sealkeep 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.5.2 — 2026-08-19
+
+- "Manage in cloud" now opens sealkeep.spala.ai — the panel URL was still
+  derived from the API origin, which the rename left behind. Self-hosted
+  planes keep deriving from their own origin.
+- The cloud panel folds chunk families into one archive per row, edits the
+  account's storage routing (priorities, caps, project pins, Google Drive),
+  and gained a for-companies section.
+
 ## 0.5.1 — 2026-08-19
 
 The first release that lives entirely at its new addresses.

package/dist/site/index.html

@@ -386,6 +386,40 @@
 
 </section>
 
+<section id="teams"><div class="wrap">
+  <h2>For teams and companies</h2>
+  <p class="sub">Agent transcripts are source code, prompts, and pasted secrets. Treat them like it.</p>
+
+  <div class="row-item duo">
+    <div class="human">
+      <span class="mark">Custody</span>
+      <h3>Your data never changes hands</h3>
+      <p>Sealed before it leaves the machine, stored in a bucket you own if you choose, opened only by keys we never hold. Data residency is wherever you put the bucket. A secrets scan runs before anything is uploaded, and retention only ever stages to trash — there is no delete path.</p>
+    </div>
+    <div class="machine"><div class="ev">sealed on machine · keys stay yours<br>your bucket, your region, your retention<br>leak scan before every upload</div></div>
+  </div>
+
+  <div class="row-item duo">
+    <div class="human">
+      <span class="mark">Audit</span>
+      <h3>Every action, written down</h3>
+      <p>Each seal, upload, restore, and reclaim lands in a local audit log, and the control plane keeps its own account-scoped trail — identifiers and counts, never content. When someone asks what happened to a session, the answer is a query, not a shrug.</p>
+    </div>
+    <div class="machine"><div class="ev">$ sealkeep audit<br>sealed 9f2c1ab4 · uploaded · verified<br>restored by device macbook · 12 Aug</div></div>
+  </div>
+
+  <div class="row-item duo">
+    <div class="human">
+      <span class="mark">Share</span>
+      <h3>Hand a session over, not the vault</h3>
+      <p>One session goes to a teammate as a sealed bundle under a one-time passcode — your recovery phrase never travels. Team spaces — one sealed memory for a whole project, across people, with instant offboarding — are designed on the same envelope machinery and are next on the roadmap.</p>
+    </div>
+    <div class="machine"><div class="ev">$ sealkeep share 9f2c1ab4<br>bundle sealed · passcode shown once<br>opens without your phrase</div></div>
+  </div>
+
+  <p class="why">Straight talk: the encryption is built on published primitives with test vectors and a tamper suite, and has not yet had an independent audit. We say so here because your security review will ask.</p>
+</div></section>
+
 <section id="plans">
   <h2>Two ways to run it</h2>
   <p class="sub">Same encryption either way. The only difference is which side of the line the bucket sits on.</p>
@@ -522,7 +556,7 @@ sealkeep open 08424eb6… ./session.jsonl \
   <div class="pane" id="p-account">
     <div class="ph" id="a-strip" tabindex="-1">
       <span class="name" id="a-label">—</span>
-      <span class="chip" id="a-plan">—</span>
+      <button class="chip" id="a-plan" type="button" title="See your plan">—</button>
       <span class="who" id="a-who">—</span>
     </div>
 
@@ -559,18 +593,18 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="c-archives" style="display:none">
       <span class="eyebrow">Archives</span>
-      <p id="s-intro">Deleting one here removes the stored copy. If your machine already reclaimed the source, this is the last copy.</p>
+      <p id="s-intro">Names live on your machines — the cloud holds sealed archives it cannot read, listed here by reference. Deleting one removes the stored copy; if your machine already reclaimed the source, this is the last copy.</p>
       <p class="msg" id="s-msg">Loading…</p>
       <div id="s-wrap" style="display:none;overflow-x:auto">
         <table>
-          <thead><tr><th>Ref</th><th>Size</th><th>State</th><th>Added</th><th></th></tr></thead>
+          <thead><tr><th>Archive</th><th>Contents</th><th>State</th><th>Added</th><th></th></tr></thead>
           <tbody id="s-body"></tbody>
         </table>
         <p class="msg" id="s-foot"></p>
       </div>
     </div>
 
-    <div class="card">
+    <div class="card" id="c-plan">
       <span class="eyebrow">Plan</span>
       <div id="a-plan-free" style="display:none">
         <h3>Free — your bucket, your bill</h3>
@@ -658,6 +692,25 @@ sealkeep open 08424eb6… ./session.jsonl \
       <p class="why">Either way we hold no key that opens an archive. The difference is only who pays the storage bill and who can delete the bucket.</p>
     </div>
 
+    <div class="card" id="c-targets">
+      <span class="eyebrow">Routing</span>
+      <h3>Where new archives go</h3>
+      <p>Rules live on your account, so every machine of the vault follows the same ones. Lowest priority number wins; a project pinned to a target always goes there; a target at its cap passes to the next. Managed cloud is the fallback when nothing else claims an archive.</p>
+      <p class="msg" id="tg-msg">Loading…</p>
+      <div id="tg-wrap" style="display:none;overflow-x:auto">
+        <table>
+          <thead><tr><th>Target</th><th>Where</th><th>Priority</th><th>Cap (GB)</th><th>Only these projects</th><th></th></tr></thead>
+          <tbody id="tg-body"></tbody>
+        </table>
+      </div>
+      <div class="inline" style="margin-top:.9rem">
+        <button class="ghost" id="tg-add-drive" type="button">Add Google Drive</button>
+        <button class="primary" id="tg-save" type="button">Save routing</button>
+        <span class="saved" id="tg-save-msg" role="status" aria-live="polite"></span>
+      </div>
+      <p class="why" id="tg-note">Drive holds single objects and skips streaming; big under-pressure seals route to cloud or a bucket on their own. Adding Drive here sets the rule — the one-time consent happens on your machine: <code>sealkeep storage connect gdrive</code>.</p>
+    </div>
+
     <div class="card">
       <span class="eyebrow">Machines</span>
       <p>Each connected machine signs its own uploads. Revoking one stops it writing here; the archives it already stored are untouched.</p>
@@ -924,6 +977,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     $("a-name").value = user.label || "";
     $("a-plan").textContent = paid ? "Managed storage" : "Free";
     $("a-plan").className = "chip" + (paid ? " pro" : "");
+    $("a-plan").onclick = () => $("c-plan").scrollIntoView({ behavior: "smooth", block: "start" });
     $("a-who").textContent = [
       user.email,
       "joined " + day(user.created_at),
@@ -1095,6 +1149,109 @@ sealkeep open 08424eb6… ./session.jsonl \
     }
   }
 
+  // Managed chunk folders arrive as one row per stored object —
+  // <archive>.chunk-000001 … plus <archive>.envelope.vlmeta. A listing is
+  // about archives, so fold each family into one row: the archive id, the
+  // summed chunk bytes, and durable only when every member is durable.
+  // Mirrors collapseCloudRows in the CLI, so both surfaces tell one story.
+  const FAMILY_REF = /^(.+)\.(chunk-\d{6}|envelope\.vlmeta)$/;
+  function foldFamilies(rows) {
+    const families = new Map();
+    const plain = [];
+    for (const row of rows) {
+      const match = FAMILY_REF.exec(String(row.vault_ref));
+      if (!match) { plain.push(row); continue; }
+      const fam = families.get(match[1]) ?? { rows: [], chunkBytes: 0, chunks: 0, members: [], allDurable: true };
+      fam.rows.push(row);
+      fam.members.push(row.vault_ref);
+      if (match[2].startsWith("chunk-")) { fam.chunkBytes += Number(row.bytes) || 0; fam.chunks++; }
+      if (row.state !== "durable") fam.allDurable = false;
+      families.set(match[1], fam);
+    }
+    const folded = [...families.entries()].map(([id, fam]) => ({
+      ...fam.rows[0], vault_ref: id, bytes: fam.chunkBytes, chunked: true,
+      chunkCount: fam.chunks, members: fam.members, state: fam.allDurable ? "durable" : "pending"
+    }));
+    return [...plain, ...folded];
+  }
+
+  /* ------------------------------------------------ routing (storage targets) */
+  // The same rules the CLI syncs: GET/PUT /v1/cloud/storage-targets carries
+  // {targets_json} — a JSON string of [{id, provider, bucket, prefix, maxGb,
+  // projects, priority}]. Editing here lands on every machine of the vault,
+  // because resolveTargets is cloud-first.
+  let targetRows = [];
+  const providerLabel = (p) => ({ vaultline: "Sealkeep cloud", gdrive: "Google Drive", r2: "Cloudflare R2", s3: "S3", gcs: "Google Cloud" }[p] || p);
+  function renderTargets() {
+    const body = $("tg-body");
+    body.replaceChildren();
+    if (!targetRows.length) {
+      $("tg-msg").className = "empty";
+      $("tg-msg").textContent = "No rules yet — everything goes to Sealkeep cloud. Add your Drive or set rules from a machine: sealkeep storage targets add …";
+      $("tg-wrap").style.display = "none";
+      return;
+    }
+    $("tg-msg").textContent = "";
+    for (const t of targetRows) {
+      const tr = document.createElement("tr");
+      const name = document.createElement("td"); name.textContent = providerLabel(t.provider);
+      const where = document.createElement("td");
+      const wc = document.createElement("code"); wc.textContent = t.provider === "vaultline" ? "managed" : [t.bucket, t.prefix].filter(Boolean).join("/") || "—"; where.append(wc);
+      const pr = document.createElement("td");
+      const prIn = document.createElement("input"); prIn.type = "number"; prIn.className = "n"; prIn.min = "0"; prIn.max = "99";
+      prIn.value = t.priority ?? (t.provider === "vaultline" ? 0 : 10);
+      prIn.setAttribute("aria-label", "Priority for " + providerLabel(t.provider));
+      prIn.addEventListener("input", () => { t.priority = Number(prIn.value); });
+      pr.append(prIn);
+      const cap = document.createElement("td");
+      const capIn = document.createElement("input"); capIn.type = "number"; capIn.className = "n"; capIn.min = "1"; capIn.max = "99999"; capIn.placeholder = "none";
+      if (t.maxGb) capIn.value = t.maxGb;
+      capIn.setAttribute("aria-label", "Cap in GB for " + providerLabel(t.provider));
+      capIn.addEventListener("input", () => { t.maxGb = capIn.value ? Number(capIn.value) : undefined; });
+      cap.append(capIn);
+      const proj = document.createElement("td");
+      const projIn = document.createElement("input"); projIn.placeholder = "all projects"; projIn.style.minWidth = "9rem";
+      projIn.value = (t.projects || []).join(", ");
+      projIn.setAttribute("aria-label", "Projects pinned to " + providerLabel(t.provider));
+      projIn.addEventListener("input", () => {
+        const list = projIn.value.split(",").map((x) => x.trim()).filter(Boolean);
+        if (list.length) t.projects = list; else delete t.projects;
+      });
+      proj.append(projIn);
+      const act = document.createElement("td");
+      const rm = document.createElement("button"); rm.className = "del"; rm.type = "button"; rm.textContent = "Remove";
+      rm.addEventListener("click", () => { targetRows = targetRows.filter((x) => x !== t); renderTargets(); });
+      act.append(rm);
+      tr.append(name, where, pr, cap, proj, act);
+      body.append(tr);
+    }
+    $("tg-wrap").style.display = "";
+  }
+  async function loadTargets(token) {
+    try {
+      const data = await api("/v1/cloud/storage-targets", { token });
+      try { targetRows = JSON.parse(data.targets_json || "[]"); } catch { targetRows = []; }
+      if (!Array.isArray(targetRows)) targetRows = [];
+      renderTargets();
+    } catch (error) { say("tg-msg", errText(error), "err"); }
+  }
+  $("tg-add-drive").addEventListener("click", () => {
+    if (targetRows.some((t) => t.provider === "gdrive")) { say("tg-save-msg", "Drive is already in the rules."); return; }
+    targetRows.push({ id: "gdrive-" + Math.random().toString(36).slice(2, 8), provider: "gdrive", bucket: "Sealkeep", maxGb: 50, priority: 10 });
+    renderTargets();
+    say("tg-save-msg", "Added — save, then run the one-time consent on your machine.");
+  });
+  $("tg-save").addEventListener("click", async () => {
+    const token = sessionStorage.getItem(TOKEN);
+    if (!token) { say("tg-save-msg", "Sign in again to save.", "err"); return; }
+    $("tg-save").disabled = true;
+    try {
+      await api("/v1/cloud/storage-targets", { method: "PUT", token, body: { targets_json: JSON.stringify(targetRows) } });
+      say("tg-save-msg", "Saved. Every machine follows these on its next seal.");
+    } catch (error) { say("tg-save-msg", errText(error), "err"); }
+    $("tg-save").disabled = false;
+  });
+
   async function loadStorage(token) {
     try {
       const rows = await api("/v1/cloud/archives", { token });
@@ -1112,12 +1269,13 @@ sealkeep open 08424eb6… ./session.jsonl \
       }
       on("s-intro", true);
 
-      for (const r of rows) {
+      for (const r of foldFamilies(rows)) {
         const tr = document.createElement("tr");
         // textContent throughout: an archive ref is data, never markup.
         const ref = document.createElement("td");
         const code = document.createElement("code"); code.textContent = String(r.vault_ref).slice(0, 8); ref.append(code);
-        const size = document.createElement("td"); size.textContent = bytes(r.bytes);
+        const size = document.createElement("td");
+        size.textContent = r.chunked ? bytes(r.bytes) + " in " + r.chunkCount + " sealed chunks" : bytes(r.bytes);
         const st = document.createElement("td");
         const s = document.createElement("span");
         s.className = "state " + (r.state === "durable" ? "durable" : "pending");
@@ -1137,7 +1295,14 @@ sealkeep open 08424eb6… ./session.jsonl \
           }
           btn.disabled = true; btn.textContent = "Deleting";
           try {
-            await api("/v1/cloud/archives/" + encodeURIComponent(r.vault_ref), { method: "DELETE", token });
+            // A chunked archive is many stored objects; removing it means
+            // removing every member, envelope last so a crash leaves an
+            // openable family rather than an orphaned envelope.
+            const refs = r.members ? [...r.members].sort((a, b) => a.endsWith(".envelope.vlmeta") ? 1 : b.endsWith(".envelope.vlmeta") ? -1 : 0) : [r.vault_ref];
+            for (let i = 0; i < refs.length; i++) {
+              if (refs.length > 1) btn.textContent = "Deleting " + (i + 1) + "/" + refs.length;
+              await api("/v1/cloud/archives/" + encodeURIComponent(refs[i]), { method: "DELETE", token });
+            }
             await loadAccount(token);
           } catch (error) { say("s-msg", errText(error), "err"); btn.disabled = false; btn.textContent = "Delete"; }
         });
@@ -1163,6 +1328,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     renderAccount(user);
     // Each section fails on its own. One dead panel must not blank the rest.
     if (user.plan === "pro") { $("a-count").textContent = "—"; loadStorage(token); }
+    loadTargets(token);
     loadAudit(token);
     loadStorage2(token);
     const devices = await loadDevices(token);

package/dist/src/local-api.js

@@ -645,11 +645,19 @@ async function cloudPlanAndQuota(dataDir) {
     const { account, source } = await resolveAccount(dataDir);
     return { plan: account.plan, quota: account.quota, email: account.email, source };
 }
-/** The account panel lives at the cloud API's origin with `/api` swapped for `#account`. */
+/**
+ * The account panel lives on the product domain, which is no longer the API's
+ * origin — deriving it from the cloud URL sent people to the old address after
+ * the rename. A self-hosted plane (VAULTLINE_CLOUD_URL set) still derives from
+ * its own origin, because there is no sealkeep.spala.ai panel for it.
+ */
 async function panelUrl() {
-    const { DEFAULT_CLOUD_URL } = await import("./cloud.js");
-    const origin = (process.env.VAULTLINE_CLOUD_URL ?? DEFAULT_CLOUD_URL).replace(/\/+$/, "").replace(/\/api$/, "");
-    return `${origin}/#account`;
+    if (process.env.VAULTLINE_CLOUD_URL) {
+        const origin = process.env.VAULTLINE_CLOUD_URL.replace(/\/+$/, "").replace(/\/api$/, "");
+        return `${origin}/#account`;
+    }
+    const { PRODUCT_URL } = await import("./branding.js");
+    return `${PRODUCT_URL}/#account`;
 }
 /**
  * Everything the settings screen shows about the account, and none of it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",