seisin 0.5.0 → 0.6.0

package/src/redact.js

@@ -59,6 +59,10 @@ export function secretsOf(settings, readFile) {
  * half of a surrogate pair on either side.
  */
 export function redactor(secrets, label = "redacted") {
+  // Embedders use this export directly; neither order nor empty values may
+  // decide how much of a split credential is retained between chunks.
+  secrets = [...new Set(secrets.filter((s) => typeof s === "string" && s.length > 0))]
+    .sort((a, b) => b.length - a.length);
   if (secrets.length === 0) return null;
   const longest = secrets[0].length;
   const decoder = new StringDecoder("utf8");
@@ -66,21 +70,22 @@ export function redactor(secrets, label = "redacted") {
 
   return new Transform({
     transform(chunk, _enc, done) {
-      // Mask the WHOLE accumulated text first, then cut. Doing it the other way
-      // — masking only the part about to be emitted — lets a secret that
-      // straddles the cut through in two innocent halves. Written that way
-      // first; the split-buffer test caught it on the first run.
+      // Retain original input, not replacement text. Replacing a shorter
+      // credential before a longer one finishes destroys their shared prefix;
+      // carrying a marker forward also lets another secret replace its label.
       const text = typeof chunk === "string" ? chunk : decoder.write(chunk);
-      const masked = mask(tail + text, secrets, label);
-      let cut = masked.length - Math.min(longest - 1, masked.length);
-      if (cut > 0 && isHighSurrogate(masked.charCodeAt(cut - 1))) cut--;
-      if (cut > 0) this.push(masked.slice(0, cut));
-      tail = masked.slice(cut);
+      const buffered = tail + text;
+      let cut = Math.max(0, buffered.length - longest + 1);
+      if (cut > 0 && isHighSurrogate(buffered.charCodeAt(cut - 1))) cut--;
+      const result = maskPrefix(buffered, cut, secrets, label);
+      if (result.output) this.push(result.output);
+      tail = result.tail;
       done();
     },
     flush(done) {
-      const rest = mask(tail + decoder.end(), secrets, label);
-      if (rest) this.push(rest);
+      const text = tail + decoder.end();
+      const result = maskPrefix(text, text.length, secrets, label);
+      if (result.output) this.push(result.output);
       tail = "";
       done();
     },
@@ -89,8 +94,22 @@ export function redactor(secrets, label = "redacted") {
 
 const isHighSurrogate = (c) => c >= 0xd800 && c <= 0xdbff;
 
-function mask(text, secrets, label) {
-  let out = text;
-  for (const s of secrets) out = out.split(s).join(`‹${label}›`);
-  return out;
+/** Only match starts with enough input to decide the longest credential. */
+function maskPrefix(text, cut, secrets, label) {
+  const next = secrets.map((s) => text.indexOf(s));
+  let from = 0, output = "";
+  while (from < cut) {
+    let at = Infinity, chosen = -1;
+    for (let i = 0; i < next.length; i++) {
+      if (next[i] >= 0 && next[i] < at) { at = next[i]; chosen = i; }
+    }
+    if (at >= cut) { output += text.slice(from, cut); from = cut; break; }
+    output += text.slice(from, at) + `‹${label}›`;
+    from = at + secrets[chosen].length;
+    // Keep each search moving forward. In particular, a value absent from
+    // this buffer is not searched again for every occurrence of another.
+    for (let i = 0; i < next.length; i++)
+      if (next[i] >= 0 && next[i] < from) next[i] = text.indexOf(secrets[i], from);
+  }
+  return { output, tail: text.slice(from) };
 }

package/src/render.js

@@ -86,6 +86,8 @@ export function renderReport(report, { verbose = true } = {}) {
     lines.push(`  ${C.b}${r.name.padEnd(width)}${C.off}  ${C.blue}writes${C.off} ${writes}\n`);
     // Only when present: absent is the default, and a "never_writes nothing" line
     // on every role is noise that teaches the reader to skip the one that matters.
+    if (r.private?.length)
+      lines.push(`  ${" ".repeat(width)}  ${C.yellow}private${C.off} ${r.private.join(" ")} ${C.dim}(only this role reads or writes it)${C.off}\n`);
     if (r.neverWrites?.length)
       lines.push(`  ${" ".repeat(width)}  ${C.yellow}never${C.off}  ${collapseSidecars(r.neverWrites).join(" ")}\n`);
     if (r.trustd)
@@ -96,6 +98,12 @@ export function renderReport(report, { verbose = true } = {}) {
       lines.push(`  ${" ".repeat(width)}  ${C.yellow}mcp${C.off}    ${r.mcp.length ? r.mcp.join(" ") : "none"} ${C.dim}(declared; the launcher enforces it)${C.off}\n`);
     if (r.localPorts?.length)
       lines.push(`  ${" ".repeat(width)}  ${C.yellow}reach${C.off}  localhost ${r.localPorts.join(" ")} ${C.dim}(local_ports, through the proxy)${C.off}\n`);
+    if (r.reads?.length)
+      lines.push(`  ${" ".repeat(width)}  ${C.blue}reads${C.off}  ${r.reads.join(" ")}\n`);
+    if (r.toolchain?.length)
+      lines.push(`  ${" ".repeat(width)}  ${C.blue}tools${C.off}  ${r.toolchain.join(" ")}\n`);
+    if (r.verify)
+      lines.push(`  ${" ".repeat(width)}  ${C.blue}verify${C.off} ${r.verify.join(" ")}\n`);
     lines.push(`  ${" ".repeat(width)}  ${C.green}keys${C.off}   ${keys}\n\n`);
   }
 
@@ -129,28 +137,33 @@ export function renderReport(report, { verbose = true } = {}) {
     const more = [
       report.protected?.length ? `${report.protected.length} protected path(s)` : "",
       report.warnings.some((w) => w.detail) ? "why each warning matters" : "",
-      report.limits?.length ? `${report.limits.length} standing limit(s)` : "",
     ].filter(Boolean);
-    if (more.length) lines.push(`  ${C.dim}seisin check --verbose: ${more.join(", ")}${C.off}\n\n`);
+    if (more.length) lines.push(`  ${C.dim}seisin check --verbose: ${more.join(", ")}${C.off}\n`);
+    lines.push(limitsLine(report), "\n");
     return lines.join("");
   }
 
   for (const w of report.warnings) {
     lines.push(`  ${C.yellow}${w.headline}${C.off}\n`);
     if (w.detail) lines.push(`  ${C.dim}${w.detail}${C.off}\n`);
+    // A list is a list: one entry per line, not a sentence of twenty paths.
+    for (const item of w.items ?? []) lines.push(`    ${C.dim}${item}${C.off}\n`);
     lines.push("\n");
   }
 
-  // Dim, and last: a standing limit is not an alarm, but it is not a footnote
-  // either — it is the part of the map that is blank.
-  for (const l of report.limits ?? []) {
-    lines.push(`  ${C.dim}${l.headline}${C.off}\n`);
-    if (l.detail) lines.push(`  ${C.dim}${l.detail}${C.off}\n`);
-    lines.push("\n");
-  }
+  // The standing limits are the same in every repo, so they are one line here
+  // and the paragraphs are `seisin help limits` — six of them closed every
+  // verbose report, under the part that was about this repo.
+  lines.push(limitsLine(report), "\n");
   return lines.join("");
 }
 
+/** Where the standing limits are, or nothing when the report carries none. */
+function limitsLine(report) {
+  const n = report.limits?.length ?? 0;
+  return n ? `  ${C.dim}${n} standing limit(s) apply to every repo: seisin help limits${C.off}\n` : "";
+}
+
 /* ── one verdict ──────────────────────────────────────────────────────── */
 
 /** The `explain` answer, as text. Takes what `owners.explain()` returns. */
@@ -169,6 +182,19 @@ export function renderVerdict(role, action, target, verdict) {
  * people to stop reading the colour.
  */
 export function renderEntry(e) {
+  if (e.event === "canary") {
+    const mark = e.confined ? `${C.green}canary passed${C.off}` : `${C.red}canary failed${C.off}`;
+    const why = e.reasons?.length ? `  ${C.dim}${e.reasons.join("; ")}${C.off}` : "";
+    return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off}${why}\n`;
+  }
+  if (e.event === "log-dropped") {
+    const mark = `${C.yellow}log dropped${C.off}`;
+    return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off} ${C.dim}${e.batches} batch(es) of system log messages lost — kernel denials may be missing${C.off}\n`;
+  }
+  if (e.event === "key") {
+    const mark = e.ok ? `${C.green}key resolved${C.off}` : `${C.red}key failed${C.off}`;
+    return `  ${C.dim}${(e.at ?? "").slice(11, 19)}${C.off}  ${mark}  ${C.b}${e.role}${C.off} ${safe(e.key)}  ${C.dim}${e.mode}${C.off}\n`;
+  }
   const mark =
     e.verdict === "denied" ? `${C.yellow}denied ${C.off}`
     : e.verdict === "observed" ? `${C.dim}seen   ${C.off}`