sealkeep 0.6.2 → 0.7.1

package/CHANGELOG.md

@@ -3,6 +3,39 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.7.1 — 2026-08-20
+
+The dashboard and the account panel are one design system again.
+
+- `design-system/tokens.css` is the single source; `npm run tokens` injects it
+  into both surfaces and `--check` fails on drift, with the suite enforcing it.
+- The rule it encodes: monospace is what a machine said — a size, a path, a
+  state, a command — and sans is what we said. The dashboard had been running
+  every sentence in monospace because `--sans` was aliased to `--mono`, so its
+  option descriptions and standing notes read as terminal output. They read as
+  English now; every number, path and identifier is untouched.
+
+## 0.7.0 — 2026-08-20
+
+Two reviews — does each section deserve to exist, and can a person finish the
+job it promises — and the answers, applied.
+
+- **Setup no longer argues for the unrecoverable mistake.** The password path
+  said skipping the recovery phrase was "fine". Your password opens the vault on
+  that machine only; the screen now says so, names the day it matters, and shows
+  the 24 words as what survives it.
+- The account panel leads with the Recovery key card instead of burying it ninth
+  of eleven, merges Plan into Your package (they answered the same question),
+  makes the package tiers actually start a change instead of looking clickable
+  and doing nothing, warns "Delete forever?" with the stake named, puts
+  connecting a machine above the list of machines, and stops calling an
+  account-wide upload rule "what leaves this machine".
+- Revoked machines fold into one line — they are kept as the record, never
+  deleted, but no longer bury the machines that can actually write.
+- `sealkeep doctor` warns when a routing rule pins a project this machine has
+  never sealed. The panel cannot check that — project names never reach us —
+  so the machine that knows does.
+
 ## 0.6.2 — 2026-08-20
 
 - New: `sealkeep projects` lists the project names this vault knows, with how

package/dist/site/index.html

@@ -22,11 +22,23 @@
      field on it is always, only, encrypted material.
      --------------------------------------------------------------------- */
   :root{
-    --paper:#f4f4f3; --card:#fbfbfa; --ink:#111316; --soft:#5e646c; --rule:#dadcde;
-    --seal:#101a3d; --seal-ink:#96a6e0; --live:#2a3fb0; --warn:#8c3220; --warn-bg:#f4e6e2;
-    --sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,"Helvetica Neue",sans-serif;
-    --mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,"DejaVu Sans Mono",Consolas,monospace;
-    --gut:2.6rem;
+    /* @tokens:start — generated from design-system/tokens.css, do not edit here */
+    --paper: #f4f4f3;
+    --card: #fbfbfa;
+    --ink: #111316;
+    --soft: #5e646c;
+    --rule: #dadcde;
+    --seal: #101a3d;
+    --seal-ink: #96a6e0;
+    --live: #2a3fb0;
+    --warn: #8c3220;
+    --warn-bg: #f4e6e2;
+    --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, "Helvetica Neue", sans-serif;
+    --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, "DejaVu Sans Mono", Consolas, monospace;
+    /* @tokens:end */
+
+    /* Layout constant for this page's spine; not part of the shared palette. */
+    --gut: 2.6rem;
   }
   @media(prefers-color-scheme:dark){:root{
     --paper:#0d0f11; --card:#14171a; --ink:#e7e9ec; --soft:#8d949c; --rule:#24282d;
@@ -216,6 +228,10 @@
   .acct-nav{display:flex;gap:.35rem;flex-wrap:wrap;position:sticky;top:0;z-index:5;background:var(--paper);padding:.65rem 0;margin:.4rem 0 .2rem;border-bottom:1px solid var(--rule)}
   .acct-nav a{font-family:var(--mono);font-size:.74rem;color:var(--soft);text-decoration:none;border:1px solid var(--rule);border-radius:999px;padding:.4rem .85rem;min-height:26px;display:inline-flex;align-items:center}
   .acct-nav a:hover{color:var(--ink);border-color:var(--ink)}
+  #d-retired details{margin:.5rem 0 .2rem}
+  #d-retired summary{font-family:var(--mono);font-size:.76rem;color:var(--soft);cursor:pointer;padding:.35rem 0}
+  #d-retired summary:hover{color:var(--ink)}
+  #d-retired .lines li{opacity:.75}
   .acct-hero{font-family:var(--mono);font-size:1.55rem;font-weight:700;letter-spacing:-.03em;margin:.9rem 0 0;line-height:1.3}
   h1.acct-hero:empty{display:none}
   .ruleslist{margin:.3rem 0 .9rem;padding-left:1.1rem}
@@ -611,6 +627,12 @@ sealkeep open 08424eb6… ./session.jsonl \
       <span class="saved" id="a-verify-msg" role="status" aria-live="polite"></span>
     </div>
 
+<div class="card" id="c-recovery"><span id="anchor-recovery"></span>
+      <span class="eyebrow">Recovery key</span>
+      <h2 id="e-head">Loading…</h2>
+      <p id="e-text"></p>
+    </div>
+
     <div class="card" id="anchor-storage">
       <span class="eyebrow">Storage</span>
       <div id="a-store-free" style="display:none">
@@ -662,7 +684,9 @@ sealkeep open 08424eb6… ./session.jsonl \
       <span class="eyebrow">Machines</span>
       <h2>Connected machines</h2>
       <p>Each connected machine signs its own uploads. Revoking one stops it writing here; the archives it already stored are untouched.</p>
+      <div id="pair-top"></div>
       <ul class="lines" id="d-list"></ul>
+      <div id="d-retired"></div>
       <p class="empty" id="d-msg">Loading…</p>
 
       <!-- One pairing block exists on the page. It leads the panel while no
@@ -700,44 +724,36 @@ sealkeep open 08424eb6… ./session.jsonl \
       <p class="msg" id="s-msg">Loading…</p>
       <div id="s-wrap" style="display:none;overflow-x:auto">
         <table>
-          <thead><tr><th>Archive</th><th>Contents</th><th>State</th><th>Added</th><th></th></tr></thead>
+          <thead><tr><th>Archive</th><th>Size</th><th>State</th><th>Added</th><th></th></tr></thead>
           <tbody id="s-body"></tbody>
         </table>
         <p class="msg" id="s-foot"></p>
       </div>
     </div>
 
-    <div class="card" id="c-plan"><span id="anchor-plan"></span>
-      <span class="eyebrow">Plan</span>
-      <div id="a-plan-free" style="display:none">
-        <h2>Free — your bucket, your bill</h2>
-        <p>Unlimited archives with the same encryption. You supply the storage credentials and pay your provider directly.</p>
-        <p class="empty">Want us to run storage instead? Pricing is in Your package, below. Write to <span id="a-sales">hello@spala.ai</span> from this address and we will switch it on.</p>
-      </div>
-      <div id="a-plan-paid" style="display:none">
-        <h2>Managed storage</h2>
-        <p>We run the bucket and meter what you store. We still hold no key that opens any of it — the only difference from your own bucket is who pays the storage bill and who can delete it.</p>
-        <div class="kv" style="margin-top:1rem">
-          <div><span class="k">Subscription</span><b id="a-sub-state">—</b></div>
-          <div><span class="k">Renews</span><b id="a-sub-end">—</b></div>
-          <div><span class="k">Billed through</span><b id="a-sub-prov">—</b></div>
-        </div>
-        <p class="empty" id="a-sub-note"></p>
-      </div>
-    </div>
+    
 
     <div class="card" id="a-pack-card">
+      <span id="anchor-plan"></span>
       <span class="eyebrow">Your package</span>
       <h2 id="a-pack-current">—</h2>
       <p class="msg" id="a-pack-context" style="margin:0 0 .8rem"></p>
       <div class="packrow" id="a-packs"></div>
+      <p class="empty" id="a-plan-free-note"></p>
       <p class="empty" id="a-pack-alt">Not storing with us? Your own bucket is free with the same encryption, and Pro Lite keeps key escrow and machine sign-in with no metered storage.</p>
+        <div class="kv" id="a-sub-facts" style="margin-top:1rem">
+          <div><span class="k">Subscription</span><b id="a-sub-state">—</b></div>
+          <div><span class="k">Renews</span><b id="a-sub-end">—</b></div>
+          <div><span class="k">Billed through</span><b id="a-sub-prov">—</b></div>
+        </div>
+        <p class="empty" id="a-sub-note"></p>
       <p class="why" id="a-pack-note">Changing your package is handled by hand today. Email hello@spala.ai from this address and we will move you within one business day — your archives keep uploading throughout.</p>
     </div>
 
     <div class="card">
-    <span class="eyebrow">What leaves this machine</span>
+    <span class="eyebrow">What gets uploaded</span>
     <h2>Your upload rules</h2>
+    <p class="why" style="margin:.1rem 0 .8rem">Saved to your account — every machine you connect follows these, the same way routing rules do.</p>
     <p>Everything you do not choose here stays local and is never uploaded.</p>
     <p class="empty" id="r-note" style="margin-bottom:.9rem">Enforced on your machine, before a session is read or sealed. Anything held back is never uploaded, so this is a rule about what leaves — not a filter we apply after it arrives.</p>
     <div class="rules">
@@ -764,11 +780,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     </div>
     </div>
 
-    <div class="card" id="c-recovery"><span id="anchor-recovery"></span>
-      <span class="eyebrow">Recovery key</span>
-      <h2 id="e-head">Loading…</h2>
-      <p id="e-text"></p>
-    </div>
+    
 
     <div class="card">
       <span class="eyebrow">Activity</span>
@@ -1051,7 +1063,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     $("a-name").value = user.label || "";
     $("a-plan").textContent = paid ? "Managed storage" : "Free";
     $("a-plan").className = "chip" + (paid ? " pro" : "");
-    $("a-plan").onclick = () => goTo($("c-plan"));
+    $("a-plan").onclick = () => goTo($("anchor-plan"));
     $("a-who").textContent = [
       user.email,
       "joined " + day(user.created_at),
@@ -1069,8 +1081,13 @@ sealkeep open 08424eb6… ./session.jsonl \
     lastPaid = paid;
     applyStorageView();
     on("anchor-archives", paid); on("nav-archives", paid);
-    on("a-plan-free", !paid);
-    on("a-plan-paid", paid);
+    // One card carries billing now. A free account is told what managed
+    // storage would give it; a paying one is told the state of what it bought.
+    $("a-plan-free-note").textContent = paid
+      ? ""
+      : "You are on your own storage: unlimited archives, same encryption, your provider's bill. Managed storage means we run the bucket and meter what you store — we still hold no key that opens any of it.";
+    on("a-sub-facts", paid);
+    on("a-plan-free-note", !paid);
 
     if (paid) {
       const quota = Number(user.quota_bytes) || 0, used = Number(user.used_bytes) || 0;
@@ -1117,7 +1134,37 @@ sealkeep open 08424eb6… ./session.jsonl \
         return deviceCount;
       }
       $("d-msg").textContent = "";
-      for (const d of devices) {
+      // Revocation never deletes a machine — the row stays as the record that
+      // it once had access. On an account that has re-paired a few times that
+      // buries the two machines actually running under a wall of history: 29
+      // rows, 1666 px, nearly two screens, all looking alike. Active machines
+      // are the answer to "what can write to my account right now"; the rest
+      // fold away, counted and reachable, deleted by nobody.
+      const active = devices.filter((d) => d.state !== "revoked");
+      const retired = devices.filter((d) => d.state === "revoked");
+      const foldHost = $("d-retired");
+      foldHost.replaceChildren();
+      if (retired.length) {
+        const fold = document.createElement("details");
+        const summary = document.createElement("summary");
+        summary.textContent = `${retired.length} revoked machine${retired.length === 1 ? "" : "s"} — kept as the record, none can write`;
+        const inner = document.createElement("ul");
+        inner.className = "lines";
+        for (const d of retired) {
+          const li = document.createElement("li");
+          const name = document.createElement("span");
+          name.className = "grow";
+          name.textContent = d.label || "Unnamed machine";
+          const when = document.createElement("span");
+          when.className = "when";
+          when.textContent = "revoked " + ago(d.revoked_at);
+          li.append(name, when);
+          inner.append(li);
+        }
+        fold.append(summary, inner);
+        foldHost.append(fold);
+      }
+      for (const d of active) {
         const li = document.createElement("li");
         const name = document.createElement("span");
         name.className = "grow";
@@ -1138,7 +1185,13 @@ sealkeep open 08424eb6… ./session.jsonl \
             // Two-step, like archive deletion: revoking locks a machine out of
             // its own backups, so a stray click must not do it.
             if (btn.dataset.armed !== "yes") {
-              btn.dataset.armed = "yes"; btn.textContent = "Confirm";
+              btn.dataset.armed = "yes";
+            // The local dashboard escalates to "Destroy forever?" when it can
+            // prove a copy is the last one. This page cannot see the customer's
+            // disk, so it must not claim either way — it names the stake and
+            // lets them decide.
+            btn.textContent = "Delete forever?";
+            btn.title = "If your machine already reclaimed the source, this is the only copy";
               setTimeout(() => {
                 if (btn.dataset.armed === "yes") { btn.dataset.armed = "no"; btn.textContent = "Revoke"; }
               }, 4000);
@@ -1489,7 +1542,7 @@ sealkeep open 08424eb6… ./session.jsonl \
          : paidPlan ? "Sealkeep cloud" : "the bucket each machine is configured with");
     const nothingYet = devices === 0 && Number(user.used_bytes) === 0;
     on("a-firstrun", nothingYet);
-    $(nothingYet ? "pair-home-first" : "pair-home-more").append($("pair"));
+    $(nothingYet ? "pair-home-first" : "pair-top").append($("pair"));
     $("pair-side").textContent = nothingYet ? "Your pairing code" : "Pairing code";
     if (devices === 0)
       $("d-msg").textContent = nothingYet
@@ -1742,8 +1795,16 @@ sealkeep open 08424eb6… ./session.jsonl \
     const host = $("a-packs");
     while (host.firstChild) host.removeChild(host.firstChild);
     for (const pack of PACKAGES.filter((p) => p.managed)) {
-      const chip = document.createElement("span");
+      const chip = document.createElement(pack.id === current ? "span" : "a");
       chip.className = "packchip" + (pack.id === current ? " now" : "");
+      if (pack.id !== current) {
+        // It looked like a picker and did nothing when clicked. Changing a
+        // package is handled by a person today, so the chip starts that
+        // message rather than pretending to be a checkout.
+        chip.href = "mailto:hello@spala.ai?subject=" + encodeURIComponent(`Move me to ${pack.name}`)
+          + "&body=" + encodeURIComponent(`Please move my account to ${pack.name}${pack.managed ? ` ($${pack.monthly} a month)` : ""}.`);
+        chip.title = `Ask us to move you to ${pack.name}`;
+      }
       const name = document.createElement("b"); name.textContent = pack.name;
       const price = document.createElement("span"); price.textContent = `$${pack.monthly}/mo`;
       chip.append(name, price);

package/dist/src/doctor.js

@@ -169,6 +169,44 @@ export async function runDoctor(dataDir, env = process.env) {
         }
     }
     catch { /* coverage is advisory; a broken sidecar must not fail doctor */ }
+    // A routing rule can pin a project to a destination, and the account panel
+    // cannot check the name: project names never reach the cloud. So a typo is
+    // saved happily and silently routes nothing, forever. This machine knows the
+    // real names, so it is the one that can say.
+    try {
+        const { resolveTargets } = await import("./storage-targets.js");
+        const targets = await resolveTargets(dataDir);
+        const pinned = [...new Set(targets.flatMap((target) => target.projects ?? []))];
+        if (pinned.length > 0) {
+            const { listArchives } = await import("./vault.js");
+            const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
+            const records = await listArchives(dataDir).catch(() => []);
+            const known = new Set();
+            for (const record of records) {
+                try {
+                    const name = record.source.agent === "claude"
+                        ? claudeProjectFromPath(record.source.path).project
+                        : record.source.agent === "codex"
+                            ? (await codexProjectFromRollout(record.source.path, record.createdAt)).project
+                            : null;
+                    if (name)
+                        known.add(name);
+                }
+                catch { /* a project we cannot read is not evidence of a bad pin */ }
+            }
+            const unmatched = pinned.filter((name) => !known.has(name));
+            if (unmatched.length === 0) {
+                checks.push({ name: "routing-pins", status: "pass", detail: `${pinned.length} pinned project${pinned.length === 1 ? "" : "s"} match sessions on this machine.` });
+            }
+            else {
+                checks.push({
+                    name: "routing-pins", status: "warn",
+                    detail: `${unmatched.length === pinned.length ? "No" : unmatched.length} pinned project${unmatched.length === 1 ? "" : "s"} match anything sealed here: ${unmatched.slice(0, 3).join(", ")}. Those rules route nothing. Run \`sealkeep projects\` for the names this vault actually knows${known.size ? `, such as ${[...known].slice(0, 2).join(", ")}` : ""}.`
+                });
+            }
+        }
+    }
+    catch { /* routing rules are advisory here; never fail doctor over them */ }
     // Where the daemon actually looks: an explicit env var, or the phrase the
     // wizard put in this machine's keystore. This used to test only the env var,
     // so a machine set up correctly through the window — phrase in the keystore,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",
@@ -41,7 +41,8 @@
     "build:site": "node tools/build-site.mjs",
     "bundle:site": "node tools/build-site.mjs && cd dist/site && zip -q -X ../site.zip index.html && cd - >/dev/null && echo \"dist/site.zip ready ($(wc -c < dist/site.zip) bytes)\"",
     "acceptance": "node scripts/acceptance.mjs",
-    "acceptance:managed": "node scripts/acceptance.mjs --managed"
+    "acceptance:managed": "node scripts/acceptance.mjs --managed",
+    "tokens": "node scripts/sync-tokens.mjs"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/web/setup.html

@@ -267,12 +267,12 @@
         <p>It unlocks with your password on this machine. If you ever lose the password, the phrase below is the only other way in — which is a good reason to spend a minute on it now.</p>
       </div>
       <details class="panel pad explain" id="phrase-fold">
-        <summary>Prefer a recovery phrase too?</summary>
+        <summary>Show the 24 words that survive this machine</summary>
         <p id="fold-note"></p>
         <ol class="phrase" id="fold-phrase-words"></ol>
       </details>
       <div class="wizfoot">
-        <p class="note">Skipping the phrase is fine — your password already opens this vault.</p>
+        <p class="note warn"><b>Your password opens this vault on this machine only.</b> It is kept in this machine's keystore — it does not travel. If this machine is lost or wiped, the 24 words above are the only thing that opens the archives, and nobody, including us, can recreate them. Take them now, or accept that this vault dies with this machine.</p>
         <div class="actions"><button type="button" class="action primary" id="finish-password">Finish setup</button></div>
       </div>
     </div>

package/web/style.css

@@ -10,12 +10,7 @@
  */
 
 :root {
-  /* Vaultline design system — the ten tokens from site/index.html, the source
-     of truth (see design-system/README.md). The older dashboard names below are
-     kept as aliases so existing rules resolve to the system's colours without a
-     full rename. The page is achromatic: the ONE saturated block is ciphertext
-     (--seal); --live marks what is interactive or currently true; --warn is
-     rationed to where inaction loses data. */
+  /* @tokens:start — generated from design-system/tokens.css, do not edit here */
   --paper: #f4f4f3;
   --card: #fbfbfa;
   --ink: #111316;
@@ -26,14 +21,17 @@
   --live: #2a3fb0;
   --warn: #8c3220;
   --warn-bg: #f4e6e2;
-
+  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, "Helvetica Neue", sans-serif;
   --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, "DejaVu Sans Mono", Consolas, monospace;
-  /* One typeface: monospace, including display sizes. --sans is aliased to it so
-     any rule still asking for a second face complies instead of breaking the
-     rule the whole system is built on. */
-  --sans: var(--mono);
+  /* @tokens:end */
 
-  /* Compatibility aliases: prior dashboard rules reference these names. */
+  /* Surface-local aliases: older dashboard rules ask for these names, and they
+     resolve to the system's colours rather than a second palette. Kept outside
+     the generated block on purpose — the token file describes the design
+     system, this describes one surface's history. */
+  /* Layout constants for this surface, not part of the shared palette. */
+  --rail: 264px;
+  --gap: 20px;
   --panel: var(--card);
   --rule-soft: #e6e7e9;
   --text: var(--ink);
@@ -43,17 +41,8 @@
   --verified: var(--live);
   --held: var(--soft);
   --alert: var(--warn);
-  /* Were dark-navy fills for the old rail; now the solid-ink fill the system
-     uses for a filled control. Lazy substitution keeps them theme-correct. */
   --ink-2: var(--ink);
   --ink-3: var(--soft);
-  /* Rail is now part of the light page, not a dark slab. These name faint
-     surfaces used for nav hover/active and glyphs. */
-  --rail-active: #ecedf0;
-  --rail-glyph: #9aa0a8;
-
-  --rail: 264px;
-  --gap: 20px;
 }
 
 /* ── Dark ─────────────────────────────────────────────── */
@@ -176,7 +165,9 @@ nav button .count { margin-left: auto; font-size: 11.5px; color: var(--soft); }
   margin-top: auto;
   border-top: 1px solid var(--rule);
   padding: 18px 12px 0;
-  font-family: var(--mono);
+  /* Prose, so it reads as prose. Mono is reserved for what a machine said —
+     a size, a path, a state, a command — and this is us explaining the page. */
+  font-family: var(--sans);
   font-size: 12px;
   color: var(--soft);
   line-height: 1.65;
@@ -674,6 +665,16 @@ nav.steps .step.locked.current:hover { background: var(--ink-2); color: #fff; }
 .callout h3 { margin: 0; }
 .callout h3 + p { margin-top: -6px; }
 .callout.warn { border-left: 3px solid var(--alert); }
+/* A note that carries a consequence reads like one. Used where setup asks
+   whether to keep the 24 words: the copy there used to call skipping them
+   "fine", which is true until the machine is lost and then permanently false. */
+.note.warn {
+  border-left: 3px solid var(--alert);
+  padding: 10px 12px;
+  background: color-mix(in srgb, var(--alert) 7%, transparent);
+  color: var(--ink);
+}
+.note.warn b { color: var(--alert); }
 .callout.warn p { color: var(--text); }
 ul.plain { margin: 0; padding-left: 19px; display: grid; gap: 8px; color: var(--text-2); max-width: 72ch; }
 ul.plain b { color: var(--text); }