seisin 0.4.0 → 0.5.0

package/src/views.js

@@ -0,0 +1,289 @@
+/**
+ * What the console and the MCP server both say about the log, computed once.
+ *
+ * The two readers are different — a person opens the console, an agent calls
+ * the MCP — and they must not disagree about the same file. This held the
+ * shared arithmetic inside serve.js, so the MCP server imported node:http to
+ * group denials. Nothing here opens a socket or writes a file.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { explain, standingOf } from "./owners.js";
+import { kindsOf, KINDS } from "./kinds.js";
+import { walls } from "./walls.js";
+import { pending, requestsPath, markStale } from "./requests.js";
+
+/**
+ * An ISO date from what a person or an agent typed, or null for no filter.
+ * Anything that does not parse is ignored rather than refused: a bad filter
+ * should show everything, not an error.
+ */
+export function parseSince(raw) {
+  const t = raw ? Date.parse(raw) : NaN;
+  return Number.isNaN(t) ? null : new Date(t).toISOString();
+}
+
+/**
+ * `explain`, remembered while the policy file stays the same.
+ *
+ * Causes and walls ask the policy about every refused path, and a real log has
+ * two thousand of them: ~0.75 ms each, most of the console's two-second poll.
+ * The answer depends on the policy text, so that is the key — and a little on
+ * the disk (on Linux a control file is protected only once it exists), so the
+ * memory is dropped after a minute too, as standingOf does. A config that was
+ * not read from a file gets a memory for this call only.
+ */
+const VERDICT_TTL = 60_000;
+let verdictMemo = { key: null, at: 0, map: new Map() };
+
+export function verdicts(cfg, { now = Date.now() } = {}) {
+  let key = null;
+  try {
+    if (cfg.path) key = `${cfg.path}\u0000${createHash("sha256").update(readFileSync(cfg.path)).digest("hex")}`;
+  } catch {}
+  let map;
+  if (key === null) map = new Map();
+  else {
+    if (verdictMemo.key !== key || now - verdictMemo.at > VERDICT_TTL) verdictMemo = { key, at: now, map: new Map() };
+    map = verdictMemo.map;
+  }
+  return (c, role, action, target) => {
+    const k = `${role}\u0000${action}\u0000${target}`;
+    let v = map.get(k);
+    if (!v) map.set(k, (v = explain(c, role, action, target)));
+    return v;
+  };
+}
+
+/**
+ * Today's denials, grouped by what was denied rather than by who asked.
+ *
+ * Called `causes` and not `friction`: `seisin review` already has a `friction`
+ * that counts something narrower — repeated denials that are not about keys —
+ * and two screens of one product reporting different numbers under one label
+ * is the kind of thing nobody notices until they are compared.
+ *
+ * The console used to show them per role, which is the same list a hundred
+ * times over: measured on one deployment, 1,080 of 1,422 refusals were a
+ * single lock file across six repositories, and per-role that reads as six
+ * hundred identical rows instead of one sentence. Grouped, the shape of the
+ * day is visible at a glance and it is almost never a territory dispute.
+ *
+ * `stillRefused` is recomputed against the policy as it stands, not read out
+ * of the log — a cause that has been granted since is history, not friction,
+ * and leaving it on the page sends somebody to fix what is already fixed.
+ */
+export function causesOf(cfg, entries, { ask = explain, limit = 12 } = {}) {
+  const by = new Map();
+  for (const e of entries) {
+    if (e.verdict !== "denied" || !e.target || !e.action) continue;
+    const k = `${e.action}\u0000${e.target}`;
+    const g = by.get(k) ?? { action: e.action, target: e.target, kind: e.kind, times: 0, roles: new Set(), ownersThen: e.owners ?? [] };
+    g.times++;
+    g.roles.add(e.role);
+    by.set(k, g);
+  }
+  const total = [...by.values()].reduce((n, g) => n + g.times, 0);
+
+  /**
+   * The same grouping again, one level coarser: by the NAME at the end of the
+   * path rather than the path.
+   *
+   * Grouping by path alone gets the most important reading backwards. Measured
+   * here: six of the top seven causes were `.git/index.lock` in six different
+   * repositories, no single one above 17% — so "no cause dominates" is what the
+   * arithmetic says and the opposite of what is true. Three quarters of the
+   * window was one *kind* of thing, and that is a tooling problem with a
+   * mechanical fix, not a territory question anybody needs to rule on.
+   *
+   * By last segment, and nothing cleverer. A regex that recognised lock files,
+   * caches and build outputs would be a list of guesses about other people's
+   * toolchains that quietly goes stale; a repeated filename is a fact about
+   * this log.
+   */
+  const fams = new Map();
+  for (const g of by.values()) {
+    const name = g.target.split("/").filter(Boolean).pop() ?? g.target;
+    const f = fams.get(name) ?? { name, times: 0, paths: 0, where: [], roles: new Set() };
+    f.times += g.times;
+    f.paths++;
+    // The places, so the console can show what a name is made of instead of
+    // asserting a percentage the reader has to take on faith.
+    f.where.push({ target: g.target, times: g.times });
+    for (const r of g.roles) f.roles.add(r);
+    fams.set(name, f);
+  }
+  const families = [...fams.values()]
+    .sort((a, b) => b.times - a.times)
+    .map((f) => ({
+      name: f.name, times: f.times, paths: f.paths,
+      share: total ? f.times / total : 0,
+      roles: [...f.roles].sort(),
+      where: f.where.sort((a, b) => b.times - a.times).slice(0, 20),
+    }));
+
+  /**
+   * What a `grep` over the log cannot tell you: where each refused path stands
+   * against the policy as it is now.
+   *
+   * The headline used to be "74% of it is one name", and a field review
+   * applied this project's own test to it: *did the number tell you something
+   * you did not know?* For somebody who reads the raw log, no. So the console
+   * added how many causes are on paths no role owns — a decision rather than a
+   * number — and then computed it from the `owners` each log line carried,
+   * which is the one thing the log already had. It said the policy and read
+   * the past: every grant made since left its refusals counted as "nobody's",
+   * and protected surfaces, ports and paths outside the repository, which
+   * nobody can ever own, were counted as waiting for somebody to claim them.
+   *
+   * Now every cause is classified by `standing` (owners.js), and the four
+   * piles are reported in paths and in refusals. `unowned` keeps its name and
+   * now means what the page always said it meant. The owners the log recorded
+   * are kept on each cause as `ownersThen`: evidence of what was true, not
+   * authority over what is.
+   */
+  const standOf = standingOf(cfg);
+  const piles = Object.fromEntries(["unowned", "owned", "protected", "outside"].map((k) => [k, { paths: 0, denials: 0 }]));
+  for (const g of by.values()) {
+    const s = standOf({ kind: g.kind, target: g.target });
+    g.standing = s;
+    piles[s.kind].paths++;
+    piles[s.kind].denials += g.times;
+  }
+
+  /**
+   * And for the unowned pile, what kind of thing each path is (kinds.js).
+   *
+   * Suggesting an owner was measured first and was right about one time in
+   * twenty; the rest widened a role over git's lock files, a test's scratch
+   * directories and a credential. What the reader needs is the kind and the
+   * move that fits it, and `territory` — the part that really is a decision —
+   * is what is left. Over every unowned cause, not the twelve shown: one rule
+   * needs the whole set (the same name made unique per run in many places).
+   */
+  const unowned = [...by.values()].filter((g) => g.standing.kind === "unowned");
+  const natures = kindsOf(unowned.map((g) => g.target), { keyDirs: cfg.keyDirs ?? [] });
+  piles.unowned.kinds = Object.fromEntries(Object.keys(KINDS).map((k) => [k, { paths: 0, denials: 0 }]));
+  for (const g of unowned) {
+    g.nature = natures.get(g.target);
+    piles.unowned.kinds[g.nature.kind].paths++;
+    piles.unowned.kinds[g.nature.kind].denials += g.times;
+  }
+
+  /**
+   * What each refusal was about — a file, a key, a network destination or an
+   * MCP tool — counted over every cause, not the ones listed. The console
+   * shows keys, network and tools apart from files: "no role owns this" is a
+   * sentence about paths, and said of a port or a tool it is simply wrong.
+   */
+  const about = Object.fromEntries(ABOUT.map((k) => [k, { paths: 0, denials: 0 }]));
+  for (const g of by.values()) {
+    const a = aboutOf(g.kind);
+    about[a].paths++;
+    about[a].denials += g.times;
+  }
+
+  return {
+    total,
+    unowned: piles.unowned.paths,
+    about,
+    standing: piles,
+    // The real number of distinct causes, not the length of the list below.
+    // The page says "over N distinct paths" and the list is capped at twelve,
+    // so taking N from the list reported the cap as if it were the count —
+    // a wrong number stated confidently, which is worse than no number.
+    distinct: by.size,
+    families: families.slice(0, 8),
+    causes: [...by.values()]
+      .sort((a, b) => b.times - a.times)
+      .slice(0, limit)
+      .map((g) => ({
+        about: aboutOf(g.kind),
+        action: g.action,
+        target: g.target,
+        times: g.times,
+        share: total ? g.times / total : 0,
+        roles: [...g.roles].sort(),
+        standing: g.standing.kind,
+        ...(g.standing.why && { why: g.standing.why }),
+        // Only on an unowned cause: what kind of thing it is, and what to do.
+        ...(g.nature && { kind: g.nature.kind, hint: g.nature.hint }),
+        owners: g.standing.owners,
+        ownersThen: g.ownersThen,
+        // How many of the roles that hit this would still hit it. `some` and
+        // not `every`: two roles out of three still blocked is still friction,
+        // and requiring all of them would quietly retire a live cause the day
+        // one role got a grant.
+        stillRefused: [...g.roles].filter((r) => cfg.roles[r] && !ask(cfg, r, g.action, g.target).allowed).length,
+      })),
+  };
+}
+
+/** What a log line was about. Lines from before the field existed are files. */
+const ABOUT = ["file", "key", "network", "tool"];
+function aboutOf(kind) {
+  return ABOUT.includes(kind) ? kind : "file";
+}
+
+/**
+ * Walls as the console shows them: each with what it was about and, when no
+ * role owns the path, the same kind and hint the Denied screen gives it.
+ *
+ * Without this the two screens contradicted each other about one path: Walls
+ * said `.env.local` "has no owner — no role can write it until one claims it",
+ * an invitation to give it one, while Denied said it is a credential and never
+ * to grant a write to it. The hint is kinds.js's, so it is the same sentence.
+ *
+ * A copy: the MCP server hands out walls() as it is, and this adds to it.
+ */
+export function describeWalls(cfg, byRole, entries) {
+  const kindOfLine = new Map();
+  for (const e of entries) if (e.verdict === "denied" && e.target) kindOfLine.set(`${e.role}\u0000${e.action}\u0000${e.target}`, e.kind);
+  const standOf = standingOf(cfg);
+  const out = {};
+  const unowned = [];
+  for (const [role, list] of Object.entries(byRole)) {
+    out[role] = list.map((w) => {
+      const about = aboutOf(kindOfLine.get(`${role}\u0000${w.action}\u0000${w.target}`));
+      const x = { ...w, about, retried: w.times - 1 };
+      // Every file wall, owned or not: a protected path can also lie inside
+      // someone's territory, and "owned" must not hide "never granted". The
+      // owners are today's, as Denied's are.
+      if (about === "file") {
+        const s = standOf({ kind: "file", target: w.target });
+        x.standing = s.kind;
+        x.owners = s.owners ?? [];
+        if (s.why) x.why = s.why;
+        if (s.kind === "unowned") unowned.push(x);
+      }
+      return x;
+    });
+  }
+  const natures = kindsOf(unowned.map((w) => w.target), { keyDirs: cfg.keyDirs ?? [] });
+  for (const w of unowned) Object.assign(w, natures.get(w.target));
+  return out;
+}
+
+/**
+ * Every role's walls, from one read of the log.
+ *
+ * `entries` are log lines of any verdict (walls keeps the denied ones); only
+ * roles with at least one wall appear. The MCP read the log once per role — 32
+ * reads on a real policy — to answer the same question.
+ */
+export function wallsByRole(cfg, entries, { ask } = {}) {
+  const denied = entries.filter((e) => e.verdict === "denied");
+  return Object.fromEntries(
+    Object.keys(cfg.roles)
+      .map((r) => [r, walls(cfg, r, { entries: denied, ...(ask && { ask }) })])
+      .filter(([, w]) => w.length));
+}
+
+/**
+ * The request queue as a person should read it: pending, with the requests
+ * the role has stopped asking for marked. `history` is the whole log, every
+ * verdict — a run that was only allowed things is still a run.
+ */
+export function queue(root, history, keyDirs = null) {
+  return markStale(pending(requestsPath(root), { keyDirs }), history);
+}

package/src/violations.js

@@ -98,7 +98,7 @@ export function actionOf(operation) {
  *   - `remote:*:<port>` — a TCP dial the profile refused. The kernel does not
  *     name the host, so the target is the port and nothing more.
  *   - a unix socket path — except under /var/run, where the system daemons
- *     live: every DNS lookup inside the box is a refused connect to
+ *     live: every DNS lookup inside the sandbox is a refused connect to
  *     mDNSResponder, and recording those would bury everything else.
  *   - anything else (an empty detail, which the kernel also writes) — dropped.
  */
@@ -219,8 +219,8 @@ export function isOurs(tagged, argv) {
  * reimplementing the runtime's shell quoting and inheriting its bugs; a process
  * tree is a fact the OS already holds.
  *
- * One `ps` per unseen pid, and only until the session suffix is learned — after
- * that the suffix alone is exact, because it is generated once per `srt`
+ * At most one `ps` per TREE_MS, and only until the session suffix is learned —
+ * after that the suffix alone is exact, because it is generated once per `srt`
  * process. In practice that is one `ps` per run.
  */
 export function descends(pid, root, snapshot) {
@@ -235,14 +235,25 @@ export function descends(pid, root, snapshot) {
   return false;
 }
 
-/** pid → ppid for every process this user can see. */
+/**
+ * pid → ppid for every process this user can see, and in `tree.roots` the
+ * pids that are a sandbox run's root: an `srt`, or a `seisin run`.
+ *
+ * The roots are what makes "not ours" provable. A process outside our tree is
+ * someone else's only if its ancestry reaches another run; one whose ancestry
+ * ends at init was orphaned — `cmd &`, a build daemon, git's fsmonitor — and
+ * may well be ours, reparented when the shell that started it exited.
+ */
 export function processTree(run = execFileSync) {
   const tree = new Map();
+  tree.roots = new Set();
   try {
-    const out = run("/bin/ps", ["-Ao", "pid=,ppid="], { encoding: "utf8" });
+    const out = run("/bin/ps", ["-Ao", "pid=,ppid=,args="], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
     for (const line of out.split("\n")) {
-      const m = line.trim().match(/^(\d+)\s+(\d+)$/);
-      if (m) tree.set(Number(m[1]), Number(m[2]));
+      const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.*))?$/);
+      if (!m) continue;
+      tree.set(Number(m[1]), Number(m[2]));
+      if (m[3] && RUN_ROOT.test(m[3])) tree.roots.add(Number(m[1]));
     }
   } catch {
     // No tree means nothing can be attributed, which the caller handles by
@@ -251,6 +262,25 @@ export function processTree(run = execFileSync) {
   return tree;
 }
 
+/** The command line of an `srt` (however it was installed) or of `seisin run`. */
+const RUN_ROOT = /(?:^|[\s/])srt(?:\s|$)|sandbox-runtime\/dist\/cli\.js(?:\s|$)|(?:^|[\s/])(?:seisin|cli\.js)\s+run\s/;
+
+/**
+ * Does `pid` descend from a run root other than `root`?
+ *
+ * A table without command lines (`roots` absent) cannot tell an orphan from a
+ * stranger, and answers as before: alive and not ours is someone else's.
+ */
+export function underAnotherRun(pid, root, snapshot) {
+  if (!snapshot.roots) return true;
+  const seen = new Set();
+  for (let at = pid; at && at !== 1 && !seen.has(at); at = snapshot.get(at)) {
+    if (at !== root && snapshot.roots.has(at)) return true;
+    seen.add(at);
+  }
+  return false;
+}
+
 /**
  * Did this refusal reach for content, or just walk past the door?
  *
@@ -336,7 +366,7 @@ export function scopeOf(settings, root) {
  * without `log` looks like — and the caller says so once rather than silently
  * logging less than it used to.
  */
-export function watchDenials(onDeny, { pid = null, argv = null, platform = process.platform, spawnFn = spawn, treeFn = processTree } = {}) {
+export function watchDenials(onDeny, { pid = null, argv = null, platform = process.platform, spawnFn = spawn, treeFn = processTree, now = () => performance.now() } = {}) {
   const stats = { attributed: 0, foreign: 0, unattributed: 0 };
 
   /**
@@ -370,9 +400,29 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
 
   let suffix = null;               // learned once, exact from then on
   let tree = null;                 // refreshed only while still learning
+  let treeAt = -Infinity;          // when `tree` was taken
   let root = pid;                  // the srt pid; not known until after spawn
   const mine = new Set();          // pids already proven to be ours
   const held = [];                 // denials seen before they could be attributed
+  const foreignSuffixes = new Set(); // other sandboxes, proven while they were alive
+  let recheck = null;              // a deferred look, when a snapshot was refused
+
+  /**
+   * One `ps` per TREE_MS at most, and a later look instead of a skipped one.
+   *
+   * `ps` is synchronous and it was taken for every denial from another sandbox
+   * while this run had not learned its own suffix — which, for a run that is
+   * never refused anything, is the whole run. Several cells at once is exactly
+   * that: 83 ms of blocked event loop per foreign line, measured. A line whose
+   * process may be younger than the last snapshot is not decided on it; it is
+   * held, and looked at again once the window has passed.
+   */
+  const snapshot = () => { tree = treeFn(); treeAt = now(); };
+  const later = () => {
+    if (recheck) return;
+    recheck = setTimeout(() => { recheck = null; if (!suffix && held.length) revisit(); }, TREE_MS);
+    recheck.unref?.();
+  };
 
   /**
    * Two anchors, and either one is enough.
@@ -396,12 +446,27 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     }
     if (root === null) return false;   // nothing to descend from yet
     if (mine.has(d.pid)) return true;
-    if (tree === null) tree = treeFn();
+    // A suffix already proven foreign needs no `ps`: the suffix is per `srt`.
+    if (d.suffix && foreignSuffixes.has(d.suffix)) return false;
+    if (tree === null) snapshot();
     if (!descends(d.pid, root, tree)) {
-      // A pid we have never seen may simply be younger than the snapshot.
-      // Refresh once, then believe the answer.
-      tree = treeFn();
-      if (!descends(d.pid, root, tree)) return false;
+      // A pid the snapshot does not have may simply be younger than it.
+      // Refresh once, then believe the answer — unless the last refresh was
+      // moments ago, and then look again later rather than refresh now. A pid
+      // it does have is answered: its parents do not change into ours.
+      if (treeAt < d.seen && !tree.has(d.pid)) {
+        if (now() - treeAt < TREE_MS) { later(); return LATER; }
+        snapshot();
+      }
+      if (!descends(d.pid, root, tree)) {
+        // Alive, not ours by either anchor, and under another run — the tag
+        // did not match above. Every later line from that `srt` is someone
+        // else's without asking. Alive but under no run at all is an orphan
+        // (`cmd &`, a daemon): possibly ours, so its suffix stays undecided
+        // rather than turning this run's own later lines into strangers.
+        if (d.suffix && tree.has(d.pid) && underAnotherRun(d.pid, root, tree)) foreignSuffixes.add(d.suffix);
+        return false;
+      }
     }
     mine.add(d.pid);
     // The first proven denial hands us the suffix for every later one.
@@ -432,7 +497,8 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
   };
 
   const consider = (d) => {
-    if (attribute(d)) {
+    const verdict = attribute(d);
+    if (verdict === true) {
       stats.attributed++;
       onDeny(d);
       // Learning the suffix makes every held line decidable. Without this,
@@ -445,7 +511,9 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     // child whose pid anchors attribution, or the process died before `ps`
     // could see it. Either way a foreign sandbox and one of ours look the same
     // from here, so hold the line rather than credit or discard it.
-    if (!suffix && d.suffix) {
+    // A line put off to the next snapshot is held with or without a suffix:
+    // the look it is waiting for is the only thing that can decide it.
+    if (verdict === LATER || (!suffix && d.suffix && !foreignSuffixes.has(d.suffix))) {
       stats.unattributed++;
       held.push(d);
       // Bounded, because the common case on a busy machine is a run that is
@@ -473,7 +541,13 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     child = spawnFn("/usr/bin/log", ["stream", "--predicate", PREDICATE, "--style", "compact"],
       { stdio: ["ignore", "pipe", "ignore"] });
   } catch (e) {
-    return { available: false, reason: `could not start the log stream: ${e.message}`, stats, close() {} };
+    // The same shape as the unavailable watcher above, for the same reason:
+    // `run` calls attributeTo() and awaits close() unconditionally.
+    return {
+      available: false, reason: `could not start the log stream: ${e.message}`, stats,
+      attributeTo() {},
+      close: () => Promise.resolve(stats),
+    };
   }
 
   let buf = "";
@@ -486,6 +560,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
       const chunk = buf.slice(0, cut + 4);
       buf = buf.slice(cut + 4);
       const d = parseChunk(chunk);
+      if (d) d.seen = now();
       // Deduplicated here and not in consider(), because a held denial goes
       // through consider() a second time when it is finally attributed. Doing
       // this there would drop every line that arrived before the child had a
@@ -528,6 +603,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
      * nothing pending — costs one tick rather than the full window.
      */
     close({ drain = 0 } = {}) {
+      clearTimeout(recheck);
       const stop = () => { try { child.kill("SIGTERM"); } catch { /* already gone */ } };
       if (drain <= 0) { stop(); return Promise.resolve(stats); }
       return new Promise((resolve) => {
@@ -551,6 +627,18 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
  */
 const QUIET_MS = 60;
 
+/**
+ * The shortest time between two `ps` snapshots while attribution is learning.
+ *
+ * Long enough that a burst of foreign denials costs one snapshot, not one
+ * each; short enough that a line held for a younger process is decided before
+ * anyone reads the log.
+ */
+const TREE_MS = 250;
+
+/** What `attribute` answers for a line it has put off to the next snapshot. */
+const LATER = "later";
+
 /**
  * How many undecided denials to keep while waiting to learn our own suffix.
  *

package/src/walls.js

@@ -4,8 +4,8 @@
  * seisin answers *whose is this* at the moment of the refusal, once, in the
  * middle of a turn, and then the sentence is gone. Nothing carries it forward,
  * so the agent tries again — and the measurement that made this module exist
- * says how often: of 345 denials on a real team, **88 (25%) were a repeat of
- * something that same role had already been refused**. One role spent 37 calls
+ * says how often: of 345 denials in a multi-repo workspace, **88 (25%) were a repeat of
+ * something that same role had already been denied**. One role spent 37 calls
  * on two walls, hitting the same one nineteen times.
  *
  * A block that repeats nineteen times is not a boundary working. It is a
@@ -33,8 +33,7 @@
  * A window is still accepted, and still useful for a different reason: a
  * refusal from three weeks ago is noise even if it is still refused today.
  */
-import { openSync, readSync, closeSync, statSync } from "node:fs";
-import { read } from "./log.js";
+import { read, readEntries } from "./log.js";
 import { explain } from "./owners.js";
 import { STALE_RUNS, RUN_GAP_MS, runsAfter } from "./requests.js";
 
@@ -49,7 +48,7 @@ export const MIN_HITS = 2;
  * different repositories are two walls, and merging them hides which one was
  * hit.
  */
-export function walls(config, role, { file, entries = null, min = MIN_HITS, since = null, limit = 6, fresh = false } = {}) {
+export function walls(config, role, { file, entries = null, min = MIN_HITS, since = null, limit = 6, fresh = false, ask = explain } = {}) {
   // `entries`: the log already read, for a caller asking about every role at
   // once (the console asks for 32 on a real policy) — one read instead of 32.
   const denied = entries
@@ -70,7 +69,9 @@ export function walls(config, role, { file, entries = null, min = MIN_HITS, sinc
     if (w.times < min) continue;
     // The policy as it stands, not as it stood. A granted wall is not a wall,
     // and the whole point of saying this to an agent is that it is true now.
-    const verdict = explain(config, role, w.action, w.target);
+    // `ask` is explain, or a remembered one (views.js) for a caller asking
+    // about every role at once.
+    const verdict = ask(config, role, w.action, w.target);
     if (verdict.allowed) continue;
     out.push({ ...w, reason: verdict.reason, owners: verdict.owners });
   }
@@ -89,17 +90,18 @@ export function walls(config, role, { file, entries = null, min = MIN_HITS, sinc
 /**
  * How much of the log `timesHit` will look at.
  *
- * The log is append-only and never rotates — that is the storage design and it
- * is the right one — so "read the file" is O(everything you have ever done),
- * on a path that runs inside the hook. Measured on a 372 KB log: 3 ms per
- * call, which is nothing, and 300 ms at 37 MB, which is not, on every refusal
- * of every turn forever.
+ * The log is append-only and a segment only rotates at 8 MiB, so "read the
+ * file" is O(everything since the last rotation), on a path that runs inside
+ * the hook. Measured on a 372 KB log: 3 ms per
+ * call, which is nothing, and 300 ms at 37 MB, which is not, on every denial
+ * of every session forever.
  *
  * So it reads the tail. That makes the count **recent repetition** rather than
  * lifetime repetition, and recent is the one the sentence is about anyway: an
  * agent being told "you have hit this three times" means this session, not
  * last month. 4 MB is thousands of entries — far more than a turn produces,
- * and bounded.
+ * and bounded. Right after a rotation the tail is short, and so is the count:
+ * the current segment only, on purpose.
  */
 const TAIL_BYTES = 4 * 1024 * 1024;
 
@@ -113,41 +115,16 @@ const TAIL_BYTES = 4 * 1024 * 1024;
  * call.
  */
 export function timesHit(file, role, action, target) {
-  let text;
-  try {
-    const { size } = statSync(file);
-    const from = Math.max(0, size - TAIL_BYTES);
-    const fd = openSync(file, "r");
-    try {
-      const buf = Buffer.alloc(size - from);
-      readSync(fd, buf, 0, buf.length, from);
-      text = buf.toString("utf8");
-    } finally {
-      closeSync(fd);
-    }
-  } catch {
-    return 0;                       // no log yet is not an error; it is a first turn
-  }
-  const lines = text.split("\n");
-  // The first line of a tail read is usually half an entry. Dropping it costs
-  // one count at most and keeps a truncated line from being parsed as if it
-  // were whole.
-  if (from0(text, file)) lines.shift();
+  // The line the tail cut lands in is dropped (readLines checks the byte before
+  // the cut, so a cut on a boundary keeps it). Comparing the file's byte size
+  // with the text's UTF-16 length used to decide that, and with any multibyte
+  // character in the tail it kept the fragment of a line or dropped a whole one.
   let n = 0;
-  for (const line of lines) {
-    if (!line.trim()) continue;
-    let e;
-    try { e = JSON.parse(line); } catch { continue; }
+  for (const e of readEntries(file, { tail: TAIL_BYTES }))
     if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) n++;
-  }
   return n;
 }
 
-/** Did we start mid-file? Then the first line is a fragment. */
-function from0(text, file) {
-  try { return statSync(file).size > text.length; } catch { return false; }
-}
-
 /**
  * The calls that went into hitting the same wall twice or more.
  *

package/src/worktree.js

@@ -30,9 +30,10 @@
  * and no dependency — a tool people install to shrink their attack surface
  * should not shell out to find out where it is.
  */
-import { statSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { statSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve, relative, isAbsolute } from "node:path";
 import { findConfig } from "./config.js";
+import { realOrSelf } from "./grants.js";
 
 const GITDIR = /^gitdir:\s*(.+?)\s*$/;
 const WORKTREE = /^(.+)\/\.git\/worktrees\/[^/]+$/;
@@ -63,18 +64,9 @@ function statOf(p) {
   }
 }
 
-/** The path with symlinks followed, or the path itself when it is not on disk. */
-function real(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return p;
-  }
-}
-
 /** Two spellings of one place — `/tmp` and `/private/tmp` — compare equal. */
 function same(a, b) {
-  return real(a) === real(b);
+  return realOrSelf(a) === realOrSelf(b);
 }
 
 /**