sealkeep 0.9.0 → 0.11.0

package/dist/src/onboarding.d.ts

@@ -1,4 +1,5 @@
 import { detectAgents } from "./adapters.js";
+import type { McpExec } from "./mcp-install.js";
 export type SetupResult = {
     initialized: boolean;
     vaultId: string;
@@ -6,5 +7,11 @@ export type SetupResult = {
     detectedAgents: Awaited<ReturnType<typeof detectAgents>>;
     files: string[];
 };
+export type SetupVaultOptions = {
+    /** Agent detection and agent-owned config writes are confined to this home. */
+    home?: string;
+    /** Test seam: setup may invoke `which`/`where` and an agent's own installer. */
+    mcpExec?: McpExec;
+};
 /** Creates only Sealkeep-owned artifacts. Agent settings are never modified. */
-export declare function setupVault(dataDir: string, providedPhrase?: string): Promise<SetupResult>;
+export declare function setupVault(dataDir: string, providedPhrase?: string, options?: SetupVaultOptions): Promise<SetupResult>;

package/dist/src/onboarding.js

@@ -12,7 +12,7 @@ catch {
 } }
 async function writeJson(path, value) { await mkdir(join(path, ".."), { recursive: true }); await writeFile(path, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 }); }
 /** Creates only Sealkeep-owned artifacts. Agent settings are never modified. */
-export async function setupVault(dataDir, providedPhrase) {
+export async function setupVault(dataDir, providedPhrase, options = {}) {
     const configPath = join(dataDir, "config.json");
     let initialized = false;
     let recoveryPhrase;
@@ -22,12 +22,12 @@ export async function setupVault(dataDir, providedPhrase) {
         recoveryPhrase = created.phrase;
     }
     const status = await vaultStatus(dataDir);
-    const detectedAgents = await detectAgents();
+    const detectedAgents = await detectAgents(options.home);
     const integrations = join(dataDir, "integrations");
     const files = [];
     for (const agent of ["codex", "claude"]) {
         const path = join(integrations, `${agent}-hooks.json`);
-        await writeJson(path, hookConfig(agent, "vaultline", dataDir));
+        await writeJson(path, hookConfig(agent, "sealkeep", dataDir));
         files.push(path);
     }
     // Written by `sealkeep mcp install`, which knows how to register with each
@@ -36,7 +36,7 @@ export async function setupVault(dataDir, providedPhrase) {
     // that install path was built, so anyone who merged it got an agent that
     // failed to start its server.
     const { installMcpServer } = await import("./mcp-install.js");
-    const mcp = await installMcpServer(dataDir);
+    const mcp = await installMcpServer(dataDir, { home: options.home, exec: options.mcpExec });
     for (const entry of mcp.agents)
         if (entry.fragmentPath)
             files.push(entry.fragmentPath);

package/dist/src/packages.d.ts

@@ -29,7 +29,7 @@
  * migration is what makes the top tier viable, not a cost optimisation.
  * See STORAGE.md.
  */
-export type PackageId = "free" | "pro_lite" | "gb100" | "gb500" | "gb2000";
+export type PackageId = "free" | "pro_lite" | "team" | "gb100" | "gb500" | "gb2000";
 export type StoragePackage = {
     id: PackageId;
     name: string;
@@ -114,7 +114,7 @@ export declare function quotaMessage(state: QuotaState): string;
 /**
  * Rewrites a bare quota rejection into something a customer can act on.
  *
- * `call()` in cloud.ts maps a 402 straight to a VaultlineError coded
+ * `call()` in cloud.ts maps a 402 straight to a SealkeepError coded
  * "forbidden" whose message is whatever the control plane said — historically
  * just "Quota exceeded", with no numbers and no next step. This asks the same
  * question `cloud status` would have answered in advance: where the account

package/dist/src/packages.js

@@ -9,13 +9,19 @@ export const PACKAGES = [
         id: "pro_lite", name: "Pro Lite", gigabytes: 0, monthly: 2, managed: false,
         blurb: "Your storage, our safety net: a sealed copy of your key in escrow, and every machine signed in. We still hold no bytes."
     },
+    {
+        // Priced per seat rather than per terabyte: a company on its own bucket
+        // consumes none of our storage and should not buy a tier it never touches.
+        id: "team", name: "Team", gigabytes: 0, monthly: 9, managed: false,
+        blurb: "Per seat. Org recovery, project-scoped access, revocation, and leaked-key monitoring across every machine. Storage priced separately, or bring your own bucket."
+    },
     {
         id: "gb100", name: "100 GB", gigabytes: 100, monthly: 6, managed: true,
         blurb: "Enough for years of transcripts on one machine. Nothing to create, nothing to configure."
     },
     {
         id: "gb500", name: "500 GB", gigabytes: 500, monthly: 12, managed: true,
-        blurb: "A whole team's history, or one machine that never deletes anything."
+        blurb: "Live team context, plus preserved history on every connected account."
     },
     {
         id: "gb2000", name: "2 TB", gigabytes: 2000, monthly: 30, managed: true,
@@ -39,6 +45,8 @@ export function quotaBytes(id) {
  * grandfathered grant should be reported honestly, not rounded into a tier.
  */
 export function packageForAccount(account) {
+    if (account.plan === "team")
+        return findPackage("team") ?? PACKAGES[0];
     if (account.plan === "pro_lite")
         return findPackage("pro_lite") ?? PACKAGES[0];
     if (account.plan !== "pro")
@@ -103,7 +111,7 @@ export function quotaMessage(state) {
 /**
  * Rewrites a bare quota rejection into something a customer can act on.
  *
- * `call()` in cloud.ts maps a 402 straight to a VaultlineError coded
+ * `call()` in cloud.ts maps a 402 straight to a SealkeepError coded
  * "forbidden" whose message is whatever the control plane said — historically
  * just "Quota exceeded", with no numbers and no next step. This asks the same
  * question `cloud status` would have answered in advance: where the account

package/dist/src/passkey.d.ts

@@ -23,4 +23,3 @@ export type PasskeyRecord = {
     /** The recipient this passkey opens, so the two can be removed together. */
     recipientId: string;
 };
-export declare function isPasskeyRecord(value: unknown): value is PasskeyRecord;

package/dist/src/passkey.js

@@ -1,6 +1,6 @@
 import { createPublicKey, hkdfSync, randomBytes } from "node:crypto";
 import { fail } from "./errors.js";
-import { x25519PrivateKeyFromRaw } from "../packages/vaultline-crypto/src/index.js";
+import { x25519PrivateKeyFromRaw } from "../packages/sealkeep-crypto/src/index.js";
 /**
  * Touch ID as a second way into a vault, built on the WebAuthn PRF extension.
  *
@@ -25,7 +25,7 @@ import { x25519PrivateKeyFromRaw } from "../packages/vaultline-crypto/src/index.
  * still exists.
  */
 /** Domain separation, so the same authenticator used elsewhere cannot collide with this. */
-const INFO = Buffer.from("vaultline-passkey-recipient:v1");
+const INFO = Buffer.from("sealkeep-passkey-recipient:v1");
 export const PRF_SECRET_BYTES = 32;
 /** A fresh per-vault salt, evaluated by the authenticator to produce the secret. */
 export function generatePrfSalt() {
@@ -47,8 +47,3 @@ export function keysFromPrfSecret(secret) {
     const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).subarray(-32).toString("base64");
     return { publicKeyBase64, privateKeyRaw: material };
 }
-export function isPasskeyRecord(value) {
-    const record = value;
-    return !!record && typeof record.credentialId === "string" && typeof record.prfSalt === "string"
-        && typeof record.label === "string" && typeof record.recipientId === "string";
-}

package/dist/src/password-lock.d.ts

@@ -1,11 +1,11 @@
-import { VaultlineError } from "./errors.js";
+import { SealkeepError } from "./errors.js";
 export declare const passwordLockPath: (dataDir: string) => string;
 /**
  * Structural damage, as opposed to a wrong password. Carries no hint about
  * either secret, and its message is written for the window: what stopped
  * working, what did not, and the way back in.
  */
-export declare class PasswordLockCorruptError extends VaultlineError {
+export declare class PasswordLockCorruptError extends SealkeepError {
     constructor(path: string, reason: string);
 }
 /** Seals the canonical phrase under a password, replacing any previous lock in one atomic step. */

package/dist/src/password-lock.js

@@ -1,9 +1,9 @@
 import { randomBytes, scryptSync } from "node:crypto";
 import { chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { aeadCipher, aeadDecipher } from "../packages/vaultline-crypto/src/aead.js";
-import { TAG_BYTES } from "../packages/vaultline-crypto/src/format.js";
-import { fail, VaultlineError } from "./errors.js";
+import { aeadCipher, aeadDecipher } from "../packages/sealkeep-crypto/src/aead.js";
+import { TAG_BYTES } from "../packages/sealkeep-crypto/src/format.js";
+import { fail, SealkeepError } from "./errors.js";
 /**
  * A password in front of the phrase, never instead of it.
  *
@@ -16,7 +16,7 @@ import { fail, VaultlineError } from "./errors.js";
  * machine and is deliberately excluded from what a vault backup means.
  *
  * The scrypt cost matches every other phrase-derived key in this repo
- * (crypto.ts, vaultline-crypto/recipients.ts), so config.json's history does
+ * (crypto.ts, sealkeep-crypto/recipients.ts), so config.json's history does
  * not repeat: the file guarding the phrase must never be cheaper to attack
  * than the envelopes sitting next to it.
  */
@@ -26,14 +26,14 @@ const MAXMEM = 128 * 1024 * 1024;
 const KEY_BYTES = 32;
 const SALT_BYTES = 16;
 const NONCE_BYTES = 12;
-const AAD = Buffer.from("vaultline-phrase-lock:v1");
+const AAD = Buffer.from("sealkeep-phrase-lock:v1");
 export const passwordLockPath = (dataDir) => join(dataDir, "phrase.lock");
 /**
  * Structural damage, as opposed to a wrong password. Carries no hint about
  * either secret, and its message is written for the window: what stopped
  * working, what did not, and the way back in.
  */
-export class PasswordLockCorruptError extends VaultlineError {
+export class PasswordLockCorruptError extends SealkeepError {
     constructor(path, reason) {
         super("ciphertext_integrity_failed", "The saved password lock on this machine is damaged, so a password cannot unlock this vault. Your archives and your recovery phrase are unaffected — unlock with the phrase, then choose a password again.", { path, reason });
         this.name = "PasswordLockCorruptError";

package/dist/src/paths.d.ts

@@ -1,4 +1,6 @@
 export declare const localApiTokenPath: (dataDir: string) => string;
+/** Separate from the bearer: proves a recorded listener belongs to this vault without disclosing API authority. */
+export declare const localUiProofKeyPath: (dataDir: string) => string;
 /**
  * Finds the bundled `web/` directory by walking up from this module.
  *

package/dist/src/paths.js

@@ -2,6 +2,8 @@ import { existsSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 export const localApiTokenPath = (dataDir) => join(dataDir, "local-api-token");
+/** Separate from the bearer: proves a recorded listener belongs to this vault without disclosing API authority. */
+export const localUiProofKeyPath = (dataDir) => join(dataDir, "local-ui-proof-key");
 /**
  * Finds the bundled `web/` directory by walking up from this module.
  *

package/dist/src/presence.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Presence — the awareness tier git lacks and meetings badly imitate.
+ *
+ * Tiny sealed facts about WHO is doing WHAT right now: "Paul started:
+ * retry() in big-refactor", "Max finished: webhook double-fire — used the
+ * idempotency key". Bytes, not transcripts; published in seconds; readable by
+ * every member and by their agents (the sealkeep_team MCP tool), so the two
+ * expensive team questions — "is anyone already on this?" and "should I warn
+ * everyone I started?" — stop costing a human interruption.
+ *
+ * Facts, not proposals: presence never passes an approval gate. It rides the
+ * machinery the bridge lane proved — per-sender refs (collision-free), sealed
+ * to the vault phrase, relayed as ciphertext.
+ */
+import type { BackendName } from "./secrets.js";
+export type PresenceKind = "started" | "finished" | "note";
+export type PresenceEvent = {
+    project: string;
+    /** Stable local identity. The project label is never an access boundary. */
+    projectKey?: string;
+    kind: PresenceKind;
+    line: string;
+    from: string;
+    sender: string;
+    seq: number;
+    at: string;
+    /** Authenticated by the hosted append endpoint for cross-account events. */
+    authorAccountId?: number;
+    /** Hosted append cursor. Present on team events; authoritative over skewed client clocks. */
+    serverId?: number;
+};
+/**
+ * A hosted space is the project identity shared by the team; `event.project`
+ * is only the sender's local folder label. Two developers are explicitly
+ * allowed to map `checkout-api` and `api-local` to the same space, so an event
+ * read from that authenticated space belongs to both aliases. Normalise it at
+ * the receiving boundary instead of dropping valid teammate work because the
+ * two machines named their folders differently.
+ */
+export declare function localiseTeamPresence(events: readonly PresenceEvent[], localProject: string, localProjectKey?: string | null): PresenceEvent[];
+export declare function presenceRef(sender: string, seq: number): string;
+export declare function presenceRefOf(vaultRef: string): {
+    sender: string;
+    seq: number;
+} | null;
+export declare function publishPresence(dataDir: string, input: {
+    project: string;
+    projectKey?: string | null;
+    kind: PresenceKind;
+    line: string;
+    from?: string;
+}, phrase: string, preferred?: BackendName): Promise<{
+    ref: string;
+    event: PresenceEvent;
+}>;
+/** Open one presence blob back into its event; the sealed meta is the truth. */
+export declare function openPresenceBlob(blob: Buffer, phrase: string): PresenceEvent;
+/**
+ * The team feed: newest presence events, optionally one project's. Presence
+ * objects are tiny, so opening a bounded number of them costs less than one
+ * transcript page — and the cap keeps a years-old account honest.
+ */
+export declare function listPresence(dataDir: string, phrase: string, options?: {
+    project?: string;
+    projectKey?: string;
+    limit?: number;
+    fetchCap?: number;
+    preferred?: BackendName;
+}): Promise<PresenceEvent[]>;
+/**
+ * Who is on something RIGHT NOW: the newest state event per (person, project)
+ * is a `started` no `finished` closed, and it is fresh. Progress notes enrich
+ * the feed but never close an open session. This is the collision
+ * check — the question an agent asks before taking overlapping work.
+ */
+export declare function activeNow(events: PresenceEvent[], options?: {
+    staleAfterMs?: number;
+    now?: number;
+}): PresenceEvent[];
+/**
+ * A cheap honest one-liner from a transcript tail — for auto-published
+ * `finished`. Codex rollouts get their last agent_message (the raw-text
+ * scrape used to surface tool noise like "Script completed Wall time 0.1
+ * seconds"); everything else falls back to the last quoted text.
+ */
+export declare function finishLineFrom(sessionPath: string): Promise<string>;

package/dist/src/presence.js

@@ -0,0 +1,240 @@
+/**
+ * Presence — the awareness tier git lacks and meetings badly imitate.
+ *
+ * Tiny sealed facts about WHO is doing WHAT right now: "Paul started:
+ * retry() in big-refactor", "Max finished: webhook double-fire — used the
+ * idempotency key". Bytes, not transcripts; published in seconds; readable by
+ * every member and by their agents (the sealkeep_team MCP tool), so the two
+ * expensive team questions — "is anyone already on this?" and "should I warn
+ * everyone I started?" — stop costing a human interruption.
+ *
+ * Facts, not proposals: presence never passes an approval gate. It rides the
+ * machinery the bridge lane proved — per-sender refs (collision-free), sealed
+ * to the vault phrase, relayed as ciphertext.
+ */
+import { readFile, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { encryptArchive, decryptArchive } from "../packages/sealkeep-crypto/src/envelope.js";
+import { canonicalPhrase } from "./mnemonic.js";
+import { fail } from "./errors.js";
+import { requestUpload, putCiphertext, completeUpload, pullCiphertext, frameObject, unframeObject, listCloudArchives } from "./cloud.js";
+import { bridgeSender, withSenderLock } from "./bridge.js";
+import { readConfig, teamSpaceOf } from "./vault.js";
+const sha256hex = (buffer) => createHash("sha256").update(buffer).digest("hex");
+const SENDER_RE = /^[a-f0-9]{8}$/;
+/**
+ * A hosted space is the project identity shared by the team; `event.project`
+ * is only the sender's local folder label. Two developers are explicitly
+ * allowed to map `checkout-api` and `api-local` to the same space, so an event
+ * read from that authenticated space belongs to both aliases. Normalise it at
+ * the receiving boundary instead of dropping valid teammate work because the
+ * two machines named their folders differently.
+ */
+export function localiseTeamPresence(events, localProject, localProjectKey) {
+    return events.map((event) => {
+        if (localProjectKey) {
+            return event.project === localProject && event.projectKey === localProjectKey
+                ? event
+                : { ...event, project: localProject, projectKey: localProjectKey };
+        }
+        if (event.project === localProject && event.projectKey === undefined)
+            return event;
+        // Membership in the authenticated team space supplies the identity when a
+        // legacy caller has no stable key. Do not retain a contributor's unrelated
+        // machine-local key as though it identified the receiving checkout.
+        const { projectKey: _ignored, ...rest } = event;
+        return { ...rest, project: localProject };
+    });
+}
+export function presenceRef(sender, seq) {
+    if (!SENDER_RE.test(sender))
+        fail("invalid_argument", `A presence sender id must be 8 hex chars; got "${sender}"`);
+    return `presence-${sender}-${String(seq).padStart(9, "0")}`;
+}
+export function presenceRefOf(vaultRef) {
+    const match = /^presence-([a-f0-9]{8})-([0-9]{9})$/.exec(vaultRef);
+    return match ? { sender: match[1], seq: Number(match[2]) } : null;
+}
+/** One line, prompt-safe and small: presence is a glance, not a report. */
+// eslint-disable-next-line no-control-regex
+const clean = (text) => text.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, 140);
+export async function publishPresence(dataDir, input, phrase, preferred) {
+    if (!input.project.trim())
+        fail("invalid_argument", "Presence needs a project");
+    const { state, seq } = await withSenderLock(dataDir, async () => {
+        const state = await bridgeSender(dataDir);
+        const seq = state.outSeq["presence"] ?? 0;
+        state.outSeq["presence"] = seq + 1;
+        await writeFile(join(dataDir, "bridge", "sender.json"), JSON.stringify(state, null, 2), { mode: 0o600 });
+        return { state, seq };
+    });
+    const event = {
+        project: input.project, kind: input.kind, line: clean(input.line),
+        from: input.from ?? state.label, sender: state.id, seq, at: new Date().toISOString(),
+        ...(input.projectKey ? { projectKey: input.projectKey } : {}),
+    };
+    const binding = teamSpaceOf(await readConfig(dataDir), input.project, input.projectKey);
+    if (binding) {
+        const { publishTeamPresenceEvent } = await import("./team-presence.js");
+        await publishTeamPresenceEvent(dataDir, binding.spaceKey, event, phrase, preferred);
+        return { ref: presenceRef(state.id, seq), event };
+    }
+    const { envelope, ciphertext } = encryptArchive(Buffer.from(event.line, "utf8"), {
+        recipients: [{ kind: "phrase", phrase: canonicalPhrase(phrase) }],
+        adapter: { agent: "presence", version: JSON.stringify({ ...event, line: undefined }) },
+    });
+    const blob = frameObject(envelope, ciphertext);
+    const ref = presenceRef(state.id, seq);
+    const lease = await requestUpload(dataDir, { vaultRef: ref, ciphertextSha256: sha256hex(blob), bytes: blob.length }, preferred);
+    await putCiphertext(lease, blob);
+    await completeUpload(dataDir, lease.lease_id, blob.length, preferred);
+    return { ref, event };
+}
+/** Open one presence blob back into its event; the sealed meta is the truth. */
+export function openPresenceBlob(blob, phrase) {
+    const { envelope, ciphertext } = unframeObject(blob);
+    if (!envelope)
+        fail("internal", "A presence object is not framed");
+    const line = decryptArchive(envelope, ciphertext, { phrase: canonicalPhrase(phrase) }).toString("utf8");
+    const metaRaw = envelope.manifest?.adapter?.version;
+    if (!metaRaw)
+        fail("internal", "A presence object carries no meta");
+    return { ...JSON.parse(metaRaw), line };
+}
+/**
+ * The team feed: newest presence events, optionally one project's. Presence
+ * objects are tiny, so opening a bounded number of them costs less than one
+ * transcript page — and the cap keeps a years-old account honest.
+ */
+export async function listPresence(dataDir, phrase, options = {}) {
+    const limit = options.limit ?? 30;
+    if (options.project) {
+        const binding = teamSpaceOf(await readConfig(dataDir), options.project, options.projectKey);
+        if (binding) {
+            const { readTeamPresence } = await import("./team-presence.js");
+            const page = await readTeamPresence(dataDir, binding.spaceKey, phrase, { preferred: options.preferred });
+            // Membership and decryption already scoped this page to exactly one
+            // hosted project. `event.project` is the sender's local alias, not an
+            // access-control boundary, so filtering it here loses legitimate work
+            // from teammates who use a different checkout folder name.
+            return localiseTeamPresence(page.events, options.project, options.projectKey).slice(0, limit);
+        }
+    }
+    const fetchCap = options.fetchCap ?? 120;
+    const remote = await listCloudArchives(dataDir, options.preferred).catch(() => []);
+    const refs = remote.map((row) => row.vault_ref).filter((ref) => presenceRefOf(ref) !== null);
+    // Per-sender streams are seq-ordered by the ref string; take each sender's
+    // newest first, so the cap cannot starve a quiet teammate.
+    const senders = new Set(refs.map((ref) => presenceRefOf(ref).sender));
+    const perSender = Math.max(8, Math.ceil(fetchCap / Math.max(1, senders.size)));
+    const bySender = new Map();
+    for (const ref of [...refs].sort().reverse()) {
+        const parsed = presenceRefOf(ref);
+        const list = bySender.get(parsed.sender) ?? [];
+        if (list.length < perSender)
+            list.push(ref);
+        bySender.set(parsed.sender, list);
+    }
+    const picked = [...bySender.values()].flat().slice(0, fetchCap);
+    const events = [];
+    // Every blob is independent. Pulling 120 one by one turned "who is working"
+    // into a minute-long startup on real teams; a small bounded pool makes the
+    // feed one handful of network round trips without opening 120 sockets at
+    // once. Push by slot, then sort below, so completion order cannot leak into
+    // the answer.
+    let next = 0;
+    await Promise.all(Array.from({ length: Math.min(12, picked.length) }, async () => {
+        while (next < picked.length) {
+            const ref = picked[next++];
+            try {
+                const { ciphertext: blob } = await pullCiphertext(dataDir, ref, options.preferred);
+                const event = openPresenceBlob(blob, phrase);
+                if (!options.project
+                    || (options.projectKey ? event.projectKey === options.projectKey : event.project === options.project))
+                    events.push(event);
+            }
+            catch { /* an unreadable one is skipped, never fatal to the feed */ }
+        }
+    }));
+    events.sort((a, b) => (a.at < b.at ? 1 : -1));
+    return events.slice(0, limit);
+}
+/**
+ * Who is on something RIGHT NOW: the newest state event per (person, project)
+ * is a `started` no `finished` closed, and it is fresh. Progress notes enrich
+ * the feed but never close an open session. This is the collision
+ * check — the question an agent asks before taking overlapping work.
+ */
+export function activeNow(events, options = {}) {
+    const staleAfter = options.staleAfterMs ?? 8 * 3600_000;
+    const now = options.now ?? Date.now();
+    const newestPer = new Map();
+    for (const event of events) {
+        if (event.kind === "note")
+            continue;
+        // A team member controls the encrypted sender label, but not the account
+        // id attached by the authenticated append endpoint. Keep one active state
+        // per real account even if a malicious member copies another sender id.
+        const author = event.authorAccountId === undefined ? event.sender : `account:${event.authorAccountId}`;
+        const key = `${author}|${event.projectKey ?? event.project}`;
+        const held = newestPer.get(key);
+        const newerByServer = event.serverId !== undefined && held?.serverId !== undefined && event.serverId > held.serverId;
+        const newerByClock = (event.serverId === undefined || held?.serverId === undefined) && (!held || event.at > held.at);
+        if (!held || newerByServer || newerByClock)
+            newestPer.set(key, event);
+    }
+    return [...newestPer.values()]
+        .filter((event) => event.kind === "started" && now - Date.parse(event.at) < staleAfter)
+        .sort((a, b) => a.serverId !== undefined && b.serverId !== undefined ? b.serverId - a.serverId : (a.at < b.at ? 1 : -1));
+}
+/**
+ * A cheap honest one-liner from a transcript tail — for auto-published
+ * `finished`. Codex rollouts get their last agent_message (the raw-text
+ * scrape used to surface tool noise like "Script completed Wall time 0.1
+ * seconds"); everything else falls back to the last quoted text.
+ */
+export async function finishLineFrom(sessionPath) {
+    try {
+        const raw = await readFile(sessionPath);
+        const tail = raw.subarray(Math.max(0, raw.length - 32768)).toString("utf8");
+        const lines = tail.split("\n");
+        for (let i = lines.length - 1; i >= 0; i--) {
+            try {
+                const parsed = JSON.parse(lines[i]);
+                // Codex has used three rollout shapes for an assistant line:
+                // - event_msg.payload.type = agent_message (older builds)
+                // - event_msg item_completed → item.type = AgentMessage (0.150)
+                // - response_item → payload.role = assistant (the durable message)
+                // Read semantic fields only. A raw `"text"` scrape mistakes tool
+                // output such as "Script completed" for the handoff — exactly what a
+                // live Mac→VPS rehearsal caught.
+                let message = parsed.payload?.type === "agent_message" ? parsed.payload.message : undefined;
+                if (!message && parsed.payload?.type === "item_completed" && parsed.payload.item?.type === "AgentMessage") {
+                    message = parsed.payload.item.content?.find((part) => part.type === "Text" && part.text?.trim())?.text;
+                }
+                if (!message && parsed.type === "response_item" && parsed.payload?.type === "message" && parsed.payload.role === "assistant") {
+                    message = parsed.payload.content?.find((part) => (part.type === "output_text" || part.type === "text") && part.text?.trim())?.text;
+                }
+                // Claude Code: `{"type":"assistant","message":{"role":"assistant","content":[{"type":"text",…}]}}`.
+                // Without this the scrape below took the LAST string in the file, which
+                // in a Claude transcript is usually the harness's own system-reminder —
+                // so a preserved session's one line read "<system-reminder> <total_tokens>…".
+                if (!message && parsed.type === "assistant" && parsed.message?.role === "assistant") {
+                    message = parsed.message.content?.find((part) => part.type === "text" && part.text?.trim())?.text;
+                }
+                if (message && message.trim())
+                    return clean(message);
+            }
+            catch { /* a torn first line of the tail window — keep looking */ }
+        }
+        const texts = [...tail.matchAll(/"(?:text|content)":"((?:[^"\\]|\\.){8,160})"/g)].map((m) => m[1])
+            // Harness scaffolding is never what a session was about.
+            .filter((text) => !/^\s*(?:\\n)*\s*<(?:system-reminder|local-command-stdout|task-notification|command-name|command-message)/.test(text));
+        const last = texts[texts.length - 1];
+        return last ? clean(last.replace(/\\n/g, " ").replace(/\\"/g, '"')) : "session sealed";
+    }
+    catch {
+        return "session sealed";
+    }
+}

package/dist/src/progress-deadline.d.ts

@@ -0,0 +1,21 @@
+/**
+ * A referenced, resettable idle deadline for work that owns durable state.
+ *
+ * `progress()` is the only way to extend the budget.  The timer never renews a
+ * queue lease by itself: silence therefore cannot make a dead seal look alive.
+ * `wait()` also races uncooperative injected/provider promises, while the
+ * derived signal lets real implementations stop their underlying I/O.
+ */
+export declare function createProgressDeadline(options: {
+    operation: string;
+    idleMs: number;
+    signal?: AbortSignal;
+}): {
+    signal: AbortSignal;
+    progress(): void;
+    wait<T>(work: Promise<T>): Promise<T>;
+    close(): void;
+};
+/** One bounded remote operation. Completion is progress; a caller may create
+ * another budget for the next meta/blob/publication step. */
+export declare function withProgressDeadline<T>(operation: string, idleMs: number, signal: AbortSignal | undefined, work: (signal: AbortSignal) => Promise<T>): Promise<T>;

package/dist/src/progress-deadline.js

@@ -0,0 +1,91 @@
+import { SealkeepError } from "./errors.js";
+function abortReason(signal, fallback) {
+    if (signal.reason instanceof Error)
+        return signal.reason;
+    const error = new Error(fallback);
+    error.name = "AbortError";
+    return error;
+}
+/**
+ * A referenced, resettable idle deadline for work that owns durable state.
+ *
+ * `progress()` is the only way to extend the budget.  The timer never renews a
+ * queue lease by itself: silence therefore cannot make a dead seal look alive.
+ * `wait()` also races uncooperative injected/provider promises, while the
+ * derived signal lets real implementations stop their underlying I/O.
+ */
+export function createProgressDeadline(options) {
+    if (!Number.isFinite(options.idleMs) || options.idleMs <= 0) {
+        throw new Error(`${options.operation} idle timeout must be positive`);
+    }
+    const idleMs = Math.max(1, Math.trunc(options.idleMs));
+    const controller = new AbortController();
+    let timer;
+    let closed = false;
+    const timeout = () => new SealkeepError("operation_timeout", `${options.operation} made no progress for ${Math.max(1, Math.round(idleMs / 1_000))} seconds and was stopped. It can be retried safely.`, { operation: options.operation, idleMs, retryable: true });
+    const arm = () => {
+        if (closed || controller.signal.aborted)
+            return;
+        if (timer)
+            clearTimeout(timer);
+        // Deliberately referenced.  A process must not disappear while it owns a
+        // queue lease or an index publication merely because the provider promise
+        // is the only other pending work.
+        timer = setTimeout(() => controller.abort(timeout()), idleMs);
+    };
+    const abortFromParent = () => {
+        if (!controller.signal.aborted) {
+            controller.abort(abortReason(options.signal, `${options.operation} was cancelled`));
+        }
+    };
+    if (options.signal?.aborted)
+        abortFromParent();
+    else
+        options.signal?.addEventListener("abort", abortFromParent, { once: true });
+    arm();
+    return {
+        signal: controller.signal,
+        progress: arm,
+        async wait(work) {
+            if (controller.signal.aborted) {
+                // The caller may have started work before cancellation. Observe its
+                // eventual rejection even though cancellation wins immediately.
+                void work.catch(() => undefined);
+                throw abortReason(controller.signal, `${options.operation} was cancelled`);
+            }
+            let onAbort;
+            const aborted = new Promise((_resolve, reject) => {
+                onAbort = () => reject(abortReason(controller.signal, `${options.operation} was cancelled`));
+                controller.signal.addEventListener("abort", onAbort, { once: true });
+            });
+            try {
+                return await Promise.race([work, aborted]);
+            }
+            finally {
+                if (onAbort)
+                    controller.signal.removeEventListener("abort", onAbort);
+            }
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            if (timer)
+                clearTimeout(timer);
+            timer = undefined;
+            options.signal?.removeEventListener("abort", abortFromParent);
+        },
+    };
+}
+/** One bounded remote operation. Completion is progress; a caller may create
+ * another budget for the next meta/blob/publication step. */
+export async function withProgressDeadline(operation, idleMs, signal, work) {
+    const deadline = createProgressDeadline({ operation, idleMs, signal });
+    try {
+        deadline.signal.throwIfAborted();
+        return await deadline.wait(work(deadline.signal));
+    }
+    finally {
+        deadline.close();
+    }
+}