seisin 0.4.2 → 0.6.0

package/src/sandboxes/srt.js

@@ -0,0 +1,163 @@
+/**
+ * `srt`: @anthropic-ai/sandbox-runtime, the sandbox seisin was built on.
+ *
+ * The default, and the reference every other provider is measured against:
+ * the settings seisin generates (srt.js, one level up) ARE this runtime's
+ * settings file, so it enforces all of them by construction and `unmet` is
+ * always empty. What a run hands it is the file and the command, nothing else.
+ */
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { join, dirname, delimiter } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * The runtime seisin depends on first, one on PATH second, and nothing third.
+ *
+ * "The one seisin depends on" is found the way Node finds a dependency — up
+ * from this file, through every `node_modules` — not at one spelled-out path.
+ * `<seisin>/node_modules/.bin/srt` is only where it lands in a checkout. In a
+ * project that installs seisin as a dependency, npm hoists the runtime to the
+ * project's own `node_modules`, and that path does not exist. Measured with
+ * 0.5.0 packed and installed into a project: `npx seisin` still worked, because
+ * npx puts the project's `.bin` on PATH; `./node_modules/.bin/seisin` and
+ * `node node_modules/seisin/src/cli.js` did not — they said "not found", or,
+ * with a global srt 0.0.75 installed, ran under THAT one instead of the 0.0.78
+ * this version pins, with none of its fixes.
+ *
+ * There is deliberately no fallback to running unsandboxed. A permission tool
+ * that quietly becomes a no-op when its enforcer is missing is worse than one
+ * that refuses, because you keep trusting it.
+ */
+export function resolveSrt({ from = HERE, path = process.env.PATH } = {}) {
+  const local = dependencySrt(from);
+  if (local) return local;
+
+  // Walk PATH rather than asking a shell. `spawnSync(..., { shell: true })`
+  // prints a deprecation warning on every single run — Node's DEP0190 — which
+  // is a line of noise in front of every user for the sake of finding one file.
+  // It is also the concatenation hazard the warning is about.
+  for (const dir of (path ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const candidate = join(dir, "srt");
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+const RUNTIME = "@anthropic-ai/sandbox-runtime";
+
+/**
+ * The `srt` of the sandbox-runtime that resolves from `from`, or null.
+ *
+ * The `.bin/srt` npm linked beside the package when there is one — that is the
+ * file npm made executable — and otherwise the package's own `bin` entry.
+ * The package's `package.json` is found by walking up rather than through
+ * `require.resolve`, which a package's `exports` map is free to refuse.
+ */
+export function dependencySrt(from = HERE) {
+  let dir = from;
+  for (;;) {
+    const nm = join(dir, "node_modules");
+    const pkg = join(nm, RUNTIME, "package.json");
+    if (existsSync(pkg)) {
+      const linked = join(nm, ".bin", "srt");
+      if (existsSync(linked)) return linked;
+      try {
+        const bin = JSON.parse(readFileSync(pkg, "utf8")).bin;
+        const rel = typeof bin === "string" ? bin : bin?.srt;
+        if (rel) {
+          const target = join(nm, RUNTIME, rel);
+          if (existsSync(target)) return target;
+        }
+      } catch { /* an unreadable package.json is not a runtime */ }
+    }
+    const up = dirname(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
+
+/**
+ * The directory of the runtime's own `apply-seccomp`, or null.
+ *
+ * On Linux the runtime runs that binary INSIDE the sandbox, from wherever the
+ * package is installed, before the command. With `read = "territory"` a home
+ * directory is shut, and seisin installed under it — nvm, a user npm prefix,
+ * a CI checkout in /home/runner — left the binary unmountable: every run died
+ * with `apply-seccomp: No such file or directory` before the canary (measured
+ * on ubuntu-latest and in Debian with the checkout in /root, srt 0.0.81).
+ * Found from the srt that runs (its real path, up to the package), so a
+ * global srt keeps its own.
+ */
+export function seccompDir(bin = resolveSrt()) {
+  if (!bin) return null;
+  let dir;
+  try { dir = dirname(realpathSync(bin)); } catch { return null; }
+  for (;;) {
+    const pkg = join(dir, "package.json");
+    if (existsSync(pkg)) {
+      try {
+        if (JSON.parse(readFileSync(pkg, "utf8")).name === RUNTIME) {
+          const vendor = join(dir, "vendor", "seccomp");
+          return existsSync(vendor) ? vendor : null;
+        }
+      } catch { /* not the runtime's */ }
+    }
+    const up = dirname(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
+
+/**
+ * How to put the runtime back, for the way this seisin was installed.
+ *
+ * It is a dependency, so it is missing only from a broken install — and the
+ * fix differs: a project's own node_modules, a global install, or a checkout.
+ * `npm i -g` was suggested to everyone, which for a project-local seisin
+ * installs a second runtime somewhere seisin does not look first.
+ */
+export function installHint(from = HERE) {
+  const at = from.split("/node_modules/seisin/")[0];
+  if (at === from) return `Install it in this checkout with: npm install (in ${dirname(dirname(from))})`;
+  // npm's global layout is <prefix>/lib/node_modules on unix, …/npm/node_modules on Windows.
+  if (/\/lib$/.test(at) || /[\\/]npm$/.test(at))
+    return "seisin is installed globally; reinstall it with: npm install -g seisin";
+  return `seisin is installed in ${at}; reinstall it there with: npm install seisin`;
+}
+
+const MACH_PRELOAD = join(HERE, "srt-mach.mjs");
+
+/**
+ * srt with srt-mach.mjs loaded into it, for a role whose browsers register a
+ * Mach service. Run by this node, so the preload is in the process: the runtime
+ * is a node script, and one that is not (a binary on PATH) cannot take it —
+ * refused here rather than run without the rule the role asked for, which
+ * would start the browser just to watch it die.
+ */
+export function withMachPreload(bin, file, inner) {
+  const cli = realpathSync(bin);
+  if (!/\.(c|m)?js$/.test(cli))
+    throw new Error(`the sandbox runtime at ${bin} is not a node script, so the browser's Mach rule cannot be added to it ` +
+      `(browsers in seisin.toml). Use the runtime seisin installs with it.`);
+  return [process.execPath, "--import", MACH_PRELOAD, cli, "--settings", file, "--", ...inner];
+}
+
+export const srt = {
+  name: "srt",
+  locate: () => resolveSrt(),
+  missing: () => `sandbox runtime not found. ${installHint()}`,
+  unmet: () => [],
+  // `--` before the command, and it is not cosmetic. Without it the runtime's
+  // own argument parser reaches into what the agent was invoked with and eats
+  // anything resembling one of its flags: `claude --settings`, `claude -c`.
+  wrap: (bin, file, _settings, inner, { machRegister = [] } = {}) =>
+    machRegister.length ? withMachPreload(bin, file, inner) : [bin, "--settings", file, "--", ...inner],
+  // Takes the `browsers` Mach rule, through srt-mach.mjs.
+  machRegister: true,
+  // Each Seatbelt denial carries this runtime's tag with the wrapped command,
+  // which is how violations.js tells this run's denials from another's.
+  tagsDenials: true,
+};

package/src/sandboxes/tartaros.js

@@ -0,0 +1,80 @@
+/**
+ * `tartaros`: the Seatbelt / Landlock sandbox, driven by its own CLI.
+ *
+ * tartaros reads seisin's settings file itself (`--settings`, the schema of
+ * sandbox-runtime) and holds itself to the contract in docs/sandboxes.md:
+ * every field enforced, or it refuses to start. So seisin does not translate
+ * anything and does not keep its own list of what tartaros can do — a list
+ * like that is out of date the day tartaros learns something. It asks:
+ *
+ *   tartaros explain --settings <file>
+ *
+ * reads the same file through the same code as `run` and exits 78, with the
+ * reason, on a field it cannot guarantee (2 before 0.1.0-alpha.6, which keeps
+ * 2 for a bad command line). seisin takes any exit but 0 as that no, so the
+ * code is not read. That answer is what `unmet` returns,
+ * so a role tartaros cannot hold is passed over before it starts (or `seisin
+ * check` says so), and the canary still checks every run that it can.
+ */
+import { existsSync } from "node:fs";
+import { join, delimiter } from "node:path";
+import { assessCheck } from "./command.js";
+
+/** `tartaros` on PATH, or null. */
+export function resolveTartaros(path = process.env.PATH) {
+  for (const dir of (path ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const candidate = join(dir, "tartaros");
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+/** The command line for one run: the settings as they are, the role as a label. */
+export function tartarosArgv(bin, file, inner, { role = null, machRegister = [] } = {}) {
+  // A browser role gets tartaros's browser grants — the shared memory, IOKit
+  // classes and sysctls a headless Chromium dies without (f7edae1) — and a
+  // run-private TMPDIR, the only place it may open a unix socket (bcb0c69):
+  // where @playwright/mcp publishes its browser.
+  const browser = machRegister.length ? ["--browser", "--private-tmp"] : [];
+  // --inherit-env: the environment seisin hands tartaros is already the one
+  // the role gets — built from the role's own list (env.js), with the hook's
+  // socket, the role's name and its env-mode keys. tartaros's own scrub
+  // (7f9925f) would drop those, and the hook would go silent.
+  return [bin, "run", ...(role ? ["--role", role] : []), "--inherit-env", ...browser, "--settings", file, "--", ...inner];
+}
+
+/** What tartaros says of this file: what it cannot hold, and its warnings. Only asked of a binary that was found. */
+export function tartarosAssess(bin, file, { platform = process.platform } = {}) {
+  if (platform !== "darwin" && platform !== "linux") return { unmet: [`tartaros runs on macOS and Linux, not ${platform}`], warnings: [] };
+  return assessCheck([bin, "explain", "--settings", "{policy}"], file, "tartaros");
+}
+
+export const tartarosUnmet = (bin, file, ctx) => tartarosAssess(bin, file, ctx).unmet;
+
+/**
+ * `browsers`: tartaros takes the Mach names to register in its settings, as
+ * network.allowMachRegister with sandbox-runtime's trailing `*` for a prefix
+ * (tartaros 99b0117). Only when there is one: an unchanged role is handed the
+ * same file as before, and srt, whose schema is strict, never sees the field.
+ */
+export function tartarosSettings(settings, { machRegister = [] } = {}) {
+  if (!machRegister.length) return settings;
+  return { ...settings, network: { ...settings.network, allowMachRegister: machRegister.map((p) => `${p}*`) } };
+}
+
+export const tartaros = {
+  name: "tartaros",
+  locate: () => resolveTartaros(),
+  missing: () => "tartaros not found on PATH. Build it (cargo build --release -p tartaros-cli) and put its target directory on PATH.",
+  asksFile: true,
+  adapt: tartarosSettings,
+  machRegister: true,
+  assess: (_settings, { bin, file, platform } = {}) => tartarosAssess(bin, file, { platform }),
+  unmet: (_settings, { bin, file, platform } = {}) => tartarosUnmet(bin, file, { platform }),
+  wrap: (bin, file, _settings, inner, ctx) => tartarosArgv(bin, file, inner, ctx),
+  // Every deny in its Seatbelt profile carries sandbox-runtime's tag
+  // (`CMD64_<command>_END_<suffix>_SBX`), so violations.js attributes them
+  // exactly as it does srt's. Measured 2026-10-13 with tartaros ad85515.
+  tagsDenials: true,
+};

package/src/scan.js

@@ -17,9 +17,10 @@
  * than no scanner: it converts a real risk into a wall of noise someone learns
  * to skip. Three things were wrong and all three are handled below.
  */
-import { readdirSync, readFileSync, statSync, realpathSync } from "node:fs";
-import { join, relative, sep } from "node:path";
+import { readdirSync, readFileSync, statSync, realpathSync, existsSync } from "node:fs";
+import { join, resolve, relative, sep, dirname } from "node:path";
 import { covers } from "./owners.js";
+import { toWritePath } from "./grants.js";
 
 /**
  * A match is `certain` when the shape alone is enough — these strings are
@@ -65,6 +66,29 @@ const PLACEHOLDER = /^(?:changeme|change_me|xxx+|your[-_a-z]*|example|placeholde
  * finding repeated five times, and three keys belonging to a company that is
  * not the one running the scan.
  */
+/**
+ * A password inside a URL — `postgres://app:hunter2@db/prod`.
+ *
+ * The commonest way a database credential sits in a repo, and no issued shape
+ * covers it: `.env` with a DATABASE_URL scanned clean. Certain, because a URL
+ * with a password in it is a credential whatever the password is, unless the
+ * password is plainly a stand-in (`password`, `${DB_PASS}`, `<pass>`, `xxx`).
+ */
+export const URL_CREDENTIAL = /\b[a-z][a-z0-9+.-]*:\/\/([^\s:@\/'"]+):([^\s@\/'"]+)@[^\s\/'"]+/i;
+const PASSWORD_STANDIN = /^(?:pass(?:word)?|passwd|pwd|pw|secret|user|username)$|[{}$<>%]/i;
+
+/**
+ * Files that usually hold secrets, by their name alone.
+ *
+ * Listed, never read for this — a name is not proof, and the list says so.
+ * A `.env` of `DEBUG=1` is a false alarm; a `.env` nobody declared that holds
+ * the production database is the most common credential there is, and a scan
+ * that only knows issued shapes calls it clean. `.example`, `.sample`,
+ * `.template` and `.dist` are the checked-in stand-ins and are left out.
+ */
+export const SECRET_NAMES = /^(?:\.env(?:\..+)?|.+\.(?:pem|key|p12|pfx|jks|keystore)|id_(?:rsa|dsa|ecdsa|ed25519)|\.netrc|\.pgpass|credentials\.json|service-account.*\.json)$/i;
+const STAND_IN_FILE = /\.(?:example|sample|template|dist|tmpl)$|\.(?:example|sample|template)\./i;
+
 export const DEFAULT_IGNORE = [
   "**/node_modules/**", "**/.git/**", "**/dist/**", "**/build/**", "**/.next/**",
   "**/vendor/**", "**/__pycache__/**", "**/.venv/**", "**/venv/**", "**/coverage/**",
@@ -74,7 +98,7 @@ export const DEFAULT_IGNORE = [
   "**/*.min.js", "**/*.min.css", "**/*-lock.json", "**/*.lock",
 ];
 
-const SKIP_EXT = /\.(png|jpe?g|gif|webp|ico|svg|pdf|zip|gz|tgz|bz2|xz|mp[34]|mov|wav|woff2?|ttf|otf|eot|so|dylib|a|o|class|jar|wasm|sqlite3?|db)$/i;
+const SKIP_EXT = /\.(png|jpe?g|gif|webp|ico|svg|pdf|zip|gz|tgz|bz2|xz|mp[34]|mov|wav|woff2?|ttf|otf|eot|so|dylib|a|o|class|jar|wasm|sqlite3?|db|pyc|pyo)$/i;
 const MAX_BYTES = 512 * 1024;
 // Written as an escape, not as the byte itself. A literal NUL in the source
 // makes git classify this file as binary, and a file with no readable diff
@@ -88,17 +112,71 @@ const NUL = "\u0000";
  * `protectedDirs` are the declared key directories: a hit inside one is the
  * system working, not a finding. `ignore` adds to DEFAULT_IGNORE rather than
  * replacing it, so a user's list stays short.
+ *
+ * `limit` caps the `review` lines and the links, never the `certain` ones.
+ * It used to cap all of them together, and the walk stopped at the cap: 500
+ * ordinary `PASSWORD =` lines early in the tree hid a `ghp_` token after them,
+ * `certain` came back empty and a CI job gated on it exited 0. A certain hit is
+ * the finding the command exists for, so the walk always finishes and every
+ * one of them is kept; what the cap drops is counted in `omitted`.
+ *
+ * ── Nested checkouts: pruned inside a repo, walked outside one ──
+ * When the root is inside a git repository, a directory below it with its own
+ * `.git` (a clone, a submodule, a worktree, an agent's work copy) is somebody
+ * else's repository, and is skipped whole: counted in `skipped.nested`, named
+ * in `nestedPaths`. Measured on a real tree: two such directories held 207k
+ * files, and scanning them took 145 s and 413 MB for findings that belong to
+ * somebody else's policy.
+ *
+ * When the root is NOT a repository, the same rule made the command blind: a
+ * folder that holds projects (a workspace) is nothing BUT nested
+ * checkouts, so every one of them was pruned, the scan read almost nothing
+ * and exited 0 with "nothing credential-shaped". There is no "somebody else"
+ * there — the checkouts are the tree — so they are walked. A tree of work
+ * copies that is too big to walk goes in `[scan] ignore`.
+ *
+ * Either way a pruned checkout is still readable by every role; the renderer
+ * says so in yellow and says how to scan it, so a pruned tree never reads as
+ * a clean one.
+ *
+ * `.gitignore` is deliberately NOT honoured (no `git ls-files`): the files a
+ * repository ignores are precisely where credentials sit — `.env`, a local
+ * config — and every role can read them all the same. Skipping them would
+ * make the command quiet about the case it was written for.
  */
-export function scan(root, protectedDirs = [], ignore = [], limit = 500) {
-  const safe = protectedDirs.map((d) => join(root, d));
+export function scan(root, protectedDirs = [], ignore = [], limit = 500, { roots = null } = {}) {
+  // The real root, so a symlink's destination is compared like with like: on
+  // macOS a tree under /tmp is really under /private/tmp, and every link
+  // inside it pointed "out of the repo" until both sides were resolved.
+  try { root = realpathSync.native(root); } catch { /* scanned as written */ }
+  // `.secrets/` and `.secrets` are one directory. With the slash kept, the
+  // prefix test below never matched and the protected directory was scanned.
+  const safe = protectedDirs.map((d) => {
+    const path = resolve(root, d);
+    // The root was canonicalised above. Match the same spelling for absolute
+    // directories, including macOS's /var -> /private/var ancestor.
+    try { return realpathSync.native(path); } catch { return path; }
+  });
   const patterns = [...DEFAULT_IGNORE, ...ignore];
   const hits = [];
-  const skipped = { ignored: 0, protectedDirs: 0, reference: 0, placeholder: 0 };
+  const skipped = { ignored: 0, protectedDirs: 0, reference: 0, placeholder: 0, nested: 0 };
+  const nestedPaths = [];
+  // With `roots`, only those directories are walked, and a checkout inside one
+  // is another repository — pruned, unless it is itself one of the roots.
+  const walked = roots ? roots.map((r) => { try { return realpathSync.native(r); } catch { return r; } }) : null;
+  const prune = walked ? true : insideRepo(root);
+  let capped = 0;                         // review lines and links counted against `limit`
+  let omitted = 0;                        // … and the ones dropped because of it
+  const keep = (hit) => {
+    if (hit.level === "certain") return hits.push(hit);
+    if (capped >= limit) return omitted++;
+    capped++;
+    hits.push(hit);
+  };
 
   const isIgnored = (rel) => patterns.some((p) => covers(p, rel));
 
-  (function walk(dir) {
-    if (hits.length >= limit) return;
+  function walk(dir) {
     let entries;
     try {
       entries = readdirSync(dir, { withFileTypes: true });
@@ -106,7 +184,6 @@ export function scan(root, protectedDirs = [], ignore = [], limit = 500) {
       return; // an unreadable directory is a permission, not a finding
     }
     for (const e of entries) {
-      if (hits.length >= limit) return;
       const full = join(dir, e.name);
       const rel = relative(root, full);
 
@@ -129,19 +206,27 @@ export function scan(root, protectedDirs = [], ignore = [], limit = 500) {
       if (e.isSymbolicLink()) {
         let real;
         try {
-          real = realpathSync(full);
+          real = realpathSync.native(full);
         } catch {
           continue;                       // a broken link has nothing to leak
         }
         if (!real.startsWith(root + sep) && real !== root)
-          hits.push({
-            file: rel, line: 0, level: "link", shape: real,
-          });
+          keep({ file: rel, line: 0, level: "link", shape: real });
         continue;
       }
 
-      if (e.isDirectory()) { walk(full); continue; }
-      if (!e.isFile() || SKIP_EXT.test(e.name)) continue;
+      if (e.isDirectory()) {
+        if (prune && existsSync(join(full, ".git"))) {
+          if (walked?.includes(full)) continue;   // walked on its own
+          skipped.nested++; nestedPaths.push(rel); continue;
+        }
+        walk(full);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      if (SECRET_NAMES.test(e.name) && !STAND_IN_FILE.test(e.name))
+        keep({ file: rel, line: 0, level: "named", shape: "usually holds secrets, by its name" });
+      if (SKIP_EXT.test(e.name)) continue;
 
       let text;
       try {
@@ -153,8 +238,14 @@ export function scan(root, protectedDirs = [], ignore = [], limit = 500) {
       if (text.includes(NUL)) continue; // binary
 
       const lines = text.split(/\r?\n/);
-      for (let i = 0; i < lines.length && hits.length < limit; i++) {
+      for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
+        const url = URL_CREDENTIAL.exec(line);
+        if (url) {
+          const pw = url[2];
+          if (PASSWORD_STANDIN.test(pw) || PLACEHOLDER.test(pw) || /^[x*]+$/i.test(pw)) skipped.placeholder++;
+          else { keep({ file: rel, line: i + 1, shape: "password in a URL", level: "certain" }); continue; }
+        }
         for (const [level, shape, re] of SHAPES) {
           const m = re.exec(line);
           if (!m) continue;
@@ -164,12 +255,83 @@ export function scan(root, protectedDirs = [], ignore = [], limit = 500) {
             if (REFERENCE.test(line)) { skipped.reference++; break; }
             if (m[1] && PLACEHOLDER.test(m[1])) { skipped.placeholder++; break; }
           }
-          hits.push({ file: rel, line: i + 1, shape, level });
+          keep({ file: rel, line: i + 1, shape, level });
           break; // one finding per line; the first shape is the most specific
         }
       }
     }
-  })(root);
+  }
+  for (const r of walked ?? [root]) walk(r);
+
+  // A file with a certain finding is already listed with its line; naming it
+  // again as "usually holds secrets" says less about the same file.
+  const sure = new Set(hits.filter((h) => h.level === "certain").map((h) => h.file));
+  for (let i = hits.length - 1; i >= 0; i--) if (hits[i].level === "named" && sure.has(hits[i].file)) hits.splice(i, 1);
+
+  return { hits, skipped, nestedPaths, truncated: omitted > 0, omitted };
+}
+
+/**
+ * Whether `dir` is inside a git checkout: a `.git` (directory, or the file a
+ * worktree or submodule has) at `dir` or at any directory above it. Read from
+ * the filesystem, not from `git`, so a machine without git scans the same way.
+ */
+export function insideRepo(dir) {
+  for (let d = dir; ; d = dirname(d)) {
+    if (existsSync(join(d, ".git"))) return true;
+    if (dirname(d) === d) return false;
+  }
+}
+
+/**
+ * What `seisin scan` walks when the policy sits in a folder that is not a
+ * repository — the repositories its territories live in, whole.
+ *
+ * A policy at the root of one repository scans that repository, and that is
+ * right: a `.env` at its root is outside every territory and every role reads
+ * it. A policy at the root of a folder that holds many repositories (a
+ * workspace, a monorepo of clones) is a different shape. Walking the whole
+ * folder read everything the person running it ever kept there — archives, experiments,
+ * copies — measured at 155 s and 1,137 certain hits on one such folder, most of
+ * them in directories no agent works in. The question the command answers is
+ * "which credentials will an agent come across", and the agents work in their
+ * territories: so the scan follows the policy, and moves with it when the
+ * folder is reorganised. `--all` still walks everything.
+ *
+ * Each territory is widened to the repository that contains it, because a
+ * credential at a repository's root is read by an agent working anywhere in it.
+ * A territory outside any repository is walked as itself. Territories outside
+ * the policy's folder are left out: they are another folder's to scan.
+ */
+export function territoryRoots(config) {
+  const root = config.root;
+  const inside = (p) => p === root || p.startsWith(root + sep);
+  const found = new Set();
+  for (const role of Object.values(config.roles)) {
+    for (const glob of role.writes ?? []) {
+      let p;
+      try { p = join(root, toWritePath(glob)); } catch { continue; }
+      if (!inside(p)) continue;
+      found.add(repositoryOf(p, root));
+    }
+  }
+  // A plain folder inside another root is walked already; a checkout is not
+  // (the walk prunes checkouts), so it stays a root of its own.
+  const all = [...found];
+  return all.filter((r) => r === root || existsSync(join(r, ".git")) ||
+    !all.some((o) => o !== r && (o === root || r.startsWith(o + sep))));
+}
+
+/** The nearest checkout at or above `p`, stopping below `root`; else the territory itself. */
+function repositoryOf(p, root) {
+  let d = p;
+  while (d !== root && !isDir(d)) d = dirname(d);   // a file, or not created yet
+  const territory = d;
+  for (let at = d; at !== root && at.startsWith(root + sep); at = dirname(at))
+    if (existsSync(join(at, ".git"))) return at;
+  return territory;
+}
 
-  return { hits, skipped, truncated: hits.length >= limit };
+function isDir(p) {
+  try { return statSync(p).isDirectory(); } catch { return false; }
 }