sealkeep 0.9.0 → 0.11.0

package/dist/src/mcp.js

@@ -1,60 +1,329 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { archiveFile, defaultDataDir, listArchives, previewRetention, vaultStatus } from "./vault.js";
+import { archiveFile, defaultDataDir, listArchives, previewRetention, readConfig, vaultStatus } from "./vault.js";
 import { restoreArchive } from "./restore.js";
 import { providers } from "./control-plane.js";
 import { envVar } from "./env.js";
+import { search } from "./search.js";
+import { watchOnce, publishOnce, defaultMirrorPath, publishBridgeMessage, pullBridgeMessages, drainPending, promptInjection } from "./bridge.js";
+import { readFile } from "node:fs/promises";
+import { readContext } from "./context-reader.js";
+import { resolveMcpWorkspace } from "./mcp-workspace.js";
+const sourceSchema = z.object({
+    version: z.literal(1), archiveId: z.string().uuid(), envelopeArchiveId: z.string().uuid(),
+    sourceSha256: z.string().regex(/^[a-f0-9]{64}$/i), sourceBytes: z.number().int().nonnegative(),
+    ciphertextSha256: z.string().regex(/^[a-f0-9]{64}$/i), project: z.string().optional(),
+    projectKey: z.string().optional(), spaceKey: z.string().optional(),
+});
 const dataDir = envVar("DATA_DIR") ?? defaultDataDir();
-const phrase = envVar("RECOVERY_PHRASE");
-const server = new McpServer({ name: "vaultline", version: "0.1.0" });
-function text(value) { return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] }; }
-function requirePhrase() { if (!phrase)
-    throw new Error("SEALKEEP_RECOVERY_PHRASE is required for archive and recovery actions"); return phrase; }
-server.registerTool("vaultline_status", {
+/**
+ * The phrase, from the env var or from this machine's keystore.
+ *
+ * Reading ONLY the env var meant an agent's search was metadata-only forever
+ * unless the person pasted their recovery phrase in plaintext into the
+ * agent's MCP config — the exact place a phrase must not live. The CLI's own
+ * commands already resolve env-then-keystore; the MCP now resolves the same
+ * way, so a vault that "seals on its own" also searches on its own.
+ */
+let phrasePromise = null;
+function phraseAvailable() {
+    phrasePromise ??= (async () => {
+        const fromEnv = envVar("RECOVERY_PHRASE");
+        if (fromEnv)
+            return fromEnv;
+        try {
+            const { readConfig } = await import("./vault.js");
+            const { resolveRecoveryPhrase } = await import("./secrets.js");
+            const { vaultId } = await readConfig(dataDir);
+            return (await resolveRecoveryPhrase(dataDir, vaultId)) ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    return phrasePromise;
+}
+const server = new McpServer({ name: "sealkeep", version: "0.1.0" });
+function text(value, compact = false) { return { content: [{ type: "text", text: JSON.stringify(value, null, compact ? undefined : 2) }] }; }
+const PROJECT_KEY_RE = /^(?:g1|p1):[a-f0-9]{64}$/;
+/** A confirmed checkout can name its team before it has any local archives.
+ * Labels remain hints, never a reason to union distinct stable identities. */
+async function resolveProject(project, projectKey) {
+    const records = project ? await listArchives(dataDir) : [];
+    if (projectKey && !project) {
+        return { records, note: "projectKey must be paired with its display project" };
+    }
+    if (!project || projectKey)
+        return { records, projectKey };
+    const config = await readConfig(dataDir);
+    const matchingKeys = new Set(records.flatMap((record) => record.version === 2
+        && record.source.project === project && record.source.projectKey ? [record.source.projectKey] : []));
+    for (const [key, binding] of Object.entries(config.teamSpaces ?? {})) {
+        if (PROJECT_KEY_RE.test(key) && binding.localConfirmed === true && binding.localProject === project) {
+            matchingKeys.add(key);
+        }
+    }
+    if (matchingKeys.size > 1) {
+        return { records, note: `More than one stable project is named ${project}; supply projectKey so their memories are not combined.` };
+    }
+    const exactProjectKey = [...matchingKeys][0];
+    const unconfirmedBinding = Object.entries(config.teamSpaces ?? {}).some(([key, binding]) => binding.localConfirmed !== true && (key === project || binding.localProject === project));
+    if (!exactProjectKey && unconfirmedBinding) {
+        return { records, note: `No locally confirmed project identity for ${project}; supply project and projectKey from a confirmed checkout.` };
+    }
+    // No binding evidence is not a refusal: a fresh personal device can have a
+    // readable account index without any local archive records or team config.
+    return { records, projectKey: exactProjectKey };
+}
+async function defaultWorkspace(project, projectKey, scope) {
+    if (project || projectKey)
+        return { project, projectKey };
+    if (scope === "account")
+        return { project, projectKey };
+    const config = await readConfig(dataDir);
+    const bindings = config.teamSpaces ?? {};
+    // A confirmed team project is the ONLY thing that makes an unqualified search
+    // ambiguous: which member's project did the agent mean? With none, this is a
+    // personal vault, and its own account history is unambiguously the answer.
+    // Returning the "resolve a project first" note here instead handed an empty
+    // result to the single most important question — "what did I decide before" —
+    // which reads exactly like "you never discussed that", the failure the phrase
+    // path exists to prevent. So default to account scope unless a real team
+    // project could be confused for another.
+    const hasConfirmedProject = Object.entries(bindings).some(([key, binding]) => /^(g1|p1):[a-f0-9]{64}$/.test(key) && binding.localConfirmed && Boolean(binding.localProject));
+    if (!hasConfirmedProject)
+        return { project: undefined, projectKey: undefined };
+    let roots;
+    if (server.server.getClientCapabilities()?.roots) {
+        // Capability advertised but failed/empty roots is not permission to use a
+        // possibly unrelated process directory. Ask for an explicit scope instead.
+        roots = await server.server.listRoots(undefined, { timeout: 2000 }).then((result) => result.roots, () => []);
+    }
+    return resolveMcpWorkspace({ roots, cwd: process.cwd(), bindings });
+}
+async function requirePhrase() {
+    const phrase = await phraseAvailable();
+    if (!phrase)
+        throw new Error("No recovery phrase: set SEALKEEP_RECOVERY_PHRASE, or store the phrase in this machine's keystore (Settings → remember, or `sealkeep autopilot`)");
+    return phrase;
+}
+/** Registers one tool under one name. */
+function registerTool(name, config, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+handler) {
+    server.registerTool(name, config, handler);
+}
+registerTool("sealkeep_status", {
     title: "Sealkeep status",
     description: "Read local Sealkeep health, archive count, and encrypted storage usage. No session content is returned.",
     inputSchema: {}
 }, async () => text(await vaultStatus(dataDir)));
-server.registerTool("vaultline_search", {
+/**
+ * The one tool that justifies an agent having this server at all.
+ *
+ * It used to substring-match the archive id, the source path and the agent
+ * name — which, for a Codex rollout named `rollout-<timestamp>-<uuid>.jsonl`,
+ * means an agent could search its own history for a date or a UUID it has no
+ * way of knowing. Nothing it would actually ask for could ever match. The
+ * capability existed the whole time in the CLI; it was simply never wired to
+ * the surface where an agent could reach it.
+ *
+ * Content mode decrypts locally, needs the recovery phrase, and is the
+ * default when one is available — because "what did I decide about retention
+ * last week" is the question, and metadata cannot answer it. Without a phrase
+ * it degrades to the old metadata match and says so, rather than returning an
+ * empty list that reads like "you never discussed that".
+ */
+registerTool("sealkeep_search", {
     title: "Search archived sessions",
-    description: "Searches local encrypted archive metadata. It returns identifiers and source metadata, never decrypts transcript contents.",
-    inputSchema: { query: z.string().min(1).max(200), agent: z.string().optional() }
-}, async ({ query, agent }) => {
-    const normalized = query.toLowerCase();
-    const matches = (await listArchives(dataDir)).filter((item) => (!agent || item.source.agent === agent) && `${item.id} ${item.source.path} ${item.source.agent}`.toLowerCase().includes(normalized));
-    return text(matches.map(({ id, createdAt, source }) => ({ id, createdAt, agent: source.agent, path: source.path, bytes: source.bytes })));
-});
-server.registerTool("vaultline_prepare_archive", {
+    description: "Searches archived sessions and returns matching quotes plus immutable source/context references. To understand a found decision, pass the hit's context object to sealkeep_read_context; it expands the source, user prompt and neighboring messages without repeated searches. With no recovery phrase, only metadata is searched. Decryption is local.",
+    inputSchema: {
+        query: z.string().min(1).max(200),
+        agent: z.string().optional(),
+        archiveId: z.string().uuid().optional()
+            .describe("Search only one immutable archive snapshot. This remains available for callers that already know an archive id."),
+        sessionId: z.string().uuid().optional()
+            .describe("Search every preserved snapshot of this exact Codex session; resume pointers supply it automatically."),
+        project: z.string().optional().describe("Explicit project override. Otherwise resolve the current client workspace to its confirmed stable project."),
+        scope: z.enum(["workspace", "account"]).optional().describe("Default workspace. Use account only to explicitly search across personal account history without a project filter."),
+        projectKey: z.string().regex(/^(?:g1|p1):[a-f0-9]{64}$/).optional()
+            .describe("Stable project ref supplied by Sealkeep context; use with project when same-named folders exist."),
+        mode: z.enum(["content", "metadata"]).optional()
+    }
+}, async ({ query, agent, archiveId, sessionId, project, projectKey, mode, scope }) => {
+    const phrase = await phraseAvailable();
+    const wanted = mode ?? (phrase ? "content" : "metadata");
+    const workspace = await defaultWorkspace(project, projectKey, scope);
+    if ("note" in workspace)
+        return text({ mode: wanted, ...workspace, hits: [] });
+    ({ project, projectKey } = workspace);
+    const resolved = await resolveProject(project, projectKey);
+    if (resolved.note)
+        return text({ mode: wanted, note: resolved.note, hits: [] });
+    const { records, projectKey: exactProjectKey } = resolved;
+    if (wanted === "metadata" || !phrase) {
+        const hits = await search(dataDir, query, {
+            mode: "metadata",
+            ...(agent ? { agent } : {}),
+            ...(archiveId ? { archiveId } : {}),
+            ...(sessionId ? { sessionId } : {}),
+        });
+        const scoped = exactProjectKey
+            ? hits.filter((hit) => records.some((record) => record.id === hit.id && record.version === 2 && record.source.projectKey === exactProjectKey))
+            : project
+                ? hits.filter((hit) => records.some((record) => record.id === hit.id && record.version === 2
+                    && !record.source.projectKey && record.source.project === project))
+                : hits;
+        return text({
+            mode: "metadata",
+            ...(!phrase ? { note: "No recovery phrase on this machine: store it in the keystore (Settings → remember) or set SEALKEEP_RECOVERY_PHRASE; matched on file metadata only." } : {}),
+            hits: scoped,
+        });
+    }
+    const hits = await search(dataDir, query, {
+        mode: wanted,
+        ...(phrase ? { phrase } : {}),
+        ...(agent ? { agent } : {}),
+        ...(archiveId ? { archiveId } : {}),
+        ...(sessionId ? { sessionId } : {}),
+        ...(project ? { project } : {}),
+        ...(exactProjectKey ? { projectKey: exactProjectKey } : {}),
+    });
+    return text({ mode: wanted, hits, next: "Pass a hit's context object to sealkeep_read_context to read its decision and surrounding messages." });
+});
+registerTool("sealkeep_read_context", {
+    title: "Read context around a search result",
+    description: "Pass a search hit's context object to read its immutable source passage, actual user prompt when available, nearby messages and tool relationships. Follow the returned continuation as cursor with the same source to read more. Each call checks current Team access and enforces transfer, decompression and response budgets. This is a local read; it writes no restored transcript.",
+    inputSchema: {
+        source: sourceSchema, query: z.string().max(200).optional(),
+        byteStart: z.number().int().nonnegative().optional(), chunkIndex: z.number().int().nonnegative().optional(),
+        cursor: z.object({ sourceSha256: z.string().regex(/^[a-f0-9]{64}$/i), byteStart: z.number().int().nonnegative(), textOffset: z.number().int().nonnegative().optional() }).optional(),
+        maxTokens: z.number().int().min(2048).max(32768).optional().describe("Default 8192. Conservative UTF-8 byte ceiling for the complete JSON response, including provenance and continuation; this safely bounds text tokens."),
+        maxWireBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional().describe("Default 8 MiB. Aggregate encrypted index and archive payload transfers; small authorization responses are excluded. The buffered index must also fit this ceiling even when cached."),
+        maxDecodedBytes: z.number().int().min(1).max(64 * 1024 * 1024).optional().describe("Default 16 MiB. Aggregate decoded index/source-facts plus source/dependency bytes, including chunk padding and rejected cache decode attempts. Team source-facts cache hits decode only generation-bound facts after current head/access checks; a miss verifies the whole checkpoint. index_budget_exceeded means checkpoint work exceeds the budget, not that the cited passage is absent."),
+        neighboringMessages: z.number().int().min(0).max(12).optional(),
+    }, annotations: { readOnlyHint: true },
+}, async (args) => text(await readContext(dataDir, await requirePhrase(), { ...args, signal: AbortSignal.timeout(30_000) }), true));
+registerTool("sealkeep_prepare_archive", {
     title: "Archive a session",
     description: "Encrypts and queues a local transcript for archive. The transcript is encrypted before it reaches any storage provider.",
     inputSchema: { path: z.string().min(1), agent: z.string().default("custom") },
     annotations: { destructiveHint: false }
-}, async ({ path, agent }) => text(await archiveFile(dataDir, path, requirePhrase(), agent)));
-server.registerTool("vaultline_recover", {
+}, async ({ path, agent }) => text(await archiveFile(dataDir, path, await requirePhrase(), agent, { indexInline: true })));
+registerTool("sealkeep_recover", {
     title: "Recover an archived session",
-    description: "Decrypts one selected archive into a destination path on this device. This is a local action. It refuses to overwrite an existing file unless the caller explicitly chooses backup or replace.",
+    description: "Dry-run by default: reports the archive, byte count, and destination a restore WOULD produce, writing nothing — pass dryRun: false to actually decrypt into the destination path. For a Team result, include the search hit's source reference or its project/projectKey. Team restores currently support up to 64 MiB of transferred and decoded bytes; larger sources report an explicit unsupported limit. Use sealkeep_read_context for a bounded reading without restoring a file. Existing files are refused by default; backup/replace retains the displaced inode.",
     inputSchema: {
         archiveId: z.string().uuid(),
+        source: sourceSchema.optional(), project: z.string().optional(), projectKey: z.string().optional(),
         destination: z.string().min(1).optional(),
         native: z.boolean().default(false).describe("Restore to the adapter's original transcript path instead of a chosen destination"),
-        overwrite: z.enum(["refuse", "backup", "replace"]).default("refuse")
+        overwrite: z.enum(["refuse", "backup", "replace"]).default("refuse"),
+        dryRun: z.boolean().default(true).describe("Preview only (the default): nothing is written. Pass false to perform the restore.")
     },
     annotations: { destructiveHint: true }
-}, async ({ archiveId, destination, native, overwrite }) => {
-    const outcome = await restoreArchive(dataDir, archiveId, requirePhrase(), { destination, native, overwrite });
-    return text({ archiveId: outcome.record.id, output: outcome.output, bytes: outcome.bytes, native: outcome.native, backupPath: outcome.backupPath });
+}, async ({ archiveId, source, project, projectKey, destination, native, overwrite, dryRun }) => {
+    const outcome = await restoreArchive(dataDir, archiveId, await requirePhrase(), { source, project, projectKey, destination, native, overwrite, dryRun });
+    return text({
+        archiveId: outcome.record.id, output: outcome.output, bytes: outcome.bytes, native: outcome.native, backupPath: outcome.backupPath,
+        ...(outcome.dryRun ? {
+            dryRun: true,
+            ...(outcome.destinationExists !== undefined ? { destinationExists: outcome.destinationExists } : {}),
+            note: "Preview only — nothing was written. Call again with dryRun: false to restore.",
+        } : {}),
+    });
 });
-server.registerTool("vaultline_create_upload", {
+registerTool("sealkeep_create_upload", {
     title: "Get upload lease status",
     description: "Reports the storage lease mechanism used by Sealkeep. In the local MVP provider, no remote URL is necessary; the future hosted control plane returns a short-lived, object-scoped signed URL.",
+    // "vaultline" here is the built-in local storage provider's wire identifier, not the product
+    // name — every archive record and lease already on disk says "vaultline", so this id does not change.
     inputSchema: { provider: z.enum(["vaultline", "s3", "r2", "gcs"]).default("vaultline"), bucket: z.string().min(1), prefix: z.string().min(1), ciphertextSha256: z.string().regex(/^[a-f0-9]{64}$/), bytes: z.number().int().positive() }
 }, async ({ provider, bucket, prefix, ciphertextSha256, bytes }) => text(providers[provider].createUploadLease({ provider: provider, bucket, prefix }, { ciphertextSha256, bytes })));
-server.registerTool("vaultline_retention_preview", {
+registerTool("sealkeep_retention_preview", {
     title: "Preview local session reclamation",
     description: "Lists old source transcripts that could eventually be reclaimed. This is read-only and always preserves sources until a verified remote archive exists.",
     inputSchema: { olderThanDays: z.number().min(0).default(30) },
     annotations: { readOnlyHint: true }
 }, async ({ olderThanDays }) => text(await previewRetention(dataDir, olderThanDays)));
+/**
+ * Realtime Bridge — the tools that let a member's OWN agent follow a shared
+ * session live. `sealkeep_bridge_watch` advances this machine's mirror of a
+ * channel and hands back the freshly-arrived lines, so an agent can reason
+ * about a colleague's ongoing session ("what has Paul's run concluded so far?")
+ * while it is still running. `sealkeep_bridge_publish_pass` is the driver-side
+ * counterpart for a companion that wants to push the next delta by hand.
+ *
+ * Read-only over the session: neither tool can drive another person's agent.
+ * See docs/realtime-bridge.md for the scope ladder.
+ */
+registerTool("sealkeep_bridge_watch", {
+    title: "Follow a shared session (bridge)",
+    description: "Pulls any new sealed deltas of a live bridge channel, verifies the hash chain, and appends them to this machine's local mirror. Returns the mirror path and the newly-arrived text so your agent can follow a colleague's ongoing session. Needs the recovery phrase to unseal; content is decrypted locally.",
+    inputSchema: { channel: z.string().regex(/^[A-Za-z0-9-]{1,64}$/), fromSeq: z.number().int().min(0).default(0) },
+    annotations: { readOnlyHint: true }
+}, async ({ channel, fromSeq }) => {
+    const phrase = await requirePhrase();
+    const mirrorPath = defaultMirrorPath(dataDir, channel);
+    const before = await readFile(mirrorPath).then((b) => b.length).catch(() => 0);
+    const result = await watchOnce(dataDir, { channel, fromSeq, mirrorPath }, phrase);
+    const after = await readFile(mirrorPath).catch(() => Buffer.alloc(0));
+    const fresh = after.subarray(before).toString("utf8");
+    return text({ channel, mirrorPath, applied: result.applied, nextSeq: result.nextSeq, gaps: result.gaps, needsReset: result.needsReset, newText: fresh });
+});
+registerTool("sealkeep_bridge_publish_pass", {
+    title: "Publish the next bridge delta (driver)",
+    description: "Driver side: seals the bytes a session file has grown by since a given offset and pushes them as the next delta on a bridge channel. Returns the new high-water offset to pass next time. The transcript is sealed on this machine before anything leaves it.",
+    inputSchema: { channel: z.string().regex(/^[A-Za-z0-9-]{1,64}$/), sessionPath: z.string().min(1), seq: z.number().int().min(0), fromByte: z.number().int().min(0).default(0) }
+}, async ({ channel, sessionPath, seq, fromByte }) => {
+    const phrase = await requirePhrase();
+    const outcome = await publishOnce(dataDir, { channel, seq, sessionPath, fromByte }, phrase);
+    return text(outcome ? { published: outcome.ref, seq: outcome.seq, newHighWater: outcome.newHighWater } : { published: null, note: "Nothing new since fromByte." });
+});
+registerTool("sealkeep_team", {
+    title: "Who is working on what right now",
+    description: "The team awareness feed git lacks: who STARTED what (and has not finished), plus recent finished lines. Call this before taking a task that might overlap a teammate's work — if someone is already on it, coordinate instead of doubling the effort. Presence events are one sealed line each, published by launches and by active-mode seals.",
+    inputSchema: {
+        project: z.string().optional(),
+        scope: z.enum(["workspace", "account"]).optional(),
+        projectKey: z.string().regex(PROJECT_KEY_RE).optional()
+            .describe("Stable project ref; pair with project to distinguish same-named checkouts."),
+    },
+    annotations: { readOnlyHint: true }
+}, async ({ project, projectKey, scope }) => {
+    const phrase = await requirePhrase();
+    const workspace = await defaultWorkspace(project, projectKey, scope);
+    if ("note" in workspace)
+        return text({ activeNow: [], recent: [], ...workspace });
+    ({ project, projectKey } = workspace);
+    const resolved = await resolveProject(project, projectKey);
+    if (resolved.note)
+        return text({ activeNow: [], recent: [], note: resolved.note });
+    const { listPresence, activeNow } = await import("./presence.js");
+    const events = await listPresence(dataDir, phrase, { project, projectKey: resolved.projectKey, limit: 25 });
+    return text({ activeNow: activeNow(events), recent: events.slice(0, 12) });
+});
+registerTool("sealkeep_bridge_push", {
+    title: "Speak into a shared bridge channel",
+    description: "Sends a labeled message to every member of a live bridge channel — the collaboration write-path (anthropics/claude-code#60082): a follower's suggestion reaches the driver's agent on its next turn. Sealed on this machine before it leaves; kinds: suggest, note, handoff.",
+    inputSchema: { channel: z.string().regex(/^[A-Za-z0-9-]{1,64}$/), message: z.string().min(1), kind: z.enum(["suggest", "note", "handoff"]).default("suggest") }
+}, async ({ channel, message, kind }) => {
+    const phrase = await requirePhrase();
+    const outcome = await publishBridgeMessage(dataDir, { channel, kind, text: message }, phrase);
+    return text({ pushed: outcome.ref, from: outcome.message.from, at: outcome.message.at });
+});
+registerTool("sealkeep_bridge_inbox", {
+    title: "Read teammates' bridge messages",
+    description: "Pulls new teammate messages on a bridge channel and returns the ones not yet delivered to this agent, oldest first, with a ready-to-use context block. This is the pull half of the collaboration lane — call it between tasks when following or driving a shared session (Codex drivers use this; Claude drivers usually get the same content injected by the UserPromptSubmit hook).",
+    inputSchema: { channel: z.string().regex(/^[A-Za-z0-9-]{1,64}$/) }
+}, async ({ channel }) => {
+    const phrase = await requirePhrase();
+    await pullBridgeMessages(dataDir, channel, phrase);
+    const pending = await drainPending(dataDir, channel);
+    const { pendingCount } = await import("./bridge.js");
+    const waiting = await pendingCount(dataDir, channel);
+    return text({ channel, messages: pending, stillWaiting: waiting, context: promptInjection(pending, waiting) || null });
+});
 const transport = new StdioServerTransport();
 server.connect(transport).catch((error) => { console.error(error); process.exit(1); });

package/dist/src/migrate.js

@@ -1,6 +1,6 @@
 import { readFile, rename, rm, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { decryptArchive as openEnvelope, encryptArchive as sealEnvelope, rewrapArchive } from "../packages/vaultline-crypto/src/index.js";
+import { decryptArchive as openEnvelope, encryptArchive as sealEnvelope, rewrapArchive } from "../packages/sealkeep-crypto/src/index.js";
 import { equalHex, matchesPhraseCheck, sha256 } from "./crypto.js";
 import { canonicalPhrase } from "./mnemonic.js";
 import { fail } from "./errors.js";
@@ -70,41 +70,47 @@ export async function rewrapVault(dataDir, rawPhrase, options = {}) {
     }
     if (!matchesPhraseCheck(config.recovery.phraseCheck, phrase))
         fail("recovery_phrase_mismatch", "Recovery phrase does not match this vault");
-    const recipients = configuredRecipients(config, phrase, { group: options.group, project: options.project });
     const records = await listArchives(dataDir);
     const rewrapped = [];
     const skipped = [];
     // Extending a project's membership must not touch archives of other
     // projects: rewrapping those would either add the member (leaking work they
     // were never given) or drop them (silently revoking elsewhere).
-    const projectOf = options.project
-        ? await (async () => {
-            const { claudeProjectFromPath, codexProjectFromRollout } = await import("./adapters.js");
-            return async (record) => {
-                try {
-                    if (record.source.agent === "claude")
-                        return claudeProjectFromPath(record.source.path).project;
-                    if (record.source.agent === "codex")
-                        return (await codexProjectFromRollout(record.source.path, record.createdAt)).project;
-                }
-                catch { /* unreadable project is not a match */ }
-                return null;
-            };
-        })()
-        : null;
+    const { projectOfRecord } = await import("./adapters.js");
+    /**
+     * Recipients are resolved PER RECORD, from that record's own project.
+     *
+     * One list computed for the whole vault dropped every project-scoped
+     * recipient the moment a rewrap ran without --project — which is the normal
+     * case, revoking an unrelated device or retiring a rotated phrase. Every
+     * project member then silently lost access to their project's existing
+     * archives, with a success message. The scoped-shard writer already resolved
+     * membership per project; this now does the same.
+     */
+    const recipientsFor = new Map();
+    const listFor = (project) => {
+        const key = project ?? "";
+        let list = recipientsFor.get(key);
+        if (!list) {
+            list = configuredRecipients(config, phrase, { group: options.group, ...(project ? { project } : {}) });
+            recipientsFor.set(key, list);
+        }
+        return list;
+    };
     for (const record of records) {
         if (!isV2(record)) {
             skipped.push({ id: record.id, reason: "v1 archive; run `sealkeep migrate` first" });
             continue;
         }
-        if (projectOf && await projectOf(record) !== options.project) {
+        const recordProject = await projectOfRecord(record).catch(() => null);
+        if (options.project && recordProject !== options.project) {
             skipped.push({ id: record.id, reason: `belongs to another project` });
             continue;
         }
-        const envelope = rewrapArchive(record.envelope, { phrase }, recipients);
+        const envelope = rewrapArchive(record.envelope, { phrase }, listFor(recordProject));
         await writeRecord(config.storage.root, { ...record, envelope });
         rewrapped.push(record.id);
     }
-    await recordAudit(dataDir, "archive.rewrap", "allowed", { rewrapped: rewrapped.length, skipped: skipped.length, recipients: recipients.length, group: options.group ?? null });
-    return { rewrapped: rewrapped.length, skipped, recipients: recipients.length };
+    await recordAudit(dataDir, "archive.rewrap", "allowed", { rewrapped: rewrapped.length, skipped: skipped.length, recipients: listFor(null).length, group: options.group ?? null });
+    return { rewrapped: rewrapped.length, skipped, recipients: listFor(null).length };
 }

package/dist/src/notify.d.ts

@@ -33,7 +33,7 @@ export type TickSummary = {
  * Decides whether a round of work is worth interrupting someone for.
  *
  * Routine sealing is not: it happens constantly and saying so would train people to
- * ignore the product. Reclaimed disk is, because a file moved. A failure is, because
+ * ignore the product. Reclaimed disk is, because local blocks were actually released. A failure is, because
  * it needs a decision.
  */
 export declare function summarize(tick: TickSummary): Notification | null;

package/dist/src/notify.js

@@ -53,7 +53,7 @@ function bytes(value) {
  * Decides whether a round of work is worth interrupting someone for.
  *
  * Routine sealing is not: it happens constantly and saying so would train people to
- * ignore the product. Reclaimed disk is, because a file moved. A failure is, because
+ * ignore the product. Reclaimed disk is, because local blocks were actually released. A failure is, because
  * it needs a decision.
  */
 export function summarize(tick) {
@@ -62,11 +62,11 @@ export function summarize(tick) {
     }
     if (tick.reclaimed > 0) {
         const freed = tick.freedBytes ? ` and freed ${bytes(tick.freedBytes)}` : "";
-        return { title: "Disk reclaimed", body: `Moved ${tick.reclaimed} archived session${tick.reclaimed === 1 ? "" : "s"} to the trash${freed}. The archives are safe.` };
-    }
-    if (tick.archived >= 5) {
-        return { title: "Sessions preserved", body: `Sealed ${tick.archived} agent sessions${tick.uploaded ? `, ${tick.uploaded} copied off this machine` : ""}.` };
+        return { title: "Disk reclaimed", body: `Freed the local originals for ${tick.reclaimed} archived session${tick.reclaimed === 1 ? "" : "s"}${freed}. Their verified encrypted archives remain stored.` };
     }
+    // Routine sealing never notifies. The docstring above says exactly that —
+    // "never for routine sealing, which would just train you to ignore it" — and
+    // a branch three lines below it fired on five ordinary seals anyway.
     return null;
 }
 /** Keeps a quiet period between notifications so a busy machine cannot spam. */