seisin 0.5.0 → 0.6.0

package/src/serve.js

@@ -18,9 +18,11 @@ import { fileURLToPath } from "node:url";
 import { loadConfig } from "./config.js";
 import { read, logPath, logSegments } from "./log.js";
 import { settingsFor } from "./srt.js";
-import { pending, requestsPath, settle, applyGrant, refuseIfBarred, editPolicy, cleanReason } from "./requests.js";
+import { describeHandoff } from "./handoff.js";
+import { pending, requestsPath, settle, applyGrant, refuseIfBarred, editPolicy, cleanReason, asFileGrant, lastAgentOf, fileOnlyNote } from "./requests.js";
 import { causesOf, describeWalls, parseSince, queue, verdicts, wallsByRole } from "./views.js";
 import { planEdit, hashOf } from "./controls.js";
+import { inspect } from "./inspect.js";
 
 // Moved to views.js, which the MCP server shares; kept importable from here.
 export { causesOf } from "./views.js";
@@ -135,11 +137,16 @@ export function state(configPath, { since = null, snap = snapshot(configPath) }
     keys: r.keys,
     env: r.env,
     neverWrites: r.neverWritesDeclared ?? r.neverWrites ?? [],
+    private: r.private ?? [],
     localBinding: r.localBinding === true,
     localPorts: r.localPorts ?? [],
     mcp: r.mcp ?? null,
     trustd: r.trustd === true,
     controlFiles: r.controlFiles ?? [],
+    reads: r.reads ?? [],
+    toolchain: r.toolchain ?? [],
+    verify: r.verify,
+    canary: [...all].reverse().find((e) => e.event === "canary" && e.role === r.name) ?? null,
     // Counted over the same window as the causes, so the KPI and the screen it
     // links to agree.
     blocks: derived.blocks.get(r.name) ?? 0,
@@ -152,7 +159,16 @@ export function state(configPath, { since = null, snap = snapshot(configPath) }
     // is not old just because the filter hides the runs that made it old. The
     // whole log, every verdict, as `seisin requests` and the MCP read it — this
     // counted runs over denials only, and marked differently from both.
-    requests: queue(cfg.root, all, cfg.keyDirs),
+    // A write keyed by a folder can be granted as its one file instead; the
+    // line that choice carries is said here, once, so the page and the CLI
+    // say the same thing about Claude Code.
+    requests: queue(cfg, all).map((r) => ({
+      ...r,
+      // Said by the server in the same words as the CLI, so the page never
+      // works out where a request goes on its own (handoff.js).
+      handoffNote: describeHandoff(r.handoff, r.attempt, r.chainStopped),
+      ...(r.action === "write" && r.grant !== r.target ? { fileNote: fileOnlyNote(r.role, lastAgentOf(all, r.role)) } : {}),
+    })),
     since,
     // The file itself, not a regeneration of it. The page can render a policy
     // from its own model, and that model has no comments — so showing it under
@@ -165,6 +181,9 @@ export function state(configPath, { since = null, snap = snapshot(configPath) }
     // so a policy edited in between is not overwritten by a stale decision.
     base: hashOf(text),
     allowedDomains: cfg.allowedDomains,
+    read: cfg.read,
+    isolate: cfg.isolate,
+    warnings: inspect(cfg).warnings,
     roles,
     causes: derived.causes,
     walls: derived.walls,
@@ -208,7 +227,7 @@ function settingsOf(configPath, role) {
  * an exception for loopback. That is what lets the console hold the half the
  * MCP server deliberately does not.
  */
-function decide(configPath, { key, decision, reason }) {
+function decide(configPath, { key, decision, reason, scope = "folder" }) {
   /**
    * By the request's id, never by its place in the queue.
    *
@@ -220,13 +239,8 @@ function decide(configPath, { key, decision, reason }) {
    * The CLI stopped doing this long ago; the console had not.
    */
   if (typeof key !== "string" || !key) throw bad("key is required — the id of the request on screen");
-  /**
-   * A person declines; the boundary denies. The console sends "declined".
-   * "denied" is still accepted from anything that scripted against the old
-   * value, and is what the queue stores either way — renaming a stored value
-   * is a breaking change, listed in docs/glossary.md, not made here.
-   */
-  if (decision === "denied") decision = "declined";
+  // A person declines; the boundary denies (docs/glossary.md). One word each,
+  // here and in the queue.
   if (decision !== "granted" && decision !== "declined")
     throw bad(`decision must be granted or declined`);
   /**
@@ -238,9 +252,11 @@ function decide(configPath, { key, decision, reason }) {
   if (typeof reason !== "string" || !cleanReason(reason))
     throw bad("a reason is required — it is written next to the decision");
   // It grants the folder the request is keyed by (docs/api.md asked, docs/**
-  // granted), and the page says so before the click. Granting the one file
-  // instead would need the queue to key by file: a later ask for a sibling
-  // folds into this settled request and would never reach the queue.
+  // granted), and the page says so before the click — or, with scope "file",
+  // the one file that was asked for, as a literal path. The queue stays keyed
+  // by folder; the settle line records the file, so a later ask for a sibling
+  // reopens the request instead of folding into it (requests.js, reduce).
+  if (scope !== "folder" && scope !== "file") throw bad(`scope must be folder or file`);
   const cfg = loadConfig(configPath);
   const file = requestsPath(cfg.root);
 
@@ -259,12 +275,14 @@ function decide(configPath, { key, decision, reason }) {
   let result = null;
   try {
     result = editPolicy(cfg, (before) => {
-      req = pending(file, { keyDirs: cfg.keyDirs }).find((r) => r.key === key);
+      const current = loadConfig(configPath, before);
+      req = pending(file, { keyDirs: current.keyDirs }).find((r) => r.key === key);
       if (!req) throw bad(`request ${key} is no longer pending — reload to see the queue as it is now`);
       if (decision !== "granted") return { toml: before, changed: false };
-      refuseIfBarred(cfg, req);
+      if (scope === "file") req = asFileGrant(req);
+      refuseIfBarred(current, req);
       return applyGrant(before, req, reason);
-    }, { after: () => settle(file, req.key, decision === "granted" ? "granted" : "denied", reason) });
+    }, { after: () => settle(file, req.key, decision, reason, { only: req.only }) });
   } catch (e) {
     if (e.code === "ELOCKED") throw Object.assign(new Error("another grant is in progress — try again in a moment"), { status: 503 });
     throw e;
@@ -428,7 +446,7 @@ function declineAll(configPath, { keys, reason }) {
       after: () => {
         for (const req of pending(file)) {
           if (!wanted.has(req.key)) continue;
-          settle(file, req.key, "denied", reason);
+          settle(file, req.key, "declined", reason);
           declined++;
         }
       },

package/src/spool.js

@@ -29,6 +29,7 @@
 import { createServer, createConnection, Socket } from "node:net";
 import { unlinkSync, existsSync, openSync, writeSync, closeSync, constants } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { lineReader as readLines } from "./lines.js";
 
 /** The env var a confined hook looks for. Absent means "write the file". */
 export const SOCK_ENV = "SEISIN_SPOOL";
@@ -62,24 +63,14 @@ const PIPE_BUF = 4096;
 
 /** Parses newline-separated JSON messages and hands each to `sink`. */
 function lineReader(sink, onTooLong) {
-  let buffer = "";
-  return (chunk) => {
-    buffer += chunk;
-    // A 1 MB line is not a log entry, it is something trying to fill a disk.
-    if (buffer.length > 1_000_000) { buffer = ""; return onTooLong?.(); }
-    let nl;
-    while ((nl = buffer.indexOf("\n")) !== -1) {
-      const line = buffer.slice(0, nl);
-      buffer = buffer.slice(nl + 1);
-      if (!line.trim()) continue;
-      try {
-        const msg = JSON.parse(line);
-        if (msg && (msg.to === "log" || msg.to === "requests")) sink(msg.to, msg.entry);
-      } catch {
-        // Garbage from inside the sandbox is not the parent's emergency.
-      }
+  return readLines((line) => {
+    try {
+      const msg = JSON.parse(line);
+      if (msg && (msg.to === "log" || msg.to === "requests")) sink(msg.to, msg.entry);
+    } catch {
+      // Garbage from inside the sandbox is not the parent's emergency.
     }
-  };
+  }, { onTooLong });
 }
 
 /**

package/src/srt.js

@@ -14,24 +14,30 @@
  *      error, which is most of what this file is for.
  */
 import { unknownRole } from "./suggest.js";
+import { privateDir } from "./config.js";
 import { existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
+import { homedir } from "node:os";
 import { STATE_DIR, CONFIG_NAME } from "./layout.js";
-import { entriesOf } from "./keys.js";
+import { entriesOf, injectKeysOf } from "./keys.js";
 import { enforcedNeverWrites } from "./owners.js";
 import { realAncestor } from "./paths.js";
 import { denyFor } from "./surface.js";
-import { runsRootOf } from "./rundir.js";
+import { runsRootOf, SETTINGS_NAME, TMP_NAME } from "./rundir.js";
 import { FIFO_SUFFIX } from "./spool.js";
+import { machOf } from "./browsers.js";
+import { territoryReads, outlastAllows, dataRoots, keptFor } from "./territory.js";
+import { seccompDir } from "./sandboxes/srt.js";
 import {
   SOCKET_MAX, isLink, realOrSelf, expand, homeFits, roleHome, roleHomeRoot,
-  CREDENTIAL_HOMES, toWritePath, writePathsOf,
+  CREDENTIAL_HOMES, toWritePath, writePathsOf, otherAgentsCredentials,
 } from "./grants.js";
 
 // Re-exported: these were srt.js's exports before grants.js existed, and
 // callers (the CLI, the tests, anyone embedding seisin) import them from here.
 export {
   expand, homeFits, roleHome, roleHomeRoot, CREDENTIAL_HOMES, RUNTIME_WRITES,
+  AGENTS, AGENT_HOMES, AGENT_CREDENTIALS, agentOf,
 } from "./grants.js";
 
 
@@ -77,7 +83,7 @@ export const NO_PROXY_WITHOUT_LOOPBACK = "169.254.0.0/16,10.0.0.0/8,172.16.0.0/1
 
 /**
  * The command a role runs, with loopback routed through the proxy when it
- * has `local_ports`.
+ * has `local_ports` and the sandbox is sandbox-runtime.
  *
  * An `env` in front and not a variable in the environment seisin passes: the
  * runtime sets NO_PROXY itself, after seisin's environment, so the only place
@@ -86,14 +92,35 @@ export const NO_PROXY_WITHOUT_LOOPBACK = "169.254.0.0/16,10.0.0.0/8,172.16.0.0/1
  * to be pointed at the proxy, or the port needs `local_binding`, which opens
  * every port.
  */
-export function loopbackVia(role, cmd) {
-  if (!role?.localPorts?.length) return cmd;
+export function loopbackVia(role, cmd, sandbox = "srt") {
+  // tartaros holds the port list in the kernel's profile itself: a listed port
+  // is reached directly, any other refused, and its own NO_PROXY already exempts
+  // loopback. Its egress broker, made to carry loopback as a forward proxy, cut
+  // POST bodies (measured on 0.1.0-alpha.7: curl got no answer, and Claude Code
+  // retried until ECONNRESET), so under it the route is left as it sets it.
+  if (!role?.localPorts?.length || sandbox === "tartaros") return cmd;
   return ["env", `NO_PROXY=${NO_PROXY_WITHOUT_LOOPBACK}`, `no_proxy=${NO_PROXY_WITHOUT_LOOPBACK}`, ...cmd];
 }
 
-export function settingsFor(config, roleName, spool = null, observe = false) {
+/** The temp directory sandbox-runtime grants every sandbox it starts. See settingsFor. */
+export const SHARED_TMP = { darwin: ["/tmp/claude", "/private/tmp/claude"], linux: ["/tmp/claude"] };
+
+/**
+ * `agent` is what the run's command runs — `agentOf(cmd)`, or `--agent`. It
+ * decides which agent's home is scratch for this run and whose sign-in files
+ * are closed to it. Left out (check, console, explain: no command), the
+ * settings are the most the role can get, which is every agent's home.
+ */
+export function settingsFor(config, roleName, spool = null, observe = false, { agent, program, tmp, forRun = false } = {}) {
   const role = config.roles[roleName];
   if (!role) throw unknownRole(config, roleName);
+  const claudeGrant = role.writes.find((g) => /^(?:\.\/)?\.claude(?:\/|$)/.test(g));
+  if (claudeGrant)
+    throw new Error(
+      `roles.${roleName}.writes includes "${claudeGrant}", but a project's .claude cannot be granted.\n` +
+      "  Claude Code reads its settings and hooks outside the sandbox. Remove this territory; " +
+      "a broad territory such as ** keeps working with .claude protected.",
+    );
 
   const abs = (p) => (p.startsWith("/") ? p : join(config.root, p));
   // "credentials" closes the places credentials live; "home" does that and
@@ -126,10 +153,25 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
    *   any directory that exists. It is the directory Claude Code itself logs
    *   to; making it empty changes nothing for anyone.
    */
-  const scratch = writePathsOf(config, config.roles[roleName] ?? { name: roleName, writes: [] });
+  const scratch = writePathsOf(config, config.roles[roleName] ?? { name: roleName, writes: [] }, { agent });
   const runtimeConvenience = ["~/.npm/_logs", "~/.claude/debug"]
     .map(expand)
     .filter((p) => process.platform !== "linux" || existsSync(p) || madeFirst(p, scratch));
+  /**
+   * The runtime's own temp directory, shared by every sandbox on the machine.
+   *
+   * sandbox-runtime grants `/tmp/claude` to every sandbox it starts, outside
+   * any allowWrite and "never left out", and hands it to the child as TMPDIR.
+   * Every Claude Code session on the machine keeps its own temp files there
+   * too, so a confined role could write beside them — caches, locks — with
+   * nothing in the policy saying so (measured: `echo x > /tmp/claude/…` from
+   * a role with `read = "territory"` and no scratch, rc=0). Only a denyWrite
+   * takes it back. The run gets a temp directory of its own instead
+   * (`tmp`, passed in, through CLAUDE_CODE_TMPDIR in commands/run.js), so
+   * nothing the runtime does needs the shared one.
+   */
+  const sharedTmp = SHARED_TMP[process.platform === "linux" ? "linux" : "darwin"]
+    .filter((p) => process.platform !== "linux" || existsSync(p) || madeFirst(p, scratch));
 
   /**
    * Refuse before the runtime does, because the runtime's refusal says nothing.
@@ -195,9 +237,29 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
    * touches, gets one wrong, and fails as an unexplainable crash inside the
    * agent. Naming the places credentials actually live is narrower than the
    * ideal and it is a boundary that holds up in practice.
+   *
+   * For agents you would not trust there is `[runtime] read = "territory"`,
+   * below: not that allowlist, but its useful half — the places data lives are
+   * denied, the system stays readable, and what a toolchain needs from a home
+   * is declared and checked before the run. decisions.md has both halves.
    */
   if (shielded) denyRead.push(...CREDENTIAL_HOMES.map(expand));
 
+  /**
+   * The other agents' sign-in, closed to this run both ways. See AGENT_HOMES
+   * in grants.js. Under `isolate = "home"` the agent signs in inside the role's
+   * own home, so that is where the files are looked for too.
+   *
+   * On Linux only the ones that exist: bubblewrap would otherwise put a file
+   * where the agent will later want to write its own. The directory around a
+   * missing one is not this run's to write (it is another agent's home), so
+   * nothing in the run can create it either — except under `isolate = "home"`,
+   * where the whole role home is writable and a missing one stays creatable.
+   */
+  const notMine = otherAgentsCredentials(agent, isolated ? roleHome(config, roleName) : homedir())
+    .filter((p) => process.platform !== "linux" || existsSync(p));
+  denyRead.push(...notMine);
+
   /**
    * `~/.claude` and `~/.codex` are closed only at the `home` level, and the
    * difference is the whole reason the two levels exist.
@@ -226,7 +288,7 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
    *
    * A reference has no path, so there is nothing here to allow: it is resolved
    * by the parent before the sandbox starts and handed over as an environment
-   * variable or as a scratch file. See keys.js. Filtering here rather than
+   * variable or as a file in the run directory. See keys.js. Filtering here rather than
    * upstream keeps the two kinds from having to know about each other — the
    * settings this function emits are still, entirely, about the filesystem.
    */
@@ -262,9 +324,9 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
   /**
    * Other runs' directories are unreadable; this run's is readable.
    *
-   * Every run keeps its socket and `scratch` keys under one root (rundir.js),
+   * Every run keeps its socket and `run-file` keys under one root (rundir.js),
    * and every role runs as the same user, so the directory mode protects
-   * nothing between roles. Measured: one role read another's scratch key while
+   * nothing between roles. Measured: one role read another's run-file key while
    * both ran. Same shape as the key directories: deny the parent, allow your own.
    */
   const runs = runsRootOf(spool);
@@ -272,7 +334,101 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
   if (runs) {
     denyRead.push(runs);
     allowRead.push(dirname(spool));
+    /**
+     * And the temp directories runs are given when their role may write no
+     * other (rundir.js, TMP_NAME): denied as a whole, this run's own allowed
+     * back. Same shape again, and for the same reason — every run is the same
+     * user, so a run could otherwise read what another left in its temp.
+     */
+    const tmps = join(dirname(runs), TMP_NAME);
+    denyRead.push(tmps);
+    if (tmp && (tmp === tmps || tmp.startsWith(tmps + "/"))) allowRead.push(tmp);
+    /**
+     * This run's settings are not this run's to read.
+     *
+     * They sit in the run's own directory, which the run reads for its run-file
+     * keys, so they were readable from inside: a map of every path left open
+     * and every one shut, handed to the process it confines. Not a defence on
+     * its own — the policy has to be right either way — but there is no reason
+     * to give an agent the list of doors to try. Named here, by the path
+     * rundir.js writes them to, because they do not exist yet.
+     */
+    denyRead.push(join(dirname(spool), SETTINGS_NAME));
+  }
+
+  /**
+   * `[runtime] read = "territory"`: the data roots are denied whole and what
+   * this role needs is allowed back inside them. See territory.js for why
+   * allowed back and no longer carved.
+   *
+   * Allowed back: the repo (key directories inside it stay denied by name,
+   * above), what the role writes, and what it declares in `reads` and
+   * `toolchain` — except where a deny above already covers it. A `reads`
+   * entry under `~/.ssh` stays shut, as it did when the mode only denied.
+   *
+   * Not allowed back twice: what is already re-allowed above — this run's
+   * directory, the role's own home, the key files.
+   */
+  /**
+   * Other roles' private folders: denied to read and to write, whatever this
+   * role's territory says and in either read mode.
+   *
+   * Deny-only, and never an allow for the owner: the owner reaches its folder
+   * the way it reaches the rest of its territory, and nobody else gets an
+   * allow anywhere near it. That is the shape that holds on both platforms —
+   * an allow around a deny is re-emitted after it on macOS, and a read allow
+   * is mounted over the writable mounts on Linux (territory.js).
+   *
+   * On Linux the folder is made first when it is missing: bubblewrap denies a
+   * missing path by putting something on the host in its place, and the owner
+   * would find a file where its folder should be. It is the owner's territory,
+   * so an empty folder there is what the policy already says. Only for a run
+   * (`forRun`, passed by `seisin run`): check, explain and the console ask for
+   * these settings too, and they write nothing to disk. For them a missing
+   * folder on Linux is left out — there is no run for it to be denied in.
+   */
+  const shut = othersPrivate(config, roleName, abs, { make: forRun });
+  denyRead.push(...shut);
+
+  const allowWrite = [
+    // Observing means the kernel stops refusing, because otherwise there is
+    // nothing to observe. `--observe` used to relax only the hook, so the
+    // sandbox denied the write anyway and the banner said "nothing denied"
+    // over a transcript of denials — and `init --from-observations` builds
+    // a policy out of that transcript. It would read "the agent needs
+    // nothing outside its territory", which is the opposite of the truth.
+    //
+    // The repo, and only the repo. Everything in denyWrite below still
+    // holds: the config, the state directory and the key directories stay
+    // shut even here, because observing is not a reason to hand over the
+    // paperwork of the confinement.
+    // One function answers "what may this role write" for the settings and
+    // for surface.js, which needs the union over every role. Two copies of
+    // that arithmetic would be two answers the day one of them changes.
+    ...writePathsOf(config, role, { observe, agent }),
+    ...(isFifo ? [spool] : []),
+    ...(tmp ? [tmp] : []),
+  ];
+
+  if (config.read === "territory") {
+    const reopened = allowRead.map(realOrSelf);
+    const inReopened = (p) => { const r = realAncestor(p); return reopened.some((a) => r === a || r.startsWith(a + "/")); };
+    // On Linux the runtime's apply-seccomp runs inside: see seccompDir.
+    const seccomp = process.platform === "linux" ? seccompDir() : null;
+    const keep = [...keptFor(config, role, { observe, agent, program }), ...(seccomp ? [seccomp] : [])]
+      .filter((p) => !inReopened(p));
+    const { deny, allow } = territoryReads(dataRoots(), keep, { writes: allowWrite, denied: [...denyRead] });
+    denyRead.push(...deny);
+    allowRead.push(...allow);
   }
+  // The key directory inside a repo that is now an allow: see outlastAllows.
+  const spelt = config.read === "territory" && process.platform === "darwin"
+    ? outlastAllows(denyRead, allowRead, realAncestor) : denyRead;
+
+  const allowedDomains = role.localPorts?.length
+    ? [...(role.network ?? config.allowedDomains ?? []), ...localPortDomains(role.localPorts)]
+    : role.network ?? config.allowedDomains;
+  const { credentials, tlsTerminate } = injectSettings(config, role, allowedDomains);
 
   return {
     network: {
@@ -280,38 +436,35 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
       // proxy is the one place that sees the destination PORT. See loopbackVia.
       // Without ports the value is passed through untouched, `undefined` included: that
       // is how a config with no network list has always read, and a spread would throw.
-      allowedDomains: role.localPorts?.length
-        ? [...(role.network ?? config.allowedDomains ?? []), ...localPortDomains(role.localPorts)]
-        : role.network ?? config.allowedDomains,
+      allowedDomains,
       deniedDomains: [],
+      // `[network] deny_addresses`: what an allowed name may not resolve to, on
+      // top of the runtime's own loopback / link-local / metadata set. Left out
+      // when empty, so a policy without it emits the settings it always did.
+      ...(config.deniedAddresses?.length ? { deniedResolvedAddresses: config.deniedAddresses } : {}),
+      /**
+       * `inject` keys terminate TLS, because substituting a header needs reading
+       * it. Only the hosts that carry a masked credential are terminated; every
+       * other allowed domain is excluded, so the MITM is as narrow as the policy
+       * lets it be. A wildcard allow that covers an inject host is terminated
+       * whole — srt cannot terminate one host out of `*.x` — and `check` says so.
+       */
+      ...(tlsTerminate ? { tlsTerminate } : {}),
       // Exactly one socket: the parent's audit spool, when there is a parent.
       // Granted by path, not by turning unix sockets on.
       allowUnixSockets: spool && !isFifo ? [spool] : [],
       // Per role, `local_binding = true`. Off by default: listening is a
       // capability, and most roles never need it.
       allowLocalBinding: role.localBinding === true,
+      // `browsers = ["chromium"]`: the Mach services the browser's own
+      // processes look up to find each other, by prefix (browsers.js). The
+      // register half has no field here; srt-mach.mjs adds it.
+      ...(machOf(role).lookup.length ? { allowMachLookup: machOf(role).lookup.map((p) => `${p}*`) } : {}),
     },
     filesystem: {
-      denyRead,
+      denyRead: spelt,
       allowRead,
-      allowWrite: [
-        // Observing means the kernel stops refusing, because otherwise there is
-        // nothing to observe. `--observe` used to relax only the hook, so the
-        // sandbox denied the write anyway and the banner said "nothing denied"
-        // over a transcript of denials — and `init --from-observations` builds
-        // a policy out of that transcript. It would read "the agent needs
-        // nothing outside its territory", which is the opposite of the truth.
-        //
-        // The repo, and only the repo. Everything in denyWrite below still
-        // holds: the config, the state directory and the key directories stay
-        // shut even here, because observing is not a reason to hand over the
-        // paperwork of the confinement.
-        // One function answers "what may this role write" for the settings and
-        // for surface.js, which needs the union over every role. Two copies of
-        // that arithmetic would be two answers the day one of them changes.
-        ...writePathsOf(config, role, { observe }),
-        ...(isFifo ? [spool] : []),
-      ],
+      allowWrite,
       /**
        * The confinement's own paperwork, never writable — not even by a role
        * that was granted the whole repo.
@@ -329,6 +482,8 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
        */
       denyWrite: [
         ...runtimeConvenience,
+        ...sharedTmp,
+        ...notMine,
         /**
          * The role's own subtractions, `never_writes`.
          *
@@ -353,6 +508,7 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
          * each member of the family is on it. `seisin check` prints it.
          */
         ...denyFor(config, role, { observe }).map((e) => e.path),
+        ...shut,
         // The audit socket, and the directory holding it. Denying only the
         // socket left `mv /tmp/seisin-xxxx /tmp/gone` as a way to take the
         // channel out without ever touching the file that was protected.
@@ -375,7 +531,81 @@ export function settingsFor(config, roleName, spool = null, observe = false) {
      * and off by default, so the answer is written next to the role that needs it.
      */
     ...(role.trustd === true ? { enableWeakerNetworkIsolation: true } : {}),
+    /**
+     * Masked credentials: the real value reaches the runtime's own environment
+     * (run.js), never the sandbox, which sees `fake_value_…`. `mode: "mask"`
+     * and the per-credential `injectHosts` are all that is emitted — no
+     * `extract`, `decode`, files or SigV4, and never `allowPlaintextInject`,
+     * which over HTTPS carries the sentinel and so is deny with extra steps.
+     */
+    ...(credentials ? { credentials } : {}),
+  };
+}
+
+/**
+ * A domain pattern covers a host — srt's rule, narrowed to what seisin needs.
+ * `*` covers all; `*.base` covers any `x.base`; otherwise an exact, case-folded
+ * match. Mirrors `matchesDomainPattern` in the runtime's domain-pattern.js;
+ * written here rather than imported because seisin generates settings and does
+ * not embed the library, and exported so `inspect/inject.js` shares the one
+ * rule. Inject hosts are exact (config.js rejects a wildcard), so
+ * this is only ever asked "does this allowedDomains pattern cover this host".
+ */
+export function coversHost(pattern, host) {
+  const p = String(pattern).toLowerCase(), h = host.toLowerCase();
+  if (p === "*") return true;
+  if (p.startsWith("*.")) return h.endsWith("." + p.slice(2));
+  return h === p;
+}
+
+/**
+ * The `credentials` block and `tlsTerminate.excludeDomains` for a role's
+ * `inject` keys, or `{}` when it has none. One `envVars` entry per credential,
+ * `mode: "mask"` with its own `injectHosts`; TLS is terminated only for the
+ * domains that carry one, every other allowed domain excluded. Throws when an
+ * inject host is not reachable through the role's `allowedDomains` — a masked
+ * credential aimed at a host the role cannot connect to is a policy mistake,
+ * not a thing to emit silently.
+ */
+export function injectSettings(config, role, allowedDomains) {
+  const inject = injectKeysOf(config, role);
+  if (inject.length === 0) return {};
+  const allowed = allowedDomains ?? [];
+  for (const c of inject)
+    for (const h of c.hosts)
+      if (!allowed.some((p) => coversHost(p, h)))
+        throw new Error(
+          `roles.${role.name}: inject host ${h} (for ${c.name}) is not reachable.\n` +
+          `  A masked credential is substituted only on egress to its host, and this role's ` +
+          `network does not allow ${h}. Add it: [roles.${role.name}] network = ["${h}", …], ` +
+          `or correct the host in inject_hosts.`);
+  const credentials = {
+    envVars: inject.map((c) => ({ name: c.name, mode: "mask", injectHosts: c.hosts })),
   };
+  // Terminate a domain only if it carries an inject host; exclude the rest.
+  const targets = inject.flatMap((c) => c.hosts);
+  const excludeDomains = allowed.filter((d) => !targets.some((h) => coversHost(d, h)));
+  return { credentials, tlsTerminate: { excludeDomains } };
+}
+
+/**
+ * The private folders of every role but `roleName`, absolute, in both
+ * spellings (as written and as the kernel meets it through a symlink).
+ */
+export function othersPrivate(config, roleName, abs = (p) => (p.startsWith("/") ? p : join(config.root, p)), { make = false } = {}) {
+  const out = [];
+  for (const r of Object.values(config.roles))
+    if (r.name !== roleName)
+      for (const entry of r.private ?? []) {
+        const p = abs(privateDir(entry));
+        if (process.platform === "linux" && !existsSync(p)) {
+          if (!make) continue;
+          try { mkdirSync(p, { recursive: true }); } catch { continue; }
+        }
+        const real = realAncestor(p);
+        out.push(...(real === p ? [p] : [p, real]));
+      }
+  return out;
 }
 
 /** Creates `p` when its parent exists and a role may write there; says whether it now exists. */