sealkeep 0.11.6 → 0.11.7

package/dist/src/leakscan.js

@@ -14,23 +14,410 @@
  * the same bytes always produce the same findings, which is what lets the
  * exit code gate a script.
  *
- * Phase 2 — integration points, deliberately not implemented here:
+ * Seal-time scanning runs on every new archive — local, delta, MCP, and both
+ * streamed layouts — when the machine policy is `record` or `block-high`.
+ * `off` (the default) does not scan. Medium findings stay advisory.
+ * `block-high` refuses the seal before encryption or upload. A transcript
+ * that changes during the scan is always refused. Any other scanner failure
+ * refuses the seal when `block-high` is on or `secretScanFailClosed` is set;
+ * otherwise the seal continues and records no scan, so an empty finding list
+ * always means the bytes were actually read.
  *
- * (a) Worker seal path: worker.ts calls scanFileStreaming(job.sourcePath)
- *     just before sealing and stores the findings — kind, severity, line,
- *     masked preview — as metadata beside the archive record, so "which
- *     archives hold live credentials?" is answerable without opening any
- *     of them.
- * (b) Org rollup: the control plane receives kind/severity/counts only —
- *     never content, never lines, never previews. Because only this machine
- *     ever holds plaintext, an org can learn *that* a credential was sealed
- *     and *what sort*, but the credential itself cannot travel.
+ * Archive metadata stores detector kind, severity, count, and line numbers.
+ * Matched text and previews stay in the live `sealkeep scan` report only.
+ * An organization rollup, sent only with per-machine consent, carries kind,
+ * severity, and count. It never carries transcript text, matched values,
+ * paths, or line numbers.
  */
-import { createReadStream } from "node:fs";
-import { readdir, stat } from "node:fs/promises";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { once } from "node:events";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
-import { fail } from "./errors.js";
+import { Worker } from "node:worker_threads";
+import { recordAudit } from "./audit.js";
+import { signedControlPlaneFetch } from "./control-plane/auth.js";
+import { fail, isSealkeepError } from "./errors.js";
+import { readLocalSettings } from "./machine-settings.js";
+const BUILTIN_KINDS = new Set([
+    "aws-access-key-id", "aws-secret-access-key", "github-token", "google-api-key",
+    "slack-token", "private-key", "jwt", "high-entropy-value"
+]);
+const KIND_PATTERN = /^[a-z][a-z0-9-]{1,40}$/;
+function literalRun(source) {
+    let best = 0;
+    let run = 0;
+    let escaped = false;
+    let inClass = false;
+    for (const character of source) {
+        if (escaped) {
+            escaped = false;
+            if (!inClass && /[A-Za-z0-9]/.test(character)) {
+                run += 1;
+                best = Math.max(best, run);
+            }
+            else
+                run = 0;
+            continue;
+        }
+        if (character === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (character === "[") {
+            inClass = true;
+            run = 0;
+            continue;
+        }
+        if (character === "]" && inClass) {
+            inClass = false;
+            run = 0;
+            continue;
+        }
+        if (inClass || !/[A-Za-z0-9]/.test(character)) {
+            run = 0;
+            continue;
+        }
+        run += 1;
+        best = Math.max(best, run);
+    }
+    return best;
+}
+/**
+ * Custom patterns are a bounded subset of regular expressions. Alternation,
+ * unbounded quantifiers, lookaround, and backreferences are rejected because
+ * JavaScript's matcher can take exponential time on them. A fixed bound such
+ * as `{8}` or `{1,16}` is allowed.
+ */
+function assertBoundedPattern(source) {
+    let escaped = false;
+    let inClass = false;
+    for (let index = 0; index < source.length; index += 1) {
+        const character = source[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (character === "\\") {
+            const next = source[index + 1];
+            if (next && /[1-9]/.test(next))
+                fail("invalid_argument", "Custom patterns cannot use backreferences.");
+            escaped = true;
+            continue;
+        }
+        if (character === "[") {
+            inClass = true;
+            continue;
+        }
+        if (character === "]" && inClass) {
+            inClass = false;
+            continue;
+        }
+        if (inClass)
+            continue;
+        if (character === "|")
+            fail("invalid_argument", "Custom patterns cannot use alternation.");
+        if (character === "*" || character === "+" || character === "?") {
+            fail("invalid_argument", "Custom patterns cannot use unbounded quantifiers. Use a fixed bound such as {1,16}.");
+        }
+        if (source.startsWith("(?", index) && source[index + 2] !== ":") {
+            fail("invalid_argument", "Custom patterns cannot use lookaround or other special groups.");
+        }
+        if (character === "{") {
+            const close = source.indexOf("}", index);
+            const body = close > index ? source.slice(index + 1, close) : "";
+            const match = /^(\d+)(?:,(\d+))?$/.exec(body);
+            if (!match || (match[2] === undefined && body.includes(","))) {
+                fail("invalid_argument", "Custom patterns cannot use an open-ended quantifier.");
+            }
+            const low = Number(match[1]);
+            const high = match[2] === undefined ? low : Number(match[2]);
+            if (high < low || high - low > 32 || high > 200) {
+                fail("invalid_argument", "A custom quantifier must be a closed range no wider than 32 and no longer than 200.");
+            }
+            index = close;
+        }
+    }
+}
+/** Reject patterns that match everything, fail to compile, or can backtrack without bound. */
+export function validateCustomPattern(input) {
+    const kind = input.kind.trim();
+    const source = input.source;
+    if (!KIND_PATTERN.test(kind) || BUILTIN_KINDS.has(kind)) {
+        fail("invalid_argument", "A custom pattern kind must be 2–41 lowercase letters, digits, or hyphens, and must not reuse a built-in detector name.");
+    }
+    if (input.severity !== "high" && input.severity !== "medium")
+        fail("invalid_argument", "Pattern severity must be high or medium.");
+    if (source.length < 4 || source.length > 200)
+        fail("invalid_argument", "A custom pattern must be between 4 and 200 characters.");
+    assertBoundedPattern(source);
+    if (literalRun(source) < 4)
+        fail("invalid_argument", "A custom pattern needs at least four consecutive letters or digits so it cannot match ordinary text.");
+    let compiled;
+    try {
+        compiled = new RegExp(source, "d");
+    }
+    catch {
+        fail("invalid_argument", "That pattern is not a valid regular expression.");
+    }
+    if (compiled.test(""))
+        fail("invalid_argument", "A custom pattern must not match the empty string.");
+    return { kind, severity: input.severity, source };
+}
+const CUSTOM_LINE_MS = 50;
+/** Worker startup is once per scan and can be slow on a busy machine. It is not the per-line deadline. */
+const CUSTOM_START_MS = 5_000;
+function openCustomMatcher(patterns) {
+    const worker = new Worker(`
+    import { parentPort } from "node:worker_threads";
+    const compiled = [];
+    parentPort.on("message", (message) => {
+      if (message.patterns) {
+        compiled.length = 0;
+        for (const pattern of message.patterns) compiled.push({ ...pattern, expression: new RegExp(pattern.source, "dg") });
+        parentPort.postMessage({ ready: true });
+        return;
+      }
+      const found = [];
+      for (const pattern of compiled) {
+        for (const match of message.line.matchAll(pattern.expression)) {
+          const span = match.indices && match.indices[0];
+          if (span) found.push({ kind: pattern.kind, severity: pattern.severity, start: span[0], end: span[1] });
+        }
+      }
+      parentPort.postMessage(found);
+    });
+  `, { eval: true, execArgv: [] });
+    worker.postMessage({ patterns });
+    return worker;
+}
+/** Runs custom detectors off the seal thread and stops them if one line runs long. */
+export async function matchCustomLine(line, patterns, timeoutMs = CUSTOM_LINE_MS) {
+    if (patterns.length === 0)
+        return [];
+    const worker = openCustomMatcher(patterns);
+    try {
+        return await new Promise((resolve, reject) => {
+            let timer = setTimeout(() => reject(new Error("custom pattern timed out")), CUSTOM_START_MS);
+            const onMessage = (value) => {
+                if (!Array.isArray(value)) {
+                    clearTimeout(timer);
+                    timer = setTimeout(() => reject(new Error("custom pattern timed out")), timeoutMs);
+                    worker.postMessage({ line });
+                    return;
+                }
+                clearTimeout(timer);
+                worker.off("message", onMessage);
+                resolve(value);
+            };
+            worker.on("message", onMessage);
+            worker.once("error", (error) => { clearTimeout(timer); reject(error); });
+        });
+    }
+    finally {
+        await worker.terminate();
+    }
+}
+function compileCustom(patterns) {
+    return patterns.map((pattern) => {
+        const checked = validateCustomPattern(pattern);
+        return { kind: checked.kind, pattern: new RegExp(checked.source, "dg"), severity: checked.severity };
+    });
+}
+export function findingsMetadata(findings, policy) {
+    const groups = new Map();
+    for (const finding of findings) {
+        const key = `${finding.kind}\0${finding.severity}`;
+        const group = groups.get(key) ?? { kind: finding.kind, severity: finding.severity, count: 0, lines: [] };
+        group.count += 1;
+        if (group.lines.length < 32 && !group.lines.includes(finding.line))
+            group.lines.push(finding.line);
+        groups.set(key, group);
+    }
+    return { version: 1, scannedAt: new Date().toISOString(), policy, findings: [...groups.values()] };
+}
+export function orgRollupBody(archiveId, scan) {
+    return {
+        version: 1,
+        archiveId,
+        scannedAt: scan.scannedAt,
+        counts: scan.findings.map(({ kind, severity, count }) => ({ kind, severity, count }))
+    };
+}
+/** Removes a scanned snapshot. Safe to call when the scan did not take one. */
+export async function discardScanSnapshot(scan) {
+    if (scan?.snapshotPath)
+        await rm(scan.snapshotPath, { force: true });
+}
+const snapshotName = /^[0-9a-f]+\.(\d+)\.snap$/;
+function processAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/**
+ * A crash after the snapshot is written leaves plaintext in scan-snapshots.
+ * The name records the creating pid. Startup and the next scanned seal remove
+ * a file only when that process is gone, so a live seal keeps its copy.
+ */
+export async function sweepStaleScanSnapshots(dataDir) {
+    const names = await readdir(join(dataDir, "scan-snapshots")).catch(() => []);
+    for (const name of names) {
+        const match = snapshotName.exec(name);
+        if (!match)
+            continue;
+        const pid = Number(match[1]);
+        if (pid === process.pid || processAlive(pid))
+            continue;
+        await rm(join(dataDir, "scan-snapshots", name), { force: true }).catch(() => undefined);
+    }
+}
+/**
+ * Set by tests to change the file after the scan has accepted it and before
+ * the seal reads it again. Production leaves this unset.
+ */
+export const sealScanTestHooks = {};
+/**
+ * Scan before encryption or upload. Returns metadata and the digest of the
+ * exact byte range the seal will read, or undefined when the policy is off
+ * or a fail-open scanner error skipped it. Throws before any archive exists
+ * when the seal must not proceed.
+ */
+export async function scanBeforeSeal(dataDir, path, signal, hooks, byteLength, options) {
+    const settings = await readLocalSettings(dataDir);
+    if (settings.secretScanPolicy === "off")
+        return undefined;
+    const policy = settings.secretScanPolicy;
+    signal?.throwIfAborted();
+    const before = await stat(path);
+    const end = byteLength ?? before.size;
+    const snapshotDir = join(dataDir, "scan-snapshots");
+    if (options?.snapshot)
+        await sweepStaleScanSnapshots(dataDir);
+    const snapshotPath = options?.snapshot ? join(snapshotDir, `${randomBytes(9).toString("hex")}.${process.pid}.snap`) : undefined;
+    let snapshot;
+    if (snapshotPath) {
+        await mkdir(snapshotDir, { recursive: true, mode: 0o700 });
+        snapshot = createWriteStream(snapshotPath, { mode: 0o600 });
+    }
+    const discard = async () => {
+        snapshot?.destroy();
+        if (snapshotPath)
+            await rm(snapshotPath, { force: true });
+    };
+    let scanned;
+    try {
+        scanned = await scanByteRange(path, end, settings.secretScanPatterns, signal, snapshot);
+        if (snapshot) {
+            snapshot.end();
+            await once(snapshot, "finish");
+        }
+        await hooks?.afterRead?.();
+    }
+    catch (error) {
+        await discard();
+        if (isSealkeepError(error) || (error instanceof Error && error.name === "AbortError"))
+            throw error;
+        if (policy === "block-high" || settings.secretScanFailClosed) {
+            fail("secret_scan_failed", "Seal stopped: the secret scan could not finish, and this machine fails closed.", { sourcePath: path });
+        }
+        return undefined;
+    }
+    try {
+        signal?.throwIfAborted();
+        const after = await stat(path).catch(() => fail("source_unreadable", "Transcript disappeared while secret scanning.", { sourcePath: path }));
+        if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ino !== after.ino) {
+            fail("source_unreadable", "Transcript changed while secret scanning; retry the seal after the agent pauses.", { sourcePath: path });
+        }
+        const high = scanned.findings.filter((finding) => finding.severity === "high");
+        if (policy === "block-high" && high.length > 0) {
+            const kinds = [...new Set(high.map((finding) => finding.kind))];
+            fail("secret_scan_blocked", `Seal blocked: secret scan found ${high.length} high-confidence finding${high.length === 1 ? "" : "s"} (${kinds.slice(0, 5).join(", ")}). Review with “sealkeep scan <transcript>” and remove or rotate any real credentials.`, { count: high.length, kinds });
+        }
+        await sealScanTestHooks.afterAccepted?.(path);
+        return { metadata: findingsMetadata(scanned.findings, policy), sha256: scanned.sha256, ...(snapshotPath ? { snapshotPath } : {}) };
+    }
+    catch (error) {
+        await discard();
+        throw error;
+    }
+}
+/** Refuse to publish a seal whose plaintext digest is not the digest that was scanned. */
+export function assertScanCoversSeal(scan, sealedSha256, sourcePath) {
+    if (!scan)
+        return;
+    const left = Buffer.from(scan.sha256, "hex");
+    const right = Buffer.from(sealedSha256, "hex");
+    if (left.length !== right.length || !timingSafeEqual(left, right)) {
+        fail("source_unreadable", "Transcript changed after the secret scan; retry the seal after the agent pauses.", { sourcePath });
+    }
+}
+/** @deprecated Use scanBeforeSeal. Kept so older call sites keep blocking. */
+export async function assertSecretScanPasses(dataDir, path, signal) {
+    await scanBeforeSeal(dataDir, path, signal);
+}
+const controlPlaneDevicePath = (dataDir) => join(dataDir, "control-plane-device.json");
+export async function readControlPlaneDevice(dataDir) {
+    try {
+        const parsed = JSON.parse(await readFile(controlPlaneDevicePath(dataDir), "utf8"));
+        if (typeof parsed.deviceId !== "string" || typeof parsed.privateKeyPem !== "string")
+            return null;
+        return { deviceId: parsed.deviceId, privateKeyPem: parsed.privateKeyPem };
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeControlPlaneDevice(dataDir, device) {
+    await writeFile(controlPlaneDevicePath(dataDir), JSON.stringify(device) + "\n", { mode: 0o600 });
+}
+/** Best-effort delivery after a durable seal. A network failure never rolls the archive back. */
+export async function deliverOrgRollup(dataDir, archiveId, scan) {
+    if (!scan)
+        return;
+    const settings = await readLocalSettings(dataDir);
+    if (!settings.secretScanOrgRollup || !settings.secretScanControlPlaneUrl)
+        return;
+    const body = orgRollupBody(archiveId, scan);
+    const device = await readControlPlaneDevice(dataDir);
+    const counts = body.counts.reduce((total, item) => total + item.count, 0);
+    if (!device) {
+        await recordAudit(dataDir, "secret_scan.rollup", "denied", { archiveId, status: 401, counts }).catch(() => undefined);
+        return;
+    }
+    try {
+        const response = await signedControlPlaneFetch({
+            origin: settings.secretScanControlPlaneUrl,
+            method: "POST",
+            path: "/v1/secret-scan/rollups",
+            deviceId: device.deviceId,
+            privateKey: device.privateKeyPem,
+            body: JSON.stringify(body)
+        });
+        if (!response.ok) {
+            await recordAudit(dataDir, "secret_scan.rollup", "denied", { archiveId, status: response.status, counts }).catch(() => undefined);
+        }
+    }
+    catch {
+        await recordAudit(dataDir, "secret_scan.rollup", "denied", { archiveId, status: 0, counts }).catch(() => undefined);
+    }
+}
+/** What may move between machines. Consent and the control-plane URL stay local. */
+export function sharedScanPolicy(settings) {
+    return {
+        version: 1,
+        secretScanPolicy: settings.secretScanPolicy,
+        secretScanFailClosed: settings.secretScanFailClosed,
+        secretScanPatterns: settings.secretScanPatterns.map((pattern) => validateCustomPattern(pattern))
+    };
+}
 /**
  * First four characters, then only the length. A leak report that repeats the
  * leak is a second leak: findings travel further than the transcript did —
@@ -122,10 +509,10 @@ const BENIGN_VALUE_SHAPES = [
     /^AAAA/, // base64 of leading zero bytes: well-known placeholders and ssh key headers
     /^(?:vlt|vault)_/i // Sealkeep's own refs (vlt_…, vault_ref ids), which are public by design
 ];
-function scanLine(line, lineNumber) {
+function scanLine(line, lineNumber, extra = []) {
     const findings = [];
     const claimed = [];
-    for (const detector of PATTERN_DETECTORS) {
+    for (const detector of [...PATTERN_DETECTORS, ...extra]) {
         for (const match of line.matchAll(detector.pattern)) {
             const span = match.indices?.[detector.group ?? 0];
             if (!span)
@@ -134,7 +521,7 @@ function scanLine(line, lineNumber) {
             if (detector.validate && !detector.validate(secret))
                 continue;
             claimed.push(span);
-            findings.push({ kind: detector.kind, line: lineNumber, column: span[0] + 1, preview: maskSecret(secret), severity: "high" });
+            findings.push({ kind: detector.kind, line: lineNumber, column: span[0] + 1, preview: maskSecret(secret), severity: detector.severity ?? "high" });
         }
     }
     for (const match of line.matchAll(GENERIC_ASSIGNMENT)) {
@@ -153,8 +540,9 @@ function scanLine(line, lineNumber) {
     }
     return findings.sort((a, b) => a.column - b.column || a.kind.localeCompare(b.kind));
 }
-export function scanText(text) {
-    return text.split(/\r?\n/).flatMap((line, index) => scanLine(line, index + 1));
+export function scanText(text, patterns = []) {
+    const extra = patterns.length ? compileCustom(patterns) : [];
+    return text.split(/\r?\n/).flatMap((line, index) => scanLine(line, index + 1, extra));
 }
 /**
  * Line-by-line over a read stream: memory is bounded by the longest single
@@ -162,7 +550,75 @@ export function scanText(text) {
  * a small one. An unreadable input rejects — a scanner that swallows a read
  * error would be reporting "clean" about bytes it never saw.
  */
-export async function scanFileStreaming(path, onFinding) {
+/** Hash and scan exactly `[0, end)`, the range a seal will read. */
+async function scanByteRange(path, end, patterns, signal, snapshot) {
+    const hash = createHash("sha256");
+    const decoder = new TextDecoder("utf8");
+    const findings = [];
+    let pending = "";
+    let lineNumber = 0;
+    const matcher = patterns.length > 0 ? openCustomMatcher(patterns) : null;
+    const consume = async (line) => {
+        lineNumber += 1;
+        for (const finding of scanLine(line, lineNumber))
+            findings.push(finding);
+        if (!matcher)
+            return;
+        const custom = await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new Error("custom pattern timed out")), CUSTOM_LINE_MS);
+            const onMessage = (value) => {
+                if (!Array.isArray(value))
+                    return;
+                clearTimeout(timer);
+                matcher.off("message", onMessage);
+                resolve(value);
+            };
+            matcher.on("message", onMessage);
+            matcher.postMessage({ line });
+        });
+        for (const hit of custom) {
+            const secret = line.slice(hit.start, hit.end);
+            findings.push({ kind: hit.kind, line: lineNumber, column: hit.start + 1, preview: maskSecret(secret), severity: hit.severity });
+        }
+    };
+    try {
+        if (matcher) {
+            await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => reject(new Error("custom pattern timed out")), CUSTOM_START_MS);
+                matcher.once("message", () => { clearTimeout(timer); resolve(); });
+                matcher.once("error", (error) => { clearTimeout(timer); reject(error); });
+            });
+        }
+        if (end > 0) {
+            const input = createReadStream(path, { start: 0, end: end - 1, signal });
+            for await (const chunk of input) {
+                signal?.throwIfAborted();
+                const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                hash.update(bytes);
+                if (snapshot && !snapshot.write(bytes))
+                    await once(snapshot, "drain");
+                pending += decoder.decode(bytes, { stream: true });
+                let newline = pending.indexOf("\n");
+                while (newline >= 0) {
+                    let line = pending.slice(0, newline);
+                    pending = pending.slice(newline + 1);
+                    if (line.endsWith("\r"))
+                        line = line.slice(0, -1);
+                    await consume(line);
+                    newline = pending.indexOf("\n");
+                }
+            }
+        }
+        pending += decoder.decode();
+        if (pending.length > 0)
+            await consume(pending);
+        return { findings, sha256: hash.digest("hex") };
+    }
+    finally {
+        await matcher?.terminate();
+    }
+}
+export async function scanFileStreaming(path, onFinding, extra = []) {
     const input = createReadStream(path, { encoding: "utf8" });
     const lines = createInterface({ input, crlfDelay: Infinity });
     const findings = [];
@@ -170,7 +626,7 @@ export async function scanFileStreaming(path, onFinding) {
     try {
         for await (const line of lines) {
             lineNumber += 1;
-            for (const finding of scanLine(line, lineNumber)) {
+            for (const finding of scanLine(line, lineNumber, extra)) {
                 findings.push(finding);
                 onFinding?.(finding);
             }
@@ -205,16 +661,18 @@ async function jsonlFiles(dir) {
  * over a "medium" suspicion is exactly the cry-wolf behaviour the severity
  * split exists to avoid.
  */
-export async function scanPath(target, onFinding) {
+export async function scanPath(target, onFinding, patterns = []) {
     const info = await stat(target).catch(() => fail("source_unreadable", `Cannot read ${target}`));
     const files = info.isDirectory() ? await jsonlFiles(target) : [target];
     const findings = [];
     for (const file of files) {
-        await scanFileStreaming(file, (finding) => {
+        const info = await stat(file);
+        const scanned = await scanByteRange(file, info.size, patterns);
+        for (const finding of scanned.findings) {
             const placed = { ...finding, file };
             findings.push(placed);
             onFinding?.(placed);
-        });
+        }
     }
     const high = findings.filter((finding) => finding.severity === "high").length;
     const medium = findings.length - high;

package/dist/src/local-api.js

@@ -335,7 +335,6 @@ const setupServiceSchema = z.object({
 const policyCanReclaim = (policy) => policy === "archive-and-reclaim" || policy === "manual-approval";
 const webRoot = findWebRoot();
 const CONTENT_TYPES = { ".html": "text/html; charset=utf-8", ".css": "text/css; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".svg": "image/svg+xml" };
-const BOOTSTRAP_REDIRECT_PARAM = "__sealkeep_bootstrap";
 /**
  * Serves the companion dashboard from the same origin as the API, so the page can
  * authenticate with the local token without any cross-origin exception.
@@ -955,9 +954,8 @@ function json(response, status, value, headers = {}) {
     });
     response.end(JSON.stringify(value));
 }
-/** A direct address-bar navigation is the only unauthenticated request that
- * may receive a browser bootstrap page. Fetch Metadata keeps a cross-site
- * page from silently navigating a victim into an authenticated local UI. */
+/** Browser CSRF classification only. These headers are client-supplied, so a
+ * match must never mint a bearer ticket. Another local account can set them. */
 function isDirectDashboardNavigation(request) {
     const site = request.headers["sec-fetch-site"];
     const mode = request.headers["sec-fetch-mode"];
@@ -3252,36 +3250,21 @@ export function createLocalApiServer(dataDir, token, options = {}) {
             }
             // The UI shell is static and holds no vault data, so it loads before
             // authentication; it then presents the token on every /v1 call below.
+            // Fetch Metadata may describe a browser navigation, including one typed
+            // into the address bar. That classification is CSRF-only: any local
+            // process can set the same headers, so this response never carries a
+            // bootstrap ticket. `sealkeep ui` obtains a ticket with the owner-only
+            // HMAC proof. A second browser waits for a tab that already holds the
+            // bearer to approve it.
             if (method === "GET" && !url.pathname.startsWith("/v1/")) {
-                // A person typing the stable localhost origin into a second browser
-                // performs a genuine top-level navigation. Give that navigation the
-                // same short-lived fragment ticket as `sealkeep ui`; no command or
-                // bearer copy is needed. A one-shot marker prevents the bootstrap from
-                // looping when the browser follows it, and require Fetch Metadata headers so cross-site embeds and
-                // drive-by navigations cannot mint a local API credential. This also
-                // covers a fresh install, whose landing page is the setup wizard.
-                const directUiPath = url.pathname === "/" || url.pathname === "/index.html" || url.pathname === "/setup.html";
-                if (directUiPath && !url.searchParams.has(BOOTSTRAP_REDIRECT_PARAM) && isDirectDashboardNavigation(request)) {
-                    const { ticket } = newBootstrapTicket();
-                    const targetPath = url.pathname === "/" ? await landingPage(dataDir) : url.pathname;
-                    // The HTTP server cannot see the requested fragment. A redirect with
-                    // #ticket would erase an incoming recovery/project deep link. The
-                    // same-origin script retains a validated view before navigating to
-                    // the marked shell. Both attributes contain server-generated values:
-                    // a base64url ticket and one of the three fixed dashboard paths.
-                    const target = `${targetPath}?${BOOTSTRAP_REDIRECT_PARAM}=1`;
-                    response.writeHead(200, {
-                        "content-type": "text/html; charset=utf-8",
-                        "cache-control": "no-store",
-                        "x-content-type-options": "nosniff",
-                        "cross-origin-opener-policy": "same-origin",
-                        "x-frame-options": "DENY",
-                        "content-security-policy": "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'",
-                    });
-                    response.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Opening Sealkeep</title><script src="/bootstrap.js" defer></script></head><body data-bootstrap-ticket="${ticket}" data-bootstrap-target="${target}"><p>Opening Sealkeep securely…</p><noscript>Enable JavaScript to open this local dashboard.</noscript></body></html>`);
-                    return;
-                }
-                return serveStatic(url.pathname === "/" ? await landingPage(dataDir) : url.pathname, response);
+                const pathname = url.pathname === "/" ? await landingPage(dataDir) : url.pathname;
+                // Passing this check only means a browser would call the request a
+                // top-level visit. It used to embed a bearer ticket. A local process
+                // can set the same headers, so the visit receives the unsigned shell.
+                if ((url.pathname === "/" || url.pathname === "/index.html" || url.pathname === "/setup.html") && isDirectDashboardNavigation(request)) {
+                    return serveStatic(pathname, response);
+                }
+                return serveStatic(pathname, response);
             }
             if (!authorized(request, token))
                 return json(response, 401, { error: { code: "unauthorized", message: "A local API bearer token is required" } }, { "www-authenticate": "Bearer" });

package/dist/src/machine-settings.d.ts

@@ -8,6 +8,32 @@ export type LocalSettings = {
     watchedPaths: string[];
     exclusions: string[];
     reclaimEnabled: boolean;
+    /**
+     * Seal-time secret scan. `off` skips it. `record` stores findings and does
+     * not block. `block-high` refuses the seal when a high-confidence finding
+     * exists. Medium findings stay advisory in every mode.
+     */
+    secretScanPolicy: "off" | "record" | "block-high";
+    /**
+     * When the scanner cannot finish, refuse the seal. `block-high` always
+     * fails closed even if this is false. A transcript that changes during the
+     * scan is always refused.
+     */
+    secretScanFailClosed: boolean;
+    /**
+     * Per-machine consent to send aggregate kind/severity/count rollups to the
+     * configured control plane. Default off. Line numbers and matched text never
+     * travel, and this flag is not part of a shared policy file.
+     */
+    secretScanOrgRollup: boolean;
+    /** Control plane origin for policy pull and rollup delivery. Null sends nothing. */
+    secretScanControlPlaneUrl: string | null;
+    /** Extra detectors. High ones block under `block-high`; medium ones never do. */
+    secretScanPatterns: Array<{
+        kind: string;
+        severity: "high" | "medium";
+        source: string;
+    }>;
     trashStrategy: "auto" | TrashResult["strategy"];
     schedule: {
         intervalMinutes: number;