seisin 0.3.0 → 0.4.0

package/README.md

@@ -704,7 +704,7 @@ measured](docs/what-it-has-been-put-through.md#where-each-claim-was-actually-run
 
 ## Status
 
-`0.3.0`, 452 tests, of which **26 need `@anthropic-ai/sandbox-runtime` installed**
+`0.4.0`, 470 tests, of which **26 need `@anthropic-ai/sandbox-runtime` installed**
 and run real commands through the real kernel — and CI fails if the sandbox half *skips*, because
 a green run that quietly tested nothing looks exactly like a real one. That is not hypothetical:
 those eighteen skipped on Linux for a day, behind a runtime check that looked for the global

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it blocks it tells you whose file it was.",
   "keywords": [
     "ai-agents",

package/src/cli.js

@@ -57,7 +57,7 @@ ${C.b}seisin${C.off} — give each agent its own folders and its own keys
   seisin log verify                     does the log's hash chain hold
   seisin watch                          follow the log live
   seisin init [--from-observations]     propose a ${CONFIG_NAME} for this repo
-  seisin ui [--port n]                  open the console, live
+  seisin ui [--port n] [--link]         open the console, live (--link reopens a running one)
   seisin mcp                            an MCP server on stdio — read-only
 
 Enforcement comes from @anthropic-ai/sandbox-runtime, which asks the OS.

package/src/commands/log.js

@@ -10,7 +10,7 @@
  */
 import { createReadStream, watch as watchDir } from "node:fs";
 import { dirname, relative } from "node:path";
-import { read, logPath, size, verifyChain } from "../log.js";
+import { read, logPath, size, verifyLog } from "../log.js";
 import { renderEntry, C, out } from "../render.js";
 
 const flag = (argv, name) => {
@@ -43,14 +43,15 @@ export function log(config, argv = []) {
  * before the chain existed are reported as such, not as tampering.
  */
 function verify(config) {
-  const r = verifyChain(logPath(config.root));
+  const r = verifyLog(logPath(config.root));
   if (r.lines === 0) {
     out(`\n  ${C.dim}nothing recorded yet${C.off}\n\n`);
     return r;
   }
   const head = r.unchained ? `${r.unchained} line(s) from before the chain, then ` : "";
+  const segs = r.segments > 1 ? ` across ${r.segments} segments` : "";
   if (!r.breaks.length) {
-    out(`\n  ${C.green}intact${C.off}  ${head}${r.chained} chained line(s)\n\n`);
+    out(`\n  ${C.green}intact${C.off}  ${head}${r.chained} chained line(s)${segs}\n\n`);
     return r;
   }
   out(`\n  ${C.red}broken${C.off}  ${head}${r.chained} chained line(s), ${r.breaks.length} break(s):\n`);

package/src/commands/ui.js

@@ -5,22 +5,72 @@
  * foreground command you start and stop, serving one page and one JSON
  * document, on loopback. Nothing in the enforcement path touches it. If it is
  * not running you lose a window, not a boundary.
+ *
+ * The token that authorizes the page travels only in the link's fragment and is
+ * never in an HTTP response (see serve.js). So a lost link cannot be recovered
+ * over the wire — only from the terminal that printed it. `writeUiLink` keeps a
+ * user-only copy on disk so it can be recovered without reopening that leak:
+ * `--link` prints it, and starting over a busy port reopens it instead of just
+ * failing. See uilink.js.
  */
 import { spawnSync } from "node:child_process";
 import { relative } from "node:path";
 import { serve } from "../serve.js";
+import { writeUiLink, readUiLink, clearUiLink } from "../uilink.js";
 import { C, out } from "../render.js";
 
+function open(url) {
+  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  spawnSync(opener, [url], { stdio: "ignore", shell: process.platform === "win32" });
+}
+
 export async function ui(config, argv = []) {
   const i = argv.indexOf("--port");
   const port = i === -1 ? 4178 : Number(argv[i + 1]);
 
-  const server = await serve(config.path, port);
+  // `seisin ui --link`: print the live link a running console left, and open
+  // it, without starting anything. For when the terminal that had it is gone.
+  if (argv.includes("--link")) {
+    const found = readUiLink(port);
+    if (found && found.alive !== false) {
+      out(`\n  ${C.b}${found.url}${C.off}\n  ${C.dim}the link a seisin ui on ${port} is serving. open it here, do not paste it anywhere.${C.off}\n\n`);
+      open(found.url);
+      return;
+    }
+    if (found && found.alive === false) clearUiLink(port);
+    out(`\n  ${C.dim}no seisin ui running on ${port} — start one with: seisin ui${port === 4178 ? "" : ` --port ${port}`}${C.off}\n\n`);
+    return;
+  }
+
+  let server;
+  try {
+    server = await serve(config.path, port);
+  } catch (e) {
+    // A console is already on this port: hand back its live link rather than
+    // erroring, which is the case that sends people digging in the terminal.
+    if (e.code === "EADDRINUSE") {
+      const found = readUiLink(port);
+      if (found && found.alive !== false) {
+        out(
+          `\n  ${C.b}${found.url}${C.off}\n` +
+          `  ${C.dim}a seisin ui is already running on ${port}; reopening its link. ctrl-c that terminal to stop it.${C.off}\n\n`
+        );
+        open(found.url);
+        return;
+      }
+      // The port is busy but no live console left a link — a stale record, or
+      // something else is on the port. Drop the stale one and let the original
+      // "port is busy" message stand.
+      if (found && found.alive === false) clearUiLink(port);
+    }
+    throw e;
+  }
+
   const bound = server.address().port;
-  // The token rides in the fragment, which the browser keeps to itself: no
-  // request to this server, or to anything else, ever carries it. The page
-  // moves it into the tab's storage and strips it from the address bar.
   const url = `http://127.0.0.1:${bound}/#t=${server.seisinToken}`;
+  // Recorded before we print, so `--link` and a second `seisin ui` can find it.
+  writeUiLink(bound, url);
+
   // local_binding opens every port (macOS); local_ports opens the ones it
   // names, on every platform — so only a role that names THIS port counts.
   const reach = Object.values(config.roles)
@@ -31,15 +81,17 @@ export async function ui(config, argv = []) {
     `\n  ${C.b}${url}${C.off}\n` +
     `  ${C.dim}reading ${relative(process.cwd(), config.path)} and the log, live. ctrl-c to stop.${C.off}\n` +
     `  ${C.dim}the link carries this run's token: open it here, do not paste it anywhere.${C.off}\n` +
+    `  ${C.dim}lost it? this terminal has it above, or run: seisin ui --link${bound === 4178 ? "" : ` --port ${bound}`}${C.off}\n` +
     (reach.length
       ? `  ${C.yellow}${reach.join(", ")} can reach this port on localhost: they can load this page, ` +
         `but not the token, which only travels in the link above.${C.off}\n`
       : "") + "\n"
   );
 
-  const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  spawnSync(opener, [url], { stdio: "ignore", shell: process.platform === "win32" });
+  open(url);
 
-  process.on("SIGINT", () => { server.close(); process.exit(0); });
+  const stop = () => { clearUiLink(bound); server.close(); process.exit(0); };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
   return server;
 }

package/src/hook.js

@@ -38,12 +38,41 @@ const FILE_TOOLS = {
 const REDIRECT = /(?:^|\s|;|&&|\|\|)>{1,2}\s*("[^"]+"|'[^']+'|[^\s;|&<>]+)/g;
 const WRITERS = /(?:^|\s|;|&&|\|\|)(?:cp|mv|install|tee|touch|mkdir|rm|rmdir|truncate|dd)\s+([^\n;|&]+)/g;
 
+/**
+ * The server in an `mcp__<server>__<tool>` name, or null if it does not parse.
+ *
+ * The split is on the double underscore: a server name carries single ones
+ * (`claude_ai_Gmail`) and so does a tool name (`execute_sql`), so the server is
+ * everything between `mcp__` and the next `__`. Shared with the parent's intake,
+ * which recomputes the same verdict rather than trusting the line from the box.
+ */
+export function mcpServer(tool) {
+  const m = typeof tool === "string" && /^mcp__(.+?)__(.+)$/.exec(tool);
+  return m ? m[1] : null;
+}
+
 export function targetsOf(tool, input = {}) {
   const kind = FILE_TOOLS[tool];
   if (kind) {
     const p = input.file_path ?? input.path ?? input.notebook_path;
     return p ? [{ action: kind, path: p }] : [];
   }
+  /**
+   * An MCP tool call names a resource, not a path: `mcp__<server>__<tool>`.
+   *
+   * The kernel never sees it — the MCP server runs outside the box — so a call
+   * that goes unrecorded here goes unrecorded everywhere. Measured 2026-09-24:
+   * the event reaches PreToolUse with the tool's own arguments as `tool_input`,
+   * which is exactly why the file-tool code above returns nothing for it. We
+   * resolve the call to the *server* it belongs to, the unit the policy already
+   * declares in `mcp = [...]`, and leave the finer resource (which table, which
+   * project) for later — deriving it means a per-server adapter, and that is the
+   * line past which this stops being "whose is it" and becomes a tool gateway.
+   * A name that does not parse is returned as an unknown tool, not dropped.
+   */
+  if (typeof tool === "string" && tool.startsWith("mcp__")) {
+    return [{ action: "use", tool, server: mcpServer(tool) }];
+  }
   if (tool !== "Bash" || typeof input.command !== "string") return [];
 
   const out = [];
@@ -140,6 +169,25 @@ export function decide(config, role, event, { observe = false, now = append, ask
   const verdicts = [];
 
   for (const t of targets) {
+    // A tool call, resolved to its MCP server. "Whose is it" is the question
+    // `mcp = [...]` already answers, so it is asked through the same map rather
+    // than a second one. No request is filed on a denial: a server absent from
+    // a role's list is a policy subtraction a person edits — the shape of
+    // never_writes — not a grant a person approves, and filing one would be a
+    // request nobody can grant. An unparsable name is closed, not waved through.
+    if (t.action === "use") {
+      const v = t.server
+        ? explain(config, role, "mcp", t.server)
+        : { allowed: false, owners: [], mcp: true, reason: `${t.tool} is not a recognisable mcp__<server>__<tool> name` };
+      now(file, {
+        role, tool: event.tool_name, action: "use", kind: "tool", target: t.tool,
+        verdict: observe ? "observed" : v.allowed ? "allowed" : "denied",
+        owners: v.owners ?? [], reason: v.reason,
+      });
+      verdicts.push({ ...v, target: t.tool, kind: "tool", action: "use" });
+      continue;
+    }
+
     const rel = toRepoRelative(config, t.path);
     const kind = kindOf(config, rel);
 
@@ -225,6 +273,8 @@ export function decide(config, role, event, { observe = false, now = append, ask
           ? `${denied.reason}. Do not ask for it: nothing was queued, because the answer is already written down.` + again
           : denied.gitMetadata
           ? `${denied.reason}. Nothing was queued.` + again
+          : denied.mcp
+          ? `${denied.reason}. Nothing was queued: which MCP servers a role may load is set in its mcp list, a policy change a person makes, not a grant they approve.` + again
           : (denied.owners?.length
           ? wasRead
             ? `${denied.target} is declared for ${denied.owners.join(", ")}, not ${role}. Ask for what you need from it rather than reading the key.`

package/src/intake.js

@@ -30,6 +30,7 @@ import { explain, ownersOf } from "./owners.js";
 import { append, logPath } from "./log.js";
 import { record, requestsPath } from "./requests.js";
 import { inScope, scopeOf, reachedForContent } from "./violations.js";
+import { mcpServer } from "./hook.js";
 
 /** A hash of the policy file as it is now, short: it names a version, it proves nothing. */
 export function policyId(config) {
@@ -73,6 +74,33 @@ export function intake({ config, role, runId, observe = false, settings, notify
    */
   function fromHook(to, entry) {
     if (!entry || typeof entry !== "object") return;
+
+    /**
+     * An MCP tool call. It names a resource, not a path, so it is recorded and
+     * never queued — which servers a role may load is a change to its `mcp`
+     * list, not a grant a person approves, the same shape as never_writes. The
+     * verdict is recomputed here from the same list rather than believed from
+     * inside the box: the server is parsed from the tool name and asked of the
+     * policy, so a line claiming "allowed" for a server the role may not load
+     * comes back marked `disputed`.
+     */
+    if (to === "log" && entry.action === "use") {
+      if (typeof entry.target !== "string" || !entry.target.trim()) return;
+      if (!["allowed", "denied", "observed"].includes(entry.verdict)) return;
+      const server = mcpServer(entry.target);
+      const v = server ? explain(config, role, "mcp", server) : { allowed: false };
+      const expected = observe ? "observed" : v.allowed ? "allowed" : "denied";
+      return void log({
+        at: entry.at, role,
+        tool: String(entry.tool ?? "").slice(0, 40),
+        action: "use", kind: "tool",
+        target: entry.target.slice(0, 1000),
+        verdict: entry.verdict, owners: [],
+        reason: String(entry.reason ?? "").slice(0, 500),
+        ...(expected !== entry.verdict ? { disputed: expected } : {}),
+      });
+    }
+
     if (entry.action !== "read" && entry.action !== "write") return;
     if (typeof entry.target !== "string" || !entry.target.trim()) return;
 

package/src/log.js

@@ -13,9 +13,9 @@
  * tries the parent's socket first for exactly that reason; writing the file
  * directly is what happens when there is no parent, outside the box.
  */
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, unlinkSync } from "node:fs";
 import { createHash } from "node:crypto";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { STATE_DIR, LOG_NAME } from "./layout.js";
 import { send } from "./spool.js";
 
@@ -39,6 +39,10 @@ export function append(file, entry) {
   try {
     mkdirSync(dirname(file), { recursive: true });
     withLock(file, () => {
+      // Rotate first, under the same lock: a full segment is renamed away and a
+      // fresh one seeded so the chain continues, then this line lands in the new
+      // segment. Done here so the size check and the append never race.
+      maybeRotate(file);
       // `prev` goes last and is computed from the previous line exactly as it
       // sits on disk, so verifying needs nothing but the file.
       const line = JSON.stringify({ at: new Date().toISOString(), ...entry, prev: hashOf(lastLine(file)) });
@@ -50,6 +54,68 @@ export function append(file, entry) {
   }
 }
 
+/**
+ * When the current segment fills, retire it and start a fresh one that still
+ * chains.
+ *
+ * An append-only file that only grows is the right default and the wrong
+ * forever: a busy team writes megabytes of it, and `verify` walks all of them
+ * on every run. Rotation caps the size of the file three tools tail while
+ * keeping the property that made the chain worth having — that a deletion shows.
+ *
+ * The retired segment keeps its own chain intact; the new segment's first line
+ * is a `rotated` marker whose `prev` is the retired segment's last hash, so the
+ * two verify as one chain across the cut (`verifyLog`). The comment on GENESIS
+ * asked for exactly this. Segments are numbered upward, `.1` the oldest, and
+ * the oldest beyond the keep count are dropped — the only place seisin removes
+ * a record, and it removes whole retired segments, never a line.
+ */
+const DEFAULT_MAX_BYTES = 8 * 1024 * 1024;   // 8 MiB per segment
+const DEFAULT_KEEP = 5;                        // retired segments kept beside the current one
+
+function envInt(name, fallback) {
+  const n = Number(process.env[name]);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+
+/** Every segment of the log, oldest → newest, current last. */
+export function logSegments(file) {
+  const dir = dirname(file);
+  const base = basename(file);
+  let names = [];
+  try { names = readdirSync(dir); } catch { return existsSync(file) ? [file] : []; }
+  const archives = names
+    .map((n) => {
+      if (!n.startsWith(base + ".")) return null;
+      const seq = Number(n.slice(base.length + 1));
+      return Number.isInteger(seq) && seq > 0 ? { seq, path: join(dir, n) } : null;
+    })
+    .filter(Boolean)
+    .sort((a, b) => a.seq - b.seq)
+    .map((a) => a.path);
+  if (existsSync(file)) archives.push(file);
+  return archives;
+}
+
+function maybeRotate(file) {
+  let sz = 0;
+  try { sz = statSync(file).size; } catch { return; }
+  if (sz < envInt("SEISIN_LOG_MAX_BYTES", DEFAULT_MAX_BYTES)) return;
+
+  const tail = hashOf(lastLine(file));
+  const archives = logSegments(file).filter((p) => p !== file);
+  const seqs = archives.map((p) => Number(p.slice((file + ".").length))).filter(Number.isInteger);
+  const next = (seqs.length ? Math.max(...seqs) : 0) + 1;
+  renameSync(file, `${file}.${next}`);
+  // Seed the new current so the first real append chains from the retired tail.
+  const marker = JSON.stringify({ at: new Date().toISOString(), event: "rotated", from: `${basename(file)}.${next}`, prev: tail });
+  appendFileSync(file, marker + "\n");
+
+  const keep = envInt("SEISIN_LOG_KEEP", DEFAULT_KEEP);
+  const retired = logSegments(file).filter((p) => p !== file); // oldest → newest, includes the new archive
+  for (let i = 0; i < retired.length - keep; i++) { try { unlinkSync(retired[i]); } catch {} }
+}
+
 /**
  * The log is chained: every line carries `prev`, the hash of the line before it.
  *
@@ -116,8 +182,8 @@ function withLock(file, fn) {
  * unchained prefix, not reported as tampering. After the first chained line,
  * a line without `prev` is itself a break.
  */
-export function verifyChain(file) {
-  const out = { lines: 0, unchained: 0, chained: 0, breaks: [] };
+function walk(file, { seed = GENESIS, startLine = 0 } = {}) {
+  const out = { lines: 0, unchained: 0, chained: 0, breaks: [], tail: null };
   if (!existsSync(file)) return out;
   let previous = null;
   let started = false;
@@ -129,15 +195,54 @@ export function verifyChain(file) {
     const prev = e?.prev;
     if (!started && prev === undefined) { out.unchained++; previous = line; continue; }
     started = true;
-    const expected = out.chained === 0 && out.unchained === 0 ? GENESIS : hashOf(previous);
-    const ok = prev === expected || (out.chained === 0 && prev === hashOf(previous));
-    if (!ok) out.breaks.push({ line: out.lines, expected, found: prev ?? null });
+    const first = out.chained === 0 && out.unchained === 0;
+    // A rotation marker leading a segment we have nothing to check it against —
+    // a file verified on its own, or the oldest segment left after the prefix
+    // was pruned for retention (seed still GENESIS) — is accepted rather than
+    // called a break. For any later segment the seed is the real previous tail,
+    // so the marker's `prev` IS checked, and a whole segment deleted or
+    // reordered in the middle shows.
+    const rotationStart = first && e?.event === "rotated" && seed === GENESIS;
+    const expected = first ? seed : hashOf(previous);
+    const ok = rotationStart || prev === expected || (first && prev === hashOf(previous));
+    if (!ok) out.breaks.push({ line: startLine + out.lines, expected, found: prev ?? null });
     out.chained++;
     previous = line;
   }
+  out.tail = previous;
   return out;
 }
 
+export function verifyChain(file, seed = GENESIS) {
+  const r = walk(file, { seed });
+  return { lines: r.lines, unchained: r.unchained, chained: r.chained, breaks: r.breaks };
+}
+
+/**
+ * Verify the whole log, across every rotated segment, as one chain.
+ *
+ * Each retired segment is walked in order, and its last hash becomes the seed
+ * the next segment's `rotated` marker must match — so deleting or reordering a
+ * whole segment shows, not only an edit inside one. With no rotation there is a
+ * single segment and this is exactly `verifyChain`. What it cannot see is a
+ * segment dropped off the *oldest* end by the keep limit: that is retention, not
+ * tampering, and the count of segments is reported so the drop is not silent.
+ */
+export function verifyLog(file) {
+  const segs = logSegments(file);
+  const agg = { lines: 0, unchained: 0, chained: 0, breaks: [], segments: segs.length };
+  let seed = GENESIS;
+  for (const seg of segs) {
+    const r = walk(seg, { seed, startLine: agg.lines });
+    agg.lines += r.lines;
+    agg.unchained += r.unchained;
+    agg.chained += r.chained;
+    agg.breaks.push(...r.breaks);
+    seed = hashOf(r.tail);
+  }
+  return agg;
+}
+
 /** Reads entries, newest last. A malformed line is skipped, never fatal. */
 export function read(file, { role, verdict, since, limit = 0 } = {}) {
   if (!existsSync(file)) return [];
@@ -150,6 +255,7 @@ export function read(file, { role, verdict, since, limit = 0 } = {}) {
     } catch {
       continue; // a half-written line from a killed process is not an error
     }
+    if (e.event === "rotated") continue; // a structural marker, not a decision
     if (role && e.role !== role) continue;
     if (verdict && e.verdict !== verdict) continue;
     if (since && e.at < since) continue;

package/src/serve.js

@@ -406,7 +406,9 @@ export function serve(configPath, port = 4178) {
     });
     server.on("error", (e) =>
       fail(e.code === "EADDRINUSE"
-        ? new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`)
+        // Keep the code on the rejection: `seisin ui` reads it to tell "a
+        // console is already here, reopen its link" from any other failure.
+        ? Object.assign(new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`), { code: "EADDRINUSE" })
         : e));
   });
 }

package/src/uilink.js

@@ -0,0 +1,55 @@
+/**
+ * Where a running `seisin ui` leaves its live link, so it can be found again.
+ *
+ * The console's token never travels in an HTTP response — that was the whole
+ * point of the redesign in serve.js: a page that could GET `/` used to walk
+ * away with it. The cost was that a tab which lost the fragment had nowhere to
+ * recover the token from but the terminal that printed it once. When that
+ * terminal is gone, so is the link.
+ *
+ * This is the recovery channel that does not reopen the leak: the link (token
+ * and all) is written to a file only this user can read — under `$TMPDIR/snr/`,
+ * the same 0700 directory runs already keep their sockets and keys in — and
+ * never sent over the wire. `seisin ui` on a busy port reads it and reopens the
+ * live link instead of failing; `seisin ui --link` prints it. The token now
+ * rests on disk (0600) for the life of the run rather than only in memory, a
+ * bounded, local-user exposure, and it is removed when the run exits.
+ *
+ * The pid is stored so a file left by a crashed run is recognisable: a link
+ * whose writer is gone is stale, not a running console.
+ */
+import { writeFileSync, readFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { runsRoot } from "./rundir.js";
+
+function linkFile(port, base) {
+  return join(runsRoot(base), `ui-${port}.url`);
+}
+
+/** Records this run's live URL for the port it bound. */
+export function writeUiLink(port, url, base) {
+  writeFileSync(linkFile(port, base), JSON.stringify({ url, pid: process.pid }) + "\n", { mode: 0o600 });
+}
+
+/**
+ * The live URL a `seisin ui` left for this port, with whether its writer is
+ * still alive — or null if there is no readable record.
+ */
+export function readUiLink(port, base) {
+  let raw;
+  try { raw = readFileSync(linkFile(port, base), "utf8"); } catch { return null; }
+  let e;
+  try { e = JSON.parse(raw); } catch { return null; }
+  if (!e || typeof e.url !== "string") return null;
+  let alive = null;
+  if (typeof e.pid === "number") {
+    // Signal 0 tests for the process without touching it: it throws if gone.
+    try { process.kill(e.pid, 0); alive = true; } catch { alive = false; }
+  }
+  return { url: e.url, pid: e.pid ?? null, alive };
+}
+
+/** Removes the record. Called on exit, and when a stale one is found. */
+export function clearUiLink(port, base) {
+  try { unlinkSync(linkFile(port, base)); } catch {}
+}