seisin 0.2.0 → 0.3.0

package/src/grants.js

@@ -0,0 +1,239 @@
+/**
+ * What a line of policy grants on disk, as paths.
+ *
+ * Pulled out of srt.js, which used to hold both halves: translating a policy
+ * into paths, and assembling the runtime's settings object out of them. The
+ * first half has a second reader now — surface.js asks "what can ANY role
+ * write?" to decide what the parent must not trust — and a module that needs
+ * the answer should not have to import the settings builder to get it.
+ *
+ * No policy decisions live here. Every function answers "which path does this
+ * mean", and the callers decide what to do with it.
+ */
+import { join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { realpathSync, lstatSync } from "node:fs";
+import { createHash } from "node:crypto";
+
+/**
+ * What every agent needs to write no matter which role it is.
+ *
+ * Found by running a real cell config through the sandbox: territory alone
+ * looks correct and is unusable. An agent writes its session state under its
+ * own config directory and its tools write scratch files to the temp dir, so a
+ * policy of "your folders and nothing else" stops the agent before it starts.
+ *
+ * The list is not Claude-shaped by accident and it was Claude-shaped by
+ * mistake: the first version named `~/.claude` and `~/.codex` and stopped
+ * there, so the first agent that was neither — opencode, which logs to
+ * `~/.local/share/opencode` — died on startup with `FileSystem.open`. Hence the
+ * XDG directories, which is where a CLI that follows convention puts its state.
+ *
+ * `~/.config` is deliberately NOT here. That is where credentials live —
+ * `~/.config/gh/hosts.yml` holds a GitHub token — and while reads outside the
+ * declared key directories are open anyway, letting an agent WRITE there is a
+ * different thing. A CLI that needs it can be granted it by name.
+ *
+ * These are grants, so they are listed rather than assumed: `seisin check`
+ * prints them, and `[runtime] writes = []` turns them off for anyone who wants
+ * to find out the hard way. Note what is NOT here — the home directory, the
+ * shell profile, anything under the repo. Scratch space is not a back door.
+ */
+/**
+ * Where a role's home and scratch live when `[runtime] isolate = true`.
+ *
+ * Under the state directory but outside the repo tree the roles write, so one
+ * role cannot reach another's. Kept out of `.seisin/` inside the repo because
+ * that whole directory is denyWrite now.
+ */
+/**
+ * Short on purpose, and the reason is the same one spool.js already names: a
+ * unix socket path is capped near 104 bytes on macOS and the failure when it is
+ * too long is an unhelpful EINVAL.
+ *
+ * This file forgot that one layer down. The runtime creates its multiplexing
+ * socket INSIDE the role's home — `<home>/tmp/srt-mux-<pid>-0.sock`, 25 bytes —
+ * and the name here used to be `seisin-home-` plus 16 characters. On macOS
+ * `tmpdir()` is 48 bytes on its own, so the total cleared 104 for **every role
+ * name**, `qa` included: `isolate = true` did not misbehave, it failed to start.
+ * Measured, and it is why `homeFits` below exists rather than a comment.
+ *
+ * Eleven bytes instead of twenty-eight leaves room for a role name up to
+ * {@link MAX_ROLE_FOR_HOME} characters.
+ */
+export function roleHomeRoot(config) {
+  /**
+   * A hash of the whole path, not a slice of it.
+   *
+   * This was `base64url(root).slice(-16)` — the TAIL of the encoded path, which
+   * is the tail of the path itself. Two checkouts that end the same way get the
+   * same id: `/Users/ana/dev/proyecto` and `/Users/bob/dev/proyecto` collide, and
+   * so do `/home/a/work/api` and `/home/b/work/api`. A collision here is not a
+   * cosmetic clash — both repos' role `dev` would share one HOME, which is the
+   * session token of one handed to the other. Measured on three of four ordinary
+   * pairs; shortening the slice to fit the socket limit would have made it more
+   * likely, not less.
+   */
+  const id = createHash("sha256").update(config.root).digest("base64url").slice(0, 8);
+  return join(tmpdir(), `sn-${id}`);
+}
+
+/** What the runtime appends inside the role's home, at its longest. */
+const SRT_SOCKET_TAIL = "/tmp/srt-mux-999999-0.sock".length;
+
+/** The platform's cap on a unix socket path. macOS is the tight one. */
+export const SOCKET_MAX = 104;
+
+/**
+ * Whether a role's isolated home leaves room for the runtime's socket.
+ *
+ * Returns the room left over, negative when it does not fit. Callers refuse
+ * rather than let the runtime fail with EINVAL and no explanation — a boundary
+ * that cannot start should say so in its own words.
+ */
+export function homeFits(config, role) {
+  return SOCKET_MAX - (roleHome(config, role).length + SRT_SOCKET_TAIL);
+}
+
+export function roleHome(config, role) {
+  return join(roleHomeRoot(config), role);
+}
+
+/**
+ * Where credentials live in a home directory, denied at both isolate levels.
+ *
+ * Denies rather than a read allowlist, and the reasoning is above: a
+ * default-deny read set has to enumerate every library, interpreter and cache a
+ * toolchain touches, gets one wrong, and fails as an unexplainable crash inside
+ * the agent. Naming the places credentials actually live is narrower than the
+ * ideal and holds up.
+ *
+ * `~/.config` is here whole rather than `~/.config/gh`: it is where a growing
+ * number of CLIs keep their tokens, and listing them one by one is the
+ * enumeration this list exists to avoid. A tool that needs a directory under it
+ * can be granted it by name.
+ */
+export const CREDENTIAL_HOMES = [
+  // The order is not arbitrary: `check` names the first few, so the ones a
+  // reader recognises instantly go first. Everything in the list is denied
+  // either way.
+  "~/.ssh", "~/.aws", "~/.npmrc", "~/.config",
+  "~/.gnupg", "~/.kube", "~/.docker", "~/.netrc", "~/.git-credentials",
+];
+
+export const RUNTIME_WRITES = [
+  "~/.claude", "~/.codex",                 // the CLIs that keep state under their own name
+  "~/.local/share", "~/.local/state",      // XDG data and state: where most others log
+  "~/.cache", "$TMPDIR", "/tmp",
+];
+
+/**
+ * `~` and `$TMPDIR` are the only expansions; everything else is a literal path.
+ *
+ * Symlinks are then resolved, and that is not a nicety. On macOS `/tmp` is a
+ * link to `/private/tmp`, and the sandbox enforces on the destination — so a
+ * grant written as `/tmp` grants exactly nothing, silently. Measured: with the
+ * literal path, writing to /tmp inside the sandbox failed while the policy
+ * looked correct on screen.
+ */
+/** Is this exact path a symlink? False if it is not on disk. */
+export function isLink(p) {
+  try {
+    return lstatSync(p).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
+/** The path with symlinks followed, or the path itself if it is not on disk. */
+export function realOrSelf(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+
+export function expand(p) {
+  let out = p;
+  if (p === "$TMPDIR") out = tmpdir();
+  else if (p === "~" || p.startsWith("~/")) out = join(homedir(), p.slice(2));
+  try {
+    return realpathSync(out);
+  } catch {
+    return out; // not on disk yet; hand the literal through rather than drop it
+  }
+}
+
+/**
+ * `allowWrite` takes directories, not globs: the OS grants a subtree, it does
+ * not pattern-match. `src/api/**` and `src/api/` mean the same thing to the
+ * kernel, so the trailing glob is trimmed rather than passed through, where it
+ * would be read as a literal directory named `**` and silently grant nothing.
+ */
+export function toWritePath(glob, key = "writes") {
+  if (!EXPRESSIBLE(glob)) throw new Error(unexpressible(glob, key));
+  if (glob === "**") return ".";
+  return glob.replace(/\/\*\*$/, "") || ".";
+}
+
+/**
+ * A write pattern the kernel can be given without changing its meaning.
+ *
+ * Exactly two shapes qualify: a literal path, and a subtree ending in `/**`.
+ * Both map onto what allowWrite actually is — a prefix — so the policy, the
+ * explanation and the enforcement stay the same sentence.
+ *
+ * Everything else is refused, and the one that made this necessary is `src/*`.
+ * ownersOf() reads it as one level, because `*` compiles to `[^/]*`. The old
+ * translation trimmed the `/*` and handed the kernel `src`, which is the whole
+ * subtree. So `seisin explain` said denied and the write landed — measured, not
+ * theorised. The document was tighter than the boundary, which is the one
+ * direction a permission tool must never fail in.
+ *
+ * There is no exact translation to find later: Seatbelt and bubblewrap grant
+ * prefixes, and "one level down" is not a prefix. Refusing is not a placeholder
+ * here, it is the answer.
+ */
+const WILD = /[*?[\]]/;                       // owners.js treats all four as wildcards
+const EXPRESSIBLE = (g) =>
+  g === "**" ||                               // the whole repo
+  !WILD.test(g) ||                            // a literal path
+  (g.endsWith("/**") && !WILD.test(g.slice(0, -3)));   // a subtree, wildcard-free above it
+
+function unexpressible(glob, key = "writes") {
+  return `${key} = "${glob}" cannot be enforced as written.\n` +
+    `  The sandbox grants a path and everything under it — there is no way to say ` +
+    `"one level deep".\n` +
+    `  Use "${glob.replace(/\/\*$/, "")}/**" for the whole subtree, or name the files.\n` +
+    `  Refusing rather than widening: the old behaviour granted the subtree while ` +
+    `seisin reported the narrow pattern.`;
+}
+
+/**
+ * Every directory a role may write, absolute, as its settings will say it.
+ *
+ * Observe mode is not a role property — any role can be run with it — and it
+ * grants the whole repo, so `observe: true` answers for that case.
+ *
+ * `.seisin/` is deliberately NOT here. It used to be, because the hook runs
+ * inside the box and has to record what it decided — which made the log and
+ * the queue writable by the process they are a record of. The hook now sends
+ * its lines to the parent over a socket and the parent holds the file. See
+ * spool.js.
+ *
+ * Isolated: this role's own home and scratch, and nothing shared. Otherwise:
+ * the real ~/.claude, ~/.cache and /tmp, which every role shares — convenient,
+ * and the reason `isolate` exists.
+ */
+export function writePathsOf(config, role, { observe = false } = {}) {
+  const abs = (p) => (p.startsWith("/") ? p : join(config.root, p));
+  const level = config.isolate === true ? "home" : config.isolate;
+  const home = level === "home" ? roleHome(config, role.name) : null;
+  return [
+    ...(observe ? [abs(".")] : role.writes.map((g) => abs(toWritePath(g)))),
+    ...(home
+      ? [home, join(home, ".config"), join(home, ".local"), join(home, ".cache"), join(home, "tmp")]
+      : (config.runtimeWrites ?? RUNTIME_WRITES).map(expand)),
+  ];
+}

package/src/hook.js

@@ -16,6 +16,7 @@
  * is a minor one here, because the enforcer is the kernel and it is not fooled.
  * What escapes this file goes unexplained, not unblocked.
  */
+import { toRepoRelative } from "./paths.js";
 import { explain, normalize } from "./owners.js";
 import { append, logPath } from "./log.js";
 import { timesHit } from "./walls.js";
@@ -139,7 +140,7 @@ export function decide(config, role, event, { observe = false, now = append, ask
   const verdicts = [];
 
   for (const t of targets) {
-    const rel = t.path.startsWith(config.root + "/") ? t.path.slice(config.root.length + 1) : t.path;
+    const rel = toRepoRelative(config, t.path);
     const kind = kindOf(config, rel);
 
     // Reading an ordinary file is never a policy question. Territory divides
@@ -168,7 +169,11 @@ export function decide(config, role, event, { observe = false, now = append, ask
     // the refusal stops being a dead end and becomes something a person can act
     // on in one command. Observing records nothing to approve — there was no
     // denial to answer. See docs/permission-requests.md.
-    if (!observe && !v.allowed)
+    //
+    // Except a `never_writes` refusal. That one is the policy saying no on
+    // purpose; a request for it asks a person to undo a subtraction somebody
+    // wrote, and approving it is how the subtraction disappears unnoticed.
+    if (!observe && !v.allowed && !v.neverWrites && !v.gitMetadata)
       ask(queue, { role, action: kind === "key" ? "read" : t.action, target: rel, owners: v.owners ?? [] });
 
     // The action as it was RECORDED, not as the tool named it: a read of a key
@@ -216,7 +221,11 @@ export function decide(config, role, event, { observe = false, now = append, ask
       permissionDecisionReason:
         // The sentence has to name a next step, not just a refusal. An agent
         // told "no" retries; an agent told whose it is asks, or moves on.
-        (denied.owners?.length
+        denied.neverWrites
+          ? `${denied.reason}. Do not ask for it: nothing was queued, because the answer is already written down.` + again
+          : denied.gitMetadata
+          ? `${denied.reason}. Nothing was queued.` + again
+          : (denied.owners?.length
           ? wasRead
             ? `${denied.target} is declared for ${denied.owners.join(", ")}, not ${role}. Ask for what you need from it rather than reading the key.`
             : `${denied.target} belongs to ${denied.owners.join(", ")}. It is not ${role}'s to change — hand it over rather than working around it.`

package/src/inspect.js

@@ -10,11 +10,13 @@
  */
 import { resolve, dirname, basename, relative, join, delimiter } from "node:path";
 import { realpathSync, lstatSync, readdirSync, existsSync, readFileSync, statSync } from "node:fs";
-import { ownersOf } from "./owners.js";
+import { ownersOf, covers, enforcedNeverWrites } from "./owners.js";
+import { ROLE_KEYS } from "./config.js";
 import { entriesOf } from "./keys.js";
 import { SHAPES } from "./scan.js";
 import { wired } from "./commands/wire.js";
 import { RUNTIME_WRITES, CREDENTIAL_HOMES, expand, settingsFor } from "./srt.js";
+import { protections, resolveExecutable } from "./surface.js";
 
 /**
  * A report on one config: the roles, and every way the map lies.
@@ -29,7 +31,7 @@ export function inspect(config, only = null, where = config.path) {
 
   return {
     where,
-    roles: roles.map((r) => ({ name: r.name, writes: r.writes, keys: r.keys })),
+    roles: roles.map((r) => ({ name: r.name, writes: r.writes, keys: r.keys, neverWrites: r.neverWrites ?? [], localBinding: r.localBinding === true, localPorts: r.localPorts ?? [], mcp: r.mcp ?? null, trustd: r.trustd === true })),
     /**
      * The provider commands this config would run, listed because they are the
      * one thing in a `seisin.toml` that **executes**, and it executes in the
@@ -42,6 +44,14 @@ export function inspect(config, only = null, where = config.path) {
       name: p.name, command: p.command, mode: p.mode,
     })),
     shared: sharedPaths(config, roles),
+    /**
+     * What the kernel will refuse a role inside its own territory, and why:
+     * programs installed where a role writes, the hooks and settings of each
+     * project, provider scripts and `file://` targets. Each takes something
+     * away from a territory as written, so it is shown rather than applied
+     * quietly. See surface.js for the family and the measurements.
+     */
+    protected: protections(config, roles),
     warnings: warningsFor(config, roles),
     limits: LIMITS,
   };
@@ -69,7 +79,7 @@ const LIMITS = [
       "equivalent to read here — bubblewrap does not log refusals, and the runtime's substitute " +
       "is not reachable from outside it. The boundary holds exactly as well; what you lose is " +
       "seeing it work. Run `seisin wire` so the hook records what it can. The ask is upstream: " +
-      "github.com/carlostapiaolguin3-stack/seisin/blob/main/docs/upstream/cli-violations.md",
+      "github.com/carlostapiacl/seisin/blob/main/docs/upstream/cli-violations.md",
   }]),
   {
     kind: "keys-only-what-you-declared",
@@ -89,7 +99,25 @@ const LIMITS = [
       "library can read them; nothing reaches a caller that runs the binary, which is what " +
       "seisin does. So for an agent whose endpoints are not published, the options are to " +
       "find them another way or drop the network restriction for it. The ask is upstream: " +
-      "github.com/carlostapiaolguin3-stack/seisin/blob/main/docs/upstream/cli-violations.md",
+      "github.com/carlostapiacl/seisin/blob/main/docs/upstream/cli-violations.md",
+  },
+  ...(process.platform === "linux" ? [{
+    kind: "control-files-linux",
+    headline: "a project's hooks and settings are protected only where they already exist",
+    detail:
+      "bubblewrap denies a path by mounting over it, and for a path that is not there it would " +
+      "create it on your disk. So on Linux a role can still create a .git/hooks entry or a " +
+      ".claude/settings.json in a project of its territory that had none. On macOS the kernel " +
+      "refuses creating them too.",
+  }] : []),
+  {
+    kind: "shared-scratch",
+    headline: "roles share ~/.cache, ~/.local/share and the temp dir unless isolate = \"home\"",
+    detail:
+      "programs installed there that are on your PATH are protected, and so are Claude Code's " +
+      "settings and plugins. Anything else a program outside the box reads from those places — a " +
+      "cache it executes, a tool not on PATH — is writable by every role. isolate = \"home\" " +
+      "gives each role its own.",
   },
   {
     kind: "unlink-uncovered",
@@ -99,10 +127,127 @@ const LIMITS = [
       // package, so for most readers it named a file they do not have.
       "writes and deletes are one permission to the kernel, so `rm` inside a " +
       "role's own folders succeeds. Closing it needs denyUnlink in the sandbox " +
-      "runtime: github.com/carlostapiaolguin3-stack/seisin#how-it-holds",
+      "runtime: github.com/carlostapiacl/seisin#how-it-holds",
   },
 ];
 
+/**
+ * What is wrong with a role table's keys, as opposed to its paths.
+ *
+ * Two things, both about `never_writes` and both ways a subtraction can look
+ * written and not be:
+ *
+ *   - a key seisin does not know. It used to be dropped without a word, which
+ *     for `writes` is a role with less than it thinks, and for a misspelt
+ *     `never_writes` is a role with MORE than its owner thinks — the one
+ *     direction a permission file must not fail in. Named with the nearest
+ *     known key when there is one close enough to be the intended spelling.
+ *   - a `never_writes` entry that no `writes` of the same role covers. It
+ *     subtracts from nothing, so it is either a typo in the path or a rule
+ *     that stopped applying when the territory moved. Either way it reads as
+ *     protection and is not.
+ *
+ * Silent when `never_writes` is absent. Absent is valid; a check that asks for
+ * the key would turn an optional subtraction into a required migration.
+ */
+function roleKeyWarnings(roles, config = null) {
+  const warnings = [];
+  for (const r of roles) {
+    const enforced = new Set(enforcedNeverWrites(config, r));
+    const skipped = (r.neverWritesDeclared ?? r.neverWrites ?? []).filter((g) => !enforced.has(g));
+    if (skipped.length)
+      warnings.push({
+        kind: "never-writes-not-enforced-here",
+        headline: `${r.name}: never_writes ${skipped.join(" ")} — not enforced on Linux until it exists`,
+        detail: "bubblewrap denies a path by mounting over it, and would create a missing one on the host " +
+          "for the whole run — for a lock file, locking everyone else out, and for good if the role is " +
+          "killed. seisin skips those, and explain says allowed for them, so the sentence matches the kernel.",
+      });
+    for (const k of r.unknownKeys ?? []) {
+      const near = nearest(k, ROLE_KEYS);
+      warnings.push({
+        kind: "unknown-role-key",
+        headline: `${r.name}: unknown key "${k}" in [roles.${r.name}] — ignored` +
+          (near ? `. Did you mean "${near}"?` : ""),
+        detail: `Known keys: ${ROLE_KEYS.join(", ")}. ` +
+          (near === "never_writes"
+            ? "As written this subtracts nothing: the role can still write every path it lists."
+            : "Nothing in it takes effect."),
+      });
+    }
+    // macOS only, and not by omission: on Linux the runtime removes the network
+    // namespace, so every role already has a loopback of its own — it can serve
+    // and reach its own server with or without the key, and reaches nothing on
+    // the host either way (measured in Docker, Debian 12, bwrap 0.8.0).
+    if (r.localBinding && process.platform === "darwin")
+      warnings.push({
+        kind: "local-binding-reaches-localhost",
+        headline: `${r.name}: local_binding lets it connect to every port on localhost, not only listen`,
+        detail: "The runtime grants bind on any interface, inbound, and outbound to localhost:*. " +
+          "Anything listening on this machine without authentication — a local control API, a " +
+          "database, a dev server — is within this role's reach, outside its territory.",
+      });
+    // Both at once is a config that says "these ports" and grants "every port".
+    // macOS only: on Linux local_binding reaches nothing on the host, so there
+    // local_ports is the only one of the two that does anything.
+    if (r.localBinding && r.localPorts?.length && process.platform === "darwin")
+      warnings.push({
+        kind: "local-ports-moot",
+        headline: `${r.name}: local_ports names ${r.localPorts.join(", ")}, but local_binding already opens every localhost port`,
+        detail: "local_binding grants outbound to localhost:* in the kernel profile, so the port list " +
+          "restricts nothing for this role. Drop local_binding if the role only needs to reach " +
+          "those ports; keep it only if the role has to listen.",
+      });
+    // trustd is a macOS service; on Linux the key changes nothing.
+    if (r.trustd && process.platform === "darwin")
+      warnings.push({
+        kind: "trustd-open",
+        headline: `${r.name}: trustd = true opens com.apple.trustd.agent, a path out that the domain list does not see`,
+        detail: "trustd verifies certificates for Go (before 1.27) and Dart on macOS, and to do it fetches, " +
+          "outside the sandbox, the URLs a certificate carries. The runtime calls it an exfiltration vector; " +
+          "no public demonstration exists. Go 1.27+ does not need it: seisin sets SSL_CERT_FILE.",
+      });
+    for (const g of r.neverWrites ?? []) {
+      if (r.writes.some((w) => covers(w, g) || covers(w, g.replace(/\/\*\*$/, ""))))
+        continue;
+      warnings.push({
+        kind: "never-writes-subtracts-nothing",
+        headline: `${r.name}: never_writes "${g}" is not inside any of its writes`,
+        detail: "It denies something that was already denied, so it protects nothing. " +
+          "Check the path, or drop the entry if the territory moved.",
+      });
+    }
+  }
+  return warnings;
+}
+
+/** The candidate within edit distance 3 of `word`, or null. */
+function nearest(word, candidates) {
+  // Spellings of the same idea in another vocabulary, checked first because
+  // letters mislead here: `no_writes` is three edits from `writes`, and
+  // suggesting the grant for a misspelt subtraction is the worst answer.
+  if (/deny|never|no_?write/i.test(word)) return "never_writes";
+  let best = null, bestD = 4;
+  for (const c of candidates) {
+    const d = distance(word.toLowerCase(), c);
+    if (d < bestD) { best = c; bestD = d; }
+  }
+  return best;
+}
+
+function distance(a, b) {
+  const row = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    let prev = row[0]; row[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      const cur = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
+      prev = cur;
+    }
+  }
+  return row[b.length];
+}
+
 /**
  * Paths more than one role claims.
  *
@@ -247,6 +392,34 @@ function warningsFor(config, roles) {
       });
     }
   }
+  warnings.push(...roleKeyWarnings(roles, config));
+
+  // A provider the parent could not find where no role writes. `run` refuses
+  // it with the same sentence; here it is found before anybody runs anything.
+  for (const [scheme, p] of Object.entries(config.keyProviders ?? {})) {
+    const cmd = p.command?.[0];
+    if (!cmd || cmd.includes("/")) continue;
+    try { resolveExecutable(cmd, config); } catch (e) {
+      if (!/a role can write/.test(e.message)) continue;
+      warnings.push({
+        kind: "provider-in-territory",
+        headline: `the ${scheme}:// provider "${cmd}" is only found where a role can write`,
+        detail: e.message.split("\n").slice(1).map((l) => l.trim()).join(" "),
+      });
+    }
+  }
+
+  // PATH entries that are not absolute resolve against wherever the parent is
+  // standing, which is the repo. They are ignored for every lookup seisin makes
+  // outside the box; said here because a lookup that skips them can find a
+  // different program than your shell does.
+  const unanchored = (process.env.PATH ?? "").split(delimiter).filter((d) => !d || !d.startsWith("/"));
+  if (unanchored.length)
+    warnings.push({
+      kind: "relative-path",
+      headline: `PATH has ${unanchored.length} relative entr${unanchored.length === 1 ? "y" : "ies"} (${unanchored.map((d) => JSON.stringify(d)).join(", ")})`,
+      detail: "They resolve inside the repo, where roles write, so seisin skips them when it looks for a program to run outside the box.",
+    });
   const shared = sharedPaths(config, roles);
 
   if (shared.length)