seisin 0.4.0 → 0.4.2

package/src/serve.js

@@ -11,16 +11,16 @@
  * key each role can read, which is a map of where the credentials live.
  */
 import { createServer } from "node:http";
-import { randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadConfig } from "./config.js";
 import { read, logPath } from "./log.js";
 import { settingsFor } from "./srt.js";
-import { pending, requestsPath, settle, applyGrant, refuseIfBarred, markStale } from "./requests.js";
+import { pending, requestsPath, settle, applyGrant, refuseIfBarred, markStale, editPolicy } from "./requests.js";
 import { walls } from "./walls.js";
-import { explain } from "./owners.js";
+import { explain, standingOf } from "./owners.js";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -54,7 +54,7 @@ export function causesOf(cfg, entries) {
   for (const e of entries) {
     if (e.verdict !== "denied" || !e.target || !e.action) continue;
     const k = `${e.action}\u0000${e.target}`;
-    const g = by.get(k) ?? { action: e.action, target: e.target, times: 0, roles: new Set(), owners: e.owners ?? [] };
+    const g = by.get(k) ?? { action: e.action, target: e.target, kind: e.kind, times: 0, roles: new Set(), ownersThen: e.owners ?? [] };
     g.times++;
     g.roles.add(e.role);
     by.set(k, g);
@@ -99,25 +99,38 @@ export function causesOf(cfg, entries) {
     }));
 
   /**
-   * What a `grep` over the log cannot tell you.
+   * What a `grep` over the log cannot tell you: where each refused path stands
+   * against the policy as it is now.
    *
    * The headline used to be "74% of it is one name", and a field review
    * applied this project's own test to it: *did the number tell you something
-   * you did not know?* For somebody who reads the raw log, no — they had
-   * already counted that. The console was repeating the log back.
+   * you did not know?* For somebody who reads the raw log, no. So the console
+   * added how many causes are on paths no role owns — a decision rather than a
+   * number — and then computed it from the `owners` each log line carried,
+   * which is the one thing the log already had. It said the policy and read
+   * the past: every grant made since left its refusals counted as "nobody's",
+   * and protected surfaces, ports and paths outside the repository, which
+   * nobody can ever own, were counted as waiting for somebody to claim them.
    *
-   * These two are different, because they need the **policy** and the log does
-   * not contain it. `unowned` is the count of causes on paths no role claims:
-   * no grant resolves those until somebody decides who owns them, which is a
-   * decision rather than a number. `settled` is friction that has since been
-   * granted — real yesterday, noise today.
+   * Now every cause is classified by `standing` (owners.js), and the four
+   * piles are reported in paths and in refusals. `unowned` keeps its name and
+   * now means what the page always said it meant. The owners the log recorded
+   * are kept on each cause as `ownersThen`: evidence of what was true, not
+   * authority over what is.
    */
-  const live = [...by.values()];
-  const unowned = live.filter((g) => !(g.owners ?? []).length).length;
+  const standOf = standingOf(cfg);
+  const piles = Object.fromEntries(["unowned", "owned", "protected", "outside"].map((k) => [k, { paths: 0, denials: 0 }]));
+  for (const g of by.values()) {
+    const s = standOf({ kind: g.kind, target: g.target });
+    g.standing = s;
+    piles[s.kind].paths++;
+    piles[s.kind].denials += g.times;
+  }
 
   return {
     total,
-    unowned,
+    unowned: piles.unowned.paths,
+    standing: piles,
     // The real number of distinct causes, not the length of the list below.
     // The page says "over N distinct paths" and the list is capped at twelve,
     // so taking N from the list reported the cap as if it were the count —
@@ -133,7 +146,10 @@ export function causesOf(cfg, entries) {
         times: g.times,
         share: total ? g.times / total : 0,
         roles: [...g.roles].sort(),
-        owners: g.owners,
+        standing: g.standing.kind,
+        ...(g.standing.why && { why: g.standing.why }),
+        owners: g.standing.owners,
+        ownersThen: g.ownersThen,
         // How many of the roles that hit this would still hit it. `some` and
         // not `every`: two roles out of three still blocked is still friction,
         // and requiring all of them would quietly retire a live cause the day
@@ -220,11 +236,22 @@ export function state(configPath, { since = null } = {}) {
  * an exception for loopback. That is what lets the console hold the half the
  * MCP server deliberately does not.
  */
-function decide(configPath, { number, decision, reason }) {
+function decide(configPath, { key, decision, reason }) {
   const cfg = loadConfig(configPath);
   const file = requestsPath(cfg.root);
-  const req = pending(file)[Number(number) - 1];
-  if (!req) throw new Error(`no pending request #${number}`);
+  /**
+   * By the request's id, never by its place in the queue.
+   *
+   * It took a row number, counted against the queue as it stood when the
+   * request arrived — not when the person read the page. Agents keep writing
+   * to that queue, and another channel can settle an entry in between, so
+   * "approve #2" could approve whatever had moved into second place, with the
+   * reason typed for something else. Re-sending the POST approved the next one.
+   * The CLI stopped doing this long ago; the console had not.
+   */
+  if (typeof key !== "string" || !key) throw new Error("key is required — the id of the request on screen");
+  const req = pending(file).find((r) => r.key === key);
+  if (!req) throw new Error(`request ${key} is no longer pending — reload to see the queue as it is now`);
   if (decision !== "granted" && decision !== "denied")
     throw new Error(`decision must be granted or denied`);
 
@@ -233,8 +260,14 @@ function decide(configPath, { number, decision, reason }) {
     // before the queue is settled: if this throws, the request is still open
     // rather than marked done against a file that never changed.
     refuseIfBarred(cfg, req);
-    const { toml, changed } = applyGrant(readFileSync(cfg.path, "utf8"), req, reason);
-    if (changed) writeFileSync(cfg.path, toml);
+    // Locked and atomic, so a grant from another channel is serialised with
+    // this one instead of one silently overwriting the other. See editPolicy.
+    try {
+      editPolicy(cfg, (before) => applyGrant(before, req, reason));
+    } catch (e) {
+      if (e.code === "ELOCKED") throw new Error("another grant is in progress — try again in a moment");
+      throw e;
+    }
   }
   settle(file, req.key, decision, reason ?? "");
   return { ok: true, role: req.role, grant: req.grant, decision };
@@ -315,7 +348,16 @@ export function serve(configPath, port = 4178) {
    * from there, keeps it for the tab, and removes it from the address bar and
    * the history entry. Anything that fetches `/` gets a page with no token in it.
    */
-  const authorized = (req) => req.headers["x-seisin-token"] === token;
+  // Constant-time compare: `===` on a secret leaks its length and a prefix
+  // through timing. Loopback with a Host check makes it near-theoretical, but a
+  // role with local_binding can reach this port, so it is not free.
+  const tokenBuf = Buffer.from(token);
+  const authorized = (req) => {
+    const got = req.headers["x-seisin-token"];
+    if (typeof got !== "string") return false;
+    const gotBuf = Buffer.from(got);
+    return gotBuf.length === tokenBuf.length && timingSafeEqual(gotBuf, tokenBuf);
+  };
 
   /**
    * The Host header has to name this server.

package/src/surface.js

@@ -235,8 +235,13 @@ function dedupe(entries) {
  */
 export function parentInputs(config, { env = process.env } = {}) {
   const abs = (p) => (isAbsolute(p) ? p : join(config.root, p));
+  const policy = abs(config.path ?? CONFIG_NAME);
   const out = [
-    { path: abs(config.path ?? CONFIG_NAME), why: "the policy" },
+    { path: policy, why: "the policy" },
+    // `seisin.toml.observed` is the proposal `init --from-observations` writes
+    // for a person to diff and move onto the policy; a role that could write it
+    // could plant a policy the operator then promotes in good faith.
+    { path: policy + ".observed", why: "the policy" },
     { path: abs(STATE_DIR), why: "seisin's log and request queue" },
     ...(config.keyDirs ?? []).map((d) => ({ path: abs(d), why: "a key directory" })),
   ];
@@ -447,6 +452,15 @@ function computeDenies(config, role, { env, platform, observe }) {
     ? repoDirs.flatMap((d) => [
         `${d}/**/.claude`, `${d}/**/.claude/**`,
         `${d}/**/.git/hooks/**`, `${d}/**/.git/config`,
+        // What git runs that lives beside, not in, `.git/config`: a submodule's
+        // own config and hooks, and the files that redirect a worktree to
+        // another gitdir or config. Ordinary commits never write these, so
+        // denying them costs a working role nothing; a role that could write
+        // one would leave a command for the next `git` outside the box. The
+        // subtree of `.git` stays writable on purpose, so the agent can commit.
+        `${d}/**/.git/config.worktree`,
+        `${d}/**/.git/modules/**/config`, `${d}/**/.git/modules/**/hooks/**`,
+        `${d}/**/.git/worktrees/**/config.worktree`, `${d}/**/.git/worktrees/**/commondir`,
         `${d}/**/.mcp.json`, `${d}/**/.envrc`, `${d}/**/.codex/config.toml`,
       ]).map((path) => ({ path, why: "any project's control files in this territory, by pattern" }))
     : [];

package/ui/index.html

@@ -320,7 +320,7 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
       <a href="#activity"><i>◷</i>Activity</a>
       <a href="#configfile"><i>⚙</i>Config file</a>
       <div class="cap">Docs</div>
-      <a href="https://github.com/anthropic-experimental/sandbox-runtime" target="_blank" rel="noopener"><i>↗</i>sandbox-runtime</a>
+      <a href="https://github.com/anthropics/sandbox-runtime" target="_blank" rel="noopener"><i>↗</i>sandbox-runtime</a>
     </div>
   </nav>
 
@@ -522,6 +522,9 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
   ];
 
   function esc(s){return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");}
+  // For attribute values: the text an agent chose (a request's id is its path)
+  // must not be able to close the quote it sits in.
+  function escA(s){return esc(s).replace(/"/g,"&quot;").replace(/'/g,"&#39;");}
   function pad(n){return String(n).padStart(2,"0");}
 
   function theme(v){
@@ -886,10 +889,19 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
        person decides who owns them — a decision, not a count. Added after a
        field review pointed out that the percentage above was the console
        reading the log back to somebody who had already read it. */
+    /* Where each path stands against the policy NOW, not what the log wrote the day of the
+       refusal: that was read here once, and every grant made since kept its paths counted as
+       nobody's. Protected paths and ports are said apart, because they ask the opposite of a
+       decision \u2014 there is nothing to grant. */
+    var st = f.standing || {};
     if (f.unowned)
-      lede += " <b>" + f.unowned + "</b> of the " + (f.distinct || f.causes.length).toLocaleString() +
+      lede += " <b>" + f.unowned.toLocaleString() + "</b> of the " + (f.distinct || f.causes.length).toLocaleString() +
               " are on paths <b>no role owns</b> \u2014 a grant cannot settle those until " +
               "somebody claims them.";
+    var closed = (st.protected ? st.protected.paths : 0);
+    if (closed)
+      lede += " <b>" + closed.toLocaleString() + "</b> " + (closed === 1 ? "is" : "are") +
+              " protected on purpose \u2014 the boundary working, nothing to grant.";
     document.getElementById("ca-lede").innerHTML = lede;
     var win = document.getElementById("dn-window");
     if (win) win.textContent = rangeLabel() + " \u00b7 " + f.total.toLocaleString() + " denials \u00b7 " +
@@ -901,12 +913,16 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
       // A cause the policy no longer denies is history, not live. It is
       // shown, greyed, rather than dropped: it explains a number somebody may
       // remember from yesterday instead of silently changing it.
-      var cold = c.stillDeclined === 0;
+      // `stillRefused` is what the server sends. This read `stillDeclined`, which it never
+      // did, so nothing was ever greyed.
+      var cold = c.stillRefused === 0;
       var who = c.roles.length === 1 ? c.roles[0] : c.roles.length + " roles";
       return '<div class="bar' + (cold ? ' cold' : '') + '">' +
         '<div class="lbl"><div class="p">' + esc(c.action) + ' ' + esc(c.target) + '</div>' +
         '<div class="who">' + esc(who) +
-          (c.owners && c.owners.length ? ' · owned by ' + esc(c.owners.join(", ")) : ' · owned by nobody') +
+          (c.standing === "protected" ? ' · protected: ' + esc(c.why || "") :
+           c.standing === "outside" ? ' · ' + esc(c.why || "outside the map") :
+           c.owners && c.owners.length ? ' · owned by ' + esc(c.owners.join(", ")) : ' · owned by nobody') +
           (cold ? ' · <b>granted since</b>' : '') + '</div>' +
         '<div class="t"><span class="f" style="width:' + w + '%"></span></div></div>' +
         '<div class="num">' + c.times.toLocaleString() +
@@ -1056,7 +1072,7 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
     host.innerHTML = REQS.map(function(r, i){
       var owners = (r.owners && r.owners.length) ? " — belongs to <b>" + esc(r.owners.join(", ")) + "</b>" : "";
       var times = r.times > 1 ? ' · <span class="asked">asked ' + r.times + "×</span>" : "";
-      // Marked, not moved: Approve and Decline post this row's number.
+      // Marked, not moved: Approve and Decline post this row's id.
       var stale = r.stale ? ' · not asked again in ' + Number(r.stale.runs) + ' runs since — likely no longer needed' : "";
       return '<div class="req' + (r.stale ? ' stale' : '') + '">' +
         '<div class="who">' +
@@ -1066,8 +1082,8 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
         "</div>" +
         '<div class="act">' +
           '<input id="why-' + i + '" placeholder="why — this outlives you" aria-label="reason">' +
-          '<button class="btn" data-n="' + (i+1) + '" data-d="granted" type="button">Approve</button>' +
-          '<button class="btn warn" data-n="' + (i+1) + '" data-d="denied" type="button">Decline</button>' +
+          '<button class="btn" data-n="' + i + '" data-k="' + escA(r.key) + '" data-d="granted" type="button">Approve</button>' +
+          '<button class="btn warn" data-n="' + i + '" data-k="' + escA(r.key) + '" data-d="denied" type="button">Decline</button>' +
         "</div>" +
       "</div>";
     }).join("");
@@ -1122,19 +1138,21 @@ button.btn:active,button.tag:active,button.add:active,button.sw:active{transform
   /**
    * One decision, sent once.
    *
-   * The buttons go dead on click because a double-approve is not idempotent
-   * here — the second one would be numbered against a queue that already moved.
+   * By the request's id, taken from the row as it was drawn: a position would
+   * be counted against a queue that agents are still writing to. A second click
+   * finds the request already settled and is refused.
    */
   async function act(btn){
-    var n = Number(btn.dataset.n);
-    var why = (document.getElementById("why-" + (n-1)) || {}).value || "";
+    var i = Number(btn.dataset.n);
+    var key = btn.dataset.k;
+    var why = (document.getElementById("why-" + i) || {}).value || "";
     var row = btn.closest(".req");
     row.querySelectorAll("button,input").forEach(function(e){ e.disabled = true; });
     try {
       var r = await fetch("/api/decide", {
         method: "POST",
         headers: { "content-type": "application/json", "x-seisin-token": TOKEN },
-        body: JSON.stringify({ number: n, decision: btn.dataset.d, reason: why })
+        body: JSON.stringify({ key: key, decision: btn.dataset.d, reason: why })
       });
       var out = await r.json();
       if (!r.ok) { var err = new Error(out.error || "denied"); err.status = r.status; throw err; }