seisin 0.1.1 → 0.3.0

package/src/serve.js

@@ -18,7 +18,9 @@ import { fileURLToPath } from "node:url";
 import { loadConfig } from "./config.js";
 import { read, logPath } from "./log.js";
 import { settingsFor } from "./srt.js";
-import { pending, requestsPath, settle, applyGrant } from "./requests.js";
+import { pending, requestsPath, settle, applyGrant, refuseIfBarred, markStale } from "./requests.js";
+import { walls } from "./walls.js";
+import { explain } from "./owners.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -29,23 +31,165 @@ const HERE = dirname(fileURLToPath(import.meta.url));
  * page is a view of it — someone editing seisin.toml in an editor should see
  * the console change, not wonder why it disagrees.
  */
-function state(configPath) {
+/**
+ * Today's denials, grouped by what was denied rather than by who asked.
+ *
+ * Called `causes` and not `friction`: `seisin review` already has a `friction`
+ * that counts something narrower — repeated denials that are not about keys —
+ * and two screens of one product reporting different numbers under one label
+ * is the kind of thing nobody notices until they are compared.
+ *
+ * The console used to show them per role, which is the same list a hundred
+ * times over: measured on one deployment, 1,080 of 1,422 refusals were a
+ * single lock file across six repositories, and per-role that reads as six
+ * hundred identical rows instead of one sentence. Grouped, the shape of the
+ * day is visible at a glance and it is almost never a territory dispute.
+ *
+ * `stillRefused` is recomputed against the policy as it stands, not read out
+ * of the log — a cause that has been granted since is history, not friction,
+ * and leaving it on the page sends somebody to fix what is already fixed.
+ */
+export function causesOf(cfg, entries) {
+  const by = new Map();
+  for (const e of entries) {
+    if (e.verdict !== "denied" || !e.target || !e.action) continue;
+    const k = `${e.action}\u0000${e.target}`;
+    const g = by.get(k) ?? { action: e.action, target: e.target, times: 0, roles: new Set(), owners: e.owners ?? [] };
+    g.times++;
+    g.roles.add(e.role);
+    by.set(k, g);
+  }
+  const total = [...by.values()].reduce((n, g) => n + g.times, 0);
+
+  /**
+   * The same grouping again, one level coarser: by the NAME at the end of the
+   * path rather than the path.
+   *
+   * Grouping by path alone gets the most important reading backwards. Measured
+   * here: six of the top seven causes were `.git/index.lock` in six different
+   * repositories, no single one above 17% — so "no cause dominates" is what the
+   * arithmetic says and the opposite of what is true. Three quarters of the
+   * window was one *kind* of thing, and that is a tooling problem with a
+   * mechanical fix, not a territory question anybody needs to rule on.
+   *
+   * By last segment, and nothing cleverer. A regex that recognised lock files,
+   * caches and build outputs would be a list of guesses about other people's
+   * toolchains that quietly goes stale; a repeated filename is a fact about
+   * this log.
+   */
+  const fams = new Map();
+  for (const g of by.values()) {
+    const name = g.target.split("/").filter(Boolean).pop() ?? g.target;
+    const f = fams.get(name) ?? { name, times: 0, paths: 0, where: [], roles: new Set() };
+    f.times += g.times;
+    f.paths++;
+    // The places, so the console can show what a name is made of instead of
+    // asserting a percentage the reader has to take on faith.
+    f.where.push({ target: g.target, times: g.times });
+    for (const r of g.roles) f.roles.add(r);
+    fams.set(name, f);
+  }
+  const families = [...fams.values()]
+    .sort((a, b) => b.times - a.times)
+    .map((f) => ({
+      name: f.name, times: f.times, paths: f.paths,
+      share: total ? f.times / total : 0,
+      roles: [...f.roles].sort(),
+      where: f.where.sort((a, b) => b.times - a.times).slice(0, 20),
+    }));
+
+  /**
+   * What a `grep` over the log cannot tell you.
+   *
+   * The headline used to be "74% of it is one name", and a field review
+   * applied this project's own test to it: *did the number tell you something
+   * you did not know?* For somebody who reads the raw log, no — they had
+   * already counted that. The console was repeating the log back.
+   *
+   * These two are different, because they need the **policy** and the log does
+   * not contain it. `unowned` is the count of causes on paths no role claims:
+   * no grant resolves those until somebody decides who owns them, which is a
+   * decision rather than a number. `settled` is friction that has since been
+   * granted — real yesterday, noise today.
+   */
+  const live = [...by.values()];
+  const unowned = live.filter((g) => !(g.owners ?? []).length).length;
+
+  return {
+    total,
+    unowned,
+    // The real number of distinct causes, not the length of the list below.
+    // The page says "over N distinct paths" and the list is capped at twelve,
+    // so taking N from the list reported the cap as if it were the count —
+    // a wrong number stated confidently, which is worse than no number.
+    distinct: by.size,
+    families: families.slice(0, 8),
+    causes: [...by.values()]
+      .sort((a, b) => b.times - a.times)
+      .slice(0, 12)
+      .map((g) => ({
+        action: g.action,
+        target: g.target,
+        times: g.times,
+        share: total ? g.times / total : 0,
+        roles: [...g.roles].sort(),
+        owners: g.owners,
+        // How many of the roles that hit this would still hit it. `some` and
+        // not `every`: two roles out of three still blocked is still friction,
+        // and requiring all of them would quietly retire a live cause the day
+        // one role got a grant.
+        stillRefused: [...g.roles].filter((r) => cfg.roles[r] && !explain(cfg, r, g.action, g.target).allowed).length,
+      })),
+  };
+}
+
+/**
+ * `?since=<ISO date>`, or null for no filter. Anything that does not parse is
+ * ignored rather than refused: a bad filter should show everything, not an error.
+ */
+export function sinceOf(url) {
+  const raw = new URLSearchParams((url ?? "").split("?")[1] ?? "").get("since");
+  const t = raw ? Date.parse(raw) : NaN;
+  return Number.isNaN(t) ? null : new Date(t).toISOString();
+}
+
+export function state(configPath, { since = null } = {}) {
   const cfg = loadConfig(configPath);
-  const entries = read(logPath(cfg.root), { limit: 200 });
+  // The date filter narrows everything read from the log: activity, causes,
+  // walls and the per-role counts. Not the request queue, which is what is
+  // waiting now whatever the window.
+  const entries = read(logPath(cfg.root), { limit: 200, since });
+  // The whole window, not a tail. "All" used to mean the last 4000 lines, so a
+  // 30-day window could show more denials than "all" did (6k against 4k on a
+  // real log). Every count on the page comes from this list.
+  const forShape = read(logPath(cfg.root), since ? { since } : {});
 
   const roles = Object.values(cfg.roles).map((r) => ({
     name: r.name,
     writes: r.writes,
     keys: r.keys,
     env: r.env,
-    blocks: entries.filter((e) => e.role === r.name && e.verdict === "denied").length,
+    neverWrites: r.neverWritesDeclared ?? r.neverWrites ?? [],
+    localBinding: r.localBinding === true,
+    localPorts: r.localPorts ?? [],
+    mcp: r.mcp ?? null,
+    trustd: r.trustd === true,
+    // Counted over the same window as the causes, so the KPI and the screen it
+    // links to agree.
+    blocks: forShape.filter((e) => e.role === r.name && e.verdict === "denied").length,
     settings: settingsFor(cfg, r.name),
   }));
 
+  // Read once for every role's walls, rather than once per role.
+  const whole = read(logPath(cfg.root), { verdict: "denied", since });
+  // Staleness is about the role's whole history, never the window: a request
+  // is not old just because the filter hides the runs that made it old.
+  const history = since ? read(logPath(cfg.root), { verdict: "denied" }) : whole;
   return {
     root: cfg.root,
     config: cfg.path,
-    requests: pending(requestsPath(cfg.root)),
+    requests: markStale(pending(requestsPath(cfg.root)), history),
+    since,
     // The file itself, not a regeneration of it. The page can render a policy
     // from its own model, and that model has no comments — so showing it under
     // the heading "seisin.toml" next to "copy this back" invites someone to
@@ -54,6 +198,13 @@ function state(configPath) {
     keyDirs: cfg.keyDirs,
     allowedDomains: cfg.allowedDomains,
     roles,
+    causes: causesOf(cfg, forShape),
+    // What each role keeps being refused AND would still be refused today.
+    // Empty for a role that has hit nothing twice, which is most of them.
+    walls: Object.fromEntries(
+      Object.keys(cfg.roles)
+        .map((r) => [r, walls(cfg, r, { entries: whole })])
+        .filter(([, w]) => w.length)),
     log: entries.slice(-60).reverse(),
     live: true,
   };
@@ -81,6 +232,7 @@ function decide(configPath, { number, decision, reason }) {
     // The config is edited as text, so comments and order survive. Written
     // before the queue is settled: if this throws, the request is still open
     // rather than marked done against a file that never changed.
+    refuseIfBarred(cfg, req);
     const { toml, changed } = applyGrant(readFileSync(cfg.path, "utf8"), req, reason);
     if (changed) writeFileSync(cfg.path, toml);
   }
@@ -89,17 +241,49 @@ function decide(configPath, { number, decision, reason }) {
 }
 
 /** The body of a POST, capped: this endpoint takes three short fields. */
-function readBody(req) {
+/**
+ * A request body, capped. The cap is per route: one decision is a few hundred
+ * bytes, but "decline all" carries every key on screen — 109 of them were
+ * 9.3 KB, over the old flat 4 KB, and the connection was cut with nothing but
+ * "Failed to fetch" in the browser. Found by Carlos on the first real use.
+ */
+function readBody(req, max = 4096) {
   return new Promise((ok, fail) => {
     let s = "";
     req.on("data", (c) => {
       s += c;
-      if (s.length > 4096) { fail(new Error("body too large")); req.destroy(); }
+      if (s.length > max) { fail(new Error("body too large")); req.destroy(); }
     });
     req.on("end", () => ok(s));
   });
 }
 
+/**
+ * Refuse every request the page was showing, in one go.
+ *
+ * Only refusing. There is no "approve all" and there will not be: a grant is a
+ * decision about one path and one owner, and doing forty of them without
+ * reading them is the permissive default this tool exists to stand against.
+ * Refusing in bulk is safe — it grants nothing and changes no policy — and it
+ * is what a queue full of noise from a bug already fixed needs.
+ *
+ * By key, not "whatever is pending now": a request that arrived after the page
+ * drew is one the person has not seen, and it stays.
+ */
+function declineAll(configPath, { keys, reason }) {
+  if (!Array.isArray(keys) || !keys.length) throw new Error("keys must list the requests on screen");
+  const cfg = loadConfig(configPath);
+  const file = requestsPath(cfg.root);
+  const wanted = new Set(keys.map(String));
+  let declined = 0;
+  for (const req of pending(file)) {
+    if (!wanted.has(req.key)) continue;
+    settle(file, req.key, "denied", reason ?? "");
+    declined++;
+  }
+  return { ok: true, declined };
+}
+
 export function serve(configPath, port = 4178) {
   const page = join(HERE, "..", "ui", "index.html");
   if (!existsSync(page)) throw new Error("the console is missing from this install");
@@ -114,12 +298,69 @@ export function serve(configPath, port = 4178) {
    */
   const token = randomBytes(24).toString("hex");
 
+  /**
+   * Every route under /api/ asks for the token, reads included.
+   *
+   * The page used to be the only thing that carried the token and /api/state
+   * answered anyone. Both rested on "an agent cannot reach loopback", and
+   * `local_binding = true` on macOS makes that false: the runtime lets that
+   * role connect to every localhost port, and loopback bypasses the egress
+   * proxy. Reproduced end to end by a read-only review on 2026-09-22 — a role
+   * read the token off `GET /`, posted to /api/decide, and approved its own
+   * request into another role's territory. /api/state handed it the policy, the
+   * log and where every key lives, with no token at all.
+   *
+   * So the token no longer travels in any response. `seisin ui` puts it in the
+   * URL fragment, which a browser never sends to a server; the page takes it
+   * from there, keeps it for the tab, and removes it from the address bar and
+   * the history entry. Anything that fetches `/` gets a page with no token in it.
+   */
+  const authorized = (req) => req.headers["x-seisin-token"] === token;
+
+  /**
+   * The Host header has to name this server.
+   *
+   * A page on the operator's browser can point a hostname it controls at
+   * 127.0.0.1 (DNS rebinding) and then read responses as same-origin. It still
+   * could not produce the token, but the check is one line and makes the
+   * question moot: the only names this server answers to are its own.
+   */
+  const hostOk = (req, port) => {
+    const h = String(req.headers.host ?? "");
+    return h === `127.0.0.1:${port}` || h === `localhost:${port}`;
+  };
+
+  /**
+   * The path, without whatever came after `?`.
+   *
+   * `req.url` is the raw request target, so a query string made every route
+   * miss: `http://localhost:4178/?anything` answered 404 on the one page this
+   * server has. Harmless until a launcher appends a parameter or a link is
+   * shared with a suffix on it, and then the console just looks broken.
+   */
+  const pathOf = (u) => (u ?? "/").split("?")[0];
+
   const server = createServer(async (req, res) => {
-    if (req.method === "POST" && req.url === "/api/decide") {
-      if (req.headers["x-seisin-token"] !== token) {
-        res.writeHead(403, { "content-type": "application/json" });
-        return res.end(JSON.stringify({ error: "bad or missing token" }));
+    if (!hostOk(req, server.address()?.port)) {
+      res.writeHead(403, { "content-type": "text/plain" });
+      return res.end("wrong host");
+    }
+    if (pathOf(req.url).startsWith("/api/") && !authorized(req)) {
+      res.writeHead(403, { "content-type": "application/json" });
+      return res.end(JSON.stringify({ error: "bad or missing token — open the URL `seisin ui` printed" }));
+    }
+    if (req.method === "POST" && pathOf(req.url) === "/api/decline-all") {
+      try {
+        // ~85 bytes per key: 1 MB is ten thousand requests on one screen.
+        const out = declineAll(configPath, JSON.parse((await readBody(req, 1024 * 1024)) || "{}"));
+        res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+        return res.end(JSON.stringify(out));
+      } catch (e) {
+        res.writeHead(400, { "content-type": "application/json" });
+        return res.end(JSON.stringify({ error: e.message }));
       }
+    }
+    if (req.method === "POST" && pathOf(req.url) === "/api/decide") {
       try {
         const out = decide(configPath, JSON.parse((await readBody(req)) || "{}"));
         res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
@@ -133,10 +374,10 @@ export function serve(configPath, port = 4178) {
       res.writeHead(405).end("method not allowed");
       return;
     }
-    if (req.url === "/api/state") {
+    if (pathOf(req.url) === "/api/state") {
       let body;
       try {
-        body = JSON.stringify(state(configPath));
+        body = JSON.stringify(state(configPath, { since: sinceOf(req.url) }));
       } catch (e) {
         res.writeHead(500, { "content-type": "application/json" });
         return res.end(JSON.stringify({ error: e.message }));
@@ -145,11 +386,10 @@ export function serve(configPath, port = 4178) {
       res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
       return res.end(body);
     }
-    if (req.url === "/" || req.url === "/index.html") {
-      // Inlined rather than put in the URL: a fragment survives in history, in
-      // a screenshot, and in whatever the operator pastes into a chat.
-      const html = readFileSync(page, "utf8")
-        .replace("</head>", `<script>window.SEISIN_TOKEN=${JSON.stringify(token)}</script></head>`);
+    if (pathOf(req.url) === "/" || pathOf(req.url) === "/index.html") {
+      // No token in here. It used to be inlined, which handed it to anything
+      // that could GET this page — see `authorized` above.
+      const html = readFileSync(page, "utf8");
       res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
       return res.end(html);
     }
@@ -159,7 +399,11 @@ export function serve(configPath, port = 4178) {
   return new Promise((ok, fail) => {
     // Loopback only. The page maps where every credential lives; it has no
     // business being reachable from the network the laptop happens to be on.
-    server.listen(port, "127.0.0.1", () => ok(server));
+    server.listen(port, "127.0.0.1", () => {
+      // For `seisin ui`, which builds the URL, and for tests. Never sent.
+      Object.defineProperty(server, "seisinToken", { value: token });
+      ok(server);
+    });
     server.on("error", (e) =>
       fail(e.code === "EADDRINUSE"
         ? new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`)

package/src/spool.js

@@ -26,8 +26,9 @@
  * solved here; the log is evidence of what happened, not proof that nothing
  * else did.
  */
-import { createServer, createConnection } from "node:net";
-import { unlinkSync, existsSync, mkdtempSync, chmodSync } from "node:fs";
+import { createServer, createConnection, Socket } from "node:net";
+import { unlinkSync, existsSync, mkdtempSync, chmodSync, openSync, writeSync, closeSync, constants } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 
@@ -59,29 +60,78 @@ export function spoolPath() {
  * in. The parent decides what that means; the sender does not get to pick a
  * path, which is the other half of why this is not just a slower file write.
  */
+/**
+ * Which channel this platform can use: a unix socket, or a FIFO.
+ *
+ * On Linux the runtime blocks creating ANY unix socket inside the box with a
+ * seccomp filter — it cannot filter by path, so `allowUnixSockets` is ignored
+ * there (its README says so). The socket this file was built on therefore
+ * never carried a line on Linux: measured in Docker on 2026-09-23, with the
+ * code as published in 0.2.0 and after, the hook "sent" and the log stayed
+ * empty. A FIFO is a file, not a socket — seccomp does not see it, bubblewrap
+ * grants it by path, and a write of up to PIPE_BUF bytes is atomic, so lines
+ * from concurrent tool calls do not interleave. Measured the same day: the
+ * role wrote a line through it, could not create anything beside it, and
+ * could not remove it.
+ */
+export const FIFO_SUFFIX = ".fifo";
+export const channelName = (platform = process.platform) => (platform === "linux" ? "s.fifo" : "s.sock");
+
+/** The most a FIFO write carries atomically on Linux (PIPE_BUF). */
+const PIPE_BUF = 4096;
+
+/** Parses newline-separated JSON messages and hands each to `sink`. */
+function lineReader(sink, onTooLong) {
+  let buffer = "";
+  return (chunk) => {
+    buffer += chunk;
+    // A 1 MB line is not a log entry, it is something trying to fill a disk.
+    if (buffer.length > 1_000_000) { buffer = ""; return onTooLong?.(); }
+    let nl;
+    while ((nl = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      if (!line.trim()) continue;
+      try {
+        const msg = JSON.parse(line);
+        if (msg && (msg.to === "log" || msg.to === "requests")) sink(msg.to, msg.entry);
+      } catch {
+        // Garbage from inside the box is not the parent's emergency.
+      }
+    }
+  };
+}
+
+/**
+ * The FIFO end of the spool. Opened read-write so it never sees end-of-file
+ * when a writer closes — every hook call opens, writes one line and closes —
+ * and read through a net.Socket, which takes a pipe descriptor and reads it
+ * without holding a thread.
+ */
+function fifoSpool(sink, path) {
+  if (existsSync(path)) unlinkSync(path);
+  execFileSync("mkfifo", ["-m", "600", path]);
+  const fd = openSync(path, constants.O_RDWR | constants.O_NONBLOCK);
+  const stream = new Socket({ fd, readable: true, writable: false });
+  stream.setEncoding("utf8");
+  stream.on("data", lineReader(sink));
+  stream.on("error", () => {});
+  return Promise.resolve({
+    path,
+    close() {
+      stream.destroy();
+      try { unlinkSync(path); } catch {}
+    },
+  });
+}
+
 export function spool(sink, path = spoolPath()) {
+  if (path.endsWith(FIFO_SUFFIX)) return fifoSpool(sink, path);
   if (existsSync(path)) unlinkSync(path);
 
   const server = createServer((conn) => {
-    let buffer = "";
     conn.setEncoding("utf8");
-    conn.on("data", (chunk) => {
-      buffer += chunk;
-      // A 1 MB line is not a log entry, it is something trying to fill a disk.
-      if (buffer.length > 1_000_000) return conn.destroy();
-      let nl;
-      while ((nl = buffer.indexOf("\n")) !== -1) {
-        const line = buffer.slice(0, nl);
-        buffer = buffer.slice(nl + 1);
-        if (!line.trim()) continue;
-        try {
-          const msg = JSON.parse(line);
-          if (msg && (msg.to === "log" || msg.to === "requests")) sink(msg.to, msg.entry);
-        } catch {
-          // Garbage from inside the box is not the parent's emergency.
-        }
-      }
-    });
+    conn.on("data", lineReader(sink, () => conn.destroy()));
     conn.on("error", () => {});
   });
 
@@ -136,6 +186,7 @@ const inFlight = new Set();
 
 export function send(to, entry, path = process.env[SOCK_ENV]) {
   if (!path) return false;
+  if (path.endsWith(FIFO_SUFFIX)) return sendFifo(to, entry, path);
   const p = new Promise((done) => {
     let settled = false;
     const finish = () => { if (!settled) { settled = true; done(true); } };
@@ -162,3 +213,30 @@ export function send(to, entry, path = process.env[SOCK_ENV]) {
 export async function flush() {
   await Promise.all([...inFlight]);
 }
+
+/**
+ * One line into the FIFO, synchronously: nothing to flush, nothing to lose to
+ * `process.exit`. Non-blocking, so a parent that is gone (no reader) costs an
+ * ENXIO and not a hung tool call. Longer than PIPE_BUF, the free-text fields
+ * are shortened first — past that size a write is no longer atomic and two
+ * tool calls could interleave their lines.
+ */
+function sendFifo(to, entry, path) {
+  const full = { at: new Date().toISOString(), ...entry };
+  let line = JSON.stringify({ to, entry: full }) + "\n";
+  if (Buffer.byteLength(line) > PIPE_BUF) {
+    const short = { ...full, reason: String(full.reason ?? "").slice(0, 300), target: String(full.target ?? "").slice(0, 1000) };
+    line = JSON.stringify({ to, entry: short }) + "\n";
+    if (Buffer.byteLength(line) > PIPE_BUF) return false;
+  }
+  let fd;
+  try {
+    fd = openSync(path, constants.O_WRONLY | constants.O_NONBLOCK);
+    writeSync(fd, line);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== undefined) try { closeSync(fd); } catch {}
+  }
+}