sealkeep 0.11.5 → 0.11.7

package/CHANGELOG.md

@@ -3,6 +3,59 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.11.7 — 2026-09-26 — secret scanning and faster hooks
+
+- **Session hooks return after saving the archive request.** Queue-wide
+  reconciliation, sealing, indexing, and cloud upload continue in the
+  background, keeping large queues from exceeding the agent's hook timeout.
+
+- **Local dashboard bootstrap tickets require owner proof.** Browser-supplied
+  Fetch Metadata headers no longer mint a bearer ticket; the approved UI
+  bootstrap flow remains available.
+
+- **New seals can be checked for pasted credentials before they are encrypted
+  or uploaded.** The check is off until you turn it on. `sealkeep scan policy
+  record` stores findings with the archive. `block-high` refuses the seal
+  when a high-confidence finding exists, and it does that for automatic,
+  manual, MCP, and streamed seals. Medium findings, including the entropy
+  detector, never block. A transcript that changes while it is being scanned
+  is not sealed. Other scanner failures stop the seal when the policy is
+  `block-high`, or when `sealkeep scan policy fail-closed on` is set.
+  Otherwise the seal continues and does not claim it was scanned.
+
+- **What is stored, and what can leave the machine.** The archive record keeps
+  the detector kind, severity, count, and line numbers. It does not keep the
+  matched text or the masked preview. `sealkeep scan` on this machine still
+  prints the masked preview. An organization rollup is sent only after
+  `sealkeep scan policy rollup on` and `sealkeep scan policy plane <url>`.
+  That request contains kind, severity, and count. It does not contain
+  transcript text, matched values, paths, or line numbers. The control plane
+  keeps those rollups for 90 days. Consent is per machine and is not copied
+  when a policy file is imported.
+
+- **Patterns and policy can be shared without sharing consent.** Built-in
+  detectors stay fixed. `sealkeep scan pattern add <kind> <high|medium> <regex>`
+  adds a local detector. High custom findings block only under `block-high`.
+  A pattern must compile, must not match the empty string, must include four
+  consecutive letters or digits, and must not nest unbounded quantifiers.
+  `sealkeep scan policy export` and `import` move the mode, the fail-closed
+  flag, and the patterns. Each machine still chooses its own rollup consent
+  and control-plane URL. `sealkeep scan policy pull` copies the organization
+  policy from that URL and leaves consent unchanged.
+
+  The detectors are fixed patterns plus an entropy check. They do not prove
+  that a transcript contains no secret. A streamed or chunked seal uploads
+  the scanned copy, then deletes that copy even if later setup fails. A copy
+  left behind by a crash is removed on the next daemon start once its
+  process is gone.
+
+## 0.11.6 — 2026-09-25 — reconnect and Recovery Kit limits are separate
+
+- After a machine reconnects successfully, the Recovery Kit page says so even
+  if a later cloud check is paused by a service limit. It shows when that
+  check can be retried and no longer asks for another reconnect that cannot
+  lift the limit. The local recovery phrase and existing vault are unchanged.
+
 ## 0.11.5 — 2026-09-23 — compacting is safe, and a lost destination says so
 
 - **An agent that has just been compacted is told where the work stands.**

package/CONTROL_PLANE.md

@@ -20,6 +20,8 @@ Endpoints:
 - `POST /v1/archives/leases`, `POST /v1/archives/:id/complete`
 - `PUT /v1/archives/:id/manifest`, `GET /v1/archives`
 - `GET /v1/audit`
+- `GET` and `PUT /v1/secret-scan/policy` — mode, fail-closed, and custom patterns. No transcript content.
+- `POST` and `GET /v1/secret-scan/rollups` — detector kind, severity, and count only. Kept for 90 days. Line numbers, paths, and matched text are rejected.
 
 ## Authentication
 

package/dist/src/audit.d.ts

@@ -1,4 +1,4 @@
-export type AuditAction = "archive.create" | "index.tokens" | "index.merge" | "archive.restore" | "archive.restore_local" | "archive.sealed_copy_download" | "archive.migrate" | "archive.rewrap" | "archive.prune" | "archive.offload" | "archive.delete" | "archive.copy_delete" | "phrase.rotate" | "password.change" | "archive.share" | "source.reclaim" | "recipient.add" | "recipient.remove" | "upload.verify" | "remote.check" | "retention.approve" | "storage.gdrive_connect" | "storage.target_connect" | "storage.targets_update" | "phrase.reveal" | "recovery.codes_created" | "bridge.share" | "project.sharing" | "project.draft";
+export type AuditAction = "archive.create" | "index.tokens" | "index.merge" | "archive.restore" | "archive.restore_local" | "archive.sealed_copy_download" | "archive.migrate" | "archive.rewrap" | "archive.prune" | "archive.offload" | "archive.delete" | "archive.copy_delete" | "phrase.rotate" | "password.change" | "archive.share" | "source.reclaim" | "recipient.add" | "recipient.remove" | "upload.verify" | "remote.check" | "retention.approve" | "storage.gdrive_connect" | "storage.target_connect" | "storage.targets_update" | "phrase.reveal" | "recovery.codes_created" | "bridge.share" | "project.sharing" | "project.draft" | "secret_scan.rollup";
 export type LocalAuditEvent = {
     id: string;
     at: string;

package/dist/src/chunk-store.js

@@ -13,6 +13,7 @@ import { DEFAULT_CHUNK_BYTES, KEY_BYTES, StreamingSha256, sealChunksToSink, wrap
 import { frameObject } from "./cloud.js";
 import { aeadCipher, aeadDecipher } from "../packages/sealkeep-crypto/src/aead.js";
 import { STORAGE_PREFIX_DEFAULT } from "./branding.js";
+import { assertScanCoversSeal, deliverOrgRollup, discardScanSnapshot, scanBeforeSeal } from "./leakscan.js";
 import { oneChunk } from "./byte-stream.js";
 import { paceBackgroundByteStream } from "./background-bandwidth.js";
 const SEAL_SUITE = "chacha20-poly1305";
@@ -165,93 +166,101 @@ export async function sealToChunkFolder(dataDir, sourcePath, rawPhrase, agent, o
     const source = await stat(absolute).catch(() => null);
     if (!source || !source.isFile())
         fail("source_unreadable", `Transcript is not readable: ${absolute}`, { sourcePath: absolute });
-    const phrase = canonicalPhrase(rawPhrase);
-    const totalBytes = source.size;
-    // Same override the local seal path honours, for the same reason: proving the
-    // streamed layout works should not cost tens of megabytes of disk per run.
-    const chunkOverride = options.chunkBytes;
-    const chunkBytes = typeof chunkOverride === "number" && Number.isInteger(chunkOverride) && chunkOverride > 0
-        ? chunkOverride
-        : DEFAULT_CHUNK_BYTES;
-    const totalChunks = Math.max(1, Math.ceil(totalBytes / chunkBytes));
-    // Journal triage, chunk-layout edition. Same drain-the-stack shape as the
-    // streaming path: resume the newest matching journal or abandon it with the
-    // reason and look again.
-    for (;;) {
-        const journal = await findSpoolForSource(dataDir, absolute);
-        if (!journal)
-            break;
-        if (journal.providerState !== null && !isChunkFolderState(journal.providerState)) {
-            // A single-object streaming journal for this source belongs to the other
-            // pipeline; leave it alone and let that pipeline (or --fresh) decide.
-            break;
-        }
-        const abandon = async (reason) => {
-            await abandonFolderJournal(dataDir, client, journal, reason);
-        };
-        if (options.resume === false) {
-            await abandon("a fresh start was requested (--fresh)");
-            continue;
-        }
-        if (journal.provider !== remoteStorage.provider || journal.bucket !== remoteStorage.bucket || journal.source.totalBytes !== totalBytes) {
-            await abandon("the source file or the storage target is no longer the one the journal describes");
-            continue;
+    const sealScan = await scanBeforeSeal(dataDir, absolute, options.signal, undefined, source.size, { snapshot: true });
+    try {
+        const secretScan = sealScan?.metadata;
+        const plaintextPath = sealScan?.snapshotPath ?? absolute;
+        const phrase = canonicalPhrase(rawPhrase);
+        const totalBytes = source.size;
+        // Same override the local seal path honours, for the same reason: proving the
+        // streamed layout works should not cost tens of megabytes of disk per run.
+        const chunkOverride = options.chunkBytes;
+        const chunkBytes = typeof chunkOverride === "number" && Number.isInteger(chunkOverride) && chunkOverride > 0
+            ? chunkOverride
+            : DEFAULT_CHUNK_BYTES;
+        const totalChunks = Math.max(1, Math.ceil(totalBytes / chunkBytes));
+        // Journal triage, chunk-layout edition. Same drain-the-stack shape as the
+        // streaming path: resume the newest matching journal or abandon it with the
+        // reason and look again.
+        for (;;) {
+            const journal = await findSpoolForSource(dataDir, absolute);
+            if (!journal)
+                break;
+            if (journal.providerState !== null && !isChunkFolderState(journal.providerState)) {
+                // A single-object streaming journal for this source belongs to the other
+                // pipeline; leave it alone and let that pipeline (or --fresh) decide.
+                break;
+            }
+            const abandon = async (reason) => {
+                await abandonFolderJournal(dataDir, client, journal, reason);
+            };
+            if (options.resume === false) {
+                await abandon("a fresh start was requested (--fresh)");
+                continue;
+            }
+            if (journal.provider !== remoteStorage.provider || journal.bucket !== remoteStorage.bucket || journal.source.totalBytes !== totalBytes) {
+                await abandon("the source file or the storage target is no longer the one the journal describes");
+                continue;
+            }
+            const lock = await acquireSpoolLock(dataDir, journal.archiveId, { now: options.now });
+            try {
+                return await resumeChunkFolder({ dataDir, client, remoteStorage, targetId: routedTarget?.id ?? options.targetId, destination, destinationFingerprint, absolute, plaintextPath, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, projectKey: options.projectKey ?? null, teamRecipients: options.teamRecipients ?? [], now: options.now, signal: options.signal, maxBytesPerSecond: options.maxBytesPerSecond, onYield: options.onYield, secretScan, sealScan }, journal);
+            }
+            catch (error) {
+                if (!(error instanceof Error) || !/cannot resume/i.test(error.message))
+                    throw error;
+                await abandon(error.message);
+                continue;
+            }
+            finally {
+                await lock.release();
+            }
         }
-        const lock = await acquireSpoolLock(dataDir, journal.archiveId, { now: options.now });
+        // Fresh seal.
+        const archiveId = randomUUID();
+        const createdAt = new Date(options.now ?? Date.now()).toISOString();
+        // Sealed vault ⇒ unreadable bucket, everywhere. Sealing the CONTENT while
+        // labelling it project/date/session.jsonl would hand every storage provider
+        // the story of the work; the readable hierarchy is the dashboard's job,
+        // built from local records — and from the encrypted identity in each
+        // folder's sidecar when only the bucket survives. `remoteNaming:
+        // "readable"` in config.json is the explicit opt-out for people who want
+        // their own bucket browsable and accept what that says.
+        // Managed vaults skip the naming machinery entirely: the folder is the bare
+        // archive id, so the plane's references (`<id>.chunk-000000`) carry nothing
+        // but the grouping it could always see. Own buckets keep the hashed (or
+        // opted-in readable) project/date/session hierarchy.
+        const naming = config.remoteNaming ?? "hashed";
+        const folder = remoteStorage.provider === "vaultline" ? archiveId : chunkFolderFor({
+            configuredPrefix: remoteStorage.prefix, project: options.project ?? null, createdAt, sourcePath: absolute, archiveId,
+            naming, ...(naming === "hashed" ? { namingKey: folderNamingKey(phrase, storageScopeOf(remoteStorage)) } : {})
+        });
+        // Members of this project are wrapped in here, and nowhere else.
+        const recipients = [...configuredRecipients(config, phrase, { project: options.project ?? undefined, projectKey: options.projectKey ?? undefined }), ...(options.teamRecipients ?? [])];
+        const archiveKey = randomBytes(KEY_BYTES);
+        const noncePrefix = randomBytes(4);
+        const lock = await acquireSpoolLock(dataDir, archiveId, { now: options.now });
         try {
-            return await resumeChunkFolder({ dataDir, client, remoteStorage, targetId: routedTarget?.id ?? options.targetId, destination, destinationFingerprint, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, projectKey: options.projectKey ?? null, teamRecipients: options.teamRecipients ?? [], now: options.now, signal: options.signal, maxBytesPerSecond: options.maxBytesPerSecond, onYield: options.onYield }, journal);
-        }
-        catch (error) {
-            if (!(error instanceof Error) || !/cannot resume/i.test(error.message))
-                throw error;
-            await abandon(error.message);
-            continue;
+            await createSpool(dataDir, {
+                archiveId, suite: SEAL_SUITE, provider: remoteStorage.provider, bucket: remoteStorage.bucket, objectKey: folder,
+                source: { path: absolute, totalBytes, chunkBytes },
+                wrappedKeys: wrapAll(archiveKey, recipients, SEAL_SUITE, archiveId),
+                noncePrefixB64: noncePrefix.toString("base64"),
+                nextChunkIndex: 0,
+                consumedPrefixSha256: createHash("sha256").digest("hex"),
+                chunkHeaders: [],
+                hashState: { plaintext: "", stored: "" },
+                providerState: { kind: "chunk-folder", folder, uploaded: 0 }
+            }, { now: options.now });
+            return await runChunkSeal({ dataDir, client, remoteStorage, targetId: routedTarget?.id ?? options.targetId, destination, destinationFingerprint, absolute, plaintextPath, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, projectKey: options.projectKey ?? null, teamRecipients: options.teamRecipients ?? [], now: options.now, signal: options.signal, maxBytesPerSecond: options.maxBytesPerSecond, onYield: options.onYield, secretScan, sealScan }, { archiveId, createdAt, folder, archiveKey, noncePrefix, project: options.project ?? null, startAt: 0, verifiedHeaders: [], reusedChunks: 0 });
         }
         finally {
+            zeroize(archiveKey);
             await lock.release();
         }
     }
-    // Fresh seal.
-    const archiveId = randomUUID();
-    const createdAt = new Date(options.now ?? Date.now()).toISOString();
-    // Sealed vault ⇒ unreadable bucket, everywhere. Sealing the CONTENT while
-    // labelling it project/date/session.jsonl would hand every storage provider
-    // the story of the work; the readable hierarchy is the dashboard's job,
-    // built from local records — and from the encrypted identity in each
-    // folder's sidecar when only the bucket survives. `remoteNaming:
-    // "readable"` in config.json is the explicit opt-out for people who want
-    // their own bucket browsable and accept what that says.
-    // Managed vaults skip the naming machinery entirely: the folder is the bare
-    // archive id, so the plane's references (`<id>.chunk-000000`) carry nothing
-    // but the grouping it could always see. Own buckets keep the hashed (or
-    // opted-in readable) project/date/session hierarchy.
-    const naming = config.remoteNaming ?? "hashed";
-    const folder = remoteStorage.provider === "vaultline" ? archiveId : chunkFolderFor({
-        configuredPrefix: remoteStorage.prefix, project: options.project ?? null, createdAt, sourcePath: absolute, archiveId,
-        naming, ...(naming === "hashed" ? { namingKey: folderNamingKey(phrase, storageScopeOf(remoteStorage)) } : {})
-    });
-    // Members of this project are wrapped in here, and nowhere else.
-    const recipients = [...configuredRecipients(config, phrase, { project: options.project ?? undefined, projectKey: options.projectKey ?? undefined }), ...(options.teamRecipients ?? [])];
-    const archiveKey = randomBytes(KEY_BYTES);
-    const noncePrefix = randomBytes(4);
-    const lock = await acquireSpoolLock(dataDir, archiveId, { now: options.now });
-    try {
-        await createSpool(dataDir, {
-            archiveId, suite: SEAL_SUITE, provider: remoteStorage.provider, bucket: remoteStorage.bucket, objectKey: folder,
-            source: { path: absolute, totalBytes, chunkBytes },
-            wrappedKeys: wrapAll(archiveKey, recipients, SEAL_SUITE, archiveId),
-            noncePrefixB64: noncePrefix.toString("base64"),
-            nextChunkIndex: 0,
-            consumedPrefixSha256: createHash("sha256").digest("hex"),
-            chunkHeaders: [],
-            hashState: { plaintext: "", stored: "" },
-            providerState: { kind: "chunk-folder", folder, uploaded: 0 }
-        }, { now: options.now });
-        return await runChunkSeal({ dataDir, client, remoteStorage, targetId: routedTarget?.id ?? options.targetId, destination, destinationFingerprint, absolute, totalBytes, chunkBytes, totalChunks, phrase, agent, project: options.project ?? null, projectKey: options.projectKey ?? null, teamRecipients: options.teamRecipients ?? [], now: options.now, signal: options.signal, maxBytesPerSecond: options.maxBytesPerSecond, onYield: options.onYield }, { archiveId, createdAt, folder, archiveKey, noncePrefix, project: options.project ?? null, startAt: 0, verifiedHeaders: [], reusedChunks: 0 });
-    }
     finally {
-        zeroize(archiveKey);
-        await lock.release();
+        await discardScanSnapshot(sealScan);
     }
 }
 function isChunkFolderState(state) {
@@ -369,7 +378,7 @@ async function runChunkSeal(ctx, args) {
             pending.set(index, task);
         }
     };
-    const sealed = await sealChunksToSink({ path: ctx.absolute, end: ctx.totalBytes }, sink, {
+    const sealed = await sealChunksToSink({ path: ctx.plaintextPath, end: ctx.totalBytes }, sink, {
         recipients, archiveId: args.archiveId, adapter: { agent: ctx.agent, version: ADAPTER_VERSION },
         suite: SEAL_SUITE, chunkBytes: ctx.chunkBytes, archiveKey: args.archiveKey, noncePrefix: args.noncePrefix,
         hashers, createdAt: args.createdAt,
@@ -419,6 +428,17 @@ async function runChunkSeal(ctx, args) {
         await recordAudit(ctx.dataDir, "upload.verify", "denied", { archiveId: args.archiveId, objectKey: args.folder, problems: problems.length });
         fail("ciphertext_integrity_failed", `Refusing to record the chunked archive as durable: ${problems.join("; ")}. The journal was kept; re-running resumes what is already there.`, { archiveId: args.archiveId, objectKey: args.folder });
     }
+    try {
+        assertScanCoversSeal(ctx.sealScan, sealed.originalSha256, ctx.absolute);
+    }
+    catch (error) {
+        for (let index = 0; index < envelope.chunks.length; index += 1) {
+            await ctx.client.deleteObject(`${args.folder}/${chunkObjectName(index)}`).catch(() => undefined);
+        }
+        await ctx.client.deleteObject(`${args.folder}/${ENVELOPE_OBJECT}`).catch(() => undefined);
+        await shredSpool(ctx.dataDir, args.archiveId);
+        throw error;
+    }
     const now = new Date(ctx.now ?? Date.now()).toISOString();
     const remote = {
         provider: ctx.remoteStorage.provider, bucket: ctx.remoteStorage.bucket, objectKey: args.folder,
@@ -436,7 +456,8 @@ async function runChunkSeal(ctx, args) {
         envelope,
         objectPath: join(config.storage.root, `${args.archiveId}.skarchive`),
         remote,
-        offloaded: { at: now, provider: ctx.remoteStorage.provider, bucket: ctx.remoteStorage.bucket, objectKey: args.folder }
+        offloaded: { at: now, provider: ctx.remoteStorage.provider, bucket: ctx.remoteStorage.bucket, objectKey: args.folder },
+        ...(ctx.secretScan ? { secretScan: ctx.secretScan } : {})
     };
     const record = await mutateArchiveRecord(config.storage.root, args.archiveId, (current) => {
         if (!isV2(current))
@@ -448,7 +469,8 @@ async function runChunkSeal(ctx, args) {
         const { remote: _remote, copies: _copies, ...completedFacts } = completed;
         return appendArchiveCopy({ ...current, ...completedFacts }, remote, { makePrimary: true });
     }, { initial: completed });
-    await recordAudit(ctx.dataDir, "archive.create", "allowed", { archiveId: args.archiveId, agent: ctx.agent, bytes: ctx.totalBytes, recipients: envelope.wrappedKeys.length, chunked: true, reused: args.reusedChunks });
+    await recordAudit(ctx.dataDir, "archive.create", "allowed", { archiveId: args.archiveId, agent: ctx.agent, bytes: ctx.totalBytes, recipients: envelope.wrappedKeys.length, chunked: true, reused: args.reusedChunks, secretFindings: ctx.secretScan?.findings.reduce((total, item) => total + item.count, 0) ?? null });
+    await deliverOrgRollup(ctx.dataDir, args.archiveId, ctx.secretScan);
     await recordAudit(ctx.dataDir, "upload.verify", "allowed", { archiveId: args.archiveId, objectKey: args.folder, bytes: sealed.storedBytes, provider: ctx.remoteStorage.provider, chunked: true });
     await shredSpool(ctx.dataDir, args.archiveId);
     // The tokens collected during the seal become the archive's index entry —

package/dist/src/cli.js

@@ -39,7 +39,7 @@ import { connectGdrive } from "./providers/gdrive.js";
 import { resolveRecoveryPhrase } from "./secrets.js";
 import { amber, bold, blue, bytes, callout, command as cmd, dim, divider, green, heading, hint, keyValue, mark, relativeTime, shortPath, steps, table } from "./ui.js";
 import { envVar, PREFIX as ENV_PREFIX } from "./env.js";
-import { automaticTranscriptIsEnabled, readLocalSettings } from "./machine-settings.js";
+import { automaticTranscriptIsEnabled, readLocalSettings, writeLocalSettings } from "./machine-settings.js";
 import { normalizeDarwinServicePolicy, prepareLegacyDarwinManagerHandoff } from "./darwin-service-policy.js";
 const VALUE_FLAGS = new Set(["--data-dir", "--recovery-phrase", "--agent", "--home", "--limit", "--executable", "--provider", "--bucket", "--prefix", "--region", "--older-than-days", "--status", "--max", "--port", "--ui-port", "--overwrite", "--label", "--public-key", "--config-id", "--backend", "--endpoint", "--policy", "--grace-days", "--interval", "--manifest", "--artifact", "--key", "--current", "--api", "--token", "--group", "--cli-path", "--account-id", "--project", "--out", "--password", "--kind", "--text", "--channel", "--reword", "--mode", "--session", "--mirror", "--interval-ms", "--from-seq", "--from-byte", "--max-gb", "--priority", "--projects", "--id", "--email", "--code", "--passcode"]);
 function take(args, flag, fallback) { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : fallback; }
@@ -205,7 +205,7 @@ function usage() {
             ["archive <file>", "seal one file into the vault by hand"],
             ["archive <file> --stream", "seal straight into your bucket, no local ciphertext"],
             ["archive <file> --stream --fresh", "abandon an interrupted streamed upload and start over"],
-            ["scan <path>", "find pasted secrets in transcripts before they are sealed in"],
+            ["scan <path> · scan policy off|record|block-high", "find pasted secrets; record or block them when a session is sealed"],
             ["list", "browse archives"],
             ["search <query>", "search metadata, or contents with --content"],
             ["why <commit>", "the session — and the reasoning — behind a git commit"],
@@ -1462,9 +1462,150 @@ async function main() {
      * machine — see leakscan.ts for why it cannot.
      */
     if (command === "scan") {
+        const scanArgs = positionals(args);
+        if (scanArgs[0] === "policy") {
+            const { sharedScanPolicy, validateCustomPattern } = await import("./leakscan.js");
+            const settings = await readLocalSettings(dataDir);
+            const requested = scanArgs[1];
+            if (!requested) {
+                print(`\n  Seal-time secret scan: ${bold(settings.secretScanPolicy)} ${dim("· machine-local")}`);
+                print(`  Fail closed on scanner errors: ${bold(settings.secretScanFailClosed ? "on" : "off")} ${dim("· block-high always fails closed")}`);
+                print(`  Organization rollup: ${bold(settings.secretScanOrgRollup ? "on" : "off")} ${dim(settings.secretScanControlPlaneUrl ? `· ${settings.secretScanControlPlaneUrl}` : "· no control plane configured")}`);
+                print(`  Custom patterns: ${bold(String(settings.secretScanPatterns.length))}`);
+                print(`  ${dim("Modes: off · record · block-high. Shared files carry mode, fail-closed, and patterns. Consent stays on this machine.")}\n`);
+                return;
+            }
+            if (requested === "off" || requested === "record" || requested === "block-high") {
+                await writeLocalSettings(dataDir, { ...settings, secretScanPolicy: requested });
+                print(`\n  ${mark.ok()} Seal-time secret scan set to ${bold(requested)} ${dim("· every new local, MCP, and streamed seal")}\n`);
+                return;
+            }
+            if (requested === "fail-closed") {
+                const value = scanArgs[2];
+                if (value !== "on" && value !== "off")
+                    fail("invalid_argument", "Usage: sealkeep scan policy fail-closed on|off");
+                await writeLocalSettings(dataDir, { ...settings, secretScanFailClosed: value === "on" });
+                print(`\n  ${mark.ok()} Scanner errors ${bold(value === "on" ? "fail closed" : "do not block")} ${dim("· block-high still fails closed")}\n`);
+                return;
+            }
+            if (requested === "rollup") {
+                const value = scanArgs[2];
+                if (value !== "on" && value !== "off")
+                    fail("invalid_argument", "Usage: sealkeep scan policy rollup on|off");
+                await writeLocalSettings(dataDir, { ...settings, secretScanOrgRollup: value === "on" });
+                print(`\n  ${mark.ok()} Organization rollup ${bold(value)} ${dim("· kinds, severities, and counts only; line numbers stay here")}\n`);
+                return;
+            }
+            if (requested === "plane") {
+                const value = scanArgs[2];
+                if (!value || value === "off") {
+                    await writeLocalSettings(dataDir, { ...settings, secretScanControlPlaneUrl: null });
+                    print(`\n  ${mark.ok()} Control plane cleared. Rollups stay on this machine.\n`);
+                    return;
+                }
+                let origin;
+                try {
+                    origin = new URL(value).origin;
+                }
+                catch {
+                    fail("invalid_argument", "Usage: sealkeep scan policy plane <https://control-plane> | off");
+                }
+                await writeLocalSettings(dataDir, { ...settings, secretScanControlPlaneUrl: origin });
+                print(`\n  ${mark.ok()} Control plane set to ${bold(origin)}\n`);
+                return;
+            }
+            if (requested === "export") {
+                print(JSON.stringify(sharedScanPolicy(settings), null, 2));
+                return;
+            }
+            if (requested === "import") {
+                const file = required(scanArgs[2], "Usage: sealkeep scan policy import <file>");
+                const { readFile } = await import("node:fs/promises");
+                const parsed = JSON.parse(await readFile(file, "utf8"));
+                if (parsed.secretScanPolicy !== "off" && parsed.secretScanPolicy !== "record" && parsed.secretScanPolicy !== "block-high") {
+                    fail("invalid_argument", "Policy file needs secretScanPolicy of off, record, or block-high.");
+                }
+                const patterns = Array.isArray(parsed.secretScanPatterns) ? parsed.secretScanPatterns.map((pattern) => validateCustomPattern(pattern)) : [];
+                await writeLocalSettings(dataDir, {
+                    ...settings,
+                    secretScanPolicy: parsed.secretScanPolicy,
+                    secretScanFailClosed: parsed.secretScanFailClosed === true,
+                    secretScanPatterns: patterns
+                });
+                print(`\n  ${mark.ok()} Imported scan policy ${bold(parsed.secretScanPolicy)} with ${patterns.length} custom pattern${patterns.length === 1 ? "" : "s"}. ${dim("Rollup consent was left as it was.")}\n`);
+                return;
+            }
+            if (requested === "pull") {
+                if (!settings.secretScanControlPlaneUrl)
+                    fail("invalid_argument", "Set a control plane first: sealkeep scan policy plane <url>");
+                const { readControlPlaneDevice } = await import("./leakscan.js");
+                const { signedControlPlaneFetch } = await import("./control-plane/auth.js");
+                const device = await readControlPlaneDevice(dataDir);
+                if (!device)
+                    fail("unauthorized", "This machine has no control-plane device key. Import one before pulling a policy.");
+                const response = await signedControlPlaneFetch({
+                    origin: settings.secretScanControlPlaneUrl,
+                    method: "GET",
+                    path: "/v1/secret-scan/policy",
+                    deviceId: device.deviceId,
+                    privateKey: device.privateKeyPem
+                });
+                if (!response.ok)
+                    fail("cloud_account_unavailable", `Control plane returned ${response.status}`);
+                const parsed = await response.json();
+                if (parsed.mode !== "off" && parsed.mode !== "record" && parsed.mode !== "block-high")
+                    fail("invalid_argument", "Control plane policy was not usable.");
+                const patterns = Array.isArray(parsed.patterns) ? parsed.patterns.map((pattern) => validateCustomPattern(pattern)) : [];
+                await writeLocalSettings(dataDir, { ...settings, secretScanPolicy: parsed.mode, secretScanFailClosed: parsed.failClosed === true, secretScanPatterns: patterns });
+                print(`\n  ${mark.ok()} Pulled scan policy ${bold(parsed.mode)}. ${dim("This machine's rollup consent did not change.")}\n`);
+                return;
+            }
+            fail("invalid_argument", "Usage: sealkeep scan policy [off|record|block-high|fail-closed on|off|rollup on|off|plane <url>|export|import <file>|pull]");
+        }
+        if (scanArgs[0] === "pattern") {
+            const { validateCustomPattern } = await import("./leakscan.js");
+            const settings = await readLocalSettings(dataDir);
+            const action = scanArgs[1];
+            if (action === "list" || !action) {
+                if (json) {
+                    print(JSON.stringify(settings.secretScanPatterns, null, 2));
+                    return;
+                }
+                print(`\n${heading("Custom secret patterns")}`);
+                print(table(settings.secretScanPatterns, [
+                    { header: "kind", get: (pattern) => pattern.kind },
+                    { header: "severity", get: (pattern) => pattern.severity },
+                    { header: "pattern", get: (pattern) => dim(pattern.source) }
+                ], "None. Built-in detectors still run when scanning is on."));
+                print("");
+                return;
+            }
+            if (action === "remove") {
+                const kind = required(scanArgs[2], "Usage: sealkeep scan pattern remove <kind>");
+                await writeLocalSettings(dataDir, { ...settings, secretScanPatterns: settings.secretScanPatterns.filter((pattern) => pattern.kind !== kind) });
+                print(`\n  ${mark.ok()} Removed ${bold(kind)}\n`);
+                return;
+            }
+            if (action === "add") {
+                const kind = required(scanArgs[2], "Usage: sealkeep scan pattern add <kind> <high|medium> <regex>");
+                const severity = scanArgs[3];
+                const source = scanArgs[4];
+                if ((severity !== "high" && severity !== "medium") || !source)
+                    fail("invalid_argument", "Usage: sealkeep scan pattern add <kind> <high|medium> <regex>");
+                const pattern = validateCustomPattern({ kind, severity, source });
+                if (settings.secretScanPatterns.some((existing) => existing.kind === pattern.kind))
+                    fail("invalid_argument", `A pattern named ${pattern.kind} already exists.`);
+                if (settings.secretScanPatterns.length >= 32)
+                    fail("invalid_argument", "This machine already has 32 custom patterns.");
+                await writeLocalSettings(dataDir, { ...settings, secretScanPatterns: [...settings.secretScanPatterns, pattern] });
+                print(`\n  ${mark.ok()} Added ${bold(pattern.kind)} as ${pattern.severity}. ${dim("High findings block only when the policy is block-high.")}\n`);
+                return;
+            }
+            fail("invalid_argument", "Usage: sealkeep scan pattern list|add|remove");
+        }
         const { scanPath } = await import("./leakscan.js");
-        const target = required(positionals(args)[0], "Usage: sealkeep scan <file-or-directory> [--json]");
-        const report = await scanPath(target);
+        const target = required(scanArgs[0], "Usage: sealkeep scan <file-or-directory> [--json]");
+        const report = await scanPath(target, undefined, (await readLocalSettings(dataDir)).secretScanPatterns);
         if (json) {
             print(JSON.stringify(report, null, 2));
         }
@@ -2225,7 +2366,11 @@ async function main() {
             const event = await hookEventFromStdin(agent, raw);
             const local = await readLocalSettings(dataDir);
             if (automaticTranscriptIsEnabled(local, agent, event.sourcePath)) {
-                await new ArchiveQueue(dataDir).enqueue({ sourcePath: event.sourcePath, agent, event: event.event, sessionId: event.sessionId });
+                // Persist the archive intent and return to the agent immediately.
+                // Queue-wide supersession, sealing, indexing and cloud upload belong
+                // to the daemon; doing the queue scan here made SessionEnd exceed the
+                // agent's three-second hook budget on mature vaults.
+                await new ArchiveQueue(dataDir).enqueue({ sourcePath: event.sourcePath, agent, event: event.event, sessionId: event.sessionId }, { deferSupersede: true });
             }
         }
         catch {

package/dist/src/control-plane/auth.d.ts

@@ -46,6 +46,15 @@ export declare function signRequest(input: {
     timestamp?: string;
     nonce: string;
 }): Record<string, string>;
+/** One signed control-plane call. Unsigned fetches are not a client of this plane. */
+export declare function signedControlPlaneFetch(input: {
+    origin: string;
+    method: "GET" | "POST" | "PUT";
+    path: string;
+    deviceId: string;
+    privateKey: KeyObject | string;
+    body?: string;
+}): Promise<Response>;
 export type AuthFailure = {
     ok: false;
     status: number;

package/dist/src/control-plane/auth.js

@@ -1,4 +1,4 @@
-import { createHash, createPublicKey, sign as edSign, verify as edVerify, timingSafeEqual } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, randomUUID, sign as edSign, verify as edVerify, timingSafeEqual } from "node:crypto";
 /**
  * Device authentication for the control plane.
  *
@@ -49,7 +49,7 @@ export function signingString(method, path, timestamp, nonce, body, prefix = SIG
 export function signRequest(input) {
     const timestamp = input.timestamp ?? new Date().toISOString();
     const message = signingString(input.method, input.path, timestamp, input.nonce, input.body ?? "");
-    const key = typeof input.privateKey === "string" ? createPublicKey(input.privateKey) : input.privateKey;
+    const key = typeof input.privateKey === "string" ? createPrivateKey(input.privateKey) : input.privateKey;
     return {
         [SENDS.device]: input.deviceId,
         [SENDS.timestamp]: timestamp,
@@ -57,6 +57,23 @@ export function signRequest(input) {
         [SENDS.signature]: edSign(null, Buffer.from(message), key).toString("base64")
     };
 }
+/** One signed control-plane call. Unsigned fetches are not a client of this plane. */
+export async function signedControlPlaneFetch(input) {
+    const body = input.body ?? "";
+    const headers = {
+        ...signRequest({
+            method: input.method,
+            path: input.path,
+            deviceId: input.deviceId,
+            privateKey: input.privateKey,
+            body,
+            nonce: randomUUID()
+        })
+    };
+    if (body)
+        headers["content-type"] = "application/json";
+    return fetch(new URL(input.path, input.origin), { method: input.method, headers, body: body || undefined });
+}
 export class NonceCache {
     windowMs;
     limit;

package/dist/src/control-plane/server.js

@@ -29,6 +29,25 @@ const completeSchema = z.object({
 // The manifest is opaque ciphertext. A strict schema is what stops a future caller
 // from "temporarily" posting plaintext transcript fields to this endpoint.
 const manifestSchema = z.object({ ciphertext: z.string().min(1).max(256 * 1024) }).strict();
+const rollupSchema = z.object({
+    version: z.literal(1),
+    archiveId: z.string().uuid(),
+    scannedAt: z.string().datetime(),
+    counts: z.array(z.object({
+        kind: z.string().regex(/^[a-z][a-z0-9-]{1,40}$/),
+        severity: z.enum(["high", "medium"]),
+        count: z.number().int().positive().max(10_000)
+    })).max(64)
+}).strict();
+const scanPolicySchema = z.object({
+    mode: z.enum(["off", "record", "block-high"]),
+    failClosed: z.boolean(),
+    patterns: z.array(z.object({
+        kind: z.string().regex(/^[a-z][a-z0-9-]{1,40}$/),
+        severity: z.enum(["high", "medium"]),
+        source: z.string().min(4).max(200)
+    })).max(32)
+}).strict();
 const enrollSchema = z.object({
     accountId: z.string().uuid(),
     enrollmentToken: z.string().min(8).max(200),
@@ -255,6 +274,34 @@ export function createControlPlaneServer(options = {}) {
                 status = 200;
                 return json(response, 200, store.archivesFor(device.accountId).map(({ archiveId, bytes, objectKey, durableAt }) => ({ archiveId, bytes, objectKey, durableAt: durableAt ?? null })));
             }
+            if (method === "GET" && url.pathname === "/v1/secret-scan/policy") {
+                status = 200;
+                const policy = store.secretScanPolicy(device.accountId);
+                return json(response, 200, policy
+                    ? { version: 1, mode: policy.mode, failClosed: policy.failClosed, patterns: policy.patterns, updatedAt: policy.updatedAt }
+                    : { version: 1, mode: "off", failClosed: false, patterns: [], updatedAt: null });
+            }
+            if (method === "PUT" && url.pathname === "/v1/secret-scan/policy") {
+                const input = parse(scanPolicySchema, body);
+                const saved = store.setSecretScanPolicy({ accountId: device.accountId, updatedAt: new Date(now()).toISOString(), mode: input.mode, failClosed: input.failClosed, patterns: input.patterns });
+                store.audit({ accountId: device.accountId, deviceId: device.id, action: "secret-scan.policy", outcome: "allowed", detail: { mode: saved.mode, patterns: saved.patterns.length } });
+                status = 200;
+                return json(response, 200, { version: 1, mode: saved.mode, failClosed: saved.failClosed, patterns: saved.patterns, updatedAt: saved.updatedAt });
+            }
+            if (method === "POST" && url.pathname === "/v1/secret-scan/rollups") {
+                const input = parse(rollupSchema, body);
+                const saved = store.addSecretScanRollup({
+                    id: randomUUID(), accountId: device.accountId, deviceId: device.id, archiveId: input.archiveId,
+                    scannedAt: input.scannedAt, receivedAt: new Date(now()).toISOString(), counts: input.counts
+                }, now());
+                store.audit({ accountId: device.accountId, deviceId: device.id, action: "secret-scan.rollup", outcome: "allowed", detail: { archiveId: input.archiveId, counts: input.counts.reduce((total, item) => total + item.count, 0) } });
+                status = 201;
+                return json(response, 201, { id: saved.id, archiveId: saved.archiveId, counts: saved.counts });
+            }
+            if (method === "GET" && url.pathname === "/v1/secret-scan/rollups") {
+                status = 200;
+                return json(response, 200, store.secretScanRollups(device.accountId).map(({ archiveId, scannedAt, receivedAt, counts }) => ({ archiveId, scannedAt, receivedAt, counts })));
+            }
             if (method === "GET" && url.pathname === "/v1/audit") {
                 status = 200;
                 return json(response, 200, store.auditEvents().filter((event) => !event.accountId || event.accountId === device.accountId).slice(-200));