sealkeep 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 Notable changes, by published version. Sealkeep is pre-1.0: minor versions
 may change behavior, and say so here when they do.
 
+## 0.7.2 — 2026-08-20
+
+- Sharing is findable: the vault view offers **Share…** beside Restore. The
+  bundle is minted by the agent, not the browser — building one re-wraps the
+  archive key under a passcode, which needs the recovery phrase this API
+  deliberately never touches, the same reason Restore hands over a command.
+- `docs/sharing-b2c-b2b.md` records the split: what the one-person hand-off
+  does today (verified end to end), and what a company sharing a project on its
+  own storage actually costs to build.
+
 ## 0.7.1 — 2026-08-20
 
 The dashboard and the account panel are one design system again.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealkeep",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "description": "Sealkeep by SPALA AI \u2014 your AI coding-agent history, sealed, searchable, and shared across your machines.",
   "license": "SEE LICENSE IN LICENSE",

package/web/app.js

@@ -410,6 +410,36 @@ function renderQueue(queue, retention) {
  * command, filled in, so "how do I get this back" is a paste instead of a
  * manual.
  */
+/**
+ * Sharing, offered where the archives are. The bundle itself is made by the
+ * agent, not by this page: building one re-wraps the archive key under a
+ * passcode, which needs the recovery phrase, and this API deliberately never
+ * touches it — the same reason Restore hands over a command instead of a file.
+ * What the page can do is make the feature findable and get the command right,
+ * including the destination and the warning that the passcode travels
+ * separately.
+ */
+function shareButton(archive) {
+  const hand = document.createElement("button");
+  hand.type = "button";
+  hand.className = "action";
+  hand.textContent = "Share…";
+  hand.title = "Copies the command that seals this session into a bundle only a passcode opens";
+  hand.onclick = async () => {
+    const name = (archive.path || archive.id).split("/").pop().replace(/\.jsonl$/, "");
+    const command = `sealkeep share ${archive.id} --out ~/Desktop/${name}.vlshare`;
+    try {
+      await navigator.clipboard.writeText(command);
+      hand.textContent = "Command copied";
+      setStatus("Run it in a terminal — it prints a passcode. Send the bundle and the passcode by different routes; neither opens anything alone.", "");
+    } catch {
+      hand.textContent = command;
+    }
+    setTimeout(() => { hand.textContent = "Share…"; }, 6000);
+  };
+  return hand;
+}
+
 function restoreButton(archive) {
   const hand = document.createElement("button");
   hand.type = "button";
@@ -625,7 +655,7 @@ function renderArchives(archives, retention) {
     }
 
     const act = row.insertCell();
-    act.append(restoreButton(archive));
+    act.append(restoreButton(archive), shareButton(archive));
 
     // "Is my backup really there?" — asked of the storage, right now, not of
     // our own records. The answer arrives as a sentence on the status line