tr-plugin-auth 0.0.0-stage → 1.0.0

package/src/routes/webauthn.mjs

@@ -0,0 +1,163 @@
+import express from 'express';
+import { listPasskeys, hasPasskeys, beginRegistration, finishRegistration, beginAuthentication,
+  finishAuthentication, deletePasskey, resolveWebAuthnPath } from '../webauthn-store.mjs';
+export function createWebauthnRouter({ auth, badRequest, serverError, BRAIN_DIR, logger }) {
+const { requireAuth, requireScope, mintStepUpToken, verifyDashboardPassword } = auth;
+const router = express.Router();
+
+function brainDir() {
+  return process.env.TR_SECRETS_BRAIN || BRAIN_DIR;
+}
+
+router.get('/api/webauthn/status', requireAuth, requireScope('keys:read', 'config:read'), (req, res) => {
+  try {
+    const dir = brainDir();
+    const passkeys = listPasskeys(dir);
+    res.json({
+      enabled: true,
+      has_passkeys: passkeys.length > 0,
+      count: passkeys.length,
+      passkeys,
+      store: resolveWebAuthnPath(dir),
+      // When false, UI may offer password re-entry as step-up fallback
+      password_step_up_allowed: true,
+    });
+  } catch (err) {
+    serverError(res, err);
+  }
+});
+
+router.post(
+  '/api/webauthn/register/options',
+  requireAuth,
+  requireScope('keys:write', 'config:write'),
+  async (req, res) => {
+    try {
+      const options = await beginRegistration(brainDir(), req);
+      res.json(options);
+    } catch (err) {
+      logger.warn('webauthn', `register options failed: ${err.message}`);
+      return badRequest(res, err.message);
+    }
+  },
+);
+
+router.post(
+  '/api/webauthn/register/verify',
+  requireAuth,
+  requireScope('keys:write', 'config:write'),
+  async (req, res) => {
+    try {
+      const body = req.body || {};
+      const response = body.response || body;
+      if (!response?.id) return badRequest(res, 'WebAuthn registration response required');
+      const result = await finishRegistration(brainDir(), req, response, {
+        label: body.label,
+      });
+      res.status(201).json({
+        ...result,
+        passkeys: listPasskeys(brainDir()),
+      });
+    } catch (err) {
+      logger.warn('webauthn', `register verify failed: ${err.message}`);
+      return badRequest(res, err.message);
+    }
+  },
+);
+
+router.post(
+  '/api/webauthn/assert/options',
+  requireAuth,
+  requireScope('keys:read', 'config:read'),
+  async (req, res) => {
+    try {
+      const options = await beginAuthentication(brainDir(), req);
+      res.json(options);
+    } catch (err) {
+      return badRequest(res, err.message);
+    }
+  },
+);
+
+router.post(
+  '/api/webauthn/assert/verify',
+  requireAuth,
+  requireScope('keys:read', 'config:read'),
+  async (req, res) => {
+    try {
+      const body = req.body || {};
+      const response = body.response || body;
+      if (!response?.id) return badRequest(res, 'WebAuthn authentication response required');
+      const result = await finishAuthentication(brainDir(), req, response);
+      const step_up_token = mintStepUpToken({
+        purpose: body.purpose || 'secrets:reveal',
+        ttlSeconds: body.ttl_seconds || 60,
+        actor: 'passkey',
+      });
+      logger.info('webauthn', 'Passkey step-up granted', {
+        credentialId: result.credentialId,
+        purpose: body.purpose || 'secrets:reveal',
+      });
+      res.json({
+        verified: true,
+        step_up_token,
+        expires_in: body.ttl_seconds || 60,
+      });
+    } catch (err) {
+      logger.warn('webauthn', `assert verify failed: ${err.message}`);
+      return badRequest(res, err.message);
+    }
+  },
+);
+
+/** Password re-entry step-up (works always; preferred when no passkeys). */
+router.post(
+  '/api/webauthn/step-up/password',
+  requireAuth,
+  requireScope('keys:read', 'config:read'),
+  async (req, res) => {
+    try {
+      const password = req.body?.password;
+      if (!password) return badRequest(res, 'password is required');
+      const ok = await verifyDashboardPassword(password);
+      if (!ok) {
+        return res.status(401).json({ error: 'Invalid password' });
+      }
+      // If passkeys exist, still allow password as fallback but log it
+      if (hasPasskeys(brainDir())) {
+        logger.info('webauthn', 'Password step-up used while passkeys registered');
+      }
+      const step_up_token = mintStepUpToken({
+        purpose: req.body?.purpose || 'secrets:reveal',
+        ttlSeconds: req.body?.ttl_seconds || 60,
+        actor: 'password',
+      });
+      res.json({
+        verified: true,
+        method: 'password',
+        step_up_token,
+        expires_in: req.body?.ttl_seconds || 60,
+      });
+    } catch (err) {
+      serverError(res, err);
+    }
+  },
+);
+
+router.delete(
+  '/api/webauthn/credentials/:id',
+  requireAuth,
+  requireScope('keys:write', 'config:write'),
+  (req, res) => {
+    try {
+      const r = deletePasskey(brainDir(), req.params.id);
+      if (!r.found) return res.status(404).json({ error: 'Passkey not found' });
+      res.json({ deleted: true, passkeys: listPasskeys(brainDir()) });
+    } catch (err) {
+      serverError(res, err);
+    }
+  },
+);
+
+return router;
+}

package/src/runtime-credentials.mjs

@@ -0,0 +1,19 @@
+import { loadSecretsSync, META_KEY } from './secrets-gateway.mjs';
+const PROVIDERS = ['GOOGLE_API_KEY', 'GEMINI_API_KEY', 'ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'XAI_API_KEY', 'GROK_API_KEY', 'TAVILY_API_KEY', 'BRAVE_API_KEY', 'BRAVE_SEARCH_API_KEY', 'EXA_API_KEY', 'SERPER_API_KEY', 'GITHUB_TOKEN', 'OPENROUTER_API_KEY'];
+/** Selected-store projection for harnesses; no session/password/master material. */
+export function runtimeCredentials({ brainDir }) {
+  if (!brainDir) throw new Error('Explicit auth store required');
+  const stored = loadSecretsSync(brainDir), result = {};
+  for (const key of PROVIDERS) {
+    const item = stored[key] ?? stored[key.toLowerCase()];
+    const value = typeof item === 'object' && item !== null ? item.value : item;
+    if (typeof value === 'string' && value) result[key.toLowerCase()] = value;
+  }
+  delete result[META_KEY];
+  return result;
+}
+
+/** Never inherit master/session/provider/password material from the host shell. */
+export function sanitizeRuntimeEnvironment(env = process.env) {
+  return Object.fromEntries(Object.entries(env).filter(([name]) => !/(?:API_KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE_KEY)$/i.test(name)));
+}

package/src/runtime.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/runtime.mjs');
+export const { findBinaryInPath, loadRuntimeConfig, checkRuntimeHealth, loadDynamicSecrets, callLocalRuntime, callLocalRuntimeRaw, cleanAndParseJSON } = hostModule;

package/src/secret-integration-research.mjs

@@ -0,0 +1,340 @@
+/**
+ * AI-only secret → integration research.
+ *
+ * When a new secret is stored, a CLI agent (callLocalRuntime) decides:
+ *   - whether this credential is worth product-API research
+ *   - which product/provider it is
+ *   - what research topic + notes to enqueue
+ *
+ * No hardcoded provider lists, no key-name regex classification, no catalog matching.
+ * Optional code-usage snippets are gathered as *evidence for the model*, not as rules.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { logger } from './logger.mjs';
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+const INFER_SYSTEM = `You are a senior integrations engineer for Total Recall (a personal memory / mesh OS).
+You are given only:
+  (1) an environment/secret KEY NAME (never the secret value)
+  (2) optional code snippets where that key is referenced in THIS repo
+
+Decide whether Total Recall should queue a *research* job to learn an *external third-party* product API that is NOT already part of this product.
+
+Output ONLY valid JSON (no markdown fences):
+{
+  "researchable": boolean,
+  "skip_reason": string|null,
+  "product_name": string|null,
+  "product_slug": string|null,
+  "kind": "api_key"|"password"|"oauth"|"webhook"|"internal"|"self_hosted"|"already_integrated"|"unknown",
+  "topic": string|null,
+  "notes": string|null,
+  "priority": "low"|"medium"|"high",
+  "confidence": number
+}
+
+Rules (strict):
+- researchable=true ONLY for external SaaS/third-party APIs the product might need to learn about from the public internet.
+- researchable=false when code shows the key is for:
+  - infrastructure we already own/run (mesh, Tailscale-compatible control planes, Headscale, local routers, self-hosted mail, etc.)
+  - features already implemented in this repo (routes, clients, adapters present)
+  - passwords, email logins, SSO/client secrets, webhook signing secrets, private keys, session/DB secrets
+  - Total Recall / TR_ / mesh-sync internal credentials
+- If the key is used by existing modules (e.g. headscale routes, mesh auth, mail), set researchable=false with kind "already_integrated" or "self_hosted".
+- Never queue research whose topic is the env var name itself.
+- topic (when researchable) must name the external product and API surface; notes must say use official docs, not the raw key string.
+- Prefer skip when uncertain. Do not invent product paths.`;
+
+/**
+ * Collect a small amount of code-usage context for the AI (not classification rules).
+ * @param {string} key
+ * @param {{ roots?: string[], maxHits?: number }} [opts]
+ * @returns {string}
+ */
+export function gatherCodeUsageContext(key, opts = {}) {
+  const roots = opts.roots || [path.join(REPO_ROOT, 'src')];
+  const maxHits = opts.maxHits ?? 12;
+  const snippets = [];
+
+  // Prefer ripgrep if available; fall back to a tiny walk.
+  const rg = spawnSync(
+    'rg',
+    [
+      '-n',
+      '--no-heading',
+      '-m',
+      '8',
+      '-g',
+      '!**/node_modules/**',
+      '-g',
+      '!**/*.spec.*',
+      '-e',
+      key,
+      ...roots.filter((r) => fs.existsSync(r)),
+    ],
+    { encoding: 'utf8', timeout: 8000, maxBuffer: 512_000 },
+  );
+
+  if (rg.status === 0 && rg.stdout) {
+    for (const line of rg.stdout.split('\n').filter(Boolean).slice(0, maxHits)) {
+      snippets.push(line.slice(0, 400));
+    }
+  } else {
+    // Minimal fallback walk
+    for (const root of roots) {
+      if (!fs.existsSync(root)) continue;
+      walkForKey(root, key, snippets, maxHits, 0);
+      if (snippets.length >= maxHits) break;
+    }
+  }
+
+  if (!snippets.length) {
+    return '(no code references found in local src tree)';
+  }
+  return snippets.join('\n');
+}
+
+function walkForKey(dir, key, out, maxHits, depth) {
+  if (out.length >= maxHits || depth > 6) return;
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const ent of entries) {
+    if (out.length >= maxHits) return;
+    if (ent.name === 'node_modules' || ent.name === '.git' || ent.name.startsWith('.')) continue;
+    const full = path.join(dir, ent.name);
+    if (ent.isDirectory()) {
+      walkForKey(full, key, out, maxHits, depth + 1);
+      continue;
+    }
+    if (!/\.(mjs|js|ts|tsx|yml|yaml|json|md)$/i.test(ent.name)) continue;
+    if (/\.spec\./i.test(ent.name)) continue;
+    let text;
+    try {
+      text = fs.readFileSync(full, 'utf8');
+    } catch {
+      continue;
+    }
+    if (!text.includes(key)) continue;
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length && out.length < maxHits; i++) {
+      if (lines[i].includes(key)) {
+        const from = Math.max(0, i - 1);
+        const to = Math.min(lines.length, i + 2);
+        const chunk = lines
+          .slice(from, to)
+          .map((l, idx) => `${full}:${from + idx + 1}:${l.trim().slice(0, 200)}`)
+          .join('\n');
+        out.push(chunk);
+      }
+    }
+  }
+}
+
+/**
+ * Parse first JSON object from model output.
+ * @param {string} raw
+ */
+export function parseAiJson(raw) {
+  const text = String(raw || '');
+  const start = text.indexOf('{');
+  const end = text.lastIndexOf('}');
+  if (start < 0 || end <= start) return null;
+  try {
+    return JSON.parse(text.slice(start, end + 1));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Ask a CLI agent to infer provider / research brief from key name + code usage.
+ *
+ * @param {string} key
+ * @param {{
+ *   meta?: object,
+ *   codeContext?: string,
+ *   runtimeConfig?: object,
+ *   callRuntime?: Function,
+ * }} [opts]
+ * @returns {Promise<{
+ *   researchable: boolean,
+ *   skip_reason: string|null,
+ *   product_name: string|null,
+ *   product_slug: string|null,
+ *   kind: string,
+ *   topic: string|null,
+ *   notes: string|null,
+ *   priority: string,
+ *   confidence: number,
+ *   source: 'ai',
+ * }>}
+ */
+export async function inferSecretIntegrationWithAi(key, opts = {}) {
+  const codeContext =
+    opts.codeContext !== undefined
+      ? opts.codeContext
+      : gatherCodeUsageContext(key, { roots: opts.roots });
+
+  const prompt = [
+    `Secret key name: ${key}`,
+    opts.meta?.provider ? `Stored provider tag (may be wrong/empty): ${opts.meta.provider}` : null,
+    opts.meta?.label ? `Label: ${opts.meta.label}` : null,
+    opts.meta?.notes ? `User notes: ${String(opts.meta.notes).slice(0, 500)}` : null,
+    '',
+    'Code references (evidence only — reason about them):',
+    codeContext,
+    '',
+    'Return the JSON decision now.',
+  ]
+    .filter((l) => l !== null)
+    .join('\n');
+
+  const callRuntime =
+    opts.callRuntime ||
+    (async (user, system, cfg) => {
+      const { callLocalRuntime, loadRuntimeConfig } = await import('./runtime.mjs');
+      return callLocalRuntime(user, system, cfg || opts.runtimeConfig || loadRuntimeConfig());
+    });
+
+  let raw;
+  try {
+    raw = await callRuntime(prompt, INFER_SYSTEM, opts.runtimeConfig);
+  } catch (err) {
+    logger.warn('secrets', 'AI secret integration inference failed', {
+      key,
+      error: err.message,
+    });
+    return {
+      researchable: false,
+      skip_reason: `AI inference unavailable: ${err.message}`,
+      product_name: null,
+      product_slug: null,
+      kind: 'unknown',
+      topic: null,
+      notes: null,
+      priority: 'low',
+      confidence: 0,
+      source: 'ai',
+    };
+  }
+
+  const parsed = parseAiJson(raw);
+  if (!parsed || typeof parsed !== 'object') {
+    return {
+      researchable: false,
+      skip_reason: 'AI returned non-JSON inference',
+      product_name: null,
+      product_slug: null,
+      kind: 'unknown',
+      topic: null,
+      notes: null,
+      priority: 'low',
+      confidence: 0,
+      source: 'ai',
+    };
+  }
+
+  const researchable = parsed.researchable === true;
+  return {
+    researchable,
+    skip_reason: researchable ? null : String(parsed.skip_reason || 'AI declined research'),
+    product_name: parsed.product_name ? String(parsed.product_name) : null,
+    product_slug: parsed.product_slug ? String(parsed.product_slug) : null,
+    kind: String(parsed.kind || 'unknown'),
+    topic: researchable && parsed.topic ? String(parsed.topic) : null,
+    notes: researchable && parsed.notes ? String(parsed.notes) : null,
+    priority: ['low', 'medium', 'high'].includes(parsed.priority) ? parsed.priority : 'low',
+    confidence: Number.isFinite(Number(parsed.confidence)) ? Number(parsed.confidence) : 0,
+    source: 'ai',
+  };
+}
+
+/**
+ * Build brief via AI only.
+ * @returns {Promise<{ topic: string, notes: string, priority: string, inference: object } | null>}
+ */
+export async function buildIntegrationResearchBrief(key, meta = {}, opts = {}) {
+  const inference = await inferSecretIntegrationWithAi(key, { meta, ...opts });
+  if (!inference.researchable || !inference.topic) {
+    return null;
+  }
+  return {
+    topic: inference.topic,
+    notes: inference.notes || `AI-inferred product research for secret \`${key}\`.`,
+    priority: inference.priority || 'low',
+    inference,
+  };
+}
+
+/**
+ * Enqueue integration research when the AI says so.
+ * @returns {Promise<{ enqueued: boolean, item?: object, skipped?: string, inference?: object }>}
+ */
+export async function maybeEnqueueIntegrationResearch(brainDir, key, meta = {}, opts = {}) {
+  const inference = await inferSecretIntegrationWithAi(key, { meta, ...opts });
+  if (!inference.researchable || !inference.topic) {
+    return {
+      enqueued: false,
+      skipped: inference.skip_reason || 'AI declined research',
+      inference,
+    };
+  }
+
+  // Nobody asked for this, so it goes through the autonomous gate and counts
+  // against the same daily budget as project gap research.
+  const { proposeAutonomousResearch } = await import('./research-gate.mjs');
+  const notes = inference.notes || `AI-inferred product research for secret \`${key}\`.`;
+  const { queued, skipped } = await proposeAutonomousResearch(
+    [{ topic: inference.topic, rationale: notes, priority: inference.priority || 'low' }],
+    { project: null, via: 'secret', brainDir, coverageCheck: opts.coverageCheck },
+  );
+  if (!queued.length) {
+    return { enqueued: false, skipped: skipped[0]?.reason || 'gate declined', inference };
+  }
+  return { enqueued: true, item: queued[0], inference };
+}
+
+/**
+ * Retire obsolete key-name scrape queue items (old Automated API Integration Build: KEY topics).
+ */
+export async function cancelBogusApiIntegrationQueueItems(overrideBrainDir) {
+  const { loadQueue, updateQueueItem } = await import('./research-queue.mjs');
+  const items = loadQueue(overrideBrainDir);
+  let cancelled = 0;
+  for (const item of items) {
+    if (item.status !== 'pending' && item.status !== 'in_progress') continue;
+    if (!/^Automated API Integration Build:/i.test(String(item.topic || ''))) continue;
+    updateQueueItem(
+      item.id,
+      {
+        status: 'failed',
+        notes: `${item.notes || ''}\n\n[auto-cancelled] Obsolete key-name scrape job; re-add the secret to trigger AI provider inference.`,
+        research_phase: 'cancelled',
+      },
+      overrideBrainDir,
+    );
+    cancelled += 1;
+  }
+
+  // The same fixture pattern also landed in the research AGENDA — a different
+  // file with a different owner. Walking only the queue is why the designated
+  // remediation never removed the 29 agenda topics it was written for.
+  let cancelledAgendaTopics = 0;
+  try {
+    const { cancelBogusAgendaTopics } = await import('./fact-seeker.mjs');
+    ({ cancelled: cancelledAgendaTopics } = cancelBogusAgendaTopics());
+  } catch {
+    // Best-effort: a missing or unreadable agenda must not block the queue half.
+  }
+
+  return { cancelled, cancelledAgendaTopics };
+}

package/src/secrets-env-diff.mjs

@@ -0,0 +1,132 @@
+/**
+ * Compare repo .env files against the secrets store.
+ *
+ * The store is meant to be the SSOT and .env files its projections, but nothing
+ * ever checked that they agreed. Drift is silent and consequential: the same
+ * key can hold a rotated credential in one place and a retired one in the
+ * other, and whichever the process happens to read decides whether a service
+ * works. Length-equal drift is the dangerous kind — same provider, same format,
+ * different key — because it looks like a match in every summary that counts
+ * keys rather than comparing values.
+ *
+ * Reports only shapes and lengths. Secret values never leave this module.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { loadSecrets, listSecretsMeta } from './secrets-store.mjs';
+import { parseEnvText, isCandidateKey } from './env-import.mjs';
+
+/** Values that are obviously templates rather than credentials. */
+const PLACEHOLDER = /^(your[_-]?|xxx+|changeme|<|placeholder|todo|sk-your|example)/i;
+
+export function isPlaceholderValue(value) {
+  const v = String(value || '').trim();
+  if (!v) return true;
+  if (PLACEHOLDER.test(v)) return true;
+  // `..._HERE`, `PUT_KEY_HERE` and friends
+  return /(_|-)?here$/i.test(v);
+}
+
+/**
+ * Classify one key across the two sources.
+ * @returns {'match'|'drift'|'only_env'|'only_store'|'placeholder'}
+ */
+export function classify(envValue, storeValue, keyInStore) {
+  if (envValue !== undefined && isPlaceholderValue(envValue)) return 'placeholder';
+  if (envValue === undefined) return 'only_store';
+  if (!keyInStore) return 'only_env';
+  return String(storeValue) === String(envValue) ? 'match' : 'drift';
+}
+
+/**
+ * Locate the .env files worth comparing, from the project registry plus any
+ * explicit paths. Never hardcodes a repo: registry entries and caller input only.
+ */
+export function resolveEnvFiles(roots = [], filenames = ['.env']) {
+  const files = [];
+  for (const root of roots) {
+    for (const name of filenames) {
+      const candidate = path.join(root, name);
+      if (fs.existsSync(candidate)) files.push(candidate);
+      // Sub-app env files (e.g. a server/ workspace) drift independently.
+      const nested = path.join(root, 'server', name);
+      if (fs.existsSync(nested)) files.push(nested);
+    }
+  }
+  return files;
+}
+
+/**
+ * Diff every candidate secret in the given .env files against the store.
+ */
+/**
+ * Which repo a .env belongs to, for comparison against a secret's binding.
+ * Walks up to the directory holding the file, ignoring a nested app dir.
+ */
+export function repoOfEnvFile(file) {
+  const parts = path.resolve(file).split(path.sep);
+  const idx = parts.lastIndexOf('Github');
+  if (idx !== -1 && parts[idx + 1]) return parts[idx + 1];
+  return path.basename(path.dirname(path.resolve(file)));
+}
+
+export async function diffEnvAgainstStore(brainDir, envFiles) {
+  const store = await loadSecrets(brainDir);
+  const meta = await listSecretsMeta(brainDir).catch(() => []);
+  const bindingOf = new Map(meta.map((m) => [m.key, m.repos || m.repo || null]));
+  const rows = [];
+  const totals = { match: 0, drift: 0, only_env: 0, placeholder: 0, collision: 0 };
+
+  for (const file of envFiles) {
+    let parsed;
+    try {
+      parsed = parseEnvText(fs.readFileSync(file, 'utf8'));
+    } catch (err) {
+      rows.push({ key: '(unreadable)', file, status: 'error', detail: err.message });
+      continue;
+    }
+
+    for (const [key, value] of Object.entries(parsed)) {
+      if (!isCandidateKey(key)) continue;
+      let status = classify(value, store[key], key in store);
+      if (status === 'only_store') continue;
+
+      // A store entry is bound to exactly one repo. When the .env belongs to a
+      // different repo, the two values are not the same credential wearing one
+      // name — they are two products' credentials colliding on a shared
+      // variable name (STRIPE_SECRET_KEY, MAILCOW_API_KEY). Reporting that as
+      // drift invites "fixing" it by overwriting a live key with another
+      // product's.
+      const binding = bindingOf.get(key) || null;
+      const envRepo = repoOfEnvFile(file);
+      const crossProduct = Boolean(
+        status === 'drift' && binding && !String(binding).split(',').includes(envRepo),
+      );
+      if (crossProduct) status = 'collision';
+
+      totals[status] += 1;
+      if (status === 'match') continue;
+      rows.push({
+        key,
+        file,
+        status,
+        binding,
+        envRepo,
+        envLength: String(value ?? '').length,
+        storeLength: key in store ? String(store[key]).length : null,
+        // Equal lengths mean the same credential format — a rotation that
+        // landed on one side only, rather than two unrelated values.
+        sameShape: key in store && String(store[key]).length === String(value ?? '').length,
+      });
+    }
+  }
+
+  rows.sort((a, b) => (a.status === b.status ? a.key.localeCompare(b.key) : a.status.localeCompare(b.status)));
+  return { totals, rows, storeKeyCount: Object.keys(store).filter((k) => !k.startsWith('__')).length };
+}
+
+export function defaultBrainDir() {
+  return path.join(os.homedir(), '.agent', 'skills', 'total-recall');
+}