sealkeep 0.6.1 → 0.7.0

package/CHANGELOG.md

@@ -3,6 +3,37 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.7.0 — 2026-08-20
+
+Two reviews — does each section deserve to exist, and can a person finish the
+job it promises — and the answers, applied.
+
+- **Setup no longer argues for the unrecoverable mistake.** The password path
+  said skipping the recovery phrase was "fine". Your password opens the vault on
+  that machine only; the screen now says so, names the day it matters, and shows
+  the 24 words as what survives it.
+- The account panel leads with the Recovery key card instead of burying it ninth
+  of eleven, merges Plan into Your package (they answered the same question),
+  makes the package tiers actually start a change instead of looking clickable
+  and doing nothing, warns "Delete forever?" with the stake named, puts
+  connecting a machine above the list of machines, and stops calling an
+  account-wide upload rule "what leaves this machine".
+- Revoked machines fold into one line — they are kept as the record, never
+  deleted, but no longer bury the machines that can actually write.
+- `sealkeep doctor` warns when a routing rule pins a project this machine has
+  never sealed. The panel cannot check that — project names never reach us —
+  so the machine that knows does.
+
+## 0.6.2 — 2026-08-20
+
+- New: `sealkeep projects` lists the project names this vault knows, with how
+  many archives and how much history each holds. Routing rules can pin a
+  project to a destination, but the account panel cannot offer a list — project
+  names never reach us — so the machine that does know them prints the exact
+  strings to paste.
+- The panel's pinning field says what a project is, where to find its name, and
+  what happens to sessions that recorded none, instead of an empty box.
+
 ## 0.6.1 — 2026-08-19
 
 - Reading an offloaded archive now checks for free space first. An index build

package/dist/site/index.html

@@ -59,7 +59,9 @@
   nav{display:flex;align-items:center;gap:1.4rem;padding:1.5rem 0;font-size:.86rem}
   nav .logo{font-weight:750;letter-spacing:-.03em;font-size:1rem}
   nav .sp{flex:1}
-  nav a{color:var(--soft);text-decoration:none}
+  /* A finger needs 24px; these were 22px of bare line-height. Padding buys the
+     height without moving the row, since the nav is already flex-aligned. */
+  nav a{color:var(--soft);text-decoration:none;display:inline-flex;align-items:center;min-height:26px;padding:.15rem .1rem}
   nav a:hover{color:var(--ink)}
 
   /* ------------------------------------------------------------- the spine
@@ -179,7 +181,7 @@
      keyboard and be left without a ring — and a ring drawn on arrival would
      compete with the one card that is meant to be asking for attention. */
   .ph:focus,.ph:focus-visible{outline:none}
-  .chip{font-family:var(--mono);font-size:.7rem;border:1px solid var(--rule);border-radius:3px;
+  .chip{font-family:var(--mono);font-size:.7rem;min-height:26px;display:inline-flex;align-items:center;border:1px solid var(--rule);border-radius:3px;
     color:var(--soft);padding:.2rem .55rem}
   .chip.pro{border-color:var(--live);color:var(--live);font-weight:600}
   .card{background:var(--card);border:1px solid var(--rule);border-radius:4px;padding:1.35rem;margin-bottom:.9rem}
@@ -198,7 +200,7 @@
   .kv .cap{display:block;font-size:.78rem;color:var(--soft);margin-top:.25rem}
   .kv .k{display:block;font-family:var(--mono);font-size:.72rem;color:var(--soft);margin-bottom:.2rem}
   .kv b{font-family:var(--mono);font-size:1rem;font-weight:500;color:var(--soft);letter-spacing:-.02em}
-  .kv .lead b{font-size:2.2rem;font-weight:700;color:var(--ink);letter-spacing:-.04em;line-height:1.1}
+  .kv .lead b{font-size:clamp(1.55rem,2.1vw,2.2rem);font-weight:700;color:var(--ink);letter-spacing:-.04em;line-height:1.1;white-space:nowrap}
   .bar{height:8px;background:var(--rule);border-radius:4px;margin:1.05rem 0 .4rem;overflow:hidden}
   .bar i{display:block;height:100%;width:0;min-width:6px;background:var(--live);transition:width .5s ease}
 
@@ -212,9 +214,14 @@
   .choice .t,.choice .d{font-family:var(--sans)}
   .cellsub{display:block;font-family:var(--sans);font-size:.75rem;color:var(--soft);margin-top:.15rem}
   .acct-nav{display:flex;gap:.35rem;flex-wrap:wrap;position:sticky;top:0;z-index:5;background:var(--paper);padding:.65rem 0;margin:.4rem 0 .2rem;border-bottom:1px solid var(--rule)}
-  .acct-nav a{font-family:var(--mono);font-size:.74rem;color:var(--soft);text-decoration:none;border:1px solid var(--rule);border-radius:999px;padding:.28rem .8rem}
+  .acct-nav a{font-family:var(--mono);font-size:.74rem;color:var(--soft);text-decoration:none;border:1px solid var(--rule);border-radius:999px;padding:.4rem .85rem;min-height:26px;display:inline-flex;align-items:center}
   .acct-nav a:hover{color:var(--ink);border-color:var(--ink)}
+  #d-retired details{margin:.5rem 0 .2rem}
+  #d-retired summary{font-family:var(--mono);font-size:.76rem;color:var(--soft);cursor:pointer;padding:.35rem 0}
+  #d-retired summary:hover{color:var(--ink)}
+  #d-retired .lines li{opacity:.75}
   .acct-hero{font-family:var(--mono);font-size:1.55rem;font-weight:700;letter-spacing:-.03em;margin:.9rem 0 0;line-height:1.3}
+  h1.acct-hero:empty{display:none}
   .ruleslist{margin:.3rem 0 .9rem;padding-left:1.1rem}
   .ruleslist li{margin:.25rem 0;color:var(--soft)}
   .ruleslist b{color:var(--ink);font-weight:600}
@@ -229,7 +236,7 @@
   .packchip span{font-size:.78rem;color:var(--soft)}
   .packchip.now{border-color:var(--live)}
   .packchip.now i{font-style:normal;font-family:var(--mono);font-size:.66rem;color:var(--live);letter-spacing:.03em}
-  #p-account .card h3{font-size:1.02rem;margin:.15rem 0 .5rem}
+  #p-account .card h2{font-size:1.02rem;margin:.15rem 0 .5rem}
   [id^="anchor-"]{scroll-margin-top:3.4rem}
   .state.durable{color:var(--live)}
   .state.pending{color:var(--soft);opacity:.75}
@@ -584,7 +591,7 @@ sealkeep open 08424eb6… ./session.jsonl \
       <button class="chip" id="a-plan" type="button" title="See your plan">—</button>
       <span class="who" id="a-who">—</span>
     </div>
-    <p class="acct-hero" id="a-hero"></p>
+    <h1 class="acct-hero" id="a-hero"></h1>
     <p class="msg" id="a-summary" style="margin:.4rem 0 0"></p>
     <nav class="acct-nav" aria-label="Account sections">
       <a href="#anchor-storage">Storage</a>
@@ -597,7 +604,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card next" id="a-firstrun" style="display:none">
       <span class="eyebrow">Set up</span>
-      <h3 class="lead">Connect your first machine</h3>
+      <h2 class="lead">Connect your first machine</h2>
       <p>Sealkeep runs on your machine — that is where your keys are made and where every session is sealed before it moves. Pair one machine and archiving carries on by itself.</p>
       <div id="pair-home-first"></div>
     </div>
@@ -608,15 +615,21 @@ sealkeep open 08424eb6… ./session.jsonl \
       <span class="saved" id="a-verify-msg" role="status" aria-live="polite"></span>
     </div>
 
+<div class="card" id="c-recovery"><span id="anchor-recovery"></span>
+      <span class="eyebrow">Recovery key</span>
+      <h2 id="e-head">Loading…</h2>
+      <p id="e-text"></p>
+    </div>
+
     <div class="card" id="anchor-storage">
       <span class="eyebrow">Storage</span>
       <div id="a-store-free" style="display:none">
-        <h3>You run the bucket</h3>
+        <h2>You run the bucket</h2>
         <p>Archives go to storage you own, under your own credentials. Sealkeep never holds them, so there is nothing to meter here.</p>
         <p class="empty">Your machine reports what it has stored. Run <code>sealkeep status</code> to see it.</p>
       </div>
       <div id="a-store-paid" style="display:none">
-        <h3>What you keep here</h3>
+        <h2>What you keep here</h2>
         <div class="kv">
           <div class="lead"><span class="k">Stored</span><b id="a-used">—</b><span class="cap" id="a-used-cap">sealed before it arrived</span></div>
           <div><span class="k">Included</span><b id="a-quota-b">—</b><span class="cap">in your plan</span></div>
@@ -631,7 +644,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="c-targets"><span id="anchor-routing"></span>
       <span class="eyebrow">Routing</span>
-      <h3>Where new archives go</h3>
+      <h2>Where new archives go</h2>
       <p>Rules live on your account — every machine of the vault follows the same ones.</p>
       <ul class="ruleslist">
         <li><b>Lowest priority number wins.</b></li>
@@ -641,7 +654,7 @@ sealkeep open 08424eb6… ./session.jsonl \
       <p class="msg" id="tg-msg">Loading…</p>
       <div id="tg-wrap" style="display:none;overflow-x:auto">
         <table>
-          <thead><tr><th>Target</th><th>Where</th><th>Priority</th><th>Cap (GB)</th><th>Only these projects</th><th></th></tr></thead>
+          <thead><tr><th>Target</th><th>Where</th><th>Priority</th><th>Cap (GB)</th><th>Pinned projects</th><th></th></tr></thead>
           <tbody id="tg-body"></tbody>
         </table>
       </div>
@@ -651,14 +664,17 @@ sealkeep open 08424eb6… ./session.jsonl \
         <button class="primary" id="tg-save" type="button">Save routing</button>
         <span class="saved" id="tg-save-msg" role="status" aria-live="polite"></span>
       </div>
-      <p class="why" id="tg-note">Drive holds single objects and skips streaming; big under-pressure seals route to cloud or a bucket on their own. Adding Drive here sets the rule — the one-time consent happens on your machine: <code>sealkeep storage connect gdrive</code>.</p>
+      <p class="why" id="tg-note">A project is the folder a session ran in — <code>sealkeep</code>, <code>big-refactor</code>. Pin one and its sessions always go to that destination. Project names never reach us, which is why this page cannot list them for you: run <code>sealkeep projects</code> on your machine to see the exact names it knows, and paste them here separated by commas. Sessions that recorded no project are matched by no pin, and take the ordinary priority order.</p>
+      <p class="why">Drive holds single objects and skips streaming; big under-pressure seals route to cloud or a bucket on their own. Adding Drive here sets the rule — the one-time consent happens on your machine: <code>sealkeep storage connect gdrive</code>.</p>
     </div>
 
     <div class="card" id="anchor-machines">
       <span class="eyebrow">Machines</span>
-      <h3>Connected machines</h3>
+      <h2>Connected machines</h2>
       <p>Each connected machine signs its own uploads. Revoking one stops it writing here; the archives it already stored are untouched.</p>
+      <div id="pair-top"></div>
       <ul class="lines" id="d-list"></ul>
+      <div id="d-retired"></div>
       <p class="empty" id="d-msg">Loading…</p>
 
       <!-- One pairing block exists on the page. It leads the panel while no
@@ -691,49 +707,41 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card" id="anchor-archives" style="display:none">
       <span class="eyebrow">Archives</span>
-      <h3>What is stored</h3>
+      <h2>What is stored</h2>
       <p id="s-intro">Names live on your machines — your storage holds sealed archives it cannot read, listed here by reference. Deleting one removes the stored copy; if your machine already reclaimed the source, this is the last copy.</p>
       <p class="msg" id="s-msg">Loading…</p>
       <div id="s-wrap" style="display:none;overflow-x:auto">
         <table>
-          <thead><tr><th>Archive</th><th>Contents</th><th>State</th><th>Added</th><th></th></tr></thead>
+          <thead><tr><th>Archive</th><th>Size</th><th>State</th><th>Added</th><th></th></tr></thead>
           <tbody id="s-body"></tbody>
         </table>
         <p class="msg" id="s-foot"></p>
       </div>
     </div>
 
-    <div class="card" id="c-plan"><span id="anchor-plan"></span>
-      <span class="eyebrow">Plan</span>
-      <div id="a-plan-free" style="display:none">
-        <h3>Free — your bucket, your bill</h3>
-        <p>Unlimited archives with the same encryption. You supply the storage credentials and pay your provider directly.</p>
-        <p class="empty">Want us to run storage instead? Pricing is in Your package, below. Write to <span id="a-sales">hello@spala.ai</span> from this address and we will switch it on.</p>
-      </div>
-      <div id="a-plan-paid" style="display:none">
-        <h3>Managed storage</h3>
-        <p>We run the bucket and meter what you store. We still hold no key that opens any of it — the only difference from your own bucket is who pays the storage bill and who can delete it.</p>
-        <div class="kv" style="margin-top:1rem">
-          <div><span class="k">Subscription</span><b id="a-sub-state">—</b></div>
-          <div><span class="k">Renews</span><b id="a-sub-end">—</b></div>
-          <div><span class="k">Billed through</span><b id="a-sub-prov">—</b></div>
-        </div>
-        <p class="empty" id="a-sub-note"></p>
-      </div>
-    </div>
+    
 
     <div class="card" id="a-pack-card">
+      <span id="anchor-plan"></span>
       <span class="eyebrow">Your package</span>
-      <h3 id="a-pack-current">—</h3>
+      <h2 id="a-pack-current">—</h2>
       <p class="msg" id="a-pack-context" style="margin:0 0 .8rem"></p>
       <div class="packrow" id="a-packs"></div>
+      <p class="empty" id="a-plan-free-note"></p>
       <p class="empty" id="a-pack-alt">Not storing with us? Your own bucket is free with the same encryption, and Pro Lite keeps key escrow and machine sign-in with no metered storage.</p>
+        <div class="kv" id="a-sub-facts" style="margin-top:1rem">
+          <div><span class="k">Subscription</span><b id="a-sub-state">—</b></div>
+          <div><span class="k">Renews</span><b id="a-sub-end">—</b></div>
+          <div><span class="k">Billed through</span><b id="a-sub-prov">—</b></div>
+        </div>
+        <p class="empty" id="a-sub-note"></p>
       <p class="why" id="a-pack-note">Changing your package is handled by hand today. Email hello@spala.ai from this address and we will move you within one business day — your archives keep uploading throughout.</p>
     </div>
 
     <div class="card">
-    <span class="eyebrow">What leaves this machine</span>
-    <h3>Your upload rules</h3>
+    <span class="eyebrow">What gets uploaded</span>
+    <h2>Your upload rules</h2>
+    <p class="msg" style="margin:.1rem 0 .6rem">Saved to your account — every machine you connect follows these, the same way routing rules do.</p>
     <p>Everything you do not choose here stays local and is never uploaded.</p>
     <p class="empty" id="r-note" style="margin-bottom:.9rem">Enforced on your machine, before a session is read or sealed. Anything held back is never uploaded, so this is a rule about what leaves — not a filter we apply after it arrives.</p>
     <div class="rules">
@@ -760,15 +768,11 @@ sealkeep open 08424eb6… ./session.jsonl \
     </div>
     </div>
 
-    <div class="card" id="c-recovery"><span id="anchor-recovery"></span>
-      <span class="eyebrow">Recovery key</span>
-      <h3 id="e-head">Loading…</h3>
-      <p id="e-text"></p>
-    </div>
+    
 
     <div class="card">
       <span class="eyebrow">Activity</span>
-      <h3>What happened lately</h3>
+      <h2>What happened lately</h2>
       <p>Every change made to this account, newest first.</p>
       <ul class="lines" id="v-list"></ul>
       <p class="empty" id="v-msg">Loading…</p>
@@ -776,7 +780,7 @@ sealkeep open 08424eb6… ./session.jsonl \
 
     <div class="card">
       <span class="eyebrow">Account</span>
-      <h3>Name and email</h3>
+      <h2>Name and email</h2>
       <label for="a-name">Account name</label>
       <div class="inline">
         <input id="a-name" maxlength="60" autocomplete="off">
@@ -1047,7 +1051,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     $("a-name").value = user.label || "";
     $("a-plan").textContent = paid ? "Managed storage" : "Free";
     $("a-plan").className = "chip" + (paid ? " pro" : "");
-    $("a-plan").onclick = () => goTo($("c-plan"));
+    $("a-plan").onclick = () => goTo($("anchor-plan"));
     $("a-who").textContent = [
       user.email,
       "joined " + day(user.created_at),
@@ -1065,8 +1069,13 @@ sealkeep open 08424eb6… ./session.jsonl \
     lastPaid = paid;
     applyStorageView();
     on("anchor-archives", paid); on("nav-archives", paid);
-    on("a-plan-free", !paid);
-    on("a-plan-paid", paid);
+    // One card carries billing now. A free account is told what managed
+    // storage would give it; a paying one is told the state of what it bought.
+    $("a-plan-free-note").textContent = paid
+      ? ""
+      : "You are on your own storage: unlimited archives, same encryption, your provider's bill. Managed storage means we run the bucket and meter what you store — we still hold no key that opens any of it.";
+    on("a-sub-facts", paid);
+    on("a-plan-free-note", !paid);
 
     if (paid) {
       const quota = Number(user.quota_bytes) || 0, used = Number(user.used_bytes) || 0;
@@ -1113,7 +1122,37 @@ sealkeep open 08424eb6… ./session.jsonl \
         return deviceCount;
       }
       $("d-msg").textContent = "";
-      for (const d of devices) {
+      // Revocation never deletes a machine — the row stays as the record that
+      // it once had access. On an account that has re-paired a few times that
+      // buries the two machines actually running under a wall of history: 29
+      // rows, 1666 px, nearly two screens, all looking alike. Active machines
+      // are the answer to "what can write to my account right now"; the rest
+      // fold away, counted and reachable, deleted by nobody.
+      const active = devices.filter((d) => d.state !== "revoked");
+      const retired = devices.filter((d) => d.state === "revoked");
+      const foldHost = $("d-retired");
+      foldHost.replaceChildren();
+      if (retired.length) {
+        const fold = document.createElement("details");
+        const summary = document.createElement("summary");
+        summary.textContent = `${retired.length} revoked machine${retired.length === 1 ? "" : "s"} — kept as the record, none can write`;
+        const inner = document.createElement("ul");
+        inner.className = "lines";
+        for (const d of retired) {
+          const li = document.createElement("li");
+          const name = document.createElement("span");
+          name.className = "grow";
+          name.textContent = d.label || "Unnamed machine";
+          const when = document.createElement("span");
+          when.className = "when";
+          when.textContent = "revoked " + ago(d.revoked_at);
+          li.append(name, when);
+          inner.append(li);
+        }
+        fold.append(summary, inner);
+        foldHost.append(fold);
+      }
+      for (const d of active) {
         const li = document.createElement("li");
         const name = document.createElement("span");
         name.className = "grow";
@@ -1134,7 +1173,13 @@ sealkeep open 08424eb6… ./session.jsonl \
             // Two-step, like archive deletion: revoking locks a machine out of
             // its own backups, so a stray click must not do it.
             if (btn.dataset.armed !== "yes") {
-              btn.dataset.armed = "yes"; btn.textContent = "Confirm";
+              btn.dataset.armed = "yes";
+            // The local dashboard escalates to "Destroy forever?" when it can
+            // prove a copy is the last one. This page cannot see the customer's
+            // disk, so it must not claim either way — it names the stake and
+            // lets them decide.
+            btn.textContent = "Delete forever?";
+            btn.title = "If your machine already reclaimed the source, this is the only copy";
               setTimeout(() => {
                 if (btn.dataset.armed === "yes") { btn.dataset.armed = "no"; btn.textContent = "Revoke"; }
               }, 4000);
@@ -1313,7 +1358,7 @@ sealkeep open 08424eb6… ./session.jsonl \
       capIn.addEventListener("input", () => { t.maxGb = capIn.value ? Number(capIn.value) : undefined; });
       cap.append(capIn);
       const proj = document.createElement("td");
-      const projIn = document.createElement("input"); projIn.placeholder = "all projects"; projIn.style.minWidth = "9rem";
+      const projIn = document.createElement("input"); projIn.placeholder = "empty = every project"; projIn.style.minWidth = "9rem";
       projIn.value = (t.projects || []).join(", ");
       projIn.setAttribute("aria-label", "Projects pinned to " + providerLabel(t.provider));
       projIn.addEventListener("input", () => {
@@ -1485,7 +1530,7 @@ sealkeep open 08424eb6… ./session.jsonl \
          : paidPlan ? "Sealkeep cloud" : "the bucket each machine is configured with");
     const nothingYet = devices === 0 && Number(user.used_bytes) === 0;
     on("a-firstrun", nothingYet);
-    $(nothingYet ? "pair-home-first" : "pair-home-more").append($("pair"));
+    $(nothingYet ? "pair-home-first" : "pair-top").append($("pair"));
     $("pair-side").textContent = nothingYet ? "Your pairing code" : "Pairing code";
     if (devices === 0)
       $("d-msg").textContent = nothingYet
@@ -1738,8 +1783,16 @@ sealkeep open 08424eb6… ./session.jsonl \
     const host = $("a-packs");
     while (host.firstChild) host.removeChild(host.firstChild);
     for (const pack of PACKAGES.filter((p) => p.managed)) {
-      const chip = document.createElement("span");
+      const chip = document.createElement(pack.id === current ? "span" : "a");
       chip.className = "packchip" + (pack.id === current ? " now" : "");
+      if (pack.id !== current) {
+        // It looked like a picker and did nothing when clicked. Changing a
+        // package is handled by a person today, so the chip starts that
+        // message rather than pretending to be a checkout.
+        chip.href = "mailto:hello@spala.ai?subject=" + encodeURIComponent(`Move me to ${pack.name}`)
+          + "&body=" + encodeURIComponent(`Please move my account to ${pack.name}${pack.managed ? ` ($${pack.monthly} a month)` : ""}.`);
+        chip.title = `Ask us to move you to ${pack.name}`;
+      }
       const name = document.createElement("b"); name.textContent = pack.name;
       const price = document.createElement("span"); price.textContent = `$${pack.monthly}/mo`;
       chip.append(name, price);

package/dist/src/cli.js

@@ -202,6 +202,7 @@ function usage() {
             ["scan <path>", "find pasted secrets in transcripts before they are sealed in"],
             ["list", "browse archives"],
             ["search <query>", "search metadata, or contents with --content"],
+            ["projects", "the project names this vault knows — the ones routing rules pin"],
             ["index build", "build the local content index that --content searches"],
             ["index status", "what is searchable and what is not yet indexed"],
             ["storage targets", "several storages at once, with limits, pins, and priority"],
@@ -1003,6 +1004,65 @@ async function main() {
         print(dim("\n  On a package we run the storage and choose the provider. Your own bucket means\n  your provider, your region, your bill. Either way we hold no key that opens an archive.\n"));
         return;
     }
+    if (command === "projects") {
+        // Routing rules can pin a project to a destination, and the panel cannot
+        // offer a list: project names never reach the cloud — that is the point.
+        // So this machine, which does know them, prints the exact strings to paste.
+        const { listArchives } = await import("./vault.js");
+        const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
+        const records = await listArchives(dataDir);
+        const seen = new Map();
+        let unknown = 0;
+        let unknownBytes = 0;
+        for (const record of records) {
+            const agentName = record.source.agent;
+            let project = null;
+            try {
+                if (agentName === "claude")
+                    project = claudeProjectFromPath(record.source.path).project;
+                else if (agentName === "codex")
+                    project = (await codexProjectFromRollout(record.source.path, record.createdAt)).project;
+            }
+            catch {
+                project = null;
+            }
+            if (!project) {
+                unknown += 1;
+                unknownBytes += record.source.bytes ?? 0;
+                continue;
+            }
+            const entry = seen.get(project) ?? { archives: 0, bytes: 0, agent: agentName };
+            entry.archives += 1;
+            entry.bytes += record.source.bytes ?? 0;
+            seen.set(project, entry);
+        }
+        const rows = [...seen.entries()].sort((a, b) => b[1].bytes - a[1].bytes);
+        if (json) {
+            print(JSON.stringify({
+                projects: rows.map(([name, v]) => ({ name, archives: v.archives, bytes: v.bytes, agent: v.agent })),
+                withoutProject: { archives: unknown, bytes: unknownBytes }
+            }, null, 2));
+            return;
+        }
+        print(`\n${bold("Projects in this vault")}\n${dim("─".repeat(30))}`);
+        if (rows.length === 0) {
+            print(`\n  ${dim("None of the archived sessions recorded a project.")}`);
+            print(`  ${dim("Codex records one only when the session wrote its working directory;")}`);
+            print(`  ${dim("Claude Code always does. Until a session carries one, a project pin")}`);
+            print(`  ${dim("in your routing rules matches nothing — leave that field empty.")}\n`);
+            return;
+        }
+        print(table(rows, [
+            { header: "project", get: ([name]) => name },
+            { header: "archives", get: ([, v]) => String(v.archives), align: "right" },
+            { header: "size", get: ([, v]) => bytes(v.bytes), align: "right" },
+            { header: "agent", get: ([, v]) => dim(v.agent) }
+        ], "no project recorded yet"));
+        if (unknown > 0)
+            print(`\n  ${dim(`${unknown} archive${unknown === 1 ? "" : "s"} recorded no project (${bytes(unknownBytes)}).`)}`);
+        print(`\n  ${dim("Paste a name into \"Only these projects\" in the account panel to pin it to a destination.")}\n`);
+        return;
+    }
     if (command === "open") {
         const [vaultRef, destination] = positionals(args);
         if (!vaultRef || !destination)

package/dist/src/doctor.js

@@ -169,6 +169,44 @@ export async function runDoctor(dataDir, env = process.env) {
         }
     }
     catch { /* coverage is advisory; a broken sidecar must not fail doctor */ }
+    // A routing rule can pin a project to a destination, and the account panel
+    // cannot check the name: project names never reach the cloud. So a typo is
+    // saved happily and silently routes nothing, forever. This machine knows the
+    // real names, so it is the one that can say.
+    try {
+        const { resolveTargets } = await import("./storage-targets.js");
+        const targets = await resolveTargets(dataDir);
+        const pinned = [...new Set(targets.flatMap((target) => target.projects ?? []))];
+        if (pinned.length > 0) {
+            const { listArchives } = await import("./vault.js");
+            const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
+            const records = await listArchives(dataDir).catch(() => []);
+            const known = new Set();
+            for (const record of records) {
+                try {
+                    const name = record.source.agent === "claude"
+                        ? claudeProjectFromPath(record.source.path).project
+                        : record.source.agent === "codex"
+                            ? (await codexProjectFromRollout(record.source.path, record.createdAt)).project
+                            : null;
+                    if (name)
+                        known.add(name);
+                }
+                catch { /* a project we cannot read is not evidence of a bad pin */ }
+            }
+            const unmatched = pinned.filter((name) => !known.has(name));
+            if (unmatched.length === 0) {
+                checks.push({ name: "routing-pins", status: "pass", detail: `${pinned.length} pinned project${pinned.length === 1 ? "" : "s"} match sessions on this machine.` });
+            }
+            else {
+                checks.push({
+                    name: "routing-pins", status: "warn",
+                    detail: `${unmatched.length === pinned.length ? "No" : unmatched.length} pinned project${unmatched.length === 1 ? "" : "s"} match anything sealed here: ${unmatched.slice(0, 3).join(", ")}. Those rules route nothing. Run \`sealkeep projects\` for the names this vault actually knows${known.size ? `, such as ${[...known].slice(0, 2).join(", ")}` : ""}.`
+                });
+            }
+        }
+    }
+    catch { /* routing rules are advisory here; never fail doctor over them */ }
     // Where the daemon actually looks: an explicit env var, or the phrase the
     // wizard put in this machine's keystore. This used to test only the env var,
     // so a machine set up correctly through the window — phrase in the keystore,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",

package/web/index.html

@@ -108,7 +108,7 @@
   </header>
 
   <section id="gate" class="panel gate pad" hidden>
-    <h3>Local token required</h3>
+    <h2>Local token required</h2>
     <p class="note">This browser has not been given its key yet. Paste the token from <code id="token-path">local-api-token</code> in your Sealkeep data folder (<code>~/.sealkeep</code>, or <code>~/.vaultline</code> for older vaults) — a local file, so nothing here is sent anywhere. The browser <code>sealkeep ui</code> opened is signed in already.</p>
     <form id="token-form">
       <input id="token-input" type="password" autocomplete="off" spellcheck="false" placeholder="local API token" aria-label="Local API token">

package/web/setup.html

@@ -267,12 +267,12 @@
         <p>It unlocks with your password on this machine. If you ever lose the password, the phrase below is the only other way in — which is a good reason to spend a minute on it now.</p>
       </div>
       <details class="panel pad explain" id="phrase-fold">
-        <summary>Prefer a recovery phrase too?</summary>
+        <summary>Show the 24 words that survive this machine</summary>
         <p id="fold-note"></p>
         <ol class="phrase" id="fold-phrase-words"></ol>
       </details>
       <div class="wizfoot">
-        <p class="note">Skipping the phrase is fine — your password already opens this vault.</p>
+        <p class="note warn"><b>Your password opens this vault on this machine only.</b> It is kept in this machine's keystore — it does not travel. If this machine is lost or wiped, the 24 words above are the only thing that opens the archives, and nobody, including us, can recreate them. Take them now, or accept that this vault dies with this machine.</p>
         <div class="actions"><button type="button" class="action primary" id="finish-password">Finish setup</button></div>
       </div>
     </div>

package/web/style.css

@@ -674,6 +674,16 @@ nav.steps .step.locked.current:hover { background: var(--ink-2); color: #fff; }
 .callout h3 { margin: 0; }
 .callout h3 + p { margin-top: -6px; }
 .callout.warn { border-left: 3px solid var(--alert); }
+/* A note that carries a consequence reads like one. Used where setup asks
+   whether to keep the 24 words: the copy there used to call skipping them
+   "fine", which is true until the machine is lost and then permanently false. */
+.note.warn {
+  border-left: 3px solid var(--alert);
+  padding: 10px 12px;
+  background: color-mix(in srgb, var(--alert) 7%, transparent);
+  color: var(--ink);
+}
+.note.warn b { color: var(--alert); }
 .callout.warn p { color: var(--text); }
 ul.plain { margin: 0; padding-left: 19px; display: grid; gap: 8px; color: var(--text-2); max-width: 72ch; }
 ul.plain b { color: var(--text); }