sealkeep 0.11.5 → 0.11.7

package/dist/src/machine-settings.js

@@ -103,6 +103,11 @@ export function defaultLocalSettings() {
         watchedPaths: [],
         exclusions: [],
         reclaimEnabled: false,
+        secretScanPolicy: "off",
+        secretScanFailClosed: false,
+        secretScanOrgRollup: false,
+        secretScanControlPlaneUrl: null,
+        secretScanPatterns: [],
         trashStrategy: "auto",
         schedule: { intervalMinutes: 5 },
         bandwidth: { uploadLimitMbps: null },
@@ -144,6 +149,24 @@ export async function readLocalSettings(dataDir) {
         return {
             ...fallback,
             ...saved,
+            secretScanPolicy: saved?.secretScanPolicy === "block-high" || saved?.secretScanPolicy === "record" ? saved.secretScanPolicy : "off",
+            secretScanFailClosed: saved?.secretScanFailClosed === true,
+            secretScanOrgRollup: saved?.secretScanOrgRollup === true,
+            secretScanControlPlaneUrl: typeof saved?.secretScanControlPlaneUrl === "string" && /^https?:\/\//.test(saved.secretScanControlPlaneUrl)
+                ? saved.secretScanControlPlaneUrl.replace(/\/+$/, "")
+                : null,
+            secretScanPatterns: Array.isArray(saved?.secretScanPatterns)
+                ? saved.secretScanPatterns.flatMap((pattern) => {
+                    if (!pattern || typeof pattern !== "object")
+                        return [];
+                    const entry = pattern;
+                    if (typeof entry.kind !== "string" || typeof entry.source !== "string")
+                        return [];
+                    if (entry.severity !== "high" && entry.severity !== "medium")
+                        return [];
+                    return [{ kind: entry.kind, severity: entry.severity, source: entry.source }];
+                }).slice(0, 32)
+                : [],
             watchedAgents: Array.isArray(saved?.watchedAgents)
                 ? saved.watchedAgents.filter((agent) => agent === "codex" || agent === "claude")
                 : fallback.watchedAgents,

package/dist/src/queue.d.ts

@@ -46,6 +46,16 @@ export type EnqueueRequest = {
     event: string;
     sessionId?: string;
 };
+export type EnqueueOptions = {
+    /**
+     * Skip the queue-wide stale-snapshot reconciliation. Lifecycle hooks use
+     * this after durably recording one row so a mature queue cannot hold the
+     * agent open while thousands of unrelated rows are scanned. The daemon
+     * performs that reconciliation asynchronously as it discovers claimable
+     * work.
+     */
+    deferSupersede?: boolean;
+};
 export type EnqueueResult = {
     job: ArchiveJob;
     deduped: boolean;
@@ -218,7 +228,7 @@ export declare class ArchiveQueue {
     private describe;
     private persist;
     /** Records intent to archive a transcript. It never reads transcript contents. */
-    enqueue(request: EnqueueRequest): Promise<EnqueueResult>;
+    enqueue(request: EnqueueRequest, options?: EnqueueOptions): Promise<EnqueueResult>;
     /**
      * Batch form used by startup/rescan discovery. Individual unreadable sources
      * are reported without aborting the rest of the pass, matching the watcher's

package/dist/src/queue.js

@@ -740,7 +740,7 @@ export class ArchiveQueue {
         return { job: await this.require(job.id), deduped: true };
     }
     /** Records intent to archive a transcript. It never reads transcript contents. */
-    async enqueue(request) {
+    async enqueue(request, options = {}) {
         const described = await this.describe(request);
         await mkdir(this.root, { recursive: true, mode: 0o700 });
         let persisted = await this.persist(described);
@@ -762,7 +762,7 @@ export class ArchiveQueue {
             });
             persisted = { ...persisted, job: promoted };
         }
-        const retired = await this.supersedeMany([persisted.job]);
+        const retired = options.deferSupersede ? new Map() : await this.supersedeMany([persisted.job]);
         return { ...persisted, superseded: retired.get(persisted.job.id) ?? [] };
     }
     /**

package/dist/src/stream-to-cloud.d.ts

@@ -55,6 +55,8 @@ type StreamClient = {
         checksum?: string;
     }>;
     abortMultipart?(objectKey: string, uploadId: string): Promise<void>;
+    /** Removes a completed object when a seal is refused after the bytes were uploaded. */
+    deleteObject?(objectKey: string): Promise<void>;
     /** The provider's own account of an in-flight multipart — resume's source of truth. */
     listParts?(objectKey: string, uploadId: string): Promise<{
         partNumber: number;

package/dist/src/stream-to-cloud.js

@@ -18,6 +18,7 @@ import { DEFAULT_CHUNK_BYTES, ENVELOPE_VERSION, KEY_BYTES, StreamingSha256, TAG_
 // seals to the bytes the provider already holds. Reaching into the package for
 // that beats re-implementing the cipher setup here and drifting from it.
 import { aeadCipher, aeadDecipher } from "../packages/sealkeep-crypto/src/aead.js";
+import { assertScanCoversSeal, deliverOrgRollup, discardScanSnapshot, scanBeforeSeal } from "./leakscan.js";
 const STREAMABLE = new Set(["s3", "r2", "b2", "gcs"]);
 const SEAL_SUITE = "chacha20-poly1305";
 const sha256hex = (input) => createHash("sha256").update(input).digest("hex");
@@ -178,63 +179,71 @@ export async function sealArchiveToCloud(dataDir, sourcePath, rawPhrase, agent,
     const source = await stat(absolute).catch(() => null);
     if (!source || !source.isFile())
         fail("source_unreadable", `Transcript is not readable: ${absolute}`, { sourcePath: absolute });
-    const phrase = canonicalPhrase(rawPhrase);
-    const rawClient = options.client ?? await uploadClientFromStore(dataDir, config.vaultId, remoteStorage);
-    if (!("uploadStream" in rawClient) || typeof rawClient.uploadStream !== "function") {
-        fail("invalid_argument", `The ${remoteStorage.provider} client cannot stream uploads`);
-    }
-    const client = rawClient;
-    const shared = { dataDir, client, config, remoteStorage, absolute, totalBytes: source.size, phrase, agent, project: options.project ?? null, projectKey: options.projectKey ?? null, targetId: options.targetId, now: options.now };
-    // Journal triage. Each pass either resumes the newest journal for this
-    // source or abandons it with the reason and looks again, so a stack of
-    // crashed attempts drains to the one worth continuing — or to none.
-    for (;;) {
-        const journal = await findSpoolForSource(dataDir, absolute);
-        if (!journal)
-            break;
-        if (options.resume === false) {
-            await abandonJournal(dataDir, client, journal, "a fresh start was requested (--fresh)");
-            continue;
-        }
-        if (journal.provider !== remoteStorage.provider || journal.bucket !== remoteStorage.bucket
-            || journal.source.totalBytes !== source.size
-            || !Number.isInteger(journal.source.chunkBytes) || journal.source.chunkBytes <= 0
-            || !Number.isInteger(journal.nextChunkIndex) || journal.nextChunkIndex < 0) {
-            await abandonJournal(dataDir, client, journal, "the source file or the storage target is no longer the one the journal describes");
-            continue;
-        }
-        // THE SAFETY GATE, before anything else: the same (archiveKey,
-        // noncePrefix, chunkIndex) triple must never encrypt two different
-        // plaintexts, and every resume decision must be provably on the safe side
-        // of that line. Chunks below `nextChunkIndex` were already encrypted and
-        // handed over under this journal's key, so this seal may only continue if
-        // the bytes they covered are still byte-for-byte the bytes on disk. Hash
-        // the consumed prefix and compare; on any mismatch the journal — key,
-        // nonce prefix, provider session, all of it — is dead, and the archive
-        // starts over with a fresh identity.
-        const consumed = Math.min(journal.nextChunkIndex * journal.source.chunkBytes, source.size);
-        const gate = await hashFileRange(absolute, 0, consumed);
-        if (gate.sha256 !== journal.consumedPrefixSha256) {
-            await abandonJournal(dataDir, client, journal, "the source bytes under the already-uploaded chunks changed, so the sealed prefix no longer describes this file");
-            continue;
-        }
-        // One process per journal, held across the whole resume including its
-        // abandon path — a second process asking meanwhile is told to wait.
-        const lock = await acquireSpoolLock(dataDir, journal.archiveId, { now: options.now });
-        try {
-            return await resumeSeal(shared, journal);
-        }
-        catch (error) {
-            if (!resumeRefused(error))
-                throw error;
-            await abandonJournal(dataDir, client, journal, error instanceof Error ? error.message : "the journaled provider state was not resumable");
-            continue;
+    const sealScan = await scanBeforeSeal(dataDir, absolute, undefined, undefined, source.size, { snapshot: true });
+    try {
+        const secretScan = sealScan?.metadata;
+        const plaintextPath = sealScan?.snapshotPath ?? absolute;
+        const phrase = canonicalPhrase(rawPhrase);
+        const rawClient = options.client ?? await uploadClientFromStore(dataDir, config.vaultId, remoteStorage);
+        if (!("uploadStream" in rawClient) || typeof rawClient.uploadStream !== "function") {
+            fail("invalid_argument", `The ${remoteStorage.provider} client cannot stream uploads`);
         }
-        finally {
-            await lock.release();
+        const client = rawClient;
+        const shared = { dataDir, client, config, remoteStorage, absolute, plaintextPath, totalBytes: source.size, phrase, agent, project: options.project ?? null, projectKey: options.projectKey ?? null, targetId: options.targetId, now: options.now, secretScan, sealScan };
+        // Journal triage. Each pass either resumes the newest journal for this
+        // source or abandons it with the reason and looks again, so a stack of
+        // crashed attempts drains to the one worth continuing — or to none.
+        for (;;) {
+            const journal = await findSpoolForSource(dataDir, absolute);
+            if (!journal)
+                break;
+            if (options.resume === false) {
+                await abandonJournal(dataDir, client, journal, "a fresh start was requested (--fresh)");
+                continue;
+            }
+            if (journal.provider !== remoteStorage.provider || journal.bucket !== remoteStorage.bucket
+                || journal.source.totalBytes !== source.size
+                || !Number.isInteger(journal.source.chunkBytes) || journal.source.chunkBytes <= 0
+                || !Number.isInteger(journal.nextChunkIndex) || journal.nextChunkIndex < 0) {
+                await abandonJournal(dataDir, client, journal, "the source file or the storage target is no longer the one the journal describes");
+                continue;
+            }
+            // THE SAFETY GATE, before anything else: the same (archiveKey,
+            // noncePrefix, chunkIndex) triple must never encrypt two different
+            // plaintexts, and every resume decision must be provably on the safe side
+            // of that line. Chunks below `nextChunkIndex` were already encrypted and
+            // handed over under this journal's key, so this seal may only continue if
+            // the bytes they covered are still byte-for-byte the bytes on disk. Hash
+            // the consumed prefix and compare; on any mismatch the journal — key,
+            // nonce prefix, provider session, all of it — is dead, and the archive
+            // starts over with a fresh identity.
+            const consumed = Math.min(journal.nextChunkIndex * journal.source.chunkBytes, source.size);
+            const gate = await hashFileRange(plaintextPath, 0, consumed);
+            if (gate.sha256 !== journal.consumedPrefixSha256) {
+                await abandonJournal(dataDir, client, journal, "the source bytes under the already-uploaded chunks changed, so the sealed prefix no longer describes this file");
+                continue;
+            }
+            // One process per journal, held across the whole resume including its
+            // abandon path — a second process asking meanwhile is told to wait.
+            const lock = await acquireSpoolLock(dataDir, journal.archiveId, { now: options.now });
+            try {
+                return await resumeSeal(shared, journal);
+            }
+            catch (error) {
+                if (!resumeRefused(error))
+                    throw error;
+                await abandonJournal(dataDir, client, journal, error instanceof Error ? error.message : "the journaled provider state was not resumable");
+                continue;
+            }
+            finally {
+                await lock.release();
+            }
         }
+        return await freshSeal(shared);
+    }
+    finally {
+        await discardScanSnapshot(sealScan);
     }
-    return freshSeal(shared);
 }
 /**
  * The seal↔upload bridge both the fresh and the resumed path run: seal chunks
@@ -328,7 +337,7 @@ async function streamSealCore(ctx, args) {
             providerState: progress.journalable
         });
     };
-    const sealPromise = sealChunksToSink({ path: ctx.absolute, start: args.firstChunkIndex * args.chunkBytes, end: ctx.totalBytes }, sink, {
+    const sealPromise = sealChunksToSink({ path: ctx.plaintextPath, start: args.firstChunkIndex * args.chunkBytes, end: ctx.totalBytes }, sink, {
         recipients: args.recipients, archiveId: args.archiveId, adapter: { agent: ctx.agent, version: ADAPTER_VERSION },
         suite: args.suite, chunkBytes: args.chunkBytes, archiveKey: args.archiveKey, noncePrefix: args.noncePrefix,
         firstChunkIndex: args.firstChunkIndex, hashers: args.hashers,
@@ -394,6 +403,16 @@ async function verifyAndRecord(ctx, flight) {
         await shredSpool(ctx.dataDir, archiveId);
         fail("ciphertext_integrity_failed", `Refusing to record the streamed archive as durable: ${problems.join("; ")}. Nothing was written locally; re-run the archive.`, { archiveId, objectKey });
     }
+    const plaintextSha256 = flight.hashers.plaintext.digestHex();
+    try {
+        assertScanCoversSeal(ctx.sealScan, plaintextSha256, ctx.absolute);
+    }
+    catch (error) {
+        await abortProviderState(ctx.client, objectKey, flight.progress);
+        await ctx.client.deleteObject?.(objectKey).catch(() => undefined);
+        await shredSpool(ctx.dataDir, archiveId);
+        throw error;
+    }
     const now = new Date(ctx.now ?? Date.now()).toISOString();
     // `remote.checksum` stays OUR whole-object stored SHA-256 (base64), resumed
     // or not — the resumable hasher covered every stored byte across processes.
@@ -409,7 +428,7 @@ async function verifyAndRecord(ctx, flight) {
     const completed = {
         version: 2, id: archiveId, createdAt: flight.envelope.manifest.createdAt,
         source: {
-            path: ctx.absolute, agent: ctx.agent, bytes: ctx.totalBytes, sha256: flight.hashers.plaintext.digestHex(),
+            path: ctx.absolute, agent: ctx.agent, bytes: ctx.totalBytes, sha256: plaintextSha256,
             ...(ctx.project ? { project: ctx.project } : {}),
             ...(ctx.projectKey ? { projectKey: ctx.projectKey } : {}),
             ...(teamSpaceOf(ctx.config, ctx.project, ctx.projectKey)?.spaceKey ? { projectScope: teamSpaceOf(ctx.config, ctx.project, ctx.projectKey).spaceKey } : {}),
@@ -421,7 +440,8 @@ async function verifyAndRecord(ctx, flight) {
         // an uploaded-then-offloaded archive reaches, arrived at without the detour.
         objectPath: join(ctx.config.storage.root, `${archiveId}.skarchive`),
         remote,
-        offloaded: { at: now, provider: ctx.remoteStorage.provider, bucket: ctx.remoteStorage.bucket, objectKey }
+        offloaded: { at: now, provider: ctx.remoteStorage.provider, bucket: ctx.remoteStorage.bucket, objectKey },
+        ...(ctx.secretScan ? { secretScan: ctx.secretScan } : {})
     };
     const record = await mutateArchiveRecord(ctx.config.storage.root, archiveId, (current) => {
         if (!isV2(current))
@@ -429,7 +449,8 @@ async function verifyAndRecord(ctx, flight) {
         const { remote: _remote, copies: _copies, ...completedFacts } = completed;
         return appendArchiveCopy({ ...current, ...completedFacts }, remote, { makePrimary: true });
     }, { initial: completed });
-    await recordAudit(ctx.dataDir, "archive.create", "allowed", { archiveId, agent: ctx.agent, bytes: ctx.totalBytes, recipients: flight.envelope.wrappedKeys.length, streamed: true, ...(flight.resumed ? { resumed: true } : {}) });
+    await recordAudit(ctx.dataDir, "archive.create", "allowed", { archiveId, agent: ctx.agent, bytes: ctx.totalBytes, recipients: flight.envelope.wrappedKeys.length, streamed: true, ...(flight.resumed ? { resumed: true } : {}), secretFindings: ctx.secretScan?.findings.reduce((total, item) => total + item.count, 0) ?? null });
+    await deliverOrgRollup(ctx.dataDir, archiveId, ctx.secretScan);
     await recordAudit(ctx.dataDir, "upload.verify", "allowed", { archiveId, objectKey, bytes: flight.wholeStoredBytes, provider: ctx.remoteStorage.provider, streamed: true, ...(flight.resumed ? { resumed: true } : {}) });
     await shredSpool(ctx.dataDir, archiveId);
     await sweepStaleJournals(ctx.dataDir, ctx.client, ctx.absolute);
@@ -587,7 +608,7 @@ async function resumeSeal(ctx, journal) {
                 }
             };
             if (count > 0 || (feedPartialTo > 0 && trueParts)) {
-                const handle = await open(ctx.absolute, "r");
+                const handle = await open(ctx.plaintextPath, "r");
                 try {
                     const buffer = Buffer.allocUnsafe(Math.min(chunkBytes, Math.max(ctx.totalBytes, 1)));
                     for (let index = 0; index < count; index += 1) {

package/dist/src/types.d.ts

@@ -203,6 +203,24 @@ export type ArchiveRecordV2 = {
         baseArchiveId: string;
         baseBytes: number;
     };
+    /**
+     * Seal-time secret scan, stored beside the archive so "which archives hold
+     * credentials?" does not require opening them. Kind, severity, count, and
+     * line numbers only — never matched text, previews, or paths.
+     */
+    secretScan?: ArchiveSecretScan;
+};
+/** Local-only scan summary. Line numbers stay on this machine. */
+export type ArchiveSecretScan = {
+    version: 1;
+    scannedAt: string;
+    policy: "record" | "block-high";
+    findings: Array<{
+        kind: string;
+        severity: "high" | "medium";
+        count: number;
+        lines: number[];
+    }>;
 };
 export type ArchiveRecord = ArchiveRecordV1 | ArchiveRecordV2;
 export type StorageTargetConfig = {

package/dist/src/vault.js

@@ -15,6 +15,7 @@ import { isV2, teamCustodyRecordIsValid } from "./types.js";
 import { envVar } from "./env.js";
 import { hasCompleteVerifiedCopyChain, hasVerifiedCopy } from "./archive-copies.js";
 import { acquireDurableTicketLock } from "./durable-ticket-lock.js";
+import { assertScanCoversSeal, deliverOrgRollup, scanBeforeSeal } from "./leakscan.js";
 // Agent hook stdout/stderr is a protocol boundary. A damaged historical
 // sidecar must remain visible in Doctor/Health, but the low-level warning that
 // `listArchives` emits for an interactive process must not make an otherwise
@@ -986,6 +987,9 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
     // both decide the answer is no.
     return withSourceLock(dataDir, absolute, async () => {
         hooks.signal?.throwIfAborted();
+        // Shared archive boundary: daemon, CLI, and MCP seals use this path.
+        const sealScan = await scanBeforeSeal(dataDir, absolute, hooks.signal, undefined, source.size);
+        const secretScan = sealScan?.metadata;
         // Hashing the source to answer "have I already archived exactly this?" is a
         // whole extra read of a file that may be gigabytes, so it is only worth doing
         // when some archive of this path already claims the same length. Anything of
@@ -1023,7 +1027,7 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
             // limit, fall through to the ordinary full-snapshot writer. That snapshot
             // is independently restorable, and later appends start a short new chain.
             if (resolveDeltaChain(archives, baseRecord).length < MAX_DELTA_CHAIN_LINKS) {
-                return sealDeltaArchive(dataDir, config, absolute, agent, phrase, source.size, { ...base, sha256: baseRecord.source.sha256 }, hooks);
+                return sealDeltaArchive(dataDir, config, absolute, agent, phrase, source.size, { ...base, sha256: baseRecord.source.sha256 }, hooks, sealScan);
             }
         }
         const id = randomUUID();
@@ -1050,8 +1054,15 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
                 // a project's membership needs the answer the seal already had.
                 source: { path: absolute, agent, bytes: plain.originalBytes, sha256: plain.originalSha256, ...(hooks.project ? { project: hooks.project } : {}), ...(hooks.projectKey ? { projectKey: hooks.projectKey } : {}), ...(projectScope ? { projectScope } : {}) },
                 cipher: { algorithm: "none", ciphertextSha256: plain.storedSha256, storedBytes: plain.storedBytes, chunks: 0 },
-                objectPath, ...(base ? { supersedes: base } : {})
+                objectPath, ...(base ? { supersedes: base } : {}), ...(secretScan ? { secretScan } : {})
             };
+            try {
+                assertScanCoversSeal(sealScan, plain.originalSha256, absolute);
+            }
+            catch (error) {
+                await rm(staged, { force: true });
+                throw error;
+            }
             try {
                 await rename(staged, objectPath);
             }
@@ -1060,7 +1071,8 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
                 throw error;
             }
             await writeRecord(config.storage.root, record);
-            await recordAudit(dataDir, "archive.create", "allowed", { archiveId: id, agent, bytes: plain.originalBytes, recipients: 0, supersedes: base?.archiveId ?? null });
+            await recordAudit(dataDir, "archive.create", "allowed", { archiveId: id, agent, bytes: plain.originalBytes, recipients: 0, supersedes: base?.archiveId ?? null, secretFindings: secretScan?.findings.reduce((total, item) => total + item.count, 0) ?? null });
+            await deliverOrgRollup(dataDir, id, secretScan);
             return { ...record, deduplicated: false };
         }
         // Compression happens before the seal because ciphertext is incompressible
@@ -1095,10 +1107,17 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
             version: 2, id, createdAt: sealed.envelope.manifest.createdAt,
             source: { path: absolute, agent, bytes: sealed.originalBytes, sha256: sealed.originalSha256, ...(hooks.project ? { project: hooks.project } : {}), ...(hooks.projectKey ? { projectKey: hooks.projectKey } : {}), ...(projectScope ? { projectScope } : {}) },
             cipher: { algorithm: sealed.envelope.suite, ciphertextSha256: sealed.ciphertextSha256, storedBytes: sealed.storedBytes, chunks: sealed.envelope.chunks.length },
-            envelope: sealed.envelope, objectPath, ...(base ? { supersedes: base } : {})
+            envelope: sealed.envelope, objectPath, ...(base ? { supersedes: base } : {}), ...(secretScan ? { secretScan } : {})
         };
         // The object only becomes an archive once it is whole: the manifest hashes are
         // proved by the last chunk, so a crash mid-seal leaves a .partial nobody reads.
+        try {
+            assertScanCoversSeal(sealScan, sealed.originalSha256, absolute);
+        }
+        catch (error) {
+            await rm(staged, { force: true });
+            throw error;
+        }
         try {
             await rename(staged, objectPath);
         }
@@ -1107,7 +1126,8 @@ export async function archiveFile(dataDir, sourcePath, rawPhrase, agent = "custo
             throw error;
         }
         await writeRecord(config.storage.root, record);
-        await recordAudit(dataDir, "archive.create", "allowed", { archiveId: id, agent, bytes: sealed.originalBytes, recipients: sealed.envelope.wrappedKeys.length, supersedes: base?.archiveId ?? null });
+        await recordAudit(dataDir, "archive.create", "allowed", { archiveId: id, agent, bytes: sealed.originalBytes, recipients: sealed.envelope.wrappedKeys.length, supersedes: base?.archiveId ?? null, secretFindings: secretScan?.findings.reduce((total, item) => total + item.count, 0) ?? null });
+        await deliverOrgRollup(dataDir, id, secretScan);
         if (tokenCollector)
             await indexSealInline(dataDir, phrase, record, tokenCollector.finish(sealed.envelope.chunks.length), hooks.signal);
         return { ...record, deduplicated: false };
@@ -1214,11 +1234,12 @@ async function hashDeltaSnapshot(sourcePath, size, prefixBytes, onActivity, sign
         tailSha256: tail.digest("hex")
     };
 }
-async function sealDeltaArchive(dataDir, config, absolute, agent, phrase, size, base, hooks) {
+async function sealDeltaArchive(dataDir, config, absolute, agent, phrase, size, base, hooks, sealScan) {
     const id = randomUUID();
     const objectPath = join(config.storage.root, `${id}.skarchive`);
     const staged = `${objectPath}.${randomUUID()}.partial`;
     const projectScope = teamSpaceOf(config, hooks.project, hooks.projectKey)?.spaceKey;
+    const secretScan = sealScan?.metadata;
     // Same inline-indexing gate a full seal uses, sized to what THIS seal
     // actually covers: the delta's own appended range, not the whole
     // transcript. That range is exactly what the delta's own chunk numbers
@@ -1265,12 +1286,20 @@ async function sealDeltaArchive(dataDir, config, absolute, agent, phrase, size,
         await rm(staged, { force: true });
         fail("source_unreadable", `${absolute} changed while its append was being sealed; it will re-archive whole on the next pass`, { sourcePath: absolute, bytes: size });
     }
+    try {
+        assertScanCoversSeal(sealScan, snapshot.wholeSha256, absolute);
+    }
+    catch (error) {
+        await rm(staged, { force: true });
+        throw error;
+    }
     const record = {
         version: 2, id, createdAt: sealed.envelope.manifest.createdAt,
         source: { path: absolute, agent, bytes: size, sha256: snapshot.wholeSha256, ...(hooks.project ? { project: hooks.project } : {}), ...(hooks.projectKey ? { projectKey: hooks.projectKey } : {}), ...(projectScope ? { projectScope } : {}) },
         cipher: { algorithm: sealed.envelope.suite, ciphertextSha256: sealed.ciphertextSha256, storedBytes: sealed.storedBytes, chunks: sealed.envelope.chunks.length },
         envelope: sealed.envelope, objectPath,
-        delta: { baseArchiveId: base.archiveId, baseBytes: base.bytes }
+        delta: { baseArchiveId: base.archiveId, baseBytes: base.bytes },
+        ...(secretScan ? { secretScan } : {})
     };
     try {
         await rename(staged, objectPath);
@@ -1280,7 +1309,8 @@ async function sealDeltaArchive(dataDir, config, absolute, agent, phrase, size,
         throw error;
     }
     await writeRecord(config.storage.root, record);
-    await recordAudit(dataDir, "archive.create", "allowed", { archiveId: id, agent, bytes: size, appendedBytes: sealed.originalBytes, recipients: sealed.envelope.wrappedKeys.length, supersedes: null, deltaBase: base.archiveId });
+    await recordAudit(dataDir, "archive.create", "allowed", { archiveId: id, agent, bytes: size, appendedBytes: sealed.originalBytes, recipients: sealed.envelope.wrappedKeys.length, supersedes: null, deltaBase: base.archiveId, secretFindings: secretScan?.findings.reduce((total, item) => total + item.count, 0) ?? null });
+    await deliverOrgRollup(dataDir, id, secretScan);
     // The seal is durable either way; indexing it is advisory (see
     // indexSealInline) and, unlike a full seal, covers only the appended range.
     if (tokenCollector)

package/docs/README.md

@@ -0,0 +1,21 @@
+# The documentation map
+
+**Published with the package** (repo root): [README](../README.md) —
+[ARCHITECTURE](../ARCHITECTURE.md) — [CONTROL_PLANE](../CONTROL_PLANE.md) —
+[THREAT_MODEL](../THREAT_MODEL.md) — [THIRD_PARTY](../THIRD_PARTY.md).
+
+**Living internal docs** (repo root, referenced from code): PRODUCT,
+PRODUCT_ARCHITECTURE, CONTROL_PANEL, SPALA_BACKEND, STORAGE, BORROWED.
+
+**This directory — designs and operations:**
+
+| Page | What it holds |
+| --- | --- |
+| [RUNBOOK.md](./RUNBOOK.md) | Operating the control plane |
+| [secret-scanning.md](./secret-scanning.md) | Seal-time secret scan: defaults, what stays local, what a rollup sends |
+| [legal/](./legal/) | Draft DPA, privacy, security, retention, rights, breach, self-hosting, and DPIA procurement pack |
+| [managed-streaming-contract.md](./managed-streaming-contract.md) | The CREDENTIALS lease contract, written before B2 exists |
+| [sharing-and-spaces.md](./sharing-and-spaces.md) | Sharing today, and the full spaces/org design — **designed, not built** |
+| [history/](./history/) | Dated snapshots, kept but not maintained |
+- [Browser QA checklist](qa-browser-checklist.md) — the clickable scenarios, what has been run against the live service, and what needs a human.
+- [Sharing: one person, and one company](sharing-b2c-b2b.md) — the B2C hand-off that ships, the B2B model that does not, and what each costs.

package/docs/secret-scanning.md

@@ -0,0 +1,81 @@
+# Secret scanning
+
+Seal-time scanning is off by default. Turn it on per machine:
+
+```sh
+sealkeep scan policy record       # scan, store findings, do not block
+sealkeep scan policy block-high   # also refuse high-confidence findings
+sealkeep scan policy off
+```
+
+`record` and `block-high` run before encryption or upload on every new seal:
+the background worker, `sealkeep archive`, the MCP archive tool, delta seals,
+and both streamed upload paths. A transcript that changes during the scan is
+not sealed. If the scanner cannot finish, `block-high` stops the seal.
+`record` stops it only after `sealkeep scan policy fail-closed on`.
+
+Medium findings, including the generic entropy detector, are advisory in every
+mode. High findings are the built-in credential shapes plus any custom pattern
+you mark `high`.
+
+## What stays on the machine
+
+The archive record stores detector kind, severity, count, and up to 32 line
+numbers per kind. It does not store matched text or the masked preview.
+`sealkeep scan <file>` still prints that preview locally. Logs and audit
+entries store counts and kinds, not values.
+
+## What can leave the machine
+
+Nothing, until this machine opts in:
+
+```sh
+sealkeep scan policy plane https://control-plane.example
+sealkeep scan policy rollup on
+```
+
+Policy pull and rollup delivery are signed device requests. Without a
+control-plane device key on this machine, nothing is sent. The control
+plane then receives kind, severity, and count for each scanned archive.
+It does not receive transcript content, matched values, paths, or line
+numbers. Rollups older than 90 days are dropped on write and on read.
+Turning rollup off, or clearing
+the plane with `sealkeep scan policy plane off`, stops further delivery.
+Importing a policy file does not turn rollup on.
+
+## Custom patterns and shared policy
+
+```sh
+sealkeep scan pattern add acme-token high 'ACME[0-9]{8}'
+sealkeep scan pattern list
+sealkeep scan pattern remove acme-token
+```
+
+A pattern must be a valid regular expression of 4–200 characters, must not
+match the empty string, and must contain four consecutive letters or digits.
+Alternation, unbounded quantifiers (`*`, `+`, `?`), lookaround, and
+backreferences are rejected. A closed bound such as `{8}` or `{1,16}` is
+allowed. Each line is matched on a short deadline so a pattern cannot stall
+a seal. Kinds cannot reuse a built-in name. At most 32 patterns are kept.
+
+The scan hashes the exact byte range the seal will read. If that digest
+does not match the sealed plaintext, a local archive is not published.
+Streamed and chunked seals upload an immutable copy of the scanned bytes,
+so a later edit of the live transcript is not what reaches the bucket. That
+copy is removed when the seal finishes, including when later setup fails.
+A copy left by a crash is removed on the next daemon start, or on the next
+scanned seal, once the process that wrote it is gone.
+Custom-pattern startup may take a few seconds; each line still has a 50ms
+deadline.
+
+`sealkeep scan policy export` prints a file with the mode, the fail-closed
+flag, and the patterns. `import <file>` applies that file on another machine.
+`pull` does the same from `GET /v1/secret-scan/policy`. Consent and the
+control-plane URL stay on the machine that set them.
+
+## Limits
+
+The built-in detectors look for AWS key ids, AWS secrets in an assignment,
+GitHub tokens, Google API keys, Slack tokens, private-key headers, JWTs with
+a JSON header, and long high-entropy assignments. A secret in another shape
+is not detected. A clean scan is not proof that the transcript is safe.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "type": "module",
   "description": "Sealkeep by SPALA AI — your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "repository": {
@@ -29,7 +29,8 @@
     "CONTROL_PLANE.md",
     "THREAT_MODEL.md",
     "THIRD_PARTY.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "docs/secret-scanning.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",