sealkeep 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.5.1 — 2026-08-19
+
+The first release that lives entirely at its new addresses.
+
+- Dashboard: the token gate probes once instead of eight times, so a first
+  visit no longer floods the console with 401s; every page carries the seal
+  favicon; panel and sign-in links point at sealkeep.spala.ai.
+- Setup and token help name the real data folders — `~/.sealkeep`, or
+  `~/.vaultline` for vaults created before the rename.
+- Google sign-in survives the old-domain bounce: the interim redirect at the
+  previous address forwards the OAuth code instead of dropping it.
+
 ## 0.5.0 — 2026-08-18
 
 **Vaultline is now Sealkeep** (by SPALA AI) — the old name is used by several

package/dist/site/index.html

@@ -337,7 +337,7 @@
 
 <section>
   <h2>What it does</h2>
-  <p class="sub">Three things, and it does them without ever seeing your work.</p>
+  <p class="sub">Five things, and it does them without ever seeing your work.</p>
 
   <div class="row-item duo">
     <div class="human">
@@ -365,6 +365,25 @@
     </div>
     <div class="machine"><div class="ev">ChaCha20-Poly1305 · per-archive key<br>key wrapped to your 24-word phrase<br><b>server sees ciphertext only</b></div></div>
   </div>
+
+  <div class="row-item duo">
+    <div class="human">
+      <span class="mark">Remember</span>
+      <h3>One memory across every machine</h3>
+      <p>The sealed index syncs beside your archives, so the laptop finds what the desktop sealed. Your agents search it too, over MCP — a collective memory of the project, not a folder on one disk.</p>
+    </div>
+    <div class="machine"><div class="ev">$ sealkeep search "why we forked the retry logic"<br><b>1 session</b> · sealed on your other machine<br>restore ✓ <b>byte-identical</b></div></div>
+  </div>
+
+  <div class="row-item duo">
+    <div class="human">
+      <span class="mark">Drive</span>
+      <h3>The Drive space you never use</h3>
+      <p>Point your agent history at the Google Drive storage you already pay for. One consent connects it; everything is sealed before upload, so Drive holds ciphertext. Cap it, pin projects to it, and let the rest go to managed cloud.</p>
+    </div>
+    <div class="machine"><div class="ev">$ sealkeep storage targets add gdrive --max-gb 50<br>connected · folder <b>Sealkeep</b> · cap 50 GB<br>project big-refactor → Drive · rest → cloud</div></div>
+  </div>
+
 </section>
 
 <section id="plans">
@@ -711,7 +730,9 @@ sealkeep open 08424eb6… ./session.jsonl \
 
 <script>
   const $ = (id) => document.getElementById(id);
-  const API = "/p04946/api";
+  const API = location.hostname === "shared.spala.ai"
+    ? "/p04946/api"
+    : "https://shared.spala.ai/p04946/api";
   // sessionStorage, not localStorage: a bearer token should die with the tab
   // rather than rest on disk.
   const TOKEN = "vaultline.token";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",
@@ -62,4 +62,4 @@
     "sessions"
   ],
   "homepage": "https://sealkeep.spala.ai"
-}
+}

package/web/app.js

@@ -1361,7 +1361,17 @@ async function guard(action) {
 async function start() {
   // No token in hand is not yet a reason to gate: a browser that has been here
   // before holds the HttpOnly cookie, which the server accepts and this page
-  // cannot see. Try the API first; only a 401 shows the gate.
+  // cannot see. But discovering that costs one request, not eight — probe
+  // /v1/status alone, and only fan out the full refresh once it answers. The
+  // browser prints every 401 to the console no matter what we do; one line on
+  // a first visit is honest, eight looked like a malfunction.
+  const probe = await fetch("/v1/status", {
+    headers: { authorization: `Bearer ${token ?? ""}` }
+  }).catch(() => null);
+  if (!probe || probe.status === 401) {
+    showGate(token ? "That token was not accepted." : undefined);
+    return;
+  }
   await guard(refresh);
   // Land on the view named in the URL (e.g. arriving at index.html#settings from
   // the Sessions page), not always Overview.

package/web/index.html

@@ -5,6 +5,7 @@
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="referrer" content="no-referrer">
 <title>Sealkeep</title>
+  <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 16 16%22%3E%3Ctext x=%228%22 y=%2213%22 font-size=%2214%22 text-anchor=%22middle%22%3E%E2%8C%91%3C/text%3E%3C/svg%3E">
 <link rel="stylesheet" href="./style.css">
 <style>
   /* Memory pool: the project column. The name answers "which repo", the dim
@@ -108,7 +109,7 @@
 
   <section id="gate" class="panel gate pad" hidden>
     <h3>Local token required</h3>
-    <p class="note">This browser has not been given its key yet. Paste the token from <code id="token-path">~/.vaultline/local-api-token</code> — a local file, so nothing here is sent anywhere. The browser <code>vaultline ui</code> opened is signed in already.</p>
+    <p class="note">This browser has not been given its key yet. Paste the token from <code id="token-path">local-api-token</code> in your Sealkeep data folder (<code>~/.sealkeep</code>, or <code>~/.vaultline</code> for older vaults) — a local file, so nothing here is sent anywhere. The browser <code>sealkeep ui</code> opened is signed in already.</p>
     <form id="token-form">
       <input id="token-input" type="password" autocomplete="off" spellcheck="false" placeholder="local API token" aria-label="Local API token">
       <button type="submit" class="action">Connect</button>
@@ -172,7 +173,7 @@
            where work in motion belongs. -->
       <div class="panel" id="archives-panel"></div>
       <div class="panel pad" style="margin-top:var(--gap)">
-        <p class="note"><b>If this machine is lost:</b> your recovery phrase plus <code>vaultline cloud login</code> on any machine reaches every copy in managed storage. The phrase is the only key — no copy anywhere can be opened without it.</p>
+        <p class="note"><b>If this machine is lost:</b> your recovery phrase plus <code>sealkeep cloud login</code> on any machine reaches every copy in managed storage. The phrase is the only key — no copy anywhere can be opened without it.</p>
       </div>
     </section>
 
@@ -264,7 +265,7 @@
 
       <h2>Account</h2>
       <div class="panel pad">
-        <p class="note">Set from <a id="set-panel-link" href="https://shared.spala.ai" target="_blank" rel="noopener">the account panel</a>, not here — these apply to every machine on the account, and this machine only mirrors them.</p>
+        <p class="note">Set from <a id="set-panel-link" href="https://sealkeep.spala.ai" target="_blank" rel="noopener">the account panel</a>, not here — these apply to every machine on the account, and this machine only mirrors them.</p>
         <div class="metrics">
           <div class="metric"><h3>What leaves this machine</h3><b id="set-sync-mode" class="small">–</b><small id="set-sync-source"></small></div>
           <div class="metric"><h3>Plan</h3><b id="set-plan" class="small">–</b><small>&nbsp;</small></div>

package/web/retention.html

@@ -3,6 +3,7 @@
 <head>
 <meta charset="utf-8">
 <title>Free up disk — rules · Sealkeep</title>
+  <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 16 16%22%3E%3Ctext x=%228%22 y=%2213%22 font-size=%2214%22 text-anchor=%22middle%22%3E%E2%8C%91%3C/text%3E%3C/svg%3E">
 <meta name="referrer" content="no-referrer">
 </head>
 <body>

package/web/sessions.html

@@ -3,6 +3,7 @@
 <head>
 <meta charset="utf-8">
 <title>Sealkeep — memory pool</title>
+  <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 16 16%22%3E%3Ctext x=%228%22 y=%2213%22 font-size=%2214%22 text-anchor=%22middle%22%3E%E2%8C%91%3C/text%3E%3C/svg%3E">
 <meta name="referrer" content="no-referrer">
 </head>
 <body>

package/web/setup.html

@@ -5,6 +5,7 @@
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="referrer" content="no-referrer">
 <title>Sealkeep — first run</title>
+  <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 16 16%22%3E%3Ctext x=%228%22 y=%2213%22 font-size=%2214%22 text-anchor=%22middle%22%3E%E2%8C%91%3C/text%3E%3C/svg%3E">
 <link rel="stylesheet" href="./style.css">
 </head>
 <body>
@@ -175,8 +176,8 @@
       <!-- Both links name a tab, not just the section, so nobody lands on the
            page and has to work out which half they were sent for. -->
       <div class="actions">
-        <a class="action primary" href="https://shared.spala.ai/p04946/#signup" target="_blank" rel="noreferrer noopener">Create an account</a>
-        <a class="action" href="https://shared.spala.ai/p04946/#signin" target="_blank" rel="noreferrer noopener">I already have one — sign in</a>
+        <a class="action primary" href="https://sealkeep.spala.ai/#signup" target="_blank" rel="noreferrer noopener">Create an account</a>
+        <a class="action" href="https://sealkeep.spala.ai/#signin" target="_blank" rel="noreferrer noopener">I already have one — sign in</a>
       </div>
       <p class="note">The pairing code is single use, and it is not your recovery phrase.</p>
       <div class="actions">
@@ -194,12 +195,12 @@
       <div class="row">
         <div class="field">
           <label for="f-bucket">Bucket name</label>
-          <input id="f-bucket" name="bucket" type="text" autocomplete="off" spellcheck="false" placeholder="my-vaultline-archives">
+          <input id="f-bucket" name="bucket" type="text" autocomplete="off" spellcheck="false" placeholder="my-sealkeep-archives">
           <p class="note error" id="e-bucket" hidden></p>
         </div>
         <div class="field">
           <label for="f-prefix">Folder inside it</label>
-          <input id="f-prefix" name="prefix" type="text" autocomplete="off" spellcheck="false" value="vaultline">
+          <input id="f-prefix" name="prefix" type="text" autocomplete="off" spellcheck="false" value="sealkeep">
           <p class="note error" id="e-prefix" hidden></p>
         </div>
       </div>
@@ -372,16 +373,16 @@
   <!-- Shown instead of a blank page when the machine cannot answer. -->
   <!-- The token lives in sessionStorage, which belongs to one browser. Opening
        this address in a second one arrives with nothing, and telling that person
-       to "run vaultline ui" is both a terminal instruction and the wrong one:
+       to "run sealkeep ui" is both a terminal instruction and the wrong one:
        it would open their default browser, not the one they are looking at. So
        the page offers the way in that works from here. -->
   <section class="screen" id="screen-gate" hidden>
     <header>
       <h1>Sign this browser in</h1>
-      <p class="lede">Sealkeep is running on this machine — this browser just has not been given its key yet. That happens automatically in whichever browser <code>vaultline ui</code> opened.</p>
+      <p class="lede">Sealkeep is running on this machine — this browser just has not been given its key yet. That happens automatically in whichever browser <code>sealkeep ui</code> opened.</p>
     </header>
     <div class="panel pad">
-      <p class="note">Paste the token from <code id="gate-token-path">~/.vaultline/local-api-token</code>. It is a local file; nothing here is sent anywhere.</p>
+      <p class="note">Paste the token from <code id="gate-token-path">local-api-token</code> in your Sealkeep data folder (<code>~/.sealkeep</code>, or <code>~/.vaultline</code> for older vaults). It is a local file; nothing here is sent anywhere.</p>
       <form id="gate-form">
         <div class="field">
           <label for="gate-token">Local API token</label>
@@ -390,7 +391,7 @@
         <div class="actions"><button type="submit" class="action primary">Connect this browser</button></div>
       </form>
       <p class="note error" id="gate-error" hidden></p>
-      <p class="note">On macOS or Linux: <code>cat ~/.vaultline/local-api-token</code></p>
+      <p class="note">On macOS or Linux: <code>cat ~/.sealkeep/local-api-token</code> (older vaults: <code>~/.vaultline</code>)</p>
     </div>
   </section>
 
@@ -401,8 +402,8 @@
     </header>
     <div class="panel pad callout">
       <h3>What to do instead</h3>
-      <p>Update to a build that has the setup endpoints: <code>npm i -g vaultline@latest</code>, then run <code>vaultline</code> again.</p>
-      <p>Or set the same things up from a terminal — the wizard is a second way in, never the only one: <code>vaultline setup</code>, <code>vaultline storage configure</code>.</p>
+      <p>Update to a build that has the setup endpoints: <code>npm i -g sealkeep@latest</code>, then run <code>sealkeep</code> again.</p>
+      <p>Or set the same things up from a terminal — the wizard is a second way in, never the only one: <code>sealkeep setup</code>, <code>sealkeep storage configure</code>.</p>
       <p>Already have a vault? The <a href="./index.html">dashboard</a> works regardless.</p>
     </div>
   </section>

package/web/setup.js

@@ -654,7 +654,7 @@ async function boot() {
       // here" ticked above a fully drawn R2 form.
       draft.intent = intentFor(draft.providerId);
       draft.storage.bucket = state.storage.bucket ?? "";
-      draft.storage.prefix = state.storage.prefix ?? "vaultline";
+      draft.storage.prefix = state.storage.prefix ?? "sealkeep";
     }
   } catch (error) {
     if (error.missing) {