quoxcli 0.4.0 → 0.6.0

package/lib/commands/notesSeal.js

@@ -0,0 +1,617 @@
+/**
+ * quox notes seal init|status|new|open|edit|print: ENQRYPT sealed notes (ENQRYPT stream E4, enqrypt ADR-0001/0002/0003).
+ *
+ * Sealing and opening happen HERE, on the client, with the owner's ENQRYPT identity (passphrase-protected key
+ * file, default ~/.quox/enqrypt). NotesQ only ever receives the sealed envelope: the server, the collector and
+ * agents cannot read a sealed note. Titles, collections and tags are NOT sealed (they stay searchable).
+ * ENQRYPT is an adapter dependency, loaded on demand; core Quox does not need it.
+ */
+import { readFileSync, existsSync, mkdirSync, statSync, lstatSync, openSync, writeSync, closeSync, fsyncSync, renameSync, unlinkSync } from 'fs';
+import { homedir } from 'os';
+import { join, resolve, dirname } from 'path';
+import { randomUUID, randomBytes, createHash } from 'crypto';
+import { pathToFileURL } from 'url';
+import { QuoxError, QuoxApiError } from '../core/errors.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+export const SEAL_PURPOSE = 'notesq.note';
+export const SEAL_MARK = 'enqrypt-sealed-note';
+const FENCE = 'enqrypt-envelope';
+const FP_RE = /^[0-9a-f]{64}$/;
+const B64U_RE = /^[A-Za-z0-9_-]+$/;
+
+export const keystoreDir = (opt) => resolve(opt || join(homedir(), '.quox', 'enqrypt'));
+
+/** Markdown NotesQ stores for a sealed note: a heading, a plain explanation, and the envelope. Nothing secret. */
+export function sealedNoteMarkdown({ title, envelope, fingerprint }) {
+  const b64 = Buffer.from(envelope).toString('base64url');
+  const wrapped = b64.match(/.{1,76}/g).join('\n');
+  return `# ${title}\n\n🔐 Sealed with ENQRYPT (HPKE, RFC 9180). The server stores only this envelope and cannot read it.\n`
+    + `Open it on a device holding the key with fingerprint \`${fingerprint.slice(0, 16)}…\`: \`quox notes seal open <id>\`\n\n`
+    + '```' + FENCE + '\n' + wrapped + '\n```\n';
+}
+
+export function extractEnvelope(markdown) {
+  const blocks = [...String(markdown || '').matchAll(new RegExp('```' + FENCE + '\\n([\\s\\S]*?)\\n```', 'g'))];
+  if (blocks.length !== 1) throw new QuoxError(blocks.length ? 'This note has more than one ENQRYPT envelope; refusing to guess.' : 'This note holds no ENQRYPT envelope.', 1);
+  const b64 = blocks[0][1].replace(/\n/g, '');
+  if (!B64U_RE.test(b64)) throw new QuoxError('The ENQRYPT envelope in this note is damaged.', 1);
+  return new Uint8Array(Buffer.from(b64, 'base64url'));
+}
+
+export function sealProperties({ fingerprint, objectId, version, collection, tags }) {
+  const p = { enqrypt: SEAL_MARK, enqrypt_fp: fingerprint, enqrypt_object: objectId, enqrypt_version: version };
+  if (collection) p.collection = collection;
+  if (tags) p.tags = tags;
+  return p;
+}
+
+export function readSealProperties(props) {
+  const p = props || {};
+  const version = Number(p.enqrypt_version);
+  if (p.enqrypt !== SEAL_MARK) throw new QuoxError('This note is not an ENQRYPT sealed note.', 1);
+  if (!FP_RE.test(String(p.enqrypt_fp)) || !/^[0-9a-f-]{36}$/.test(String(p.enqrypt_object)) || !Number.isSafeInteger(version) || version < 1) {
+    throw new QuoxError('This sealed note has damaged ENQRYPT properties.', 1);
+  }
+  return { fingerprint: p.enqrypt_fp, objectId: p.enqrypt_object, version };
+}
+
+// Rollback floor: the highest version this client has opened or written per sealed object. Older envelopes are
+// refused. ENQRYPT-NOTES F11: the floor fails CLOSED. A floor file that is damaged, unreadable or not a floor map is
+// refused, never read as 0; a floor file that has been used before (marker file, or a floor already seen in this
+// process) and is now missing is refused too. Only a keystore that has never recorded a floor starts at 0. Writes
+// are a fresh read, merge and atomic replace (temp file, fsync, rename) under a cross-process lock file, modelled on
+// the ENQRYPT CLI's state files, so concurrent quox processes cannot lose each other's floors.
+const floorFile = (dir) => join(dir, 'notes-floor.json');
+const floorMarker = (dir) => join(dir, 'notes-floor.used');
+const FLOOR_LOCK_STALE_MS = 30_000;
+const FLOOR_LOCK_TIMEOUT_MS = 10_000;
+const seenFloors = new Map(); // resolved dir -> Map(objectId -> highest floor seen in this process)
+
+function floorRefusal(dir, why) {
+  return new QuoxError(
+    `The ENQRYPT rollback floor file ${floorFile(dir)} is ${why}, so this device cannot tell whether the server is serving an older version of a sealed note. Nothing was opened or written. `
+    + `Restore it from a backup of ${dir}. Only if you accept that an older version could be accepted once, delete ${floorFile(dir)} and ${floorMarker(dir)} to start the floors again.`, 1);
+}
+
+function memFloors(dir) {
+  const k = resolve(dir);
+  if (!seenFloors.has(k)) seenFloors.set(k, new Map());
+  return seenFloors.get(k);
+}
+
+// RT-13: the floor, its marker, the binding record and the lock are files this CLI writes itself (atomic rename,
+// never through a link). A symbolic link in their place was planted, so it is refused, never followed.
+const isLink = (p) => { try { return lstatSync(p).isSymbolicLink(); } catch { return false; } };
+function markerPresent(dir) {
+  if (isLink(floorMarker(dir))) throw floorRefusal(dir, 'unverifiable (its marker file is a symbolic link)');
+  return existsSync(floorMarker(dir));
+}
+
+function loadFloors(dir) {
+  let text;
+  if (isLink(floorFile(dir))) throw floorRefusal(dir, 'a symbolic link (not a file this device wrote)');
+  try { text = readFileSync(floorFile(dir), 'utf8'); } catch (e) {
+    if (e && e.code === 'ENOENT') {
+      if (markerPresent(dir) || memFloors(dir).size > 0) throw floorRefusal(dir, 'missing');
+      return {};
+    }
+    throw floorRefusal(dir, `unreadable (${e && e.code ? e.code : 'read error'})`);
+  }
+  let all;
+  try { all = JSON.parse(text); } catch { throw floorRefusal(dir, 'damaged (not valid JSON)'); }
+  if (!all || typeof all !== 'object' || Array.isArray(all)) throw floorRefusal(dir, 'damaged (not a floor map)');
+  for (const v of Object.values(all)) {
+    if (!Number.isSafeInteger(v) || v < 1) throw floorRefusal(dir, 'damaged (a floor is not a positive whole number)');
+  }
+  return all;
+}
+
+export function readFloor(dir, objectId) {
+  const fromFile = Number(loadFloors(dir)[objectId]) || 0;
+  return Math.max(fromFile, memFloors(dir).get(objectId) || 0);
+}
+
+const sleepSync = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+function readLockFile(lock) {
+  if (isLink(lock)) return { pid: 0, t: 0, nonce: '', link: true }; // RT-13/14: never follow a planted link
+  try { return JSON.parse(readFileSync(lock, 'utf8')); } catch (e) { return e.code === 'ENOENT' ? null : { pid: 0, t: 0, nonce: '' }; }
+}
+function lockAge(lock) {
+  try { return Date.now() - lstatSync(lock).mtimeMs; } catch { return 0; }
+}
+// RT-14: a lock whose time is further in the future than the stale bound (clock skew, or planted) is stale too,
+// otherwise it would block every seal command forever.
+const lockAged = (p) => { const age = lockAge(p); return age > FLOOR_LOCK_STALE_MS || age < -FLOOR_LOCK_STALE_MS; };
+function breakStaleLock(lock, seen) {
+  const brk = `${lock}.break`;
+  let fd;
+  try { fd = openSync(brk, 'wx', 0o600); } catch (e) {
+    if (e.code !== 'EEXIST') throw e;
+    if (lockAged(brk)) { try { unlinkSync(brk); } catch { /* raced */ } }
+    return;
+  }
+  try {
+    const now = readLockFile(lock);
+    if (now && now.nonce === seen.nonce) { try { unlinkSync(lock); } catch { /* raced */ } }
+  } finally { closeSync(fd); try { unlinkSync(brk); } catch { /* raced */ } }
+}
+function withFloorLock(dir, fn) {
+  const lock = `${floorFile(dir)}.lock`;
+  const nonce = randomUUID();
+  const deadline = Date.now() + FLOOR_LOCK_TIMEOUT_MS;
+  for (;;) {
+    let fd = null;
+    try { fd = openSync(lock, 'wx', 0o600); } catch (e) { if (e.code !== 'EEXIST') throw e; }
+    if (fd !== null) {
+      try { writeSync(fd, JSON.stringify({ pid: process.pid, t: Date.now(), nonce })); } finally { closeSync(fd); }
+      break;
+    }
+    const held = readLockFile(lock);
+    if (held) {
+      // A lock with no nonce yet (holder between create and write) is only judged stale once it is old.
+      const stale = held.link || (held.nonce ? (!pidAlive(held.pid) || lockAged(lock)) : lockAged(lock));
+      if (stale) { breakStaleLock(lock, held); continue; }
+    }
+    if (Date.now() > deadline) throw new QuoxError(`The ENQRYPT rollback floor file is locked by another quox process (${lock}). Nothing was written; try again.`, 1);
+    sleepSync(5 + Math.floor(Math.random() * 20));
+  }
+  try { return fn(); } finally {
+    const h = readLockFile(lock);
+    if (h && h.nonce === nonce) { try { unlinkSync(lock); } catch { /* already gone */ } }
+  }
+}
+function atomicWrite(file, data) {
+  const tmp = `${file}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    const fd = openSync(tmp, 'wx', 0o600);
+    try { writeSync(fd, data); fsyncSync(fd); } finally { closeSync(fd); }
+    renameSync(tmp, file);
+  } catch (e) { try { unlinkSync(tmp); } catch { /* not created */ } throw e; }
+  try { const d = openSync(dirname(file), 'r'); try { fsyncSync(d); } finally { closeSync(d); } } catch { /* directory fsync is best effort */ }
+}
+
+export function bumpFloor(dir, objectId, version) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  withFloorLock(dir, () => {
+    const all = loadFloors(dir); // fresh read inside the lock; a damaged file refuses rather than being overwritten
+    const mem = memFloors(dir);
+    const next = Math.max(Number(all[objectId]) || 0, mem.get(objectId) || 0, version);
+    if (all[objectId] !== next) {
+      all[objectId] = next;
+      atomicWrite(floorFile(dir), JSON.stringify(all, null, 2) + '\n');
+    }
+    if (!markerPresent(dir)) atomicWrite(floorMarker(dir), 'This keystore has recorded ENQRYPT rollback floors in notes-floor.json. Do not delete either file.\n');
+    mem.set(objectId, next);
+  });
+}
+
+// NOTE BINDING (red team RT-15). ENQRYPT authenticates (op, purpose, objectId) but not which NotesQ note an
+// envelope belongs to, so a server could serve note A's envelope (and properties) under note B. A BOUND object id
+// commits to the note id: `<nonce8>-<h4>-0b1d-<h4>-<h12>`, the fixed third group marking the format (never a
+// random v4 UUID, whose third group starts with 4) and h = sha256("notesq.note\0" + noteId + "\0" + nonce). The
+// object id is inside the authenticated envelope, so an envelope bound to note A cannot verify as note B. Notes
+// sealed before binding (random UUID object ids) still open, with a warning; this device also records which object
+// it last saw for each note (notes-bind.json, next to the floor) and refuses a mismatch; `seal edit` re-seals an
+// unbound note under a bound id. `seal new` cannot bind at creation (the server assigns the id after the envelope is
+// sent), so a new note is bound by this device's record until its first `seal edit`.
+const BIND_MARK = '0b1d';
+const bindHash = (noteId, nonce) => createHash('sha256').update(`notesq.note\0${noteId}\0${nonce}`).digest('hex');
+export function bindObjectId(noteId, nonce = randomBytes(4).toString('hex')) {
+  const h = bindHash(noteId, nonce);
+  return `${nonce}-${h.slice(0, 4)}-${BIND_MARK}-${h.slice(4, 8)}-${h.slice(8, 20)}`;
+}
+export const isBoundObjectId = (objectId) => /^[0-9a-f]{8}-[0-9a-f]{4}-0b1d-[0-9a-f]{4}-[0-9a-f]{12}$/.test(String(objectId));
+export function objectBindsNote(objectId, noteId) {
+  if (!isBoundObjectId(objectId) || !noteId) return false;
+  return bindObjectId(String(noteId), String(objectId).slice(0, 8)) === objectId;
+}
+
+const bindFile = (dir) => join(dir, 'notes-bind.json');
+function loadBinds(dir) {
+  let text;
+  if (isLink(bindFile(dir))) throw new QuoxError(`The note binding record ${bindFile(dir)} is a symbolic link (not a file this device wrote). Nothing was opened or written.`, 1);
+  try { text = readFileSync(bindFile(dir), 'utf8'); } catch (e) {
+    if (e && e.code === 'ENOENT') return {};
+    throw new QuoxError(`The note binding record ${bindFile(dir)} is unreadable (${e && e.code ? e.code : 'read error'}). Nothing was opened or written.`, 1);
+  }
+  let all;
+  try { all = JSON.parse(text); } catch { all = null; }
+  if (!all || typeof all !== 'object' || Array.isArray(all) || Object.values(all).some((v) => typeof v !== 'string')) {
+    throw new QuoxError(`The note binding record ${bindFile(dir)} is damaged. Nothing was opened or written. Restore it from a backup of ${dir}.`, 1);
+  }
+  return all;
+}
+export function recordBinding(dir, noteId, objectId) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  withFloorLock(dir, () => {
+    const all = loadBinds(dir);
+    if (all[noteId] === objectId) return;
+    all[noteId] = objectId;
+    atomicWrite(bindFile(dir), JSON.stringify(all, null, 2) + '\n');
+  });
+}
+
+/**
+ * After an envelope OPENED under objectId, check it belongs to noteId. Refuses a swap; warns for an unbound note
+ * this device cannot vouch for. Records the binding. Returns 'bound' | 'recorded' | 'unverified'.
+ */
+export function checkNoteBinding(dir, noteId, objectId, { warn = (m) => console.error(m) } = {}) {
+  const swapped = (why) => new QuoxError(`Refusing note ${noteId}: ${why} The server may be serving another note's sealed envelope under this id. Nothing was shown or written.`, 1);
+  if (isBoundObjectId(objectId)) {
+    if (!objectBindsNote(objectId, noteId)) throw swapped(`its sealed envelope (object ${objectId}) is bound to a different note.`);
+    recordBinding(dir, noteId, objectId);
+    return 'bound';
+  }
+  const all = loadBinds(dir);
+  if (all[noteId] && all[noteId] !== objectId && !objectBindsNote(all[noteId], noteId)) throw swapped(`this device last saw it as sealed object ${all[noteId]}, but the server sent object ${objectId}.`);
+  if (all[noteId] && objectBindsNote(all[noteId], noteId)) throw swapped(`this device last saw it bound to object ${all[noteId]}, but the server sent an unbound envelope (object ${objectId}).`);
+  const other = Object.keys(all).find((k) => k !== noteId && all[k] === objectId);
+  if (other) throw swapped(`its sealed envelope (object ${objectId}) belongs to note ${other} on this device.`);
+  const known = all[noteId] === objectId;
+  if (!known) warn(`Warning: note ${noteId} was sealed before notes were bound to their ids, and this device has no record of it, so it cannot prove the server sent the right note. Re-seal it to bind it: quox notes seal edit ${noteId}`);
+  recordBinding(dir, noteId, objectId);
+  return known ? 'recorded' : 'unverified';
+}
+
+/** A passphrase file must be private to its owner; anything looser is refused rather than trusted. */
+export function readPassphraseFile(path) {
+  const st = statSync(path);
+  if ((st.mode & 0o077) !== 0) throw new QuoxError(`Refusing ${path}: passphrase files must be chmod 600.`, 2);
+  return readFileSync(path, 'utf8').replace(/\r?\n$/, '');
+}
+
+// quox#1675: ENQRYPT is not on npm yet. The CLI looks in QUOX_ENQRYPT_PATH, then its own install location
+// ~/.quox/enqrypt-src (a clone of quoxai/enqrypt main with its dependencies), then the package name. A directory
+// counts only if it holds src/seal.mjs, and what loads must export every function the CLI calls (an old checkout
+// is refused, not half used). A developer's working checkout is never picked up implicitly.
+export const ENQRYPT_PACKAGE = '@quoxai/enqrypt-script';
+export const ENQRYPT_NEEDS = ['createKeystore', 'unlockKeystore', 'readPublicIdentity', 'fingerprint', 'seal', 'open', 'parseEnvelope', 'toAsciiArmor', 'fromAsciiArmor'];
+export const enqryptInstallDir = (home = homedir()) => join(home, '.quox', 'enqrypt-src');
+export function enqryptSources({ env = process.env, home = homedir() } = {}) {
+  const dirs = [env.QUOX_ENQRYPT_PATH, enqryptInstallDir(home)].filter((d, i) => d && (i === 0 || existsSync(join(d, 'src', 'seal.mjs'))));
+  return [...dirs, ENQRYPT_PACKAGE];
+}
+
+export async function loadEnqryptFrom(src, importer = (u) => import(u)) {
+  const at = (sub) => (src === ENQRYPT_PACKAGE ? `${src}/${sub}` : pathToFileURL(join(src, 'src', `${sub}.mjs`)).href);
+  const [seal, keystore, armor] = await Promise.all([importer(at('seal')), importer(at('keystore')), importer(at('armor'))]);
+  const E = { ...seal, ...keystore, ...armor };
+  const missing = ENQRYPT_NEEDS.filter((f) => typeof E[f] !== 'function');
+  if (missing.length) throw new Error(`${src} is too old for quox notes seal (missing ${missing.join(', ')})`);
+  return E;
+}
+
+async function defaultLoadEnqrypt() {
+  const reasons = [];
+  for (const src of enqryptSources()) {
+    try { return await loadEnqryptFrom(src); } catch (e) {
+      if (src !== ENQRYPT_PACKAGE) reasons.push(/too old/.test(e.message) ? e.message : `${src} did not load`);
+    }
+  }
+  const tried = reasons.length ? ` Tried: ${reasons.join('; ')}.` : '';
+  throw new QuoxError(`ENQRYPT is not available on this machine. It is not on npm yet: clone quoxai/enqrypt into ${enqryptInstallDir()} and run \`npm ci\` there, or set QUOX_ENQRYPT_PATH to a checkout.${tried} Never \`npm install enqrypt\`: that name is an unrelated malicious package.`, 1);
+}
+
+async function askPassphrase(message, confirm = false) {
+  if (!process.stdin.isTTY) throw new QuoxError('No terminal to ask for the passphrase: pass --passphrase-file <chmod-600 file>.', 2);
+  const { default: inquirer } = await import('inquirer');
+  const { p } = await inquirer.prompt([{ type: 'password', name: 'p', message, mask: '*' }]);
+  if (confirm) {
+    const { q } = await inquirer.prompt([{ type: 'password', name: 'q', message: 'Repeat the passphrase', mask: '*' }]);
+    if (p !== q) throw new QuoxError('The passphrases did not match. Nothing was created.', 2);
+  }
+  return p;
+}
+
+// Properties a sealed note keeps visible (organisation only). Every other property of a converted note moves
+// inside the seal, because a property can hold a secret as easily as the body can.
+const VISIBLE_PROPS = ['collection', 'tags', 'pinned', 'archived'];
+export const NEUTRAL_TITLE = 'Sealed note';
+
+// RT-05: sealed means the seal mark, or a well-formed envelope block (same rule as quoxbrain lib/sealedNote.js), not
+// a note that merely mentions the fence or carries some other enqrypt_* property.
+const ENVELOPE_BLOCK_RE = new RegExp('```' + FENCE + '[ \\t]*\\r?\\n([\\s\\S]*?)\\r?\\n[ \\t]*```', 'g');
+export function isAlreadySealed(note) {
+  const p = (note && note.properties) || {};
+  if (p.enqrypt === SEAL_MARK) return true;
+  const text = String((note && (note.body ?? note.markdown)) || '');
+  return [...text.matchAll(ENVELOPE_BLOCK_RE)].some((m) => { const b = m[1].replace(/\s+/g, ''); return b.length >= 16 && B64U_RE.test(b); });
+}
+
+// RT-17: files attached with `quox notes attach` live in the org files store, linked from the body. Sealing the body
+// moves the link inside the seal but leaves the FILE readable, so convert names them and refuses unless told to
+// go ahead. Same pattern as ATTACH_REF in notes.js (a test pins the two equal).
+export const NOTE_ATTACH_REF = /!?\[([^\]]*)\]\((\/api\/orgs\/[^/)\s]+\/files\/([^/?#)\s]+))\)/g;
+export function noteAttachments(text) {
+  const seen = new Map();
+  for (const m of String(text || '').matchAll(NOTE_ATTACH_REF)) {
+    const fileId = decodeURIComponent(m[3]);
+    if (!seen.has(fileId)) seen.set(fileId, { name: m[1] || fileId, file_id: fileId });
+  }
+  return [...seen.values()];
+}
+const listAttachments = (a) => a.map((x) => `${x.name} (file ${x.file_id})`).join(', ');
+
+/** Plain lines for what the server's seal purge removed, and what it cannot reach. */
+export function purgeReport(id, r) {
+  const p = (r && r.purged) || {};
+  const n = (v) => (Number.isFinite(v) ? v : 0);
+  const lines = [
+    `Purged from the server for note ${id}: the text of ${n(p.revisions)} earlier revisions, ${n(p.embeddings)} embeddings (${n(p.ann_points_queued)} vector index points queued for deletion), ${n(p.beliefs_retracted)} derived belief(s) retracted. The search index now holds only the sealed envelope.`,
+  ];
+  if (p.belief_retract_error) lines.push(`Some derived beliefs could not be retracted yet (${p.belief_retract_error}); the retraction is queued and retried by the server.`);
+  lines.push((r && r.backups) || 'Backups taken before this purge still hold the old plaintext until they expire.');
+  return lines;
+}
+
+export function registerNotesSeal(notes, ctx) {
+  const { program, client, auth, call, getNote, putNote, readContent, isJson, printJson, announce } = ctx;
+  const loadEnqrypt = ctx.loadEnqrypt || defaultLoadEnqrypt;
+  const passphrase = (options, msg, confirm) => (options.passphraseFile ? readPassphraseFile(options.passphraseFile) : askPassphrase(msg, confirm));
+  const mapErr = (e) => {
+    if (e && (e.name === 'EnqryptError' || e.name === 'KeystoreError')) return new QuoxError(`ENQRYPT refused: ${e.code} (${e.message}). Nothing was shown.`, 1);
+    return e;
+  };
+  const unlock = async (E, options) => {
+    try { return await E.unlockKeystore({ dir: keystoreDir(options.keystore), passphrase: await passphrase(options, 'ENQRYPT passphrase') }); }
+    catch (e) { throw mapErr(e); }
+  };
+
+  const seal = notes.command('seal').description('ENQRYPT sealed notes: encrypted on this device, the server stores only the envelope (prototype, security review pending)');
+  const common = (cmd) => cmd
+    .option('--keystore <dir>', 'ENQRYPT keystore directory (default ~/.quox/enqrypt)')
+    .option('--passphrase-file <path>', 'read the passphrase from a chmod-600 file instead of asking');
+
+  common(seal.command('init').description('Create your ENQRYPT key (passphrase-protected) and show the one-time recovery key'))
+    .action(async (options) => {
+      const E = await loadEnqrypt();
+      const dir = keystoreDir(options.keystore);
+      if (existsSync(join(dir, 'identity.age'))) throw new QuoxError(`An ENQRYPT key already exists in ${dir}. Nothing was changed.`, 1);
+      console.log('If you lose BOTH this passphrase and the recovery key shown next, your sealed notes cannot be recovered by anyone.');
+      let out;
+      try { out = await E.createKeystore({ dir, passphrase: await passphrase(options, 'New ENQRYPT passphrase (10+ characters)', true) }); }
+      catch (e) { throw mapErr(e); }
+      if (isJson(program)) return printJson({ dir, fingerprint: out.fingerprint, recovery_key: out.recoveryKey });
+      console.log(`\nKey created in ${dir}\nFingerprint: ${out.fingerprint}\n`);
+      console.log('RECOVERY KEY (shown once; store it offline, it opens every sealed note):');
+      console.log(`  ${out.recoveryKey}\n`);
+      announce('seal init', `key ${out.fingerprint.slice(0, 16)}…`);
+    });
+
+  common(seal.command('status').description('Show whether this device has an ENQRYPT key, and its fingerprint'))
+    .action(async (options) => {
+      const dir = keystoreDir(options.keystore);
+      let E;
+      try { E = await loadEnqrypt(); } catch (e) {
+        // status must report, not fail, when the seal backend is absent (the other verbs still refuse).
+        const reason = e && e.message ? e.message : 'ENQRYPT could not be loaded.';
+        if (isJson(program)) return printJson({ dir, backend: 'unavailable', fingerprint: null, reason });
+        return console.log(`ENQRYPT backend: not available on this machine, so no key can be read from ${dir}.\n${reason}`);
+      }
+      try {
+        const pub = await E.readPublicIdentity({ dir });
+        if (isJson(program)) return printJson({ dir, fingerprint: pub.fingerprint });
+        console.log(`ENQRYPT key in ${dir}\nFingerprint: ${pub.fingerprint}`);
+      } catch (e) {
+        if (e && e.code === 'MISSING') return console.log(`No ENQRYPT key in ${dir}. Create one: quox notes seal init`);
+        throw mapErr(e);
+      }
+    });
+
+  common(seal.command('new').description('Create a sealed note from --file or --stdin. The title is NOT sealed.'))
+    .option('--scope <scope>', 'user | org (default user)', 'user')
+    .option('--title <t>', 'visible title (not sealed)', 'Sealed note')
+    .option('--collection <c>', 'collection (not sealed)')
+    .option('--tag <t>', 'tag (repeatable, not sealed)', (v, prev) => (prev || []).concat(v))
+    .option('--file <path>', 'read the secret text from a file')
+    .option('--stdin', 'read the secret text from stdin')
+    .action(async (options) => {
+      auth.requireAuth();
+      if (!['user', 'org'].includes(options.scope)) throw new QuoxError('--scope must be user or org.', 2);
+      const text = await readContent(options);
+      if (text === null) throw new QuoxError('seal new needs --file <path> or --stdin (the secret is never taken from a flag).', 2);
+      const E = await loadEnqrypt();
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      const objectId = randomUUID();
+      let envelope;
+      try { envelope = await E.seal({ sender: me, recipientPublicKey: me.publicKey, recipientFingerprint: fingerprint, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, seq: 1, plaintext: new TextEncoder().encode(text) }); }
+      catch (e) { throw mapErr(e); }
+      const ep = resolveEndpoint('notesq.notes.create');
+      const body = { scope: options.scope, markdown: sealedNoteMarkdown({ title: options.title, envelope, fingerprint }), properties: sealProperties({ fingerprint, objectId, version: 1, collection: options.collection, tags: options.tag }) };
+      const data = await call(() => client.post(ep.path, { service: ep.service, body }));
+      bumpFloor(keystoreDir(options.keystore), objectId, 1);
+      if (data && data.note && data.note.id) recordBinding(keystoreDir(options.keystore), String(data.note.id), objectId);
+      if (isJson(program)) return printJson({ id: data.note?.id, object: objectId, version: 1, fingerprint });
+      console.log(`Sealed note ${data.note?.id} created (${text.length} characters sealed; the title "${options.title}" is visible).`);
+      announce('seal new', `sealed note ${data.note?.id}`);
+    });
+
+  common(seal.command('print').description('Print a sealed note as a plain ASCII armour block (ciphertext only, safe to print or file; no passphrase needed)'))
+    .argument('<id>', 'note id')
+    .action(async (id) => {
+      auth.requireAuth();
+      const n = await getNote(id);
+      const props = readSealProperties(n.properties);
+      const envelope = extractEnvelope(n.markdown ?? n.body);
+      const E = await loadEnqrypt();
+      const armor = await E.toAsciiArmor(envelope, { Version: '1', Key: props.fingerprint.slice(0, 16), Object: props.objectId, Note: String(id).slice(0, 64) });
+      if (isJson(program)) return printJson({ id, armor });
+      process.stdout.write(armor);
+    });
+
+  common(seal.command('open').description('Open a sealed note on this device and print it (by note id, or offline from a printed armour block)'))
+    .argument('[id]', 'note id (omit with --armor-file)')
+    .option('--armor-file <path>', 'open a printed/saved ASCII armour block instead of fetching the note ("-" = stdin)')
+    .action(async (id, options) => {
+      let envelope, objectId, expectFp = null, label = id;
+      const E = await loadEnqrypt();
+      if (options.armorFile) {
+        if (id) throw new QuoxError('Give a note id or --armor-file, not both.', 2);
+        const text = options.armorFile === '-' ? await readContent({ stdin: true }) : readFileSync(options.armorFile, 'utf8');
+        let parsed;
+        try { parsed = await E.fromAsciiArmor(text); } catch (e) { throw new QuoxError(`That armour block was refused: ${e.message}. Nothing was opened.`, 1); }
+        envelope = parsed.envelope;
+        objectId = parsed.headers.Object;
+        if (!/^[0-9a-f-]{36}$/.test(String(objectId))) throw new QuoxError('That armour block has no valid Object header; it cannot be bound to a note.', 1);
+        label = parsed.headers.Note || 'armour';
+      } else {
+        if (!id) throw new QuoxError('seal open needs a note id or --armor-file <path>.', 2);
+        auth.requireAuth();
+        const n = await getNote(id);
+        const props = readSealProperties(n.properties);
+        envelope = extractEnvelope(n.markdown ?? n.body);
+        objectId = props.objectId;
+        expectFp = props.fingerprint;
+      }
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      if (expectFp && fingerprint !== expectFp) throw new QuoxError(`This note was sealed to key ${expectFp.slice(0, 16)}…, not this device's key ${fingerprint.slice(0, 16)}….`, 1);
+      const dir = keystoreDir(options.keystore);
+      let plain;
+      try { plain = await E.open({ recipient: me, senderPublicKey: me.publicKey, senderFingerprint: fingerprint, envelope, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, minVersion: readFloor(dir, objectId) }); }
+      catch (e) { throw mapErr(e); }
+      if (!options.armorFile) checkNoteBinding(dir, String(id), objectId);
+      else if (isBoundObjectId(objectId) && label !== 'armour' && !objectBindsNote(objectId, label)) throw new QuoxError(`Refusing that armour block: its sealed object ${objectId} is not bound to note ${label}. Nothing was opened.`, 1);
+      const v = E.parseEnvelope(envelope).seq;
+      bumpFloor(dir, objectId, v);
+      const text = new TextDecoder().decode(plain);
+      if (isJson(program)) return printJson({ id: label, version: v, text });
+      process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+    });
+
+  common(seal.command('edit').description('Replace a sealed note\'s secret text (--file or --stdin); writes a new sealed version'))
+    .argument('<id>', 'note id')
+    .option('--file <path>', 'read the new secret text from a file')
+    .option('--stdin', 'read the new secret text from stdin')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      const text = await readContent(options);
+      if (text === null) throw new QuoxError('seal edit needs --file <path> or --stdin.', 2);
+      const cur = await getNote(id);
+      const props = readSealProperties(cur.properties);
+      const E = await loadEnqrypt();
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      if (fingerprint !== props.fingerprint) throw new QuoxError('This note was sealed to a different key; refusing to re-seal it.', 1);
+      // ENQRYPT-NOTES F10: the next version comes from the AUTHENTICATED envelope, never from the server's
+      // enqrypt_version property. Opening the current envelope proves its seq and object binding, and refuses it
+      // (ROLLBACK) when it is older than this device's floor, so a server cannot bury the owner's newest text.
+      const dir = keystoreDir(options.keystore);
+      const current = extractEnvelope(cur.markdown ?? cur.body);
+      const floor = readFloor(dir, props.objectId);
+      try { await E.open({ recipient: me, senderPublicKey: me.publicKey, senderFingerprint: fingerprint, envelope: current, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId: props.objectId, minVersion: floor }); }
+      catch (e) { throw mapErr(e); }
+      checkNoteBinding(dir, String(id), props.objectId); // RT-15: refuse another note's envelope before writing
+      const version = Math.max(E.parseEnvelope(current).seq, floor) + 1;
+      // RT-15: an unbound note is re-sealed under a fresh object id bound to this note; the old object's floor is
+      // raised too, so its older envelopes stay refused.
+      const rebind = !isBoundObjectId(props.objectId);
+      const objectId = rebind ? bindObjectId(String(id)) : props.objectId;
+      let envelope;
+      try { envelope = await E.seal({ sender: me, recipientPublicKey: me.publicKey, recipientFingerprint: fingerprint, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, seq: version, plaintext: new TextEncoder().encode(text) }); }
+      catch (e) { throw mapErr(e); }
+      const title = String(cur.title || 'Sealed note');
+      const data = await putNote(id, { markdown: sealedNoteMarkdown({ title, envelope, fingerprint }), properties: { ...cur.properties, enqrypt_object: objectId, enqrypt_version: version }, base_hash: cur.content_hash });
+      bumpFloor(dir, props.objectId, version);
+      if (rebind) { bumpFloor(dir, objectId, version); recordBinding(dir, String(id), objectId); }
+      if (isJson(program)) return printJson({ id, version, revision: data.revision?.rev, ...(rebind ? { bound: true, object: objectId } : {}) });
+      console.log(`Sealed note ${id} updated to sealed version ${version}. Earlier revisions hold earlier envelopes, never plaintext.`);
+      if (rebind) console.log(`It is now bound to its note id (sealed object ${objectId}), so a server cannot pass another note's envelope off as this one.`);
+      announce('seal edit', `sealed note ${id} v${version}`);
+    });
+
+  // RT-04: the purge is bound to the exact sealed body this device checked (expected_hash), so a note that changes
+  // between the check and the purge is refused (409) instead of purged.
+  const runPurge = async (id, expectedHash) => {
+    const ep = resolveEndpoint('notesq.notes.sealPurge', { id });
+    try { return await call(() => client.post(ep.path, { service: ep.service, body: expectedHash ? { expected_hash: expectedHash } : {} })); } catch (e) {
+      if (e instanceof QuoxApiError && e.status === 403) throw new QuoxError(`Purge refused (${e.code}): only the author, the owner or an org admin can purge a sealed note, and only from a human session.`, 1);
+      if (e instanceof QuoxApiError && e.status === 409) throw new QuoxError(`Purge refused (${e.code}): the note is not sealed (or changed); nothing was purged.`, 1);
+      throw e;
+    }
+  };
+
+  common(seal.command('convert').description('Seal an EXISTING note on this device, then purge its earlier plaintext from the server (human only, irreversible, requires --yes)'))
+    .argument('<id>', 'note id')
+    .option('--keep-title', 'keep the current title visible (by default it is replaced with a neutral one)')
+    .option('--attachments-stay-plaintext', 'seal the text even though the note links attached files, which are NOT sealed and stay readable in the org files store')
+    .option('--yes', 'confirm: the note is sealed and its earlier plaintext revisions, embeddings and derived beliefs are purged')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      if (!options.yes) throw new QuoxError(`Refusing to seal ${id} without --yes: sealing an existing note purges its earlier plaintext from the server (revisions, embeddings, derived beliefs) and cannot be undone.`, 2);
+      const cur = await getNote(id);
+      if (isAlreadySealed(cur)) throw new QuoxError(`Note ${id} is already sealed. Use \`quox notes seal edit ${id}\` to change it.`, 1);
+      const text = String(cur.body ?? cur.markdown ?? '');
+      const attachments = noteAttachments(`${text}\n${cur.markdown ?? ''}`);
+      if (attachments.length && !options.attachmentsStayPlaintext) {
+        throw new QuoxError(`Refusing to seal ${id}: it links ${attachments.length} attached file(s) that seal convert cannot seal: ${listAttachments(attachments)}. `
+          + 'Sealing would hide the links inside the seal while the files stay readable in the org files store. Nothing was changed. '
+          + `Download and delete them first (\`quox notes download <fileId>\`), or pass --attachments-stay-plaintext to seal only the text.`, 1);
+      }
+      const E = await loadEnqrypt();
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      const objectId = bindObjectId(String(id)); // RT-15: the note id is known, so the sealed object is bound to it
+      let envelope;
+      try { envelope = await E.seal({ sender: me, recipientPublicKey: me.publicKey, recipientFingerprint: fingerprint, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, seq: 1, plaintext: new TextEncoder().encode(text) }); }
+      catch (e) { throw mapErr(e); }
+      const oldTitle = String(cur.title || '');
+      const title = options.keepTitle && oldTitle ? oldTitle : NEUTRAL_TITLE;
+      const props = cur.properties || {};
+      const visible = Object.fromEntries(VISIBLE_PROPS.filter((k) => props[k] !== undefined && props[k] !== null).map((k) => [k, props[k]]));
+      const movedInside = Object.keys(props).filter((k) => !VISIBLE_PROPS.includes(k) && k !== 'title');
+      const properties = { ...sealProperties({ fingerprint, objectId, version: 1 }), ...visible };
+      const sealedPut = await putNote(id, { markdown: sealedNoteMarkdown({ title, envelope, fingerprint }), properties, base_hash: cur.content_hash });
+      bumpFloor(keystoreDir(options.keystore), objectId, 1);
+      recordBinding(keystoreDir(options.keystore), String(id), objectId);
+      let purged;
+      try { purged = await runPurge(id, sealedPut && sealedPut.note && sealedPut.note.content_hash); } catch (e) {
+        const why = (e && e.message) || 'unknown error';
+        throw new QuoxError(`Note ${id} is sealed now, but the purge was refused (${why}): its earlier revisions still hold the plaintext on the server. Finish from a human session: quox notes seal purge ${id} --yes`, 1);
+      }
+      if (isJson(program)) return printJson({ id, object: objectId, version: 1, fingerprint, title, kept_title: title === oldTitle, moved_inside_seal: movedInside, attachments_not_sealed: attachments, ...purged });
+      console.log(attachments.length
+        ? `Sealed note ${id} (${text.length} characters sealed on this device; the server now stores only the envelope for the note's text).`
+        : `Sealed note ${id} (${text.length} characters sealed on this device; the server now stores only the envelope).`);
+      if (attachments.length) console.log(`NOT sealed: ${attachments.length} attached file(s) stay readable in the org files store: ${listAttachments(attachments)}. Their links are now inside the seal.`);
+      console.log(title === oldTitle && options.keepTitle
+        ? `The title "${oldTitle}" stays visible: titles are NOT sealed.`
+        : `The title "${oldTitle}" was replaced with "${NEUTRAL_TITLE}" (titles are not sealed; use --keep-title to keep one visible).`);
+      if (movedInside.length) console.log(`These properties are now inside the seal, not visible: ${movedInside.join(', ')}. Still visible: ${Object.keys(visible).join(', ') || 'none'}.`);
+      for (const line of purgeReport(id, purged)) console.log(line);
+      announce('seal convert', `sealed note ${id}, history purged`);
+    });
+
+  common(seal.command('purge').description('Purge a sealed note\'s earlier plaintext from the server: revisions, embeddings, derived beliefs (human only, irreversible, requires --yes; first opens the note with your key)'))
+    .argument('<id>', 'note id')
+    .option('--yes', 'confirm the purge')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      if (!options.yes) throw new QuoxError(`Refusing to purge ${id} without --yes: the earlier text of a sealed note is removed from the server and cannot be recovered.`, 2);
+      // RT-04: anyone who could write the note could dress plaintext up as sealed, and a purge would then erase its
+      // real history. So the purge runs only after THIS device opens the live envelope with the owner's key.
+      const cur = await getNote(id);
+      const props = readSealProperties(cur.properties);
+      const envelope = extractEnvelope(cur.markdown ?? cur.body);
+      const E = await loadEnqrypt();
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      if (fingerprint !== props.fingerprint) throw new QuoxError(`Purge refused: note ${id} is not sealed to this device's key (${fingerprint.slice(0, 16)}…). Nothing was purged.`, 1);
+      try { await E.open({ recipient: me, senderPublicKey: me.publicKey, senderFingerprint: fingerprint, envelope, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId: props.objectId, minVersion: readFloor(keystoreDir(options.keystore), props.objectId) }); }
+      catch (e) {
+        const why = e && e.code ? e.code : (e && e.message) || 'open failed';
+        throw new QuoxError(`Purge refused: the envelope in note ${id} does not open with your key (${why}), so it may not be a genuine sealed note and its earlier revisions could be the only copy of the real text. Nothing was purged.`, 1);
+      }
+      checkNoteBinding(keystoreDir(options.keystore), String(id), props.objectId); // RT-15: another note's envelope is refused
+      const purged = await runPurge(id, cur.content_hash);
+      if (isJson(program)) return printJson({ id, ...purged });
+      for (const line of purgeReport(id, purged)) console.log(line);
+      announce('seal purge', `sealed note ${id} history purged`);
+    });
+}

package/lib/commands/objective.js

@@ -12,6 +12,7 @@
  *                        live loop gate: budget, risk, interval).
  */
 
+import { withStepUp } from '../core/stepUpPrompt.js';
 import { formatOutput, formatDetail, printSuccess, printWarning } from '../core/output.js';
 import { parseJSON } from './helpers.js';
 import { resolveEndpoint } from '../api/endpoints.js';
@@ -181,7 +182,8 @@ export function registerObjectiveCommands(program, ctx) {
     .argument('<id>', 'objective ID')
     .action(async (id) => {
       auth.requireAuth();
-      const data = await client.post(resolveEndpoint('objectives.approve-plan', { id }).path, { service: resolveEndpoint('objectives.approve-plan', { id }).service });
+      const planEp = resolveEndpoint('objectives.approve-plan', { id });
+      const data = await withStepUp((headers) => client.post(planEp.path, { service: planEp.service, headers }), { client, orgId: auth.getOrgId?.(program.opts().org) || null, io: ctx.stepUpIO, what: 'Approving this plan' });
       printSuccess(`Objective ${id}: ${data.status}${data.message ? ` — ${data.message}` : ''}`);
     });
 
@@ -231,7 +233,8 @@ export function registerObjectiveCommands(program, ctx) {
       const body = {};
       if (options.notes) body.notes = options.notes;
       const params = { id: objectiveId, checkpointId };
-      const data = await client.post(resolveEndpoint('objectives.checkpoint-approve', params).path, { service: resolveEndpoint('objectives.checkpoint-approve', params).service, body });
+      const cpEp = resolveEndpoint('objectives.checkpoint-approve', params);
+      const data = await withStepUp((headers) => client.post(cpEp.path, { service: cpEp.service, headers, body }), { client, orgId: auth.getOrgId?.(program.opts().org) || null, io: ctx.stepUpIO, what: 'Approving this checkpoint' });
       // LOOPQ-HALT: "approved" is not "running". When the server says the loop did not start, say so in words.
       if (data.started === false) {
         printWarning(`Checkpoint ${checkpointId}: ${data.status}, but the objective did NOT start (objective ${data.objective_status || 'pending'}).`);