sealkeep 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.7.2 — 2026-08-20
+
+- Sharing is findable: the vault view offers **Share…** beside Restore. The
+  bundle is minted by the agent, not the browser — building one re-wraps the
+  archive key under a passcode, which needs the recovery phrase this API
+  deliberately never touches, the same reason Restore hands over a command.
+- `docs/sharing-b2c-b2b.md` records the split: what the one-person hand-off
+  does today (verified end to end), and what a company sharing a project on its
+  own storage actually costs to build.
+
+## 0.7.1 — 2026-08-20
+
+The dashboard and the account panel are one design system again.
+
+- `design-system/tokens.css` is the single source; `npm run tokens` injects it
+  into both surfaces and `--check` fails on drift, with the suite enforcing it.
+- The rule it encodes: monospace is what a machine said — a size, a path, a
+  state, a command — and sans is what we said. The dashboard had been running
+  every sentence in monospace because `--sans` was aliased to `--mono`, so its
+  option descriptions and standing notes read as terminal output. They read as
+  English now; every number, path and identifier is untouched.
+
 ## 0.7.0 — 2026-08-20
 
 Two reviews — does each section deserve to exist, and can a person finish the

package/dist/site/index.html

@@ -22,11 +22,23 @@
      field on it is always, only, encrypted material.
      --------------------------------------------------------------------- */
   :root{
-    --paper:#f4f4f3; --card:#fbfbfa; --ink:#111316; --soft:#5e646c; --rule:#dadcde;
-    --seal:#101a3d; --seal-ink:#96a6e0; --live:#2a3fb0; --warn:#8c3220; --warn-bg:#f4e6e2;
-    --sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,"Helvetica Neue",sans-serif;
-    --mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,"DejaVu Sans Mono",Consolas,monospace;
-    --gut:2.6rem;
+    /* @tokens:start — generated from design-system/tokens.css, do not edit here */
+    --paper: #f4f4f3;
+    --card: #fbfbfa;
+    --ink: #111316;
+    --soft: #5e646c;
+    --rule: #dadcde;
+    --seal: #101a3d;
+    --seal-ink: #96a6e0;
+    --live: #2a3fb0;
+    --warn: #8c3220;
+    --warn-bg: #f4e6e2;
+    --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, "Helvetica Neue", sans-serif;
+    --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, "DejaVu Sans Mono", Consolas, monospace;
+    /* @tokens:end */
+
+    /* Layout constant for this page's spine; not part of the shared palette. */
+    --gut: 2.6rem;
   }
   @media(prefers-color-scheme:dark){:root{
     --paper:#0d0f11; --card:#14171a; --ink:#e7e9ec; --soft:#8d949c; --rule:#24282d;
@@ -741,7 +753,7 @@ sealkeep open 08424eb6… ./session.jsonl \
     <div class="card">
     <span class="eyebrow">What gets uploaded</span>
     <h2>Your upload rules</h2>
-    <p class="msg" style="margin:.1rem 0 .6rem">Saved to your account — every machine you connect follows these, the same way routing rules do.</p>
+    <p class="why" style="margin:.1rem 0 .8rem">Saved to your account — every machine you connect follows these, the same way routing rules do.</p>
     <p>Everything you do not choose here stays local and is never uploaded.</p>
     <p class="empty" id="r-note" style="margin-bottom:.9rem">Enforced on your machine, before a session is read or sealed. Anything held back is never uploaded, so this is a rule about what leaves — not a filter we apply after it arrives.</p>
     <div class="rules">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",
@@ -41,7 +41,8 @@
     "build:site": "node tools/build-site.mjs",
     "bundle:site": "node tools/build-site.mjs && cd dist/site && zip -q -X ../site.zip index.html && cd - >/dev/null && echo \"dist/site.zip ready ($(wc -c < dist/site.zip) bytes)\"",
     "acceptance": "node scripts/acceptance.mjs",
-    "acceptance:managed": "node scripts/acceptance.mjs --managed"
+    "acceptance:managed": "node scripts/acceptance.mjs --managed",
+    "tokens": "node scripts/sync-tokens.mjs"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/web/app.js

@@ -410,6 +410,36 @@ function renderQueue(queue, retention) {
  * command, filled in, so "how do I get this back" is a paste instead of a
  * manual.
  */
+/**
+ * Sharing, offered where the archives are. The bundle itself is made by the
+ * agent, not by this page: building one re-wraps the archive key under a
+ * passcode, which needs the recovery phrase, and this API deliberately never
+ * touches it — the same reason Restore hands over a command instead of a file.
+ * What the page can do is make the feature findable and get the command right,
+ * including the destination and the warning that the passcode travels
+ * separately.
+ */
+function shareButton(archive) {
+  const hand = document.createElement("button");
+  hand.type = "button";
+  hand.className = "action";
+  hand.textContent = "Share…";
+  hand.title = "Copies the command that seals this session into a bundle only a passcode opens";
+  hand.onclick = async () => {
+    const name = (archive.path || archive.id).split("/").pop().replace(/\.jsonl$/, "");
+    const command = `sealkeep share ${archive.id} --out ~/Desktop/${name}.vlshare`;
+    try {
+      await navigator.clipboard.writeText(command);
+      hand.textContent = "Command copied";
+      setStatus("Run it in a terminal — it prints a passcode. Send the bundle and the passcode by different routes; neither opens anything alone.", "");
+    } catch {
+      hand.textContent = command;
+    }
+    setTimeout(() => { hand.textContent = "Share…"; }, 6000);
+  };
+  return hand;
+}
+
 function restoreButton(archive) {
   const hand = document.createElement("button");
   hand.type = "button";
@@ -625,7 +655,7 @@ function renderArchives(archives, retention) {
     }
 
     const act = row.insertCell();
-    act.append(restoreButton(archive));
+    act.append(restoreButton(archive), shareButton(archive));
 
     // "Is my backup really there?" — asked of the storage, right now, not of
     // our own records. The answer arrives as a sentence on the status line

package/web/style.css

@@ -10,12 +10,7 @@
  */
 
 :root {
-  /* Vaultline design system — the ten tokens from site/index.html, the source
-     of truth (see design-system/README.md). The older dashboard names below are
-     kept as aliases so existing rules resolve to the system's colours without a
-     full rename. The page is achromatic: the ONE saturated block is ciphertext
-     (--seal); --live marks what is interactive or currently true; --warn is
-     rationed to where inaction loses data. */
+  /* @tokens:start — generated from design-system/tokens.css, do not edit here */
   --paper: #f4f4f3;
   --card: #fbfbfa;
   --ink: #111316;
@@ -26,14 +21,17 @@
   --live: #2a3fb0;
   --warn: #8c3220;
   --warn-bg: #f4e6e2;
-
+  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, system-ui, "Helvetica Neue", sans-serif;
   --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, "DejaVu Sans Mono", Consolas, monospace;
-  /* One typeface: monospace, including display sizes. --sans is aliased to it so
-     any rule still asking for a second face complies instead of breaking the
-     rule the whole system is built on. */
-  --sans: var(--mono);
+  /* @tokens:end */
 
-  /* Compatibility aliases: prior dashboard rules reference these names. */
+  /* Surface-local aliases: older dashboard rules ask for these names, and they
+     resolve to the system's colours rather than a second palette. Kept outside
+     the generated block on purpose — the token file describes the design
+     system, this describes one surface's history. */
+  /* Layout constants for this surface, not part of the shared palette. */
+  --rail: 264px;
+  --gap: 20px;
   --panel: var(--card);
   --rule-soft: #e6e7e9;
   --text: var(--ink);
@@ -43,17 +41,8 @@
   --verified: var(--live);
   --held: var(--soft);
   --alert: var(--warn);
-  /* Were dark-navy fills for the old rail; now the solid-ink fill the system
-     uses for a filled control. Lazy substitution keeps them theme-correct. */
   --ink-2: var(--ink);
   --ink-3: var(--soft);
-  /* Rail is now part of the light page, not a dark slab. These name faint
-     surfaces used for nav hover/active and glyphs. */
-  --rail-active: #ecedf0;
-  --rail-glyph: #9aa0a8;
-
-  --rail: 264px;
-  --gap: 20px;
 }
 
 /* ── Dark ─────────────────────────────────────────────── */
@@ -176,7 +165,9 @@ nav button .count { margin-left: auto; font-size: 11.5px; color: var(--soft); }
   margin-top: auto;
   border-top: 1px solid var(--rule);
   padding: 18px 12px 0;
-  font-family: var(--mono);
+  /* Prose, so it reads as prose. Mono is reserved for what a machine said —
+     a size, a path, a state, a command — and this is us explaining the page. */
+  font-family: var(--sans);
   font-size: 12px;
   color: var(--soft);
   line-height: 1.65;