quilltap 4.9.0-dev → 4.9.0-dev.102

package/README.md

@@ -182,6 +182,7 @@ quilltap docs export <mount> <outputDir>        # Mount → directory
 quilltap docs find <pattern>                    # Substring match on file names (--mount, --ext, --type, --limit)
 quilltap docs grep <pattern>                    # Substring match on extracted text (--mount, --ignore-case, -l, --max, --context)
 quilltap docs status                            # Per-mount extraction + embedding rollup (--mount, --top)
+quilltap docs docker-mounts                     # Bind mounts filesystem stores need under Docker (--format args|json)
 
 # Server-required
 quilltap docs scan <mount>                                    # Trigger a rescan
@@ -391,8 +392,11 @@ Fish picks new completion files up automatically — no shell restart needed.
 
 - **Subcommands**: `quilltap d<TAB>` → `db docs`
 - **Sub-verbs per namespace**: `quilltap db s<TAB>` → `schema show`
+- **Flags per verb**: `quilltap docs docker-mounts --<TAB>` → the flags that verb accepts
 - **Instance names**: `quilltap --instance Fr<TAB>` → registered instances
-- **Mount names**: `quilltap docs ls --mount Qu<TAB>` → mount points in the active instance
+- **Mount names**: both `--mount` and the positional a verb takes — `quilltap docs ls Qu<TAB>`, and either end of `docs move`/`copy`/`link`
+
+Completions **parse the line rather than counting words**, so a flag typed anywhere the CLI itself accepts one does not derail them: `quilltap docs --instance Friday <TAB>` still offers the `docs` verbs. bash and zsh also reuse the `-i` / `-d` / `--passphrase` already on the line when looking store names up, so the names offered come from the instance you are addressing rather than the default one. fish completes `--mount` but not the positionals, and always reads the default instance.
 
 Dynamic completions shell out to `quilltap`'s own subcommands. If the active instance is encrypted and no passphrase is reachable, the completion silently returns nothing rather than prompting in the middle of a tab.
 

package/bin/quilltap.js

@@ -264,23 +264,47 @@ function linkNativeModules(standaloneDir) {
   const sharpDir = resolveModuleDir('sharp');
   linkModule('sharp', sharpDir);
 
-  // Link sharp's @img platform packages — they live near sharp's location
-  if (sharpDir) {
-    const sharpParent = path.dirname(sharpDir);
-
-    // If sharp is in a scoped dir or regular node_modules, look for @img there
-    const imgDir = path.join(sharpParent, '@img');
-    if (fs.existsSync(imgDir)) {
-      try {
-        const imgPackages = fs.readdirSync(imgDir).filter(name => name.startsWith('sharp-'));
-        for (const pkg of imgPackages) {
-          linkModule(`@img/${pkg}`, path.join(imgDir, pkg));
-        }
-      } catch {
-        // Non-fatal — sharp may work without explicit @img links
+  // Link a scoped native's platform-specific siblings (@img/sharp-*,
+  // @napi-rs/canvas-*). Both wrappers require their binary as a SCOPE-SIBLING
+  // — `@img/sharp-darwin-arm64` from inside `@img/sharp` — so the binary has to
+  // sit in the same node_modules the wrapper was resolved from. It cannot be
+  // inherited: the standalone tree lives in the download cache
+  // (~/Library/Caches/Quilltap/standalone and friends), far outside this
+  // package's node_modules, so Node's upward walk never reaches the copy npm
+  // installed for us. Linking the wrapper without its siblings therefore
+  // produces a wrapper that resolves and then throws at first use.
+  function linkScopedPlatformSiblings(scope, prefix, wrapperName, wrapperDir) {
+    if (!wrapperDir) return;
+    // Walk back exactly as many segments as the wrapper's own name has, so this
+    // works whether the wrapper is unscoped ('sharp' -> one) or scoped
+    // ('@napi-rs/canvas' -> two). Counting fixed levels would silently resolve
+    // one directory too high for sharp and miss @img entirely.
+    let nodeModulesDir = wrapperDir;
+    for (let i = 0; i < wrapperName.split('/').length; i++) {
+      nodeModulesDir = path.dirname(nodeModulesDir);
+    }
+    const scopeDir = path.join(nodeModulesDir, scope);
+    if (!fs.existsSync(scopeDir)) return;
+    try {
+      for (const name of fs.readdirSync(scopeDir)) {
+        if (!name.startsWith(prefix)) continue;
+        linkModule(`${scope}/${name}`, path.join(scopeDir, name));
       }
+    } catch {
+      // Non-fatal — the wrapper may still find a binary by another route.
     }
   }
+
+  linkScopedPlatformSiblings('@img', 'sharp-', 'sharp', sharpDir);
+
+  // Link @napi-rs/canvas (pdfjs-dist's PDF rasteriser) the same way sharp is
+  // handled: build-standalone-tarball.mjs strips every @napi-rs/canvas-* binary
+  // from the tarball, so without this the standalone tree keeps only the JS
+  // wrapper and PDF rendering dies on a missing native. The wrapper is scoped,
+  // so it needs its siblings linked alongside it.
+  const canvasDir = resolveModuleDir('@napi-rs/canvas');
+  linkModule('@napi-rs/canvas', canvasDir);
+  linkScopedPlatformSiblings('@napi-rs', 'canvas-', '@napi-rs/canvas', canvasDir);
 }
 
 // Main
@@ -505,8 +529,8 @@ function handleLockCommand(dataDir, opts) {
     } else if (alive && !isNode) {
       status = '\x1b[33mSUSPECT\x1b[0m (PID alive but does not look like Quilltap — possible PID reuse)';
     } else if (!sameHost) {
-      // Different hostname — could be a VM/container on this machine
-      const isVMOrContainer = ['docker', 'lima', 'wsl2'].includes(lock.environment);
+      // Different hostname — could be a container on this machine
+      const isVMOrContainer = lock.environment === 'docker';
       const heartbeatAgeMs = lock.lastHeartbeat
         ? Date.now() - new Date(lock.lastHeartbeat).getTime()
         : Infinity;
@@ -589,8 +613,8 @@ function handleLockCommand(dataDir, opts) {
         console.log('This is likely a stale lock with a reused PID. Removing.');
       }
     } else if (!sameHost) {
-      // Different hostname — check if it's a VM/container with a recent heartbeat
-      const isVMOrContainer = ['docker', 'lima', 'wsl2'].includes(lock.environment);
+      // Different hostname — check if it's a container with a recent heartbeat
+      const isVMOrContainer = lock.environment === 'docker';
       const heartbeatAgeMs = lock.lastHeartbeat
         ? Date.now() - new Date(lock.lastHeartbeat).getTime()
         : Infinity;

package/lib/__tests__/completion-behavior.test.js

@@ -0,0 +1,162 @@
+/**
+ * Behavioural guard for the shell-completion templates.
+ *
+ * The static coverage test next door proves every subcommand is *mentioned*.
+ * This one proves the completions still fire once flags are on the line — the
+ * failure the templates actually shipped with: `quilltap docs --instance
+ * Friday <TAB>` offered nothing, because the verb was looked up by counting
+ * words rather than by parsing them.
+ *
+ * Bash is driven for real (source the script, set COMP_WORDS/COMP_CWORD, read
+ * COMPREPLY back). Zsh's completion system can only be driven from inside a
+ * completion widget, so its template is checked structurally instead.
+ *
+ * The one zsh assertion that needs a real `zsh` — the parse check — skips
+ * where the shell isn't installed. Bash is on every machine that runs this
+ * suite; zsh is not (GitHub's ubuntu runners ship without it, which is why
+ * CI's test job installs it before calling jest).
+ *
+ * @jest-environment node
+ */
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const COMPLETION_DIR = path.join(__dirname, '..', 'completion');
+
+/** A `quilltap` on PATH that answers the completion lookups deterministically. */
+function makeStubBin() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'quilltap-completion-'));
+  const stub = path.join(dir, 'quilltap');
+  fs.writeFileSync(
+    stub,
+    [
+      '#!/bin/sh',
+      'case "$*" in',
+      '  *"instances list --names-only"*) printf "StubInstance\\n" ;;',
+      '  *"docs list --names-only"*) printf "Stub Store\\nOther Store\\n" ;;',
+      'esac',
+      'exit 0',
+      '',
+    ].join('\n'),
+    { mode: 0o755 }
+  );
+  return dir;
+}
+
+const STUB_BIN = makeStubBin();
+afterAll(() => fs.rmSync(STUB_BIN, { recursive: true, force: true }));
+
+/** Whether a real `zsh` exists to hand a script to. */
+const HAS_ZSH = (() => {
+  try {
+    execFileSync('zsh', ['-c', ':'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+})();
+
+/**
+ * Complete `line` with the bash template and return the candidate list.
+ * A trailing space means "start a new word", exactly as at a real prompt.
+ */
+function bashComplete(line) {
+  const script = `
+    source ${JSON.stringify(path.join(COMPLETION_DIR, 'bash.template'))}
+    COMP_LINE=${JSON.stringify(line)}
+    COMP_POINT=\${#COMP_LINE}
+    eval "COMP_WORDS=(\$COMP_LINE)"
+    [[ "\$COMP_LINE" =~ [[:space:]]$ ]] && COMP_WORDS+=("")
+    COMP_CWORD=\$(( \${#COMP_WORDS[@]} - 1 ))
+    _quilltap_complete
+    printf '%s\\n' "\${COMPREPLY[@]}"
+  `;
+  return execFileSync('bash', ['-c', script], {
+    encoding: 'utf8',
+    env: { ...process.env, PATH: `${STUB_BIN}:${process.env.PATH}` },
+  })
+    .split('\n')
+    .filter(Boolean);
+}
+
+describe('bash completion survives flags on the line', () => {
+  it('offers docs verbs with no flags', () => {
+    expect(bashComplete('quilltap docs ')).toContain('list');
+  });
+
+  it.each([
+    ['an instance flag', 'quilltap docs --instance Friday '],
+    ['a short instance flag', 'quilltap docs -i Friday '],
+    ['a subcommand flag that takes a value', 'quilltap docs --limit 5 '],
+    ['a valueless flag', 'quilltap docs --json '],
+    ['flags on both sides', 'quilltap --instance Friday docs --json '],
+  ])('still offers docs verbs after %s', (_label, line) => {
+    expect(bashComplete(line)).toContain('list');
+  });
+
+  it('still offers db verbs after a flag', () => {
+    expect(bashComplete('quilltap db --limit 5 ')).toContain('characters');
+  });
+
+  it('still offers db characters verbs after a flag', () => {
+    expect(bashComplete('quilltap db characters --instance Friday ')).toContain('status');
+  });
+
+  it('treats -i as --ignore-case under memories, not --instance', () => {
+    const got = bashComplete('quilltap memories -i ');
+    expect(got).toContain('ls');
+    expect(got).not.toContain('StubInstance');
+  });
+});
+
+describe('bash completion looks up names against the addressed instance', () => {
+  it('completes --mount from the document stores', () => {
+    expect(bashComplete('quilltap docs --mount ')).toContain('Stub\\ Store');
+  });
+
+  it('completes a store positional for verbs that take one', () => {
+    expect(bashComplete('quilltap docs ls ')).toContain('Stub\\ Store');
+  });
+
+  it('completes the destination store of a move', () => {
+    expect(bashComplete('quilltap docs move Src a.md ')).toContain('Stub\\ Store');
+  });
+
+  it('does not offer stores where the verb takes none', () => {
+    expect(bashComplete('quilltap docs find ')).not.toContain('Stub\\ Store');
+  });
+});
+
+describe('zsh completion parses positions instead of counting words', () => {
+  const tpl = fs.readFileSync(path.join(COMPLETION_DIR, 'zsh.template'), 'utf8');
+
+  it('has no hard-coded word-index tests', () => {
+    // `(( CURRENT == 2 ))` is the bug: it only holds when the verb sits
+    // immediately after the subcommand, so any preceding flag hides it.
+    expect(tpl).not.toMatch(/\(\(\s*CURRENT\s*==/);
+  });
+
+  it('stops the top-level _arguments swallowing flags typed after the subcommand', () => {
+    // Without the (-) prefixes the rest-argument array comes back empty and
+    // _quilltap_subcommand has nothing to dispatch on.
+    expect(tpl).toContain("'(-): :->subcommand'");
+    expect(tpl).toContain("'(-)*::arg:->args'");
+  });
+
+  it('hands every subcommand verb to _arguments as a positional', () => {
+    const dispatchers = tpl.match(/'\(?-?\)?1: :->\w+'/g) || [];
+    expect(dispatchers.length).toBeGreaterThanOrEqual(6);
+  });
+
+  // Needs the shell itself; skipped rather than failed where it is absent.
+  (HAS_ZSH ? it : it.skip)('is syntactically valid', () => {
+    const file = path.join(STUB_BIN, '_quilltap');
+    fs.writeFileSync(file, tpl);
+    expect(() => execFileSync('zsh', ['-n', file], { stdio: 'pipe' })).not.toThrow();
+  });
+});

package/lib/__tests__/completion-coverage.test.js

@@ -94,3 +94,98 @@ describe('every subcommand has its own completion arm', () => {
     expect(noFlags).toEqual([]);
   });
 });
+
+/**
+ * The arm-per-subcommand check above is still too coarse: `docs docker-mounts`
+ * had its own arm in all three shells while `--format`, its only flag, was
+ * offered by none of them. A flag documented in a subcommand's own `--help` is
+ * the contract the user reads, so that text is the source of truth here —
+ * whatever `--help` advertises, the three templates must offer.
+ *
+ * Each entry names the single function whose template literal prints that
+ * subcommand's help.
+ */
+const HELP_SOURCES = {
+  db: ['bin/quilltap.js', 'printDbHelp'],
+  docs: ['lib/docs-commands.js', 'printDocsHelp'],
+  memories: ['lib/memories-commands.js', 'printMemoriesHelp'],
+  themes: ['lib/theme-commands.js', 'printHelp'],
+  instances: ['lib/instances-commands.js', 'printHelp'],
+  logs: ['lib/logs-commands.js', 'printLogsHelp'],
+  migrations: ['lib/migrations-commands.js', 'printHelp'],
+  maintenance: ['lib/maintenance-commands.js', 'printHelp'],
+  'file-verify': ['lib/file-verify-commands.js', 'printHelp'],
+  'memory-diff': ['lib/memory-diff-command.js', 'printMemoryDiffHelp'],
+  'recall-replay': ['lib/recall-replay-command.js', 'printRecallReplayHelp'],
+  completion: ['lib/completion-commands.js', 'printCompletionHelp'],
+};
+
+const PKG_ROOT = path.join(__dirname, '..', '..');
+
+/**
+ * Long flags named anywhere in one subcommand's help text. The declaration
+ * pattern tolerates arbitrary whitespace and an `async`/parameter list, so
+ * reformatting a help function does not fail a test about its content.
+ */
+function flagsInHelp(relPath, fnName) {
+  const src = fs.readFileSync(path.join(PKG_ROOT, relPath), 'utf8');
+  const decl = String.raw`(?:async\s+)?function\s+${fnName}\s*\([^)]*\)\s*\{`;
+  const body = src.match(new RegExp(`${decl}([\\s\\S]*?)\\n\\}`));
+  if (!body) throw new Error(`Could not locate ${fnName}() in ${relPath}`);
+  return [...new Set(body[1].match(/--[a-z0-9][a-z0-9-]+/g) || [])].sort();
+}
+
+/**
+ * `--max` is a prefix of `--max-nodes`, so a plain substring test passes for a
+ * flag that is not actually there. Require the match to end at a non-flag
+ * character.
+ */
+function mentionsFlag(haystack, flag) {
+  return new RegExp(`${flag}(?![a-z0-9-])`).test(haystack);
+}
+
+describe('completions offer every flag the help text advertises', () => {
+  it('covers every subcommand in the dispatch table', () => {
+    // A new subcommand needs a help source here, or its flags go unchecked.
+    expect(Object.keys(HELP_SOURCES).sort()).toEqual([...SUBCOMMANDS].sort());
+  });
+
+  const cases = Object.entries(HELP_SOURCES).flatMap(([sub, [file, fn]]) =>
+    ['bash', 'zsh', 'fish'].map((shell) => [sub, shell, file, fn])
+  );
+
+  it.each(cases)('%s: %s template offers every documented flag', (sub, shell, file, fn) => {
+    const tpl = fs.readFileSync(path.join(COMPLETION_DIR, `${shell}.template`), 'utf8');
+    // fish spells the flag `-l 'name'`, already an exact quoted token.
+    const present = (flag) =>
+      shell === 'fish' ? tpl.includes(`-l '${flag.slice(2)}'`) : mentionsFlag(tpl, flag);
+    const missing = flagsInHelp(file, fn).filter((flag) => !present(flag));
+    expect(missing).toEqual([]);
+  });
+});
+
+/**
+ * bash cannot infer which flags swallow the next word, so it carries explicit
+ * `vf_*` lists. A valued flag missing from its list makes the flag's value look
+ * like the subcommand's verb — the bug 101 failure mode. zsh and fish take the
+ * value from the flag's own spec, so only bash needs guarding.
+ */
+describe('bash knows which docs flags take a value', () => {
+  it('lists every valued docs flag in vf_docs', () => {
+    const tpl = fs.readFileSync(path.join(COMPLETION_DIR, 'bash.template'), 'utf8');
+    // The scanner reads `$vf_global$vf_docs`, so a flag in either list counts.
+    const vfGlobal = tpl.match(/local vf_global="([^"]*)"/);
+    const vfDocs = tpl.match(/local vf_docs="([^"]*)"/);
+    expect(vfGlobal).toBeTruthy();
+    expect(vfDocs).toBeTruthy();
+    const scanned = new Set(`${vfGlobal[1]} ${vfDocs[1]}`.trim().split(/\s+/));
+    // A docs flag zsh declares with a `:value:` spec is by definition valued.
+    const zsh = fs.readFileSync(path.join(COMPLETION_DIR, 'zsh.template'), 'utf8');
+    const docsOpts = zsh.match(/docs_opts=\(([\s\S]*?)\n  \)/);
+    expect(docsOpts).toBeTruthy();
+    const valued = [...docsOpts[1].matchAll(/'(--[a-z0-9-]+)\[[^\]]*\]:[^']*'/g)].map((m) => m[1]);
+    expect(valued.length).toBeGreaterThan(5);
+    const missing = valued.filter((flag) => !scanned.has(flag));
+    expect(missing).toEqual([]);
+  });
+});

package/lib/__tests__/dbkey-restore.test.js

@@ -0,0 +1,162 @@
+/**
+ * `quilltap instances restore-key` — the guards that stand between an operator
+ * with a pepper and a `.dbkey` that would brick an instance.
+ *
+ * The load-bearing one is the pepper proof: a key file holding the WRONG
+ * pepper is worse than none at all, because the server unwraps it happily and
+ * then reports an intact database as corrupt. So the proof runs against real
+ * SQLCipher files, not the suite's `better-sqlite3` mock — the mock would open
+ * anything.
+ *
+ * @jest-environment node
+ */
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+
+const PKG_ROOT = path.join(__dirname, '..', '..');
+
+// The root jest config maps both driver names onto __mocks__/better-sqlite3.ts,
+// which accepts any key. Point them back at the real binding by absolute path
+// so a wrong pepper actually fails to decrypt.
+//
+// Two copies can back this: the per-package install used in local development,
+// and — in CI, where only the root `npm ci` runs — the root alias, where
+// package.json installs better-sqlite3-multiple-ciphers under the name
+// `better-sqlite3`. Same fallback chain as the __tests__/unit/packages/quilltap
+// integration suites.
+jest.mock('better-sqlite3-multiple-ciphers', () => {
+  const join = require('path').join;
+  try {
+    return require(join(PKG_ROOT, 'node_modules', 'better-sqlite3-multiple-ciphers'));
+  } catch {
+    return require(join(PKG_ROOT, '..', '..', 'node_modules', 'better-sqlite3'));
+  }
+});
+
+const Database = require('better-sqlite3-multiple-ciphers');
+const { provePepper, databaseState } = require('../dbkey-restore');
+const {
+  INTERNAL_PASSPHRASE,
+  encryptDbKey,
+  decryptDbKey,
+  tryDecryptDbKey,
+  preserveExtraFields,
+  readDbKeyFile,
+  writeDbKeyFile,
+} = require('../dbkey');
+
+const PEPPER = crypto.randomBytes(32).toString('base64');
+const OTHER_PEPPER = crypto.randomBytes(32).toString('base64');
+
+let dataDir;
+
+function seedEncryptedDb(filename, pepper) {
+  const db = new Database(path.join(dataDir, filename));
+  db.pragma(`key = "x'${Buffer.from(pepper, 'base64').toString('hex')}'"`);
+  db.exec("CREATE TABLE t (a TEXT); INSERT INTO t VALUES ('hello');");
+  db.close();
+}
+
+function seedPlaintextDb(filename) {
+  const db = new Database(path.join(dataDir, filename));
+  db.exec('CREATE TABLE t (a TEXT);');
+  db.close();
+}
+
+beforeEach(() => {
+  dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'qtap-restore-'));
+});
+
+afterEach(() => {
+  fs.rmSync(dataDir, { recursive: true, force: true });
+});
+
+describe('databaseState', () => {
+  it('reads the SQLite magic to tell plaintext from SQLCipher', () => {
+    seedPlaintextDb('plain.db');
+    seedEncryptedDb('enc.db', PEPPER);
+
+    expect(databaseState(path.join(dataDir, 'plain.db'))).toBe('plaintext');
+    expect(databaseState(path.join(dataDir, 'enc.db'))).toBe('encrypted');
+    expect(databaseState(path.join(dataDir, 'nope.db'))).toBe('absent');
+  });
+});
+
+describe('provePepper', () => {
+  it('proves the right pepper against every encrypted database', () => {
+    seedEncryptedDb('quilltap.db', PEPPER);
+    seedEncryptedDb('quilltap-llm-logs.db', PEPPER);
+    seedEncryptedDb('quilltap-mount-index.db', PEPPER);
+
+    const { proved, results } = provePepper(dataDir, PEPPER);
+    expect(proved).toBe(true);
+    expect(results.every((r) => r.ok === true)).toBe(true);
+  });
+
+  it('refuses a pepper that does not open the databases', () => {
+    seedEncryptedDb('quilltap.db', PEPPER);
+
+    const { proved, results } = provePepper(dataDir, OTHER_PEPPER);
+    expect(proved).toBe(false);
+    expect(results.find((r) => r.filename === 'quilltap.db').ok).toBe(false);
+  });
+
+  it('reports one bad database among good ones rather than averaging it away', () => {
+    seedEncryptedDb('quilltap.db', PEPPER);
+    seedEncryptedDb('quilltap-llm-logs.db', OTHER_PEPPER);
+
+    const { proved, results } = provePepper(dataDir, PEPPER);
+    expect(proved).toBe(false);
+    expect(results.find((r) => r.filename === 'quilltap.db').ok).toBe(true);
+    expect(results.find((r) => r.filename === 'quilltap-llm-logs.db').ok).toBe(false);
+  });
+
+  it('cannot prove anything when the databases are absent or still plaintext', () => {
+    expect(provePepper(dataDir, PEPPER).proved).toBe(false);
+
+    seedPlaintextDb('quilltap.db');
+    const { proved, results } = provePepper(dataDir, PEPPER);
+    expect(proved).toBe(false);
+    expect(results.find((r) => r.filename === 'quilltap.db')).toMatchObject({
+      state: 'plaintext',
+      ok: null,
+    });
+  });
+});
+
+describe('rewrapping a key file', () => {
+  it('round-trips the pepper under a new passphrase', () => {
+    writeDbKeyFile(dataDir, encryptDbKey(PEPPER, INTERNAL_PASSPHRASE));
+    expect(decryptDbKey(readDbKeyFile(dataDir), INTERNAL_PASSPHRASE)).toBe(PEPPER);
+
+    writeDbKeyFile(dataDir, encryptDbKey(PEPPER, 'the lamplighter'));
+    const rewrapped = readDbKeyFile(dataDir);
+    expect(tryDecryptDbKey(rewrapped, INTERNAL_PASSPHRASE)).toBeNull();
+    expect(decryptDbKey(rewrapped, 'the lamplighter')).toBe(PEPPER);
+  });
+
+  it('carries fields the wrapping does not own across the rebuild', () => {
+    // `minServerVersion` is written by lib/startup/version-guard.ts for the
+    // Electron shell's pre-launch check. Dropping it on a rewrap would take
+    // the version floor with it.
+    const existing = encryptDbKey(PEPPER, INTERNAL_PASSPHRASE);
+    existing.minServerVersion = '4.9.0-dev.91';
+
+    const fresh = preserveExtraFields(existing, encryptDbKey(PEPPER, 'the lamplighter'));
+
+    expect(fresh.minServerVersion).toBe('4.9.0-dev.91');
+    expect(fresh.salt).not.toBe(existing.salt);
+    expect(decryptDbKey(fresh, 'the lamplighter')).toBe(PEPPER);
+  });
+
+  it('writes the key file owner-only', () => {
+    writeDbKeyFile(dataDir, encryptDbKey(PEPPER, INTERNAL_PASSPHRASE));
+    const mode = fs.statSync(path.join(dataDir, 'quilltap.dbkey')).mode & 0o777;
+    expect(mode).toBe(0o600);
+  });
+});