formatted: mon.priceFormatted, requires_purchase: true }));
+      console.log(JSON.stringify({ ok: false, plugin: pluginId, error: errDetail, price_formatted: mon.priceFormatted, requires_purchase: true }));
     } else {
-      console.log(`\n💳 Commercial License Purchase:`);
-      console.log(`   Plugin: ${plugin.manifest.name} (${mon.priceFormatted})`);
-      console.log(`   Activate license after purchase: total-recall plugin license ${pluginId} activate --stdin\n`);
+      console.error(`❌ Stripe checkout failed for '${pluginId}': ${errDetail}`);
+      console.error(`   Activate an existing license with: total-recall plugin license ${pluginId} activate --stdin`);
     }
+    process.exitCode = 1;
     return;
   }
 
@@ -105,6 +112,33 @@ export async function managePluginLicense(args = []) {
       else console.log(`ℹ️ Plugin '${pluginId}' does not require a commercial license (${mon.model}).`);
       return;
     }
+    const sessIdx = args.indexOf('--session-id');
+    const sessionId = sessIdx !== -1 ? args[sessIdx + 1] : null;
+    if (sessionId) {
+      const TR = process.env.TOTAL_RECALL_BIN || 'total-recall';
+      const script = TR.endsWith('.mjs');
+      const vRes = spawnSync(script ? process.execPath : TR, [
+        ...(script ? [TR] : []),
+        'stripe', 'verify-entitlement',
+        '--session-id', sessionId,
+        '--consumer', pluginId,
+        '--amount', String(mon.price_cents || 1000),
+        '--currency', (mon.currency || 'USD').toLowerCase(),
+        '--json'
+      ], { encoding: 'utf8', timeout: 15000 });
+      let vParsed = null;
+      try { vParsed = vRes.stdout ? JSON.parse(vRes.stdout) : null; } catch {}
+      if (vRes.status !== 0 || !vParsed?.entitled) {
+        const msg = vParsed?.error || (vRes.stderr || vRes.stdout || 'Stripe entitlement verification failed').trim();
+        if (json) console.log(JSON.stringify({ verified: false, plugin: pluginId, session_id: sessionId, error: msg }));
+        else console.error(`❌ Stripe entitlement check failed for '${pluginId}': ${msg}`);
+        process.exitCode = 1;
+        return;
+      }
+      if (json) console.log(JSON.stringify({ verified: true, plugin: pluginId, session_id: sessionId, status: 'active', entitlement: vParsed }));
+      else console.log(`✅ Stripe entitlement verified active for '${pluginId}' (session ${sessionId}).`);
+      return;
+    }
     const secretKey = mon.license_key_secret;
     const currentKey = secretKey ? await getSecret(defaultBrainDir(), secretKey, { actor: 'plugin-license' }) : null;
     if (!currentKey?.found || !currentKey?.value) {

package/src/cli/plugin/search.mjs

@@ -2,17 +2,18 @@ import { listAvailableBundled } from '../../core/plugin-store.mjs';
 
 function parseArgs(args) {
   const isJson = args.includes('--json');
+  const isStore = args.includes('--store');
   let useCase = null;
   const words = [];
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === '--json') continue;
+    if (args[i] === '--json' || args[i] === '--store') continue;
     if (args[i] === '--use-case' && args[i + 1]) {
       useCase = args[++i];
       continue;
     }
     words.push(args[i]);
   }
-  return { isJson, useCase, query: words.join(' ').toLowerCase().trim() };
+  return { isJson, isStore, useCase, query: words.join(' ').toLowerCase().trim() };
 }
 
 /**
@@ -108,7 +109,28 @@ export async function listPeers(args = []) {
 
 /** `plugin search <query>` — bundled plugins plus whatever mesh peers share. */
 export async function searchPlugins(args = []) {
-  const { isJson, useCase, query } = parseArgs(args);
+  const { isJson, isStore, useCase, query } = parseArgs(args);
+  if (isStore) {
+    const base = (process.env.TR_STORE_URL || 'http://127.0.0.1:3000').replace(/\/+$/, '');
+    const params = new URLSearchParams();
+    if (query) params.set('q', query);
+    if (useCase) params.set('use_case', useCase);
+    const res = await fetch(`${base}/api/store/plugins${params.toString() ? `?${params}` : ''}`);
+    if (!res.ok) throw new Error(`Store catalog unavailable (HTTP ${res.status})`);
+    const data = await res.json();
+    const storePlugins = data.plugins || [];
+    if (isJson) {
+      console.log(JSON.stringify({ store: storePlugins }, null, 2));
+      return;
+    }
+    console.log(`\n🛒 Store plugins matching "${query || '*'}"${useCase ? ` (use case: ${useCase})` : ''}\n`);
+    if (storePlugins.length === 0) {
+      console.log('No store plugins found.\n');
+      return;
+    }
+    for (const p of storePlugins) printPlugin(p, `store:${p.id}`);
+    return;
+  }
   const bundled = listAvailableBundled(process.cwd()).filter((p) => matches(p, query, useCase));
   const { listPeerPlugins } = await import('../../core/plugin-peers.mjs');
   const peers = await listPeerPlugins();