seisin 0.5.0 → 0.6.0

package/src/inspect/credentials.js

@@ -0,0 +1,48 @@
+import { join } from "node:path";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { SHAPES } from "../scan.js";
+
+/**
+ * Credential-shaped names at the top of the repository, and nothing deeper.
+ *
+ * One `readdir`, no recursion, conventional names only. It exists to answer
+ * "does this repo plausibly have secrets" fast enough to run on every `check`,
+ * not to find them — `seisin scan` is the one that looks properly.
+ */
+const CREDENTIAL_NAMES = /^(\.env(\..+)?|\.secrets|secrets|\.netrc|.*\.(pem|key|p12|pfx))$/i;
+
+export function credentialish(root) {
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const found = new Set(entries.filter((e) => CREDENTIAL_NAMES.test(e.name)).map((e) => e.name));
+
+  /**
+   * And the ones whose name gives nothing away.
+   *
+   * The name test misses `credentials.txt`, `tokens.conf`, `config.local` —
+   * which a field review found by writing a test file this did not catch, and
+   * then blaming the test. The test was fine; the detector was name-only.
+   *
+   * So the root's small text files are also read, with the same shapes
+   * `seisin scan` uses. Root only, small only, and it stops at the first hit
+   * per file: this runs on every `check` and the full walk is `scan`'s job.
+   */
+  const CERTAIN = SHAPES.filter(([c]) => c === "certain").map(([, , re]) => re);
+  for (const e of entries) {
+    if (found.size >= 4) break;
+    if (!e.isFile() || found.has(e.name)) continue;
+    try {
+      const p = join(root, e.name);
+      if (statSync(p).size > 64 * 1024) continue;
+      const text = readFileSync(p, "utf8");
+      if (CERTAIN.some((re) => re.test(text))) found.add(e.name);
+    } catch {
+      /* unreadable, or not text: not our business here */
+    }
+  }
+  return [...found].sort().slice(0, 4);
+}

package/src/inspect/enforce.js

@@ -0,0 +1,24 @@
+import { settingsFor } from "../srt.js";
+
+export function enforceWarnings(config, roles) {
+  const warnings = [];
+  // A pattern the kernel cannot be given is not a policy, it is a sentence that
+  // reads like one. `run` refuses it; `check` exists precisely so you find that
+  // out while reading the map rather than mid-run.
+  for (const r of roles) {
+    try {
+      settingsFor(config, r.name);
+    } catch (e) {
+      // Whatever settingsFor refuses, `run` will refuse too. The label used to
+      // say "unenforceable-glob" for every one of them, which mislabelled the
+      // key-outside-its-directory error as a glob problem — a warning that
+      // names the wrong cause sends the reader to the wrong line.
+      warnings.push({
+        kind: "cannot-be-enforced",
+        headline: `${r.name}: ${e.message.split("\n")[0]}`,
+        detail: e.message.split("\n").slice(1).map((s) => s.trim()).filter(Boolean).join(" "),
+      });
+    }
+  }
+  return warnings;
+}

package/src/inspect/files.js

@@ -0,0 +1,71 @@
+import { resolve } from "node:path";
+import { lstatSync, readdirSync } from "node:fs";
+
+/**
+ * A role's territory, sorted by what the kernel will do with each line.
+ *
+ * Three shapes get through `settingsFor` (see EXPRESSIBLE in srt.js): the whole
+ * repo, a subtree `x/**`, and a literal path. The literal path is the one the
+ * text cannot settle on its own — `data/base.sqlite` and `data` are both
+ * literal, and to the kernel the second is a subtree because it is a directory.
+ * So the disk is asked, once per line: a regular file is a file, a directory is
+ * a subtree, and anything else — absent, a symlink, a socket — goes in neither
+ * count rather than being guessed at. That is one `lstat` per declared path,
+ * bounded by the length of the policy and not the size of the repo, which is
+ * the line `check` stays on.
+ *
+ * Subtrees come back as the absolute prefix the kernel will be handed, so that
+ * "is this file's folder inside that grant" is the same comparison the kernel
+ * makes — a prefix — and not a second reading of the glob.
+ */
+export function territoryOf(config, role) {
+  const root = resolve(config.root);
+  const abs = (p) => resolve(root, p);
+  const files = [];
+  const subtrees = [];
+  for (const glob of role.writes) {
+    if (glob === "**" || glob.endsWith("/**")) {
+      subtrees.push(abs(glob === "**" ? "." : glob.slice(0, -3)));
+      continue;
+    }
+    if (/[*?[\]]/.test(glob)) continue;      // already refused above as cannot-be-enforced
+    if (implicitSidecar(role, glob)) continue; // part of its database, not a file of its own
+    const s = lstatOrNull(abs(glob));
+    if (s?.isFile()) files.push({ glob, abs: abs(glob) });
+    else if (s?.isDirectory()) subtrees.push(abs(glob));
+  }
+  return { files, subtrees };
+}
+
+/**
+ * A `-wal`, `-shm` or `-journal` the role has because it writes the database
+ * beside it — the expansion in config.js, which `writes` carries. It is the
+ * same resource as the database, so it is not counted or reported as another
+ * file. One declared WITHOUT its database is the role's own, and counts.
+ */
+export function implicitSidecar(role, glob) {
+  const m = /^(.*\.sqlite3?)-(wal|shm|journal)$/.exec(glob);
+  return !!m && role.writes.includes(m[1]);
+}
+
+/** Is `p` the prefix, or somewhere beneath it. The kernel's own test, in one line. */
+export function under(p, prefix) {
+  return p === prefix || p.startsWith(prefix + "/");
+}
+
+/** The regular files directly inside `dir`, by name. Not folders, not links, not deeper. */
+export function regularFilesIn(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((d) => d.isFile()).map((d) => d.name).sort();
+  } catch {
+    return [];
+  }
+}
+
+function lstatOrNull(p) {
+  try {
+    return lstatSync(p);
+  } catch {
+    return null;
+  }
+}

package/src/inspect/home.js

@@ -0,0 +1,43 @@
+import { CREDENTIAL_HOMES } from "../srt.js";
+
+/**
+ * What a role can still read in YOUR home, which is the limit people are most
+ * surprised by.
+ *
+ * `~/.ssh`, `~/.aws/credentials`, `~/.npmrc` and `~/.config/gh/hosts.yml` are
+ * ordinary readable files to every role unless `[runtime] isolate` says
+ * otherwise, and nothing on screen said so. Reads outside the key directories
+ * being open is a deliberate trade - an agent that cannot read the machine
+ * cannot work - but a trade nobody was shown is not a trade they made.
+ *
+ * It reports the level rather than pushing one. `credentials` closes those four
+ * and leaves the agent logged in; `home` closes the agent's own directories too
+ * and costs the session. Which of the two you want is the threat model, which
+ * is why there is no default beyond off.
+ */
+export function homeReachWarning(config) {
+  if (config.read === "territory") return null;
+  const level = config.isolate === true ? "home" : config.isolate;
+  if (level === "home") return null;             // nothing left to say
+
+  const where = CREDENTIAL_HOMES.slice(0, 4).join(" ");
+  return level === "credentials"
+    ? {
+        kind: "home-partly-open",
+        headline: "your credentials are closed to every role; the agent's own directories are not",
+        detail:
+          `isolate = "credentials" denies ${where} and the rest. What stays open is ` +
+          "~/.claude to runs of claude and ~/.codex to runs of codex, which is what keeps the " +
+          "agent signed in, so the runs of one agent share its session and can read each other's. " +
+          '`isolate = "home"` closes those ' +
+          "too, and then every CLI in the sandbox will ask you to log in again.",
+      }
+    : {
+        kind: "home-open",
+        headline: `every role can read ${where} and the rest of your home`,
+        detail:
+          "reads outside the [keys] dir are open on purpose - an agent that cannot read the " +
+          "machine cannot work - but that includes the places credentials live. " +
+          '`[runtime] isolate = "credentials"` closes them, and the agent stays logged in.',
+      };
+}

package/src/inspect/inject.js

@@ -0,0 +1,68 @@
+/**
+ * Warnings for `key_mode = "inject"`: the MITM it costs, the traffic it
+ * widens, the one thing it does not close, and the platform it does not run on.
+ *
+ * Masking is the only mode where the agent never sees the value, and it is the
+ * only one that reads the role's encrypted traffic to do it. A reader of
+ * `check` should see, per masked credential: which hosts are intercepted (and
+ * when a wildcard allow drags more than the one host under interception), that
+ * the value is still recoverable by reflection, and — off Linux — that the role
+ * will not run here. None of this is a reason not to use inject; it is the
+ * price printed next to the thing it buys.
+ */
+import { injectKeysOf } from "../keys.js";
+import { coversHost as covers } from "../srt.js";
+
+export function injectWarnings(config, roles) {
+  const out = [];
+  for (const r of roles) {
+    let inject;
+    try {
+      inject = injectKeysOf(config, r);
+    } catch (e) {
+      const [headline, ...rest] = e.message.split("\n");
+      out.push({ kind: "cannot-be-enforced", role: r.name, headline, detail: rest.join("\n").trim() });
+      continue;
+    }
+    if (inject.length === 0) continue;
+    const allowed = r.network ?? config.allowedDomains ?? [];
+
+    if (process.platform !== "linux")
+      out.push({
+        kind: "inject-platform",
+        role: r.name,
+        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform} — it is Linux-only for now`,
+        detail: `On this machine the role will not run. Masked injection on macOS is tracked upstream ` +
+          `(anthropics/sandbox-runtime#593) and enables once that lands. Run this role on Linux, or ` +
+          `use "env"/"run-file" here.`,
+      });
+
+    for (const c of inject) {
+      const terminated = new Set();
+      const wholesale = [];
+      for (const h of c.hosts)
+        for (const p of allowed)
+          if (covers(p, h)) {
+            terminated.add(p);
+            if (p.startsWith("*.")) wholesale.push({ pattern: p, host: h });
+          }
+      const under = [...terminated].join(", ") || "(none reachable — check network)";
+      const wildcardNote = wholesale.length
+        ? ` The wildcard ${wholesale.map((w) => w.pattern).join(", ")} is terminated whole, not just ` +
+          `${wholesale.map((w) => w.host).join(", ")}: srt cannot intercept one host out of a wildcard.`
+        : "";
+      out.push({
+        kind: "inject-mitm",
+        role: r.name,
+        headline: `${r.name}: ${c.name} is masked (agent sees a fake); TLS terminated for ${under}`,
+        detail:
+          `seisin reads this role's HTTPS to ${under} with a CA of its own, to substitute the real token ` +
+          `on the way out.${wildcardNote} The token is still recoverable by reflection: if ${c.hosts.join("/")} ` +
+          `stores what the agent sends and returns it later (an issue, a gist, a comment, a note), the agent ` +
+          `can POST the sentinel, have the host keep the real value, and read it back. inject stops the agent ` +
+          `from seeing the token directly and from sending it anywhere else — not this. Use a least-scope token.`,
+      });
+    }
+  }
+  return out;
+}

package/src/inspect/keys.js

@@ -0,0 +1,74 @@
+import { entriesOf } from "../keys.js";
+import { credentialish } from "./credentials.js";
+
+export function envWarnings(roles) {
+  const warnings = [];
+  // `env` is a hole in the [keys] model, on purpose: some tools only take a
+  // credential through the environment. It should still be loud, because it is
+  // the one place a secret reaches a role without being a declared key.
+  const SECRETISH = /(TOKEN|KEY|SECRET|PASSWORD|PASSWD|AUTH|COOKIE|SESSION|PRIVATE|CREDENTIAL)/i;
+  for (const r of roles) {
+    const risky = (r.env ?? []).filter((n) => SECRETISH.test(n));
+    if (risky.length)
+      warnings.push({
+        kind: "secret-through-env",
+        headline: `${r.name} receives ${risky.join(", ")} through the environment`,
+        detail:
+          "that bypasses [keys] entirely: it is not scoped, not redacted by name, and not " +
+          "visible in the key map. Declare it as a key file where the tool allows one.",
+      });
+  }
+  return warnings;
+}
+
+export function keyFloorWarnings(config) {
+  const warnings = [];
+  /**
+   * A policy with no credential floor at all, in a repo that has credentials.
+   *
+   * `[keys] dir` is what produces `denyRead`. Without it the emitted settings
+   * carry an empty deny list, so every role reads every secret in the
+   * repository — and until this warning, nothing said so. The existing
+   * `keys-unscoped` only fires when a role *lists* keys, which is the case
+   * where somebody already thought about it.
+   *
+   * The dangerous shape is the other one, and it is not hypothetical: a policy
+   * generated by a script. The deployment this was built against generates its
+   * `seisin.toml` from a Python program, and declares `[keys] dir` mostly so
+   * `scan` skips those directories. A generator that dropped that one line
+   * would hand every role the credential tree and produce a clean `check`.
+   *
+   * Credit where it is due: this is `L-01` of a code review of another
+   * project's contract type, which makes its credential floor impossible to
+   * construct empty. That is the right shape and it is a bigger change than a
+   * warning. This is the cheap half — and the review's claim that the file
+   * path was safe turned out to be generous: it was not.
+   *
+   * Deliberately NOT a full `seisin scan`: that walks the tree and `check` has
+   * to stay instant. A shallow look at the repository root catches the
+   * conventional places and costs one `readdir`.
+   */
+  if ((config.keyDirs ?? []).length === 0) {
+    const found = credentialish(config.root);
+    if (found.length)
+      warnings.push({
+        kind: "no-key-floor",
+        headline: `no [keys] dir is declared, and this repo has ${found.join(", ")} — every role can read them`,
+        detail:
+          "Without a key directory the emitted policy denies no reads at all. Declare the " +
+          "directory your secrets live in, and the roles that may read each one.",
+      });
+  }
+
+  // Only a key that is a PATH needs a key directory. A config whose secrets all
+  // live in a vault has no `[keys] dir` and nothing wrong with it, and warning
+  // there would be the tool insisting on the arrangement it was built for.
+  if (config.keyDirs.length === 0 &&
+      Object.values(config.roles).some((r) => entriesOf(r).some((k) => k.kind === "file")))
+    warnings.push({
+      kind: "keys-unscoped",
+      headline: "keys are listed but [keys] dir is unset — nothing will be scoped",
+      detail: null,
+    });
+  return warnings;
+}

package/src/inspect/layout.js

@@ -0,0 +1,258 @@
+import { resolve, dirname, basename, relative, join } from "node:path";
+import { existsSync } from "node:fs";
+import { territoryOf, implicitSidecar, under, regularFilesIn } from "./files.js";
+import { covers } from "../owners.js";
+
+export function layoutWarnings(config, roles, scoped) {
+  const warnings = [];
+  // A territory that leaves the repo is supported — a role can own its handover
+  // note one level up — but it is a different promise from "this repo, divided",
+  // and it should be a sentence somebody chose rather than a line that drifted.
+  const loose = [];      // roles granting individual files
+  const listed = [];     // role + folder pairs that enumerate
+
+  /**
+   * A private folder inside another role's territory. Allowed — it is how a
+   * folder is taken out of a wide `writes = ["**"]` — but that role loses it,
+   * reading included, and nothing in its own table says so.
+   */
+  for (const r of roles)
+    for (const p of r.private ?? []) {
+      const dir = p.replace(/\/\*\*$/, "").replace(/\/+$/, "").replace(/^\.\//, "");
+      for (const o of Object.values(config.roles)) {
+        if (o.name === r.name) continue;
+        const g = (o.writesDeclared ?? o.writes).find((w) => covers(w, dir));
+        if (g)
+          warnings.push({
+            kind: "private-inside-territory",
+            headline: `${r.name}: private "${p}" is inside ${o.name}'s writes ("${g}") — ${o.name} can neither read nor write it`,
+            detail: `Every role but ${r.name} is denied the folder, and the deny wins over ${o.name}'s territory. ` +
+              `If ${o.name} needs what is in it, it asks ${r.name}; if it should keep it, the folder is not private.`,
+          });
+      }
+    }
+
+  for (const r of roles) {
+    const out = r.writes.filter((w) => w.startsWith("/") || w.startsWith("../"));
+    if (out.length)
+      warnings.push({
+        kind: "territory-outside-repo",
+        headline: `${r.name} writes outside this repo: ${out.join(" ")}`,
+        detail: "the sandbox will grant it. Nothing here checks what lives there.",
+      });
+  }
+
+  /**
+   * A territory that is not on disk.
+   *
+   * A proposal written for another repo — or one typo — reads as a working
+   * policy: `check` printed the map and the first sign of anything wrong was a
+   * denial inside the agent. Said per glob, as a warning and never a failure:
+   * a role can own a folder it is about to create.
+   */
+  for (const r of roles) {
+    for (const g of r.writes) {
+      if (g === "**" || g.startsWith("/") || g.startsWith("../")) continue;
+      // A database's sidecars come with it (config.js) and exist only while it
+      // is open: absent on disk is their normal state, not a typo to report.
+      if (implicitSidecar(r, g)) continue;
+      const fixed = [];
+      for (const part of g.split("/")) {
+        if (/[*?[\]]/.test(part)) break;
+        fixed.push(part);
+      }
+      if (!fixed.length || existsSync(join(config.root, ...fixed))) continue;
+      warnings.push({
+        kind: "writes-match-nothing",
+        headline: `${r.name} writes ${g} — matches nothing in this repo`,
+        detail: "fine if the role is about to create it; otherwise the territory points at a folder that is not there.",
+      });
+    }
+  }
+
+  /**
+   * A territory inside a key directory.
+   *
+   * Seen in use: a role's whole territory sat under the folder declared as
+   * `[keys] dir`, which is closed to every role, so the role could write
+   * nothing at all — and `check` printed its territory as if it held. A key
+   * directory is read by the roles that declare a key in it and written by
+   * none; a folder a role must write belongs somewhere else.
+   */
+  const keyRoots = (config.keyDirs ?? []).map((d) => d.replace(/\/+$/, "")).filter(Boolean);
+  for (const r of roles) {
+    for (const g of r.writes) {
+      const fixed = [];
+      for (const part of g.split("/")) {
+        if (/[*?[\]]/.test(part)) break;
+        fixed.push(part);
+      }
+      const at = fixed.join("/");
+      const dir = at && keyRoots.find((d) => at === d || at.startsWith(d + "/"));
+      if (!dir) continue;
+      warnings.push({
+        kind: "territory-in-key-dir",
+        headline: `${r.name} writes ${g} — inside the key directory ${dir}, which no role can write`,
+        detail: "a key directory is read by the roles that declare its keys and written by none. Move what this role writes out of it, or drop the territory.",
+      });
+    }
+  }
+
+  /**
+   * A file granted by name does not come with its neighbours.
+   *
+   * Measured, in production, and it survived two reviews of the policy by people:
+   * a role was granted its database file and still could not write the
+   * database. The database opens a second file beside the first — a journal —
+   * and the sibling was outside the grant, so the write failed in the
+   * database's own words ("readonly") rather than as a permission error.
+   *
+   * What is deliberately NOT here: a list of which programs write which
+   * siblings. That would ask seisin to know about databases, and the next
+   * question is why it does not know about a lock file, the temporary file of
+   * an atomic write, or an editor's backup. The list has no end and every entry
+   * is a guess about a repo nobody foresaw. The general form needs no list: the
+   * kernel grants a path and everything under it, so a grant on a file covers
+   * the file and nothing else. Whether a tool will want a neighbour is the
+   * reader's to know; that the neighbour is not granted is arithmetic.
+   */
+  for (const r of roles) {
+    const { files, subtrees } = territoryOf(config, r);
+    // A file inside one of the role's own subtrees has its siblings covered by
+    // that subtree, so naming it changes nothing and warns about nothing.
+    const alone = files.filter((f) => !subtrees.some((s) => under(dirname(f.abs), s)));
+    if (alone.length)
+      loose.push({ role: r.name, n: alone.length, of: r.writes.filter((g) => !implicitSidecar(r, g)).length,
+                   globs: alone.map((f) => f.glob) });
+
+
+    /**
+     * A territory written as a list of files is a photograph of the folder.
+     *
+     * A sandbox cannot say "the source files in this folder" — one level down
+     * is not a prefix, and `src/*` is refused above for exactly that reason,
+     * correctly. So a territory that means that has to be written as the files
+     * that exist today, and the day a file is added the policy is one behind:
+     * the owning role cannot write its own new file, and nothing fails loudly.
+     *
+     * Reported as a count, never as a verdict. "Comparable" here means only
+     * "a regular file in the same folder" — not the same extension, not the
+     * same shape of name, because either of those is a guess about what the
+     * territory *meant*, and a guess about intent is the thing this check
+     * exists to avoid. The unnamed files are listed by name instead, so the
+     * reader can see in one glance whether the gap is an oversight or a
+     * decision. seisin cannot tell, and does not pretend to.
+     *
+     * Silent when a folder has fewer than two named files (one file is a
+     * grant, not an enumeration) and when the folder is also granted as a
+     * subtree (then the list is decorative).
+     */
+    const byDir = new Map();
+    for (const f of alone) {
+      const dir = dirname(f.abs);
+      if (!byDir.has(dir)) byDir.set(dir, []);
+      byDir.get(dir).push(basename(f.abs));
+    }
+    for (const [dir, named] of byDir) {
+      if (named.length < 2) continue;
+      const onDisk = regularFilesIn(dir);
+      const unnamed = onDisk.filter((n) => !named.includes(n));
+      if (!unnamed.length) continue;
+      const shown = relative(resolve(config.root), dir);
+      listed.push({ role: r.name, named: named.length, total: onDisk.length,
+                    where: shown ? shown + "/" : "the repo root", unnamed });
+
+    }
+  }
+
+  /**
+   * One warning per finding, not one per role.
+   *
+   * These were emitted inside the role loop, which reads fine on the two-role
+   * fixture they were written against and falls apart on a real policy: 30
+   * roles produced 39 of these lines and took `seisin check` from 30 lines to
+   * **297**. That is the defect the detail text below is about — a check nobody
+   * finishes reading protects nobody — reached from the other side.
+   *
+   * So the count leads and a few examples follow. Whoever wants the full list
+   * has `seisin check <role>`, which is the question they were asking anyway.
+   */
+  if (loose.length) {
+    const shown = loose.slice(0, 3).map((l) => `${l.role} (${l.n} of ${l.of})`).join(", ");
+    const more = loose.length > 3 ? `, and ${loose.length - 3} more` : "";
+    warnings.push({
+      kind: "siblings-uncovered",
+      headline:
+        `${loose.length} role(s) grant individual files rather than folders: ${shown}${more}`,
+      detail:
+        "the kernel grants exactly that path. Anything a tool creates beside it — a " +
+        "database's journal, a lock file, the temporary file of an atomic write — is a " +
+        "sibling, and a sibling is outside the grant; the failure arrives in the tool's " +
+        "own words, not as a permission error. Grant the folder where the tool needs " +
+        "neighbours. " +
+        (scoped
+          ? `The files: ${loose[0].globs.join(" ")}.`
+          : "`seisin check <role>` names the files for one role."),
+    });
+  }
+
+  /**
+   * The one sibling that is not a guess: Claude Code's own.
+   *
+   * Claude Code's Edit and Write do not write the file. They write
+   * `<file>.tmp.<pid>.<12 hex>` beside it and rename it over, so a role that
+   * holds a file by name and not its folder is refused at the temporary file
+   * on every edit — EPERM, and the agent goes around it with a shell (measured:
+   * 4 EPERM in one real run). No grant can name that file: its name changes on
+   * every edit, and a write grant takes no glob (the runtime drops them; seisin
+   * refuses one above). So the choice is the folder, or the shell — said per
+   * role, which is where the decision is made.
+   *
+   * Said whatever agent the role runs: check cannot know, and a role that runs
+   * something else reads one line it can skip. Three roles by name and the rest
+   * as a count, for the reason the warning above gives.
+   */
+  for (const l of loose.slice(0, 3)) {
+    // A file at the root has the whole repo for a folder, which is not a
+    // suggestion: then the move is to put it in a folder of its own.
+    const dirs = [...new Set(l.globs.map((g) => dirname(g)).filter((d) => d !== "."))].map((d) => `${d}/**`);
+    const fix = dirs.length
+      ? `Either grant the folder (${dirs.join(", ")})`
+      : "Its folder is the repo root, so either move it into a folder the role can own whole and grant that";
+    warnings.push({
+      kind: "claude-atomic-write",
+      headline: `${l.role}: writes ${l.globs.slice(0, 3).join(" ")}${l.globs.length > 3 ? ` +${l.globs.length - 3}` : ""} by name — ` +
+        "Claude Code's Edit and Write on it fail (EPERM)",
+      detail:
+        "Claude Code edits a file by writing <file>.tmp.<pid>.<random> beside it and renaming it over; " +
+        "the temporary file is outside a grant on the file, and no grant can name it — its name changes " +
+        `on every edit and a write grant takes no glob. ${fix}, ` +
+        "or accept that the agent writes it with its shell (a redirect writes the file itself) instead of Edit. " +
+        "A role that does not run Claude Code can ignore this.",
+    });
+  }
+  if (loose.length > 3)
+    warnings.push({
+      kind: "claude-atomic-write",
+      headline: `${loose.length - 3} more role(s) write files by name, where Claude Code's Edit and Write fail: seisin check <role>`,
+      detail: "",
+    });
+
+  if (listed.length) {
+    const shown = listed.slice(0, 3)
+      .map((l) => `${l.role} names ${l.named} of ${l.total} in ${l.where}`).join("; ");
+    const more = listed.length > 3 ? `; and ${listed.length - 3} more` : "";
+    warnings.push({
+      kind: "enumerated-territory",
+      headline: `${listed.length} territory(ies) list some files of a folder: ${shown}${more}`,
+      detail:
+        `not named, in the first of them: ${listed[0].unnamed.slice(0, 8).join(" ")}` +
+        `${listed[0].unnamed.length > 8 ? ` … and ${listed[0].unnamed.length - 8} more` : ""}` +
+        `. A sandbox grants a path, ` +
+        `not "the files of this kind here", so a territory that means that is the list of files ` +
+        `that existed when it was written — the next one added lands outside it, and nothing ` +
+        `fails loudly. Whether these are left out on purpose is not something a count can tell.`,
+    });
+  }
+  return warnings;
+}