sealkeep 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.6.2 — 2026-08-20
+
+- New: `sealkeep projects` lists the project names this vault knows, with how
+  many archives and how much history each holds. Routing rules can pin a
+  project to a destination, but the account panel cannot offer a list — project
+  names never reach us — so the machine that does know them prints the exact
+  strings to paste.
+- The panel's pinning field says what a project is, where to find its name, and
+  what happens to sessions that recorded none, instead of an empty box.
+
+## 0.6.1 — 2026-08-19
+
+- Reading an offloaded archive now checks for free space first. An index build
+  reads each archive in full, and on a machine already short of space that
+  filled the disk and died mid-build — the failure this product exists to
+  prevent. It refuses in words that name the archive and the shortfall, keeps a
+  512 MB reserve, and lets the build carry on with the rest.
+
 ## 0.6.0 — 2026-08-19
 
 **A second machine no longer wipes your search index.** The content index is

package/dist/site/index.html

@@ -59,7 +59,9 @@
   nav{display:flex;align-items:center;gap:1.4rem;padding:1.5rem 0;font-size:.86rem}
   nav .logo{font-weight:750;letter-spacing:-.03em;font-size:1rem}
   nav .sp{flex:1}
-  nav a{color:var(--soft);text-decoration:none}
+  /* A finger needs 24px; these were 22px of bare line-height. Padding buys the
+     height without moving the row, since the nav is already flex-aligned. */
+  nav a{color:var(--soft);text-decoration:none;display:inline-flex;align-items:center;min-height:26px;padding:.15rem .1rem}
   nav a:hover{color:var(--ink)}
 
   /* ------------------------------------------------------------- the spine
@@ -179,7 +181,7 @@
      keyboard and be left without a ring — and a ring drawn on arrival would
      compete with the one card that is meant to be asking for attention. */
   .ph:focus,.ph:focus-visible{outline:none}
-  .chip{font-family:var(--mono);font-size:.7rem;border:1px solid var(--rule);border-radius:3px;
+  .chip{font-family:var(--mono);font-size:.7rem;min-height:26px;display:inline-flex;align-items:center;border:1px solid var(--rule);border-radius:3px;
     color:var(--soft);padding:.2rem .55rem}
   .chip.pro{border-color:var(--live);color:var(--live);font-weight:600}
   .card{background:var(--card);border:1px solid var(--rule);border-radius:4px;padding:1.35rem;margin-bottom:.9rem}
@@ -198,7 +200,7 @@
   .kv .cap{display:block;font-size:.78rem;color:var(--soft);margin-top:.25rem}
   .kv .k{display:block;font-family:var(--mono);font-size:.72rem;color:var(--soft);margin-bottom:.2rem}
   .kv b{font-family:var(--mono);font-size:1rem;font-weight:500;color:var(--soft);letter-spacing:-.02em}
-  .kv .lead b{font-size:2.2rem;font-weight:700;color:var(--ink);letter-spacing:-.04em;line-height:1.1}
+  .kv .lead b{font-size:clamp(1.55rem,2.1vw,2.2rem);font-weight:700;color:var(--ink);letter-spacing:-.04em;line-height:1.1;white-space:nowrap}
   .bar{height:8px;background:var(--rule);border-radius:4px;margin:1.05rem 0 .4rem;overflow:hidden}
   .bar i{display:block;height:100%;width:0;min-width:6px;background:var(--live);transition:width .5s ease}
 
@@ -212,9 +214,10 @@
   .choice .t,.choice .d{font-family:var(--sans)}
   .cellsub{display:block;font-family:var(--sans);font-size:.75rem;color:var(--soft);margin-top:.15rem}
   .acct-nav{display:flex;gap:.35rem;flex-wrap:wrap;position:sticky;top:0;z-index:5;background:var(--paper);padding:.65rem 0;margin:.4rem 0 .2rem;border-bottom:1px solid var(--rule)}
-  .acct-nav a{font-family:var(--mono);font-size:.74rem;color:var(--soft);text-decoration:none;border:1px solid var(--rule);border-radius:999px;padding:.28rem .8rem}
+  .acct-nav a{font-family:var(--mono);font-size:.74rem;color:var(--soft);text-decoration:none;border:1px solid var(--rule);border-radius:999px;padding:.4rem .85rem;min-height:26px;display:inline-flex;align-items:center}
   .acct-nav a:hover{color:var(--ink);border-color:var(--ink)}
   .acct-hero{font-family:var(--mono);font-size:1.55rem;font-weight:700;letter-spacing:-.03em;margin:.9rem 0 0;line-height:1.3}
+  h1.acct-hero:empty{display:none}
   .ruleslist{margin:.3rem 0 .9rem;padding-left:1.1rem}
   .ruleslist li{margin:.25rem 0;color:var(--soft)}
   .ruleslist b{color:var(--ink);font-weight:600}
@@ -229,7 +232,7 @@
   .packchip span{font-size:.78rem;color:var(--soft)}
   .packchip.now{border-color:var(--live)}
   .packchip.now i{font-style:normal;font-family:var(--mono);font-size:.66rem;color:var(--live);letter-spacing:.03em}
-  #p-account .card h3{font-size:1.02rem;margin:.15rem 0 .5rem}
+  #p-account .card h2{font-size:1.02rem;margin:.15rem 0 .5rem}
   [id^="anchor-"]{scroll-margin-top:3.4rem}
   .state.durable{color:var(--live)}
   .state.pending{color:var(--soft);opacity:.75}
@@ -584,7 +587,7 @@ sealkeep open 08424eb6… ./session.jsonl \
       <button class="chip" id="a-plan" type="button" title="See your plan">—</button>
       <span class="who" id="a-who">—</span>
     </div>
-    <p class="acct-hero" id="a-hero"></p>
+    <h1 class="acct-hero" id="a-hero"></h1>
     <p class="msg" id="a-summary" style="margin:.4rem 0 0"></p>
     <nav class="acct-nav" aria-label="Account sections">
       <a href="#anchor-storage">Storage</a>
@@ -597,7 +600,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card next" id="a-firstrun" style="display:none">
       <span class="eyebrow">Set up</span>
-      <h3 class="lead">Connect your first machine</h3>
+      <h2 class="lead">Connect your first machine</h2>
       <p>Sealkeep runs on your machine — that is where your keys are made and where every session is sealed before it moves. Pair one machine and archiving carries on by itself.</p>
       <div id="pair-home-first"></div>
     </div>
@@ -611,12 +614,12 @@ sealkeep open 08424eb6… ./session.jsonl \
     <div class="card" id="anchor-storage">
       <span class="eyebrow">Storage</span>
       <div id="a-store-free" style="display:none">
-        <h3>You run the bucket</h3>
+        <h2>You run the bucket</h2>
         <p>Archives go to storage you own, under your own credentials. Sealkeep never holds them, so there is nothing to meter here.</p>
         <p class="empty">Your machine reports what it has stored. Run <code>sealkeep status</code> to see it.</p>
       </div>
       <div id="a-store-paid" style="display:none">
-        <h3>What you keep here</h3>
+        <h2>What you keep here</h2>
         <div class="kv">
           <div class="lead"><span class="k">Stored</span><b id="a-used">—</b><span class="cap" id="a-used-cap">sealed before it arrived</span></div>
           <div><span class="k">Included</span><b id="a-quota-b">—</b><span class="cap">in your plan</span></div>
@@ -631,7 +634,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="c-targets"><span id="anchor-routing"></span>
       <span class="eyebrow">Routing</span>
-      <h3>Where new archives go</h3>
+      <h2>Where new archives go</h2>
       <p>Rules live on your account — every machine of the vault follows the same ones.</p>
       <ul class="ruleslist">
         <li><b>Lowest priority number wins.</b></li>
@@ -641,7 +644,7 @@ sealkeep open 08424eb6… ./session.jsonl \
       <p class="msg" id="tg-msg">Loading…</p>
       <div id="tg-wrap" style="display:none;overflow-x:auto">
         <table>
-          <thead><tr><th>Target</th><th>Where</th><th>Priority</th><th>Cap (GB)</th><th>Only these projects</th><th></th></tr></thead>
+          <thead><tr><th>Target</th><th>Where</th><th>Priority</th><th>Cap (GB)</th><th>Pinned projects</th><th></th></tr></thead>
           <tbody id="tg-body"></tbody>
         </table>
       </div>
@@ -651,12 +654,13 @@ sealkeep open 08424eb6… ./session.jsonl \
         <button class="primary" id="tg-save" type="button">Save routing</button>
         <span class="saved" id="tg-save-msg" role="status" aria-live="polite"></span>
       </div>
-      <p class="why" id="tg-note">Drive holds single objects and skips streaming; big under-pressure seals route to cloud or a bucket on their own. Adding Drive here sets the rule — the one-time consent happens on your machine: <code>sealkeep storage connect gdrive</code>.</p>
+      <p class="why" id="tg-note">A project is the folder a session ran in — <code>sealkeep</code>, <code>big-refactor</code>. Pin one and its sessions always go to that destination. Project names never reach us, which is why this page cannot list them for you: run <code>sealkeep projects</code> on your machine to see the exact names it knows, and paste them here separated by commas. Sessions that recorded no project are matched by no pin, and take the ordinary priority order.</p>
+      <p class="why">Drive holds single objects and skips streaming; big under-pressure seals route to cloud or a bucket on their own. Adding Drive here sets the rule — the one-time consent happens on your machine: <code>sealkeep storage connect gdrive</code>.</p>
     </div>
 
     <div class="card" id="anchor-machines">
       <span class="eyebrow">Machines</span>
-      <h3>Connected machines</h3>
+      <h2>Connected machines</h2>
       <p>Each connected machine signs its own uploads. Revoking one stops it writing here; the archives it already stored are untouched.</p>
       <ul class="lines" id="d-list"></ul>
       <p class="empty" id="d-msg">Loading…</p>
@@ -691,7 +695,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="anchor-archives" style="display:none">
       <span class="eyebrow">Archives</span>
-      <h3>What is stored</h3>
+      <h2>What is stored</h2>
       <p id="s-intro">Names live on your machines — your storage holds sealed archives it cannot read, listed here by reference. Deleting one removes the stored copy; if your machine already reclaimed the source, this is the last copy.</p>
       <p class="msg" id="s-msg">Loading…</p>
       <div id="s-wrap" style="display:none;overflow-x:auto">
@@ -706,12 +710,12 @@ sealkeep open 08424eb6… ./session.jsonl \
     <div class="card" id="c-plan"><span id="anchor-plan"></span>
       <span class="eyebrow">Plan</span>
       <div id="a-plan-free" style="display:none">
-        <h3>Free — your bucket, your bill</h3>
+        <h2>Free — your bucket, your bill</h2>
         <p>Unlimited archives with the same encryption. You supply the storage credentials and pay your provider directly.</p>
         <p class="empty">Want us to run storage instead? Pricing is in Your package, below. Write to <span id="a-sales">hello@spala.ai</span> from this address and we will switch it on.</p>
       </div>
       <div id="a-plan-paid" style="display:none">
-        <h3>Managed storage</h3>
+        <h2>Managed storage</h2>
         <p>We run the bucket and meter what you store. We still hold no key that opens any of it — the only difference from your own bucket is who pays the storage bill and who can delete it.</p>
         <div class="kv" style="margin-top:1rem">
           <div><span class="k">Subscription</span><b id="a-sub-state">—</b></div>
@@ -724,7 +728,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="a-pack-card">
       <span class="eyebrow">Your package</span>
-      <h3 id="a-pack-current">—</h3>
+      <h2 id="a-pack-current">—</h2>
       <p class="msg" id="a-pack-context" style="margin:0 0 .8rem"></p>
       <div class="packrow" id="a-packs"></div>
       <p class="empty" id="a-pack-alt">Not storing with us? Your own bucket is free with the same encryption, and Pro Lite keeps key escrow and machine sign-in with no metered storage.</p>
@@ -733,7 +737,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card">
     <span class="eyebrow">What leaves this machine</span>
-    <h3>Your upload rules</h3>
+    <h2>Your upload rules</h2>
     <p>Everything you do not choose here stays local and is never uploaded.</p>
     <p class="empty" id="r-note" style="margin-bottom:.9rem">Enforced on your machine, before a session is read or sealed. Anything held back is never uploaded, so this is a rule about what leaves — not a filter we apply after it arrives.</p>
     <div class="rules">
@@ -762,13 +766,13 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="c-recovery"><span id="anchor-recovery"></span>
       <span class="eyebrow">Recovery key</span>
-      <h3 id="e-head">Loading…</h3>
+      <h2 id="e-head">Loading…</h2>
       <p id="e-text"></p>
     </div>
 
     <div class="card">
       <span class="eyebrow">Activity</span>
-      <h3>What happened lately</h3>
+      <h2>What happened lately</h2>
       <p>Every change made to this account, newest first.</p>
       <ul class="lines" id="v-list"></ul>
       <p class="empty" id="v-msg">Loading…</p>
@@ -776,7 +780,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card">
       <span class="eyebrow">Account</span>
-      <h3>Name and email</h3>
+      <h2>Name and email</h2>
       <label for="a-name">Account name</label>
       <div class="inline">
         <input id="a-name" maxlength="60" autocomplete="off">
@@ -1313,7 +1317,7 @@ sealkeep open 08424eb6… ./session.jsonl \
       capIn.addEventListener("input", () => { t.maxGb = capIn.value ? Number(capIn.value) : undefined; });
       cap.append(capIn);
       const proj = document.createElement("td");
-      const projIn = document.createElement("input"); projIn.placeholder = "all projects"; projIn.style.minWidth = "9rem";
+      const projIn = document.createElement("input"); projIn.placeholder = "empty = every project"; projIn.style.minWidth = "9rem";
       projIn.value = (t.projects || []).join(", ");
       projIn.setAttribute("aria-label", "Projects pinned to " + providerLabel(t.provider));
       projIn.addEventListener("input", () => {

package/dist/src/cli.js

@@ -202,6 +202,7 @@ function usage() {
             ["scan <path>", "find pasted secrets in transcripts before they are sealed in"],
             ["list", "browse archives"],
             ["search <query>", "search metadata, or contents with --content"],
+            ["projects", "the project names this vault knows — the ones routing rules pin"],
             ["index build", "build the local content index that --content searches"],
             ["index status", "what is searchable and what is not yet indexed"],
             ["storage targets", "several storages at once, with limits, pins, and priority"],
@@ -1003,6 +1004,65 @@ async function main() {
         print(dim("\n  On a package we run the storage and choose the provider. Your own bucket means\n  your provider, your region, your bill. Either way we hold no key that opens an archive.\n"));
         return;
     }
+    if (command === "projects") {
+        // Routing rules can pin a project to a destination, and the panel cannot
+        // offer a list: project names never reach the cloud — that is the point.
+        // So this machine, which does know them, prints the exact strings to paste.
+        const { listArchives } = await import("./vault.js");
+        const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
+        const records = await listArchives(dataDir);
+        const seen = new Map();
+        let unknown = 0;
+        let unknownBytes = 0;
+        for (const record of records) {
+            const agentName = record.source.agent;
+            let project = null;
+            try {
+                if (agentName === "claude")
+                    project = claudeProjectFromPath(record.source.path).project;
+                else if (agentName === "codex")
+                    project = (await codexProjectFromRollout(record.source.path, record.createdAt)).project;
+            }
+            catch {
+                project = null;
+            }
+            if (!project) {
+                unknown += 1;
+                unknownBytes += record.source.bytes ?? 0;
+                continue;
+            }
+            const entry = seen.get(project) ?? { archives: 0, bytes: 0, agent: agentName };
+            entry.archives += 1;
+            entry.bytes += record.source.bytes ?? 0;
+            seen.set(project, entry);
+        }
+        const rows = [...seen.entries()].sort((a, b) => b[1].bytes - a[1].bytes);
+        if (json) {
+            print(JSON.stringify({
+                projects: rows.map(([name, v]) => ({ name, archives: v.archives, bytes: v.bytes, agent: v.agent })),
+                withoutProject: { archives: unknown, bytes: unknownBytes }
+            }, null, 2));
+            return;
+        }
+        print(`\n${bold("Projects in this vault")}\n${dim("─".repeat(30))}`);
+        if (rows.length === 0) {
+            print(`\n  ${dim("None of the archived sessions recorded a project.")}`);
+            print(`  ${dim("Codex records one only when the session wrote its working directory;")}`);
+            print(`  ${dim("Claude Code always does. Until a session carries one, a project pin")}`);
+            print(`  ${dim("in your routing rules matches nothing — leave that field empty.")}\n`);
+            return;
+        }
+        print(table(rows, [
+            { header: "project", get: ([name]) => name },
+            { header: "archives", get: ([, v]) => String(v.archives), align: "right" },
+            { header: "size", get: ([, v]) => bytes(v.bytes), align: "right" },
+            { header: "agent", get: ([, v]) => dim(v.agent) }
+        ], "no project recorded yet"));
+        if (unknown > 0)
+            print(`\n  ${dim(`${unknown} archive${unknown === 1 ? "" : "s"} recorded no project (${bytes(unknownBytes)}).`)}`);
+        print(`\n  ${dim("Paste a name into \"Only these projects\" in the account panel to pin it to a destination.")}\n`);
+        return;
+    }
     if (command === "open") {
         const [vaultRef, destination] = positionals(args);
         if (!vaultRef || !destination)

package/dist/src/errors.d.ts

@@ -3,7 +3,7 @@
  * between releases; these codes are a contract for the CLI, local API, and MCP.
  * Details are operational only: never place plaintext, phrases, or keys here.
  */
-export type VaultlineErrorCode = "invalid_argument" | "vault_not_initialized" | "vault_already_initialized" | "config_unsupported_version" | "recovery_phrase_missing" | "recovery_phrase_mismatch" | "archive_not_found" | "source_unreadable" | "destination_exists" | "destination_unwritable" | "path_not_permitted" | "native_restore_unavailable" | "ciphertext_integrity_failed" | "plaintext_integrity_failed" | "hook_payload_invalid" | "queue_job_not_found" | "queue_lease_invalid" | "queue_lease_expired" | "queue_job_exhausted" | "storage_not_configured" | "provider_unsupported" | "signer_not_configured" | "lease_expired" | "unauthorized" | "forbidden" | "internal";
+export type VaultlineErrorCode = "invalid_argument" | "vault_not_initialized" | "vault_already_initialized" | "config_unsupported_version" | "recovery_phrase_missing" | "recovery_phrase_mismatch" | "archive_not_found" | "source_unreadable" | "destination_exists" | "destination_unwritable" | "insufficient_disk_space" | "path_not_permitted" | "native_restore_unavailable" | "ciphertext_integrity_failed" | "plaintext_integrity_failed" | "hook_payload_invalid" | "queue_job_not_found" | "queue_lease_invalid" | "queue_lease_expired" | "queue_job_exhausted" | "storage_not_configured" | "provider_unsupported" | "signer_not_configured" | "lease_expired" | "unauthorized" | "forbidden" | "internal";
 export declare class VaultlineError extends Error {
     readonly code: VaultlineErrorCode;
     readonly details: Record<string, unknown>;

package/dist/src/offload.js

@@ -320,6 +320,19 @@ export async function checkRemoteCopyMany(dataDir, ids, client) {
 export async function materialiseArchive(dataDir, record, client) {
     if (!isV2(record) || !record.offloaded)
         return { path: record.objectPath, release: async () => { } };
+    // Reading an offloaded archive means writing it back to disk in full, and
+    // this runs in a loop during an index build. On a machine that offloaded
+    // BECAUSE it was short of space, that filled the disk and died on ENOSPC
+    // mid-build — the exact failure this product exists to prevent. Ask first,
+    // and refuse in words that name the archive and the shortfall.
+    const { freeBytes } = await import("./disk.js");
+    const free = await freeBytes(tmpdir());
+    const needed = record.cipher.storedBytes ?? record.remote?.bytes ?? 0;
+    const RESERVE = 512 * 1024 * 1024;
+    if (free !== undefined && needed > 0 && free < needed + RESERVE) {
+        const gb = (n) => `${(n / 1024 ** 3).toFixed(1)} GB`;
+        fail("insufficient_disk_space", `Reading archive ${record.id.slice(0, 8)} needs about ${gb(needed)} of temporary space and this machine has ${gb(free)} free. Nothing was written. Free some space, or reclaim what is already archived, and try again.`, { archiveId: record.id, free, needed });
+    }
     const ciphertext = await fetchCiphertext(dataDir, record, client);
     if (sha256(ciphertext) !== record.cipher.ciphertextSha256) {
         fail("ciphertext_integrity_failed", `The copy of archive ${record.id} in ${record.offloaded.bucket} is not the archive that was stored there`, { archiveId: record.id });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",

package/web/index.html

@@ -108,7 +108,7 @@
   </header>
 
   <section id="gate" class="panel gate pad" hidden>
-    <h3>Local token required</h3>
+    <h2>Local token required</h2>
     <p class="note">This browser has not been given its key yet. Paste the token from <code id="token-path">local-api-token</code> in your Sealkeep data folder (<code>~/.sealkeep</code>, or <code>~/.vaultline</code> for older vaults) — a local file, so nothing here is sent anywhere. The browser <code>sealkeep ui</code> opened is signed in already.</p>
     <form id="token-form">
       <input id="token-input" type="password" autocomplete="off" spellcheck="false" placeholder="local API token" aria-label="Local API token">