seisin 0.4.2 → 0.6.0

package/src/violations.js

@@ -38,16 +38,37 @@
  * reads paths out of the traced process's memory — its own comment calls those
  * events attacker-controlled and racy. That is not a stream an outside process
  * can attach to, and it is not one to reimplement. On Linux this returns an
- * unavailable watcher with the reason, and `seisin run` says so once.
+ * unavailable watcher with the reason. `seisin run` does not print it — once
+ * per run is a line nobody can act on — and `seisin check` says it, with the
+ * platform's other standing limits.
  */
 import { spawn, execFileSync } from "node:child_process";
 import { statSync } from "node:fs";
+import { basename } from "node:path";
 
 /** Only sandbox-runtime tags its violations this way. Everything else on the
  *  machine — Safari, mDNSResponder, Spotlight — is filtered out by the OS
  *  before a byte reaches us, which is why the predicate is not a grep. */
 const PREDICATE = 'eventMessage ENDSWITH "_SBX"';
 
+/**
+ * What `log stream` prints in place of the messages it could not keep up with.
+ *
+ * The one way this instrument loses a denial without anything else noticing:
+ * the kernel refuses, the agent sees EPERM, and the line never arrives. It
+ * happens when the unified log is flooded — measured, a network filter's
+ * kernel extension writing ~6,700 lines a second while it dropped two
+ * sessions' connections — and the predicate does not help, because the stream
+ * is dropped before it is filtered. The marker carries no count and no names:
+ * one line per batch lost, which is all there is to report.
+ */
+const DROPPED = /^=== Messages dropped during live streaming\b/gm;
+
+/** How many batches `log stream` says it dropped in this text. */
+export function droppedIn(text) {
+  return (String(text).match(DROPPED) ?? []).length;
+}
+
 /** `Sandbox: <proc>(<pid>) deny(<n>) <operation> <detail>` */
 const DENY = /Sandbox:\s+(\S+)\((\d+)\)\s+deny\(\d+\)\s+(\S+)\s+(.+?)\s*$/;
 
@@ -82,9 +103,25 @@ export function actionOf(operation) {
   if (operation.startsWith("file-write")) return "write";
   if (operation === "file-read-data") return "read";
   if (operation === "network-outbound") return "connect";
+  if (SYSTEM.test(operation)) return "system";
   return null;
 }
 
+/**
+ * The operations that are neither a file nor a connection — `mach-register`,
+ * `mach-lookup`, `sysctl-read`, `iokit-open`… — and that used to be dropped.
+ *
+ * They were dropped as the sandbox doing its job against the machine, and most
+ * of them are: a browser asks for the window server and carries on. But one of
+ * them was the whole failure of a headless Chromium — a refused
+ * `mach-register` that killed the browser at start — and from seisin's record
+ * there was no way to know: five file reads in the log, and a crash. So they
+ * are recorded now, by operation and name, once per run each (intake.js), and
+ * never as a request: there is no territory to hand them to. What grants one
+ * is a preset like `browsers`, not `seisin grant`.
+ */
+const SYSTEM = /^(mach|sysctl|iokit|ipc|signal|process|system|user-preference|darwin|nvram|lsopen|appleevent)-/;
+
 /**
  * The target of a refused connection, or null when it is not one worth a line.
  *
@@ -98,7 +135,7 @@ export function actionOf(operation) {
  *   - `remote:*:<port>` — a TCP dial the profile refused. The kernel does not
  *     name the host, so the target is the port and nothing more.
  *   - a unix socket path — except under /var/run, where the system daemons
- *     live: every DNS lookup inside the box is a refused connect to
+ *     live: every DNS lookup inside the sandbox is a refused connect to
  *     mDNSResponder, and recording those would bury everything else.
  *   - anything else (an empty detail, which the kernel also writes) — dropped.
  */
@@ -139,6 +176,13 @@ export function parseChunk(chunk) {
     if (!target) return null;
     return { ...deny, action, path: target, suffix: tag?.suffix ?? null, command: tag?.command ?? null };
   }
+  // The name as the kernel gave it ("com.apple.tsm.portname (per-pid)"); an
+  // operation with no name is not a line anyone can act on.
+  if (action === "system") {
+    const name = deny.detail.trim();
+    if (!name) return null;
+    return { ...deny, action, path: name, suffix: tag?.suffix ?? null, command: tag?.command ?? null };
+  }
   // Only an absolute path is a territory question. A relative or malformed
   // detail means the line was not what it looked like; dropping beats guessing.
   if (!deny.detail.startsWith("/")) return null;
@@ -219,8 +263,8 @@ export function isOurs(tagged, argv) {
  * reimplementing the runtime's shell quoting and inheriting its bugs; a process
  * tree is a fact the OS already holds.
  *
- * One `ps` per unseen pid, and only until the session suffix is learned — after
- * that the suffix alone is exact, because it is generated once per `srt`
+ * At most one `ps` per TREE_MS, and only until the session suffix is learned —
+ * after that the suffix alone is exact, because it is generated once per `srt`
  * process. In practice that is one `ps` per run.
  */
 export function descends(pid, root, snapshot) {
@@ -235,14 +279,25 @@ export function descends(pid, root, snapshot) {
   return false;
 }
 
-/** pid → ppid for every process this user can see. */
+/**
+ * pid → ppid for every process this user can see, and in `tree.roots` the
+ * pids that are a sandbox run's root: an `srt`, or a `seisin run`.
+ *
+ * The roots are what makes "not ours" provable. A process outside our tree is
+ * someone else's only if its ancestry reaches another run; one whose ancestry
+ * ends at init was orphaned — `cmd &`, a build daemon, git's fsmonitor — and
+ * may well be ours, reparented when the shell that started it exited.
+ */
 export function processTree(run = execFileSync) {
   const tree = new Map();
+  tree.roots = new Set();
   try {
-    const out = run("/bin/ps", ["-Ao", "pid=,ppid="], { encoding: "utf8" });
+    const out = run("/bin/ps", ["-Ao", "pid=,ppid=,args="], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
     for (const line of out.split("\n")) {
-      const m = line.trim().match(/^(\d+)\s+(\d+)$/);
-      if (m) tree.set(Number(m[1]), Number(m[2]));
+      const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.*))?$/);
+      if (!m) continue;
+      tree.set(Number(m[1]), Number(m[2]));
+      if (m[3] && RUN_ROOT.test(m[3])) tree.roots.add(Number(m[1]));
     }
   } catch {
     // No tree means nothing can be attributed, which the caller handles by
@@ -251,6 +306,25 @@ export function processTree(run = execFileSync) {
   return tree;
 }
 
+/** The command line of an `srt` (however it was installed) or of `seisin run`. */
+const RUN_ROOT = /(?:^|[\s/])srt(?:\s|$)|sandbox-runtime\/dist\/cli\.js(?:\s|$)|(?:^|[\s/])(?:seisin|cli\.js)\s+run\s/;
+
+/**
+ * Does `pid` descend from a run root other than `root`?
+ *
+ * A table without command lines (`roots` absent) cannot tell an orphan from a
+ * stranger, and answers as before: alive and not ours is someone else's.
+ */
+export function underAnotherRun(pid, root, snapshot) {
+  if (!snapshot.roots) return true;
+  const seen = new Set();
+  for (let at = pid; at && at !== 1 && !seen.has(at); at = snapshot.get(at)) {
+    if (at !== root && snapshot.roots.has(at)) return true;
+    seen.add(at);
+  }
+  return false;
+}
+
 /**
  * Did this refusal reach for content, or just walk past the door?
  *
@@ -336,8 +410,8 @@ export function scopeOf(settings, root) {
  * without `log` looks like — and the caller says so once rather than silently
  * logging less than it used to.
  */
-export function watchDenials(onDeny, { pid = null, argv = null, platform = process.platform, spawnFn = spawn, treeFn = processTree } = {}) {
-  const stats = { attributed: 0, foreign: 0, unattributed: 0 };
+export function watchDenials(onDeny, { pid = null, argv = null, platform = process.platform, spawnFn = spawn, treeFn = processTree, now = () => performance.now() } = {}) {
+  const stats = { attributed: 0, foreign: 0, unattributed: 0, dropped: 0 };
 
   /**
    * Unavailable is a watcher that does nothing, NOT a different shape.
@@ -361,7 +435,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     return {
       available: false,
       reason: platform === "linux"
-        ? "kernel denials are not readable from outside the runtime on Linux — see docs/upstream/cli-violations.md"
+        ? "kernel denials are not readable from outside the runtime on Linux — see https://github.com/carlostapiacl/seisin/blob/main/docs/upstream/cli-violations.md"
         : `no kernel denial stream on ${platform}`,
       stats,
       attributeTo() {},
@@ -370,9 +444,29 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
 
   let suffix = null;               // learned once, exact from then on
   let tree = null;                 // refreshed only while still learning
+  let treeAt = -Infinity;          // when `tree` was taken
   let root = pid;                  // the srt pid; not known until after spawn
   const mine = new Set();          // pids already proven to be ours
   const held = [];                 // denials seen before they could be attributed
+  const foreignSuffixes = new Set(); // other sandboxes, proven while they were alive
+  let recheck = null;              // a deferred look, when a snapshot was refused
+
+  /**
+   * One `ps` per TREE_MS at most, and a later look instead of a skipped one.
+   *
+   * `ps` is synchronous and it was taken for every denial from another sandbox
+   * while this run had not learned its own suffix — which, for a run that is
+   * never refused anything, is the whole run. Several cells at once is exactly
+   * that: 83 ms of blocked event loop per foreign line, measured. A line whose
+   * process may be younger than the last snapshot is not decided on it; it is
+   * held, and looked at again once the window has passed.
+   */
+  const snapshot = () => { tree = treeFn(); treeAt = now(); };
+  const later = () => {
+    if (recheck) return;
+    recheck = setTimeout(() => { recheck = null; if (!suffix && held.length) revisit(); }, TREE_MS);
+    recheck.unref?.();
+  };
 
   /**
    * Two anchors, and either one is enough.
@@ -396,12 +490,27 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     }
     if (root === null) return false;   // nothing to descend from yet
     if (mine.has(d.pid)) return true;
-    if (tree === null) tree = treeFn();
+    // A suffix already proven foreign needs no `ps`: the suffix is per `srt`.
+    if (d.suffix && foreignSuffixes.has(d.suffix)) return false;
+    if (tree === null) snapshot();
     if (!descends(d.pid, root, tree)) {
-      // A pid we have never seen may simply be younger than the snapshot.
-      // Refresh once, then believe the answer.
-      tree = treeFn();
-      if (!descends(d.pid, root, tree)) return false;
+      // A pid the snapshot does not have may simply be younger than it.
+      // Refresh once, then believe the answer — unless the last refresh was
+      // moments ago, and then look again later rather than refresh now. A pid
+      // it does have is answered: its parents do not change into ours.
+      if (treeAt < d.seen && !tree.has(d.pid)) {
+        if (now() - treeAt < TREE_MS) { later(); return LATER; }
+        snapshot();
+      }
+      if (!descends(d.pid, root, tree)) {
+        // Alive, not ours by either anchor, and under another run — the tag
+        // did not match above. Every later line from that `srt` is someone
+        // else's without asking. Alive but under no run at all is an orphan
+        // (`cmd &`, a daemon): possibly ours, so its suffix stays undecided
+        // rather than turning this run's own later lines into strangers.
+        if (d.suffix && tree.has(d.pid) && underAnotherRun(d.pid, root, tree)) foreignSuffixes.add(d.suffix);
+        return false;
+      }
     }
     mine.add(d.pid);
     // The first proven denial hands us the suffix for every later one.
@@ -432,7 +541,8 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
   };
 
   const consider = (d) => {
-    if (attribute(d)) {
+    const verdict = attribute(d);
+    if (verdict === true) {
       stats.attributed++;
       onDeny(d);
       // Learning the suffix makes every held line decidable. Without this,
@@ -445,7 +555,9 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     // child whose pid anchors attribution, or the process died before `ps`
     // could see it. Either way a foreign sandbox and one of ours look the same
     // from here, so hold the line rather than credit or discard it.
-    if (!suffix && d.suffix) {
+    // A line put off to the next snapshot is held with or without a suffix:
+    // the look it is waiting for is the only thing that can decide it.
+    if (verdict === LATER || (!suffix && d.suffix && !foreignSuffixes.has(d.suffix))) {
       stats.unattributed++;
       held.push(d);
       // Bounded, because the common case on a busy machine is a run that is
@@ -473,7 +585,13 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     child = spawnFn("/usr/bin/log", ["stream", "--predicate", PREDICATE, "--style", "compact"],
       { stdio: ["ignore", "pipe", "ignore"] });
   } catch (e) {
-    return { available: false, reason: `could not start the log stream: ${e.message}`, stats, close() {} };
+    // The same shape as the unavailable watcher above, for the same reason:
+    // `run` calls attributeTo() and awaits close() unconditionally.
+    return {
+      available: false, reason: `could not start the log stream: ${e.message}`, stats,
+      attributeTo() {},
+      close: () => Promise.resolve(stats),
+    };
   }
 
   let buf = "";
@@ -485,14 +603,20 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     while ((cut = buf.indexOf("_SBX")) !== -1) {
       const chunk = buf.slice(0, cut + 4);
       buf = buf.slice(cut + 4);
+      // A marker never contains the tag, so it is whole in one chunk or still
+      // in `buf`, which close() counts.
+      stats.dropped += droppedIn(chunk);
       const d = parseChunk(chunk);
+      if (d) d.seen = now();
       // Deduplicated here and not in consider(), because a held denial goes
       // through consider() a second time when it is finally attributed. Doing
       // this there would drop every line that arrived before the child had a
       // pid — which, on a short command, is all of them.
       if (d && !isRepeat(d)) consider(d);
     }
-    if (buf.length > 64_000) buf = "";   // a stream we cannot parse is not a leak
+    // A stream we cannot parse is not a leak. A flooded one is mostly markers
+    // with no tag between them, so they are counted before they go.
+    if (buf.length > 64_000) { stats.dropped += droppedIn(buf); buf = ""; }
   });
   // A monitor that cannot run must never take the run down with it. Same rule
   // as append(): the instrument is allowed to fail, the agent is not.
@@ -528,11 +652,12 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
      * nothing pending — costs one tick rather than the full window.
      */
     close({ drain = 0 } = {}) {
-      const stop = () => { try { child.kill("SIGTERM"); } catch { /* already gone */ } };
-      if (drain <= 0) { stop(); return Promise.resolve(stats); }
+      clearTimeout(recheck);
+      const stop = () => ended(child).then(() => { stats.dropped += droppedIn(buf); buf = ""; return stats; });
+      if (drain <= 0) return stop();
       return new Promise((resolve) => {
         let quiet = null;
-        const settle = () => { clearTimeout(quiet); clearTimeout(cap); stop(); resolve(stats); };
+        const settle = () => { clearTimeout(quiet); clearTimeout(cap); resolve(stop()); };
         const cap = setTimeout(settle, drain);
         const bump = () => { clearTimeout(quiet); quiet = setTimeout(settle, QUIET_MS); };
         child.stdout?.on("data", bump);
@@ -542,6 +667,28 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
   };
 }
 
+/**
+ * Stop a `log stream` and wait for what it was still holding.
+ *
+ * SIGINT, not SIGTERM. Writing to a pipe, `log` buffers its own notices — a
+ * denial's line arrives at once, but the "messages dropped" markers were buffered
+ * 8 KB at a time and came out together, measured twelve seconds after the flood
+ * began. SIGINT makes it flush them before it exits; SIGTERM threw them away
+ * (18 markers against 0 in the same flood). Bounded, so a stream that will not
+ * exit cannot hold up the end of a run.
+ */
+function ended(child, cap = END_MS) {
+  return new Promise((resolve) => {
+    if (child.exitCode !== null || child.signalCode !== null) return resolve();
+    const timer = setTimeout(() => { try { child.kill("SIGKILL"); } catch {} resolve(); }, cap);
+    child.once("close", () => { clearTimeout(timer); resolve(); });
+    try { child.kill("SIGINT"); } catch { clearTimeout(timer); resolve(); }
+  });
+}
+
+/** How long a stopped `log stream` gets to flush and exit. */
+const END_MS = 1000;
+
 /**
  * How long the stream has to stay silent before a drain gives up on it.
  *
@@ -551,6 +698,18 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
  */
 const QUIET_MS = 60;
 
+/**
+ * The shortest time between two `ps` snapshots while attribution is learning.
+ *
+ * Long enough that a burst of foreign denials costs one snapshot, not one
+ * each; short enough that a line held for a younger process is decided before
+ * anyone reads the log.
+ */
+const TREE_MS = 250;
+
+/** What `attribute` answers for a line it has put off to the next snapshot. */
+const LATER = "later";
+
 /**
  * How many undecided denials to keep while waiting to learn our own suffix.
  *
@@ -570,3 +729,68 @@ const HELD_MAX = 500;
  * `asked 3×` mean anything.
  */
 const REPEAT_MS = 1000;
+
+/**
+ * Is the system log dropping messages right now, and who is writing the most?
+ *
+ * For `seisin check --system-log`. Two streams for `seconds`: one with the run's
+ * own predicate, counting the batches it loses — the number a run would have
+ * seen — and one unfiltered, counting messages by sender, because a flood
+ * comes from somebody and naming them is the only fix there is. A kernel
+ * message is named by its first word, which is the function that wrote it
+ * (`cfil_inp_log`): "kernel" alone names nothing.
+ *
+ * Reads the log and starts no sandbox. Not available off macOS, where denials
+ * are not read from a log at all.
+ */
+export function measureSystemLog({ seconds = 3, platform = process.platform, spawnFn = spawn } = {}) {
+  if (platform !== "darwin") return Promise.resolve({ available: false, reason: `no system log stream on ${platform}` });
+  const streams = [];
+  const start = (args) => {
+    const child = spawnFn("/usr/bin/log", ["stream", ...args], { stdio: ["ignore", "pipe", "ignore"] });
+    child.on("error", () => {});
+    streams.push(child);
+    return child;
+  };
+  return new Promise((resolve) => {
+    let dropped = 0, lines = 0, tail = "", rest = "";
+    const by = new Map();
+    let ours, all;
+    try {
+      ours = start(["--predicate", PREDICATE, "--style", "compact"]);
+      all = start(["--style", "ndjson"]);
+    } catch (e) {
+      for (const c of streams) try { c.kill("SIGTERM"); } catch {}
+      return resolve({ available: false, reason: `could not start the log stream: ${e.message}` });
+    }
+    ours.stdout?.on("data", (d) => {
+      const text = tail + d.toString();
+      const cut = text.lastIndexOf("\n");
+      dropped += droppedIn(text.slice(0, cut + 1));
+      tail = text.slice(cut + 1);
+    });
+    all.stdout?.on("data", (d) => {
+      const parts = (rest + d.toString()).split("\n");
+      rest = parts.pop();
+      for (const line of parts) {
+        if (!line.startsWith("{")) continue;
+        let e;
+        try { e = JSON.parse(line); } catch { continue; }
+        lines++;
+        const proc = basename(String(e.processImagePath ?? "?"));
+        const who = e.subsystem
+          ? `${proc} · ${e.subsystem}`
+          : proc === "kernel" ? `kernel · ${String(e.eventMessage ?? "").split(/[\s:]/)[0] || "?"}` : proc;
+        by.set(who, (by.get(who) ?? 0) + 1);
+      }
+      if (rest.length > 1_000_000) rest = "";
+    });
+    setTimeout(async () => {
+      await Promise.all(streams.map((c) => ended(c)));
+      dropped += droppedIn(tail);
+      const top = [...by].sort((a, b) => b[1] - a[1]).slice(0, 3)
+        .map(([who, n]) => ({ who, perSecond: Math.round(n / seconds) }));
+      resolve({ available: true, seconds, dropped, perSecond: Math.round(lines / seconds), top });
+    }, seconds * 1000);
+  });
+}

package/src/walls.js

@@ -4,8 +4,8 @@
  * seisin answers *whose is this* at the moment of the refusal, once, in the
  * middle of a turn, and then the sentence is gone. Nothing carries it forward,
  * so the agent tries again — and the measurement that made this module exist
- * says how often: of 345 denials on a real team, **88 (25%) were a repeat of
- * something that same role had already been refused**. One role spent 37 calls
+ * says how often: of 345 denials in a multi-repo workspace, **88 (25%) were a repeat of
+ * something that same role had already been denied**. One role spent 37 calls
  * on two walls, hitting the same one nineteen times.
  *
  * A block that repeats nineteen times is not a boundary working. It is a
@@ -31,12 +31,12 @@
  * its wall disappear on the next turn instead of two days later.
  *
  * A window is still accepted, and still useful for a different reason: a
- * refusal from three weeks ago is noise even if it is still refused today.
+ * denial from three weeks ago is noise even if it is still denied today.
  */
-import { openSync, readSync, closeSync, statSync } from "node:fs";
-import { read } from "./log.js";
+import { read, readEntries } from "./log.js";
 import { explain } from "./owners.js";
 import { STALE_RUNS, RUN_GAP_MS, runsAfter } from "./requests.js";
+import { expectedOf } from "./kinds.js";
 
 /** A wall is something you hit more than once. Once is information; twice is a pattern. */
 export const MIN_HITS = 2;
@@ -49,12 +49,14 @@ export const MIN_HITS = 2;
  * different repositories are two walls, and merging them hides which one was
  * hit.
  */
-export function walls(config, role, { file, entries = null, min = MIN_HITS, since = null, limit = 6, fresh = false } = {}) {
+export function walls(config, role, { file, entries = null, min = MIN_HITS, since = null, limit = 6, fresh = false, ask = explain } = {}) {
   // `entries`: the log already read, for a caller asking about every role at
   // once (the console asks for 32 on a real policy) — one read instead of 32.
-  const denied = entries
+  // Less the caller's own probes (`seisin run --expect-denied`): denied as
+  // whoever started the run asked, and not a wall the role keeps hitting.
+  const denied = (entries
     ? entries.filter((e) => e.role === role && e.verdict === "denied" && (!since || e.at >= since))
-    : read(file, { role, verdict: "denied", ...(since ? { since } : {}) });
+    : read(file, { role, verdict: "denied", ...(since ? { since } : {}) })).filter((e) => e.expected !== true);
 
   const byKey = new Map();
   for (const e of denied) {
@@ -70,9 +72,14 @@ export function walls(config, role, { file, entries = null, min = MIN_HITS, sinc
     if (w.times < min) continue;
     // The policy as it stands, not as it stood. A granted wall is not a wall,
     // and the whole point of saying this to an agent is that it is true now.
-    const verdict = explain(config, role, w.action, w.target);
+    // `ask` is explain, or a remembered one (views.js) for a caller asking
+    // about every role at once.
+    const verdict = ask(config, role, w.action, w.target);
     if (verdict.allowed) continue;
-    out.push({ ...w, reason: verdict.reason, owners: verdict.owners });
+    // Refused correctly and nothing to do about it (kinds.js expectedOf): kept,
+    // and marked, so a screen says it apart instead of as a role stuck.
+    const expected = expectedOf(w.target);
+    out.push({ ...w, reason: verdict.reason, owners: verdict.owners, ...(expected && { expected }) });
   }
   // A wall the role stopped hitting — it ran STALE_RUNS times since, refused
   // elsewhere but not here — is still true and no longer worth saying. Same
@@ -89,17 +96,18 @@ export function walls(config, role, { file, entries = null, min = MIN_HITS, sinc
 /**
  * How much of the log `timesHit` will look at.
  *
- * The log is append-only and never rotates — that is the storage design and it
- * is the right one — so "read the file" is O(everything you have ever done),
- * on a path that runs inside the hook. Measured on a 372 KB log: 3 ms per
- * call, which is nothing, and 300 ms at 37 MB, which is not, on every refusal
- * of every turn forever.
+ * The log is append-only and a segment only rotates at 8 MiB, so "read the
+ * file" is O(everything since the last rotation), on a path that runs inside
+ * the hook. Measured on a 372 KB log: 3 ms per
+ * call, which is nothing, and 300 ms at 37 MB, which is not, on every denial
+ * of every session forever.
  *
  * So it reads the tail. That makes the count **recent repetition** rather than
  * lifetime repetition, and recent is the one the sentence is about anyway: an
  * agent being told "you have hit this three times" means this session, not
  * last month. 4 MB is thousands of entries — far more than a turn produces,
- * and bounded.
+ * and bounded. Right after a rotation the tail is short, and so is the count:
+ * the current segment only, on purpose.
  */
 const TAIL_BYTES = 4 * 1024 * 1024;
 
@@ -113,39 +121,56 @@ const TAIL_BYTES = 4 * 1024 * 1024;
  * call.
  */
 export function timesHit(file, role, action, target) {
-  let text;
-  try {
-    const { size } = statSync(file);
-    const from = Math.max(0, size - TAIL_BYTES);
-    const fd = openSync(file, "r");
-    try {
-      const buf = Buffer.alloc(size - from);
-      readSync(fd, buf, 0, buf.length, from);
-      text = buf.toString("utf8");
-    } finally {
-      closeSync(fd);
+  return hitsOf(file, role, action, target).total;
+}
+
+/**
+ * The same count, and how much of it is this run's.
+ *
+ * Denial lines carry no run id; each run's canary does, and comes first. So
+ * `inRun` counts from the canary of `run` (SEISIN_RUN_ID) onwards, and is null
+ * when that canary is not in the tail — outside `seisin run`, or a run older
+ * than the tail. Measured: a fresh run told "denied 5 times now" about its
+ * first try read as a counter gone wrong; the five were from earlier runs.
+ */
+export function hitsOf(file, role, action, target, run = null) {
+  // The line the tail cut lands in is dropped (readLines checks the byte before
+  // the cut, so a cut on a boundary keeps it). Comparing the file's byte size
+  // with the text's UTF-16 length used to decide that, and with any multibyte
+  // character in the tail it kept the fragment of a line or dropped a whole one.
+  const id = run ? String(run).slice(0, 8) : null;
+  let total = 0, inRun = null;
+  for (const e of readEntries(file, { tail: TAIL_BYTES })) {
+    if (id && e.event === "canary" && e.role === role && e.run === id) inRun = 0;
+    if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) {
+      total++;
+      if (inRun !== null) inRun++;
     }
-  } catch {
-    return 0;                       // no log yet is not an error; it is a first turn
-  }
-  const lines = text.split("\n");
-  // The first line of a tail read is usually half an entry. Dropping it costs
-  // one count at most and keeps a truncated line from being parsed as if it
-  // were whole.
-  if (from0(text, file)) lines.shift();
-  let n = 0;
-  for (const line of lines) {
-    if (!line.trim()) continue;
-    let e;
-    try { e = JSON.parse(line); } catch { continue; }
-    if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) n++;
   }
-  return n;
+  return { total, inRun };
+}
+
+/**
+ * The sentence about having been denied this before, or "".
+ *
+ * `times` and `inRun` include the attempt being answered. Said about this run
+ * when the run is known, and earlier runs are named as earlier runs. Silent on
+ * a first time anywhere.
+ */
+export function againWords({ times, inRun = null }) {
+  if (inRun === null)
+    return times > 1 ? ` You have been denied this ${times} times now; it is not going to work on the ${ordinal(times + 1)} try.` : "";
+  const earlier = times - inRun;
+  if (inRun > 1)
+    return ` You have been denied this ${inRun} times in this run` + (earlier > 0 ? ` (and ${earlier} in earlier runs)` : "") +
+      `; it is not going to work on the ${ordinal(inRun + 1)} try.`;
+  return earlier > 0 ? ` It was denied ${earlier} time(s) in earlier runs too; this run gets the same answer.` : "";
 }
 
-/** Did we start mid-file? Then the first line is a fragment. */
-function from0(text, file) {
-  try { return statSync(file).size > text.length; } catch { return false; }
+/** 4 -> "fourth". Past a handful the numeral reads better than the word. */
+export function ordinal(n) {
+  const words = ["", "first", "second", "third", "fourth", "fifth", "sixth", "seventh", "eighth", "ninth", "tenth"];
+  return words[n] ?? `${n}th`;
 }
 
 /**
@@ -155,7 +180,9 @@ function from0(text, file) {
  * one after that is the cost of not having been able to remember.
  */
 export function wasted(list) {
-  return list.reduce((n, w) => n + w.times - 1, 0);
+  // An expected refusal is the agent program's own housekeeping, not a call
+  // the agent spent retrying.
+  return list.reduce((n, w) => n + (w.expected ? 0 : w.times - 1), 0);
 }
 
 /**
@@ -166,6 +193,9 @@ export function wasted(list) {
  * whole section — and then the one turn it matters, it is skipped too.
  */
 export function render(list) {
+  // Not the agent's to stop retrying: Claude Code's plugin updater is not a
+  // tool call, so telling the agent about it is a line it can do nothing with.
+  list = list.filter((w) => !w.expected);
   if (!list.length) return "";
   const lines = [
     "WALLS — you have already been denied these, and the policy still denies them.",

package/src/worktree.js

@@ -30,9 +30,10 @@
  * and no dependency — a tool people install to shrink their attack surface
  * should not shell out to find out where it is.
  */
-import { statSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { statSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve, relative, isAbsolute } from "node:path";
 import { findConfig } from "./config.js";
+import { realOrSelf } from "./grants.js";
 
 const GITDIR = /^gitdir:\s*(.+?)\s*$/;
 const WORKTREE = /^(.+)\/\.git\/worktrees\/[^/]+$/;
@@ -63,18 +64,9 @@ function statOf(p) {
   }
 }
 
-/** The path with symlinks followed, or the path itself when it is not on disk. */
-function real(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return p;
-  }
-}
-
 /** Two spellings of one place — `/tmp` and `/private/tmp` — compare equal. */
 function same(a, b) {
-  return real(a) === real(b);
+  return realOrSelf(a) === realOrSelf(b);
 }
 
 /**