sealnet-mcp 0.2.4 → 0.3.0

package/dist/index.cjs

@@ -35,16 +35,20 @@ __export(index_exports, {
   BackendError: () => BackendError,
   DEFAULT_BACKEND_URL: () => DEFAULT_BACKEND_URL,
   DEFAULT_PUBLIC_HOST: () => DEFAULT_PUBLIC_HOST,
+  EPHEMERAL_ENV_VAR: () => EPHEMERAL_ENV_VAR,
   HandoffBothChannelsFailedError: () => HandoffBothChannelsFailedError,
+  IdentityConflictError: () => IdentityConflictError,
   KEYCHAIN_ACCOUNT: () => KEYCHAIN_ACCOUNT,
   KEYCHAIN_SERVICE: () => KEYCHAIN_SERVICE,
-  KeytarUnavailableError: () => KeytarUnavailableError,
   LOCK_FILE_NAME: () => LOCK_FILE_NAME,
   PASSPHRASE_ENV_VAR: () => PASSPHRASE_ENV_VAR,
   PUBLIC_HOST_ENV_VAR: () => PUBLIC_HOST_ENV_VAR,
-  PassphraseNotFoundError: () => PassphraseNotFoundError,
+  SEED_ENV_VAR: () => SEED_ENV_VAR,
+  SEED_FILE_NAME: () => SEED_FILE_NAME,
   STATE_FILE_NAME: () => STATE_FILE_NAME,
   SealApi: () => SealApi,
+  SeedInvalidError: () => SeedInvalidError,
+  StateBusyError: () => StateBusyError,
   StateCorrupt: () => StateCorrupt,
   StateLockedError: () => StateLockedError,
   StatePassphraseInvalid: () => StatePassphraseInvalid,
@@ -52,20 +56,22 @@ __export(index_exports, {
   acquireStateLock: () => acquireStateLock,
   createEmptyState: () => createEmptyState,
   createServer: () => createServer,
-  deleteKeychainPassphrase: () => deleteKeychainPassphrase,
+  deleteRootSecret: () => deleteRootSecret,
   generateHandle: () => generateHandle,
   generateIdentity: () => generateIdentity,
+  holderMayRun: () => holderMayRun,
+  identityFromSeed: () => identityFromSeed,
   identityToFields: () => identityToFields,
   isValidHandle: () => isValidHandle,
   loadIdentity: () => loadIdentity,
   loadState: () => loadState,
+  openAgentState: () => openAgentState,
   performHandoff: () => performHandoff,
   probeKeychain: () => probeKeychain,
   probeStateLock: () => probeStateLock,
-  promptHiddenPassphrase: () => promptHiddenPassphrase,
+  readSeed: () => readSeed,
   recoverPendingOperations: () => recoverPendingOperations,
   resolveBackendUrl: () => resolveBackendUrl,
-  resolvePassphraseFromStores: () => resolvePassphraseFromStores,
   resolvePublicHost: () => resolvePublicHost,
   resolveStateDir: () => resolveStateDir,
   saveState: () => saveState,
@@ -73,12 +79,13 @@ __export(index_exports, {
   sealOpen: () => sealOpen,
   sealRevoke: () => sealRevoke,
   sealShare: () => sealShare,
-  setKeychainPassphrase: () => setKeychainPassphrase
+  statePassphrase: () => statePassphrase,
+  updateState: () => updateState,
+  withStateLock: () => withStateLock
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/server.ts
-var import_node_path9 = require("path");
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 
@@ -4138,13 +4145,13 @@ var seal_mcp_v1_default = {
     progress: "When a `tools/call` carries `_meta.progressToken`, `seal_share` and `seal_open mode=file` send `notifications/progress` with `progress` = ciphertext bytes done (upload: confirmed by storage) and `total` = ciphertext bytes in all; at most one per second, `progress` strictly increasing, the last one at `progress = total`."
   },
   server_instructions: {
-    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files).",
+    text: "SEAL moves files and secrets between people and agents without their content entering this conversation. When someone wants a file, folder or secret sent to them, to another machine or to another agent, call seal_share with its path and do not open, print or Read it first. When you need an API key, password, file or folder from the user, or they offer or ask how to give you one, call seal_request right away instead of explaining other ways or asking them to paste or upload it. Open a SEAL link someone gave you with seal_open (mode=file for secrets and large files). Never read or print a SEAL handoff file.",
     note: "The `instructions` of the `initialize` result (SPEC-AGENTS \xA78.1). Hosts that defer MCP tools behind a tool search (Claude Code) show the model only tool names until it searches, but put these instructions into the system prompt: this is the one text a model reads before it decides to look for a tool, or reads the file it was asked to send."
   },
   tools: {
     seal_share: {
       title: "Share a file via SEAL",
-      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for any size (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard or a 0600 file and you get only a handle. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
+      description: "Give the user or another agent a file or a secret WITHOUT it passing through this chat. Works for large files (folders, dumps, exports, builds, videos \u2014 up to 1 GB free, more after one card payment by the user). Default mode `handoff`: the link goes to the user's clipboard and you get a handle. Where there is no clipboard it goes to a 0600 file and you get its path: do not read that file and do not print it. Mode `forward`: a link only the holder of the given X25519 key can open \u2014 use it for another agent. Never paste secrets or huge content into the chat instead.",
       annotations: { destructiveHint: false, openWorldHint: true },
       input: {
         properties: {
@@ -4188,13 +4195,15 @@ var seal_mcp_v1_default = {
         required: ["handle", "receipt", "handoff_channel"],
         properties: {
           handle: { type: "string", pattern: "^h_[A-Za-z0-9_-]{12,}$", description: "Opaque server-internal ID. Used by `seal_revoke` and other tools. 12+ base64url chars after the `h_` prefix \u2014 the alphabet includes `-` and `_` (generateHandle emits base64url), so the pattern must too." },
-          receipt: { type: "string", description: "Plain-text status the model should relay verbatim to the user. e.g. 'The seal link is on your clipboard. Paste it to the recipient.' In ephemeral mode (see `passphrase_delivery`) it adds that the handle lives until the server restarts and the seal's expiry does not depend on it." },
+          receipt: { type: "string", description: "Plain-text status the model should relay verbatim to the user. e.g. 'The seal link is on your clipboard. Paste it to the recipient.' In ephemeral mode (see `root_secret.ephemeral_mode`) it adds that the handle lives until the server restarts and the seal's expiry does not depend on it." },
           handoff_channel: { type: "string", enum: ["clipboard", "file"] },
           handoff_file: { type: "string", description: "ONLY when handoff_channel='file'. Absolute path to a 0o600 file containing the share link and a newline." },
           expires_at: { type: "string", format: "date-time", description: "ISO 8601 UTC expiry timestamp." }
         },
         MUST_NOT_contain: ["share_url", "url", "password", "passphrase", "link_key", "owner_token"],
-        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode."
+        rationale: "Anything in this object reaches the model. Any field that lets the model reconstruct or re-issue the share capability defeats handoff mode.",
+        receipt_clipboard: "The seal link is on your clipboard. Paste it to the recipient.",
+        receipt_file: "The seal link is in {file} (mode 0600, removed automatically later). Give it to the recipient. Anyone who can read files on this machine as this user, this agent included, can read it. In a cloud or container session prefer mode=forward to the recipient\u2019s key."
       },
       output_forward: {
         type: "object",
@@ -4522,7 +4531,7 @@ var seal_mcp_v1_default = {
           type: "object",
           required: ["x25519_secret_b64", "x25519_public_b64"],
           properties: {
-            x25519_secret_b64: { type: "string", description: "32 raw bytes, base64-padded. Generated once, at `sealnet-mcp init` or at the first `sealnet-mcp serve` without state. Lost passphrase = lost identity = unable to open incoming targeted seals; handoff continues to work without identity." },
+            x25519_secret_b64: { type: "string", description: "32 raw bytes, base64url. The seed of `root_secret`: must equal it, else the server refuses with `identity_conflict`. Lost seed = lost address = incoming targeted seals unopenable; handoff continues to work without identity." },
             x25519_public_b64: { type: "string", description: "32 raw bytes, derived from secret. Safe to publish; advertised so other parties can target this MCP." }
           }
         },
@@ -4543,7 +4552,7 @@ var seal_mcp_v1_default = {
         },
         pending: {
           type: "object",
-          description: "Durable operation journal (ISSUE-0623), keyed by handle. A seal_share journals BEFORE its first remote effect and checkpoints every step; completion removes the entry in the same envelope write that inserts the durable handle. OPTIONAL: envelopes written before the journal existed omit it and readers normalise to {}. Recovery semantics at server start: 'preparing' (no confirmed remote effect) is dropped; 'uploaded'/'awaiting_payment'/'compensating' (URL never delivered) is revoked, AWAITED \u2014 an unpaid seal cannot be finished after a restart, and a payment that lands after the revoke is refunded by the server; 'delivering' (URL possibly already delivered) is ADOPTED as a durable handle \u2014 never revoked, so the owner keeps control of a link the user may already hold.",
+          description: "Durable operation journal (ISSUE-0623), keyed by handle. A seal_share journals BEFORE its first remote effect and checkpoints every step; completion removes the entry in the same envelope write that inserts the durable handle. OPTIONAL: envelopes written before the journal existed omit it and readers normalise to {}. Recovery semantics at server start, for entries whose `owner` cannot still be running (several MCP hosts share one state, SPEC-ADDRESS F1 \xA74): 'preparing' (no confirmed remote effect) is dropped; 'uploaded'/'awaiting_payment'/'compensating' (URL never delivered) is revoked, AWAITED \u2014 an unpaid seal cannot be finished after a restart, and a payment that lands after the revoke is refunded by the server; 'delivering' (URL possibly already delivered) is ADOPTED as a durable handle \u2014 never revoked, so the owner keeps control of a link the user may already hold.",
           additionalProperties: {
             type: "object",
             required: ["tool", "mode", "started_at", "owner_token_b64", "expires_at", "step"],
@@ -4556,6 +4565,12 @@ var seal_mcp_v1_default = {
               step: { type: "string", enum: ["preparing", "awaiting_payment", "uploaded", "delivering", "compensating"] },
               seal_id: { type: "string", pattern: "^[A-Za-z0-9_-]{6,20}$", description: "Set once the upload confirms; (seal_id, owner_token_b64) is the full revoke capability." },
               handoff_channels_attempted: { type: "array", items: { type: "string", enum: ["clipboard", "file"] }, description: "Channels performHandoff will try, in order (handoff mode only; journaled before delivery starts)." },
+              owner: {
+                type: "object",
+                required: ["pid", "hostname"],
+                properties: { pid: { type: "integer" }, hostname: { type: "string" } },
+                description: "The process running the operation. Recovery leaves an entry alone while that process may still run: alive on this host, or on another host, which cannot be probed (the state lock's rule). Entries without it, from 0.2.x, are recovered as crashed."
+              },
               compensation: {
                 type: "object",
                 required: ["action", "outcome", "error", "at"],
@@ -4587,27 +4602,20 @@ var seal_mcp_v1_default = {
       }
     }
   },
-  passphrase_delivery: {
-    ordered_priority: [
-      {
-        rank: 1,
-        method: "os_keychain",
-        implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. It replaced keytar in 0.2.4 and finds the entry keytar wrote (Windows credential `seal-mcp/state`, the passphrase as UTF-8 bytes; on Linux the old entry is read once through `secret-tool` and stored anew). Service id: 'seal-mcp', account: 'state'. Set during `sealnet-mcp init` (chosen by the user), or by the first `sealnet-mcp serve` without state, which generates a random 32-byte passphrase itself \u2014 no prompt, no `init` step. Read on every subsequent process start.",
-        default: true
-      },
-      {
-        rank: 2,
-        method: "env_var",
-        implementation: "$SEAL_MCP_PASSPHRASE. Visible to same-user attackers via /proc/<pid>/environ on Linux. Warning logged on stderr at startup. Use only in CI / headless containers."
-      },
-      {
-        rank: 3,
-        method: "REFUSED",
-        implementation: "Cleartext passphrase file on disk is explicitly refused even if user passes `--passphrase-file \u2026`. Error message points at options 1 and 2."
-      }
+  root_secret: {
+    seed: "The agent's one root secret (SPEC-ADDRESS F1): a 32-byte X25519 secret, as text 43 base64url characters \u2014 the same bytes as `state.identity.x25519_secret_b64`, the CLI's `identity.v1.json::x25519_secret_b64url`, the SDK's `KeyPair.secretKey` and sealnet's `keygen().secret_key`. Its public half is the agent's address; it must survive a restart, a second MCP host on the machine and a move to the cloud.",
+    ordered_sources: [
+      { rank: 1, source: "env", implementation: "$SEAL_SEED. How a container or a cloud session gets the same address as at home." },
+      { rank: 2, source: "keychain", implementation: "@napi-rs/keyring (the Secret Service on Linux, never the kernel keyring, which forgets on reboot; macOS Keychain; Windows Credential Manager), an OPTIONAL dependency loaded lazily: its absence never fails install or start. Service 'seal-mcp', account 'seed', the seed as UTF-8 bytes." },
+      { rank: 3, source: "file", implementation: "`<state_dir>/seed`, mode 0600 in the 0700 state directory, created on the first start where there is no keychain. The CLI's threat model (`secrets.rs`): a process running as this user reads it either way, keychain or file." }
     ],
-    ephemeral_mode: "First `serve` without state where neither the keychain nor SEAL_MCP_PASSPHRASE is available (container, CI), or `serve --ephemeral`: identity, handles, journal and audit live only in process memory and nothing is written to disk (rank 3 stays refused). The `seal_share` receipt says the handle lives until the server restarts and the seal's expiry does not depend on it.",
-    lost_passphrase_recovery: "Passphrase is NOT recoverable. `sealnet-mcp init --force` mints a new identity, but old targeted seals (addressed to the old pubkey) become permanently unopenable. Handoff seals are not affected (they don't use identity)."
+    created: "The first `serve` (or `init`) with no seed in any source makes one and keeps it in the keychain, or in the file where there is none. `init` asks nothing.",
+    state_passphrase: "base64url(HKDF-SHA256(ikm = seed, salt = 'seal-mcp:state:v1', info = 'passphrase', 32 bytes)). The state envelope (Argon2id \u2192 AES-256-GCM) is unchanged; only where its passphrase comes from changed. One root secret instead of a passphrase and a key.",
+    identity_conflict: "`state.identity` must be the seed. A state that opens neither with the seed's passphrase nor with a migration passphrase belongs to another key (a foreign SEAL_SEED): `serve` refuses with `identity_conflict`, exit 3. Unset SEAL_SEED, or `sealnet-mcp reset --force`. The address never changes silently.",
+    migration_0_2: "Once, when no seed exists in any source and a state does: open it with the old passphrase (keychain entry 'seal-mcp'/'state', including the Linux entry keytar wrote, or $SEAL_MCP_PASSPHRASE), take the seed from `state.identity`, store it (keychain 'seed', else the file), save the same state under the seed's passphrase (atomic, as every save), delete the old keychain entry. $SEAL_MCP_PASSPHRASE is read only here and warns that it is no longer used. Removed in the first minor release after no 0.2.x state is left, the condition `readKeytarLinuxEntry` carries.",
+    ephemeral_mode: "Only `serve --ephemeral` or $SEAL_MCP_EPHEMERAL=1: a new key each start; identity, handles, journal and audit live only in process memory, nothing is written to disk. The `seal_share` receipt says the handle lives until the server restarts and the seal's expiry does not depend on it.",
+    several_hosts: "Every MCP host of one user on one machine (Claude Desktop, Claude Code, Cursor) runs its own `serve` on the same state: one seed, one address. The state lock is taken per write, not for a process lifetime: each change re-reads `state.json`, applies this process's insertions and explicit deletions and saves. Waiting for the lock ends after 5 s with `state_busy`.",
+    lost_seed: "The seed is the address: lost (`reset --force`, a wiped keychain with no file) means links addressed to the old key stay unopenable and paired owners must pair again; handoff seals are unaffected. `sealnet-mcp seed --force` prints it, to move the agent by setting SEAL_SEED elsewhere."
   },
   handoff_delivery: {
     primary_channel: "system_clipboard",
@@ -4683,11 +4691,12 @@ var seal_mcp_v1_default = {
     pro_file_not_granted: "seal_pro_file_get: the room's seal is visible but a file's key envelope is refused to this agent.",
     pro_failed: "seal_pro_*: SEAL Pro answered with another error; the message has the status.",
     state_persist_failed: "seal_share: the journal checkpoint (`uploaded` or `delivering`) could not be made durable. The fresh seal is auto-revoked (compensation outcome embedded in the message) because delivering a capability the journal cannot account for is worse than failing the call.",
+    state_busy: "Another sealnet-mcp process held the state lock for more than 5 s. Nothing was changed by this call; safe to retry.",
     runtime_unsupported: "Node runtime is missing a global the bundle assumes (e.g. `globalThis.File` or `globalThis.Blob`). Upgrade to Node \u226520.",
     internal_inconsistency: "Server detected a state branch the type-system thought was unreachable (e.g. forward gate passed but recipientPub is null). Always a bug \u2014 caller should report.",
-    "state.passphrase_invalid": "AES-256-GCM tag check failed. Likely wrong passphrase in keychain / env; could be tampered file. Server refuses to start.",
+    identity_conflict: "Startup: the state does not open with this seed's passphrase nor with a migration passphrase \u2014 it belongs to another key (a foreign SEAL_SEED), or it was tampered with. Server refuses to start (exit 3); see `root_secret.identity_conflict`.",
     "state.corrupt": "Envelope JSON malformed or version unknown. Server refuses to start; user must rerun `sealnet-mcp init --force` (lose old data) or restore from backup.",
-    state_dir_unsafe: "Startup: the state directory is a symlink or not a real directory \u2014 the lifetime lock and the envelope it protects would resolve to different places. Server refuses to start.",
+    state_dir_unsafe: "The state directory is a symlink or not a real directory \u2014 the state lock and the envelope it protects would resolve to different places. Refused.",
     base_url_invalid: "Startup/config: backend or public-host base URL is not an absolute http(s) URL, or carries a query string / fragment / embedded credentials. Every derived URL would be corrupt, so the value is rejected at configuration time."
   },
   current_format_version: 1,
@@ -11511,7 +11520,7 @@ function safeFilename(name) {
   return cleaned.length > 0 ? cleaned : "seal-file";
 }
 async function receiveToDisk(opened, dir, name) {
-  const fs2 = await import(
+  const fs3 = await import(
     /* webpackIgnore: true */
     /* @vite-ignore */
     "fs/promises"
@@ -11521,10 +11530,10 @@ async function receiveToDisk(opened, dir, name) {
     /* @vite-ignore */
     "path"
   );
-  await fs2.mkdir(dir, { recursive: true });
+  await fs3.mkdir(dir, { recursive: true });
   const suffix = Array.from(crypto.getRandomValues(new Uint8Array(6)), (b) => b.toString(16).padStart(2, "0")).join("");
   const tmp = path.join(dir, `.seal-partial-${suffix}`);
-  const fh = await fs2.open(tmp, "wx", 384);
+  const fh = await fs3.open(tmp, "wx", 384);
   let placed = false;
   try {
     await opened.stream.pipeTo(
@@ -11542,12 +11551,12 @@ async function receiveToDisk(opened, dir, name) {
     for (let i = 0; i < 1e3; i++) {
       const candidate = path.join(dir, i === 0 ? name : `${stem} (${i})${ext}`);
       try {
-        await fs2.link(tmp, candidate);
+        await fs3.link(tmp, candidate);
       } catch (err2) {
         if (err2.code === "EEXIST") continue;
         throw err2;
       }
-      await fs2.unlink(tmp);
+      await fs3.unlink(tmp);
       placed = true;
       return { path: candidate, sizeBytes, sha256: sha2562 };
     }
@@ -11555,7 +11564,7 @@ async function receiveToDisk(opened, dir, name) {
   } finally {
     if (!placed) {
       await fh.close().catch(() => void 0);
-      await fs2.unlink(tmp).catch(() => void 0);
+      await fs3.unlink(tmp).catch(() => void 0);
     }
   }
 }
@@ -11993,6 +12002,9 @@ async function generateIdentity() {
   const { publicKey, secretKey } = await generateRecipientKeyPair();
   return { secret: secretKey, public: publicKey };
 }
+async function identityFromSeed(seed) {
+  return { secret: seed, public: await recipientPublicKey(seed) };
+}
 function identityToFields(id) {
   return {
     x25519_secret_b64: toB64(id.secret),
@@ -12026,20 +12038,27 @@ var import_node_crypto = require("crypto");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var LOCK_FILE_NAME = "state.lock";
+var LOCK_WAIT_MS = 5e3;
+var LOCK_RETRY_MS = 25;
 var StateLockedError = class extends Error {
   code = "state_locked";
   holder;
   lockPath;
   constructor(lockPath, holder) {
     const who = holder === null ? "holder info unreadable" : `pid ${holder.pid} on ${holder.hostname} since ${holder.acquired_at}`;
-    super(
-      `state directory is locked by another sealnet-mcp process (${who}). Only one writer may use a state dir at a time; stop the other instance or point this one at a different --state-dir. Lock file: ${lockPath}`
-    );
+    super(`state directory is locked by another sealnet-mcp process (${who}). Lock file: ${lockPath}`);
     this.name = "StateLockedError";
     this.holder = holder;
     this.lockPath = lockPath;
   }
 };
+var StateBusyError = class extends Error {
+  code = "state_busy";
+  constructor(locked) {
+    super(`${locked.message}; waited ${LOCK_WAIT_MS / 1e3} s, nothing was changed, safe to retry`);
+    this.name = "StateBusyError";
+  }
+};
 var StateDirUnsafeError = class extends Error {
   code = "state_dir_unsafe";
   constructor(stateDir, reason) {
@@ -12058,6 +12077,9 @@ function defaultIsPidAlive(pid) {
     return code === "EPERM";
   }
 }
+function holderMayRun(holder, deps = {}) {
+  return holder.hostname !== (deps.host ?? (0, import_node_os.hostname)()) || (deps.isPidAlive ?? defaultIsPidAlive)(holder.pid);
+}
 function parseHolder(raw) {
   try {
     const parsed = JSON.parse(raw);
@@ -12100,7 +12122,7 @@ async function tryCreate(lockPath, info) {
     await (0, import_promises2.unlink)(tmp).catch(() => void 0);
   }
 }
-async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
+async function tryBreakStale(lockPath, probed, deps) {
   const claimPath = `${lockPath}.break-${process.pid}-${(0, import_node_crypto.randomBytes)(4).toString("hex")}`;
   try {
     await (0, import_promises2.rename)(lockPath, claimPath);
@@ -12108,8 +12130,7 @@ async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
     return true;
   }
   const claimed = parseHolder(await (0, import_promises2.readFile)(claimPath, "utf8").catch(() => ""));
-  const claimedStale = claimed === null || claimed.hostname === selfHost && !isAlive(claimed.pid);
-  if (sameHolder(claimed, probed) || claimedStale) {
+  if (sameHolder(claimed, probed) || claimed === null || !holderMayRun(claimed, deps)) {
     await (0, import_promises2.unlink)(claimPath).catch(() => void 0);
     return true;
   }
@@ -12122,11 +12143,9 @@ async function tryBreakStale(lockPath, probed, isAlive, selfHost) {
 }
 async function acquireStateLock(stateDir, deps = {}) {
   const lockPath = (0, import_node_path.join)(stateDir, LOCK_FILE_NAME);
-  const isAlive = deps.isPidAlive ?? defaultIsPidAlive;
-  const selfHost = deps.host ?? (0, import_node_os.hostname)();
   const self2 = {
     pid: deps.pid ?? process.pid,
-    hostname: selfHost,
+    hostname: deps.host ?? (0, import_node_os.hostname)(),
     acquired_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   await (0, import_promises2.mkdir)(stateDir, { recursive: true, mode: 448 });
@@ -12137,11 +12156,10 @@ async function acquireStateLock(stateDir, deps = {}) {
   await (0, import_promises2.chmod)(stateDir, 448).catch(() => void 0);
   if (!await tryCreate(lockPath, self2)) {
     const holder = await readHolder(lockPath);
-    const stale = holder !== null && holder.hostname === selfHost && !isAlive(holder.pid);
-    if (holder !== null && !stale) {
+    if (holder !== null && holderMayRun(holder, deps)) {
       throw new StateLockedError(lockPath, holder);
     }
-    if (!await tryBreakStale(lockPath, holder, isAlive, selfHost)) {
+    if (!await tryBreakStale(lockPath, holder, deps)) {
       throw new StateLockedError(lockPath, await readHolder(lockPath));
     }
     if (!await tryCreate(lockPath, self2)) {
@@ -12173,6 +12191,30 @@ async function acquireStateLock(stateDir, deps = {}) {
     }
   };
 }
+var queues = /* @__PURE__ */ new Map();
+function withStateLock(stateDir, fn, deps = {}) {
+  const run = (queues.get(stateDir) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    let lock;
+    for (; ; ) {
+      try {
+        lock = await acquireStateLock(stateDir, deps);
+        break;
+      } catch (err2) {
+        if (!(err2 instanceof StateLockedError)) throw err2;
+        if (Date.now() >= deadline) throw new StateBusyError(err2);
+        await new Promise((resolve5) => setTimeout(resolve5, LOCK_RETRY_MS));
+      }
+    }
+    try {
+      return await fn();
+    } finally {
+      await lock.release();
+    }
+  });
+  queues.set(stateDir, run);
+  return run;
+}
 async function probeStateLock(stateDir, deps = {}) {
   const lockPath = (0, import_node_path.join)(stateDir, LOCK_FILE_NAME);
   const holder = await readHolder(lockPath);
@@ -12184,10 +12226,7 @@ async function probeStateLock(stateDir, deps = {}) {
       return { held: false, holder: null, stale: false };
     }
   }
-  const isAlive = deps.isPidAlive ?? defaultIsPidAlive;
-  const sameHost = holder.hostname === (deps.host ?? (0, import_node_os.hostname)());
-  const stale = sameHost && !isAlive(holder.pid);
-  return { held: true, holder, stale };
+  return { held: true, holder, stale: !holderMayRun(holder, deps) };
 }
 
 // src/recovery.ts
@@ -12204,6 +12243,10 @@ async function recoverPendingOperations(view, client, opts = {}) {
       log4(`[seal-mcp] recovery: skipping unknown pending op tool=${String(op.tool)} handle=${handle}`);
       continue;
     }
+    if (op.owner !== void 0 && op.owner.pid !== process.pid && holderMayRun(op.owner)) {
+      log4(`[seal-mcp] recovery: left ${handle} alone \u2014 pid ${op.owner.pid} on ${op.owner.hostname} may still run it`);
+      continue;
+    }
     if (op.seal_id === void 0) {
       delete view.pending[handle];
       report.dropped.push(handle);
@@ -12293,7 +12336,7 @@ var AES_KEY_BYTES = 32;
 var AES_NONCE_BYTES = 12;
 var StatePassphraseInvalid = class extends Error {
   constructor() {
-    super("state.passphrase_invalid: AES-256-GCM tag check failed");
+    super("AES-256-GCM tag check failed: another passphrase, or a tampered file");
     this.name = "StatePassphraseInvalid";
   }
 };
@@ -12493,6 +12536,13 @@ async function saveState(state, passphrase, statePath) {
   await import_node_fs2.promises.chmod(dir, 448).catch(() => {
   });
 }
+function updateState(passphrase, statePath, mutate) {
+  return withStateLock((0, import_node_path2.dirname)(statePath), async () => {
+    const view = await loadState(passphrase, statePath);
+    if (await mutate(view) !== false) await saveState(view, passphrase, statePath);
+    return view;
+  });
+}
 
 // src/tools/context.ts
 var import_node_crypto3 = require("crypto");
@@ -12510,19 +12560,18 @@ var HANDLE_REGEX = /^h_[A-Za-z0-9_-]{12,}$/;
 function isValidHandle(handle) {
   return typeof handle === "string" && HANDLE_REGEX.test(handle);
 }
+function auditEntry(ctx, tool, handle, mode) {
+  return { ts: (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString(), tool, handle, mode };
+}
 function appendAudit(ctx, tool, handle, mode) {
-  ctx.state.audit.push({
-    ts: (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
-    tool,
-    handle,
-    mode
-  });
+  const entry = auditEntry(ctx, tool, handle, mode);
+  return ctx.update((state) => void state.audit.push(entry));
 }
-function insertHandle(ctx, handle, entry) {
-  if (ctx.state.handles[handle]) {
+function insertHandle(state, handle, entry) {
+  if (state.handles[handle]) {
     throw new Error(`insertHandle: collision on ${handle}`);
   }
-  ctx.state.handles[handle] = entry;
+  state.handles[handle] = entry;
 }
 function lookupHandle(ctx, handle) {
   const entry = ctx.state.handles[handle];
@@ -12545,6 +12594,7 @@ var ToolError = class extends Error {
 // src/tools/list.ts
 var SINGLE_FILE_COUNT = 1;
 async function sealList(ctx, input = {}) {
+  await appendAudit(ctx, "seal_list", null, null);
   const now = (ctx.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const entries = [];
   for (const [handle, entry] of Object.entries(ctx.state.handles)) {
@@ -12561,8 +12611,6 @@ async function sealList(ctx, input = {}) {
     });
   }
   entries.sort((a, b) => Date.parse(b.created_at) - Date.parse(a.created_at));
-  appendAudit(ctx, "seal_list", null, null);
-  await ctx.persist();
   return { entries };
 }
 
@@ -12647,13 +12695,11 @@ async function sealOpen(ctx, input) {
   if (mode === "inline") {
     const refusal = classifyInlineRefusal(first.mime);
     if (refusal !== null) {
-      appendAudit(ctx, "seal_open", handle, mode);
-      await ctx.persist();
+      await appendAudit(ctx, "seal_open", handle, mode);
       return { handle, refusal, mime: first.mime, note: refusalNote(refusal, first.mime) };
     }
     if (first.size > INLINE_CIPHERTEXT_MAX_BYTES) {
-      appendAudit(ctx, "seal_open", handle, mode);
-      await ctx.persist();
+      await appendAudit(ctx, "seal_open", handle, mode);
       return {
         handle,
         refusal: "inline_blocked.too_large",
@@ -12689,12 +12735,10 @@ async function sealOpen(ctx, input) {
         err2
       );
     }
-    appendAudit(ctx, "seal_open", handle, mode);
-    await ctx.persist();
+    await appendAudit(ctx, "seal_open", handle, mode);
     return { handle, mime: bareMime(first.mime), sizeBytes: plaintext.byteLength, encoding: "utf-8", content };
   }
-  appendAudit(ctx, "seal_open", handle, mode);
-  await ctx.persist();
+  await appendAudit(ctx, "seal_open", handle, mode);
   return {
     handle,
     filename: first.name,
@@ -12740,8 +12784,7 @@ async function openToDisk(ctx, seal, handle, input) {
       throw streamError(err2, file.id);
     }
   }
-  appendAudit(ctx, "seal_open", handle, "file");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_open", handle, "file");
   return { handle, files: out };
 }
 
@@ -12844,8 +12887,7 @@ async function sealRequest(ctx, input, deps) {
   if (input.whereUrl) cliArgs.push("--where", input.whereUrl);
   const local = await (deps.runCli ?? runSealCli)(cliArgs);
   if (local && "files" in local) {
-    appendAudit(ctx, "seal_request", handle, "local");
-    await ctx.persist();
+    await appendAudit(ctx, "seal_request", handle, "local");
     return {
       handle,
       source: "local",
@@ -12885,8 +12927,7 @@ async function sealRequest(ctx, input, deps) {
     }
     return receiveThroughLink(ctx, handle, intake.id, deps, input.onProgress);
   }
-  appendAudit(ctx, "seal_request", handle, "link");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_request", handle, "link");
   return { handle, url, emoji, expiresAt: intake.expires_at };
 }
 async function receiveThroughLink(ctx, handle, intakeId, deps, onProgress) {
@@ -12907,8 +12948,7 @@ async function receiveThroughLink(ctx, handle, intakeId, deps, onProgress) {
   const opened = await sealOpen(ctx, { url: `${deps.publicHost}${sharePath}`, mode: "file", dir, onProgress });
   if (!("files" in opened)) throw new ToolError("internal_inconsistency", "seal_open mode=file returned no files");
   ctx.requests?.delete(handle);
-  appendAudit(ctx, "seal_request", handle, "link");
-  await ctx.persist();
+  await appendAudit(ctx, "seal_request", handle, "link");
   return {
     handle,
     source: "link",
@@ -12921,6 +12961,7 @@ async function sealRevoke(ctx, input) {
   if (!isValidHandle(input.handle)) {
     throw new ToolError("handle_invalid", `handle does not match contract pattern: ${input.handle}`);
   }
+  await ctx.update(() => false);
   const entry = lookupHandle(ctx, input.handle);
   const now = (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
   if (entry.revoked_at) {
@@ -12955,15 +12996,17 @@ async function sealRevoke(ctx, input) {
       err2
     );
   }
-  entry.revoked_at = now;
-  appendAudit(ctx, "seal_revoke", input.handle, entry.mode);
-  await ctx.persist();
+  await ctx.update((state) => {
+    state.handles[input.handle] = { ...entry, revoked_at: now };
+    state.audit.push(auditEntry(ctx, "seal_revoke", input.handle, entry.mode));
+  });
   return { revoked: true, revokedAt: now };
 }
 
 // src/tools/share.ts
 var import_node_fs5 = require("fs");
 var import_promises9 = require("fs/promises");
+var import_node_os7 = require("os");
 var import_node_path8 = require("path");
 
 // ../../contracts/limits.json
@@ -13190,6 +13233,7 @@ function guessMimeFromName(name) {
 }
 var VALID_TTL = ["5m", "30m", "1h", "1d", "7d"];
 var EXPIRE_DEFAULT = seal_mcp_v1_default.tools.seal_share.expire_default;
+var HANDOFF_OUTPUT = seal_mcp_v1_default.tools.seal_share.output_handoff;
 var TIER_BYTES2 = limits_default2.limits.TIER_BYTES;
 var PAYMENT_RECEIPT = "The file is larger than 1 GB. Show the user the payment link; the upload continues after payment. Then call seal_share with `payment` set to this handle.";
 function defaultExpire(mode, size) {
@@ -13217,31 +13261,46 @@ var FORWARD_MAX_READS_FORCED = 1;
 function nowIso2(ctx) {
   return (ctx.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
 }
-async function persistBestEffort(ctx) {
+function journal(ctx, handle, op) {
+  return ctx.update((state) => {
+    state.pending[handle] = op;
+  });
+}
+function dropJournal(ctx, handle) {
+  return ctx.update((state) => {
+    delete state.pending[handle];
+  });
+}
+function complete(ctx, handle, entry) {
+  return ctx.update((state) => {
+    insertHandle(state, handle, entry);
+    state.audit.push(auditEntry(ctx, "seal_share", handle, entry.mode));
+    delete state.pending[handle];
+  });
+}
+async function bestEffort(write) {
   try {
-    await ctx.persist();
+    await write;
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
-    process.stderr.write(`[seal-mcp] warn: journal persist failed during compensation: ${msg}
+    process.stderr.write(`[seal-mcp] warn: journal write failed: ${msg}
 `);
   }
 }
-async function compensateRevoke(ctx, handle) {
-  const op = ctx.state.pending[handle];
-  const sealId = op?.seal_id;
-  if (!op || sealId === void 0) {
+async function compensateRevoke(ctx, handle, op) {
+  const sealId = op.seal_id;
+  if (sealId === void 0) {
     return "no live seal to revoke";
   }
   try {
     await ctx.client.revoke(sealId, op.owner_token_b64);
-    delete ctx.state.pending[handle];
-    await persistBestEffort(ctx);
+    await bestEffort(dropJournal(ctx, handle));
     return "seal auto-revoked";
   } catch (err2) {
     const msg = err2 instanceof Error ? err2.message : String(err2);
     op.step = "compensating";
     op.compensation = { action: "revoke", outcome: "failed", error: msg, at: nowIso2(ctx) };
-    await persistBestEffort(ctx);
+    await bestEffort(journal(ctx, handle, op));
     return `auto-revoke FAILED (${msg}) \u2014 the orphaned seal stays live until its TTL (${op.expires_at}); revoke is journaled and will be retried at next server start`;
   }
 }
@@ -13413,13 +13472,14 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
     // backend this seal is actually created on — recovery refuses to
     // "revoke" against a different backend whose 404 would be misread
     // as success.
-    backend_url: ctx.client.baseUrl
+    backend_url: ctx.client.baseUrl,
+    // SPEC-ADDRESS F1 §4: another MCP host starting now must not recover
+    // (revoke) this upload while it runs.
+    owner: { pid: process.pid, hostname: (0, import_node_os7.hostname)() }
   };
-  ctx.state.pending[handle] = op;
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    delete ctx.state.pending[handle];
     throw new ToolError(
       "state_persist_failed",
       `refusing to upload: could not journal the operation before its first remote effect: ${err2 instanceof Error ? err2.message : String(err2)}`,
@@ -13440,7 +13500,7 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
       // `uploaded` checkpoint after this call is the durability gate.
       onSealCreated: async (sealId) => {
         op.seal_id = sealId;
-        await persistBestEffort(ctx);
+        await bestEffort(journal(ctx, handle, op));
       }
     });
   } catch (err2) {
@@ -13449,15 +13509,14 @@ async function uploadAndDeliver(ctx, input, deps, prepared) {
       return awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, expiresAt, session });
     }
     if (op.seal_id !== void 0) {
-      const outcome = await compensateRevoke(ctx, handle);
+      const outcome = await compensateRevoke(ctx, handle, op);
       throw new ToolError(
         "upload_failed",
         `seal upload failed after the seal was created: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
         err2
       );
     }
-    delete ctx.state.pending[handle];
-    await persistBestEffort(ctx);
+    await bestEffort(dropJournal(ctx, handle));
     throw new ToolError(
       "upload_failed",
       `seal upload failed: ${err2 instanceof Error ? err2.message : String(err2)}`,
@@ -13470,9 +13529,9 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   op.seal_id = uploaded.sealId;
   op.step = "uploaded";
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "state_persist_failed",
       `could not journal the live seal after upload: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13485,7 +13544,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     shareBlobBytes = await encryptShareBlob(fileKeysB64, shareLinkKey, void 0);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "share_blob_failed",
       `share blob encryption failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13497,7 +13556,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     shareCode = await ctx.client.createShareLink(uploaded.sealId, ownerTokenB64, shareBlobB64);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "share_link_failed",
       `POST /seal/${uploaded.sealId}/share failed: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13515,7 +13574,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     try {
       fragment = await buildTargetedFragment(shareLinkKey, recipientPub, uploaded.sealId);
     } catch (err2) {
-      const outcome = await compensateRevoke(ctx, handle);
+      const outcome = await compensateRevoke(ctx, handle, op);
       const message = err2 instanceof Error ? err2.message : String(err2);
       if (message.includes("non-contributory")) {
         throw new ToolError(
@@ -13536,7 +13595,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   const host = resolvePublicHost(deps.publicHost);
   const shareUrl = `${host}/s/${uploaded.sealId}/${shareCode}#${fragment}`;
   if (mode === "forward") {
-    insertHandle(ctx, handle, {
+    await complete(ctx, handle, {
       seal_id: uploaded.sealId,
       owner_token_b64: ownerTokenB64,
       created_at: nowIso2(ctx),
@@ -13544,9 +13603,6 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
       expires_at: expiresAt,
       backend_url: ctx.client.baseUrl
     });
-    appendAudit(ctx, "seal_share", handle, mode);
-    delete ctx.state.pending[handle];
-    await ctx.persist();
     return {
       handle,
       shareUrl,
@@ -13558,9 +13614,9 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   op.step = "delivering";
   op.handoff_channels_attempted = deps.handoff?.disableClipboard ? ["file"] : ["clipboard", "file"];
   try {
-    await ctx.persist();
+    await journal(ctx, handle, op);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "state_persist_failed",
       `could not journal the delivery attempt before handing off the URL: ${err2 instanceof Error ? err2.message : String(err2)} (${outcome})`,
@@ -13571,14 +13627,14 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
   try {
     handoff = await performHandoff({ handle, shareUrl, expireMs }, deps.handoff);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError(
       "handoff_both_channels_failed",
       `both clipboard and file handoff channels failed \u2014 ${outcome}`,
       err2
     );
   }
-  insertHandle(ctx, handle, {
+  await complete(ctx, handle, {
     seal_id: uploaded.sealId,
     owner_token_b64: ownerTokenB64,
     created_at: nowIso2(ctx),
@@ -13587,10 +13643,7 @@ async function deliver(ctx, deps, { mode, recipientPub, expireMs }, { handle, op
     handoff_channel: handoff.channel,
     backend_url: ctx.client.baseUrl
   });
-  appendAudit(ctx, "seal_share", handle, mode);
-  delete ctx.state.pending[handle];
-  await ctx.persist();
-  const delivered = handoff.channel === "clipboard" ? "The seal link is on your clipboard. Paste it to the recipient." : `The seal link is in ${handoff.file} (mode 0600, removed automatically later). Give it to the recipient.`;
+  const delivered = handoff.channel === "clipboard" ? HANDOFF_OUTPUT.receipt_clipboard : HANDOFF_OUTPUT.receipt_file.replace("{file}", handoff.file ?? "");
   const verified = uploaded.verification === "verified" ? delivered : `${delivered} The server has not finished verifying the file: for the next few seconds the recipient sees "not ready", after which the link works.`;
   const receipt = ctx.ephemeral ? `${verified} This server keeps no state on disk: the handle lives until it restarts; the seal's expiry does not depend on it.` : verified;
   return {
@@ -13608,12 +13661,12 @@ async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, se
   const tier = prepared.tier;
   const sealId = op.seal_id;
   op.step = "awaiting_payment";
-  await persistBestEffort(ctx);
+  await bestEffort(journal(ctx, handle, op));
   let paymentUrl;
   try {
     paymentUrl = await ctx.client.createCheckout(sealId, ownerTokenB64, tier);
   } catch (err2) {
-    const outcome = await compensateRevoke(ctx, handle);
+    const outcome = await compensateRevoke(ctx, handle, op);
     throw new ToolError("payment_failed", `POST /billing/checkout failed: ${messageOf3(err2)} (${outcome})`, err2);
   }
   const deadline = paymentDeadline(op.expires_at);
@@ -13623,7 +13676,7 @@ async function awaitPayment(ctx, deps, prepared, { handle, op, ownerTokenB64, se
     clearTimeout(timer);
     ctx.payments?.delete(handle);
     await prepared.cleanup();
-    throw new ToolError(code, `${why} (${await compensateRevoke(ctx, handle)})`);
+    throw new ToolError(code, `${why} (${await compensateRevoke(ctx, handle, op)})`);
   };
   const finish = async (onProgress) => {
     if (running) throw new ToolError("payment_invalid", `share ${handle} is already being finished`);
@@ -13792,7 +13845,7 @@ function proFileGetOutputToWire(out) {
 }
 
 // src/server.ts
-var SERVER_VERSION = "0.2.4";
+var SERVER_VERSION = "0.3.0";
 var toolMeta = (name) => {
   const { title, description, annotations } = seal_mcp_v1_default.tools[name];
   return { title, description, annotations };
@@ -13819,41 +13872,29 @@ function progressReporter(extra) {
 }
 async function createServer(options) {
   logEngineToStderr();
-  let view;
-  let identity;
-  let lock = null;
   const client = new SealApi({ baseUrl: resolveBackendUrl(options.backendBaseUrl) });
   const disk = options.state;
+  let view;
+  const update = async (mutate) => {
+    if (disk === null) await mutate(view);
+    else view = await updateState(disk.passphrase, disk.path, mutate);
+  };
+  let identity;
   if (disk === null) {
     identity = await generateIdentity();
     view = createEmptyState(identityToFields(identity));
   } else {
-    const held = await acquireStateLock((0, import_node_path9.dirname)(disk.path));
-    lock = held;
-    try {
-      view = await loadState(disk.passphrase, disk.path);
-      identity = await loadIdentity(view.identity);
-      const { changed } = await recoverPendingOperations(view, client);
-      if (changed) {
-        await saveState(view, disk.passphrase, disk.path);
-      }
-    } catch (err2) {
-      await held.release();
-      throw err2;
-    }
+    view = await updateState(disk.passphrase, disk.path, async (state) => (await recoverPendingOperations(state, client)).changed);
+    identity = await loadIdentity(view.identity);
   }
   const publicHost = resolvePublicHost(options.publicHost);
-  let persistChain = Promise.resolve();
-  const persist = () => {
-    if (disk === null) return Promise.resolve();
-    persistChain = persistChain.catch(() => void 0).then(() => saveState(view, disk.passphrase, disk.path));
-    return persistChain;
-  };
   const ctx = {
-    state: view,
+    get state() {
+      return view;
+    },
     identity,
     client,
-    persist,
+    update,
     ephemeral: disk === null,
     requests: /* @__PURE__ */ new Map(),
     payments: /* @__PURE__ */ new Map()
@@ -14056,18 +14097,12 @@ async function createServer(options) {
     );
   }
   const transport = new import_stdio.StdioServerTransport();
-  try {
-    await mcp.connect(transport);
-  } catch (err2) {
-    await lock?.release();
-    throw err2;
-  }
+  await mcp.connect(transport);
   const close = async () => {
     try {
       await mcp.close();
     } finally {
       await transport.close().catch(() => void 0);
-      await lock?.release();
     }
   };
   return { mcp, transport, close };
@@ -14081,7 +14116,7 @@ async function wrapTool(fn, toWire) {
       structuredContent: wire
     };
   } catch (err2) {
-    if (err2 instanceof ToolError) {
+    if (err2 instanceof ToolError || err2 instanceof StateBusyError) {
       return {
         isError: true,
         content: [
@@ -14101,8 +14136,8 @@ async function wrapTool(fn, toWire) {
 }
 
 // src/paths.ts
-var import_node_os7 = require("os");
-var import_node_path10 = require("path");
+var import_node_os8 = require("os");
+var import_node_path9 = require("path");
 var APP_NAME = "seal-mcp";
 var STATE_FILE_NAME = "state.json";
 function resolveStateDir(opts = {}) {
@@ -14110,7 +14145,7 @@ function resolveStateDir(opts = {}) {
   if (opts.cliFlag !== void 0 && opts.cliFlag.length > 0) {
     return {
       dir: opts.cliFlag,
-      statePath: (0, import_node_path10.join)(opts.cliFlag, STATE_FILE_NAME),
+      statePath: (0, import_node_path9.join)(opts.cliFlag, STATE_FILE_NAME),
       source: "flag"
     };
   }
@@ -14118,51 +14153,56 @@ function resolveStateDir(opts = {}) {
   if (envOverride !== void 0 && envOverride.length > 0) {
     return {
       dir: envOverride,
-      statePath: (0, import_node_path10.join)(envOverride, STATE_FILE_NAME),
+      statePath: (0, import_node_path9.join)(envOverride, STATE_FILE_NAME),
       source: "env"
     };
   }
-  const dir = osDefaultDir(env, opts.platform ?? process.platform, opts.home ?? (0, import_node_os7.homedir)());
-  return { dir, statePath: (0, import_node_path10.join)(dir, STATE_FILE_NAME), source: "os-default" };
+  const dir = osDefaultDir(env, opts.platform ?? process.platform, opts.home ?? (0, import_node_os8.homedir)());
+  return { dir, statePath: (0, import_node_path9.join)(dir, STATE_FILE_NAME), source: "os-default" };
 }
 function osDefaultDir(env, platform, home) {
   switch (platform) {
     case "darwin":
-      return (0, import_node_path10.join)(home, "Library", "Application Support", APP_NAME);
+      return (0, import_node_path9.join)(home, "Library", "Application Support", APP_NAME);
     case "win32": {
       const appdata = env.APPDATA;
-      return appdata !== void 0 && appdata.length > 0 ? (0, import_node_path10.join)(appdata, APP_NAME) : (0, import_node_path10.join)(home, "AppData", "Roaming", APP_NAME);
+      return appdata !== void 0 && appdata.length > 0 ? (0, import_node_path9.join)(appdata, APP_NAME) : (0, import_node_path9.join)(home, "AppData", "Roaming", APP_NAME);
     }
     default: {
       const xdg = env.XDG_CONFIG_HOME;
-      return xdg !== void 0 && xdg.length > 0 ? (0, import_node_path10.join)(xdg, APP_NAME) : (0, import_node_path10.join)(home, ".config", APP_NAME);
+      return xdg !== void 0 && xdg.length > 0 ? (0, import_node_path9.join)(xdg, APP_NAME) : (0, import_node_path9.join)(home, ".config", APP_NAME);
     }
   }
 }
 
-// src/passphrase.ts
+// src/seed.ts
 var import_node_child_process2 = require("child_process");
 var import_node_crypto4 = require("crypto");
-var SERVICE_NAME = "seal-mcp";
-var ACCOUNT_NAME = "state";
-var ENV_VAR = "SEAL_MCP_PASSPHRASE";
-var KEYCHAIN_SERVICE = SERVICE_NAME;
-var KEYCHAIN_ACCOUNT = ACCOUNT_NAME;
-var PASSPHRASE_ENV_VAR = ENV_VAR;
-var KeytarUnavailableError = class extends Error {
-  code = "keytar_unavailable";
-  constructor(detail) {
-    super(`keytar unavailable: ${detail}`);
-    this.name = "KeytarUnavailableError";
-  }
-};
-var PassphraseNotFoundError = class extends Error {
-  code = "passphrase_not_found";
-  constructor() {
+var import_node_fs6 = require("fs");
+var import_node_path10 = require("path");
+var SEED_ENV_VAR = "SEAL_SEED";
+var EPHEMERAL_ENV_VAR = "SEAL_MCP_EPHEMERAL";
+var PASSPHRASE_ENV_VAR = "SEAL_MCP_PASSPHRASE";
+var SEED_FILE_NAME = "seed";
+var KEYCHAIN_SERVICE = "seal-mcp";
+var KEYCHAIN_ACCOUNT = "seed";
+var LEGACY_KEYCHAIN_ACCOUNT = "state";
+var SeedInvalidError = class extends Error {
+  code = "seed_invalid";
+  constructor(where) {
+    super(
+      `${where} is not an agent key: expected 43 base64url characters, as \`sealnet-mcp seed --force\` or \`seal keygen --export --force\` print them`
+    );
+    this.name = "SeedInvalidError";
+  }
+};
+var IdentityConflictError = class extends Error {
+  code = "identity_conflict";
+  constructor(statePath) {
     super(
-      `No passphrase found. Run \`sealnet-mcp init\` to store one in your OS keychain, or export ${ENV_VAR} for CI/headless use.`
+      `${statePath} does not open with this agent's key: it belongs to another key (a foreign ${SEED_ENV_VAR}?) or was tampered with. Unset ${SEED_ENV_VAR}, or run \`sealnet-mcp reset --force\` to start over with a new address.`
     );
-    this.name = "PassphraseNotFoundError";
+    this.name = "IdentityConflictError";
   }
 };
 function keyringEntry(keyring, platform, service, account) {
@@ -14197,114 +14237,147 @@ async function loadKeytar() {
   try {
     const mod = await import("@napi-rs/keyring");
     const keyring = mod.default ?? mod;
-    keyringEntry(keyring, process.platform, SERVICE_NAME, ACCOUNT_NAME);
+    keyringEntry(keyring, process.platform, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
     keytarCache = keytarOverKeyring(keyring);
   } catch {
     keytarCache = null;
   }
   return keytarCache;
 }
-async function loadKeytarOrThrow() {
-  const k = await loadKeytar();
-  if (k === null) {
-    throw new KeytarUnavailableError(
-      "no OS keychain. On Linux start a Secret Service (gnome-keyring or KWallet); on macOS/Windows this should never happen \u2014 file a bug."
-    );
+async function keychainGet(account) {
+  const keytar = await loadKeytar();
+  if (keytar === null) return null;
+  try {
+    const value = await keytar.getPassword(KEYCHAIN_SERVICE, account);
+    return value !== null && value.length > 0 ? value : null;
+  } catch {
+    return null;
   }
-  return k;
 }
-async function resolvePassphraseFromStores(env = process.env) {
+async function keychainDelete(account) {
+  const keytar = await loadKeytar();
+  if (keytar === null) return false;
+  try {
+    return await keytar.deletePassword(KEYCHAIN_SERVICE, account);
+  } catch {
+    return false;
+  }
+}
+function parseSeed(text, where) {
+  const seed = Buffer.from(text, "base64url");
+  if (!/^[A-Za-z0-9_-]{43}$/.test(text) || seed.toString("base64url") !== text) throw new SeedInvalidError(where);
+  return new Uint8Array(seed);
+}
+async function readSeed(stateDir, env = process.env) {
+  const fromEnv = env[SEED_ENV_VAR]?.trim();
+  if (fromEnv) return { seed: parseSeed(fromEnv, SEED_ENV_VAR), source: "env" };
+  const stored = await keychainGet(KEYCHAIN_ACCOUNT);
+  if (stored !== null) return { seed: parseSeed(stored, `keychain entry ${KEYCHAIN_SERVICE}/${KEYCHAIN_ACCOUNT}`), source: "keychain" };
+  const file = (0, import_node_path10.join)(stateDir, SEED_FILE_NAME);
+  let text;
+  try {
+    text = await import_node_fs6.promises.readFile(file, "utf8");
+  } catch (err2) {
+    if (err2.code === "ENOENT") return null;
+    throw err2;
+  }
+  return { seed: parseSeed(text.trim(), file), source: "file" };
+}
+async function storeSeed(stateDir, seed) {
+  const text = Buffer.from(seed).toString("base64url");
   const keytar = await loadKeytar();
   if (keytar !== null) {
     try {
-      const stored = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-      if (stored !== null && stored.length > 0) {
-        return { passphrase: stored, source: "keychain" };
-      }
+      await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, text);
+      return "keychain";
     } catch {
     }
   }
-  const fromEnv = env[ENV_VAR];
-  if (fromEnv !== void 0 && fromEnv.length > 0) {
-    return { passphrase: fromEnv, source: "env" };
+  const fh = await import_node_fs6.promises.open((0, import_node_path10.join)(stateDir, SEED_FILE_NAME), "wx", 384);
+  try {
+    await fh.writeFile(`${text}
+`, "utf8");
+    await fh.sync();
+  } finally {
+    await fh.close();
   }
-  return null;
+  return "file";
 }
-async function probeKeychain() {
-  const keytar = await loadKeytar();
-  if (keytar === null) return { available: false, hasEntry: false };
+function statePassphrase(seed) {
+  return Buffer.from((0, import_node_crypto4.hkdfSync)("sha256", seed, "seal-mcp:state:v1", "passphrase", 32)).toString("base64url");
+}
+async function legacyPassphrase(env) {
+  const stored = await keychainGet(LEGACY_KEYCHAIN_ACCOUNT);
+  if (stored !== null) return { passphrase: stored, source: "keychain" };
+  const fromEnv = env[PASSPHRASE_ENV_VAR];
+  return fromEnv ? { passphrase: fromEnv, source: "env" } : null;
+}
+async function tryOpen(passphrase, statePath) {
   try {
-    const v = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
-    return { available: true, hasEntry: v !== null && v.length > 0 };
-  } catch {
-    return { available: false, hasEntry: false };
+    return await loadState(passphrase, statePath);
+  } catch (err2) {
+    if (err2 instanceof StatePassphraseInvalid) return null;
+    throw err2;
   }
 }
-async function setKeychainPassphrase(passphrase) {
-  if (passphrase.length === 0) {
-    throw new Error("refusing to store an empty passphrase in the keychain");
-  }
-  const keytar = await loadKeytarOrThrow();
-  await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, passphrase);
+async function requireIdentity(view, seed, statePath) {
+  const { secret } = await loadIdentity(view.identity);
+  if (!Buffer.from(secret).equals(Buffer.from(seed))) throw new IdentityConflictError(statePath);
+}
+function openAgentState(path, env = process.env) {
+  return withStateLock(path.dir, async () => {
+    let root = await readSeed(path.dir, env);
+    if (!await import_node_fs6.promises.stat(path.statePath).then(() => true, () => false)) {
+      if (root === null) {
+        const { secret } = await generateIdentity();
+        root = { seed: secret, source: await storeSeed(path.dir, secret) };
+      }
+      const passphrase2 = statePassphrase(root.seed);
+      const identity = await identityFromSeed(root.seed);
+      await saveState(createEmptyState(identityToFields(identity)), passphrase2, path.statePath);
+      return { root, passphrase: passphrase2, created: true, moved: null };
+    }
+    if (root !== null) {
+      const view2 = await tryOpen(statePassphrase(root.seed), path.statePath);
+      if (view2 !== null) {
+        await requireIdentity(view2, root.seed, path.statePath);
+        return { root, passphrase: statePassphrase(root.seed), created: false, moved: null };
+      }
+    }
+    const legacy = await legacyPassphrase(env);
+    const view = legacy === null ? null : await tryOpen(legacy.passphrase, path.statePath);
+    if (legacy === null || view === null) throw new IdentityConflictError(path.statePath);
+    if (root !== null) await requireIdentity(view, root.seed, path.statePath);
+    else {
+      const { secret } = await loadIdentity(view.identity);
+      root = { seed: secret, source: await storeSeed(path.dir, secret) };
+    }
+    const passphrase = statePassphrase(root.seed);
+    await saveState(view, passphrase, path.statePath);
+    await keychainDelete(LEGACY_KEYCHAIN_ACCOUNT);
+    return { root, passphrase, created: false, moved: legacy.source };
+  });
 }
-async function deleteKeychainPassphrase() {
+async function deleteRootSecret(stateDir) {
+  let seedFile = true;
+  await import_node_fs6.promises.unlink((0, import_node_path10.join)(stateDir, SEED_FILE_NAME)).catch((err2) => {
+    if (err2.code !== "ENOENT") throw err2;
+    seedFile = false;
+  });
+  const seed = await keychainDelete(KEYCHAIN_ACCOUNT);
+  const legacy = await keychainDelete(LEGACY_KEYCHAIN_ACCOUNT);
+  return { seedFile, keychain: seed || legacy };
+}
+async function probeKeychain() {
   const keytar = await loadKeytar();
-  if (keytar === null) return false;
+  if (keytar === null) return { available: false, hasSeed: false };
   try {
-    return await keytar.deletePassword(SERVICE_NAME, ACCOUNT_NAME);
+    const value = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    return { available: true, hasSeed: value !== null && value.length > 0 };
   } catch {
-    return false;
+    return { available: false, hasSeed: false };
   }
 }
-async function promptHiddenPassphrase(prompt) {
-  const stdin = process.stdin;
-  if (!stdin.isTTY) {
-    throw new Error(
-      `Cannot prompt for passphrase: stdin is not a TTY. Set ${ENV_VAR} for non-interactive use.`
-    );
-  }
-  process.stdout.write(prompt);
-  const wasRaw = stdin.isRaw;
-  stdin.setRawMode(true);
-  stdin.resume();
-  stdin.setEncoding("utf8");
-  return new Promise((resolve5, reject) => {
-    let buf = "";
-    const cleanup = () => {
-      stdin.removeListener("data", onData);
-      stdin.setRawMode(wasRaw);
-      stdin.pause();
-      process.stdout.write("\n");
-    };
-    const onData = (chunk) => {
-      const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      for (let i = 0; i < text.length; i++) {
-        const ch = text[i];
-        if (ch === "") {
-          cleanup();
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "" && buf.length === 0) {
-          cleanup();
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "\r" || ch === "\n") {
-          cleanup();
-          resolve5(buf);
-          return;
-        }
-        if (ch === "\x7F" || ch === "\b") {
-          buf = buf.slice(0, -1);
-          continue;
-        }
-        buf += ch;
-      }
-    };
-    stdin.on("data", onData);
-  });
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   APP_NAME,
@@ -14312,16 +14385,20 @@ async function promptHiddenPassphrase(prompt) {
   BackendError,
   DEFAULT_BACKEND_URL,
   DEFAULT_PUBLIC_HOST,
+  EPHEMERAL_ENV_VAR,
   HandoffBothChannelsFailedError,
+  IdentityConflictError,
   KEYCHAIN_ACCOUNT,
   KEYCHAIN_SERVICE,
-  KeytarUnavailableError,
   LOCK_FILE_NAME,
   PASSPHRASE_ENV_VAR,
   PUBLIC_HOST_ENV_VAR,
-  PassphraseNotFoundError,
+  SEED_ENV_VAR,
+  SEED_FILE_NAME,
   STATE_FILE_NAME,
   SealApi,
+  SeedInvalidError,
+  StateBusyError,
   StateCorrupt,
   StateLockedError,
   StatePassphraseInvalid,
@@ -14329,20 +14406,22 @@ async function promptHiddenPassphrase(prompt) {
   acquireStateLock,
   createEmptyState,
   createServer,
-  deleteKeychainPassphrase,
+  deleteRootSecret,
   generateHandle,
   generateIdentity,
+  holderMayRun,
+  identityFromSeed,
   identityToFields,
   isValidHandle,
   loadIdentity,
   loadState,
+  openAgentState,
   performHandoff,
   probeKeychain,
   probeStateLock,
-  promptHiddenPassphrase,
+  readSeed,
   recoverPendingOperations,
   resolveBackendUrl,
-  resolvePassphraseFromStores,
   resolvePublicHost,
   resolveStateDir,
   saveState,
@@ -14350,7 +14429,9 @@ async function promptHiddenPassphrase(prompt) {
   sealOpen,
   sealRevoke,
   sealShare,
-  setKeychainPassphrase
+  statePassphrase,
+  updateState,
+  withStateLock
 });
 /*! Bundled license information: