seisin 0.4.2 → 0.6.0

package/src/nested.js

@@ -41,7 +41,15 @@
 const SELF_SANDBOXING = {
   codex: {
     on: true,
-    off: ["--dangerously-bypass-approvals-and-sandbox"],
+    // `-s danger-full-access` first: it is the one to suggest. It turns off only
+    // the sandbox, and inside `seisin run` that is the whole change wanted —
+    // `--dangerously-bypass…` also turns off approvals, which says more than
+    // the situation needs. Warning about `-s danger-full-access` was a warning
+    // about a thing that was not happening: measured on 2026-09-30 with codex
+    // 0.150.1, a turn under seisin with that flag ran its commands and finished.
+    off: ["--sandbox=danger-full-access", "--dangerously-bypass-approvals-and-sandbox"],
+    // The same setting spelt as a flag and its value, two words.
+    offPairs: [["-s", "danger-full-access"], ["--sandbox", "danger-full-access"]],
     // The subcommand whose entire job is to confine. No flag turns that off.
     never: ["sandbox"],
   },
@@ -71,7 +79,8 @@ export function nestedSandboxWarning(cmd = []) {
       `  Run the command directly — seisin is already the boundary here.`
     );
 
-  const turnedOff = (spec.off ?? []).some((f) => rest.some((a) => a === f || a.startsWith(f + "=")));
+  const turnedOff = (spec.off ?? []).some((f) => rest.some((a) => a === f || a.startsWith(f + "="))) ||
+    (spec.offPairs ?? []).some(([flag, value]) => rest.some((a, i) => a === flag && rest[i + 1] === value));
   if (turnedOff) return null;
   const confining = spec.on || (spec.onWith ?? []).some((f) => rest.includes(f));
   if (!confining) return null;
@@ -81,6 +90,6 @@ export function nestedSandboxWarning(cmd = []) {
     `second profile to a process that already has one.\n` +
     `  This does not fail here — it fails on the first command ${name} tries to run, which ` +
     `looks like an agent that did nothing.\n` +
-    `  Run it with its own sandbox off: \`${name} … ${(spec.off ?? ["--no-sandbox"])[0]}\`.`
+    `  Run it with its own sandbox off: \`${name} … ${spec.offPairs ? spec.offPairs[0].join(" ") : (spec.off ?? ["--no-sandbox"])[0]}\`.`
   );
 }

package/src/notify.js

@@ -17,20 +17,22 @@
  *     never holds the URL, and `SEISIN_NOTIFY_URL` is dropped from its
  *     environment even if the role names it;
  *   - the URL is not readable from any territory. A ntfy topic or a webhook is
- *     a credential — whoever can read it can send the person a fake "approve
+ *     a credential — whoever can read it can send the person a fake "grant
  *     #3". So it lives in a key directory no role declares (`url_file`), or in
  *     the parent's environment, and never as a plain value in seisin.toml,
  *     which every role can read.
  */
 import { readFileSync } from "node:fs";
-import { basename, join } from "node:path";
-import { keyOf, pending, requestsPath, grantFor, shellId } from "./requests.js";
+import { basename, join, resolve, sep } from "node:path";
+import { keyOf, pending, requestsPath, grantFor, shellId, queueOf, withHandoffs } from "./requests.js";
+import { describeHandoff } from "./handoff.js";
+import { realAncestor } from "./paths.js";
 
-export const FORMATS = ["text", "json", "slack"];
-export const ENV_URL = "SEISIN_NOTIFY_URL";
+const FORMATS = ["text", "json", "slack"];
+const ENV_URL = "SEISIN_NOTIFY_URL";
 
 /** The URL to notify, or null. Read in the parent only. */
-export function notifyUrl(config, env = process.env) {
+function notifyUrl(config, env = process.env) {
   if (env[ENV_URL]) return env[ENV_URL].trim();
   if (!config.notify?.urlFile) return null;
   try {
@@ -41,19 +43,34 @@ export function notifyUrl(config, env = process.env) {
   }
 }
 
-/** The body for one request, in the chosen format. */
+/**
+ * The body for one request, in the chosen format.
+ *
+ * Whose it is and where it goes are the queue's decision (handoff.js), the
+ * same one `seisin requests` prints; a request handed in without one is
+ * decided here by the same function, never described from its stored owners.
+ */
 export function message(config, req, number, format = "text") {
-  const owner = req.owners?.length ? `It belongs to ${req.owners.join(", ")}.` : "Nobody owns it.";
+  const d = req.handoff ?? withHandoffs(config, [{ ...req, key: keyOf(req) }])[0].handoff;
+  const owners = d.owners ?? [];
+  const where = describeHandoff(d, req.attempt);
+  const owner = (owners.length ? `It belongs to ${owners.join(", ")}.` : "Nobody owns it.") +
+    (where ? ` ${where[0].toUpperCase()}${where.slice(1)}.` : "");
   const text =
-    `seisin (${basename(config.root)}): ${req.role} was refused ${req.action} on ${req.target}. ${owner} ` +
-    `Approve: seisin grant ${shellId(keyOf(req))} · decline: seisin decline ${shellId(keyOf(req))}`;
-  if (format === "slack") return { type: "application/json", body: JSON.stringify({ text }) };
+    `seisin (${basename(config.root)}): ${req.role} was denied ${req.action} on ${req.target}. ${owner} ` +
+    `Grant: seisin grant ${shellId(keyOf(req))} · decline: seisin decline ${shellId(keyOf(req))}`;
+  // Slack reads `<url|label>` as a link and `<!channel>` as a mention, and the
+  // path is chosen by the agent: `<https://evil|approve here>` in a target
+  // would arrive as a clickable link in the channel a person approves from.
+  // Its own escaping, and only these three characters, is what it asks for.
+  if (format === "slack")
+    return { type: "application/json", body: JSON.stringify({ text: text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;") }) };
   if (format === "json")
     return {
       type: "application/json",
       body: JSON.stringify({
         text, repo: basename(config.root), number, id: keyOf(req), role: req.role, action: req.action,
-        target: req.target, owners: req.owners ?? [], grant: grantFor(req),
+        target: req.target, owners, grant: grantFor(req), handoff: d,
       }),
     };
   return { type: "text/plain; charset=utf-8", body: text };
@@ -81,10 +98,10 @@ export function notifier(config, { env = process.env, fetchImpl = globalThis.fet
     const key = keyOf(req);
     if (known.has(key)) return false;
     known.add(key);
-    const queue = pending(file);
+    const queue = queueOf(config);
     const number = queue.findIndex((p) => p.key === key) + 1;
     if (number < 1) return false;
-    const { type, body } = message(config, { ...req, owners: req.owners ?? queue[number - 1].owners }, number, format);
+    const { type, body } = message(config, queue[number - 1], number, format);
     inflight.push(
       fetchImpl(url, {
         method: "POST",
@@ -95,20 +112,37 @@ export function notifier(config, { env = process.env, fetchImpl = globalThis.fet
         signal: AbortSignal.timeout(timeoutMs),
       })
         .then((r) => { if (!r.ok) failures.push(`HTTP ${r.status}`); })
-        .catch((e) => failures.push(e.name === "TimeoutError" ? "timed out" : e.message)),
+        // Native fetch errors can embed the whole URL, including a webhook
+        // credential. Only report known categories, never the raw message.
+        .catch((e) => failures.push(notificationFailure(e))),
     );
     return true;
   }
 
   async function settle(capMs = timeoutMs + 500) {
     if (!inflight.length) return failures;
-    await Promise.race([Promise.allSettled(inflight), new Promise((ok) => setTimeout(ok, capMs))]);
+    let timer;
+    try {
+      await Promise.race([Promise.allSettled(inflight), new Promise((ok) => { timer = setTimeout(ok, capMs); })]);
+    } finally {
+      clearTimeout(timer);
+    }
     return failures;
   }
 
   return { enabled: !!url, maybe, settle };
 }
 
+function notificationFailure(error) {
+  if (error?.name === "TimeoutError") return "timed out";
+  if (error?.name === "AbortError") return "aborted";
+  const code = error?.cause?.code ?? error?.code;
+  if (code === "ERR_INVALID_URL") return "invalid URL";
+  if (code === "ENOTFOUND") return "host not found";
+  if (code === "ECONNREFUSED") return "connection unavailable";
+  return "request failed";
+}
+
 /**
  * `[notify]` from seisin.toml, refused rather than guessed when it would leak.
  * Called by the config loader.
@@ -127,20 +161,32 @@ export function readNotify(table, { path, root, keyDirs, roles, own }) {
   if (urlFile === undefined) return { urlFile: null, format };
   if (typeof urlFile !== "string" || !urlFile.trim() || urlFile.startsWith("/") || urlFile.split("/").includes(".."))
     throw new Error(`${path}: [notify] url_file must be a path inside the repo`);
-  const inKeyDir = keyDirs.some((d) => urlFile.startsWith(d.replace(/\/+$/, "") + "/"));
+  const canonical = (p) => realAncestor(resolve(root, p));
+  const file = canonical(urlFile);
+  const inKeyDir = keyDirs.some((d) => file.startsWith(canonical(d) + sep));
   if (!inKeyDir)
     throw new Error(
       `${path}: [notify] url_file "${urlFile}" is not inside a key directory, so every role can read ` +
       `it. Move it under ${keyDirs[0] ?? "a [keys] dir"}.`);
   // A file key is written bare (`netlify.txt`, meaning the first key directory)
   // or with its directory (`shared/api.txt`) — the same resolution settingsFor uses.
-  const resolve = (raw) => (raw.includes("/") ? raw : join(keyDirs[0] ?? "", raw));
+  const fileKey = (raw) => canonical(raw.includes("/") ? raw : join(keyDirs[0] ?? "", raw));
   const holders = Object.entries(roles)
-    .filter(([, r]) => r.keyEntries?.some((k) => k.kind === "file" && resolve(k.raw) === urlFile))
+    .filter(([, r]) => r.keyEntries?.some((k) => {
+      if (k.kind === "file") {
+        const held = fileKey(k.raw);
+        return file === held || file.startsWith(held + sep);
+      }
+      if (k.kind !== "ref" || k.scheme !== "file") return false;
+      // Match the builtin resolver's last-fragment rule. A reference delivers
+      // the contents even though it opens no filesystem read for the role.
+      const hash = k.ref.lastIndexOf("#");
+      return canonical(hash === -1 ? k.ref : k.ref.slice(0, hash)) === file;
+    }))
     .map(([n]) => n);
   if (holders.length)
     throw new Error(
       `${path}: [notify] url_file "${urlFile}" is declared as a key by ${holders.join(", ")} — ` +
-      `that role could read it and send the person a fake "approve". No role may hold it.`);
+      `that role could read it and send the person a fake "grant this". No role may hold it.`);
   return { urlFile, format };
 }