seisin 0.3.0 → 0.4.2

package/src/owners.js

@@ -10,7 +10,8 @@
  * agents have to read each other's code to do anything useful. Keys are the
  * exception, and they are handled separately below.
  */
-import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { protectedBy } from "./surface.js";
 
@@ -45,7 +46,7 @@ export function covers(glob, path) {
   // The path itself, or anything beneath it. The `/` is load-bearing: without
   // it `src/api` would also cover `src/apifoo.ts`, which the kernel does not.
   if (m.prefix !== null) return p === m.prefix || p.startsWith(m.prefix + "/");
-  return m.re.test(p);
+  return matchGlob(m.glob, p);
 }
 
 /**
@@ -68,7 +69,7 @@ function matcherOf(glob) {
   if (m) return m;
   let g = normalize(glob);
   if (glob.endsWith("/")) g += "/**";
-  m = WILD.test(g) ? { prefix: null, re: toRegExp(g) } : { prefix: g, re: null };
+  m = WILD.test(g) ? { prefix: null, glob: g } : { prefix: g, glob: null };
   if (GLOBS.size >= MAX_CACHED) GLOBS.clear();
   GLOBS.set(glob, m);
   return m;
@@ -126,18 +127,66 @@ export function normalize(s) {
  * must not: covering one file too many costs an argument, covering one too few
  * is the hole. When the two readings disagree, this one takes the wider set.
  */
-function toRegExp(glob) {
-  const out = glob
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-    .replace(/\/\*\*$/, "\u0001")
-    .replace(/\*\*\//g, "\u0002")
-    .replace(/\*\*/g, "\u0003")
-    .replace(/\*/g, "[^/]*")
-    .replace(/\?/g, "[^/]")
-    .replace(/\u0001/g, "(?:/.*)?")
-    .replace(/\u0002/g, "(?:.*/)?")
-    .replace(/\u0003/g, ".*");
-  return new RegExp("^" + out + "$");
+/**
+ * Does `glob` cover `path`? A linear matcher, not a regular expression.
+ *
+ * The regex form (`**` → `.*`, `**\/` → `(?:.*\/)?`) put several unbounded `.*`
+ * next to literals, and on a long path that does not match, the engine
+ * backtracks catastrophically: measured on a crafted glob, 9 `**` took ~26 s
+ * and 11 hung for over a minute. Since a request's target — which an agent
+ * chooses — becomes a glob here (`grantFor`), that is a denial-of-service on the
+ * hook and on `explain`. This matcher is memoised on (glob index, path index),
+ * so its cost is bounded by their product and no input backtracks.
+ *
+ * Same wildcards as before: `?` one non-`/`, `*` a run of non-`/`, `**` any run
+ * including `/`, `**\/` zero or more whole directories, a trailing `/**` the
+ * subtree. Characters are compared literally; nothing is treated as regex.
+ */
+function matchGlob(glob, path) {
+  const G = glob.length, P = path.length;
+  // memo[gi * (P+1) + pi]: 0 unknown, 1 true, 2 false. One flat array, reused.
+  const memo = new Uint8Array((G + 1) * (P + 1));
+  const at = (gi, pi) => {
+    for (;;) {
+      const key = gi * (P + 1) + pi;
+      const seen = memo[key];
+      if (seen) return seen === 1;
+      let res;
+      if (gi === G) { res = pi === P; }
+      else if (glob[gi] === "*" && glob[gi + 1] === "*") {
+        if (glob[gi + 2] === "/") {
+          // `**/` = zero or more whole directories: empty, or any chars ending
+          // at a `/` then the rest.
+          if (at(gi + 3, pi)) res = true;
+          else if (pi < P) {
+            if (path[pi] === "/" && at(gi + 3, pi + 1)) res = true;
+            else { memo[key] = 2; pi++; continue; }   // consume one char, stay on `**/`
+          } else res = false;
+        } else {
+          // `**` = any run including `/` (also covers `**` at the very end,
+          // where `at(gi+2, pi)` requires pi to reach the end).
+          if (at(gi + 2, pi)) res = true;
+          else if (pi < P) { memo[key] = 2; pi++; continue; }  // consume one char, stay on `**`
+          else res = false;
+        }
+      } else if (glob[gi] === "/" && glob[gi + 1] === "*" && glob[gi + 2] === "*" && gi + 3 === G) {
+        // trailing `/**`: the directory itself, or anything beneath it.
+        res = pi === P || path[pi] === "/";
+      } else if (glob[gi] === "*") {
+        // `*` = a run of non-`/`.
+        if (at(gi + 1, pi)) res = true;
+        else if (pi < P && path[pi] !== "/") { memo[key] = 2; pi++; continue; }
+        else res = false;
+      } else if (glob[gi] === "?") {
+        res = pi < P && path[pi] !== "/" && at(gi + 1, pi + 1);
+      } else {
+        res = pi < P && glob[gi] === path[pi] && at(gi + 1, pi + 1);
+      }
+      memo[key] = res ? 1 : 2;
+      return res;
+    }
+  };
+  return at(0, 0);
 }
 
 /** Is this path inside a `.git` directory (git's metadata, not a working file)? */
@@ -166,6 +215,82 @@ export function ownersOf(config, path) {
     .map((r) => r.name);
 }
 
+/**
+ * Where a refused target stands against the policy as it is now.
+ *
+ * One of four, and only the last one is a decision somebody has to make:
+ *
+ *   outside    not a place in the map at all — a port, a key directory, or a
+ *              path outside the repository, which no `writes` reaches
+ *   protected  closed to every role on purpose (surface.js); the boundary
+ *              working, with nothing to grant
+ *   owned      some role's territory today
+ *   unowned    in the repository, ownable, and nobody claims it
+ *
+ * Computed from the policy, never from the `owners` a log line carries. That
+ * value is what was true the day of the refusal; every grant made since makes
+ * it more wrong, so a screen reading it gets worse the more seisin is used the
+ * way it is meant to be. Measured on one deployment: the console said 1,178 of
+ * 1,486 refused paths had no owner; against the policy of that day it was 316.
+ * The rest had been claimed since, were protected, or were not paths at all.
+ */
+export function standing(config, entry) {
+  const target = entry.target;
+  if (entry.kind === "network")
+    return { kind: "outside", owners: [], why: "a port or a socket, which no role owns" };
+  if (entry.kind === "key")
+    return { kind: "outside", owners: [], why: "a key directory, closed on purpose" };
+  const guard = protectedBy(config, target);
+  if (guard) return { kind: "protected", owners: [], why: guard.why };
+  if (target.startsWith("/")) {
+    const root = config.root?.endsWith("/") ? config.root : `${config.root}/`;
+    if (!config.root || !target.startsWith(root))
+      return { kind: "outside", owners: [], why: "outside the repository, where no role's territory reaches" };
+  }
+  const owners = ownersOf(config, target);
+  return { kind: owners.length ? "owned" : "unowned", owners };
+}
+
+/**
+ * `standing`, remembered while the policy stays the same.
+ *
+ * The console asks for its whole state every two seconds, and a real log has
+ * well over a thousand distinct refused paths: classifying all of them costs
+ * most of a second each time (measured: ~400 ms in protectedBy, ~335 ms in
+ * ownersOf), on a call that already took about that long. What a path's
+ * standing depends on is the policy file, so that is the key. It also depends,
+ * a little, on the disk — on Linux a control file is protected only once it
+ * exists — so the memory is dropped after a minute as well, which bounds how
+ * stale an answer can be without paying for it on every poll.
+ *
+ * A config that was not read from a file (tests, embedders) gets a memory for
+ * this call only.
+ */
+const STANDING_TTL = 60_000;
+let standingMemo = { key: null, at: 0, map: new Map() };
+
+export function standingOf(config, { now = Date.now() } = {}) {
+  let map;
+  let key = null;
+  try {
+    if (config.path) key = `${config.path}\u0000${createHash("sha256").update(readFileSync(config.path)).digest("hex")}`;
+  } catch {
+    key = null;
+  }
+  if (key === null) map = new Map();
+  else {
+    if (standingMemo.key !== key || now - standingMemo.at > STANDING_TTL)
+      standingMemo = { key, at: now, map: new Map() };
+    map = standingMemo.map;
+  }
+  return (entry) => {
+    const k = `${entry.kind ?? ""}\u0000${entry.target}`;
+    let s = map.get(k);
+    if (!s) map.set(k, (s = standing(config, entry)));
+    return s;
+  };
+}
+
 /**
  * The `never_writes` entries the kernel will actually be given for this role.
  *

package/src/render.js

@@ -25,6 +25,17 @@ export const C =
       }
     : { dim: "", b: "", off: "", red: "", green: "", yellow: "", blue: "" };
 
+/**
+ * A value chosen by an agent (a target, a grant, an id) made safe to print.
+ *
+ * `target` and the id built from it are strings the agent picked, and they were
+ * written to the terminal raw. Terminal escape sequences (ESC, CR, other C0
+ * controls) let such a string repaint the line a person reads before approving.
+ * On disk they are already JSON-escaped; this is for the screen. Stripped, not
+ * rendered, so what shows is the literal path with the control bytes removed.
+ */
+export const safe = (s) => String(s ?? "").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+
 export const out = (s) => process.stdout.write(s);
 export const err = (s) => process.stderr.write(s);
 
@@ -125,7 +136,7 @@ export function renderReport(report) {
 /** The `explain` answer, as text. Takes what `owners.explain()` returns. */
 export function renderVerdict(role, action, target, verdict) {
   const head = verdict.allowed ? `${C.green}allowed${C.off}` : `${C.yellow}denied${C.off}`;
-  return `\n  ${head}  ${C.b}${role}${C.off} ${action} ${target}\n  ${C.dim}${verdict.reason}${C.off}\n\n`;
+  return `\n  ${head}  ${C.b}${role}${C.off} ${action} ${safe(target)}\n  ${C.dim}${safe(verdict.reason)}${C.off}\n\n`;
 }
 
 /* ── the log ──────────────────────────────────────────────────────────── */
@@ -149,7 +160,7 @@ export function renderEntry(e) {
   // about a run, a reader needs to know which line is which without going to
   // the file — so the one that carries more weight is the one that is marked.
   const from = e.source === "kernel" ? `  ${C.dim}[kernel]${C.off}` : "";
-  return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off} ${e.action} ${e.target}${owners}${from}\n`;
+  return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off} ${e.action} ${safe(e.target)}${owners}${from}\n`;
 }
 
 /* ── the scan ─────────────────────────────────────────────────────────── */

package/src/requests.js

@@ -27,10 +27,11 @@
  * deleted — it is followed by a line saying what happened to it.
  */
 import { neverWrites, isGitMetadata, covers } from "./owners.js";
-import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { STATE_DIR, tomlString } from "./layout.js";
 import { send } from "./spool.js";
+import { withLock } from "./log.js";
 
 export const REQUESTS_NAME = "requests.jsonl";
 
@@ -57,6 +58,17 @@ export function keyOf({ role, action, target }) {
 }
 
 /** The glob a grant would add, derived from what was asked. */
+/**
+ * A request's id as one shell word, for the commands seisin suggests.
+ *
+ * The id carries a path an agent chose, so it is single-quoted whole and any
+ * quote inside it is closed and escaped: pasting the suggestion runs `seisin
+ * grant` on that request and nothing else.
+ */
+export function shellId(key) {
+  return `'${String(key).replace(/'/g, `'\\''`)}'`;
+}
+
 export function grantFor({ action, target }) {
   const t = typeof target === "string" ? target : "";
   // A key keeps its directory when it has one. Stripping it turned a request
@@ -283,6 +295,32 @@ export function refuseIfBarred(config, request) {
       `rewrite another owner's history. Decline it; a role that needs to commit gets a worktree of its own.`);
 }
 
+/**
+ * Apply one policy edit under a lock, and write it atomically.
+ *
+ * `grant` and the console both did read → applyGrant → write with no lock, so
+ * two approvals racing (a person at the CLI and one on the console, or two
+ * terminals) lost one edit: the queue marked both granted while `seisin.toml`
+ * kept only the last writer's change (measured: 39 of 40 concurrent pairs). The
+ * lock serialises them — it already survives a writer that died holding it
+ * (see log.js) — and the write goes to a temp file then renames over the config,
+ * so a crash mid-write cannot leave a half-written, partly-privileged policy.
+ *
+ * `mutate(toml)` returns `{ toml, changed }`. Nothing is written when unchanged.
+ */
+export function editPolicy(config, mutate, { waitMs = 10000 } = {}) {
+  return withLock(config.path, () => {
+    const before = readFileSync(config.path, "utf8");
+    const result = mutate(before);
+    if (result.changed) {
+      const tmp = `${config.path}.tmp-${process.pid}`;
+      writeFileSync(tmp, result.toml);
+      renameSync(tmp, config.path);
+    }
+    return result;
+  }, { waitMs });
+}
+
 export function applyGrant(toml, request, note = "") {
   const field = request.action === "read" ? "keys" : "writes";
   const header = new RegExp(`^\\[roles\\.${escapeRe(request.role)}\\]\\s*$`, "m");
@@ -295,9 +333,8 @@ export function applyGrant(toml, request, note = "") {
   const to = next ? from + next.index : toml.length;
   const section = toml.slice(from, to);
 
-  const line = new RegExp(`^(${field}\\s*=\\s*)\\[([^\\]]*)\\]`, "m");
-  const m = line.exec(section);
-  if (!m)
+  const open = new RegExp(`^${field}\\s*=\\s*\\[`, "m").exec(section);
+  if (!open)
     throw new Error(
       `[roles.${request.role}] has no ${field} list to grant into. ` +
       `Add \`${field} = []\` to that section first — seisin will not write it into another role's block.`
@@ -309,20 +346,60 @@ export function applyGrant(toml, request, note = "") {
   // loads, after they approved something, is its own kind of broken.
   tomlString(request.grant);   // refuses what the format cannot hold
 
-  const items = (m[2].match(/"[^"]*"/g) ?? []).map((s) => s.slice(1, -1));
-  if (items.includes(request.grant)) return { toml, changed: false };
+  const start = open.index + open[0].length;
+  const list = scanList(section, start);
+  if (list.items.includes(request.grant)) return { toml, changed: false };
 
+  /**
+   * Appended, never rebuilt.
+   *
+   * The list used to be re-written from every quoted string between its
+   * brackets — comments included. `"src/web/**",  # was "src/**"` came back as
+   * two grants, so approving anything also granted what a comment mentioned,
+   * and the reason an approver typed (quoted in the provenance comment) became
+   * a path on the next approval. Every earlier provenance comment was lost on
+   * the way. Now the items are the strings outside comments, what is there is
+   * left as it is, and the new entry goes last. The reason is set off with
+   * «», never a double quote, so no older reader can take it for a value.
+   */
+  let inner = section.slice(start, list.end).replace(/\s+$/, "");
+  if (list.lastItemEnd !== null && !list.commaAfterLast) {
+    const at = list.lastItemEnd - start;
+    inner = inner.slice(0, at) + "," + inner.slice(at);
+  }
   const stamp = `# granted ${new Date().toISOString().slice(0, 10)} · asked ${request.times}×` +
-                `${note ? ` · "${cleanReason(note)}"` : ""}`;
-  const body = [...items, request.grant]
-    .map((v) => `  "${v}"${v === request.grant ? `,   ${stamp}` : ","}`)
-    .join("\n")
-    .replace(/,(\s*#[^\n]*)?$/, "$1");
-
-  const edited = section.replace(line, `$1[\n${body}\n]`);
+                `${note ? ` · «${cleanReason(note)}»` : ""}`;
+  const edited = section.slice(0, start) + `${inner}\n  "${request.grant}"   ${stamp}\n]` + section.slice(list.end + 1);
   return { toml: toml.slice(0, from) + edited + toml.slice(to), changed: true };
 }
 
+/**
+ * The strings of a TOML array that starts at `start` (just past its `[`),
+ * skipping comments, and where it closes. The subset has no escapes, so a
+ * string runs to the next double quote.
+ */
+function scanList(text, start) {
+  const items = [];
+  let lastItemEnd = null;
+  let commaAfterLast = false;
+  for (let i = start; i < text.length; i++) {
+    const c = text[i];
+    if (c === "#") { const nl = text.indexOf("\n", i); if (nl === -1) break; i = nl; continue; }
+    if (c === '"') {
+      const close = text.indexOf('"', i + 1);
+      if (close === -1) break;
+      items.push(text.slice(i + 1, close));
+      lastItemEnd = close + 1;
+      commaAfterLast = false;
+      i = close;
+      continue;
+    }
+    if (c === ",") { commaAfterLast = true; continue; }
+    if (c === "]") return { items, end: i, lastItemEnd, commaAfterLast };
+  }
+  throw new Error(`the ${text.slice(0, 40).trim()}… list never closes; fix the config by hand before granting`);
+}
+
 /**
  * The approver's own words, made safe to put in a config file.
  *

package/src/review.js

@@ -28,7 +28,7 @@
  * means nothing without "…in how long".
  */
 import { read, logPath } from "./log.js";
-import { covers, ownersOf } from "./owners.js";
+import { covers, standingOf } from "./owners.js";
 
 /**
  * One reading of the log against the policy.
@@ -122,7 +122,10 @@ function findings(config, entries, minDenials) {
    * than full — a consumer that has never heard of `unusedKnowable` then reports
    * nothing instead of everything, which is the direction this has to fail in.
    */
-  const knowable = entries.some((e) => e.verdict === "allowed");
+  // A disputed line is the parent saying the verdict did not match the policy
+  // — often a forged line. It is not evidence of legitimate use, so it neither
+  // makes the window knowable nor marks a territory used.
+  const knowable = entries.some((e) => e.verdict === "allowed" && !e.disputed);
 
   // Only writes. A key that is declared and not read is ordinary — most roles
   // hold a credential for the one turn a month that needs it — but a folder a
@@ -130,7 +133,7 @@ function findings(config, entries, minDenials) {
   // miss, and the only evidence anyone will ever have for removing it.
   const used = new Set();
   for (const e of entries) {
-    if (e.verdict !== "allowed" || e.action !== "write" || !e.target) continue;
+    if (e.verdict !== "allowed" || e.disputed || e.action !== "write" || !e.target) continue;
     for (const role of Object.values(config.roles))
       for (const glob of role.writes)
         if (role.name === e.role && covers(glob, e.target)) used.add(`${role.name} ${glob}`);
@@ -144,12 +147,17 @@ function findings(config, entries, minDenials) {
 
   /* ── 3. what nobody owns ────────────────────────────────────────────── */
 
+  // The same classification the console and `seisin_causes` use, so the word
+  // means one thing everywhere. A key directory is closed on purpose, a port is
+  // not a path, a protected file is closed to every role and a path outside
+  // the repository is outside every territory: none of them is a hole in the
+  // map. This used to skip keys and ports and count the rest, protected ones
+  // included, while the console counted all four — one word, two numbers.
   const unowned = new Map();
+  const standOf = standingOf(config);
   for (const e of entries) {
-    // A key directory is closed on purpose; a port or a socket is not a path
-    // anybody could own. Neither is a hole in the map.
-    if (!e.target || e.kind === "key" || e.kind === "network") continue;
-    if (ownersOf(config, e.target).length) continue;
+    if (!e.target) continue;
+    if (standOf(e).kind !== "unowned") continue;
     const dir = dirOf(e.target);
     unowned.set(dir, (unowned.get(dir) ?? 0) + 1);
   }

package/src/serve.js

@@ -11,16 +11,16 @@
  * key each role can read, which is a map of where the credentials live.
  */
 import { createServer } from "node:http";
-import { randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadConfig } from "./config.js";
 import { read, logPath } from "./log.js";
 import { settingsFor } from "./srt.js";
-import { pending, requestsPath, settle, applyGrant, refuseIfBarred, markStale } from "./requests.js";
+import { pending, requestsPath, settle, applyGrant, refuseIfBarred, markStale, editPolicy } from "./requests.js";
 import { walls } from "./walls.js";
-import { explain } from "./owners.js";
+import { explain, standingOf } from "./owners.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -54,7 +54,7 @@ export function causesOf(cfg, entries) {
   for (const e of entries) {
     if (e.verdict !== "denied" || !e.target || !e.action) continue;
     const k = `${e.action}\u0000${e.target}`;
-    const g = by.get(k) ?? { action: e.action, target: e.target, times: 0, roles: new Set(), owners: e.owners ?? [] };
+    const g = by.get(k) ?? { action: e.action, target: e.target, kind: e.kind, times: 0, roles: new Set(), ownersThen: e.owners ?? [] };
     g.times++;
     g.roles.add(e.role);
     by.set(k, g);
@@ -99,25 +99,38 @@ export function causesOf(cfg, entries) {
     }));
 
   /**
-   * What a `grep` over the log cannot tell you.
+   * What a `grep` over the log cannot tell you: where each refused path stands
+   * against the policy as it is now.
    *
    * The headline used to be "74% of it is one name", and a field review
    * applied this project's own test to it: *did the number tell you something
-   * you did not know?* For somebody who reads the raw log, no — they had
-   * already counted that. The console was repeating the log back.
+   * you did not know?* For somebody who reads the raw log, no. So the console
+   * added how many causes are on paths no role owns — a decision rather than a
+   * number — and then computed it from the `owners` each log line carried,
+   * which is the one thing the log already had. It said the policy and read
+   * the past: every grant made since left its refusals counted as "nobody's",
+   * and protected surfaces, ports and paths outside the repository, which
+   * nobody can ever own, were counted as waiting for somebody to claim them.
    *
-   * These two are different, because they need the **policy** and the log does
-   * not contain it. `unowned` is the count of causes on paths no role claims:
-   * no grant resolves those until somebody decides who owns them, which is a
-   * decision rather than a number. `settled` is friction that has since been
-   * granted — real yesterday, noise today.
+   * Now every cause is classified by `standing` (owners.js), and the four
+   * piles are reported in paths and in refusals. `unowned` keeps its name and
+   * now means what the page always said it meant. The owners the log recorded
+   * are kept on each cause as `ownersThen`: evidence of what was true, not
+   * authority over what is.
    */
-  const live = [...by.values()];
-  const unowned = live.filter((g) => !(g.owners ?? []).length).length;
+  const standOf = standingOf(cfg);
+  const piles = Object.fromEntries(["unowned", "owned", "protected", "outside"].map((k) => [k, { paths: 0, denials: 0 }]));
+  for (const g of by.values()) {
+    const s = standOf({ kind: g.kind, target: g.target });
+    g.standing = s;
+    piles[s.kind].paths++;
+    piles[s.kind].denials += g.times;
+  }
 
   return {
     total,
-    unowned,
+    unowned: piles.unowned.paths,
+    standing: piles,
     // The real number of distinct causes, not the length of the list below.
     // The page says "over N distinct paths" and the list is capped at twelve,
     // so taking N from the list reported the cap as if it were the count —
@@ -133,7 +146,10 @@ export function causesOf(cfg, entries) {
         times: g.times,
         share: total ? g.times / total : 0,
         roles: [...g.roles].sort(),
-        owners: g.owners,
+        standing: g.standing.kind,
+        ...(g.standing.why && { why: g.standing.why }),
+        owners: g.standing.owners,
+        ownersThen: g.ownersThen,
         // How many of the roles that hit this would still hit it. `some` and
         // not `every`: two roles out of three still blocked is still friction,
         // and requiring all of them would quietly retire a live cause the day
@@ -220,11 +236,22 @@ export function state(configPath, { since = null } = {}) {
  * an exception for loopback. That is what lets the console hold the half the
  * MCP server deliberately does not.
  */
-function decide(configPath, { number, decision, reason }) {
+function decide(configPath, { key, decision, reason }) {
   const cfg = loadConfig(configPath);
   const file = requestsPath(cfg.root);
-  const req = pending(file)[Number(number) - 1];
-  if (!req) throw new Error(`no pending request #${number}`);
+  /**
+   * By the request's id, never by its place in the queue.
+   *
+   * It took a row number, counted against the queue as it stood when the
+   * request arrived — not when the person read the page. Agents keep writing
+   * to that queue, and another channel can settle an entry in between, so
+   * "approve #2" could approve whatever had moved into second place, with the
+   * reason typed for something else. Re-sending the POST approved the next one.
+   * The CLI stopped doing this long ago; the console had not.
+   */
+  if (typeof key !== "string" || !key) throw new Error("key is required — the id of the request on screen");
+  const req = pending(file).find((r) => r.key === key);
+  if (!req) throw new Error(`request ${key} is no longer pending — reload to see the queue as it is now`);
   if (decision !== "granted" && decision !== "denied")
     throw new Error(`decision must be granted or denied`);
 
@@ -233,8 +260,14 @@ function decide(configPath, { number, decision, reason }) {
     // before the queue is settled: if this throws, the request is still open
     // rather than marked done against a file that never changed.
     refuseIfBarred(cfg, req);
-    const { toml, changed } = applyGrant(readFileSync(cfg.path, "utf8"), req, reason);
-    if (changed) writeFileSync(cfg.path, toml);
+    // Locked and atomic, so a grant from another channel is serialised with
+    // this one instead of one silently overwriting the other. See editPolicy.
+    try {
+      editPolicy(cfg, (before) => applyGrant(before, req, reason));
+    } catch (e) {
+      if (e.code === "ELOCKED") throw new Error("another grant is in progress — try again in a moment");
+      throw e;
+    }
   }
   settle(file, req.key, decision, reason ?? "");
   return { ok: true, role: req.role, grant: req.grant, decision };
@@ -315,7 +348,16 @@ export function serve(configPath, port = 4178) {
    * from there, keeps it for the tab, and removes it from the address bar and
    * the history entry. Anything that fetches `/` gets a page with no token in it.
    */
-  const authorized = (req) => req.headers["x-seisin-token"] === token;
+  // Constant-time compare: `===` on a secret leaks its length and a prefix
+  // through timing. Loopback with a Host check makes it near-theoretical, but a
+  // role with local_binding can reach this port, so it is not free.
+  const tokenBuf = Buffer.from(token);
+  const authorized = (req) => {
+    const got = req.headers["x-seisin-token"];
+    if (typeof got !== "string") return false;
+    const gotBuf = Buffer.from(got);
+    return gotBuf.length === tokenBuf.length && timingSafeEqual(gotBuf, tokenBuf);
+  };
 
   /**
    * The Host header has to name this server.
@@ -406,7 +448,9 @@ export function serve(configPath, port = 4178) {
     });
     server.on("error", (e) =>
       fail(e.code === "EADDRINUSE"
-        ? new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`)
+        // Keep the code on the rejection: `seisin ui` reads it to tell "a
+        // console is already here, reopen its link" from any other failure.
+        ? Object.assign(new Error(`port ${port} is busy — pass another with: seisin ui --port <n>`), { code: "EADDRINUSE" })
         : e));
   });
 }

package/src/surface.js

@@ -235,8 +235,13 @@ function dedupe(entries) {
  */
 export function parentInputs(config, { env = process.env } = {}) {
   const abs = (p) => (isAbsolute(p) ? p : join(config.root, p));
+  const policy = abs(config.path ?? CONFIG_NAME);
   const out = [
-    { path: abs(config.path ?? CONFIG_NAME), why: "the policy" },
+    { path: policy, why: "the policy" },
+    // `seisin.toml.observed` is the proposal `init --from-observations` writes
+    // for a person to diff and move onto the policy; a role that could write it
+    // could plant a policy the operator then promotes in good faith.
+    { path: policy + ".observed", why: "the policy" },
     { path: abs(STATE_DIR), why: "seisin's log and request queue" },
     ...(config.keyDirs ?? []).map((d) => ({ path: abs(d), why: "a key directory" })),
   ];
@@ -447,6 +452,15 @@ function computeDenies(config, role, { env, platform, observe }) {
     ? repoDirs.flatMap((d) => [
         `${d}/**/.claude`, `${d}/**/.claude/**`,
         `${d}/**/.git/hooks/**`, `${d}/**/.git/config`,
+        // What git runs that lives beside, not in, `.git/config`: a submodule's
+        // own config and hooks, and the files that redirect a worktree to
+        // another gitdir or config. Ordinary commits never write these, so
+        // denying them costs a working role nothing; a role that could write
+        // one would leave a command for the next `git` outside the box. The
+        // subtree of `.git` stays writable on purpose, so the agent can commit.
+        `${d}/**/.git/config.worktree`,
+        `${d}/**/.git/modules/**/config`, `${d}/**/.git/modules/**/hooks/**`,
+        `${d}/**/.git/worktrees/**/config.worktree`, `${d}/**/.git/worktrees/**/commondir`,
         `${d}/**/.mcp.json`, `${d}/**/.envrc`, `${d}/**/.codex/config.toml`,
       ]).map((path) => ({ path, why: "any project's control files in this territory, by pattern" }))
     : [];