seisin 0.2.0 → 0.4.0

package/src/requests.js

@@ -26,6 +26,7 @@
  * rewritten is not evidence. A request that is granted or refused is not
  * deleted — it is followed by a line saying what happened to it.
  */
+import { neverWrites, isGitMetadata, covers } from "./owners.js";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { STATE_DIR, tomlString } from "./layout.js";
@@ -173,6 +174,68 @@ export function pending(file, { includeSettled = false } = {}) {
   return includeSettled ? all : all.filter((r) => r.state === "pending");
 }
 
+/**
+ * How many runs of the role, after the last time it asked, make a request old.
+ *
+ * A request is recorded again on every refusal, so one the role still needs
+ * keeps a fresh `last`. One whose need went away — the work moved somewhere the
+ * role may write, or the task ended — stops being asked while the role keeps
+ * running. Three runs is enough to say "not since" and few enough that a queue
+ * does not carry a dead request for a week.
+ */
+export const STALE_RUNS = 3;
+
+/**
+ * Two log lines of a role this far apart belong to different runs — for lines
+ * written before the log had a run marker. Lines with `run` are counted by it.
+ */
+export const RUN_GAP_MS = 10 * 60_000;
+
+/**
+ * How many runs produced these lines, strictly after `since` (ms).
+ *
+ * By the `run` id when a line has one (intake.js writes it on every line since
+ * 2026-09-23), by the gap otherwise. The gap guessed: three runs started a
+ * minute apart by an orchestrator counted as one, and one run idle for eleven
+ * minutes counted as two.
+ */
+export function runsAfter(entries, since, gapMs = RUN_GAP_MS) {
+  const ids = new Set();
+  const untagged = [];
+  for (const e of entries) {
+    const t = Date.parse(e.at);
+    if (Number.isNaN(t) || t <= since) continue;
+    if (e.run) ids.add(e.run);
+    else untagged.push(t);
+  }
+  untagged.sort((a, b) => a - b);
+  let n = 0, prev = -Infinity;
+  for (const t of untagged) { if (t - prev > gapMs) n++; prev = t; }
+  return ids.size + n;
+}
+
+/**
+ * Marks the requests the role has stopped asking for, read off the log.
+ *
+ * Marked, never settled and never moved. Declining is a person's decision, and
+ * reordering would shift the numbers `grant <n>` is typed against while
+ * nobody decided anything. The mark says what is true — the role ran N times
+ * since and did not ask again — and leaves the rest to whoever reads it.
+ * `entries` are log lines (`read(logPath(root))`); `now` is for the tests.
+ */
+export function markStale(queue, entries, { runs = STALE_RUNS, gapMs = RUN_GAP_MS } = {}) {
+  const byRole = new Map();             // role -> its log lines
+  for (const e of entries) {
+    if (!e.role) continue;
+    (byRole.get(e.role) ?? byRole.set(e.role, []).get(e.role)).push(e);
+  }
+  for (const r of queue) {
+    const n = runsAfter(byRole.get(r.role) ?? [], Date.parse(r.last), gapMs);
+    if (n >= runs) r.stale = { runs: n, since: r.last };
+  }
+  return queue;
+}
+
 /**
  * Adds a granted glob to a role in the config text, with its provenance.
  *
@@ -195,6 +258,31 @@ export function pending(file, { includeSettled = false } = {}) {
  * is the worst possible bug, and it is not exotic: a role with only `keys`
  * declared is an ordinary config.
  */
+/**
+ * Refuses a grant that `never_writes` would cancel, before anything is written.
+ *
+ * A request filed before the subtraction existed can still be in the queue.
+ * Approving it would add the path to `writes` and change nothing — denyWrite
+ * wins — so the person would believe they granted something the kernel still
+ * refuses. The two keys contradict each other, and which one should win is the
+ * decision; seisin will not make it by writing one of them silently.
+ */
+export function refuseIfBarred(config, request) {
+  if (request.action === "read") return;
+  const role = config.roles?.[request.role];
+  const hit = role && neverWrites(role, request.target, config);
+  if (hit)
+    throw new Error(
+      `${request.target} is under never_writes of ${request.role} ("${hit}"), which wins over ` +
+      `writes. Granting it would change nothing. If the subtraction is wrong, remove that ` +
+      `entry from [roles.${request.role}]; otherwise decline this request.`);
+  // Only a repository the role does not write: its own `.git` is its own business.
+  if (isGitMetadata(request.target) && !(role?.writes ?? []).some((g) => covers(g, request.target)))
+    throw new Error(
+      `${request.target} is git's own bookkeeping, not a territory: granting it lets ${request.role} ` +
+      `rewrite another owner's history. Decline it; a role that needs to commit gets a worktree of its own.`);
+}
+
 export function applyGrant(toml, request, note = "") {
   const field = request.action === "read" ? "keys" : "writes";
   const header = new RegExp(`^\\[roles\\.${escapeRe(request.role)}\\]\\s*$`, "m");

package/src/review.js

@@ -73,7 +73,7 @@ function findings(config, entries, minDenials) {
   const stopped = new Map();                 // role + directory -> how often
   for (const e of entries) {
     if (e.verdict !== "denied" || !e.target) continue;
-    const dir = e.action === "read" ? e.target : dirOf(e.target);
+    const dir = e.action === "read" || e.action === "connect" ? e.target : dirOf(e.target);
     const key = `${e.role} ${e.action} ${dir}`;
     const seen = stopped.get(key) ?? {
       role: e.role, action: e.action, where: dir, times: 0,
@@ -81,7 +81,7 @@ function findings(config, entries, minDenials) {
       // Carried by the log from both writers — the hook sets it from the config
       // and so does the parent for a kernel denial. Recomputing it from the path
       // here would be a second opinion on a settled question.
-      kind: e.kind === "key" ? "key" : "file",
+      kind: e.kind === "key" || e.kind === "network" ? e.kind : "file",
     };
     seen.times++;
     stopped.set(key, seen);
@@ -91,8 +91,10 @@ function findings(config, entries, minDenials) {
     .filter((f) => f.times >= minDenials)
     .sort((a, b) => b.times - a.times);
 
-  const friction = repeated.filter((f) => f.kind !== "key");
+  const friction = repeated.filter((f) => f.kind !== "key" && f.kind !== "network");
   const guarded = repeated.filter((f) => f.kind === "key");
+  // Ports and sockets: repeated, and not a thing `grant` can answer.
+  const connects = repeated.filter((f) => f.kind === "network");
 
   /* ── 2. what was granted and never used ─────────────────────────────── */
 
@@ -144,7 +146,9 @@ function findings(config, entries, minDenials) {
 
   const unowned = new Map();
   for (const e of entries) {
-    if (!e.target || e.kind === "key") continue;
+    // A key directory is closed on purpose; a port or a socket is not a path
+    // anybody could own. Neither is a hole in the map.
+    if (!e.target || e.kind === "key" || e.kind === "network") continue;
     if (ownersOf(config, e.target).length) continue;
     const dir = dirOf(e.target);
     unowned.set(dir, (unowned.get(dir) ?? 0) + 1);
@@ -153,6 +157,7 @@ function findings(config, entries, minDenials) {
   return {
     friction,
     guarded,
+    connects,
     unused,
     unusedKnowable: knowable,
     unowned: [...unowned.entries()]

package/src/rundir.js

@@ -0,0 +1,113 @@
+/**
+ * One private directory per run, for everything that belongs to that run only:
+ * the audit socket, the sandbox settings, and `scratch` keys.
+ *
+ * ── Why ──
+ * These lived in two places and both leaked. The settings were written to
+ * `.seisin/<role>.json`, one file per ROLE, so two runs of the same role — an
+ * orchestrator does that all day — wrote the same file with different socket
+ * paths, and one could start with the other's. The socket and the scratch keys
+ * lived in `$TMPDIR/seisin-XXXX/`, private by mode, but every role runs as the
+ * same user and every role can read the temp dir: measured on 2026-09-23, one
+ * role read another's `scratch` key while it ran (`cat …/keys/S` → the value).
+ *
+ * ── How ──
+ * All runs live under one root, `$TMPDIR/snr/`, and each role's profile denies
+ * reading that root and allows reading its own run's directory — the shape the
+ * key directories and the isolated homes already use. The root is denied for
+ * writing too, so no role can swap it for a symlink between runs.
+ *
+ * Short names on purpose: the socket path is capped near 104 bytes on macOS.
+ */
+import { mkdirSync, mkdtempSync, lstatSync, chmodSync, writeFileSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { join, basename, dirname } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { realOrSelf } from "./grants.js";
+import { channelName } from "./spool.js";
+
+export const RUNS_NAME = "snr";
+
+/**
+ * The root every run lives under, created private, and checked.
+ *
+ * Real path, because the kernel enforces on real paths and on macOS the temp
+ * dir sits behind /var → /private/var. Refused rather than used when it is not
+ * a directory of this user's with nobody else's bits on it: it holds keys.
+ */
+export function runsRoot(base = tmpdir()) {
+  const root = join(realOrSelf(base), RUNS_NAME);
+  try { mkdirSync(root, { mode: 0o700 }); } catch (e) { if (e.code !== "EEXIST") throw e; }
+  const st = lstatSync(root);
+  const mine = typeof process.getuid !== "function" || st.uid === process.getuid();
+  if (st.isSymbolicLink() || !st.isDirectory() || !mine)
+    throw new Error(
+      `${root} is not a directory of yours (${st.isSymbolicLink() ? "it is a symlink" : "wrong owner or type"}).\n` +
+      `  It holds each run's socket and keys, so seisin will not use it. Remove it and run again.`);
+  if (st.mode & 0o077) chmodSync(root, 0o700);
+  return root;
+}
+
+/** Is the process that owns a run directory still alive? */
+function alive(pid) {
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
+}
+
+/**
+ * Removes the directories of runs whose process is gone.
+ *
+ * A run cleans up after itself on exit. A run that is killed does not, and
+ * its directory keeps its `scratch` keys on disk indefinitely — measured by
+ * SIGKILL on a keyed run. Swept at the start of the next one; a directory
+ * without a pid file is younger than the write that creates it, and is left.
+ */
+function sweep(root) {
+  for (const name of readdirSync(root)) {
+    const dir = join(root, name);
+    let pid;
+    try { pid = Number(readFileSync(join(dir, "pid"), "utf8")); } catch { continue; }
+    if (pid && !alive(pid)) rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Opens a run: its id, its directory, and the paths inside it.
+ *
+ * The id is the one the rest of the run uses — the nonce in the kernel's
+ * command tag, the `run` field on every log line — so one value ties the
+ * socket, the settings, the log and the kernel's reports together.
+ */
+export function openRun({ base = tmpdir(), id = randomUUID() } = {}) {
+  const root = runsRoot(base);
+  try { sweep(root); } catch { /* a sweep that fails is not a reason not to run */ }
+  const dir = mkdtempSync(join(root, `${id.slice(0, 6)}-`));
+  writeFileSync(join(dir, "pid"), String(process.pid), { mode: 0o600 });
+  return {
+    id,
+    dir,
+    root,
+    // A socket on macOS, a FIFO on Linux, where the runtime blocks every unix
+    // socket inside the box (spool.js).
+    sock: join(dir, channelName()),
+    keys: join(dir, "keys"),
+    /**
+     * `wx`: created by this call or not at all. A settings file that already
+     * exists is not this run's, and the runtime would read whatever it says.
+     */
+    writeSettings(settings) {
+      const file = join(dir, "settings.json");
+      writeFileSync(file, JSON.stringify(settings, null, 2) + "\n", { flag: "wx", mode: 0o600 });
+      return file;
+    },
+    close() {
+      try { rmSync(dir, { recursive: true, force: true }); } catch {}
+    },
+  };
+}
+
+/** The runs root a socket path belongs to, or null when it is not one of ours. */
+export function runsRootOf(sock) {
+  if (!sock) return null;
+  const root = dirname(dirname(sock));
+  return basename(root) === RUNS_NAME ? root : null;
+}

package/src/serve.js

@@ -18,7 +18,7 @@ import { fileURLToPath } from "node:url";
 import { loadConfig } from "./config.js";
 import { read, logPath } from "./log.js";
 import { settingsFor } from "./srt.js";
-import { pending, requestsPath, settle, applyGrant } from "./requests.js";
+import { pending, requestsPath, settle, applyGrant, refuseIfBarred, markStale } from "./requests.js";
 import { walls } from "./walls.js";
 import { explain } from "./owners.js";
 
@@ -143,26 +143,53 @@ export function causesOf(cfg, entries) {
   };
 }
 
-function state(configPath) {
+/**
+ * `?since=<ISO date>`, or null for no filter. Anything that does not parse is
+ * ignored rather than refused: a bad filter should show everything, not an error.
+ */
+export function sinceOf(url) {
+  const raw = new URLSearchParams((url ?? "").split("?")[1] ?? "").get("since");
+  const t = raw ? Date.parse(raw) : NaN;
+  return Number.isNaN(t) ? null : new Date(t).toISOString();
+}
+
+export function state(configPath, { since = null } = {}) {
   const cfg = loadConfig(configPath);
-  const entries = read(logPath(cfg.root), { limit: 200 });
-  // A wider window than the activity tail, because grouping by cause is an
-  // arithmetic question and 200 lines of a busy day is one role's morning.
-  const forShape = read(logPath(cfg.root), { limit: 4000 });
+  // The date filter narrows everything read from the log: activity, causes,
+  // walls and the per-role counts. Not the request queue, which is what is
+  // waiting now whatever the window.
+  const entries = read(logPath(cfg.root), { limit: 200, since });
+  // The whole window, not a tail. "All" used to mean the last 4000 lines, so a
+  // 30-day window could show more denials than "all" did (6k against 4k on a
+  // real log). Every count on the page comes from this list.
+  const forShape = read(logPath(cfg.root), since ? { since } : {});
 
   const roles = Object.values(cfg.roles).map((r) => ({
     name: r.name,
     writes: r.writes,
     keys: r.keys,
     env: r.env,
-    blocks: entries.filter((e) => e.role === r.name && e.verdict === "denied").length,
+    neverWrites: r.neverWritesDeclared ?? r.neverWrites ?? [],
+    localBinding: r.localBinding === true,
+    localPorts: r.localPorts ?? [],
+    mcp: r.mcp ?? null,
+    trustd: r.trustd === true,
+    // Counted over the same window as the causes, so the KPI and the screen it
+    // links to agree.
+    blocks: forShape.filter((e) => e.role === r.name && e.verdict === "denied").length,
     settings: settingsFor(cfg, r.name),
   }));
 
+  // Read once for every role's walls, rather than once per role.
+  const whole = read(logPath(cfg.root), { verdict: "denied", since });
+  // Staleness is about the role's whole history, never the window: a request
+  // is not old just because the filter hides the runs that made it old.
+  const history = since ? read(logPath(cfg.root), { verdict: "denied" }) : whole;
   return {
     root: cfg.root,
     config: cfg.path,
-    requests: pending(requestsPath(cfg.root)),
+    requests: markStale(pending(requestsPath(cfg.root)), history),
+    since,
     // The file itself, not a regeneration of it. The page can render a policy
     // from its own model, and that model has no comments — so showing it under
     // the heading "seisin.toml" next to "copy this back" invites someone to
@@ -176,7 +203,7 @@ function state(configPath) {
     // Empty for a role that has hit nothing twice, which is most of them.
     walls: Object.fromEntries(
       Object.keys(cfg.roles)
-        .map((r) => [r, walls(cfg, r, { file: logPath(cfg.root) })])
+        .map((r) => [r, walls(cfg, r, { entries: whole })])
         .filter(([, w]) => w.length)),
     log: entries.slice(-60).reverse(),
     live: true,
@@ -205,6 +232,7 @@ function decide(configPath, { number, decision, reason }) {
     // The config is edited as text, so comments and order survive. Written
     // before the queue is settled: if this throws, the request is still open
     // rather than marked done against a file that never changed.
+    refuseIfBarred(cfg, req);
     const { toml, changed } = applyGrant(readFileSync(cfg.path, "utf8"), req, reason);
     if (changed) writeFileSync(cfg.path, toml);
   }
@@ -213,17 +241,49 @@ function decide(configPath, { number, decision, reason }) {
 }
 
 /** The body of a POST, capped: this endpoint takes three short fields. */
-function readBody(req) {
+/**
+ * A request body, capped. The cap is per route: one decision is a few hundred
+ * bytes, but "decline all" carries every key on screen — 109 of them were
+ * 9.3 KB, over the old flat 4 KB, and the connection was cut with nothing but
+ * "Failed to fetch" in the browser. Found by Carlos on the first real use.
+ */
+function readBody(req, max = 4096) {
   return new Promise((ok, fail) => {
     let s = "";
     req.on("data", (c) => {
       s += c;
-      if (s.length > 4096) { fail(new Error("body too large")); req.destroy(); }
+      if (s.length > max) { fail(new Error("body too large")); req.destroy(); }
     });
     req.on("end", () => ok(s));
   });
 }
 
+/**
+ * Refuse every request the page was showing, in one go.
+ *
+ * Only refusing. There is no "approve all" and there will not be: a grant is a
+ * decision about one path and one owner, and doing forty of them without
+ * reading them is the permissive default this tool exists to stand against.
+ * Refusing in bulk is safe — it grants nothing and changes no policy — and it
+ * is what a queue full of noise from a bug already fixed needs.
+ *
+ * By key, not "whatever is pending now": a request that arrived after the page
+ * drew is one the person has not seen, and it stays.
+ */
+function declineAll(configPath, { keys, reason }) {
+  if (!Array.isArray(keys) || !keys.length) throw new Error("keys must list the requests on screen");
+  const cfg = loadConfig(configPath);
+  const file = requestsPath(cfg.root);
+  const wanted = new Set(keys.map(String));
+  let declined = 0;
+  for (const req of pending(file)) {
+    if (!wanted.has(req.key)) continue;
+    settle(file, req.key, "denied", reason ?? "");
+    declined++;
+  }
+  return { ok: true, declined };
+}
+
 export function serve(configPath, port = 4178) {
   const page = join(HERE, "..", "ui", "index.html");
   if (!existsSync(page)) throw new Error("the console is missing from this install");
@@ -238,6 +298,38 @@ export function serve(configPath, port = 4178) {
    */
   const token = randomBytes(24).toString("hex");
 
+  /**
+   * Every route under /api/ asks for the token, reads included.
+   *
+   * The page used to be the only thing that carried the token and /api/state
+   * answered anyone. Both rested on "an agent cannot reach loopback", and
+   * `local_binding = true` on macOS makes that false: the runtime lets that
+   * role connect to every localhost port, and loopback bypasses the egress
+   * proxy. Reproduced end to end by a read-only review on 2026-09-22 — a role
+   * read the token off `GET /`, posted to /api/decide, and approved its own
+   * request into another role's territory. /api/state handed it the policy, the
+   * log and where every key lives, with no token at all.
+   *
+   * So the token no longer travels in any response. `seisin ui` puts it in the
+   * URL fragment, which a browser never sends to a server; the page takes it
+   * from there, keeps it for the tab, and removes it from the address bar and
+   * the history entry. Anything that fetches `/` gets a page with no token in it.
+   */
+  const authorized = (req) => req.headers["x-seisin-token"] === token;
+
+  /**
+   * The Host header has to name this server.
+   *
+   * A page on the operator's browser can point a hostname it controls at
+   * 127.0.0.1 (DNS rebinding) and then read responses as same-origin. It still
+   * could not produce the token, but the check is one line and makes the
+   * question moot: the only names this server answers to are its own.
+   */
+  const hostOk = (req, port) => {
+    const h = String(req.headers.host ?? "");
+    return h === `127.0.0.1:${port}` || h === `localhost:${port}`;
+  };
+
   /**
    * The path, without whatever came after `?`.
    *
@@ -249,11 +341,26 @@ export function serve(configPath, port = 4178) {
   const pathOf = (u) => (u ?? "/").split("?")[0];
 
   const server = createServer(async (req, res) => {
-    if (req.method === "POST" && pathOf(req.url) === "/api/decide") {
-      if (req.headers["x-seisin-token"] !== token) {
-        res.writeHead(403, { "content-type": "application/json" });
-        return res.end(JSON.stringify({ error: "bad or missing token" }));
+    if (!hostOk(req, server.address()?.port)) {
+      res.writeHead(403, { "content-type": "text/plain" });
+      return res.end("wrong host");
+    }
+    if (pathOf(req.url).startsWith("/api/") && !authorized(req)) {
+      res.writeHead(403, { "content-type": "application/json" });
+      return res.end(JSON.stringify({ error: "bad or missing token — open the URL `seisin ui` printed" }));
+    }
+    if (req.method === "POST" && pathOf(req.url) === "/api/decline-all") {
+      try {
+        // ~85 bytes per key: 1 MB is ten thousand requests on one screen.
+        const out = declineAll(configPath, JSON.parse((await readBody(req, 1024 * 1024)) || "{}"));
+        res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+        return res.end(JSON.stringify(out));
+      } catch (e) {
+        res.writeHead(400, { "content-type": "application/json" });
+        return res.end(JSON.stringify({ error: e.message }));
       }
+    }
+    if (req.method === "POST" && pathOf(req.url) === "/api/decide") {
       try {
         const out = decide(configPath, JSON.parse((await readBody(req)) || "{}"));
         res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
@@ -270,7 +377,7 @@ export function serve(configPath, port = 4178) {
     if (pathOf(req.url) === "/api/state") {
       let body;
       try {
-        body = JSON.stringify(state(configPath));
+        body = JSON.stringify(state(configPath, { since: sinceOf(req.url) }));
       } catch (e) {
         res.writeHead(500, { "content-type": "application/json" });
         return res.end(JSON.stringify({ error: e.message }));
@@ -280,10 +387,9 @@ export function serve(configPath, port = 4178) {
       return res.end(body);
     }
     if (pathOf(req.url) === "/" || pathOf(req.url) === "/index.html") {
-      // Inlined rather than put in the URL: a fragment survives in history, in
-      // a screenshot, and in whatever the operator pastes into a chat.
-      const html = readFileSync(page, "utf8")
-        .replace("</head>", `<script>window.SEISIN_TOKEN=${JSON.stringify(token)}</script></head>`);
+      // No token in here. It used to be inlined, which handed it to anything
+      // that could GET this page — see `authorized` above.
+      const html = readFileSync(page, "utf8");
       res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
       return res.end(html);
     }
@@ -293,10 +399,16 @@ export function serve(configPath, port = 4178) {
   return new Promise((ok, fail) => {
     // Loopback only. The page maps where every credential lives; it has no
     // business being reachable from the network the laptop happens to be on.
-    server.listen(port, "127.0.0.1", () => ok(server));
+    server.listen(port, "127.0.0.1", () => {
+      // For `seisin ui`, which builds the URL, and for tests. Never sent.
+      Object.defineProperty(server, "seisinToken", { value: token });
+      ok(server);
+    });
     server.on("error", (e) =>
       fail(e.code === "EADDRINUSE"
-        ? new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`)
+        // Keep the code on the rejection: `seisin ui` reads it to tell "a
+        // console is already here, reopen its link" from any other failure.
+        ? Object.assign(new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`), { code: "EADDRINUSE" })
         : e));
   });
 }

package/src/spool.js

@@ -26,8 +26,9 @@
  * solved here; the log is evidence of what happened, not proof that nothing
  * else did.
  */
-import { createServer, createConnection } from "node:net";
-import { unlinkSync, existsSync, mkdtempSync, chmodSync } from "node:fs";
+import { createServer, createConnection, Socket } from "node:net";
+import { unlinkSync, existsSync, mkdtempSync, chmodSync, openSync, writeSync, closeSync, constants } from "node:fs";
+import { execFileSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 
@@ -59,29 +60,78 @@ export function spoolPath() {
  * in. The parent decides what that means; the sender does not get to pick a
  * path, which is the other half of why this is not just a slower file write.
  */
+/**
+ * Which channel this platform can use: a unix socket, or a FIFO.
+ *
+ * On Linux the runtime blocks creating ANY unix socket inside the box with a
+ * seccomp filter — it cannot filter by path, so `allowUnixSockets` is ignored
+ * there (its README says so). The socket this file was built on therefore
+ * never carried a line on Linux: measured in Docker on 2026-09-23, with the
+ * code as published in 0.2.0 and after, the hook "sent" and the log stayed
+ * empty. A FIFO is a file, not a socket — seccomp does not see it, bubblewrap
+ * grants it by path, and a write of up to PIPE_BUF bytes is atomic, so lines
+ * from concurrent tool calls do not interleave. Measured the same day: the
+ * role wrote a line through it, could not create anything beside it, and
+ * could not remove it.
+ */
+export const FIFO_SUFFIX = ".fifo";
+export const channelName = (platform = process.platform) => (platform === "linux" ? "s.fifo" : "s.sock");
+
+/** The most a FIFO write carries atomically on Linux (PIPE_BUF). */
+const PIPE_BUF = 4096;
+
+/** Parses newline-separated JSON messages and hands each to `sink`. */
+function lineReader(sink, onTooLong) {
+  let buffer = "";
+  return (chunk) => {
+    buffer += chunk;
+    // A 1 MB line is not a log entry, it is something trying to fill a disk.
+    if (buffer.length > 1_000_000) { buffer = ""; return onTooLong?.(); }
+    let nl;
+    while ((nl = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      if (!line.trim()) continue;
+      try {
+        const msg = JSON.parse(line);
+        if (msg && (msg.to === "log" || msg.to === "requests")) sink(msg.to, msg.entry);
+      } catch {
+        // Garbage from inside the box is not the parent's emergency.
+      }
+    }
+  };
+}
+
+/**
+ * The FIFO end of the spool. Opened read-write so it never sees end-of-file
+ * when a writer closes — every hook call opens, writes one line and closes —
+ * and read through a net.Socket, which takes a pipe descriptor and reads it
+ * without holding a thread.
+ */
+function fifoSpool(sink, path) {
+  if (existsSync(path)) unlinkSync(path);
+  execFileSync("mkfifo", ["-m", "600", path]);
+  const fd = openSync(path, constants.O_RDWR | constants.O_NONBLOCK);
+  const stream = new Socket({ fd, readable: true, writable: false });
+  stream.setEncoding("utf8");
+  stream.on("data", lineReader(sink));
+  stream.on("error", () => {});
+  return Promise.resolve({
+    path,
+    close() {
+      stream.destroy();
+      try { unlinkSync(path); } catch {}
+    },
+  });
+}
+
 export function spool(sink, path = spoolPath()) {
+  if (path.endsWith(FIFO_SUFFIX)) return fifoSpool(sink, path);
   if (existsSync(path)) unlinkSync(path);
 
   const server = createServer((conn) => {
-    let buffer = "";
     conn.setEncoding("utf8");
-    conn.on("data", (chunk) => {
-      buffer += chunk;
-      // A 1 MB line is not a log entry, it is something trying to fill a disk.
-      if (buffer.length > 1_000_000) return conn.destroy();
-      let nl;
-      while ((nl = buffer.indexOf("\n")) !== -1) {
-        const line = buffer.slice(0, nl);
-        buffer = buffer.slice(nl + 1);
-        if (!line.trim()) continue;
-        try {
-          const msg = JSON.parse(line);
-          if (msg && (msg.to === "log" || msg.to === "requests")) sink(msg.to, msg.entry);
-        } catch {
-          // Garbage from inside the box is not the parent's emergency.
-        }
-      }
-    });
+    conn.on("data", lineReader(sink, () => conn.destroy()));
     conn.on("error", () => {});
   });
 
@@ -136,6 +186,7 @@ const inFlight = new Set();
 
 export function send(to, entry, path = process.env[SOCK_ENV]) {
   if (!path) return false;
+  if (path.endsWith(FIFO_SUFFIX)) return sendFifo(to, entry, path);
   const p = new Promise((done) => {
     let settled = false;
     const finish = () => { if (!settled) { settled = true; done(true); } };
@@ -162,3 +213,30 @@ export function send(to, entry, path = process.env[SOCK_ENV]) {
 export async function flush() {
   await Promise.all([...inFlight]);
 }
+
+/**
+ * One line into the FIFO, synchronously: nothing to flush, nothing to lose to
+ * `process.exit`. Non-blocking, so a parent that is gone (no reader) costs an
+ * ENXIO and not a hung tool call. Longer than PIPE_BUF, the free-text fields
+ * are shortened first — past that size a write is no longer atomic and two
+ * tool calls could interleave their lines.
+ */
+function sendFifo(to, entry, path) {
+  const full = { at: new Date().toISOString(), ...entry };
+  let line = JSON.stringify({ to, entry: full }) + "\n";
+  if (Buffer.byteLength(line) > PIPE_BUF) {
+    const short = { ...full, reason: String(full.reason ?? "").slice(0, 300), target: String(full.target ?? "").slice(0, 1000) };
+    line = JSON.stringify({ to, entry: short }) + "\n";
+    if (Buffer.byteLength(line) > PIPE_BUF) return false;
+  }
+  let fd;
+  try {
+    fd = openSync(path, constants.O_WRONLY | constants.O_NONBLOCK);
+    writeSync(fd, line);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== undefined) try { closeSync(fd); } catch {}
+  }
+}