tr-plugin-auth 0.0.0-stage → 1.0.0

package/src/env-import.mjs

@@ -0,0 +1,502 @@
+/**
+ * Scan env sources and import keys into the secrets store.
+ *
+ * Import is pattern-based (any secret-shaped env name) — NOT a hardcoded list of
+ * product APIs. Optional provider tags are best-effort labels for the catalog UI.
+ * Never logs or returns full secret values in scan results.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { setSecret, listSecretsMeta, updateSecretMeta } from './secrets-store.mjs';
+import { providerForKeyName } from './provider-catalog.mjs';
+
+/**
+ * @deprecated Kept as empty/export for older callers. Import does NOT use this
+ * as a whitelist — any secret-shaped key is eligible.
+ */
+export const KNOWN_SECRET_KEYS = [];
+
+/**
+ * Name looks like a secret: ends with KEY/TOKEN/SECRET/PASSWORD/etc.
+ * Or contains those segments. Shell noise is skipped.
+ */
+const SECRET_NAME_RE =
+  /(?:^|_)(API[_-]?KEY|API[_-]?TOKEN|ACCESS[_-]?TOKEN|ACCESS[_-]?KEY|SECRET[_-]?KEY|PRIVATE[_-]?KEY|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET|WEBHOOK[_-]?SECRET|PASSWORD|PASSWD|TOKEN|SECRET|KEY)$/i;
+
+/**
+ * The secrets store's own master password must never be imported into the
+ * store, and neither may anything else that controls access to it.
+ *
+ * TR_SECRETS_PASSWORD is exported into every shell by ~/.zshenv (from the
+ * macOS Keychain), so it shows up in the env scan like any other credential —
+ * and `secret import-env --all`, the command the help text recommends, would
+ * happily write it in. That is the key to the box stored inside the box: it
+ * cannot be read back without the value it holds, and it puts the one
+ * credential that protects everything else next to what it protects.
+ */
+const STORE_CONTROL_KEYS = new Set([
+  'TR_SECRETS_PASSWORD',
+  'TR_SECRETS_KEY_CACHE',
+  'TR_REMOTE_VAULT_TOKEN',
+]);
+
+/** Obvious non-secrets even if they match loosely */
+const SKIP_KEYS = new Set([
+  'PATH',
+  'HOME',
+  'USER',
+  'SHELL',
+  'PWD',
+  'TMPDIR',
+  'TERM',
+  'LANG',
+  'LC_ALL',
+  'NODE_ENV',
+  'COLORTERM',
+  'SSH_AUTH_SOCK',
+  'DISPLAY',
+  'USERPROFILE',
+  'HOSTNAME',
+  'LOGNAME',
+  'XPC_SERVICE_NAME',
+  'COMMAND_MODE',
+  'SHLVL',
+  'OLDPWD',
+  'TERM_PROGRAM',
+  'TERM_SESSION_ID',
+  'TMP',
+  'TEMP',
+  'EDITOR',
+  'VISUAL',
+  'PAGER',
+  'MANPATH',
+  'INFOPATH',
+  'GOPATH',
+  'GOROOT',
+  'JAVA_HOME',
+  'ANDROID_HOME',
+  'NVM_DIR',
+  'PNPM_HOME',
+  'BUN_INSTALL',
+  'ZSH',
+  'FPATH',
+  'LS_COLORS',
+  'COLORFGBG',
+  'ITERM_SESSION_ID',
+  'TERM_PROGRAM_VERSION',
+  'SSH_AGENT_PID',
+  'XPC_FLAGS',
+  'LaunchInstanceID',
+  'SECURITYSESSIONID',
+  '__CFBundleIdentifier',
+  '__CF_USER_TEXT_ENCODING',
+]);
+
+/**
+ * Infer a short provider *label* from the key name for catalog grouping.
+ * Not a whitelist — unknown keys still import; label may be null or derived.
+ *
+ * Strategy:
+ *  1. Optional match against provider-catalog key_patterns (data, not import gate)
+ *  2. Else first path segment of KEY_NAME before _API / _SECRET / _TOKEN / _KEY
+ *
+ * @param {string} key
+ * @returns {string|null}
+ */
+export function inferProvider(key) {
+  if (!key) return null;
+  const k = String(key);
+
+  // A known provider anywhere in the key name wins (JSN_SMTP2GO_API_KEY -> smtp2go).
+  const known = providerForKeyName(k);
+  if (known) return known.id;
+
+  // Strip common prefixes that are not the vendor
+  let base = k
+    .replace(/^(DEVELOPER_|VITE_|NEXT_PUBLIC_|PUBLIC_|NUXT_PUBLIC_)/i, '')
+    .toUpperCase();
+
+  // Take leading brand segment(s) before secret suffix
+  const stripped = base
+    .replace(
+      /(_?API_?KEY|_?API_?TOKEN|_?ACCESS_?TOKEN|_?ACCESS_?KEY|_?SECRET_?KEY|_?PRIVATE_?KEY|_?AUTH_?TOKEN|_?CLIENT_?SECRET|_?WEBHOOK_?SECRET|_?PASSWORD|_?PASSWD|_?TOKEN|_?SECRET|_?KEY)$/i,
+      '',
+    )
+    .replace(/^_+|_+$/g, '');
+
+  if (!stripped) return null;
+
+  // Normalize multi-word vendors into a slug (OPEN_ROUTER → open-router, GOOGLE_GENERATIVE_AI → google)
+  const parts = stripped.toLowerCase().split(/_+/).filter(Boolean);
+  if (!parts.length) return null;
+
+  // Prefer first 1–2 meaningful parts, drop noise words
+  const noise = new Set(['api', 'app', 'service', 'role', 'admin', 'user', 'test', 'public', 'private']);
+  const useful = parts.filter((p) => !noise.has(p));
+  const take = useful.length ? useful : parts;
+  if (take.length === 1) return take[0];
+  // e.g. google_generative → google; digital_ocean → digitalocean
+  if (take[0].length <= 3 && take.length >= 2) return `${take[0]}-${take[1]}`;
+  return take[0];
+}
+
+/**
+ * @param {string} value
+ */
+export function maskSecret(value) {
+  const s = String(value || '');
+  if (s.length <= 8) return '••••••••';
+  return `${s.slice(0, 4)}…${s.slice(-4)} (${s.length} chars)`;
+}
+
+/**
+ * Parse .env-style text into key/value map.
+ * @param {string} text
+ * @returns {Record<string, string>}
+ */
+export function parseEnvText(text) {
+  const out = {};
+  if (!text || typeof text !== 'string') return out;
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#')) continue;
+    const exportPrefix = line.startsWith('export ') ? line.slice(7).trim() : line;
+    const eq = exportPrefix.indexOf('=');
+    if (eq <= 0) continue;
+    const key = exportPrefix.slice(0, eq).trim();
+    let val = exportPrefix.slice(eq + 1).trim();
+    if (
+      (val.startsWith('"') && val.endsWith('"')) ||
+      (val.startsWith("'") && val.endsWith("'"))
+    ) {
+      val = val.slice(1, -1);
+    }
+    // strip trailing inline comments for unquoted values
+    if (!exportPrefix.slice(eq + 1).trim().startsWith('"') && !exportPrefix.slice(eq + 1).trim().startsWith("'")) {
+      val = val.replace(/\s+#.*$/, '').trim();
+    }
+    if (key && val) out[key] = val;
+  }
+  return out;
+}
+
+/**
+ * True if env var *name* looks secret-shaped. No product/API whitelist.
+ * @param {string} key
+ */
+export function isCandidateKey(key) {
+  if (!key || typeof key !== 'string') return false;
+  if (STORE_CONTROL_KEYS.has(key.toUpperCase())) return false;
+  if (SKIP_KEYS.has(key) || SKIP_KEYS.has(key.toUpperCase())) return false;
+  // skip pure PATH-like / numeric shell junk
+  if (key.length < 4 || key.length > 128) return false;
+  if (!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(key)) return false;
+  return SECRET_NAME_RE.test(key);
+}
+
+/**
+ * Discover .env* files under a directory (shallow, no node_modules).
+ * @param {string} root
+ * @param {number} maxDepth
+ * @param {string[]} out
+ * @param {number} depth
+ */
+function walkEnvFiles(root, maxDepth, out, depth = 0) {
+  if (depth > maxDepth || !root) return;
+  let entries;
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const ent of entries) {
+    if (ent.name === 'node_modules' || ent.name === '.git' || ent.name === 'dist' || ent.name === 'build') {
+      continue;
+    }
+    const full = path.join(root, ent.name);
+    if (ent.isFile() && /^\.env(\.|$)/.test(ent.name)) {
+      out.push(full);
+    } else if (ent.isDirectory() && !ent.name.startsWith('.') || ent.name === '.agent' || ent.name === '.config') {
+      if (ent.name.startsWith('.') && ent.name !== '.agent' && ent.name !== '.config') continue;
+      walkEnvFiles(full, maxDepth, out, depth + 1);
+    }
+  }
+}
+
+/**
+ * Candidate env file paths — discovered, not a hardcoded product list.
+ * @param {{ brainDir?: string, projectRoot?: string, cwd?: string, extraFiles?: string[], discoverRoot?: string, maxDepth?: number }} opts
+ */
+export function defaultEnvFilePaths(opts = {}) {
+  const home = os.homedir();
+  const cwd = opts.cwd || process.cwd();
+  const paths = [
+    path.join(home, '.env'),
+    path.join(home, '.agent', '.env'),
+    path.join(home, '.agent', 'skills', 'total-recall', '.env'),
+    path.join(home, '.agent', 'skills', 'total-recall', 'config', '.env'),
+    path.join(home, '.config', 'total-recall', '.env'),
+    path.join(cwd, '.env'),
+    path.join(cwd, '.env.local'),
+    path.join(cwd, '.env.development'),
+    path.join(cwd, '.env.production'),
+  ];
+  if (opts.brainDir) {
+    paths.push(path.join(opts.brainDir, '.env'));
+    paths.push(path.join(opts.brainDir, 'config', '.env'));
+  }
+  if (opts.projectRoot) {
+    paths.push(path.join(opts.projectRoot, '.env'));
+    paths.push(path.join(opts.projectRoot, '.env.local'));
+  }
+  if (opts.extraFiles && Array.isArray(opts.extraFiles)) {
+    paths.push(...opts.extraFiles);
+  }
+
+  // Auto-discover under ~/Github (or discoverRoot) without naming products
+  const discoverRoot = opts.discoverRoot ?? path.join(home, 'Github');
+  const maxDepth = opts.maxDepth ?? 3;
+  if (discoverRoot && fs.existsSync(discoverRoot)) {
+    walkEnvFiles(discoverRoot, maxDepth, paths, 0);
+  }
+  // Also discover under home/.agent
+  walkEnvFiles(path.join(home, '.agent'), 4, paths, 0);
+
+  return [...new Set(paths)];
+}
+
+/**
+ * @param {Record<string, string>} map
+ * @param {string} source
+ * @param {Map<string, object>} into
+ */
+function mergeCandidates(map, source, into) {
+  for (const [key, value] of Object.entries(map)) {
+    if (!isCandidateKey(key)) continue;
+    if (!value || !String(value).trim()) continue;
+    const existing = into.get(key);
+    // Prefer first non-process.env file sources over later process.env unless only env
+    if (existing && existing.source !== 'process.env' && source === 'process.env') continue;
+    if (existing) {
+      if (!existing.sources) existing.sources = [existing.source];
+      if (!existing.sources.includes(source)) existing.sources.push(source);
+      if (existing.source === 'process.env' && source !== 'process.env') {
+        existing.source = source;
+      }
+      continue;
+    }
+    into.set(key, {
+      key,
+      source,
+      sources: [source],
+      provider: inferProvider(key),
+      masked: maskSecret(value),
+      length: String(value).length,
+      known: true, // all pattern-matched secrets are first-class; no API whitelist
+      // internal only — stripped before API response
+      _value: String(value),
+    });
+  }
+}
+
+/**
+ * Scan process.env + default env files.
+ * @param {{ brainDir?: string, projectRoot?: string, cwd?: string, includeProcessEnv?: boolean }} opts
+ */
+export function scanEnvSources(opts = {}) {
+  const includeProcessEnv = opts.includeProcessEnv !== false;
+  const candidates = new Map();
+
+  for (const filePath of defaultEnvFilePaths(opts)) {
+    try {
+      if (!fs.existsSync(filePath) || !fs.statSync(filePath).isFile()) continue;
+      const text = fs.readFileSync(filePath, 'utf8');
+      mergeCandidates(parseEnvText(text), filePath, candidates);
+    } catch {
+      // unreadable path — skip
+    }
+  }
+
+  if (includeProcessEnv) {
+    const envMap = {};
+    for (const [k, v] of Object.entries(process.env)) {
+      if (typeof v === 'string' && v) envMap[k] = v;
+    }
+    mergeCandidates(envMap, 'process.env', candidates);
+  }
+
+  const list = [...candidates.values()].sort((a, b) => a.key.localeCompare(b.key));
+  return {
+    candidates: list,
+    sources_scanned: [
+      ...(includeProcessEnv ? ['process.env'] : []),
+      ...defaultEnvFilePaths(opts),
+    ],
+  };
+}
+
+/**
+ * Public scan result (no raw values).
+ */
+export function publicScanResult(scan, existingKeys = new Set()) {
+  return {
+    candidates: scan.candidates.map(({ key, source, provider, masked, length, known }) => ({
+      key,
+      source: source === 'process.env' ? 'process.env' : path.basename(source) === source ? source : source,
+      source_label: source === 'process.env' ? 'shell environment' : shortenPath(source),
+      provider,
+      masked,
+      length,
+      known,
+      already_set: existingKeys.has(key),
+    })),
+    count: scan.candidates.length,
+    sources_scanned: scan.sources_scanned.map((s) =>
+      s === 'process.env' ? s : shortenPath(s),
+    ),
+  };
+}
+
+function shortenPath(p) {
+  const home = os.homedir();
+  if (p.startsWith(home)) return `~${p.slice(home.length)}`;
+  return p;
+}
+
+/**
+ * Import selected keys into secrets store.
+ * @param {string} brainDir
+ * @param {{ keys?: string[], pairs?: Record<string,string>, overwrite?: boolean, actor?: string }} opts
+ *   - keys: import from scan (must re-scan for values)
+ *   - pairs: explicit key→value (from paste)
+ */
+export async function importEnvSecrets(brainDir, opts = {}) {
+  const overwrite = !!opts.overwrite;
+  const actor = opts.actor || 'import';
+  const existing = await listSecretsMeta(brainDir);
+  const existingSet = new Set(existing.map((e) => e.key));
+  const existingByKey = new Map(existing.map((e) => [e.key, e]));
+
+  /** @type {Record<string, string>} */
+  let values = {};
+
+  if (opts.pairs && typeof opts.pairs === 'object') {
+    for (const [k, v] of Object.entries(opts.pairs)) {
+      if (isCandidateKey(k) && v) values[k] = String(v);
+    }
+  }
+
+  /** @type {Record<string, string>} */
+  const sourceByKey = { ...(opts.sourceByKey || {}) };
+  /** @type {Record<string, string[]>} */
+  const sourcesByKey = {};
+
+  if (Array.isArray(opts.keys) && opts.keys.length) {
+    const scan = scanEnvSources({ brainDir, includeProcessEnv: true });
+    const byKey = new Map(scan.candidates.map((c) => [c.key, c]));
+    for (const k of opts.keys) {
+      const c = byKey.get(k);
+      if (c?._value) {
+        values[k] = c._value;
+        sourceByKey[k] = c.source;
+        sourcesByKey[k] = c.sources || [c.source];
+      }
+    }
+  }
+
+  // If only "import all" with empty keys and no pairs — import everything from scan
+  if (!opts.pairs && (!opts.keys || opts.keys.length === 0) && opts.all) {
+    const scan = scanEnvSources({ brainDir, includeProcessEnv: true });
+    for (const c of scan.candidates) {
+      if (c._value) {
+        values[c.key] = c._value;
+        sourceByKey[c.key] = c.source;
+        sourcesByKey[c.key] = c.sources || [c.source];
+      }
+    }
+  }
+
+  const imported = [];
+  const skipped = [];
+  const errors = [];
+
+  for (const [key, value] of Object.entries(values)) {
+    const isSet = existingSet.has(key);
+
+    const sources = sourcesByKey[key] || (sourceByKey[key] ? [sourceByKey[key]] : []);
+    let computedRepos = [];
+    for (const src of sources) {
+      if (src && typeof src === 'string' && src !== 'process.env' && src !== 'paste') {
+        const parts = src.replace(/\\/g, '/').split('/');
+        const envIdx = parts.findIndex((p) => p.startsWith('.env'));
+        if (envIdx > 0) computedRepos.push(parts[envIdx - 1]);
+      }
+    }
+    const existingEntry = existingByKey.get(key);
+    const existingRepos = existingEntry?.repos || [];
+    const finalRepos = [...new Set([...existingRepos, ...computedRepos])].filter(Boolean);
+
+    // If already set and not overwriting, we only append repos
+    if (isSet && !overwrite) {
+      if (finalRepos.length > existingRepos.length) {
+        try {
+          await updateSecretMeta(brainDir, key, { repos: finalRepos }, { actor });
+          imported.push({ key, provider: inferProvider(key), repos: finalRepos, meta_only: true });
+        } catch (err) {
+          errors.push({ key, error: err.message });
+        }
+      } else {
+        skipped.push({ key, reason: 'already_set' });
+      }
+      continue;
+    }
+
+    try {
+      await setSecret(brainDir, key, value, {
+        provider: inferProvider(key),
+        scope: 'global',
+        repos: finalRepos.length > 0 ? finalRepos : undefined,
+        actor,
+      });
+      imported.push({ key, provider: inferProvider(key), repos: finalRepos });
+      existingSet.add(key);
+    } catch (err) {
+      errors.push({ key, error: err.message });
+    }
+  }
+
+  return {
+    imported,
+    skipped,
+    errors,
+    imported_count: imported.length,
+    skipped_count: skipped.length,
+  };
+}
+
+/**
+ * Parse pasted .env and return public candidates + internal pairs for import.
+ * @param {string} text
+ */
+export function candidatesFromPaste(text) {
+  const map = parseEnvText(text);
+  const candidates = [];
+  const pairs = {};
+  for (const [key, value] of Object.entries(map)) {
+    if (!isCandidateKey(key) || !value) continue;
+    candidates.push({
+      key,
+      source: 'paste',
+      source_label: 'pasted .env',
+      provider: inferProvider(key),
+      masked: maskSecret(value),
+      length: String(value).length,
+      known: true,
+    });
+    pairs[key] = value;
+  }
+  candidates.sort((a, b) => a.key.localeCompare(b.key));
+  return { candidates, pairs };
+}

package/src/fact-seeker.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/fact-seeker.mjs');
+export const { getLocalizedDateTime, formatBeautifulDate, loadAgenda, addToAgenda, CANCELLED_STATUS, cancelBogusAgendaTopics, reclassifyCancelledAgendaTopics, markTopicResearched, getNextAgendaTopic, inferTopicsFromSession, buildMultiNoteGraph, runSelfDiagnosis, runKnowledgeAcquisitionCycle, ingestSessionTopics, runResearchDeliberationCycle, runResearchImprovementCycle, runMemoryCompaction } = hostModule;

package/src/frontmatter.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/frontmatter.mjs');
+export default hostModule.default;

package/src/google-oauth.mjs

@@ -0,0 +1,139 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { loadSecretsSync, saveSecretsSync } from './secrets-gateway.mjs';
+import { authState, appendAuthMetadata, assertNoSecretValues } from './metadata-state.mjs';
+
+const STORE_KEY = 'google_oauth_accounts';
+const digest = value => crypto.createHash('sha256').update(value).digest('hex');
+const subject = value => {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,255}$/.test(value)) throw new Error('Invalid Google account identifier');
+  return value;
+};
+
+/** Tokens remain opaque encrypted auth resources. SSSS stores lifecycle metadata only. */
+export function createGoogleOAuth({ brainDir, load = loadSecretsSync, save = saveSecretsSync,
+  fetchImpl = fetch, now = Date.now, metadata, record } = {}) {
+  if (!brainDir) throw new Error('An explicit auth store is required');
+  const state = metadata || authState(path.join(brainDir, 'config/google-oauth-metadata.json'));
+  const audit = record || (row => appendAuthMetadata(path.join(brainDir, 'logs/google-oauth.jsonl'), row));
+  const pending = new Map();
+  const refreshes = new Map();
+  const config = () => {
+    const values = load(brainDir);
+    if (!values.GOOGLE_CLIENT_ID || !values.GOOGLE_CLIENT_SECRET) throw new Error('Google OAuth is not configured');
+    const redirect = new URL(values.GOOGLE_REDIRECT_URI || '');
+    if ((redirect.protocol !== 'https:' && !(redirect.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(redirect.hostname))) || redirect.username || redirect.password || redirect.search || redirect.hash || redirect.pathname !== '/auth/google/callback') throw new Error('Configure a trusted GOOGLE_REDIRECT_URI ending in /auth/google/callback');
+    return { clientId: values.GOOGLE_CLIENT_ID, clientSecret: values.GOOGLE_CLIENT_SECRET, redirectUri: redirect.href };
+  };
+  const status = () => {
+    const rows = state.read({}); assertNoSecretValues(rows);
+    return Object.values(rows);
+  };
+  const commit = (id, credentials, phase) => {
+    // Read both snapshots immediately before synchronous commits; never retain a stale whole store across HTTP awaits.
+    const values = load(brainDir);
+    const previous = values[STORE_KEY]?.[id] || {};
+    const accounts = { ...(values[STORE_KEY] || {}) };
+    const rows = state.read({});
+    const timestamp = new Date(now()).toISOString();
+    if (credentials === null) delete accounts[id];
+    else accounts[id] = { ...previous, ...credentials };
+    const account = accounts[id];
+    rows[id] = { account_id: id, email: account?.email || rows[id]?.email || '',
+      status: phase, expiry: account?.expires_at || null,
+      scopes: account?.scope?.split(/\s+/).filter(Boolean) || [],
+      can_refresh: Boolean(account?.refresh_token), updated_at: timestamp };
+    assertNoSecretValues(rows);
+    // Audit intent before external credential commit; completed metadata is never reported before encryption succeeds.
+    audit({ action: 'google_oauth_intent', account_id: id, status: phase, timestamp });
+    save(brainDir, { ...values, [STORE_KEY]: accounts });
+    state.write(rows);
+    audit({ action: 'google_oauth_committed', account_id: id, status: phase, timestamp });
+    return rows[id];
+  };
+  const requestTokens = async parameters => {
+    const cfg = config();
+    const response = await fetchImpl('https://oauth2.googleapis.com/token', {
+      method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ client_id: cfg.clientId, client_secret: cfg.clientSecret, ...parameters }),
+      signal: AbortSignal.timeout(15000), redirect: 'error',
+    });
+    const data = await response.json();
+    if (!response.ok) {
+      const error = new Error(data.error === 'invalid_grant' ? 'Google authorization expired or revoked; reconnect required' : 'Google token exchange failed');
+      error.reconnect = data.error === 'invalid_grant'; throw error;
+    }
+    if (typeof data.access_token !== 'string' || !data.access_token || data.token_type?.toLowerCase() !== 'bearer' || !Number.isFinite(Number(data.expires_in)) || Number(data.expires_in) <= 0) throw new Error('Invalid Google token response');
+    return { access_token: data.access_token, ...(typeof data.refresh_token === 'string' && data.refresh_token ? { refresh_token: data.refresh_token } : {}),
+      ...(typeof data.scope === 'string' ? { scope: data.scope } : {}), expires_at: new Date(now() + Number(data.expires_in) * 1000).toISOString() };
+  };
+  return {
+    config, status,
+    begin() {
+      const cfg = config();
+      for (const [key, value] of pending) if (value.expires <= now()) pending.delete(key);
+      if (pending.size >= 1000) throw new Error('Too many pending authorizations');
+      const stateValue = crypto.randomBytes(32).toString('base64url');
+      const browser = crypto.randomBytes(32).toString('base64url');
+      const verifier = crypto.randomBytes(48).toString('base64url');
+      pending.set(stateValue, { browser: digest(browser), verifier, expires: now() + 600000, redirectUri: cfg.redirectUri });
+      const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
+      for (const [key, value] of Object.entries({ client_id: cfg.clientId, redirect_uri: cfg.redirectUri, response_type: 'code', scope: 'openid email profile',
+        state: stateValue, access_type: 'offline', prompt: 'consent select_account', code_challenge: crypto.createHash('sha256').update(verifier).digest('base64url'), code_challenge_method: 'S256' })) url.searchParams.set(key, value);
+      return { url: url.href, redirectUri: cfg.redirectUri, browser };
+    },
+    async complete({ code, state: stateValue, browser }) {
+      const attempt = typeof stateValue === 'string' ? pending.get(stateValue) : null;
+      if (!attempt || attempt.expires <= now() || typeof browser !== 'string' || !crypto.timingSafeEqual(Buffer.from(attempt.browser), Buffer.from(digest(browser)))) throw new Error('Invalid or expired OAuth browser state');
+      pending.delete(stateValue);
+      if (typeof code !== 'string' || !code || code.length > 8192 || config().redirectUri !== attempt.redirectUri) throw new Error('Invalid OAuth callback');
+      const tokens = await requestTokens({ code, redirect_uri: attempt.redirectUri, grant_type: 'authorization_code', code_verifier: attempt.verifier });
+      const response = await fetchImpl('https://www.googleapis.com/oauth2/v3/userinfo', { headers: { Authorization: `Bearer ${tokens.access_token}` }, signal: AbortSignal.timeout(15000), redirect: 'error' });
+      if (!response.ok) throw new Error('Google identity verification failed');
+      const user = await response.json();
+      const id = subject(user.sub);
+      if (user.email_verified !== true || typeof user.email !== 'string' || !user.email.includes('@')) throw new Error('Google identity is not verified');
+      const allowed = load(brainDir).GOOGLE_ALLOWED_EMAILS;
+      const emails = Array.isArray(allowed) ? allowed : typeof allowed === 'string' ? allowed.split(',') : [];
+      if (!emails.some(email => typeof email === 'string' && email.trim().toLowerCase() === user.email.toLowerCase())) throw new Error('Google account is not authorized for this dashboard');
+      commit(id, { ...tokens, email: user.email, name: typeof user.name === 'string' ? user.name : '' }, 'connected');
+      return { sub: id, email: user.email, name: typeof user.name === 'string' ? user.name : '' };
+    },
+    async access(id) {
+      id = subject(id);
+      const account = load(brainDir)[STORE_KEY]?.[id];
+      if (!account) throw new Error('Google account is not connected');
+      if (account.access_token && Date.parse(account.expires_at) > now() + 60000) return account.access_token;
+      if (!account.refresh_token) { commit(id, null, 'reconnect_required'); throw new Error('Google account must be reconnected'); }
+      if (!refreshes.has(id)) {
+        const operation = (async () => {
+          try {
+            const tokens = await requestTokens({ refresh_token: account.refresh_token, grant_type: 'refresh_token' });
+            const current = load(brainDir)[STORE_KEY]?.[id];
+            if (!current || current.refresh_token !== account.refresh_token) throw new Error('Google connection changed while refreshing');
+            commit(id, tokens, 'connected'); return tokens.access_token;
+          } catch (error) {
+            if (error.reconnect) {
+              const current = load(brainDir)[STORE_KEY]?.[id];
+              if (current?.refresh_token === account.refresh_token) commit(id, null, 'reconnect_required');
+            }
+            throw error;
+          }
+        })().finally(() => refreshes.delete(id));
+        refreshes.set(id, operation);
+      }
+      return refreshes.get(id);
+    },
+    async disconnect(id) {
+      id = subject(id);
+      const account = load(brainDir)[STORE_KEY]?.[id];
+      if (!account) return { account_id: id, disconnected: true };
+      const response = await fetchImpl('https://oauth2.googleapis.com/revoke', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ token: account.refresh_token || account.access_token }), signal: AbortSignal.timeout(15000), redirect: 'error' });
+      if (!response.ok) throw new Error('Google revocation failed; connection retained');
+      const current = load(brainDir)[STORE_KEY]?.[id];
+      if (current?.refresh_token !== account.refresh_token || current?.access_token !== account.access_token) throw new Error('Google connection changed during revocation');
+      commit(id, null, 'disconnected'); return { account_id: id, disconnected: true };
+    },
+  };
+}

package/src/host-runtime.mjs

@@ -0,0 +1,7 @@
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+export function importHostModule(relative) {
+  const root = process.env.TR_PACKAGE_ROOT;
+  if (!root || !path.isAbsolute(root) || !/^src\/(core|cli|server)\/[A-Za-z0-9_./-]+\.mjs$/.test(relative) || relative.includes('..')) throw new Error('Explicit valid Total Recall host runtime required');
+  return import(pathToFileURL(path.join(root, relative)).href);
+}

package/src/leader-election.mjs

@@ -0,0 +1,9 @@
+import { importHostModule } from './host-runtime.mjs';
+const { loadPluginModule } = await importHostModule('src/core/plugin-runtime.mjs');
+export async function FAILOVER_BOUND_MS(...args) { return (await loadPluginModule('mesh', 'leader-election')).FAILOVER_BOUND_MS(...args); }
+export async function leaderPin(...args) { return (await loadPluginModule('mesh', 'leader-election')).leaderPin(...args); }
+export async function getLeaderInfo(...args) { return (await loadPluginModule('mesh', 'leader-election')).getLeaderInfo(...args); }
+export async function isLeader(...args) { return (await loadPluginModule('mesh', 'leader-election')).isLeader(...args); }
+export async function tryAcquireLease(...args) { return (await loadPluginModule('mesh', 'leader-election')).tryAcquireLease(...args); }
+export async function renewLease(...args) { return (await loadPluginModule('mesh', 'leader-election')).renewLease(...args); }
+export async function releaseLease(...args) { return (await loadPluginModule('mesh', 'leader-election')).releaseLease(...args); }

package/src/logger.mjs

@@ -0,0 +1,3 @@
+import { importHostModule } from './host-runtime.mjs';
+const hostModule = await importHostModule('src/core/logger.mjs');
+export const { logEvents, logger, LOG_DIR, getLogFile } = hostModule;