sealkeep 0.11.3 → 0.11.5

package/CHANGELOG.md

@@ -3,6 +3,63 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.11.5 — 2026-09-23 — compacting is safe, and a lost destination says so
+
+- **An agent that has just been compacted is told where the work stands.**
+  Compacting is the only thing that makes a running session cheaper: the whole
+  conversation is re-sent on every request, so cost is roughly its size times
+  the number of steps. Measured on one real machine, a session was sending
+  577,000 tokens per step, 98% of it re-read history. What stops people
+  compacting early is that the summary loses detail and the agent then
+  re-reads files to work out where it was, which costs far more than being
+  told. Sealkeep now hears the compaction — Claude names that source too, and
+  only Codex was listening — and treats the session as a new reader, because
+  it is: everything it had been handed is gone from the window. It says the
+  short version once, with your next message. Nothing is lost from the archive
+  either way; the transcript on disk keeps every message, compacted or not.
+  Settings → "What reaches your agent" has the switch. Codex reviews changed
+  hooks once, so it asks you to review Sealkeep's again after this upgrade.
+
+- **When a destination stops accepting this machine, you are told.** Sealkeep
+  worked out reachability every minute and published it to the account panel,
+  so a Drive whose authorization had lapsed was visible to anyone who opened
+  Settings or ran doctor, and to nobody else — while archives piled up locally
+  and the upload ledger grew. It now says so once when that changes, as a
+  desktop notification on macOS, Linux and Windows, and as a line after your
+  next command. The first sight of a destination is never announced, still
+  broken is not repeated, and the last state is kept across restarts so an
+  upgrade neither repeats a message nor swallows one. It names what it means
+  for the work first: new archives stay here and nothing is lost.
+
+## 0.11.4 — 2026-09-23 — history stays findable
+
+- **An archive can no longer be dropped from search because one sidecar could
+  not be read.** The build treats an id missing from the archive ledger as
+  deleted and retires it, which in segments mode is permanent: the id vanishes
+  from every later lookup and no build indexes it again. But the ledger scan
+  skips any sidecar it cannot parse — a partial write being replaced, one
+  transient read error — and that scan is cached per directory, so the damage
+  only surfaces when something else changes the directory: a seal arriving
+  while a build runs, which is what a busy machine does all day. On one real
+  vault ten archives had been retired with nothing superseding them, and two
+  sessions were genuinely unfindable — words in one returned no hits from it
+  while matching hundreds of other sessions. Absence now counts as deletion
+  only when the scan read every sidecar.
+
+  A vault that already lost archives this way recovers with `sealkeep index
+  drop` followed by `sealkeep index build`, which clears every retirement and
+  indexes the archives again. Repairing it automatically was tried and dropped:
+  a retirement also travels between your machines, so a build that lifted one
+  could undo a removal another machine meant, and the suite caught that.
+
+- **The team check no longer runs on every seal.** 0.11.3 gave the lane its own
+  backing-off cadence, but a tick still asked it for a pass, and a tick is
+  scheduled whenever the queue has work — so cloud traffic still followed local
+  sealing. Measured on a busy machine: passes 4-6 seconds apart while a backlog
+  drained, against the 6-to-120-second schedule the lane had chosen. Nothing is
+  lost by waiting for that schedule; a pass this machine's own sealing triggers
+  cannot learn anything sooner than one the clock triggers.
+
 ## 0.11.3 — 2026-09-23 — the context tax, and a vault that catches up
 
 - **The team check stops asking the cloud every three seconds.** The daemon

package/dist/src/adapters.d.ts

@@ -26,7 +26,7 @@ export type AgentInstall = {
 export declare const SETUP_AGENT_IDS: SetupAgentId[];
 /** The subset with a session adapter. Mirrors `AgentId` at runtime for schema use. */
 export declare const ARCHIVING_AGENT_IDS: readonly ["codex", "claude"];
-export declare const HOOK_LIFECYCLE_VERSION = 3;
+export declare const HOOK_LIFECYCLE_VERSION = 4;
 /** Narrows a setup id to an archiving one, so callers prove the subset rather than casting to it. */
 export declare function isArchivingAgent(agent: SetupAgentId): agent is AgentId;
 /** Detect only well-known local roots; it never reads transcript contents. */

package/dist/src/adapters.js

@@ -69,7 +69,7 @@ const AGENTS = {
 export const SETUP_AGENT_IDS = Object.keys(AGENTS);
 /** The subset with a session adapter. Mirrors `AgentId` at runtime for schema use. */
 export const ARCHIVING_AGENT_IDS = ["codex", "claude"];
-export const HOOK_LIFECYCLE_VERSION = 3;
+export const HOOK_LIFECYCLE_VERSION = 4;
 /** Narrows a setup id to an archiving one, so callers prove the subset rather than casting to it. */
 export function isArchivingAgent(agent) {
     return ARCHIVING_AGENT_IDS.includes(agent);
@@ -589,7 +589,10 @@ export function hookConfig(agent, executable = "sealkeep", dataDir = "~/.sealkee
         ...(agent === "codex" ? { additionalContextLimit: 2000 } : {})
     };
     const contextStart = [{
-            matcher: agent === "codex" ? "startup|resume|clear|compact" : "startup|resume|clear",
+            // "compact" matters most of all: the window has just been replaced by a
+            // summary, which is exactly when an agent starts re-reading files to work
+            // out where it was. Claude names that source too; only Codex was listening.
+            matcher: "startup|resume|clear|compact",
             hooks: [{ type: "command", command: contextSync, timeout: 30, async: true }]
         }];
     const contextPrompt = [{ hooks: [
@@ -835,21 +838,17 @@ function lifecycleInstalled(agent, contents) {
         const owned = commandsIn(document.hooks).filter((command) => lifecycleIdentity(command)?.endsWith(`:${agent}`));
         if (owned.some((command) => !command.includes(`--lifecycle ${HOOK_LIFECYCLE_VERSION}`)))
             return false;
-        const actionCount = (action) => owned.filter((command) => lifecycleIdentity(command) === `${action}:${agent}`).length;
-        if (actionCount("enqueue") !== (agent === "codex" ? 2 : 1)
-            || actionCount("rehydrate") !== 0
-            || actionCount("context") !== 2
-            || actionCount("context-sync") !== 3)
+        // The expected lifecycle is read from the generator, not restated here. A
+        // restated count ("context-sync appears three times") declared every file
+        // the generator had just written incomplete the moment it gained a hook.
+        const expected = hookConfig(agent).hooks;
+        const identities = (commands) => commands.map(lifecycleIdentity).filter((identity) => identity !== null).sort();
+        if (identities(owned).join() !== identities(commandsIn(expected)).join())
             return false;
-        const eventHas = (event, action) => commandsIn(document.hooks?.[event]).some((command) => command.includes(`hook ${action} --agent ${agent}`)
-            && command.includes(`--lifecycle ${HOOK_LIFECYCLE_VERSION}`));
-        return eventHas("SessionEnd", "enqueue")
-            && eventHas("UserPromptSubmit", "context")
-            && eventHas("PostToolUse", "context")
-            && eventHas("SessionStart", "context-sync")
-            && eventHas("UserPromptSubmit", "context-sync")
-            && eventHas("PostToolUse", "context-sync")
-            && (agent !== "codex" || eventHas("PostCompact", "enqueue"));
+        return Object.entries(expected).every(([event, groups]) => {
+            const present = new Set(identities(commandsIn(document.hooks?.[event])));
+            return identities(commandsIn(groups)).every((identity) => present.has(identity));
+        });
     }
     catch {
         return false;

package/dist/src/agent-context.d.ts

@@ -23,6 +23,8 @@ export type AgentHookPayload = {
     transcript_path?: string;
     rollout_path?: string;
     tool_name?: string;
+    /** Why a session started: "startup" | "resume" | "clear" | "compact". */
+    source?: string;
 };
 export type AutomaticContextOutcome = {
     project: string;

package/dist/src/agent-context.js

@@ -88,6 +88,9 @@ export function parseAgentHookPayload(raw) {
             hook_event_name: text("hook_event_name"), session_id: text("session_id"), thread_id: text("thread_id"),
             cwd: text("cwd"), prompt: text("prompt"), transcript_path: text("transcript_path"),
             rollout_path: text("rollout_path"), tool_name: text("tool_name"),
+            // Without this a compaction is indistinguishable from any other start,
+            // and the session is never told what the summary dropped.
+            source: text("source"),
         };
     }
     catch {
@@ -1122,6 +1125,20 @@ export async function automaticAgentContext(dataDir, phrase, agent, payload, opt
         //
         // SEALKEEP_RECALL_PUSH=0 turns later boundaries off entirely, leaving only
         // the memories handed over at session start.
+        // A compaction replaces the conversation with a summary, so everything this
+        // session was already handed is gone from the window — and the record of
+        // what it has been told is now wrong. Clearing that record re-establishes
+        // the framing and the load-bearing lines once, at the one moment an agent
+        // would otherwise start re-reading files to work out where it was. That
+        // re-read costs far more than the few hundred tokens this spends, and
+        // compaction is the only thing that makes a running session cheaper: the
+        // whole window is re-sent on every request, so cost is roughly its size
+        // times the number of steps. Nothing is lost from the archive either way —
+        // the transcript on disk keeps every message, compacted or not.
+        const settings = await readLocalSettings(dataDir).catch(() => null);
+        if (event === "SessionStart" && payload.source === "compact" && (settings?.recall.atCompaction ?? true)) {
+            state.injected = [];
+        }
         const seen = new Set(state.injected ?? []);
         const greeted = seen.size > 0;
         // The switch lives in Settings; the environment variable stays as an override
@@ -1131,7 +1148,7 @@ export async function automaticAgentContext(dataDir, phrase, agent, payload, opt
             ? true
             : quiet === "1" || quiet === "true" || quiet === "on"
                 ? false
-                : !(await readLocalSettings(dataDir).then((settings) => settings.recall.autoInject).catch(() => true));
+                : !(settings?.recall.autoInject ?? true);
         // History the agent will actually believe goes in its own memory directory,
         // not only into the prompt. See src/agent-memory.ts for why: injected recall
         // was delivered perfectly and then refused, on two different models.

package/dist/src/cli.js

@@ -3778,6 +3778,15 @@ async function noteNewerRelease() {
         const latest = await newerReleaseThan(current, dataDir);
         if (latest)
             console.error(`\n  ${hint(updateNotice(latest, current))}\n`);
+        // A destination that stopped accepting this machine is worth the same
+        // sentence, and for the same reason: a person finds out from the tool they
+        // already have open, or not at all. The background service notices within
+        // a minute and records it; this only reads that record, so it costs no
+        // network and no credentials.
+        const { unreachableDestinations, unreachableNotice } = await import("./storage-reachability.js");
+        const unreachable = await unreachableDestinations(dataDir);
+        if (unreachable.length)
+            console.error(`\n  ${hint(unreachableNotice(unreachable))}\n`);
     }
     catch { /* a version check must never be the thing that fails */ }
 }

package/dist/src/daemon.js

@@ -1,3 +1,5 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
 import { freeBytes, resolveReserveBytes } from "./disk.js";
 import { ArchiveQueue } from "./queue.js";
 import { applyRetention, readApprovals, reconcileCodexReclaims, retentionSettings } from "./retention.js";
@@ -670,10 +672,58 @@ export async function startDaemon(dataDir, options) {
         // stay on each machine. Report only reachability (never credentials) on an
         // independent advisory lane so a disconnected Drive is visible in the
         // account panel before the next archive tries and fails to upload.
+        /**
+         * Say it out loud when a destination stops accepting this machine.
+         *
+         * Reachability was computed every minute and published to the account panel,
+         * and that was all: a Drive whose access had lapsed was visible only if you
+         * opened Settings or ran doctor. Meanwhile archives pile up locally and the
+         * upload ledger grows — the silent stall this product exists to prevent.
+         * Only a change is announced, and the last state is kept on disk so a
+         * restart (an upgrade restarts this service) neither repeats the message nor
+         * swallows one that happened while it was down.
+         */
+        const { reachabilityPath } = await import("./storage-reachability.js");
+        const reachabilityFile = reachabilityPath(dataDir);
+        const readReachability = async () => {
+            try {
+                const raw = JSON.parse(await readFile(reachabilityFile, "utf8"));
+                return Object.fromEntries(Object.entries(raw).filter(([, value]) => typeof value === "boolean"));
+            }
+            catch {
+                return {};
+            }
+        };
+        const announceStorageReachability = async () => {
+            const { resolveTargets, targetConnectionEvidence } = await import("./storage-targets.js");
+            const previous = await readReachability();
+            const current = {};
+            const changes = [];
+            for (const target of await resolveTargets(dataDir)) {
+                if (target.enabled === false)
+                    continue;
+                const { connected } = await targetConnectionEvidence(dataDir, target).catch(() => ({ connected: previous[target.id] ?? true }));
+                current[target.id] = connected;
+                const was = previous[target.id];
+                // An unseen destination is recorded, never announced: the first sight of
+                // one is not news, and a new machine would otherwise open with a warning.
+                if (was !== undefined && was !== connected)
+                    changes.push({ target: target.provider ?? target.id, connected });
+            }
+            await mkdir(dirname(reachabilityFile), { recursive: true, mode: 0o700 }).catch(() => undefined);
+            await writeFile(reachabilityFile, JSON.stringify(current, null, 2) + "\n", { mode: 0o600 }).catch(() => undefined);
+            for (const change of changes) {
+                await notify(change.connected
+                    ? { title: "Storage reconnected", body: `${change.target} is accepting this machine again. Waiting archives upload on the next pass.` }
+                    : { title: "Sealkeep cannot reach your storage", body: `${change.target} is not accepting this machine. New archives stay here, nothing is lost, and Sealkeep keeps trying. Reconnect it in Settings.` }, { ...options.notify, enabled: options.notifications ?? options.notify?.enabled }).catch(() => undefined);
+            }
+        };
         const reportStorageHealth = async () => {
             if (storageHealthInFlight)
                 return storageHealthInFlight;
-            const task = import("./storage-targets.js").then(({ pushTargetUsage }) => pushTargetUsage(dataDir));
+            const task = import("./storage-targets.js")
+                .then(({ pushTargetUsage }) => pushTargetUsage(dataDir))
+                .then(() => announceStorageReachability().catch(() => undefined));
             storageHealthInFlight = task;
             try {
                 await task;
@@ -780,9 +830,19 @@ export async function startDaemon(dataDir, options) {
                     notes.push(`rescanned transcript roots (${found} seen)`);
             }
             // Human access decisions live in SealKeep Cloud; private-key work stays on
-            // this machine. Polling here closes both loops automatically: owners wrap
-            // new invitations and accepted teammates/fresh machines bind the project.
-            requestAccessReconciliation();
+            // this machine, and the access lane above closes both loops on its own
+            // cadence: owners wrap new invitations and accepted teammates/fresh
+            // machines bind the project.
+            //
+            // A tick deliberately does NOT ask for a pass. A tick is scheduled
+            // whenever the queue has claimable work, so asking here tied cloud
+            // traffic to local sealing: on a machine sealing a session every couple
+            // of minutes the lane ran that often no matter how quiet the team was.
+            // Measured on a busy host, passes came 4-6 seconds apart while a backlog
+            // drained, against the 6-to-120-second schedule the lane had chosen.
+            // Nothing is lost by waiting for that schedule — a pass triggered by this
+            // machine's own sealing cannot learn anything sooner than one triggered
+            // by the clock.
             // This used to read `options.diskPressureFreeBytes` with no default, and
             // nothing anywhere set it — so the guard was dead code and the installed
             // service ran with no floor at all, on machines chosen for being short of

package/dist/src/local-api.js

@@ -214,7 +214,7 @@ const localSettingsSchema = z.object({
     bandwidth: z.object({ uploadLimitMbps: z.number().min(0).max(100_000).nullable() }).strict().optional(),
     // What reaches the agent. Injection is convenient and it is re-read on every
     // later step of a conversation, so it is a switch rather than a given.
-    recall: z.object({ autoInject: z.boolean() }).strict().optional(),
+    recall: z.object({ autoInject: z.boolean(), atCompaction: z.boolean().optional() }).strict().optional(),
     mcp: z.object({ enabled: z.boolean() }).strict().optional(),
     // Ceilings for background work. A floor on each, because a limit below it
     // would stall the work rather than pace it. null returns to automatic.
@@ -5474,7 +5474,10 @@ export function createLocalApiServer(dataDir, token, options = {}) {
                 const next = {
                     ...current, ...patch,
                     schedule: { ...current.schedule, ...patch.schedule },
-                    bandwidth: { ...current.bandwidth, ...patch.bandwidth }
+                    bandwidth: { ...current.bandwidth, ...patch.bandwidth },
+                    // Merged field by field like the others: a panel that sends only the
+                    // switch it changed must not drop the rest of the group.
+                    recall: { ...current.recall, ...patch.recall },
                 };
                 // The explicit, confirmed machine opt-in must be operational rather
                 // than a green switch in front of a policy that can never select work.

package/dist/src/machine-settings.d.ts

@@ -32,6 +32,19 @@ export type LocalSettings = {
      */
     recall: {
         autoInject: boolean;
+        /**
+         * Hand the agent its bearings back when its conversation is compacted.
+         *
+         * Compaction is the only thing that makes a running session cheaper: the
+         * whole conversation is re-sent on every request, so cost is roughly the
+         * size of the live window times the number of steps. What stops people
+         * compacting early is that the summary loses detail and the agent then
+         * re-reads files to work out where it was — which costs far more than the
+         * few hundred tokens of a note saying what is true now and that the rest
+         * is one search away. Nothing is lost from the archive either way: the
+         * transcript on disk keeps every message, compacted or not.
+         */
+        atCompaction: boolean;
     };
     /** The local MCP server that lets an agent search this vault by itself. */
     mcp: {

package/dist/src/machine-settings.js

@@ -113,7 +113,7 @@ export function defaultLocalSettings() {
         // On by default: an agent that is handed its history at the start of a
         // session is the product. It is deduplicated and never repeats itself, so
         // the standing cost is small — but it is a cost, and it is switchable.
-        recall: { autoInject: true },
+        recall: { autoInject: true, atCompaction: true },
         mcp: { enabled: true },
         limits: { cpuPercent: null, memoryMb: null },
     };
@@ -151,7 +151,10 @@ export async function readLocalSettings(dataDir) {
             exclusions: Array.isArray(saved?.exclusions) ? saved.exclusions.filter((path) => typeof path === "string") : [],
             schedule: { ...fallback.schedule, ...saved?.schedule },
             bandwidth: { ...fallback.bandwidth, ...saved?.bandwidth },
-            recall: { autoInject: typeof saved?.recall?.autoInject === "boolean" ? saved.recall.autoInject : fallback.recall.autoInject },
+            recall: {
+                autoInject: typeof saved?.recall?.autoInject === "boolean" ? saved.recall.autoInject : fallback.recall.autoInject,
+                atCompaction: typeof saved?.recall?.atCompaction === "boolean" ? saved.recall.atCompaction : fallback.recall.atCompaction,
+            },
             mcp: { enabled: typeof saved?.mcp?.enabled === "boolean" ? saved.mcp.enabled : fallback.mcp.enabled },
             limits: {
                 // A floor of 5% and 128 MB, because a ceiling below those would stall

package/dist/src/search.js

@@ -8,7 +8,7 @@ import { createGunzip, gunzipSync } from "node:zlib";
 import { decryptArchive as openEnvelope, decryptArchiveBodyChunks, encryptArchive as sealEnvelope, openArchiveToFile, sealArchiveToFile, unsqueezeStream, unsqueezeSync, validateEnvelope, rawPublicKey, x25519PrivateKeyFromRaw, x25519PublicKeyFromRaw } from "../packages/sealkeep-crypto/src/index.js";
 import { fail, isSealkeepError } from "./errors.js";
 import { canonicalPhrase } from "./mnemonic.js";
-import { configuredRecipients, decryptRecord, deltaOf, listArchives, readConfig, resolveDeltaChain, restoreRecordToFile, teamSpaceOf } from "./vault.js";
+import { configuredRecipients, decryptRecord, deltaOf, listArchives, listArchivesWithIntegrity, readConfig, resolveDeltaChain, restoreRecordToFile, teamSpaceOf } from "./vault.js";
 import { chunkWindowForRange, openChunkWindow, supportsChunkAccess } from "../packages/sealkeep-crypto/src/chunk-access.js";
 import { isV2, teamCustodyRecordIsValid } from "./types.js";
 import { archiveWrapsEveryMember } from "./upload.js";
@@ -849,7 +849,9 @@ export async function buildContentIndex(dataDir, rawPhrase, options = {}) {
     await readConfig(dataDir);
     await cleanupStaleContentIndexTemps(dataDir);
     await adoptLegacyIndexFile(dataDir);
-    const records = await listArchives(dataDir);
+    // Absence is only evidence of deletion when every sidecar could be read.
+    const { records, unreadable } = await listArchivesWithIntegrity(dataDir);
+    const absenceMeansGone = unreadable.length === 0;
     // Segments mode is decided once, up front: a vault either has a manifest
     // with at least one segment (sealkeep index migrate created it) or it
     // stays on the legacy blob path below, unchanged.
@@ -970,12 +972,19 @@ export async function buildContentIndex(dataDir, rawPhrase, options = {}) {
         // file's index entry, the newer snapshot named by its `supersedes` field
         // is — and every superseded id is named here even one this machine never
         // got around to covering, so the manifest need not remember it later.
-        const stale = [...new Set([...mine, ...superseded])].filter((id) => superseded.has(id) || !liveIds.has(id));
+        // Retiring an id from a segment is permanent: it disappears from every
+        // later lookup and compaction, and no build ever indexes it again. So it
+        // may only follow proof. A superseded snapshot is proof. Absence is not,
+        // unless the scan read every sidecar — see listArchivesWithIntegrity.
+        const stale = [...new Set([...mine, ...superseded])]
+            .filter((id) => superseded.has(id) || (absenceMeansGone && !liveIds.has(id)));
         if (stale.length)
             await retireArchiveIds(dataDir, stale);
     }
     else {
         for (const id of Object.keys(index.archives)) {
+            if (!absenceMeansGone)
+                break; // a short scan is not a deletion
             if (liveIds.has(id))
                 continue;
             if (!mine.has(id))

package/dist/src/storage-reachability.d.ts

@@ -0,0 +1,9 @@
+export declare const reachabilityPath: (dataDir: string) => string;
+/** Destination ids the service last saw refusing this machine, sorted. */
+export declare function unreachableDestinations(dataDir: string): Promise<string[]>;
+/**
+ * Says what broke, what it means for the work, and what to do — in that order.
+ * "Nothing is lost" is the part a person needs first: the archives are still
+ * here and still sealed, they simply have not left this machine yet.
+ */
+export declare function unreachableNotice(names: readonly string[]): string;

package/dist/src/storage-reachability.js

@@ -0,0 +1,38 @@
+/**
+ * Which destinations last refused this machine, and how to say so.
+ *
+ * Reachability was computed every minute and published to the account panel,
+ * and that was the only place it went: a Drive whose authorization had lapsed
+ * was visible to someone who opened Settings or ran doctor, and to nobody
+ * else. Archives pile up locally meanwhile and the upload ledger grows, which
+ * is the silent stall this product exists to prevent.
+ *
+ * The background service owns the observation and writes it here. Every reader
+ * — the CLI notice, a test — only reads this file, so telling a person costs
+ * no network call and touches no credential.
+ */
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+export const reachabilityPath = (dataDir) => join(dataDir, "runtime", "storage-reachability.json");
+/** Destination ids the service last saw refusing this machine, sorted. */
+export async function unreachableDestinations(dataDir) {
+    try {
+        const raw = JSON.parse(await readFile(reachabilityPath(dataDir), "utf8"));
+        return Object.entries(raw).filter(([, reachable]) => reachable === false).map(([id]) => id).sort();
+    }
+    catch {
+        // No observation yet, or an unreadable file. Saying nothing is correct:
+        // this is an advisory line after somebody's real answer, and a warning
+        // invented from a missing file would be worse than silence.
+        return [];
+    }
+}
+/**
+ * Says what broke, what it means for the work, and what to do — in that order.
+ * "Nothing is lost" is the part a person needs first: the archives are still
+ * here and still sealed, they simply have not left this machine yet.
+ */
+export function unreachableNotice(names) {
+    const subject = names.length === 1 ? `${names[0]} is` : `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]} are`;
+    return `${subject} not accepting this machine. New archives stay here and nothing is lost; reconnect in Settings (\`sealkeep ui\`).`;
+}

package/dist/src/vault.d.ts

@@ -181,6 +181,20 @@ export declare function teamRecipientsForProject(dataDir: string, project: strin
  * problem into a missing one. The archives that do parse still answer.
  */
 export declare function listArchives(dataDir: string): Promise<ArchiveRecord[]>;
+/**
+ * The same list, plus whether the scan could read every sidecar.
+ *
+ * A caller that concludes "this archive no longer exists" from absence needs
+ * this: one sidecar that could not be read — a partial write being replaced, a
+ * transient EIO — silently shortens the list. The index build drew exactly that
+ * conclusion and retired the archive from search permanently. Two of a real
+ * vault's sessions became unfindable that way; words in one returned no hits
+ * from it while matching hundreds of other sessions.
+ */
+export declare function listArchivesWithIntegrity(dataDir: string): Promise<{
+    records: ArchiveRecord[];
+    unreadable: string[];
+}>;
 /**
  * Registers an X25519 public key that may open future archives. Only the public
  * key is stored; the matching private key stays on its own device.

package/dist/src/vault.js

@@ -1373,6 +1373,22 @@ export async function listArchives(dataDir) {
     // dashboard requests shared the underlying filesystem scan.
     return scan.records.slice();
 }
+/**
+ * The same list, plus whether the scan could read every sidecar.
+ *
+ * A caller that concludes "this archive no longer exists" from absence needs
+ * this: one sidecar that could not be read — a partial write being replaced, a
+ * transient EIO — silently shortens the list. The index build drew exactly that
+ * conclusion and retired the archive from search permanently. Two of a real
+ * vault's sessions became unfindable that way; words in one returned no hits
+ * from it while matching hundreds of other sessions.
+ */
+export async function listArchivesWithIntegrity(dataDir) {
+    const config = await readConfig(dataDir);
+    const scan = await currentArchiveLedgerScan(config.storage.root);
+    reportUnreadableArchiveRecords(config.storage.root, scan.unreadable);
+    return { records: scan.records.slice(), unreadable: scan.unreadable.slice() };
+}
 // The dashboard loads several archive-derived endpoints together. A per-call
 // batch bound alone still multiplied 32 opens by every endpoint. Share both an
 // in-flight scan and a completed, generation-validated scan. Archive record

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.11.3",
+  "version": "0.11.5",
   "type": "module",
   "description": "Sealkeep by SPALA AI — your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "repository": {

package/web/app.js

@@ -4491,6 +4491,7 @@ function renderSettingsForm(local, _resolvedTrashStrategy) {
   const check = (id, on) => { const el = $(id); if (el) el.checked = on; };
   const fill = (id, value) => { const el = $(id); if (el) el.value = value; };
   check("f-auto-inject", local.recall?.autoInject !== false);
+  check("f-at-compaction", local.recall?.atCompaction !== false);
   check("f-mcp-enabled", local.mcp?.enabled !== false);
   fill("f-cpu", local.limits?.cpuPercent ?? "");
   fill("f-memory", local.limits?.memoryMb ?? "");
@@ -4521,7 +4522,7 @@ function collectSettingsPatch() {
       const raw = $("f-reserve").value.trim();
       return raw === "" ? null : Math.min(102_400, Math.max(200, Math.round(Number(raw) || 0)));
     })(),
-    recall: { autoInject: $("f-auto-inject")?.checked !== false },
+    recall: { autoInject: $("f-auto-inject")?.checked !== false, atCompaction: $("f-at-compaction")?.checked !== false },
     mcp: { enabled: $("f-mcp-enabled")?.checked !== false },
     limits: {
       cpuPercent: (() => {

package/web/index.html

@@ -329,6 +329,11 @@
             <p class="note">On by default. Your agent opens a project and already knows where you left off, without being asked.</p>
             <p class="note"><b>What it costs.</b> Anything placed in a conversation is re-read by the model on every later step, so a block added at the start is paid for again on every request that follows. Sealkeep sends each thing once and never repeats itself, which on a measured session cut this from 86 million tokens to 11 million, under one percent of what that session sent. Turn this off and preserved history is still written as notes your agent reads for itself, and is still searchable — it simply is not volunteered.</p>
           </div>
+          <div class="field">
+            <label class="opt"><input id="f-at-compaction" type="checkbox"> Give the agent its bearings back after its conversation is compacted</label>
+            <p class="note">On by default. When an agent's conversation is replaced by a summary, Sealkeep hands it the short version of where the work stands, once. Without that, an agent typically re-reads files to work out where it was, which costs far more than the note does.</p>
+            <p class="note"><b>Why it saves money.</b> The whole conversation is re-sent to the model on every step, so cost is roughly the size of that conversation times the number of steps. Compacting is the only thing that makes a running session cheaper, and this is what makes compacting early safe: nothing is lost either way, because the full transcript is preserved and searchable.</p>
+          </div>
           <div class="field">
             <label class="opt"><input id="f-mcp-enabled" type="checkbox"> Let agents search this vault themselves</label>
             <p class="note">On by default. Runs a local tool server so Claude Code and Codex can search your sealed history on demand. Nothing is exposed to the network. Turn it off and agents keep the notes and the automatic recall, but cannot go looking for more.</p>