quoxcli 0.5.0 → 0.6.0

package/lib/commands/notesSeal.js

@@ -6,12 +6,12 @@
  * agents cannot read a sealed note. Titles, collections and tags are NOT sealed (they stay searchable).
  * ENQRYPT is an adapter dependency, loaded on demand; core Quox does not need it.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'fs';
+import { readFileSync, existsSync, mkdirSync, statSync, lstatSync, openSync, writeSync, closeSync, fsyncSync, renameSync, unlinkSync } from 'fs';
 import { homedir } from 'os';
-import { join, resolve } from 'path';
-import { randomUUID } from 'crypto';
+import { join, resolve, dirname } from 'path';
+import { randomUUID, randomBytes, createHash } from 'crypto';
 import { pathToFileURL } from 'url';
-import { QuoxError } from '../core/errors.js';
+import { QuoxError, QuoxApiError } from '../core/errors.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 
 export const SEAL_PURPOSE = 'notesq.note';
@@ -56,17 +56,206 @@ export function readSealProperties(props) {
   return { fingerprint: p.enqrypt_fp, objectId: p.enqrypt_object, version };
 }
 
-// Rollback floor: the highest version this client has opened per sealed object. Older envelopes are refused.
+// Rollback floor: the highest version this client has opened or written per sealed object. Older envelopes are
+// refused. ENQRYPT-NOTES F11: the floor fails CLOSED. A floor file that is damaged, unreadable or not a floor map is
+// refused, never read as 0; a floor file that has been used before (marker file, or a floor already seen in this
+// process) and is now missing is refused too. Only a keystore that has never recorded a floor starts at 0. Writes
+// are a fresh read, merge and atomic replace (temp file, fsync, rename) under a cross-process lock file, modelled on
+// the ENQRYPT CLI's state files, so concurrent quox processes cannot lose each other's floors.
 const floorFile = (dir) => join(dir, 'notes-floor.json');
+const floorMarker = (dir) => join(dir, 'notes-floor.used');
+const FLOOR_LOCK_STALE_MS = 30_000;
+const FLOOR_LOCK_TIMEOUT_MS = 10_000;
+const seenFloors = new Map(); // resolved dir -> Map(objectId -> highest floor seen in this process)
+
+function floorRefusal(dir, why) {
+  return new QuoxError(
+    `The ENQRYPT rollback floor file ${floorFile(dir)} is ${why}, so this device cannot tell whether the server is serving an older version of a sealed note. Nothing was opened or written. `
+    + `Restore it from a backup of ${dir}. Only if you accept that an older version could be accepted once, delete ${floorFile(dir)} and ${floorMarker(dir)} to start the floors again.`, 1);
+}
+
+function memFloors(dir) {
+  const k = resolve(dir);
+  if (!seenFloors.has(k)) seenFloors.set(k, new Map());
+  return seenFloors.get(k);
+}
+
+// RT-13: the floor, its marker, the binding record and the lock are files this CLI writes itself (atomic rename,
+// never through a link). A symbolic link in their place was planted, so it is refused, never followed.
+const isLink = (p) => { try { return lstatSync(p).isSymbolicLink(); } catch { return false; } };
+function markerPresent(dir) {
+  if (isLink(floorMarker(dir))) throw floorRefusal(dir, 'unverifiable (its marker file is a symbolic link)');
+  return existsSync(floorMarker(dir));
+}
+
+function loadFloors(dir) {
+  let text;
+  if (isLink(floorFile(dir))) throw floorRefusal(dir, 'a symbolic link (not a file this device wrote)');
+  try { text = readFileSync(floorFile(dir), 'utf8'); } catch (e) {
+    if (e && e.code === 'ENOENT') {
+      if (markerPresent(dir) || memFloors(dir).size > 0) throw floorRefusal(dir, 'missing');
+      return {};
+    }
+    throw floorRefusal(dir, `unreadable (${e && e.code ? e.code : 'read error'})`);
+  }
+  let all;
+  try { all = JSON.parse(text); } catch { throw floorRefusal(dir, 'damaged (not valid JSON)'); }
+  if (!all || typeof all !== 'object' || Array.isArray(all)) throw floorRefusal(dir, 'damaged (not a floor map)');
+  for (const v of Object.values(all)) {
+    if (!Number.isSafeInteger(v) || v < 1) throw floorRefusal(dir, 'damaged (a floor is not a positive whole number)');
+  }
+  return all;
+}
+
 export function readFloor(dir, objectId) {
-  try { return Number(JSON.parse(readFileSync(floorFile(dir), 'utf8'))[objectId]) || 0; } catch { return 0; }
+  const fromFile = Number(loadFloors(dir)[objectId]) || 0;
+  return Math.max(fromFile, memFloors(dir).get(objectId) || 0);
+}
+
+const sleepSync = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+function pidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+function readLockFile(lock) {
+  if (isLink(lock)) return { pid: 0, t: 0, nonce: '', link: true }; // RT-13/14: never follow a planted link
+  try { return JSON.parse(readFileSync(lock, 'utf8')); } catch (e) { return e.code === 'ENOENT' ? null : { pid: 0, t: 0, nonce: '' }; }
+}
+function lockAge(lock) {
+  try { return Date.now() - lstatSync(lock).mtimeMs; } catch { return 0; }
+}
+// RT-14: a lock whose time is further in the future than the stale bound (clock skew, or planted) is stale too,
+// otherwise it would block every seal command forever.
+const lockAged = (p) => { const age = lockAge(p); return age > FLOOR_LOCK_STALE_MS || age < -FLOOR_LOCK_STALE_MS; };
+function breakStaleLock(lock, seen) {
+  const brk = `${lock}.break`;
+  let fd;
+  try { fd = openSync(brk, 'wx', 0o600); } catch (e) {
+    if (e.code !== 'EEXIST') throw e;
+    if (lockAged(brk)) { try { unlinkSync(brk); } catch { /* raced */ } }
+    return;
+  }
+  try {
+    const now = readLockFile(lock);
+    if (now && now.nonce === seen.nonce) { try { unlinkSync(lock); } catch { /* raced */ } }
+  } finally { closeSync(fd); try { unlinkSync(brk); } catch { /* raced */ } }
+}
+function withFloorLock(dir, fn) {
+  const lock = `${floorFile(dir)}.lock`;
+  const nonce = randomUUID();
+  const deadline = Date.now() + FLOOR_LOCK_TIMEOUT_MS;
+  for (;;) {
+    let fd = null;
+    try { fd = openSync(lock, 'wx', 0o600); } catch (e) { if (e.code !== 'EEXIST') throw e; }
+    if (fd !== null) {
+      try { writeSync(fd, JSON.stringify({ pid: process.pid, t: Date.now(), nonce })); } finally { closeSync(fd); }
+      break;
+    }
+    const held = readLockFile(lock);
+    if (held) {
+      // A lock with no nonce yet (holder between create and write) is only judged stale once it is old.
+      const stale = held.link || (held.nonce ? (!pidAlive(held.pid) || lockAged(lock)) : lockAged(lock));
+      if (stale) { breakStaleLock(lock, held); continue; }
+    }
+    if (Date.now() > deadline) throw new QuoxError(`The ENQRYPT rollback floor file is locked by another quox process (${lock}). Nothing was written; try again.`, 1);
+    sleepSync(5 + Math.floor(Math.random() * 20));
+  }
+  try { return fn(); } finally {
+    const h = readLockFile(lock);
+    if (h && h.nonce === nonce) { try { unlinkSync(lock); } catch { /* already gone */ } }
+  }
 }
+function atomicWrite(file, data) {
+  const tmp = `${file}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    const fd = openSync(tmp, 'wx', 0o600);
+    try { writeSync(fd, data); fsyncSync(fd); } finally { closeSync(fd); }
+    renameSync(tmp, file);
+  } catch (e) { try { unlinkSync(tmp); } catch { /* not created */ } throw e; }
+  try { const d = openSync(dirname(file), 'r'); try { fsyncSync(d); } finally { closeSync(d); } } catch { /* directory fsync is best effort */ }
+}
+
 export function bumpFloor(dir, objectId, version) {
-  let all = {};
-  try { all = JSON.parse(readFileSync(floorFile(dir), 'utf8')); } catch { /* first use */ }
-  if (!(Number(all[objectId]) >= version)) all[objectId] = version;
   mkdirSync(dir, { recursive: true, mode: 0o700 });
-  writeFileSync(floorFile(dir), JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
+  withFloorLock(dir, () => {
+    const all = loadFloors(dir); // fresh read inside the lock; a damaged file refuses rather than being overwritten
+    const mem = memFloors(dir);
+    const next = Math.max(Number(all[objectId]) || 0, mem.get(objectId) || 0, version);
+    if (all[objectId] !== next) {
+      all[objectId] = next;
+      atomicWrite(floorFile(dir), JSON.stringify(all, null, 2) + '\n');
+    }
+    if (!markerPresent(dir)) atomicWrite(floorMarker(dir), 'This keystore has recorded ENQRYPT rollback floors in notes-floor.json. Do not delete either file.\n');
+    mem.set(objectId, next);
+  });
+}
+
+// NOTE BINDING (red team RT-15). ENQRYPT authenticates (op, purpose, objectId) but not which NotesQ note an
+// envelope belongs to, so a server could serve note A's envelope (and properties) under note B. A BOUND object id
+// commits to the note id: `<nonce8>-<h4>-0b1d-<h4>-<h12>`, the fixed third group marking the format (never a
+// random v4 UUID, whose third group starts with 4) and h = sha256("notesq.note\0" + noteId + "\0" + nonce). The
+// object id is inside the authenticated envelope, so an envelope bound to note A cannot verify as note B. Notes
+// sealed before binding (random UUID object ids) still open, with a warning; this device also records which object
+// it last saw for each note (notes-bind.json, next to the floor) and refuses a mismatch; `seal edit` re-seals an
+// unbound note under a bound id. `seal new` cannot bind at creation (the server assigns the id after the envelope is
+// sent), so a new note is bound by this device's record until its first `seal edit`.
+const BIND_MARK = '0b1d';
+const bindHash = (noteId, nonce) => createHash('sha256').update(`notesq.note\0${noteId}\0${nonce}`).digest('hex');
+export function bindObjectId(noteId, nonce = randomBytes(4).toString('hex')) {
+  const h = bindHash(noteId, nonce);
+  return `${nonce}-${h.slice(0, 4)}-${BIND_MARK}-${h.slice(4, 8)}-${h.slice(8, 20)}`;
+}
+export const isBoundObjectId = (objectId) => /^[0-9a-f]{8}-[0-9a-f]{4}-0b1d-[0-9a-f]{4}-[0-9a-f]{12}$/.test(String(objectId));
+export function objectBindsNote(objectId, noteId) {
+  if (!isBoundObjectId(objectId) || !noteId) return false;
+  return bindObjectId(String(noteId), String(objectId).slice(0, 8)) === objectId;
+}
+
+const bindFile = (dir) => join(dir, 'notes-bind.json');
+function loadBinds(dir) {
+  let text;
+  if (isLink(bindFile(dir))) throw new QuoxError(`The note binding record ${bindFile(dir)} is a symbolic link (not a file this device wrote). Nothing was opened or written.`, 1);
+  try { text = readFileSync(bindFile(dir), 'utf8'); } catch (e) {
+    if (e && e.code === 'ENOENT') return {};
+    throw new QuoxError(`The note binding record ${bindFile(dir)} is unreadable (${e && e.code ? e.code : 'read error'}). Nothing was opened or written.`, 1);
+  }
+  let all;
+  try { all = JSON.parse(text); } catch { all = null; }
+  if (!all || typeof all !== 'object' || Array.isArray(all) || Object.values(all).some((v) => typeof v !== 'string')) {
+    throw new QuoxError(`The note binding record ${bindFile(dir)} is damaged. Nothing was opened or written. Restore it from a backup of ${dir}.`, 1);
+  }
+  return all;
+}
+export function recordBinding(dir, noteId, objectId) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  withFloorLock(dir, () => {
+    const all = loadBinds(dir);
+    if (all[noteId] === objectId) return;
+    all[noteId] = objectId;
+    atomicWrite(bindFile(dir), JSON.stringify(all, null, 2) + '\n');
+  });
+}
+
+/**
+ * After an envelope OPENED under objectId, check it belongs to noteId. Refuses a swap; warns for an unbound note
+ * this device cannot vouch for. Records the binding. Returns 'bound' | 'recorded' | 'unverified'.
+ */
+export function checkNoteBinding(dir, noteId, objectId, { warn = (m) => console.error(m) } = {}) {
+  const swapped = (why) => new QuoxError(`Refusing note ${noteId}: ${why} The server may be serving another note's sealed envelope under this id. Nothing was shown or written.`, 1);
+  if (isBoundObjectId(objectId)) {
+    if (!objectBindsNote(objectId, noteId)) throw swapped(`its sealed envelope (object ${objectId}) is bound to a different note.`);
+    recordBinding(dir, noteId, objectId);
+    return 'bound';
+  }
+  const all = loadBinds(dir);
+  if (all[noteId] && all[noteId] !== objectId && !objectBindsNote(all[noteId], noteId)) throw swapped(`this device last saw it as sealed object ${all[noteId]}, but the server sent object ${objectId}.`);
+  if (all[noteId] && objectBindsNote(all[noteId], noteId)) throw swapped(`this device last saw it bound to object ${all[noteId]}, but the server sent an unbound envelope (object ${objectId}).`);
+  const other = Object.keys(all).find((k) => k !== noteId && all[k] === objectId);
+  if (other) throw swapped(`its sealed envelope (object ${objectId}) belongs to note ${other} on this device.`);
+  const known = all[noteId] === objectId;
+  if (!known) warn(`Warning: note ${noteId} was sealed before notes were bound to their ids, and this device has no record of it, so it cannot prove the server sent the right note. Re-seal it to bind it: quox notes seal edit ${noteId}`);
+  recordBinding(dir, noteId, objectId);
+  return known ? 'recorded' : 'unverified';
 }
 
 /** A passphrase file must be private to its owner; anything looser is refused rather than trusted. */
@@ -76,15 +265,36 @@ export function readPassphraseFile(path) {
   return readFileSync(path, 'utf8').replace(/\r?\n$/, '');
 }
 
+// quox#1675: ENQRYPT is not on npm yet. The CLI looks in QUOX_ENQRYPT_PATH, then its own install location
+// ~/.quox/enqrypt-src (a clone of quoxai/enqrypt main with its dependencies), then the package name. A directory
+// counts only if it holds src/seal.mjs, and what loads must export every function the CLI calls (an old checkout
+// is refused, not half used). A developer's working checkout is never picked up implicitly.
+export const ENQRYPT_PACKAGE = '@quoxai/enqrypt-script';
+export const ENQRYPT_NEEDS = ['createKeystore', 'unlockKeystore', 'readPublicIdentity', 'fingerprint', 'seal', 'open', 'parseEnvelope', 'toAsciiArmor', 'fromAsciiArmor'];
+export const enqryptInstallDir = (home = homedir()) => join(home, '.quox', 'enqrypt-src');
+export function enqryptSources({ env = process.env, home = homedir() } = {}) {
+  const dirs = [env.QUOX_ENQRYPT_PATH, enqryptInstallDir(home)].filter((d, i) => d && (i === 0 || existsSync(join(d, 'src', 'seal.mjs'))));
+  return [...dirs, ENQRYPT_PACKAGE];
+}
+
+export async function loadEnqryptFrom(src, importer = (u) => import(u)) {
+  const at = (sub) => (src === ENQRYPT_PACKAGE ? `${src}/${sub}` : pathToFileURL(join(src, 'src', `${sub}.mjs`)).href);
+  const [seal, keystore, armor] = await Promise.all([importer(at('seal')), importer(at('keystore')), importer(at('armor'))]);
+  const E = { ...seal, ...keystore, ...armor };
+  const missing = ENQRYPT_NEEDS.filter((f) => typeof E[f] !== 'function');
+  if (missing.length) throw new Error(`${src} is too old for quox notes seal (missing ${missing.join(', ')})`);
+  return E;
+}
+
 async function defaultLoadEnqrypt() {
-  const base = process.env.QUOX_ENQRYPT_PATH;
-  const at = (sub) => (base ? pathToFileURL(join(base, 'src', `${sub}.mjs`)).href : `@quoxai/enqrypt-script/${sub}`);
-  try {
-    const [seal, keystore, armor] = await Promise.all([import(at('seal')), import(at('keystore')), import(at('armor'))]);
-    return { ...seal, ...keystore, ...armor };
-  } catch {
-    throw new QuoxError('ENQRYPT is not available on this machine. It is not published yet: set QUOX_ENQRYPT_PATH to a checkout of quoxai/enqrypt (never `npm install enqrypt`, that name is an unrelated malicious package).', 1);
+  const reasons = [];
+  for (const src of enqryptSources()) {
+    try { return await loadEnqryptFrom(src); } catch (e) {
+      if (src !== ENQRYPT_PACKAGE) reasons.push(/too old/.test(e.message) ? e.message : `${src} did not load`);
+    }
   }
+  const tried = reasons.length ? ` Tried: ${reasons.join('; ')}.` : '';
+  throw new QuoxError(`ENQRYPT is not available on this machine. It is not on npm yet: clone quoxai/enqrypt into ${enqryptInstallDir()} and run \`npm ci\` there, or set QUOX_ENQRYPT_PATH to a checkout.${tried} Never \`npm install enqrypt\`: that name is an unrelated malicious package.`, 1);
 }
 
 async function askPassphrase(message, confirm = false) {
@@ -98,6 +308,47 @@ async function askPassphrase(message, confirm = false) {
   return p;
 }
 
+// Properties a sealed note keeps visible (organisation only). Every other property of a converted note moves
+// inside the seal, because a property can hold a secret as easily as the body can.
+const VISIBLE_PROPS = ['collection', 'tags', 'pinned', 'archived'];
+export const NEUTRAL_TITLE = 'Sealed note';
+
+// RT-05: sealed means the seal mark, or a well-formed envelope block (same rule as quoxbrain lib/sealedNote.js), not
+// a note that merely mentions the fence or carries some other enqrypt_* property.
+const ENVELOPE_BLOCK_RE = new RegExp('```' + FENCE + '[ \\t]*\\r?\\n([\\s\\S]*?)\\r?\\n[ \\t]*```', 'g');
+export function isAlreadySealed(note) {
+  const p = (note && note.properties) || {};
+  if (p.enqrypt === SEAL_MARK) return true;
+  const text = String((note && (note.body ?? note.markdown)) || '');
+  return [...text.matchAll(ENVELOPE_BLOCK_RE)].some((m) => { const b = m[1].replace(/\s+/g, ''); return b.length >= 16 && B64U_RE.test(b); });
+}
+
+// RT-17: files attached with `quox notes attach` live in the org files store, linked from the body. Sealing the body
+// moves the link inside the seal but leaves the FILE readable, so convert names them and refuses unless told to
+// go ahead. Same pattern as ATTACH_REF in notes.js (a test pins the two equal).
+export const NOTE_ATTACH_REF = /!?\[([^\]]*)\]\((\/api\/orgs\/[^/)\s]+\/files\/([^/?#)\s]+))\)/g;
+export function noteAttachments(text) {
+  const seen = new Map();
+  for (const m of String(text || '').matchAll(NOTE_ATTACH_REF)) {
+    const fileId = decodeURIComponent(m[3]);
+    if (!seen.has(fileId)) seen.set(fileId, { name: m[1] || fileId, file_id: fileId });
+  }
+  return [...seen.values()];
+}
+const listAttachments = (a) => a.map((x) => `${x.name} (file ${x.file_id})`).join(', ');
+
+/** Plain lines for what the server's seal purge removed, and what it cannot reach. */
+export function purgeReport(id, r) {
+  const p = (r && r.purged) || {};
+  const n = (v) => (Number.isFinite(v) ? v : 0);
+  const lines = [
+    `Purged from the server for note ${id}: the text of ${n(p.revisions)} earlier revisions, ${n(p.embeddings)} embeddings (${n(p.ann_points_queued)} vector index points queued for deletion), ${n(p.beliefs_retracted)} derived belief(s) retracted. The search index now holds only the sealed envelope.`,
+  ];
+  if (p.belief_retract_error) lines.push(`Some derived beliefs could not be retracted yet (${p.belief_retract_error}); the retraction is queued and retried by the server.`);
+  lines.push((r && r.backups) || 'Backups taken before this purge still hold the old plaintext until they expire.');
+  return lines;
+}
+
 export function registerNotesSeal(notes, ctx) {
   const { program, client, auth, call, getNote, putNote, readContent, isJson, printJson, announce } = ctx;
   const loadEnqrypt = ctx.loadEnqrypt || defaultLoadEnqrypt;
@@ -175,6 +426,7 @@ export function registerNotesSeal(notes, ctx) {
       const body = { scope: options.scope, markdown: sealedNoteMarkdown({ title: options.title, envelope, fingerprint }), properties: sealProperties({ fingerprint, objectId, version: 1, collection: options.collection, tags: options.tag }) };
       const data = await call(() => client.post(ep.path, { service: ep.service, body }));
       bumpFloor(keystoreDir(options.keystore), objectId, 1);
+      if (data && data.note && data.note.id) recordBinding(keystoreDir(options.keystore), String(data.note.id), objectId);
       if (isJson(program)) return printJson({ id: data.note?.id, object: objectId, version: 1, fingerprint });
       console.log(`Sealed note ${data.note?.id} created (${text.length} characters sealed; the title "${options.title}" is visible).`);
       announce('seal new', `sealed note ${data.note?.id}`);
@@ -224,6 +476,8 @@ export function registerNotesSeal(notes, ctx) {
       let plain;
       try { plain = await E.open({ recipient: me, senderPublicKey: me.publicKey, senderFingerprint: fingerprint, envelope, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, minVersion: readFloor(dir, objectId) }); }
       catch (e) { throw mapErr(e); }
+      if (!options.armorFile) checkNoteBinding(dir, String(id), objectId);
+      else if (isBoundObjectId(objectId) && label !== 'armour' && !objectBindsNote(objectId, label)) throw new QuoxError(`Refusing that armour block: its sealed object ${objectId} is not bound to note ${label}. Nothing was opened.`, 1);
       const v = E.parseEnvelope(envelope).seq;
       bumpFloor(dir, objectId, v);
       const text = new TextDecoder().decode(plain);
@@ -245,15 +499,119 @@ export function registerNotesSeal(notes, ctx) {
       const me = await unlock(E, options);
       const fingerprint = await E.fingerprint(me.publicKey);
       if (fingerprint !== props.fingerprint) throw new QuoxError('This note was sealed to a different key; refusing to re-seal it.', 1);
-      const version = props.version + 1;
+      // ENQRYPT-NOTES F10: the next version comes from the AUTHENTICATED envelope, never from the server's
+      // enqrypt_version property. Opening the current envelope proves its seq and object binding, and refuses it
+      // (ROLLBACK) when it is older than this device's floor, so a server cannot bury the owner's newest text.
+      const dir = keystoreDir(options.keystore);
+      const current = extractEnvelope(cur.markdown ?? cur.body);
+      const floor = readFloor(dir, props.objectId);
+      try { await E.open({ recipient: me, senderPublicKey: me.publicKey, senderFingerprint: fingerprint, envelope: current, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId: props.objectId, minVersion: floor }); }
+      catch (e) { throw mapErr(e); }
+      checkNoteBinding(dir, String(id), props.objectId); // RT-15: refuse another note's envelope before writing
+      const version = Math.max(E.parseEnvelope(current).seq, floor) + 1;
+      // RT-15: an unbound note is re-sealed under a fresh object id bound to this note; the old object's floor is
+      // raised too, so its older envelopes stay refused.
+      const rebind = !isBoundObjectId(props.objectId);
+      const objectId = rebind ? bindObjectId(String(id)) : props.objectId;
       let envelope;
-      try { envelope = await E.seal({ sender: me, recipientPublicKey: me.publicKey, recipientFingerprint: fingerprint, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId: props.objectId, seq: version, plaintext: new TextEncoder().encode(text) }); }
+      try { envelope = await E.seal({ sender: me, recipientPublicKey: me.publicKey, recipientFingerprint: fingerprint, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, seq: version, plaintext: new TextEncoder().encode(text) }); }
       catch (e) { throw mapErr(e); }
       const title = String(cur.title || 'Sealed note');
-      const data = await putNote(id, { markdown: sealedNoteMarkdown({ title, envelope, fingerprint }), properties: { ...cur.properties, enqrypt_version: version }, base_hash: cur.content_hash });
-      bumpFloor(keystoreDir(options.keystore), props.objectId, version);
-      if (isJson(program)) return printJson({ id, version, revision: data.revision?.rev });
+      const data = await putNote(id, { markdown: sealedNoteMarkdown({ title, envelope, fingerprint }), properties: { ...cur.properties, enqrypt_object: objectId, enqrypt_version: version }, base_hash: cur.content_hash });
+      bumpFloor(dir, props.objectId, version);
+      if (rebind) { bumpFloor(dir, objectId, version); recordBinding(dir, String(id), objectId); }
+      if (isJson(program)) return printJson({ id, version, revision: data.revision?.rev, ...(rebind ? { bound: true, object: objectId } : {}) });
       console.log(`Sealed note ${id} updated to sealed version ${version}. Earlier revisions hold earlier envelopes, never plaintext.`);
+      if (rebind) console.log(`It is now bound to its note id (sealed object ${objectId}), so a server cannot pass another note's envelope off as this one.`);
       announce('seal edit', `sealed note ${id} v${version}`);
     });
+
+  // RT-04: the purge is bound to the exact sealed body this device checked (expected_hash), so a note that changes
+  // between the check and the purge is refused (409) instead of purged.
+  const runPurge = async (id, expectedHash) => {
+    const ep = resolveEndpoint('notesq.notes.sealPurge', { id });
+    try { return await call(() => client.post(ep.path, { service: ep.service, body: expectedHash ? { expected_hash: expectedHash } : {} })); } catch (e) {
+      if (e instanceof QuoxApiError && e.status === 403) throw new QuoxError(`Purge refused (${e.code}): only the author, the owner or an org admin can purge a sealed note, and only from a human session.`, 1);
+      if (e instanceof QuoxApiError && e.status === 409) throw new QuoxError(`Purge refused (${e.code}): the note is not sealed (or changed); nothing was purged.`, 1);
+      throw e;
+    }
+  };
+
+  common(seal.command('convert').description('Seal an EXISTING note on this device, then purge its earlier plaintext from the server (human only, irreversible, requires --yes)'))
+    .argument('<id>', 'note id')
+    .option('--keep-title', 'keep the current title visible (by default it is replaced with a neutral one)')
+    .option('--attachments-stay-plaintext', 'seal the text even though the note links attached files, which are NOT sealed and stay readable in the org files store')
+    .option('--yes', 'confirm: the note is sealed and its earlier plaintext revisions, embeddings and derived beliefs are purged')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      if (!options.yes) throw new QuoxError(`Refusing to seal ${id} without --yes: sealing an existing note purges its earlier plaintext from the server (revisions, embeddings, derived beliefs) and cannot be undone.`, 2);
+      const cur = await getNote(id);
+      if (isAlreadySealed(cur)) throw new QuoxError(`Note ${id} is already sealed. Use \`quox notes seal edit ${id}\` to change it.`, 1);
+      const text = String(cur.body ?? cur.markdown ?? '');
+      const attachments = noteAttachments(`${text}\n${cur.markdown ?? ''}`);
+      if (attachments.length && !options.attachmentsStayPlaintext) {
+        throw new QuoxError(`Refusing to seal ${id}: it links ${attachments.length} attached file(s) that seal convert cannot seal: ${listAttachments(attachments)}. `
+          + 'Sealing would hide the links inside the seal while the files stay readable in the org files store. Nothing was changed. '
+          + `Download and delete them first (\`quox notes download <fileId>\`), or pass --attachments-stay-plaintext to seal only the text.`, 1);
+      }
+      const E = await loadEnqrypt();
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      const objectId = bindObjectId(String(id)); // RT-15: the note id is known, so the sealed object is bound to it
+      let envelope;
+      try { envelope = await E.seal({ sender: me, recipientPublicKey: me.publicKey, recipientFingerprint: fingerprint, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId, seq: 1, plaintext: new TextEncoder().encode(text) }); }
+      catch (e) { throw mapErr(e); }
+      const oldTitle = String(cur.title || '');
+      const title = options.keepTitle && oldTitle ? oldTitle : NEUTRAL_TITLE;
+      const props = cur.properties || {};
+      const visible = Object.fromEntries(VISIBLE_PROPS.filter((k) => props[k] !== undefined && props[k] !== null).map((k) => [k, props[k]]));
+      const movedInside = Object.keys(props).filter((k) => !VISIBLE_PROPS.includes(k) && k !== 'title');
+      const properties = { ...sealProperties({ fingerprint, objectId, version: 1 }), ...visible };
+      const sealedPut = await putNote(id, { markdown: sealedNoteMarkdown({ title, envelope, fingerprint }), properties, base_hash: cur.content_hash });
+      bumpFloor(keystoreDir(options.keystore), objectId, 1);
+      recordBinding(keystoreDir(options.keystore), String(id), objectId);
+      let purged;
+      try { purged = await runPurge(id, sealedPut && sealedPut.note && sealedPut.note.content_hash); } catch (e) {
+        const why = (e && e.message) || 'unknown error';
+        throw new QuoxError(`Note ${id} is sealed now, but the purge was refused (${why}): its earlier revisions still hold the plaintext on the server. Finish from a human session: quox notes seal purge ${id} --yes`, 1);
+      }
+      if (isJson(program)) return printJson({ id, object: objectId, version: 1, fingerprint, title, kept_title: title === oldTitle, moved_inside_seal: movedInside, attachments_not_sealed: attachments, ...purged });
+      console.log(attachments.length
+        ? `Sealed note ${id} (${text.length} characters sealed on this device; the server now stores only the envelope for the note's text).`
+        : `Sealed note ${id} (${text.length} characters sealed on this device; the server now stores only the envelope).`);
+      if (attachments.length) console.log(`NOT sealed: ${attachments.length} attached file(s) stay readable in the org files store: ${listAttachments(attachments)}. Their links are now inside the seal.`);
+      console.log(title === oldTitle && options.keepTitle
+        ? `The title "${oldTitle}" stays visible: titles are NOT sealed.`
+        : `The title "${oldTitle}" was replaced with "${NEUTRAL_TITLE}" (titles are not sealed; use --keep-title to keep one visible).`);
+      if (movedInside.length) console.log(`These properties are now inside the seal, not visible: ${movedInside.join(', ')}. Still visible: ${Object.keys(visible).join(', ') || 'none'}.`);
+      for (const line of purgeReport(id, purged)) console.log(line);
+      announce('seal convert', `sealed note ${id}, history purged`);
+    });
+
+  common(seal.command('purge').description('Purge a sealed note\'s earlier plaintext from the server: revisions, embeddings, derived beliefs (human only, irreversible, requires --yes; first opens the note with your key)'))
+    .argument('<id>', 'note id')
+    .option('--yes', 'confirm the purge')
+    .action(async (id, options) => {
+      auth.requireAuth();
+      if (!options.yes) throw new QuoxError(`Refusing to purge ${id} without --yes: the earlier text of a sealed note is removed from the server and cannot be recovered.`, 2);
+      // RT-04: anyone who could write the note could dress plaintext up as sealed, and a purge would then erase its
+      // real history. So the purge runs only after THIS device opens the live envelope with the owner's key.
+      const cur = await getNote(id);
+      const props = readSealProperties(cur.properties);
+      const envelope = extractEnvelope(cur.markdown ?? cur.body);
+      const E = await loadEnqrypt();
+      const me = await unlock(E, options);
+      const fingerprint = await E.fingerprint(me.publicKey);
+      if (fingerprint !== props.fingerprint) throw new QuoxError(`Purge refused: note ${id} is not sealed to this device's key (${fingerprint.slice(0, 16)}…). Nothing was purged.`, 1);
+      try { await E.open({ recipient: me, senderPublicKey: me.publicKey, senderFingerprint: fingerprint, envelope, op: E.OP.SEALED_OBJECT, purpose: SEAL_PURPOSE, objectId: props.objectId, minVersion: readFloor(keystoreDir(options.keystore), props.objectId) }); }
+      catch (e) {
+        const why = e && e.code ? e.code : (e && e.message) || 'open failed';
+        throw new QuoxError(`Purge refused: the envelope in note ${id} does not open with your key (${why}), so it may not be a genuine sealed note and its earlier revisions could be the only copy of the real text. Nothing was purged.`, 1);
+      }
+      checkNoteBinding(keystoreDir(options.keystore), String(id), props.objectId); // RT-15: another note's envelope is refused
+      const purged = await runPurge(id, cur.content_hash);
+      if (isJson(program)) return printJson({ id, ...purged });
+      for (const line of purgeReport(id, purged)) console.log(line);
+      announce('seal purge', `sealed note ${id} history purged`);
+    });
 }

package/lib/commands/offload.js

@@ -2,7 +2,8 @@
  * `quox offload` : run a heavy command on a pool worker VM and behave like running it locally.
  *
  *   quox offload [--dir <path>] [--fresh] [--keep] [--cores N --memory-gb N --disk-gb N] -- <command...>
- *   quox offload status
+ *   quox offload status          every configured worker's lease (EXPIRED / EXPIRING / OK) + the selected worker's dirs
+ *   quox offload leases [--json] the same lease list, machine-readable for a timer
  *   quox offload release
  *
  * Engine: lib/core/offload.js. The worker is leased through the human pool REST API
@@ -11,7 +12,10 @@
 
 import { printInfo } from '../core/output.js';
 import { makePoolRest } from '../core/vm.js';
-import { OffloadError, realDeps, runOffload, releaseWorker, workerStatus, resolveSyncDir, WORKER_NAME_RE } from '../core/offload.js';
+import {
+  OffloadError, realDeps, runOffload, releaseWorker, workerStatus, resolveSyncDir, WORKER_NAME_RE,
+  allLeases, leaseWarnings, describeLease, LEASE_WARN_H, listWorkerNames,
+} from '../core/offload.js';
 
 export function registerOffloadCommands(program, ctx, { deps: injected } = {}) {
   const { client, auth } = ctx;
@@ -26,6 +30,19 @@ export function registerOffloadCommands(program, ctx, { deps: injected } = {}) {
     }
     return name ? Object.assign(Object.create(Object.getPrototypeOf(d)), d, { worker: String(name) }) : d;
   };
+  // Leasing needs a human profile, so an agent can only warn: one stderr line per lease ending within LEASE_WARN_H.
+  const warn = (report) => { for (const l of leaseWarnings(report)) process.stderr.write(`offload: ${l}\n`); };
+  const leaseLines = (report) => {
+    const width = Math.max(7, ...report.leases.map((l) => l.worker.length));
+    const lines = [`offload workers (warn when a lease ends within ${LEASE_WARN_H}h; source: ${report.source})`];
+    for (const l of report.leases) {
+      const head = `  ${l.worker.padEnd(width)}  `;
+      if (l.lease === 'NONE') { lines.push(`${head}no worker leased`); continue; }
+      lines.push(`${head}vm ${l.vmid}  ${l.ip || '?'}  pool ${l.pool_state}  lease ${l.lease_expires_at || '?'}  ${describeLease(l)}`);
+    }
+    if (report.pool_error) lines.push(`  (pool status failed, expiry from the local state: ${report.pool_error})`);
+    return lines;
+  };
   const WORKER_HELP = 'use your own named worker (its own lease and size) instead of the shared one; or set QUOX_OFFLOAD_WORKER';
 
   const off = program
@@ -46,6 +63,7 @@ export function registerOffloadCommands(program, ctx, { deps: injected } = {}) {
       const cwd = process.cwd();
       try {
         const dir = resolveSyncDir(cwd, options.dir);
+        try { warn(await allLeases(base(), { live: false })); } catch { /* the warning never blocks a run */ }
         const code = await runOffload(mk(options), {
           dir, cwd, command, fresh: !!options.fresh, docker: !!options.docker,
           cores: options.cores, memoryGb: options.memoryGb, diskGb: options.diskGb,
@@ -59,16 +77,32 @@ export function registerOffloadCommands(program, ctx, { deps: injected } = {}) {
     });
 
   off.command('status')
-    .description('Show your offload worker: vmid, ip, lease expiry, synced dirs')
+    .description('Show every offload worker lease (EXPIRED / EXPIRING / OK) and your worker: vmid, ip, synced dirs')
     .option('--worker <name>', WORKER_HELP)
     .action(async (options) => {
       auth.requireAuth();
-      const s = await workerStatus(mk(options));
-      if (json()) { console.log(JSON.stringify(s, null, 2)); return; }
-      if (!s.worker) { printInfo('no offload worker leased (it is leased on the next `quox offload -- <command>`)'); return; }
-      const w = s.worker;
-      console.log(`worker ${w.vmid}  ${w.ip || '?'}  ${w.state}  lessee ${w.lessee}  lease expires ${w.lease_expires_at || '?'}`);
-      for (const d of s.dirs) console.log(`  synced ${d.local} -> ${d.remote}  ${d.synced_at || ''}`);
+      // commander hands `status --worker x` to the parent offload command's --worker, so read both.
+      const s = await workerStatus(mk({ worker: options.worker ?? off.opts().worker }));
+      const report = await allLeases(base());
+      warn(report);
+      if (json()) { console.log(JSON.stringify({ ...s, leases: report.leases }, null, 2)); return; }
+      if (!s.worker) printInfo('this worker has no lease (a human profile leases it on the next `quox offload -- <command>`)');
+      else {
+        const w = s.worker;
+        console.log(`worker ${w.vmid}  ${w.ip || '?'}  ${w.state}  lessee ${w.lessee}  lease expires ${w.lease_expires_at || '?'}`);
+        for (const d of s.dirs) console.log(`  synced ${d.local} -> ${d.remote}  ${d.synced_at || ''}`);
+      }
+      for (const line of leaseLines(report)) console.log(line);
+    });
+
+  off.command('leases')
+    .description(`List every configured offload worker lease with EXPIRED / EXPIRING (within ${LEASE_WARN_H}h) / OK and the human renew command (read-only)`)
+    .action(async () => {
+      auth.requireAuth();
+      const report = await allLeases(base());
+      warn(report);
+      if (json()) { console.log(JSON.stringify(report, null, 2)); return; }
+      for (const line of leaseLines(report)) console.log(line);
     });
 
   off.command('release')
@@ -77,7 +111,14 @@ export function registerOffloadCommands(program, ctx, { deps: injected } = {}) {
     .action(async (options) => {
       auth.requireAuth();
       try {
-        const vmid = await releaseWorker(mk(options));
+        // commander hands `release --worker x` to the parent offload command; reading only the subcommand's
+        // options released (destroyed) the SHARED default worker instead of x.
+        const d = mk({ worker: options.worker ?? off.opts().worker });
+        if (d.worker && !listWorkerNames(d).includes(d.worker)) {
+          const known = listWorkerNames(d).map((n) => n || 'default').join(', ') || 'none';
+          throw new OffloadError(`no offload worker named ${JSON.stringify(d.worker)} (configured: ${known}); nothing released`);
+        }
+        const vmid = await releaseWorker(d);
         if (json()) console.log(JSON.stringify({ released: vmid }));
         else printInfo(vmid ? `released worker ${vmid}` : 'no offload worker to release');
       } catch (e) {