seisin 0.3.0 → 0.4.2

package/src/uilink.js

@@ -0,0 +1,55 @@
+/**
+ * Where a running `seisin ui` leaves its live link, so it can be found again.
+ *
+ * The console's token never travels in an HTTP response — that was the whole
+ * point of the redesign in serve.js: a page that could GET `/` used to walk
+ * away with it. The cost was that a tab which lost the fragment had nowhere to
+ * recover the token from but the terminal that printed it once. When that
+ * terminal is gone, so is the link.
+ *
+ * This is the recovery channel that does not reopen the leak: the link (token
+ * and all) is written to a file only this user can read — under `$TMPDIR/snr/`,
+ * the same 0700 directory runs already keep their sockets and keys in — and
+ * never sent over the wire. `seisin ui` on a busy port reads it and reopens the
+ * live link instead of failing; `seisin ui --link` prints it. The token now
+ * rests on disk (0600) for the life of the run rather than only in memory, a
+ * bounded, local-user exposure, and it is removed when the run exits.
+ *
+ * The pid is stored so a file left by a crashed run is recognisable: a link
+ * whose writer is gone is stale, not a running console.
+ */
+import { writeFileSync, readFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { runsRoot } from "./rundir.js";
+
+function linkFile(port, base) {
+  return join(runsRoot(base), `ui-${port}.url`);
+}
+
+/** Records this run's live URL for the port it bound. */
+export function writeUiLink(port, url, base) {
+  writeFileSync(linkFile(port, base), JSON.stringify({ url, pid: process.pid }) + "\n", { mode: 0o600 });
+}
+
+/**
+ * The live URL a `seisin ui` left for this port, with whether its writer is
+ * still alive — or null if there is no readable record.
+ */
+export function readUiLink(port, base) {
+  let raw;
+  try { raw = readFileSync(linkFile(port, base), "utf8"); } catch { return null; }
+  let e;
+  try { e = JSON.parse(raw); } catch { return null; }
+  if (!e || typeof e.url !== "string") return null;
+  let alive = null;
+  if (typeof e.pid === "number") {
+    // Signal 0 tests for the process without touching it: it throws if gone.
+    try { process.kill(e.pid, 0); alive = true; } catch { alive = false; }
+  }
+  return { url: e.url, pid: e.pid ?? null, alive };
+}
+
+/** Removes the record. Called on exit, and when a stale one is found. */
+export function clearUiLink(port, base) {
+  try { unlinkSync(linkFile(port, base)); } catch {}
+}

package/ui/index.html

@@ -320,7 +320,7 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
       <a href="#activity"><i>◷</i>Activity</a>
       <a href="#configfile"><i>⚙</i>Config file</a>
       <div class="cap">Docs</div>
-      <a href="https://github.com/anthropic-experimental/sandbox-runtime" target="_blank" rel="noopener"><i>↗</i>sandbox-runtime</a>
+      <a href="https://github.com/anthropics/sandbox-runtime" target="_blank" rel="noopener"><i>↗</i>sandbox-runtime</a>
     </div>
   </nav>
 
@@ -522,6 +522,9 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
   ];
 
   function esc(s){return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");}
+  // For attribute values: the text an agent chose (a request's id is its path)
+  // must not be able to close the quote it sits in.
+  function escA(s){return esc(s).replace(/"/g,"&quot;").replace(/'/g,"&#39;");}
   function pad(n){return String(n).padStart(2,"0");}
 
   function theme(v){
@@ -886,10 +889,19 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
        person decides who owns them — a decision, not a count. Added after a
        field review pointed out that the percentage above was the console
        reading the log back to somebody who had already read it. */
+    /* Where each path stands against the policy NOW, not what the log wrote the day of the
+       refusal: that was read here once, and every grant made since kept its paths counted as
+       nobody's. Protected paths and ports are said apart, because they ask the opposite of a
+       decision \u2014 there is nothing to grant. */
+    var st = f.standing || {};
     if (f.unowned)
-      lede += " <b>" + f.unowned + "</b> of the " + (f.distinct || f.causes.length).toLocaleString() +
+      lede += " <b>" + f.unowned.toLocaleString() + "</b> of the " + (f.distinct || f.causes.length).toLocaleString() +
               " are on paths <b>no role owns</b> \u2014 a grant cannot settle those until " +
               "somebody claims them.";
+    var closed = (st.protected ? st.protected.paths : 0);
+    if (closed)
+      lede += " <b>" + closed.toLocaleString() + "</b> " + (closed === 1 ? "is" : "are") +
+              " protected on purpose \u2014 the boundary working, nothing to grant.";
     document.getElementById("ca-lede").innerHTML = lede;
     var win = document.getElementById("dn-window");
     if (win) win.textContent = rangeLabel() + " \u00b7 " + f.total.toLocaleString() + " denials \u00b7 " +
@@ -901,12 +913,16 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
       // A cause the policy no longer denies is history, not live. It is
       // shown, greyed, rather than dropped: it explains a number somebody may
       // remember from yesterday instead of silently changing it.
-      var cold = c.stillDeclined === 0;
+      // `stillRefused` is what the server sends. This read `stillDeclined`, which it never
+      // did, so nothing was ever greyed.
+      var cold = c.stillRefused === 0;
       var who = c.roles.length === 1 ? c.roles[0] : c.roles.length + " roles";
       return '<div class="bar' + (cold ? ' cold' : '') + '">' +
         '<div class="lbl"><div class="p">' + esc(c.action) + ' ' + esc(c.target) + '</div>' +
         '<div class="who">' + esc(who) +
-          (c.owners && c.owners.length ? ' · owned by ' + esc(c.owners.join(", ")) : ' · owned by nobody') +
+          (c.standing === "protected" ? ' · protected: ' + esc(c.why || "") :
+           c.standing === "outside" ? ' · ' + esc(c.why || "outside the map") :
+           c.owners && c.owners.length ? ' · owned by ' + esc(c.owners.join(", ")) : ' · owned by nobody') +
           (cold ? ' · <b>granted since</b>' : '') + '</div>' +
         '<div class="t"><span class="f" style="width:' + w + '%"></span></div></div>' +
         '<div class="num">' + c.times.toLocaleString() +
@@ -1056,7 +1072,7 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
     host.innerHTML = REQS.map(function(r, i){
       var owners = (r.owners && r.owners.length) ? " — belongs to <b>" + esc(r.owners.join(", ")) + "</b>" : "";
       var times = r.times > 1 ? ' · <span class="asked">asked ' + r.times + "×</span>" : "";
-      // Marked, not moved: Approve and Decline post this row's number.
+      // Marked, not moved: Approve and Decline post this row's id.
       var stale = r.stale ? ' · not asked again in ' + Number(r.stale.runs) + ' runs since — likely no longer needed' : "";
       return '<div class="req' + (r.stale ? ' stale' : '') + '">' +
         '<div class="who">' +
@@ -1066,8 +1082,8 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
         "</div>" +
         '<div class="act">' +
           '<input id="why-' + i + '" placeholder="why — this outlives you" aria-label="reason">' +
-          '<button class="btn" data-n="' + (i+1) + '" data-d="granted" type="button">Approve</button>' +
-          '<button class="btn warn" data-n="' + (i+1) + '" data-d="denied" type="button">Decline</button>' +
+          '<button class="btn" data-n="' + i + '" data-k="' + escA(r.key) + '" data-d="granted" type="button">Approve</button>' +
+          '<button class="btn warn" data-n="' + i + '" data-k="' + escA(r.key) + '" data-d="denied" type="button">Decline</button>' +
         "</div>" +
       "</div>";
     }).join("");
@@ -1122,19 +1138,21 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
   /**
    * One decision, sent once.
    *
-   * The buttons go dead on click because a double-approve is not idempotent
-   * here — the second one would be numbered against a queue that already moved.
+   * By the request's id, taken from the row as it was drawn: a position would
+   * be counted against a queue that agents are still writing to. A second click
+   * finds the request already settled and is refused.
    */
   async function act(btn){
-    var n = Number(btn.dataset.n);
-    var why = (document.getElementById("why-" + (n-1)) || {}).value || "";
+    var i = Number(btn.dataset.n);
+    var key = btn.dataset.k;
+    var why = (document.getElementById("why-" + i) || {}).value || "";
     var row = btn.closest(".req");
     row.querySelectorAll("button,input").forEach(function(e){ e.disabled = true; });
     try {
       var r = await fetch("/api/decide", {
         method: "POST",
         headers: { "content-type": "application/json", "x-seisin-token": TOKEN },
-        body: JSON.stringify({ number: n, decision: btn.dataset.d, reason: why })
+        body: JSON.stringify({ key: key, decision: btn.dataset.d, reason: why })
       });
       var out = await r.json();
       if (!r.ok) { var err = new Error(out.error || "denied"); err.status = r.status; throw err; }