sealkeep 0.9.0 → 0.11.0

package/dist/src/archive-copies.d.ts

@@ -0,0 +1,47 @@
+import type { ArchiveRecordV2, RemoteObject } from "./types.js";
+/**
+ * One physical object has one id, independent of which routing rule currently
+ * names it. The version marker makes a future identity scheme explicit rather
+ * than silently changing ids already used by an API or operation journal.
+ */
+export declare function archiveCopyId(copy: Pick<RemoteObject, "provider" | "bucket" | "objectKey" | "destinationFingerprint">): string;
+/** Returns a copy with the deterministic id old records did not persist. */
+export declare function normalizeRemoteCopy(copy: RemoteObject): RemoteObject;
+/** Stable-order dedupe: the first occurrence keeps its position. */
+export declare function dedupeArchiveCopies(copies: readonly RemoteObject[]): RemoteObject[];
+/** Primary first, followed by unique secondary copies. Never mutates a record. */
+export declare function archiveCopies(record: Pick<ArchiveRecordV2, "remote" | "copies">): RemoteObject[];
+/** Rebuilds the compatibility shape: one primary plus optional secondaries. */
+export declare function normalizeArchiveCopies(record: ArchiveRecordV2): ArchiveRecordV2;
+/** True when any primary or secondary copy has earned a verification marker. */
+export declare function hasVerifiedCopy(record: Pick<ArchiveRecordV2, "remote" | "copies">): boolean;
+/**
+ * Non-secret identity used only to prove that separately stored delta links
+ * can be fetched from one destination. A mutable target label is secondary to
+ * the immutable destination fingerprint. Legacy AWS S3/GCS/B2 records can use
+ * their bucket; ambiguous R2/Drive records fail closed unless they retained a
+ * target id. A single self-contained archive does not need this join key.
+ */
+export declare function verifiedCopyDestinationKey(copy: RemoteObject): string | null;
+/** Destination keys at which this exact archive object has a verified copy. */
+export declare function verifiedCopyDestinations(record: Pick<ArchiveRecordV2, "remote" | "copies">): Set<string>;
+/**
+ * True only when one remote destination contains every record needed by a
+ * session. Verified links split between Drive and Cloud are not a restorable
+ * off-machine chain.
+ */
+export declare function hasCompleteVerifiedCopyChain(records: readonly ArchiveRecordV2[]): boolean;
+/**
+ * Idempotently adds or refreshes a copy. The first copy becomes primary;
+ * `makePrimary` explicitly promotes an existing or newly added destination.
+ */
+export declare function appendArchiveCopy(record: ArchiveRecordV2, incoming: RemoteObject, options?: {
+    makePrimary?: boolean;
+}): ArchiveRecordV2;
+/** Promotes one known copy; an unknown id is refused rather than silently succeeding. */
+export declare function promoteArchiveCopy(record: ArchiveRecordV2, copyId: string): ArchiveRecordV2;
+/**
+ * Idempotently removes a copy. Removing the primary promotes the first surviving
+ * secondary, preserving the legacy `remote` contract.
+ */
+export declare function removeArchiveCopy(record: ArchiveRecordV2, copyId: string): ArchiveRecordV2;

package/dist/src/archive-copies.js

@@ -0,0 +1,179 @@
+import { createHash } from "node:crypto";
+/**
+ * One physical object has one id, independent of which routing rule currently
+ * names it. The version marker makes a future identity scheme explicit rather
+ * than silently changing ids already used by an API or operation journal.
+ */
+export function archiveCopyId(copy) {
+    const location = copy.destinationFingerprint
+        ? ["v2", copy.destinationFingerprint, copy.provider.trim().toLowerCase(), copy.bucket, copy.objectKey].join("\0")
+        : ["v1", copy.provider.trim().toLowerCase(), copy.bucket, copy.objectKey].join("\0");
+    return `copy_${createHash("sha256").update(location).digest("hex")}`;
+}
+/** Returns a copy with the deterministic id old records did not persist. */
+export function normalizeRemoteCopy(copy) {
+    return { ...copy, copyId: archiveCopyId(copy) };
+}
+function verifiedTime(copy) {
+    const time = Date.parse(copy.verifiedAt);
+    return Number.isFinite(time) ? time : Number.NEGATIVE_INFINITY;
+}
+/**
+ * Merge two observations of the same object. The newest verification owns the
+ * byte/checksum/layout facts; a target id is routing metadata and is retained
+ * when either observation has it.
+ */
+function mergeSameCopy(current, incoming) {
+    const newer = verifiedTime(incoming) >= verifiedTime(current) ? incoming : current;
+    const older = newer === incoming ? current : incoming;
+    const targetId = newer.targetId ?? older.targetId;
+    const merged = {
+        ...older,
+        ...newer,
+        copyId: archiveCopyId(newer),
+        ...(targetId ? { targetId } : {}),
+    };
+    // Missing layout means the current object is the legacy single-object form.
+    // A stale chunk observation must not turn it back into a folder.
+    if (newer.layout === undefined)
+        delete merged.layout;
+    return merged;
+}
+/** Stable-order dedupe: the first occurrence keeps its position. */
+export function dedupeArchiveCopies(copies) {
+    const result = [];
+    const positions = new Map();
+    for (const raw of copies) {
+        const copy = normalizeRemoteCopy(raw);
+        const id = copy.copyId;
+        const existing = positions.get(id);
+        if (existing === undefined) {
+            positions.set(id, result.length);
+            result.push(copy);
+        }
+        else {
+            result[existing] = mergeSameCopy(result[existing], copy);
+        }
+    }
+    return result;
+}
+/** Primary first, followed by unique secondary copies. Never mutates a record. */
+export function archiveCopies(record) {
+    return dedupeArchiveCopies([...(record.remote ? [record.remote] : []), ...(record.copies ?? [])]);
+}
+/** Rebuilds the compatibility shape: one primary plus optional secondaries. */
+export function normalizeArchiveCopies(record) {
+    const all = archiveCopies(record);
+    const { remote: _remote, copies: _copies, ...unchanged } = record;
+    if (all.length === 0)
+        return unchanged;
+    const [remote, ...copies] = all;
+    return {
+        ...unchanged,
+        remote,
+        ...(copies.length > 0 ? { copies } : {}),
+    };
+}
+/** True when any primary or secondary copy has earned a verification marker. */
+export function hasVerifiedCopy(record) {
+    return archiveCopies(record).some((copy) => Number.isFinite(Date.parse(copy.verifiedAt)));
+}
+/**
+ * Non-secret identity used only to prove that separately stored delta links
+ * can be fetched from one destination. A mutable target label is secondary to
+ * the immutable destination fingerprint. Legacy AWS S3/GCS/B2 records can use
+ * their bucket; ambiguous R2/Drive records fail closed unless they retained a
+ * target id. A single self-contained archive does not need this join key.
+ */
+export function verifiedCopyDestinationKey(copy) {
+    if (!Number.isFinite(Date.parse(copy.verifiedAt)) || typeof copy.provider !== "string")
+        return null;
+    const provider = copy.provider.trim().toLowerCase();
+    if (!provider)
+        return null;
+    if (copy.destinationFingerprint?.trim())
+        return `${provider}\0fingerprint\0${copy.destinationFingerprint.trim()}`;
+    if (provider === "vaultline")
+        return `${provider}\0managed\0${copy.bucket || "account"}`;
+    if (copy.targetId?.trim())
+        return `${provider}\0target\0${copy.targetId.trim()}\0${copy.bucket || ""}`;
+    if (copy.bucket && provider !== "r2" && provider !== "gdrive")
+        return `${provider}\0legacy-bucket\0${copy.bucket}`;
+    return null;
+}
+/** Destination keys at which this exact archive object has a verified copy. */
+export function verifiedCopyDestinations(record) {
+    return new Set(archiveCopies(record).map(verifiedCopyDestinationKey).filter((key) => Boolean(key)));
+}
+/**
+ * True only when one remote destination contains every record needed by a
+ * session. Verified links split between Drive and Cloud are not a restorable
+ * off-machine chain.
+ */
+export function hasCompleteVerifiedCopyChain(records) {
+    if (records.length === 0)
+        return false;
+    if (records.length === 1)
+        return hasVerifiedCopy(records[0]);
+    let common = null;
+    for (const record of records) {
+        const destinations = verifiedCopyDestinations(record);
+        if (common === null)
+            common = destinations;
+        else {
+            const previous = common;
+            common = new Set([...previous].filter((destination) => destinations.has(destination)));
+        }
+        if (common.size === 0)
+            return false;
+    }
+    return (common?.size ?? 0) > 0;
+}
+/**
+ * Idempotently adds or refreshes a copy. The first copy becomes primary;
+ * `makePrimary` explicitly promotes an existing or newly added destination.
+ */
+export function appendArchiveCopy(record, incoming, options = {}) {
+    const all = archiveCopies(record);
+    const copy = normalizeRemoteCopy(incoming);
+    const existing = all.findIndex((candidate) => candidate.copyId === copy.copyId);
+    if (existing >= 0)
+        all[existing] = mergeSameCopy(all[existing], copy);
+    else
+        all.push(copy);
+    if (options.makePrimary && all.length > 1) {
+        const selected = all.findIndex((candidate) => candidate.copyId === copy.copyId);
+        if (selected > 0)
+            all.unshift(...all.splice(selected, 1));
+    }
+    return recordWithCopies(record, all);
+}
+/** Promotes one known copy; an unknown id is refused rather than silently succeeding. */
+export function promoteArchiveCopy(record, copyId) {
+    const all = archiveCopies(record);
+    const selected = all.findIndex((copy) => copy.copyId === copyId);
+    if (selected < 0)
+        throw new RangeError(`Archive ${record.id} has no remote copy ${copyId}`);
+    if (selected > 0)
+        all.unshift(...all.splice(selected, 1));
+    return recordWithCopies(record, all);
+}
+/**
+ * Idempotently removes a copy. Removing the primary promotes the first surviving
+ * secondary, preserving the legacy `remote` contract.
+ */
+export function removeArchiveCopy(record, copyId) {
+    return recordWithCopies(record, archiveCopies(record).filter((copy) => copy.copyId !== copyId));
+}
+function recordWithCopies(record, copies) {
+    const normal = dedupeArchiveCopies(copies);
+    const { remote: _remote, copies: _copies, ...unchanged } = record;
+    if (normal.length === 0)
+        return unchanged;
+    const [remote, ...secondary] = normal;
+    return {
+        ...unchanged,
+        remote,
+        ...(secondary.length > 0 ? { copies: secondary } : {}),
+    };
+}

package/dist/src/audit.d.ts

@@ -1,4 +1,4 @@
-export type AuditAction = "archive.create" | "archive.restore" | "archive.migrate" | "archive.rewrap" | "archive.prune" | "archive.offload" | "archive.delete" | "phrase.rotate" | "password.change" | "archive.share" | "source.reclaim" | "recipient.add" | "recipient.remove" | "upload.verify" | "remote.check" | "retention.approve";
+export type AuditAction = "archive.create" | "index.tokens" | "index.merge" | "archive.restore" | "archive.restore_local" | "archive.sealed_copy_download" | "archive.migrate" | "archive.rewrap" | "archive.prune" | "archive.offload" | "archive.delete" | "archive.copy_delete" | "phrase.rotate" | "password.change" | "archive.share" | "source.reclaim" | "recipient.add" | "recipient.remove" | "upload.verify" | "remote.check" | "retention.approve" | "storage.gdrive_connect" | "storage.target_connect" | "storage.targets_update" | "phrase.reveal" | "recovery.codes_created" | "bridge.share" | "project.sharing" | "project.draft";
 export type LocalAuditEvent = {
     id: string;
     at: string;

package/dist/src/audit.js

@@ -1,8 +1,19 @@
-import { appendFile, mkdir, readFile, rename, stat } from "node:fs/promises";
+import { mkdir, open, readFile, rename, stat } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 const MAX_BYTES = 5 * 1024 * 1024;
 export const auditPath = (dataDir) => join(dataDir, "audit.jsonl");
+async function syncAuditDirectory(dataDir) {
+    if (process.platform === "win32")
+        return;
+    const directory = await open(dataDir, "r");
+    try {
+        await directory.sync();
+    }
+    finally {
+        await directory.close();
+    }
+}
 /**
  * Append-only local audit log.
  *
@@ -14,10 +25,24 @@ export async function recordAudit(dataDir, action, outcome, detail) {
     const event = { id: randomUUID(), at: new Date().toISOString(), action, outcome, detail };
     const path = auditPath(dataDir);
     await mkdir(dataDir, { recursive: true, mode: 0o700 });
-    const size = await stat(path).then((info) => info.size).catch(() => 0);
-    if (size > MAX_BYTES)
+    const current = await stat(path).catch(() => null);
+    if ((current?.size ?? 0) > MAX_BYTES) {
         await rename(path, `${path}.1`).catch(() => undefined);
-    await appendFile(path, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+        await syncAuditDirectory(dataDir);
+    }
+    // A destructive decision is not "committed" merely because bytes reached a
+    // userspace stream. fsync the append before returning so reclaim can safely
+    // place its durable purge-authorized marker afterwards.
+    const handle = await open(path, "a", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(event)}\n`, "utf8");
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    if (!current || current.size > MAX_BYTES)
+        await syncAuditDirectory(dataDir);
     return event;
 }
 export async function readAudit(dataDir, options = {}) {

package/dist/src/autopilot.d.ts

@@ -1,19 +1,28 @@
 import { ArchiveQueue } from "./queue.js";
-import { type RetentionSettings } from "./retention.js";
+import { type RetentionPolicy, type RetentionSettings } from "./retention.js";
 import { type BackendName } from "./secrets.js";
 import { serviceStatus, type ServiceOptions, type ServiceOutcome } from "./service.js";
 import { type Liveness } from "./heartbeat.js";
+import type { McpExec } from "./mcp-install.js";
+import { type UiRuntimeStatus } from "./ui-server.js";
 export type AutopilotOptions = {
     phrase?: string;
     /** Keep the phrase in this machine's keystore so the service can run unattended. */
     remember?: boolean;
-    /** Let the service reclaim disk once a remote copy is verified. */
+    /**
+     * Let the service reclaim disk once every safety gate passes. Omitted means
+     * "keep this machine's saved choice"; a machine with no saved choice starts
+     * false. This distinction is what makes a package upgrade idempotent without
+     * turning deletion on for a fresh install.
+     */
     reclaim?: boolean;
     olderThanDays?: number;
     graceDays?: number;
     home?: string;
     platform?: NodeJS.Platform;
     exec?: ServiceOptions["exec"];
+    /** Separate seam for agent-owned MCP installers; falls back to `exec` in tests. */
+    mcpExec?: McpExec;
     cliPath?: string;
     /** Pin the keystore. Omitted, the strongest backend this machine offers is used. */
     backend?: BackendName;
@@ -30,6 +39,8 @@ export type AutopilotResult = {
     retention: RetentionSettings;
     service: ServiceOutcome;
     agents: string[];
+    /** Agents whose complete automatic memory lifecycle is installed (or would be in a dry run). */
+    hooks: string[];
     found: {
         sessions: number;
         bytes: number;
@@ -39,14 +50,35 @@ export type AutopilotResult = {
     hasRemoteTarget: boolean;
     notes: string[];
 };
+export type RetentionMachineSafety = {
+    /** Whether this call changed the machine's standing deletion permission. */
+    reclaimPermissionRevoked: boolean;
+    /** Whether an Autopilot service definition belongs to this vault. */
+    serviceInstalled: boolean;
+    /** Whether that installed definition was rewritten with the safe invocation. */
+    serviceReconciled: boolean;
+};
+/**
+ * Keep a non-reclaim retention policy and the machine that executes it in sync.
+ *
+ * Retention timing lives in the vault config, while unattended deletion is a
+ * separate, machine-local permission and an installed service also remembers
+ * its invocation. Changing only the policy is safe today, but leaves enough
+ * stale state for a later policy edit or older service generation to resume
+ * deletion without a new machine opt-in. Revoke that permission and rewrite an
+ * already-installed service receipt, preserving the schedule and every other
+ * local setting. A reclaim-capable policy deliberately grants nothing here.
+ */
+export declare function reconcileMachineRetentionPolicy(dataDir: string, policy: RetentionPolicy, options?: Pick<AutopilotOptions, "home" | "platform" | "exec" | "cliPath">): Promise<RetentionMachineSafety>;
 /**
  * Turns Sealkeep into something that runs itself.
  *
- * One call sets up the vault, teaches this machine to unlock it, picks a retention
- * policy, sweeps up the sessions already on disk, and installs a login service. The
- * safety gates are unchanged: reclamation still requires a verified remote copy, an
- * idle file, and an elapsed grace period, so enabling it here cannot delete anything
- * until a bucket is configured and an upload has been checked.
+ * One call sets up the vault, teaches this machine to unlock it, sweeps up the
+ * sessions already on disk, and installs a login service. Preservation, indexing,
+ * and uploads are automatic. Reclaim is a separate standing permission: it is off
+ * on a fresh machine and is enabled only by an explicit option or an already-saved
+ * machine choice. Even then, the ordinary remote, search, identity, age, grace and
+ * liveness gates remain mandatory.
  */
 export declare function enableAutopilot(dataDir: string, options?: AutopilotOptions): Promise<AutopilotResult>;
 export type AutopilotStatus = {
@@ -55,9 +87,13 @@ export type AutopilotStatus = {
     live: Liveness;
     service: Awaited<ReturnType<typeof serviceStatus>>;
     phraseAvailable: boolean;
+    /** Effective per-machine permission followed by the installed service. */
+    reclaimEnabled: boolean;
     retention: RetentionSettings;
     hasRemoteTarget: boolean;
     queue: Awaited<ReturnType<ArchiveQueue["stats"]>>;
+    /** Live listener truth, including a recorded fallback when 7477 was busy. */
+    ui: UiRuntimeStatus;
 };
 export declare function autopilotStatus(dataDir: string, options?: AutopilotOptions): Promise<AutopilotStatus>;
 /**
@@ -65,6 +101,13 @@ export declare function autopilotStatus(dataDir: string, options?: AutopilotOpti
  * automation off is not a way to lose data.
  */
 export declare function disableAutopilot(dataDir: string, options?: AutopilotOptions): Promise<{
+    service: ServiceOutcome;
+    forgotPhrase: boolean;
+    retention: RetentionSettings;
+    archivesKept: boolean;
+    hooksRemoved: string[];
+    hookOutcomes: never[];
+} | {
     service: ServiceOutcome;
     forgotPhrase: boolean;
     retention: {
@@ -74,4 +117,6 @@ export declare function disableAutopilot(dataDir: string, options?: AutopilotOpt
         deleteAfterDays?: number | null;
     };
     archivesKept: boolean;
+    hooksRemoved: import("./adapters.js").AgentId[];
+    hookOutcomes: import("./adapters.js").HookRemoveOutcome[];
 }>;

package/dist/src/autopilot.js

@@ -1,29 +1,81 @@
 import { resolveSyncRules, applySyncRules, describeSyncRules } from "./sync-rules.js";
-import { detectAgents, findTranscripts } from "./adapters.js";
+import { detectAgents, findTranscripts, installAgentHooks, removeOwnedAgentHooks } from "./adapters.js";
 import { fail } from "./errors.js";
 import { setupVault } from "./onboarding.js";
 import { ArchiveQueue } from "./queue.js";
 import { retentionSettings, setRetentionPolicy } from "./retention.js";
 import { forgetRecoveryPhrase, rememberRecoveryPhrase, resolveRecoveryPhrase } from "./secrets.js";
-import { daemonInvocation, installService, serviceStatus, servicePlan, serviceUnitEnvironment, uninstallService } from "./service.js";
+import { daemonInvocation, installService, reconcileInstalledService, serviceStatus, servicePlan, serviceUnitEnvironment, uninstallService } from "./service.js";
 import { readConfig } from "./vault.js";
 import { liveness, readHeartbeat } from "./heartbeat.js";
+import { uiRuntimeStatus } from "./ui-server.js";
+import { readLocalSettings, writeLocalSettings } from "./machine-settings.js";
 const DEFAULTS = { olderThanDays: 30, graceDays: 7 };
+const policyCanReclaim = (policy) => policy === "archive-and-reclaim" || policy === "manual-approval";
+/**
+ * Keep a non-reclaim retention policy and the machine that executes it in sync.
+ *
+ * Retention timing lives in the vault config, while unattended deletion is a
+ * separate, machine-local permission and an installed service also remembers
+ * its invocation. Changing only the policy is safe today, but leaves enough
+ * stale state for a later policy edit or older service generation to resume
+ * deletion without a new machine opt-in. Revoke that permission and rewrite an
+ * already-installed service receipt, preserving the schedule and every other
+ * local setting. A reclaim-capable policy deliberately grants nothing here.
+ */
+export async function reconcileMachineRetentionPolicy(dataDir, policy, options = {}) {
+    const local = await readLocalSettings(dataDir);
+    if (policyCanReclaim(policy)) {
+        return { reclaimPermissionRevoked: false, serviceInstalled: false, serviceReconciled: false };
+    }
+    const reclaimPermissionRevoked = local.reclaimEnabled;
+    if (reclaimPermissionRevoked) {
+        await writeLocalSettings(dataDir, { ...local, reclaimEnabled: false });
+    }
+    const invocation = daemonInvocation(dataDir, {
+        reclaim: false,
+        cliPath: options.cliPath,
+        intervalSeconds: local.schedule.intervalMinutes * 60,
+    });
+    const serviceOptions = {
+        dataDir,
+        executable: invocation.executable,
+        args: invocation.args,
+        home: options.home,
+        platform: options.platform,
+        exec: options.exec,
+        environment: serviceUnitEnvironment(),
+    };
+    const installed = await serviceStatus(serviceOptions);
+    if (!installed.installed) {
+        return { reclaimPermissionRevoked, serviceInstalled: false, serviceReconciled: false };
+    }
+    const serviceReconciled = await reconcileInstalledService(serviceOptions);
+    if (!serviceReconciled) {
+        fail("internal", "Automatic reclaim is off, but the installed Sealkeep service could not be updated. Run `sealkeep autopilot` to repair it before turning reclaim on again.");
+    }
+    return { reclaimPermissionRevoked, serviceInstalled: true, serviceReconciled };
+}
 /**
  * Turns Sealkeep into something that runs itself.
  *
- * One call sets up the vault, teaches this machine to unlock it, picks a retention
- * policy, sweeps up the sessions already on disk, and installs a login service. The
- * safety gates are unchanged: reclamation still requires a verified remote copy, an
- * idle file, and an elapsed grace period, so enabling it here cannot delete anything
- * until a bucket is configured and an upload has been checked.
+ * One call sets up the vault, teaches this machine to unlock it, sweeps up the
+ * sessions already on disk, and installs a login service. Preservation, indexing,
+ * and uploads are automatic. Reclaim is a separate standing permission: it is off
+ * on a fresh machine and is enabled only by an explicit option or an already-saved
+ * machine choice. Even then, the ordinary remote, search, identity, age, grace and
+ * liveness gates remain mandatory.
  */
 export async function enableAutopilot(dataDir, options = {}) {
     const notes = [];
     const remember = options.remember !== false;
-    const reclaim = options.reclaim !== false;
-    const setup = await setupVault(dataDir, options.phrase);
+    const setup = await setupVault(dataDir, options.phrase, {
+        home: options.home,
+        mcpExec: options.mcpExec ?? options.exec
+    });
     const config = await readConfig(dataDir);
+    const localSettings = await readLocalSettings(dataDir);
+    const reclaim = options.reclaim ?? localSettings.reclaimEnabled;
     const phrase = setup.recoveryPhrase ?? (await resolveRecoveryPhrase(dataDir, config.vaultId, options.phrase, process.env, options.backend));
     if (!phrase) {
         fail("recovery_phrase_missing", "This vault already exists and its phrase is not on this machine. Re-run with --recovery-phrase so the service can unlock it.", { dataDir });
@@ -40,13 +92,45 @@ export async function enableAutopilot(dataDir, options = {}) {
     else if (!remember) {
         notes.push("The phrase was not stored. Put SEALKEEP_RECOVERY_PHRASE in the service environment yourself, or sessions will queue up unsealed.");
     }
-    const desired = { policy: reclaim ? "archive-and-reclaim" : "sync-only", olderThanDays: options.olderThanDays ?? DEFAULTS.olderThanDays, graceDays: options.graceDays ?? DEFAULTS.graceDays };
+    const currentRetention = retentionSettings(config);
+    const currentPolicyCanReclaim = policyCanReclaim(currentRetention.policy);
+    // Keep an existing policy (including manual approval) across an upgrade. A
+    // fresh vault has no saved policy, so its useful non-destructive mode is
+    // sync-only: archive/index/upload automatically while originals remain.
+    const policy = reclaim
+        ? currentPolicyCanReclaim ? currentRetention.policy : "archive-and-reclaim"
+        : config.retention?.policy ?? "sync-only";
+    const desired = {
+        policy,
+        olderThanDays: options.olderThanDays ?? config.retention?.olderThanDays ?? DEFAULTS.olderThanDays,
+        graceDays: options.graceDays ?? config.retention?.graceDays ?? DEFAULTS.graceDays,
+    };
     // A vault written before archive lifecycle existed has no deleteAfterDays; absent means never.
     const stored = options.dryRun ? undefined : (await setRetentionPolicy(dataDir, desired)).retention;
     const retention = retentionSettings(config, { ...desired, ...stored });
+    // The native service reads this setting on every pass. Persist the effective
+    // choice even when it is the fresh false default, so its behavior, generated
+    // unit, status JSON, and the Settings page all describe the same permission.
+    if (!options.dryRun) {
+        await writeLocalSettings(dataDir, { ...localSettings, reclaimEnabled: reclaim });
+    }
     const installs = await detectAgents(options.home);
     const detected = installs.filter((install) => install.detected);
-    const found = (await Promise.all(detected.map((install) => findTranscripts(install.agent, options.home, 500)))).flat();
+    const found = (await Promise.all(detected.map((install) => findTranscripts(install.agent, options.home)))).flat();
+    // `autopilot` is the explicit one-time request for unattended behavior. A
+    // fresh CLI setup that installed only the watcher service used to preserve
+    // sessions but never inject their memory into the agent. Install both halves
+    // here; an existing hook is reconciled idempotently and custom hooks survive.
+    const hookOutcomes = options.dryRun
+        ? []
+        : await installAgentHooks(detected.map((install) => install.agent), { dataDir, home: options.home });
+    const hooks = options.dryRun
+        ? detected.map((install) => install.agent)
+        : hookOutcomes.filter((outcome) => outcome.installed).map((outcome) => outcome.agent);
+    for (const outcome of hookOutcomes) {
+        if (!outcome.installed && outcome.reason)
+            notes.push(`${outcome.agent} hooks were not installed: ${outcome.reason}`);
+    }
     // What leaves this machine is decided here, before anything is read or sealed.
     const { rules, source } = await resolveSyncRules(dataDir);
     const { included, heldBack } = applySyncRules(found, rules);
@@ -68,10 +152,9 @@ export async function enableAutopilot(dataDir, options = {}) {
     // telling it to run `storage configure` sends a paying customer to set up
     // storage they are already paying us to run.
     //
-    // Resolved before the service is written, because the service definition
-    // depends on it: a machine with somewhere to upload needs the daemon to have
-    // uploads enabled, and a service manager starts the daemon with a bare
-    // environment rather than inheriting the shell that installed it.
+    // This remains useful setup/status truth, but it does not decide whether the
+    // service is upload-capable. A target connected tomorrow must be picked up by
+    // the already-running daemon without reinstalling or restarting it.
     let managedEmail = null;
     if (!config.remoteStorage) {
         try {
@@ -81,15 +164,17 @@ export async function enableAutopilot(dataDir, options = {}) {
         catch { /* not signed in */ }
     }
     const hasRemoteTarget = Boolean(config.remoteStorage) || managedEmail !== null;
-    const invocation = daemonInvocation(dataDir, { reclaim, cliPath: options.cliPath });
+    const invocation = daemonInvocation(dataDir, {
+        reclaim,
+        cliPath: options.cliPath,
+        intervalSeconds: localSettings.schedule.intervalMinutes * 60,
+    });
     const serviceOptions = {
         dataDir, executable: invocation.executable, args: invocation.args,
         home: options.home, platform: options.platform, exec: options.exec,
-        // Installing autopilot against a configured target is the opt-in. Without
-        // this the daemon takes the "uploads are disabled" branch on every tick,
-        // and since reclaiming requires a verified remote copy, it also never frees
-        // a byte — the one thing the user installed it to do.
-        environment: serviceUnitEnvironment(hasRemoteTarget ? { SEALKEEP_ENABLE_SIGNER: "1" } : {})
+        // Automatic service ownership is the upload opt-in. Targets and credentials
+        // still fail closed, but connecting them later requires no service rewrite.
+        environment: serviceUnitEnvironment()
     };
     const service = options.dryRun
         ? { kind: servicePlan(serviceOptions).kind, installed: false, path: servicePlan(serviceOptions).path, ranCommands: [], note: "dry run: nothing was installed" }
@@ -106,6 +191,7 @@ export async function enableAutopilot(dataDir, options = {}) {
         retention,
         service,
         agents: detected.map((install) => install.agent),
+        hooks,
         found: { sessions: found.length, bytes: found.reduce((total, candidate) => total + candidate.bytes, 0) },
         queued,
         reclaimEnabled: reclaim,
@@ -115,16 +201,32 @@ export async function enableAutopilot(dataDir, options = {}) {
 }
 export async function autopilotStatus(dataDir, options = {}) {
     const config = await readConfig(dataDir);
+    let hasRemoteTarget = Boolean(config.remoteStorage) || Boolean(config.storageTargets?.length);
+    if (!hasRemoteTarget) {
+        try {
+            const { accountStatus } = await import("./cloud.js");
+            hasRemoteTarget = Boolean((await accountStatus(dataDir))?.email);
+        }
+        catch { /* not signed in to managed storage */ }
+    }
     const invocation = daemonInvocation(dataDir, { cliPath: options.cliPath });
     const service = await serviceStatus({ dataDir, executable: invocation.executable, args: invocation.args, home: options.home, platform: options.platform, exec: options.exec });
+    const [phraseAvailable, queue, ui, localSettings] = await Promise.all([
+        resolveRecoveryPhrase(dataDir, config.vaultId, undefined, process.env, options.backend).then((phrase) => phrase !== null),
+        new ArchiveQueue(dataDir).stats(),
+        uiRuntimeStatus(dataDir),
+        readLocalSettings(dataDir),
+    ]);
     return {
         running: service.present,
         live: liveness(await readHeartbeat(dataDir)),
         service,
-        phraseAvailable: (await resolveRecoveryPhrase(dataDir, config.vaultId, undefined, process.env, options.backend)) !== null,
+        phraseAvailable,
+        reclaimEnabled: localSettings.reclaimEnabled,
         retention: retentionSettings(config),
-        hasRemoteTarget: Boolean(config.remoteStorage),
-        queue: await new ArchiveQueue(dataDir).stats()
+        hasRemoteTarget,
+        queue,
+        ui,
     };
 }
 /**
@@ -135,6 +237,19 @@ export async function disableAutopilot(dataDir, options = {}) {
     const config = await readConfig(dataDir);
     const invocation = daemonInvocation(dataDir, { cliPath: options.cliPath });
     const service = await uninstallService({ dataDir, executable: invocation.executable, args: invocation.args, home: options.home, platform: options.platform, exec: options.exec });
+    if (service.installed) {
+        // A failed native stop is not "off". Keep every dependency the still-live
+        // daemon needs, including its remembered phrase and hooks, so a retry is
+        // safe and the status remains actionable.
+        return {
+            service,
+            forgotPhrase: false,
+            retention: retentionSettings(config),
+            archivesKept: true,
+            hooksRemoved: [],
+            hookOutcomes: [],
+        };
+    }
     let forgot = false;
     if (options.remember !== false) {
         try {
@@ -144,5 +259,8 @@ export async function disableAutopilot(dataDir, options = {}) {
         catch { /* nothing stored */ }
     }
     const retention = (await setRetentionPolicy(dataDir, { policy: "local-only" })).retention;
-    return { service, forgotPhrase: forgot, retention, archivesKept: true };
+    const localSettings = await readLocalSettings(dataDir);
+    await writeLocalSettings(dataDir, { ...localSettings, reclaimEnabled: false });
+    const hookOutcomes = await removeOwnedAgentHooks({ home: options.home });
+    return { service, forgotPhrase: forgot, retention, archivesKept: true, hooksRemoved: hookOutcomes.filter((outcome) => outcome.removed).map((outcome) => outcome.agent), hookOutcomes };
 }