sealkeep 0.11.0 → 0.11.2

package/CHANGELOG.md

@@ -3,6 +3,50 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.11.2 — 2026-09-18 — a release tells you when a newer one exists
+
+- Sealkeep says, once a day at most, when a newer release is on npm and what
+  to run. A person finds out from the tool they already have open, or not at
+  all: 0.11.0 sat on the registry for two days unable to open a 0.11.1 vault's
+  predecessor, and nobody running it could learn the fix existed. The note
+  prints after the command's own output, never before it and never instead of
+  it, including when the command failed. The answer is cached per machine, so
+  a scripted loop makes no traffic; a failed check counts as the day's check,
+  so an offline machine stops asking. It is silent on every failure, skipped
+  for `--json`, hooks, the daemon, the MCP server and any non-terminal output,
+  and turned off for good with `SEALKEEP_NO_UPDATE_CHECK=1` (or the
+  conventional `NO_UPDATE_NOTIFIER=1`). Nothing is sent: it reads the same
+  public package metadata `npm view` reads.
+
+## 0.11.1 — 2026-09-18 — an upgrade keeps what you already sealed
+
+Found by installing the published 0.9.0 from npm, building a vault with it,
+and upgrading in place to the published 0.11.0.
+
+- **Archives sealed before the rename open again.** A recipient is located in
+  an envelope by hashing a label with its salt, and renaming the product from
+  Vaultline to Sealkeep changed that label — so every archive written by 0.9.0
+  or earlier answered "no recipient could be opened with the supplied secret"
+  under 0.11.0, with the right phrase and intact bytes. Nothing was lost and
+  nothing was corrupt; the key could not be found to try. Both names are now
+  accepted when opening, forever, and only the current one is written. Device
+  keys were affected the same way, through their identifier and their key
+  exchange, and are fixed with them.
+- **Content search survives the upgrade.** The sealed index was named
+  `content-index.vlindex` before the rename and is read as
+  `content-index.skindex` now, so search answered "no local content index"
+  while `index status` and `sealkeep doctor` — which read the coverage file,
+  whose name never changed — both insisted every archive was searchable. The
+  index is adopted under its current name on first use, so a search, a status
+  and a build all see the work the previous release did instead of silently
+  discarding it.
+- `sealkeep doctor` fails when an agent's memory hooks are installed and the
+  service that prepares memory ran and then stopped. The hooks fail open by
+  design, so that combination gives every session no memory and no reason; it
+  happened on a test machine whose daemon had died, and nothing said so. A
+  vault that never started the service is left alone: archiving by hand is a
+  complete way to use this.
+
 ## 0.11.0 — 2026-09-16 — automatic memory that works, and an append-only index
 
 **Automatic recall now works on a real, long-lived vault.** The hook lane

package/dist/packages/sealkeep-crypto/src/recipients.d.ts

@@ -4,6 +4,7 @@ export declare class CryptoError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+export declare function legacyKeyRecipientId(publicKeyRaw: Buffer): string;
 /** Overwrites key material in place. Best effort: it cannot reach copies the runtime made. */
 export declare function zeroize(...buffers: Buffer[]): void;
 export declare function derivePhraseKey(phrase: string, salt: Buffer, params?: ScryptParams): Buffer;

package/dist/packages/sealkeep-crypto/src/recipients.js

@@ -11,6 +11,29 @@ export class CryptoError extends Error {
 }
 const b64 = (value) => value.toString("base64");
 const unb64 = (value) => Buffer.from(value, "base64");
+/**
+ * Recipient identifiers, and the names this product used to publish under.
+ *
+ * A recipient is found in an envelope by hashing a label with its salt or its
+ * public key, so the label is part of the on-disk format: renaming the product
+ * from Vaultline to Sealkeep changed every identifier, and an archive sealed
+ * by the older release stopped matching any recipient at all. Its bytes are
+ * fine and its phrase is right; nothing could find the key to try. Both names
+ * are therefore accepted when opening, forever, and only the current one is
+ * ever written.
+ */
+const PHRASE_RECIPIENT_LABEL = "sealkeep-phrase-recipient:v2";
+const LEGACY_PHRASE_RECIPIENT_LABEL = "vaultline-phrase-recipient:v2";
+const KEY_RECIPIENT_LABEL = "sealkeep-key-recipient:v2";
+const LEGACY_KEY_RECIPIENT_LABEL = "vaultline-key-recipient:v2";
+const KEY_EXCHANGE_LABEL = "sealkeep-recipient:v2";
+const LEGACY_KEY_EXCHANGE_LABEL = "vaultline-recipient:v2";
+function legacyPhraseRecipientId(salt) {
+    return createHash("sha256").update(Buffer.concat([Buffer.from(LEGACY_PHRASE_RECIPIENT_LABEL), salt])).digest("hex").slice(0, 32);
+}
+export function legacyKeyRecipientId(publicKeyRaw) {
+    return createHash("sha256").update(Buffer.concat([Buffer.from(LEGACY_KEY_RECIPIENT_LABEL), publicKeyRaw])).digest("hex").slice(0, 32);
+}
 /** Overwrites key material in place. Best effort: it cannot reach copies the runtime made. */
 export function zeroize(...buffers) {
     for (const buffer of buffers)
@@ -38,10 +61,10 @@ function openKey(suite, kek, nonce, sealed, aad) {
     }
 }
 export function phraseRecipientId(salt) {
-    return createHash("sha256").update(Buffer.concat([Buffer.from("sealkeep-phrase-recipient:v2"), salt])).digest("hex").slice(0, 32);
+    return createHash("sha256").update(Buffer.concat([Buffer.from(PHRASE_RECIPIENT_LABEL), salt])).digest("hex").slice(0, 32);
 }
 export function keyRecipientId(publicKeyRaw) {
-    return createHash("sha256").update(Buffer.concat([Buffer.from("sealkeep-key-recipient:v2"), publicKeyRaw])).digest("hex").slice(0, 32);
+    return createHash("sha256").update(Buffer.concat([Buffer.from(KEY_RECIPIENT_LABEL), publicKeyRaw])).digest("hex").slice(0, 32);
 }
 export function rawPublicKey(key) {
     // The last 32 bytes of an X25519 SPKI DER encoding are the raw public key.
@@ -94,7 +117,12 @@ export function unwrapArchiveKey(wrappedKeys, suite, archiveId, unlock) {
     for (const wrapped of wrappedKeys) {
         if ("phrase" in unlock && wrapped.type === "phrase") {
             const salt = unb64(wrapped.kdf.salt);
-            if (!timingSafeEqual(Buffer.from(phraseRecipientId(salt)), Buffer.from(wrapped.id))) {
+            // Either name: an archive sealed before the rename carries the legacy
+            // identifier, and refusing it there loses the archive to its own owner.
+            const stored = Buffer.from(wrapped.id);
+            const matches = timingSafeEqual(Buffer.from(phraseRecipientId(salt)), stored)
+                || timingSafeEqual(Buffer.from(legacyPhraseRecipientId(salt)), stored);
+            if (!matches) {
                 failures.push("phrase recipient id mismatch");
                 continue;
             }
@@ -112,16 +140,28 @@ export function unwrapArchiveKey(wrappedKeys, suite, archiveId, unlock) {
         if ("privateKey" in unlock && wrapped.type === "x25519") {
             const privateKey = typeof unlock.privateKey === "string" ? createPrivateKey(unlock.privateKey) : unlock.privateKey;
             const shared = diffieHellman({ privateKey, publicKey: x25519PublicKeyFromRaw(unb64(wrapped.ephemeralPublicKey)) });
-            const kek = Buffer.from(hkdfSync("sha256", shared, Buffer.concat([unb64(wrapped.recipientPublicKey), unb64(wrapped.ephemeralPublicKey)]), Buffer.from("sealkeep-recipient:v2"), KEY_BYTES));
-            try {
-                return openKey(suite, kek, unb64(wrapped.nonce), unb64(wrapped.ciphertext), wrapAad(archiveId, wrapped.id));
-            }
-            catch (error) {
-                failures.push(error.code);
-            }
-            finally {
-                zeroize(kek, shared);
+            const info = Buffer.concat([unb64(wrapped.recipientPublicKey), unb64(wrapped.ephemeralPublicKey)]);
+            // The key-exchange label moved with the rename too, so a device key
+            // wrapped by the older release derives a different key-encryption key.
+            // Try today's, then the one that was published before it.
+            let opened;
+            for (const label of [KEY_EXCHANGE_LABEL, LEGACY_KEY_EXCHANGE_LABEL]) {
+                const kek = Buffer.from(hkdfSync("sha256", shared, info, Buffer.from(label), KEY_BYTES));
+                try {
+                    opened = openKey(suite, kek, unb64(wrapped.nonce), unb64(wrapped.ciphertext), wrapAad(archiveId, wrapped.id));
+                }
+                catch (error) {
+                    failures.push(error.code);
+                }
+                finally {
+                    zeroize(kek);
+                }
+                if (opened)
+                    break;
             }
+            zeroize(shared);
+            if (opened)
+                return opened;
         }
     }
     throw new CryptoError("no_recipient", `No recipient could be opened with the supplied secret (${failures.length} attempted)`);

package/dist/src/cli.js

@@ -274,6 +274,27 @@ function usage() {
         `${dim("Docs:")} README.md ${dim("·")} ${dim("Security:")} THREAT_MODEL.md\n`
     ].join("\n");
 }
+/**
+ * This install's own package manifest. The file sits one level up from
+ * dist/src but two from src/, so a fixed relative path is right in exactly one
+ * of development and the published package: walk up until our own is found.
+ */
+async function ownManifest() {
+    const { readFile } = await import("node:fs/promises");
+    const { dirname, join } = await import("node:path");
+    const { fileURLToPath } = await import("node:url");
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let up = 0; up < 5; up += 1) {
+        try {
+            const found = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
+            if (found?.name === "sealkeep" || found?.name === "vaultline")
+                return found;
+        }
+        catch { /* keep walking */ }
+        dir = dirname(dir);
+    }
+    return null;
+}
 async function main() {
     const [command, ...args] = process.argv.slice(2);
     const json = args.includes("--json");
@@ -284,20 +305,7 @@ async function main() {
         // The manifest sits one level up from dist/src but two from src/, so a fixed
         // relative path is right in exactly one of dev and the published package.
         // Walk up until we find our own manifest instead.
-        const { readFile } = await import("node:fs/promises");
-        const { dirname, join } = await import("node:path");
-        const { fileURLToPath } = await import("node:url");
-        let dir = dirname(fileURLToPath(import.meta.url));
-        let manifest = null;
-        for (let up = 0; up < 5 && !manifest; up += 1) {
-            try {
-                const found = JSON.parse(await readFile(join(dir, "package.json"), "utf8"));
-                if (found?.name === "sealkeep" || found?.name === "vaultline")
-                    manifest = found;
-            }
-            catch { /* keep walking */ }
-            dir = dirname(dir);
-        }
+        const manifest = await ownManifest();
         if (!manifest)
             fail("internal", "Could not read the Sealkeep package manifest");
         print(json ? JSON.stringify({ name: manifest.name, version: manifest.version }, null, 2) : `${manifest.name} ${manifest.version}`);
@@ -3682,7 +3690,38 @@ const HINTS = {
     // copy, if one exists, is unaffected and `sealkeep verify` proves it.
     ciphertext_integrity_failed: "the local sealed file is damaged; nothing was written. If this archive has a stored copy, `sealkeep verify` checks it and `sealkeep open <ref> <destination>` reads it back"
 };
-main().catch((error) => {
+/**
+ * One line, after the command's own output, when a newer release exists.
+ *
+ * It runs last on purpose: a person came here to do something, and an
+ * announcement that delays or replaces their answer is worse than no
+ * announcement. Anything that goes wrong here — offline, blocked registry,
+ * unreadable manifest — is silence, never an error and never an exit code.
+ * Machine-readable runs, hooks and the daemon are excluded: nothing may
+ * appear in output another program parses or in a lane nobody watches.
+ */
+async function noteNewerRelease() {
+    const command = process.argv[2];
+    const args = process.argv.slice(3);
+    if (process.argv.includes("--json") || !process.stdout.isTTY)
+        return;
+    if (command === undefined || ["hook", "daemon", "mcp", "api", "--version", "-v", "version"].includes(command))
+        return;
+    try {
+        const manifest = await ownManifest();
+        const current = manifest?.version;
+        if (!current)
+            return;
+        const dataDirFlag = args.indexOf("--data-dir");
+        const dataDir = (dataDirFlag >= 0 ? args[dataDirFlag + 1] : undefined) ?? envVar("DATA_DIR") ?? defaultDataDir();
+        const { newerReleaseThan, updateNotice } = await import("./release-check.js");
+        const latest = await newerReleaseThan(current, dataDir);
+        if (latest)
+            console.error(`\n  ${hint(updateNotice(latest, current))}\n`);
+    }
+    catch { /* a version check must never be the thing that fails */ }
+}
+main().then(noteNewerRelease, (error) => {
     const { error: payload } = errorPayload(error);
     console.error(`\n  ${mark.fail()} ${payload.message}`);
     const suggestion = HINTS[payload.code];
@@ -3690,4 +3729,5 @@ main().catch((error) => {
         console.error(`  ${hint(suggestion)}`);
     console.error(`  ${dim(payload.code)}\n`);
     process.exitCode = 1;
+    return noteNewerRelease();
 });

package/dist/src/doctor.js

@@ -331,10 +331,26 @@ export async function runDoctor(dataDir, env = process.env, home = env.HOME ?? e
     // Hooks fail open, so a recall lane whose passes keep dying is invisible at
     // the agent: memory is simply absent. The service's heartbeat is the one
     // place that records it.
-    const recallLane = (await readHeartbeat(dataDir))?.context;
+    const recallBeat = await readHeartbeat(dataDir);
+    const recallLane = recallBeat?.context;
+    const recallService = liveness(recallBeat);
     const { readHookUnlockFailure } = await import("./agent-context.js");
     const unlockFailure = await readHookUnlockFailure(dataDir);
-    if (unlockFailure && Date.now() - Date.parse(unlockFailure.at) < 24 * 60 * 60_000) {
+    // A stopped service is the quietest failure of all. The hooks still run and
+    // still fail open, so every session simply gets no memory and no reason —
+    // exactly what happened on a rehearsal machine whose daemon had died: the
+    // requests queued and nobody drained them. Only worth saying when the hooks
+    // are installed, because a vault archived by hand has nothing to prepare.
+    // Only a service that RAN and stopped: a vault that never started one is
+    // being used by hand, which this product supports and says so elsewhere.
+    const hooksExpectRecall = supported.some((agent) => agent.hooksInstalled && !agent.hooksAimedElsewhere);
+    if (hooksExpectRecall && recallService.state === "stopped") {
+        checks.push({
+            name: "automatic-recall", status: "fail",
+            detail: `Your agents' memory hooks are installed, but the service that prepares memory is not running (${recallService.detail.replace(/^Not running\. /, "").replace(/^It /, "it ")}). Until it runs, every session starts with no memory and no error. Start it from Settings › Automatic archiving, or run \`sealkeep daemon\`.`,
+        });
+    }
+    else if (unlockFailure && Date.now() - Date.parse(unlockFailure.at) < 24 * 60 * 60_000) {
         checks.push({
             name: "automatic-recall", status: "fail",
             detail: `The ${unlockFailure.agent === "codex" ? "Codex" : "Claude Code"} memory hook could not unlock this vault at ${unlockFailure.at.slice(0, 16).replace("T", " ")}: automatic recall and hook capture were silently off for that session, while archiving may have kept working. The hook ran with SEALKEEP_SECRET_BACKEND ${unlockFailure.backend ? `= ${unlockFailure.backend}` : "unset"}; the hooks and the background service must find the recovery phrase in the same secret backend (Settings › Unlocking, or \`sealkeep autopilot\`).`,

package/dist/src/release-check.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The version to suggest, or null. Never throws, never blocks longer than its
+ * own timeout, and answers from cache when today's check already happened.
+ */
+export declare function newerReleaseThan(currentVersion: string, dataDir: string, options?: {
+    now?: () => number;
+    env?: NodeJS.ProcessEnv;
+    fetchLatest?: (signal: AbortSignal) => Promise<string | null>;
+}): Promise<string | null>;
+/** The one line a person sees. Kept to a fact and the command that acts on it. */
+export declare function updateNotice(latest: string, current: string): string;

package/dist/src/release-check.js

@@ -0,0 +1,117 @@
+/**
+ * "A newer Sealkeep is out."
+ *
+ * Shipping 0.11.0 taught us why this is worth having: a release that could not
+ * open archives written by its predecessor sat on the registry for two days,
+ * and nobody running it had any way to learn that the fix existed. A person
+ * finds out from the tool they already have open, or not at all.
+ *
+ * The rules this follows, because a version check is a network call the user
+ * did not ask for:
+ *  - never before the command runs, and never in its way: the check is a
+ *    background read of a cached answer, and the note prints after the work;
+ *  - at most one request a day, per machine, recorded in the vault's runtime
+ *    directory, so a scripted loop cannot turn into a traffic generator;
+ *  - never for a machine-readable run (`--json`), a hook, or a daemon;
+ *  - silent on every failure. An offline laptop, a blocked registry and a
+ *    proxy that answers with HTML all mean "no note", never an error;
+ *  - nothing is sent but the request itself: no vault id, no identifiers, no
+ *    telemetry. It reads the same public metadata `npm view` reads, and can be
+ *    turned off for good with SEALKEEP_NO_UPDATE_CHECK=1.
+ */
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+const REGISTRY_URL = "https://registry.npmjs.org/sealkeep/latest";
+const CHECK_INTERVAL_MS = 24 * 60 * 60_000;
+const REQUEST_TIMEOUT_MS = 2_000;
+const statePath = (dataDir) => join(dataDir, "runtime", "latest-release.json");
+/** A dotted release, compared numerically; anything unparseable sorts lowest. */
+function isNewer(candidate, current) {
+    const parts = (value) => {
+        const core = value.split(/[-+]/, 1)[0] ?? "";
+        const numbers = core.split(".").map((piece) => Number.parseInt(piece, 10));
+        return numbers.length === 3 && numbers.every((piece) => Number.isInteger(piece) && piece >= 0) ? numbers : null;
+    };
+    const left = parts(candidate);
+    const right = parts(current);
+    if (!left || !right)
+        return false;
+    for (let index = 0; index < 3; index += 1) {
+        if (left[index] !== right[index])
+            return left[index] > right[index];
+    }
+    // A pre-release of the same numbers is not an upgrade to offer.
+    return false;
+}
+async function readCached(dataDir) {
+    try {
+        const raw = JSON.parse(await readFile(statePath(dataDir), "utf8"));
+        if (typeof raw.version !== "string" || typeof raw.at !== "string")
+            return null;
+        return { version: raw.version, at: raw.at };
+    }
+    catch {
+        return null;
+    }
+}
+async function writeCached(dataDir, value) {
+    const target = statePath(dataDir);
+    const temp = `${target}.${randomUUID()}.tmp`;
+    try {
+        await mkdir(join(dataDir, "runtime"), { recursive: true, mode: 0o700 });
+        await writeFile(temp, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+        await rename(temp, target);
+    }
+    catch {
+        // A read-only or full disk must never cost a command its result.
+    }
+    finally {
+        await rm(temp, { force: true }).catch(() => undefined);
+    }
+}
+async function fetchLatest(signal) {
+    try {
+        const response = await fetch(REGISTRY_URL, { signal, headers: { accept: "application/vnd.npm.install-v1+json, application/json" } });
+        if (!response.ok)
+            return null;
+        const body = await response.json();
+        return typeof body.version === "string" && /^\d+\.\d+\.\d+/.test(body.version) ? body.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The version to suggest, or null. Never throws, never blocks longer than its
+ * own timeout, and answers from cache when today's check already happened.
+ */
+export async function newerReleaseThan(currentVersion, dataDir, options = {}) {
+    const env = options.env ?? process.env;
+    if (env.SEALKEEP_NO_UPDATE_CHECK === "1" || env.NO_UPDATE_NOTIFIER === "1" || env.CI === "true")
+        return null;
+    const now = options.now ?? Date.now;
+    const cached = await readCached(dataDir);
+    const fresh = cached && now() - Date.parse(cached.at) < CHECK_INTERVAL_MS;
+    if (fresh)
+        return isNewer(cached.version, currentVersion) ? cached.version : null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    let latest;
+    try {
+        latest = await (options.fetchLatest ?? fetchLatest)(controller.signal);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    // A failed check is recorded as "asked today" too: an offline machine must
+    // not retry on every single command.
+    await writeCached(dataDir, { version: latest ?? cached?.version ?? currentVersion, at: new Date(now()).toISOString() });
+    if (!latest)
+        return null;
+    return isNewer(latest, currentVersion) ? latest : null;
+}
+/** The one line a person sees. Kept to a fact and the command that acts on it. */
+export function updateNotice(latest, current) {
+    return `Sealkeep ${latest} is available (you have ${current}). Update with: npm i -g sealkeep@latest`;
+}

package/dist/src/search.js

@@ -75,6 +75,33 @@ function supersededArchiveIds(records) {
 export const INDEX_EXTRACTION_POLICY = 3;
 const indexPath = (dataDir) => join(dataDir, "index", "content-index.skindex");
 const envelopePath = (dataDir) => join(dataDir, "index", "content-index.json");
+/** What releases up to 0.9.0 named the sealed index, before the rename. */
+const legacyIndexPath = (dataDir) => join(dataDir, "index", "content-index.vlindex");
+/**
+ * Adopts an index file left by a pre-rename release.
+ *
+ * Only the NAME changed: the envelope beside it, the coverage file and the
+ * ciphertext are all still current. Upgrading therefore made content search
+ * answer "no local content index" while `index status` and doctor, which read
+ * coverage.json, kept insisting every archive was searchable — and because
+ * coverage looked complete, a rebuild believed it had nothing to do. The file
+ * is renamed on first use, which is why this is safe to call from a read.
+ */
+async function adoptLegacyIndexFile(dataDir) {
+    const current = indexPath(dataDir);
+    if (await stat(current).then(() => true, () => false))
+        return false;
+    const legacy = legacyIndexPath(dataDir);
+    if (!(await stat(legacy).then((info) => info.isFile(), () => false)))
+        return false;
+    try {
+        await rename(legacy, current);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 const coveragePath = (dataDir) => join(dataDir, "index", "coverage.json");
 const INDEX_TEMP_STALE_MS = 24 * 60 * 60_000;
 const OWNED_INDEX_TEMP = /^(content-index\.(?:skindex|json)|coverage\.json|(?:account|team)-publication\.pending\.json)\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.tmp$/;
@@ -799,6 +826,7 @@ export async function buildContentIndex(dataDir, rawPhrase, options = {}) {
     };
     await readConfig(dataDir);
     await cleanupStaleContentIndexTemps(dataDir);
+    await adoptLegacyIndexFile(dataDir);
     const records = await listArchives(dataDir);
     // Segments mode is decided once, up front: a vault either has a manifest
     // with at least one segment (sealkeep index migrate created it) or it
@@ -3885,6 +3913,7 @@ export async function loadContentIndex(dataDir, rawPhrase, options = {}) {
     options.signal?.throwIfAborted();
     const phrase = canonicalPhrase(rawPhrase);
     const identity = await localIndexFileIdentity(dataDir);
+    await adoptLegacyIndexFile(dataDir);
     const envelope = await readFile(envelopePath(dataDir), "utf8").then((raw) => JSON.parse(raw)).catch(() => null);
     const ciphertextPath = indexPath(dataDir);
     const exists = await stat(ciphertextPath).then((entry) => entry.isFile()).catch(() => false);
@@ -4955,6 +4984,9 @@ async function rangedQueryIndex(dataDir, phrase, terms, options) {
 }
 export async function loadContentIndexForQuery(dataDir, rawPhrase, terms, options = {}) {
     const phrase = canonicalPhrase(rawPhrase);
+    // A vault upgraded from a pre-rename release still has its index under the
+    // old file name; adopt it before anything asks whether an index exists.
+    await adoptLegacyIndexFile(dataDir);
     // Segments mode: every segment is opened and merged directly, never through
     // the legacy blob's ranged directory or full-decrypt paths below. The
     // personal-source-facts cache is skipped here — a term-less lookup (as
@@ -6289,6 +6321,10 @@ export async function search(dataDir, query, options = {}) {
  */
 export async function indexCoverage(dataDir, options = {}) {
     const records = await listArchives(dataDir);
+    // Status must not report a searchable vault whose index file this release
+    // cannot see (see adoptLegacyIndexFile): coverage.json survives a rename
+    // and would otherwise claim full coverage while every search failed.
+    await adoptLegacyIndexFile(dataDir);
     const coverage = await readFile(coveragePath(dataDir), "utf8")
         .then((raw) => JSON.parse(raw))
         .catch(() => null);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "repository": {