seisin 0.4.2 → 0.5.0

package/src/hook.js

@@ -28,6 +28,18 @@ const FILE_TOOLS = {
   Read: "read", NotebookRead: "read",
 };
 
+/**
+ * The tools {@link targetsOf} has anything to say about, as a hook matcher.
+ *
+ * `seisin wire` used to install PreToolUse with `"*"`, so Claude Code started
+ * this hook for Grep, Glob and TodoWrite too — a whole Node start-up, measured
+ * at 218 ms, to return nothing. Built from the same table targetsOf reads, so
+ * a tool added there is matched here. Anchored, because Claude Code reads a
+ * matcher as a regular expression and an unanchored `Write` matches
+ * `TodoWrite`.
+ */
+export const TOOL_MATCHER = `^(${[...Object.keys(FILE_TOOLS), "Bash"].join("|")}|mcp__.*)$`;
+
 /**
  * Paths a shell command is going to write.
  *
@@ -44,7 +56,7 @@ const WRITERS = /(?:^|\s|;|&&|\|\|)(?:cp|mv|install|tee|touch|mkdir|rm|rmdir|tru
  * The split is on the double underscore: a server name carries single ones
  * (`claude_ai_Gmail`) and so does a tool name (`execute_sql`), so the server is
  * everything between `mcp__` and the next `__`. Shared with the parent's intake,
- * which recomputes the same verdict rather than trusting the line from the box.
+ * which recomputes the same verdict rather than trusting the line from the sandbox.
  */
 export function mcpServer(tool) {
   const m = typeof tool === "string" && /^mcp__(.+?)__(.+)$/.exec(tool);
@@ -52,15 +64,19 @@ export function mcpServer(tool) {
 }
 
 export function targetsOf(tool, input = {}) {
+  // The event is whatever the agent's harness sent. `tool_input: null` or a
+  // path that is a number used to throw below, and a throwing hook exits 2 —
+  // which Claude Code reads as "block". Malformed means "nothing to say".
+  if (!input || typeof input !== "object") input = {};
   const kind = FILE_TOOLS[tool];
   if (kind) {
-    const p = input.file_path ?? input.path ?? input.notebook_path;
-    return p ? [{ action: kind, path: p }] : [];
+    const p = [input.file_path, input.path, input.notebook_path].find((x) => x != null);
+    return typeof p === "string" && p ? [{ action: kind, path: p }] : [];
   }
   /**
    * An MCP tool call names a resource, not a path: `mcp__<server>__<tool>`.
    *
-   * The kernel never sees it — the MCP server runs outside the box — so a call
+   * The kernel never sees it — the MCP server runs outside the sandbox — so a call
    * that goes unrecorded here goes unrecorded everywhere. Measured 2026-09-24:
    * the event reaches PreToolUse with the tool's own arguments as `tool_input`,
    * which is exactly why the file-tool code above returns nothing for it. We
@@ -132,14 +148,14 @@ function kindOf(config, path) {
 }
 
 /**
- * The half of the refusal that nothing inside the box could otherwise know.
+ * The half of the refusal that nothing inside the sandbox could otherwise know.
  *
  * `ask()` has already filed a request by the time this sentence is built — and
  * until now it did so silently, so an agent could not tell the person who sent
  * it that anything was pending. It closes two loops the bare refusal leaves
  * open: retrying, because the queue deduplicates and a second attempt only
  * raises a counter; and waiting, because nothing inside the sandbox can
- * approve.
+ * grant.
  *
  * It deliberately says nothing about the MCP server. The hook cannot know
  * whether one is configured — `wire` writes `.claude/settings.json` and MCP
@@ -167,6 +183,15 @@ export function decide(config, role, event, { observe = false, now = append, ask
   const file = logPath(config.root);
   const queue = requestsPath(config.root);
   const verdicts = [];
+  // How many times the first refusal here was given BEFORE this attempt. Read
+  // before the entry is written, because where the entry goes decides whether
+  // a read afterwards sees it: to the file outside `seisin run`, but to the
+  // parent's socket inside it — and that line is not on disk until the parent
+  // gets to it, so counting afterwards came out one behind there.
+  let before = null;
+  const priorOnce = (action, target) => {
+    if (before === null) before = timesHit(file, role, action, target);
+  };
 
   for (const t of targets) {
     // A tool call, resolved to its MCP server. "Whose is it" is the question
@@ -179,6 +204,7 @@ export function decide(config, role, event, { observe = false, now = append, ask
       const v = t.server
         ? explain(config, role, "mcp", t.server)
         : { allowed: false, owners: [], mcp: true, reason: `${t.tool} is not a recognisable mcp__<server>__<tool> name` };
+      if (!observe && !v.allowed) priorOnce("use", t.tool);
       now(file, {
         role, tool: event.tool_name, action: "use", kind: "tool", target: t.tool,
         verdict: observe ? "observed" : v.allowed ? "allowed" : "denied",
@@ -202,6 +228,7 @@ export function decide(config, role, event, { observe = false, now = append, ask
     if (t.action === "read" && kind !== "key") continue;
 
     const v = explain(config, role, kind === "key" ? "read" : "write", rel);
+    if (!observe && !v.allowed) priorOnce(kind === "key" ? "read" : t.action, rel);
 
     now(file, {
       role,
@@ -215,13 +242,15 @@ export function decide(config, role, event, { observe = false, now = append, ask
     });
     // A denial already carries everything a request needs, so leave one behind:
     // the refusal stops being a dead end and becomes something a person can act
-    // on in one command. Observing records nothing to approve — there was no
+    // on in one command. Observing records nothing to grant — there was no
     // denial to answer. See docs/permission-requests.md.
     //
     // Except a `never_writes` refusal. That one is the policy saying no on
     // purpose; a request for it asks a person to undo a subtraction somebody
     // wrote, and approving it is how the subtraction disappears unnoticed.
-    if (!observe && !v.allowed && !v.neverWrites && !v.gitMetadata)
+    // Nor a protected file: no grant opens one (the kernel keeps refusing it),
+    // which is why `seisin run` never queued those either (intake.js).
+    if (!observe && !v.allowed && !v.neverWrites && !v.gitMetadata && !v.protected)
       ask(queue, { role, action: kind === "key" ? "read" : t.action, target: rel, owners: v.owners ?? [] });
 
     // The action as it was RECORDED, not as the tool named it: a read of a key
@@ -242,19 +271,20 @@ export function decide(config, role, event, { observe = false, now = append, ask
    * How many times this exact denial has already been handed to this role.
    *
    * The sentence below is correct every time and that has not been enough:
-   * measured on a real team, 25% of all denials were a repeat of something the
-   * same role had already been refused, one of them nineteen times. Correct
+   * measured on a multi-repo workspace, 25% of all denials were a repeat of something the
+   * same role had already been denied, one of them nineteen times. Correct
    * and *heard* are different properties, and only the first was being
-   * measured. So the refusal carries its own history: the second time, it says
+   * measured. So the denial carries its own history: the second time, it says
    * it is the second time.
    *
-   * Counted from the log that was just written, so the count includes this
-   * attempt. Silent on the first — a counter that says "1×" on every first
-   * refusal is noise on the turn where the sentence is already doing its job.
+   * The earlier refusals, read before this one was recorded, plus this one —
+   * the same number whether the entry went to the file or to the socket. Silent
+   * on the first — a counter that says "1×" on every first refusal is noise on
+   * the turn where the sentence is already doing its job.
    */
-  const before = timesHit(logPath(config.root), role, denied.action, denied.target);
-  const again = before > 1
-    ? ` You have been denied this ${before} times now; it is not going to work on the ${ordinal(before + 1)} try.`
+  const times = (before ?? 0) + 1;
+  const again = times > 1
+    ? ` You have been denied this ${times} times now; it is not going to work on the ${ordinal(times + 1)} try.`
     : "";
 
   // The hook advises; it does not enforce. Returning `deny` here stops the call
@@ -271,10 +301,10 @@ export function decide(config, role, event, { observe = false, now = append, ask
         // told "no" retries; an agent told whose it is asks, or moves on.
         denied.neverWrites
           ? `${denied.reason}. Do not ask for it: nothing was queued, because the answer is already written down.` + again
-          : denied.gitMetadata
+          : denied.gitMetadata || denied.protected
           ? `${denied.reason}. Nothing was queued.` + again
           : denied.mcp
-          ? `${denied.reason}. Nothing was queued: which MCP servers a role may load is set in its mcp list, a policy change a person makes, not a grant they approve.` + again
+          ? `${denied.reason}. Nothing was queued: which MCP servers a role may load is set in its mcp list, a policy change a person makes, not something they grant from the queue.` + again
           : (denied.owners?.length
           ? wasRead
             ? `${denied.target} is declared for ${denied.owners.join(", ")}, not ${role}. Ask for what you need from it rather than reading the key.`

package/src/index.js

@@ -18,7 +18,7 @@ export { findConfig, loadConfig, parseToml } from "./config.js";
 /** Where seisin's own files live. */
 export { CONFIG_NAME, STATE_DIR, LOG_NAME } from "./layout.js";
 
-/** Who owns a path, and the sentence to hand a blocked agent. */
+/** Who owns a path, and the sentence to hand a denied agent. */
 export { covers, ownersOf, keyHolders, explain } from "./owners.js";
 
 /** A policy, resolved into sandbox settings and a child environment. */
@@ -34,7 +34,7 @@ export { buildEnv, BASE as BASE_ENV, DEFAULTS as DEFAULT_ENV } from "./env.js";
  */
 export { parseKey, defaultName, entriesOf, MODES, RESERVED_ENV } from "./keys.js";
 
-/** What a role keeps being refused, recomputed against the policy as it stands. */
+/** What a role keeps being denied, recomputed against the policy as it stands. */
 export { walls, wasted, MIN_HITS } from "./walls.js";
 
 /** The report `check` prints, without the printing. */
@@ -47,11 +47,11 @@ export { scan, SHAPES, DEFAULT_IGNORE } from "./scan.js";
 export { read as readLog, logPath, observed, generalise } from "./log.js";
 
 /**
- * The queue of refusals waiting on a person.
+ * The queue of requests waiting on a person.
  *
  * `pending` and `grantFor` are public because reading the queue and drafting a
  * proposal are things a caller — including an MCP server — legitimately does.
- * `settle` and `applyGrant` are NOT exported: approving is not a tool call, and
+ * `settle` and `applyGrant` are NOT exported: granting is not a tool call, and
  * the surface should make that hard to get wrong rather than merely document
  * it. See docs/permission-requests.md.
  */

package/src/inspect.js

@@ -8,14 +8,16 @@
  * does — each one is a way the policy silently does not hold — so they belong
  * where they can be exercised directly.
  */
+import { unknownRole } from "./suggest.js";
 import { resolve, dirname, basename, relative, join, delimiter } from "node:path";
-import { realpathSync, lstatSync, readdirSync, existsSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, readdirSync, existsSync, readFileSync, statSync } from "node:fs";
 import { ownersOf, covers, enforcedNeverWrites } from "./owners.js";
-import { ROLE_KEYS } from "./config.js";
+import { ROLE_KEYS, closest } from "./config.js";
 import { entriesOf } from "./keys.js";
 import { SHAPES } from "./scan.js";
-import { wired } from "./commands/wire.js";
+import { wired, broadlyWired } from "./commands/wire.js";
 import { RUNTIME_WRITES, CREDENTIAL_HOMES, expand, settingsFor } from "./srt.js";
+import { realOrSelf } from "./grants.js";
 import { protections, resolveExecutable } from "./surface.js";
 
 /**
@@ -26,8 +28,11 @@ import { protections, resolveExecutable } from "./surface.js";
  * answering it with silence is how a typo becomes a belief.
  */
 export function inspect(config, only = null, where = config.path) {
-  if (only && !config.roles[only]) throw new Error(`unknown role "${only}"`);
+  if (only && !config.roles[only]) throw unknownRole(config, only);
   const roles = only ? [config.roles[only]] : Object.values(config.roles);
+  // Once: it is listed on its own and again as a warning, and it is the most
+  // expensive thing check computes.
+  const shared = sharedPaths(config, roles);
 
   return {
     where,
@@ -43,16 +48,16 @@ export function inspect(config, only = null, where = config.path) {
     providers: Object.values(config.keyProviders ?? {}).map((p) => ({
       name: p.name, command: p.command, mode: p.mode,
     })),
-    shared: sharedPaths(config, roles),
+    shared,
     /**
-     * What the kernel will refuse a role inside its own territory, and why:
+     * What the kernel will deny a role inside its own territory, and why:
      * programs installed where a role writes, the hooks and settings of each
      * project, provider scripts and `file://` targets. Each takes something
      * away from a territory as written, so it is shown rather than applied
      * quietly. See surface.js for the family and the measurements.
      */
     protected: protections(config, roles),
-    warnings: warningsFor(config, roles),
+    warnings: warningsFor(config, roles, shared),
     limits: LIMITS,
   };
 }
@@ -61,8 +66,8 @@ export function inspect(config, only = null, where = config.path) {
  * What the tool cannot do at all — as opposed to `warnings`, which are things
  * wrong with *this* config.
  *
- * Kept apart on purpose. A limit printed as a warning reads as something the
- * operator could fix, and after the third run it reads as nothing at all.
+ * Kept apart on purpose. A limit printed as a warning reads as something a
+ * person could fix, and after the third run it reads as nothing at all.
  *
  * These are the sentences someone needs before they trust the map on screen
  * more than it deserves, so `check` prints them every time rather than behind a
@@ -72,11 +77,11 @@ export function inspect(config, only = null, where = config.path) {
 const LIMITS = [
   ...(process.platform === "darwin" ? [] : [{
     kind: "kernel-denials-unreadable",
-    headline: "refusals by the kernel are not recorded on this platform",
+    headline: "denials by the kernel are not recorded on this platform",
     detail:
       "on macOS `seisin run` reads them out of the system log, so a denial the hook never " +
       "saw still lands in `seisin log` with its owner and still queues a request. There is no " +
-      "equivalent to read here — bubblewrap does not log refusals, and the runtime's substitute " +
+      "equivalent to read here — bubblewrap does not log denials, and the runtime's substitute " +
       "is not reachable from outside it. The boundary holds exactly as well; what you lose is " +
       "seeing it work. Run `seisin wire` so the hook records what it can. The ask is upstream: " +
       "github.com/carlostapiacl/seisin/blob/main/docs/upstream/cli-violations.md",
@@ -95,7 +100,7 @@ const LIMITS = [
     headline: "`--observe` opens the filesystem, never the network",
     detail:
       "so it cannot tell you which domains an agent needs. The runtime does record every " +
-      "refusal the proxy makes — host, port and reason — but only a caller that embeds the " +
+      "denial the proxy makes — host, port and reason — but only a caller that embeds the " +
       "library can read them; nothing reaches a caller that runs the binary, which is what " +
       "seisin does. So for an agent whose endpoints are not published, the options are to " +
       "find them another way or drop the network restriction for it. The ask is upstream: " +
@@ -108,14 +113,14 @@ const LIMITS = [
       "bubblewrap denies a path by mounting over it, and for a path that is not there it would " +
       "create it on your disk. So on Linux a role can still create a .git/hooks entry or a " +
       ".claude/settings.json in a project of its territory that had none. On macOS the kernel " +
-      "refuses creating them too.",
+      "denies creating them too.",
   }] : []),
   {
     kind: "shared-scratch",
     headline: "roles share ~/.cache, ~/.local/share and the temp dir unless isolate = \"home\"",
     detail:
       "programs installed there that are on your PATH are protected, and so are Claude Code's " +
-      "settings and plugins. Anything else a program outside the box reads from those places — a " +
+      "settings and plugins. Anything else a program outside the sandbox reads from those places — a " +
       "cache it executes, a tool not on PATH — is writable by every role. isolate = \"home\" " +
       "gives each role its own.",
   },
@@ -137,18 +142,18 @@ const LIMITS = [
  * Two things, both about `never_writes` and both ways a subtraction can look
  * written and not be:
  *
- *   - a key seisin does not know. It used to be dropped without a word, which
+ *   - a setting seisin does not know. It used to be dropped without a word, which
  *     for `writes` is a role with less than it thinks, and for a misspelt
  *     `never_writes` is a role with MORE than its owner thinks — the one
- *     direction a permission file must not fail in. Named with the nearest
- *     known key when there is one close enough to be the intended spelling.
+ *     direction a policy must not fail in. Named with the nearest
+ *     known setting when there is one close enough to be the intended spelling.
  *   - a `never_writes` entry that no `writes` of the same role covers. It
  *     subtracts from nothing, so it is either a typo in the path or a rule
  *     that stopped applying when the territory moved. Either way it reads as
  *     protection and is not.
  *
  * Silent when `never_writes` is absent. Absent is valid; a check that asks for
- * the key would turn an optional subtraction into a required migration.
+ * the setting would turn an optional subtraction into a required migration.
  */
 function roleKeyWarnings(roles, config = null) {
   const warnings = [];
@@ -167,14 +172,27 @@ function roleKeyWarnings(roles, config = null) {
       const near = nearest(k, ROLE_KEYS);
       warnings.push({
         kind: "unknown-role-key",
-        headline: `${r.name}: unknown key "${k}" in [roles.${r.name}] — ignored` +
+        headline: `${r.name}: unknown setting "${k}" in [roles.${r.name}] — ignored` +
           (near ? `. Did you mean "${near}"?` : ""),
-        detail: `Known keys: ${ROLE_KEYS.join(", ")}. ` +
+        detail: `Known settings: ${ROLE_KEYS.join(", ")}. ` +
           (near === "never_writes"
             ? "As written this subtracts nothing: the role can still write every path it lists."
             : "Nothing in it takes effect."),
       });
     }
+    // A family handed to a role is a hole in the protection on purpose, and
+    // said on every check so it stays a decision somebody can see.
+    for (const f of r.controlFiles ?? [])
+      warnings.push({
+        kind: "control-files-handed",
+        headline: f === "ide"
+          ? `${r.name}: control_files = ["ide"] — may edit .vscode/, .cursor/ and .windsurf/ in its territory`
+          : `${r.name}: control_files = ["instructions"] — may edit CLAUDE.md, AGENTS.md and their kin in its territory`,
+        detail: f === "ide"
+          ? "Your editor applies what it writes there — tasks, settings, auto-approval, MCP servers — outside the sandbox. " +
+            "Hand it only to a role that maintains those files, and review its changes to them."
+          : "The next agent session reads what it writes there as its instructions, whichever role that session is.",
+      });
     // macOS only, and not by omission: on Linux the runtime removes the network
     // namespace, so every role already has a loopback of its own — it can serve
     // and reach its own server with or without the key, and reaches nothing on
@@ -227,25 +245,7 @@ function nearest(word, candidates) {
   // letters mislead here: `no_writes` is three edits from `writes`, and
   // suggesting the grant for a misspelt subtraction is the worst answer.
   if (/deny|never|no_?write/i.test(word)) return "never_writes";
-  let best = null, bestD = 4;
-  for (const c of candidates) {
-    const d = distance(word.toLowerCase(), c);
-    if (d < bestD) { best = c; bestD = d; }
-  }
-  return best;
-}
-
-function distance(a, b) {
-  const row = Array.from({ length: b.length + 1 }, (_, i) => i);
-  for (let i = 1; i <= a.length; i++) {
-    let prev = row[0]; row[0] = i;
-    for (let j = 1; j <= b.length; j++) {
-      const cur = row[j];
-      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
-      prev = cur;
-    }
-  }
-  return row[b.length];
+  return closest(word, candidates);
 }
 
 /**
@@ -256,10 +256,17 @@ function distance(a, b) {
  * that it stays a decision somebody made rather than a thing that drifted.
  */
 export function sharedPaths(config, roles = Object.values(config.roles)) {
+  // Asked once per distinct glob: a real policy repeats them (1,332 writes,
+  // 303 distinct in a multi-repo workspace), and each question is every glob of every
+  // role again.
   const seen = new Set();
+  const asked = new Map();
   for (const r of roles)
-    for (const glob of r.writes)
-      if (ownersOf(config, glob.replace(/\/\*\*$/, "")).length > 1) seen.add(glob);
+    for (const glob of r.writes) {
+      let many = asked.get(glob);
+      if (many === undefined) asked.set(glob, (many = ownersOf(config, glob.replace(/\/\*\*$/, "")).length > 1));
+      if (many) seen.add(glob);
+    }
   /**
    * A shared database counts once, not four times.
    *
@@ -305,7 +312,7 @@ function homeReachWarning(config) {
           `isolate = "credentials" denies ${where} and the rest. What stays open is ` +
           "~/.claude and ~/.codex, which is what keeps the agent logged in, so the roles " +
           'share one session and can read each other. `isolate = "home"` closes those ' +
-          "too, and then every CLI in the box will ask you to log in again.",
+          "too, and then every CLI in the sandbox will ask you to log in again.",
       }
     : {
         kind: "home-open",
@@ -318,7 +325,6 @@ function homeReachWarning(config) {
 }
 
 
-/** Every way this policy does not hold, each with what to do about it. */
 /**
  * Credential-shaped names at the top of the repository, and nothing deeper.
  *
@@ -364,19 +370,28 @@ function credentialish(root) {
   return [...found].sort().slice(0, 4);
 }
 
-/** Is this a command the shell would find? Walks PATH; asks no shell. */
-function onPath(cmd) {
-  if (cmd.includes("/")) return existsSync(cmd);
-  const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
-  return dirs.some((d) => existsSync(join(d, cmd)));
+/**
+ * Would the parent find this command? The same lookup `run` makes
+ * (resolveExecutable), so check does not call "missing" a program that is
+ * only in a directory a role writes — that has its own warning, above.
+ */
+function onPath(cmd, config) {
+  try {
+    // A path is resolved against the policy and not looked up, so it is there
+    // only if it exists.
+    return existsSync(resolveExecutable(cmd, config));
+  } catch (e) {
+    return /a role can write/.test(e.message);
+  }
 }
 
-function warningsFor(config, roles) {
+/** Every way this policy does not hold, each with what to do about it. */
+function warningsFor(config, roles, shared = sharedPaths(config, roles)) {
   const warnings = [];
 
   // A pattern the kernel cannot be given is not a policy, it is a sentence that
   // reads like one. `run` refuses it; `check` exists precisely so you find that
-  // out while reading the map rather than mid-turn.
+  // out while reading the map rather than mid-run.
   for (const r of roles) {
     try {
       settingsFor(config, r.name);
@@ -411,17 +426,15 @@ function warningsFor(config, roles) {
 
   // PATH entries that are not absolute resolve against wherever the parent is
   // standing, which is the repo. They are ignored for every lookup seisin makes
-  // outside the box; said here because a lookup that skips them can find a
+  // outside the sandbox; said here because a lookup that skips them can find a
   // different program than your shell does.
   const unanchored = (process.env.PATH ?? "").split(delimiter).filter((d) => !d || !d.startsWith("/"));
   if (unanchored.length)
     warnings.push({
       kind: "relative-path",
       headline: `PATH has ${unanchored.length} relative entr${unanchored.length === 1 ? "y" : "ies"} (${unanchored.map((d) => JSON.stringify(d)).join(", ")})`,
-      detail: "They resolve inside the repo, where roles write, so seisin skips them when it looks for a program to run outside the box.",
+      detail: "They resolve inside the repo, where roles write, so seisin skips them when it looks for a program to run outside the sandbox.",
     });
-  const shared = sharedPaths(config, roles);
-
   if (shared.length)
     warnings.push({
       kind: "shared",
@@ -484,7 +497,7 @@ function warningsFor(config, roles) {
   }
 
   // Without the hook, half the record is missing rather than all of it: on macOS
-  // `seisin run` reads the kernel's own refusals, so denials still land and
+  // `seisin run` reads the kernel's own denials, so they still land and
   // still queue a request. What goes unrecorded is everything the kernel
   // allowed — which is the half `init --from-observations` is built out of, and
   // the half that tells "nothing was denied" apart from "nobody was watching".
@@ -498,16 +511,26 @@ function warningsFor(config, roles) {
       headline: "only denials are being recorded: the agent has not been told to run the hook",
       detail:
         process.platform === "darwin"
-          ? "the boundary holds either way, and refusals are still logged and still queue a " +
+          ? "the boundary holds either way, and denials are still logged and still queue a " +
             "request — `seisin run` reads them from the kernel. What is missing is every " +
-            "action that was allowed, so `review` cannot tell you which grants are dead and " +
+            "action that was allowed, so `review` cannot tell you which grants are unused and " +
             "`init --from-observations` has nothing to build from. Run `seisin wire` once in " +
             "this repo."
-          : "the boundary holds either way — but on this platform the kernel's refusals are " +
+          : "the boundary holds either way — but on this platform the kernel's denials are " +
             "not readable either, so log, watch, requests, grant and review all read a record " +
             "that nobody is writing. Run `seisin wire` once in this repo.",
     });
 
+  else if (broadlyWired(config.root))
+    warnings.push({
+      kind: "hook-matcher-broad",
+      headline: "the hook runs on every tool call: it was wired before 0.5.0 with the matcher \"*\"",
+      detail:
+        "nothing is lost — every tool the hook reads is still covered — but each Read, Glob " +
+        "and TodoWrite starts a process that has nothing to say. Run `seisin wire` again: it " +
+        "narrows seisin's own entry in place and leaves everyone else's hooks alone.",
+    });
+
   // A territory that leaves the repo is supported — a role can own its handover
   // note one level up — but it is a different promise from "this repo, divided",
   // and it should be a sentence somebody chose rather than a line that drifted.
@@ -524,10 +547,63 @@ function warningsFor(config, roles) {
       });
   }
 
+  /**
+   * A territory that is not on disk.
+   *
+   * A proposal written for another repo — or one typo — reads as a working
+   * policy: `check` printed the map and the first sign of anything wrong was a
+   * denial inside the agent. Said per glob, as a warning and never a failure:
+   * a role can own a folder it is about to create.
+   */
+  for (const r of roles) {
+    for (const g of r.writes) {
+      if (g === "**" || g.startsWith("/") || g.startsWith("../")) continue;
+      const fixed = [];
+      for (const part of g.split("/")) {
+        if (/[*?[\]]/.test(part)) break;
+        fixed.push(part);
+      }
+      if (!fixed.length || existsSync(join(config.root, ...fixed))) continue;
+      warnings.push({
+        kind: "writes-match-nothing",
+        headline: `${r.name} writes ${g} — matches nothing in this repo`,
+        detail: "fine if the role is about to create it; otherwise the territory points at a folder that is not there.",
+      });
+    }
+  }
+
+  /**
+   * A territory inside a key directory.
+   *
+   * Seen in use: a role's whole territory sat under the folder declared as
+   * `[keys] dir`, which is closed to every role, so the role could write
+   * nothing at all — and `check` printed its territory as if it held. A key
+   * directory is read by the roles that declare a key in it and written by
+   * none; a folder a role must write belongs somewhere else.
+   */
+  const keyRoots = (config.keyDirs ?? []).map((d) => d.replace(/\/+$/, "")).filter(Boolean);
+  for (const r of roles) {
+    for (const g of r.writes) {
+      const fixed = [];
+      for (const part of g.split("/")) {
+        if (/[*?[\]]/.test(part)) break;
+        fixed.push(part);
+      }
+      const at = fixed.join("/");
+      const dir = at && keyRoots.find((d) => at === d || at.startsWith(d + "/"));
+      if (!dir) continue;
+      warnings.push({
+        kind: "territory-in-key-dir",
+        headline: `${r.name} writes ${g} — inside the key directory ${dir}, which no role can write`,
+        detail: "a key directory is read by the roles that declare its keys and written by none. Move what this role writes out of it, or drop the territory.",
+      });
+    }
+  }
+
   /**
    * A file granted by name does not come with its neighbours.
    *
-   * Measured, in production, and it survived two human reviews of the policy:
+   * Measured, in production, and it survived two reviews of the policy by people:
    * a role was granted its database file and still could not write the
    * database. The database opens a second file beside the first — a journal —
    * and the sibling was outside the grant, so the write failed in the
@@ -584,7 +660,6 @@ function warningsFor(config, roles) {
       const unnamed = onDisk.filter((n) => !named.includes(n));
       if (!unnamed.length) continue;
       const shown = relative(resolve(config.root), dir);
-      const more = unnamed.length > 8 ? ` … and ${unnamed.length - 8} more` : "";
       listed.push({ role: r.name, named: named.length, total: onDisk.length,
                     where: shown ? shown + "/" : "the repo root", unnamed });
 
@@ -719,14 +794,14 @@ function warningsFor(config, roles) {
     for (const k of entriesOf(r)) if (k.kind === "ref") used.add(k.scheme);
   for (const scheme of [...used].sort()) {
     const provider = config.keyProviders?.[scheme];
-    if (!provider || onPath(provider.command[0])) continue;
+    if (!provider || onPath(provider.command[0], config)) continue;
     warnings.push({
       kind: "provider-missing",
       headline: `the ${scheme} provider runs "${provider.command[0]}", which is not on PATH`,
       detail:
         "every key of that scheme will stop the run rather than resolve. Nothing is " +
         "substituted for a key that did not resolve, so this fails closed — but it fails " +
-        "at the start of a turn, not here.",
+        "at the start of a run, not here.",
     });
   }
 
@@ -789,12 +864,3 @@ function lstatOrNull(p) {
     return null;
   }
 }
-
-/** The path with symlinks followed, or the path itself if it is not on disk. */
-function realOrSelf(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return p;
-  }
-}