seisin 0.4.2 → 0.6.0

package/src/review.js

@@ -9,13 +9,13 @@
  *
  * Three questions, and the second is the one nothing else can answer.
  *
- *   1. What is a role being stopped by, over and over?
+ *   1. What is a role being denied, over and over?
  *      Forty denials on one directory is not an agent misbehaving. It is a
  *      policy that is wrong, and today it reads as forty tidy amber lines
  *      nobody adds up.
  *
  *   2. What was granted and never used?
- *      Every permission file only ever grows, everywhere, and the reason is
+ *      Every allowlist only ever grows, everywhere, and the reason is
  *      always the same: nobody can prove a line is dead, so the safe move is to
  *      leave it. Here the log can prove it. This is the only direction that
  *      makes a policy smaller.
@@ -29,6 +29,7 @@
  */
 import { read, logPath } from "./log.js";
 import { covers, standingOf } from "./owners.js";
+import { kindsOf, expectedOf } from "./kinds.js";
 
 /**
  * One reading of the log against the policy.
@@ -37,16 +38,18 @@ import { covers, standingOf } from "./owners.js";
  * is low on purpose: the cost of mentioning it is a line, and the cost of
  * missing it is a role that quietly cannot do its job.
  */
-export function review(config, { minDenials = 3 } = {}) {
-  const entries = read(logPath(config.root), { limit: 0 });
+export function review(config, { minDenials = 3, since = null } = {}) {
+  // `since`: an ISO time (views.js parseSince). Without it the whole log, and
+  // on a log months long "denied repeatedly" is led by paths fixed long ago.
+  const entries = read(logPath(config.root), { limit: 0, ...(since && { since }) });
 
   if (entries.length === 0)
-    return { window: null, entries: 0, friction: [], guarded: [], unused: [], unusedKnowable: false, unowned: [] };
+    return { window: null, ...(since && { since }), entries: 0, friction: [], expected: [], guarded: [], unused: [], unusedKnowable: false, unowned: [] };
 
   const at = entries.map((e) => e.at).filter(Boolean).sort();
   const window = { from: at[0], to: at[at.length - 1], entries: entries.length };
 
-  return { window, entries: entries.length, ...findings(config, entries, minDenials) };
+  return { window, ...(since && { since }), entries: entries.length, ...findings(config, entries, minDenials) };
 }
 
 function findings(config, entries, minDenials) {
@@ -73,15 +76,19 @@ function findings(config, entries, minDenials) {
   const stopped = new Map();                 // role + directory -> how often
   for (const e of entries) {
     if (e.verdict !== "denied" || !e.target) continue;
-    const dir = e.action === "read" || e.action === "connect" ? e.target : dirOf(e.target);
-    const key = `${e.role} ${e.action} ${dir}`;
+    // The caller's own probe (`seisin run --expect-denied`): denied on purpose.
+    if (e.expected === true) continue;
+    const dir = e.action === "read" || e.action === "connect" || e.kind === "system" ? e.target : dirOf(e.target);
+    const expected = expectedOf(e.target);
+    const key = `${e.role} ${e.action} ${dir}${expected ? " expected" : ""}`;
     const seen = stopped.get(key) ?? {
       role: e.role, action: e.action, where: dir, times: 0,
       owners: e.owners ?? [],
+      ...(expected && { expected }),
       // Carried by the log from both writers — the hook sets it from the config
       // and so does the parent for a kernel denial. Recomputing it from the path
       // here would be a second opinion on a settled question.
-      kind: e.kind === "key" || e.kind === "network" ? e.kind : "file",
+      kind: e.kind === "key" || e.kind === "network" || e.kind === "system" ? e.kind : "file",
     };
     seen.times++;
     stopped.set(key, seen);
@@ -91,7 +98,12 @@ function findings(config, entries, minDenials) {
     .filter((f) => f.times >= minDenials)
     .sort((a, b) => b.times - a.times);
 
-  const friction = repeated.filter((f) => f.kind !== "key" && f.kind !== "network");
+  // Expected (kinds.js expectedOf): Claude Code's plugin updater, refused
+  // correctly. Repeated on every start, and not a policy that is wrong — so it
+  // is said apart and never counts as friction, which is what exits 1.
+  const expected = repeated.filter((f) => f.expected);
+  // A system service is once per run (intake.js) and never grantable: not friction.
+  const friction = repeated.filter((f) => !f.expected && f.kind !== "key" && f.kind !== "network" && f.kind !== "system");
   const guarded = repeated.filter((f) => f.kind === "key");
   // Ports and sockets: repeated, and not a thing `grant` can answer.
   const connects = repeated.filter((f) => f.kind === "network");
@@ -103,11 +115,11 @@ function findings(config, entries, minDenials) {
    * that refusal is the whole of the second finding.
    *
    * "Never used" is read off `allowed` lines, and **only the hook writes those**.
-   * The kernel reports what it refused; it has nothing to say about what went
+   * The kernel reports what it denied; it has nothing to say about what went
    * through. So a log with no hook behind it holds denials and nothing else,
    * every grant falls through as unused, and this section reports that the whole
    * policy is dead — under a heading calling itself the only evidence anyone
-   * will ever have for making a permission file smaller.
+   * will ever have for making a policy smaller.
    *
    * Measured on a real repository with the hook not installed: every write
    * permission of every role listed as never used, while those roles were
@@ -128,15 +140,21 @@ function findings(config, entries, minDenials) {
   const knowable = entries.some((e) => e.verdict === "allowed" && !e.disputed);
 
   // Only writes. A key that is declared and not read is ordinary — most roles
-  // hold a credential for the one turn a month that needs it — but a folder a
+  // hold a credential for the one run a month that needs it — but a folder a
   // role owns and has never written to in the whole log is a line nobody would
   // miss, and the only evidence anyone will ever have for removing it.
+  // Straight to the line's own role, and each (role, target) once: walking
+  // every role's globs for every line to keep only one role's was the cost.
   const used = new Set();
+  const seen = new Set();
   for (const e of entries) {
     if (e.verdict !== "allowed" || e.disputed || e.action !== "write" || !e.target) continue;
-    for (const role of Object.values(config.roles))
-      for (const glob of role.writes)
-        if (role.name === e.role && covers(glob, e.target)) used.add(`${role.name} ${glob}`);
+    if (!Object.prototype.hasOwnProperty.call(config.roles, e.role)) continue;
+    const k = `${e.role}\u0000${e.target}`;
+    if (seen.has(k)) continue;
+    seen.add(k);
+    for (const glob of config.roles[e.role].writes)
+      if (covers(glob, e.target)) used.add(`${e.role} ${glob}`);
   }
 
   const unused = [];
@@ -153,24 +171,31 @@ function findings(config, entries, minDenials) {
   // the repository is outside every territory: none of them is a hole in the
   // map. This used to skip keys and ports and count the rest, protected ones
   // included, while the console counted all four — one word, two numbers.
-  const unowned = new Map();
+  //
+  // Each row also says what kind of thing it is (kinds.js), by directory and
+  // kind together: `.git` holding a lock and a folder holding a source file
+  // are different answers, and only `territory` is a hole somebody has to fill.
   const standOf = standingOf(config);
-  for (const e of entries) {
-    if (!e.target) continue;
-    if (standOf(e).kind !== "unowned") continue;
-    const dir = dirOf(e.target);
-    unowned.set(dir, (unowned.get(dir) ?? 0) + 1);
+  const loose = entries.filter((e) => e.target && standOf(e).kind === "unowned");
+  const natures = kindsOf(loose.map((e) => e.target), { keyDirs: config.keyDirs ?? [] });
+  const unowned = new Map();
+  for (const e of loose) {
+    const { kind, hint } = natures.get(e.target);
+    const where = dirOf(e.target);
+    const k = `${kind}\u0000${where}`;
+    const row = unowned.get(k) ?? { where, times: 0, kind, hint };
+    row.times++;
+    unowned.set(k, row);
   }
 
   return {
     friction,
+    expected,
     guarded,
     connects,
     unused,
     unusedKnowable: knowable,
-    unowned: [...unowned.entries()]
-      .map(([where, times]) => ({ where, times }))
-      .sort((a, b) => b.times - a.times),
+    unowned: [...unowned.values()].sort((a, b) => b.times - a.times),
   };
 }
 

package/src/rundir.js

@@ -1,15 +1,15 @@
 /**
  * One private directory per run, for everything that belongs to that run only:
- * the audit socket, the sandbox settings, and `scratch` keys.
+ * the audit socket, the sandbox settings, and `run-file` keys.
  *
  * ── Why ──
  * These lived in two places and both leaked. The settings were written to
  * `.seisin/<role>.json`, one file per ROLE, so two runs of the same role — an
  * orchestrator does that all day — wrote the same file with different socket
- * paths, and one could start with the other's. The socket and the scratch keys
+ * paths, and one could start with the other's. The socket and the run-file keys
  * lived in `$TMPDIR/seisin-XXXX/`, private by mode, but every role runs as the
  * same user and every role can read the temp dir: measured on 2026-09-23, one
- * role read another's `scratch` key while it ran (`cat …/keys/S` → the value).
+ * role read another's `run-file` key while it ran (`cat …/keys/S` → the value).
  *
  * ── How ──
  * All runs live under one root, `$TMPDIR/snr/`, and each role's profile denies
@@ -25,8 +25,17 @@ import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { realOrSelf } from "./grants.js";
 import { channelName } from "./spool.js";
+import { alive } from "./log.js";
 
 export const RUNS_NAME = "snr";
+/**
+ * Where a run's temp directory lives when the role may write no other: beside
+ * the runs root, not inside it. The runs root is denied to writes as a whole
+ * (srt.js), and a deny wins over any grant beneath it.
+ */
+export const TMP_NAME = "snt";
+/** The settings file inside a run's directory. srt.js denies it to the run by this name. */
+export const SETTINGS_NAME = "settings.json";
 
 /**
  * The root every run lives under, created private, and checked.
@@ -35,8 +44,8 @@ export const RUNS_NAME = "snr";
  * dir sits behind /var → /private/var. Refused rather than used when it is not
  * a directory of this user's with nobody else's bits on it: it holds keys.
  */
-export function runsRoot(base = tmpdir()) {
-  const root = join(realOrSelf(base), RUNS_NAME);
+export function runsRoot(base = tmpdir(), name = RUNS_NAME) {
+  const root = join(realOrSelf(base), name);
   try { mkdirSync(root, { mode: 0o700 }); } catch (e) { if (e.code !== "EEXIST") throw e; }
   const st = lstatSync(root);
   const mine = typeof process.getuid !== "function" || st.uid === process.getuid();
@@ -48,16 +57,11 @@ export function runsRoot(base = tmpdir()) {
   return root;
 }
 
-/** Is the process that owns a run directory still alive? */
-function alive(pid) {
-  try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
-}
-
 /**
  * Removes the directories of runs whose process is gone.
  *
  * A run cleans up after itself on exit. A run that is killed does not, and
- * its directory keeps its `scratch` keys on disk indefinitely — measured by
+ * its directory keeps its `run-file` keys on disk indefinitely — measured by
  * SIGKILL on a keyed run. Swept at the start of the next one; a directory
  * without a pid file is younger than the write that creates it, and is left.
  */
@@ -66,7 +70,12 @@ function sweep(root) {
     const dir = join(root, name);
     let pid;
     try { pid = Number(readFileSync(join(dir, "pid"), "utf8")); } catch { continue; }
-    if (pid && !alive(pid)) rmSync(dir, { recursive: true, force: true });
+    // Only a process the kernel says is gone: a directory kept one sweep too
+    // long costs disk, one removed early takes a live run's socket and keys.
+    if (pid && !alive(pid)) {
+      rmSync(dir, { recursive: true, force: true });
+      rmSync(join(dirname(root), TMP_NAME, name), { recursive: true, force: true });
+    }
   }
 }
 
@@ -87,20 +96,30 @@ export function openRun({ base = tmpdir(), id = randomUUID() } = {}) {
     dir,
     root,
     // A socket on macOS, a FIFO on Linux, where the runtime blocks every unix
-    // socket inside the box (spool.js).
+    // socket inside the sandbox (spool.js).
     sock: join(dir, channelName()),
     keys: join(dir, "keys"),
+    /**
+     * This run's own temp directory, made on first call: only a run whose role
+     * may write no temp directory of its own needs one (commands/run.js).
+     */
+    tmp() {
+      const at = join(runsRoot(base, TMP_NAME), basename(dir));
+      mkdirSync(at, { recursive: true, mode: 0o700 });
+      return at;
+    },
     /**
      * `wx`: created by this call or not at all. A settings file that already
      * exists is not this run's, and the runtime would read whatever it says.
      */
     writeSettings(settings) {
-      const file = join(dir, "settings.json");
+      const file = join(dir, SETTINGS_NAME);
       writeFileSync(file, JSON.stringify(settings, null, 2) + "\n", { flag: "wx", mode: 0o600 });
       return file;
     },
     close() {
       try { rmSync(dir, { recursive: true, force: true }); } catch {}
+      try { rmSync(join(dirname(root), TMP_NAME, basename(dir)), { recursive: true, force: true }); } catch {}
     },
   };
 }

package/src/sandboxes/command.js

@@ -0,0 +1,93 @@
+/**
+ * A sandbox declared in seisin.toml: a command with a placeholder.
+ *
+ *   [sandbox.providers.mybox]
+ *   command = ["mybox", "run", "--policy", "{policy}", "--"]
+ *
+ * The same shape as a key provider (keys.js), for the same reason: adding a
+ * sandbox is three lines of TOML and no code. seisin replaces `{policy}` with
+ * the path of the run's settings file and appends the command to run. The
+ * contract the provider takes on is in docs/sandboxes.md; the short form:
+ *
+ *   - the file is the settings seisin generates, in sandbox-runtime's schema;
+ *   - the provider enforces every field of it, or exits non-zero before
+ *     running anything — it never runs the command with less;
+ *   - it passes the command's exit status through.
+ *
+ * seisin cannot see inside a provider, so it asks: with a `check` command
+ *
+ *   check = ["mybox", "check", "--policy", "{policy}"]
+ *
+ * the provider says before anything runs whether it can hold a policy (exit 0)
+ * or not (anything else, the last line it prints saying why), and one that
+ * cannot is passed over like a built-in one. Without `check` there is nothing
+ * to ask, and `unmet` has nothing to say.
+ *
+ * Neither answer is taken on faith: every run starts with the canary
+ * (canary.js) under the same provider and the same file, and the agent starts
+ * only if the boundary held. A provider that ignores the file fails there.
+ */
+import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { join, delimiter, isAbsolute, basename } from "node:path";
+
+export const POLICY_PLACEHOLDER = "{policy}";
+
+function onPath(name, path = process.env.PATH) {
+  if (name.includes("/")) return isAbsolute(name) && existsSync(name) ? name : null;
+  for (const dir of (path ?? "").split(delimiter)) if (dir && existsSync(join(dir, name))) return join(dir, name);
+  return null;
+}
+
+/** Long enough for a sandbox to read a file and say no; short enough that a hung one is found out. */
+const CHECK_TIMEOUT_MS = 15000;
+
+const withPolicy = (args, file) => args.map((a) => a.split(POLICY_PLACEHOLDER).join(file));
+
+/**
+ * Runs a sandbox's own pre-check on the settings file.
+ *
+ * `unmet` is `[]` when it answered yes; otherwise one sentence, its own reason
+ * when it gave one. A check that cannot answer (not found, killed, timed out)
+ * is a no: an answer that never came is not a pass. `warnings` are the lines
+ * it printed that start with `warning:`, yes or no — what it holds, but not the
+ * way the role might expect (tartaros on Linux, a repo root it cannot let the
+ * role create entries in) — for `seisin check` to show.
+ */
+export function assessCheck(argv, file, label) {
+  const r = spawnSync(argv[0], withPolicy(argv.slice(1), file), { encoding: "utf8", timeout: CHECK_TIMEOUT_MS, stdio: ["ignore", "pipe", "pipe"] });
+  // Its own name off the front: "mybox: no domains" reads twice after "mybox says".
+  // stdout before stderr, so a report on stdout does not bury a refusal on stderr.
+  const self = `${basename(argv[0])}:`;
+  const said = `${r.stdout ?? ""}\n${r.stderr ?? ""}`.split("\n").map((l) => l.trim()).filter(Boolean)
+    .map((l) => (l.startsWith(self) ? l.slice(self.length).trim() : l));
+  const warnings = said.filter((l) => /^warning:/i.test(l)).map((l) => l.replace(/^warning:\s*/i, ""));
+  if (r.status === 0) return { unmet: [], warnings };
+  // The last line: what comes before it can be warnings about what it did hold
+  // (tartaros says which patterns its own set covers), and the no comes last.
+  const why = r.error?.code === "ETIMEDOUT" ? `it did not answer in ${CHECK_TIMEOUT_MS / 1000} s`
+    : r.error ? r.error.message
+    : said.length ? said.at(-1)
+    : r.signal ? `it was killed by ${r.signal}` : `it exited ${r.status} without saying why`;
+  return { unmet: [`${label} says it cannot hold this policy: ${why}`], warnings };
+}
+
+/** Only the answer: `[]` for yes, the reason for no. */
+export const askCheck = (argv, file, label) => assessCheck(argv, file, label).unmet;
+
+export function commandSandbox(name, command, check = null, { tagsDenials = false } = {}) {
+  const assess = (_settings, { file } = {}) => (check ? assessCheck(check, file, `its check (${check[0]})`) : { unmet: [], warnings: [] });
+  return {
+    name,
+    locate: () => onPath(command[0]),
+    missing: () => `${command[0]} (the command of [sandbox.providers.${name}]) was not found${command[0].includes("/") ? "" : " on PATH"}.`,
+    asksFile: Boolean(check),
+    assess,
+    unmet: (settings, ctx) => assess(settings, ctx).unmet,
+    wrap: (bin, file, _settings, inner) => [bin, ...withPolicy(command.slice(1), file), ...inner],
+    // Declared, not detected: `tags_denials = true` says its Seatbelt denials
+    // carry sandbox-runtime's tag (docs/sandboxes.md). Without it, on macOS,
+    // none of the kernel's refusals under it reach the log.
+    tagsDenials,
+  };
+}

package/src/sandboxes/index.js

@@ -0,0 +1,113 @@
+/**
+ * Which sandbox a role runs under.
+ *
+ * seisin decides the policy; a sandbox enforces it. There are three ways in:
+ *
+ *   - `srt` (built in, the default): @anthropic-ai/sandbox-runtime;
+ *   - `tartaros` (built in): reads the settings file itself (`--settings`);
+ *   - any name declared under `[sandbox.providers.<name>]`: a command that
+ *     takes the settings file (command.js, docs/sandboxes.md).
+ *
+ * `[sandbox] provider` names one, or several in order of preference:
+ *
+ *   [sandbox]
+ *   provider = ["tartaros", "srt"]
+ *
+ * The choice is a capability question, not a preference toggle
+ * (docs/decisions.md): each role gets the first one that is installed and
+ * enforces every part of that role's settings. One that would enforce less is
+ * passed over with the reason, and a role none of them can hold does not start.
+ * A single name means exactly that one, so a config that asks for tartaros
+ * never ends up somewhere else without having said so.
+ */
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { srt } from "./srt.js";
+import { machOf } from "../browsers.js";
+import { tartaros } from "./tartaros.js";
+import { commandSandbox } from "./command.js";
+
+export const BUILTIN_SANDBOXES = { srt, tartaros };
+export const DEFAULT_SANDBOX = "srt";
+
+/** The sandboxes the config names, in its order, as provider objects. */
+export function sandboxesOf(config) {
+  const names = config.sandbox?.provider ?? [DEFAULT_SANDBOX];
+  return names.map((n) => BUILTIN_SANDBOXES[n] ?? commandSandbox(n, config.sandbox.providers[n].command, config.sandbox.providers[n].check, { tagsDenials: config.sandbox.providers[n].tagsDenials }));
+}
+
+/**
+ * For each sandbox the config names, whether it could run these settings and
+ * why not. `chosen` is the first that can, or null.
+ *
+ * A sandbox that answers for itself (tartaros, a declared one with `check`) is
+ * asked about the file a run would hand it: `file` when the run has written
+ * one, otherwise a copy in a temp directory of its own, removed after. Only a
+ * sandbox that was found is asked; one that was not is passed over as missing.
+ */
+export function weigh(config, settings, { platform = process.platform, role = null, locate = true, file = null } = {}) {
+  const list = sandboxesOf(config);
+  const register = role ? machOf(config.roles?.[role]).register : [];
+  let scratch = null;
+  let copies = 0;
+  // The file a sandbox is asked about is the one it would be handed: the run's
+  // own when it takes the settings as they are, otherwise its own version of them.
+  const fileFor = (own) => {
+    if (file && own === settings) return file;
+    scratch ??= mkdtempSync(join(tmpdir(), "seisin-weigh-"));
+    const f = join(scratch, `settings-${copies++}.json`);
+    writeFileSync(f, JSON.stringify(own, null, 2), { mode: 0o600 });
+    return f;
+  };
+  try {
+    const options = list.map((sandbox) => {
+      const bin = locate ? sandbox.locate() : "(not looked up)";
+      const own = settingsOf(sandbox, settings, { machRegister: register });
+      const asked = sandbox.asksFile && locate && bin;
+      const ctx = { platform, role, bin, file: asked ? fileFor(own) : null };
+      const { unmet, warnings } = sandbox.asksFile && !asked ? { unmet: [], warnings: [] }
+        : sandbox.assess ? sandbox.assess(own, ctx) : { unmet: sandbox.unmet(own, ctx), warnings: [] };
+      // `browsers`: a Mach service to register. srt's schema has no field for it
+      // (srt-mach.mjs adds it); tartaros takes it as network.allowMachRegister
+      // (adapt). A sandbox that is given it neither way cannot hold the role.
+      const browser = register.length && !sandbox.machRegister
+        ? [`a Mach service to register (${register.join(", ")}, for browsers): ${sandbox.name} is not given it, only srt and tartaros are`]
+        : [];
+      return { sandbox, bin, unmet: [...unmet, ...browser], warnings, missing: bin ? null : sandbox.missing() };
+    });
+    const chosen = options.find((o) => o.bin && o.unmet.length === 0) ?? null;
+    return { chosen, options };
+  } finally {
+    if (scratch) rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+/**
+ * The settings as this sandbox is handed them: as generated, or with what it
+ * takes in its own field (tartaros: network.allowMachRegister). The same
+ * object when nothing changes, so a caller can tell.
+ */
+export function settingsOf(sandbox, settings, ctx) {
+  return sandbox.adapt ? sandbox.adapt(settings, ctx) : settings;
+}
+
+/** The sandbox and binary for one run, or an Error that says why each was passed over. */
+export function chooseSandbox(config, settings, { platform = process.platform, role = null, file = null } = {}) {
+  const { chosen, options } = weigh(config, settings, { platform, role, file });
+  if (chosen) return { sandbox: chosen.sandbox, bin: chosen.bin, options };
+  // The one sandbox there is, missing: said exactly as it always was.
+  if (options.length === 1 && options[0].missing && options[0].sandbox.name === DEFAULT_SANDBOX)
+    return { error: new Error(options[0].missing), options };
+  return { error: new Error(refusal(role, options)), options };
+}
+
+export function refusal(role, options) {
+  const lines = options.map((o) => o.missing
+    ? `  - ${o.sandbox.name}: ${o.missing}`
+    : `  - ${o.sandbox.name} cannot enforce all of it:\n${o.unmet.map((u) => `      ${u}`).join("\n")}`);
+  return `no sandbox in [sandbox] provider can hold ${role ? `role ${role}` : "this role"} as its policy is written, so it was not started:\n` +
+    `${lines.join("\n")}\n` +
+    `  A sandbox that enforces less than the policy is never used in its place. Add one that can (provider = [..., "srt"]), ` +
+    `or change the role.`;
+}

package/src/sandboxes/mach-profile.js

@@ -0,0 +1,31 @@
+/**
+ * The splice srt-mach.mjs makes into srt's profile, kept apart so it can be
+ * tested without loading into srt. See srt-mach.mjs for why it exists.
+ */
+import { MACH_PREFIX } from "../browsers.js";
+
+export const MACH_FILE = "mach.json";
+const ANCHOR = "/usr/bin/sandbox-exec -p '";
+
+export function fail(why) {
+  throw new Error(`seisin: cannot add the browser's Mach rule to the sandbox profile: ${why}`);
+}
+
+/** The profile with the rules appended, or an Error: exported so the splice is tested without srt. */
+export function withRules(line, register) {
+  for (const name of register) if (!MACH_PREFIX.test(name)) fail(`"${name}" is not a Mach name prefix`);
+  const at = line.indexOf(ANCHOR);
+  if (at === -1) fail("srt no longer runs sandbox-exec with an inline profile");
+  if (line.indexOf(ANCHOR, at + 1) !== -1) fail("the command holds more than one profile");
+  const start = at + ANCHOR.length;
+  // Single-quoted by srt's quote(), which writes a quote inside it as '"'"'
+  // (a comment in the profile says "doesn't"). The quote that ends it is the
+  // first one that does not open that sequence, and the shell's path follows.
+  let end = line.indexOf("'", start);
+  while (end !== -1 && line.startsWith(`'"'"'`, end)) end = line.indexOf("'", end + 5);
+  if (end === -1 || line[end + 1] !== " ") fail("the profile is not quoted the way it was");
+  if (!line.slice(start, end).startsWith("(version 1)")) fail("the profile does not start with (version 1)");
+  const rules = register.map((p) => `(allow mach-register (global-name-prefix "${p}"))`).join("\n");
+  return `${line.slice(0, end)}\n; seisin: browsers (src/browsers.js)\n${rules}\n${line.slice(end)}`;
+}
+

package/src/sandboxes/srt-mach.mjs

@@ -0,0 +1,43 @@
+/**
+ * Loaded into the `srt` process with `node --import`, for a role whose
+ * `browsers` need a Mach service registered (browsers.js).
+ *
+ * sandbox-runtime lets a policy name Mach services to look up
+ * (`allowMachLookup`) and has no field for registering one, which is what a
+ * Chromium browser process does first. So for those roles, and only those,
+ * this adds the one rule the profile cannot otherwise carry:
+ *
+ *   (allow mach-register (global-name-prefix "org.chromium.Chromium.MachPortRendezvousServer."))
+ *
+ * It wraps `SandboxManager.wrapWithSandbox` — the module instance srt's own CLI
+ * uses, loaded from beside it — and appends the rule to the profile that call
+ * returns, before srt runs it. Nothing else in the profile is touched, and
+ * every run still starts with the canary under the result.
+ *
+ * Fails closed. The names come from `mach.json` in the run's directory, which
+ * seisin writes; each is checked against the shape a prefix may have before
+ * it goes into the profile. And the profile must be where and what it was
+ * when this was written — `/usr/bin/sandbox-exec -p '(version 1)…'`, once. If
+ * a later srt builds its command another way, this throws, srt does not run
+ * the command, and the canary reports a sandbox that did not start (exit 86).
+ * A role that asked for a browser gets no browser; it never gets less sandbox.
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { MACH_FILE, withRules, fail } from "./mach-profile.js";
+
+const at = process.argv.indexOf("--settings");
+const settings = at === -1 ? null : process.argv[at + 1];
+if (!settings) fail("srt was not given --settings");
+const { register } = JSON.parse(readFileSync(join(dirname(settings), MACH_FILE), "utf8"));
+if (!Array.isArray(register) || register.length === 0) fail(`${MACH_FILE} names nothing to register`);
+
+// The same file srt's CLI imports as "./index.js", so the same module instance.
+const cli = realpathSync(process.argv[1]);
+const { SandboxManager } = await import(pathToFileURL(join(dirname(cli), "index.js")).href);
+if (typeof SandboxManager?.wrapWithSandbox !== "function") fail("srt has no SandboxManager.wrapWithSandbox");
+const wrap = SandboxManager.wrapWithSandbox;
+SandboxManager.wrapWithSandbox = async function (...args) {
+  return withRules(await wrap.apply(this, args), register);
+};