seisin 0.6.1 → 0.6.3

package/README.md

@@ -280,6 +280,7 @@ seisin explain frontend write src/api/x  # ask one question, exit 0 or 1
 seisin review --since 7d                 # what the log says about the policy, this week
 seisin wire                              # install the PreToolUse hook in this repo
 seisin ui                                # a console for deciding what is waiting
+seisin ui --runs <dir>                   # read only, over many runs a launcher archived (docs/runs.md)
 ```
 
 **Three ways in, and they say the same thing.** The **CLI** is what a person types and what
@@ -854,7 +855,7 @@ A **provider** is a command with a `{ref}` placeholder, so adding 1Password, Bit
 confined process. Nothing degrades: a provider that fails stops the run.
 
 A key reaches the role as a variable (`key_mode = "env"`), as a file in the run's private
-directory (`"run-file"`), or, on Linux, not at all: with `"inject"` the agent holds a
+directory (`"run-file"`), or not at all (on Linux, and on macOS under tartaros): with `"inject"` the agent holds a
 placeholder and the sandbox swaps in the real value only on the way to the hosts you list for
 it. That costs terminating TLS to those hosts, which `seisin check` names, and a host that
 stores what it is sent can still hand the value back — use a least-scope token.
@@ -1036,9 +1037,9 @@ the same kernel or workspace, and which one you want depends on what you are pro
 
 ## Status
 
-**1090 tests on macOS, 1083 passing and 7 platform skips** (0.6.1, 2026-10-26, local); in CI the
-same day, on `ubuntu-latest` **1089, 1060 passing and 29 platform skips**, and on macOS 1090,
-1081 passing and 9 skips, Node 18/20/22/24, with the 26 core boundary tests skipping none. On 2026-10-12, 91 of the suite's tests
+**1103 tests on macOS, 1096 passing and 7 platform skips** (after 0.6.3, 2026-10-26, local); in CI the
+same day, on `ubuntu-latest` **1100, 1071 passing and 29 platform skips**, and on macOS 1101,
+1092 passing and 9 skips, Node 18/20/22/24, with the 26 core boundary tests skipping none. On 2026-10-12, 91 of the suite's tests
 needed `@anthropic-ai/sandbox-runtime` installed — counted by running it with the runtime
 hidden — and run real commands through the real kernel; 26 of them are the core boundary file,
 `test/sandbox.test.js`, which the CI gate fails if it *skips*, because a green run that quietly

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it denies something it tells you whose file it was.",
   "keywords": [
     "ai-agents",
@@ -45,7 +45,7 @@
     "@anthropic-ai/sandbox-runtime": "0.0.81"
   },
   "optionalDependencies": {
-    "@carlostapiacl/tartaros": "0.1.0-alpha.14"
+    "@carlostapiacl/tartaros": "0.1.0-alpha.16"
   },
   "scripts": {
     "test": "node --test test/*.test.js",

package/src/canary.js

@@ -130,6 +130,16 @@ export async function runCanary({ srt, wrap = null, settingsFile, settings, env,
   }
 
   if (timedOut) failed.push(`the canary did not finish in ${timeoutMs / 1000}s`);
+  // tartaros refuses a run whose real value another process exposes (its exec
+  // record, which the agent can read; on macOS no sandbox hides it). That is not
+  // a boundary to fix in the policy, and its own advice names a flag seisin does
+  // not pass, so it is said apart, as the variable and the process.
+  const exposed = [...stderr.matchAll(/tartaros: secret exposed: the value of (\S+) in pid (\d+) \(([^)]*)\)/g)]
+    .map(([, name, pid, proc]) => ({ name, pid: Number(pid), proc }));
+  if (exposed.length) {
+    for (const p of [secret, outside, insideDir, shared]) if (p) try { rmSync(p, { force: true, recursive: p === insideDir }); } catch {}
+    return { ok: false, exposed, failed: exposed.map((e) => `${e.name}'s real value is readable in pid ${e.pid} (${e.proc})`), ms: Date.now() - t0 };
+  }
   if (!output.includes(`ALIVE-${nonce}`)) {
     // The runtime's own words, when it said any: a sandbox that refuses to
     // start usually says why (measured: a path the runtime read as a broken

package/src/cli.js

@@ -57,6 +57,7 @@ ${C.b}seisin${C.off} — give each agent its own folders and its own keys
   seisin init [--force]                 propose a ${CONFIG_NAME} for this repo
   seisin init --from-observations       write ${CONFIG_NAME}.observed from observed runs
   seisin ui [--port n] [--link]         open the console, live (--link reopens a running one)
+  seisin ui --runs <dir> [--link --json]  a read-only console over a directory of runs (docs/runs.md)
   seisin mcp                            an MCP server on stdio — read-only
 
 seisin <command> --help lists a command's flags, examples and exit codes.
@@ -105,7 +106,7 @@ const COMMANDS = {
   },
   // --link only reads a record; it answers without a policy here too, and
   // says so when the console it finds serves another one.
-  ui: async () => (await import("./commands/ui.js")).ui(argv.includes("--link") ? maybeConfig() : config(), argv),
+  ui: async () => (await import("./commands/ui.js")).ui(argv.includes("--link") || argv.includes("--runs") ? maybeConfig() : config(), argv),
   whose: async () => void (await import("./commands/whose.js")).whose(config(), argv),
   wire: async () => void (await import("./commands/wire.js")).wire(config()),
   review: async () => ((await import("./commands/review.js")).reviewCommand(config(), argv).friction.length ? 1 : 0),

package/src/commands/run.js

@@ -496,6 +496,14 @@ export async function run(config, argv) {
       event: "canary", role, run: theRun.id.slice(0, 8), ...trace, agent: agent ?? null, confined: false, reasons: probe.failed,
       ...(sandbox.name === DEFAULT_SANDBOX ? {} : { sandbox: sandbox.name }),
     });
+    if (probe.exposed) {
+      err(`${C.red}seisin: ${role} was NOT started — another process holds a real value the agent would see:${C.off}\n` +
+        probe.failed.map((f) => `  - ${f}\n`).join("") +
+        `  A process's environment and arguments are readable by every process of your user (on macOS no sandbox ` +
+        `hides them), so masking would hide nothing. Usually a shell that exported the token, and what it started. ` +
+        `Unset it there or end that process, and keep the value only where seisin's key points (docs/keys.md).\n`);
+      process.exit(CANARY_EXIT);
+    }
     err(`${C.red}seisin: ${role} was NOT started — the sandbox failed its canary:${C.off}\n` +
       probe.failed.map((f) => `  - ${f}\n`).join("") +
       `  The policy as generated does not hold on this machine, so no agent runs under it. ` +

package/src/commands/ui.js

@@ -14,6 +14,8 @@
  * failing. See uilink.js.
  */
 import { spawnSync } from "node:child_process";
+import { statSync } from "node:fs";
+import { resolve } from "node:path";
 import { serve } from "../serve.js";
 import { writeUiLink, readUiLink, clearUiLink } from "../uilink.js";
 import { C, out } from "../render.js";
@@ -23,28 +25,58 @@ function open(url) {
   spawnSync(opener, [url], { stdio: "ignore", shell: process.platform === "win32" });
 }
 
+/**
+ * `--runs <dir>`: the console over a directory of runs, read only (runs.js,
+ * docs/runs.md), on 4179 unless told otherwise, so it does not take the port a
+ * repository's own console would want.
+ */
+function runsDirOf(argv) {
+  const i = argv.indexOf("--runs");
+  if (i === -1) return null;
+  const dir = argv[i + 1];
+  if (!dir || dir.startsWith("--")) throw new Error("--runs needs a directory: seisin ui --runs <dir>");
+  let st = null;
+  try { st = statSync(dir); } catch {}
+  if (!st?.isDirectory()) throw new Error(`--runs ${dir}: not a directory`);
+  return resolve(dir);
+}
+
 export async function ui(config, argv = []) {
+  const runsDir = runsDirOf(argv);
+  const mode = runsDir ? "runs" : "policy";
   const i = argv.indexOf("--port");
-  const port = i === -1 ? 4178 : Number(argv[i + 1]);
+  const port = i === -1 ? (runsDir ? 4179 : 4178) : Number(argv[i + 1]);
+  const json = argv.includes("--json");
 
   // `seisin ui --link`: print the live link a running console left, and open
   // it, without starting anything. For when the terminal that had it is gone.
+  // With --json, the record for a program to read — `{url, port, mode}` — and
+  // nothing opened: the launcher's own panel links to it.
   if (argv.includes("--link")) {
     const found = readUiLink(port);
+    if (json) {
+      if (found && found.alive === false) clearUiLink(port);
+      const live = found && found.alive !== false;
+      out(JSON.stringify(live
+        ? { running: true, url: found.url, port, mode: found.mode, ...(found.dir && { dir: found.dir }), ...(found.policy && { policy: found.policy }) }
+        : { running: false, port }) + "\n");
+      return;
+    }
     if (found && found.alive !== false) {
       out(`\n  ${C.b}${found.url}${C.off}\n  ${C.dim}the link a seisin ui on ${port} is serving. open it here, do not paste it anywhere.${C.off}\n` +
-        servesWhich(found.policy, config?.path) + "\n");
+        servesWhich(found.policy, runsDir ? null : config?.path, found) + "\n");
       open(found.url);
       return;
     }
     if (found && found.alive === false) clearUiLink(port);
-    out(`\n  ${C.dim}no seisin ui running on ${port} — start one with: seisin ui${port === 4178 ? "" : ` --port ${port}`}${C.off}\n\n`);
+    const start = runsDir ? `seisin ui --runs ${runsDir}${port === 4179 ? "" : ` --port ${port}`}` : `seisin ui${port === 4178 ? "" : ` --port ${port}`}`;
+    out(`\n  ${C.dim}no seisin ui running on ${port} — start one with: ${start}${C.off}\n\n`);
     return;
   }
 
   let server;
   try {
-    server = await serve(config.path, port);
+    server = await serve(runsDir ? null : config.path, port, { runsDir });
   } catch (e) {
     // A console is already on this port: hand back its live link rather than
     // erroring, which is the case that sends people digging in the terminal.
@@ -54,7 +86,7 @@ export async function ui(config, argv = []) {
         out(
           `\n  ${C.b}${found.url}${C.off}\n` +
           `  ${C.dim}a seisin ui is already running on ${port}; reopening its link. ctrl-c that terminal to stop it.${C.off}\n` +
-          servesWhich(found.policy, config.path) + "\n"
+          servesWhich(found.policy, runsDir ? null : config.path, found) + "\n"
         );
         open(found.url);
         return;
@@ -70,19 +102,22 @@ export async function ui(config, argv = []) {
   const bound = server.address().port;
   const url = `http://127.0.0.1:${bound}/#t=${server.seisinToken}`;
   // Recorded before we print, so `--link` and a second `seisin ui` can find it.
-  writeUiLink(bound, url, undefined, config.path);
+  writeUiLink(bound, url, undefined, runsDir ? null : config.path, { mode, dir: runsDir });
 
   // local_binding opens every port (macOS); local_ports opens the ones it
   // names, on every platform — so only a role that names THIS port counts.
-  const reach = Object.values(config.roles)
+  const reach = Object.values(config?.roles ?? {})
     .filter((r) => (r.localBinding && process.platform === "darwin") || (r.localPorts ?? []).includes(bound))
     .map((r) => r.name);
 
   out(
     `\n  ${C.b}${url}${C.off}\n` +
-    `  ${C.dim}reading ${config.path} and the log, live. ctrl-c to stop.${C.off}\n` +
+    (runsDir
+      ? `  ${C.dim}reading the runs in ${runsDir}, live and read only: nothing is granted from here. ctrl-c to stop.${C.off}\n` +
+        `  ${C.dim}one run: add &run=<run_id> to the link.${C.off}\n`
+      : `  ${C.dim}reading ${config.path} and the log, live. ctrl-c to stop.${C.off}\n`) +
     `  ${C.dim}the link carries this run's token: open it here, do not paste it anywhere.${C.off}\n` +
-    `  ${C.dim}lost it? this terminal has it above, or run: seisin ui --link${bound === 4178 ? "" : ` --port ${bound}`}${C.off}\n` +
+    `  ${C.dim}lost it? this terminal has it above, or run: seisin ui${runsDir ? ` --runs ${runsDir}` : ""} --link${bound === (runsDir ? 4179 : 4178) ? "" : ` --port ${bound}`}${C.off}\n` +
     (reach.length
       ? `  ${C.yellow}${reach.join(", ")} can reach this port on localhost: they can load this page, ` +
         `but not the token, which only travels in the link above.${C.off}\n`
@@ -101,7 +136,8 @@ export async function ui(config, argv = []) {
  * Which policy a running console serves, and a warning when it is not the one
  * this directory would use. `here` is null when there is no policy here.
  */
-export function servesWhich(served, here) {
+export function servesWhich(served, here, found = null) {
+  if (found?.mode === "runs") return `  ${C.dim}serving the runs in ${found.dir} (read only)${C.off}\n`;
   if (!served) return `  ${C.dim}(started by an older seisin: which seisin.toml it serves is not recorded)${C.off}\n`;
   if (here && served !== here)
     return `  ${C.yellow}it serves ${served} — not ${here}, the policy for this directory.${C.off}\n` +

package/src/help.js

@@ -123,10 +123,12 @@ export const COMMAND_HELP = {
     exits: [["0", "written"], ["2", "a policy is already there, or nothing was observed"]],
   },
   ui: {
-    usage: ["seisin ui [--port <n>] [--link]"],
-    values: ["--port"],
-    flags: [["--port <n>", "port on 127.0.0.1 (default 4178)"], ["--link", "print the link of a console already running, start nothing"]],
-    examples: ["seisin ui", "seisin ui --link"],
+    usage: ["seisin ui [--port <n>] [--link]", "seisin ui --runs <dir> [--port <n>] [--link [--json]]"],
+    values: ["--port", "--runs"],
+    flags: [["--port <n>", "port on 127.0.0.1 (default 4178; 4179 with --runs)"], ["--link", "print the link of a console already running, start nothing"],
+      ["--runs <dir>", "a read-only console over a directory of runs, one folder each (docs/runs.md)"],
+      ["--json", "with --link: {running, url, port, mode} for a program to read, nothing opened"]],
+    examples: ["seisin ui", "seisin ui --link", "seisin ui --runs ~/.wapentake/seisin/runs", "seisin ui --runs ~/.wapentake/seisin/runs --link --json"],
     exits: [["0", "stopped"], ["2", "could not start"]],
   },
   mcp: {

package/src/inspect/inject.js

@@ -11,6 +11,7 @@
  * price printed next to the thing it buys.
  */
 import { injectKeysOf } from "../keys.js";
+import { sandboxesOf } from "../sandboxes/index.js";
 import { coversHost as covers } from "../srt.js";
 
 export function injectWarnings(config, roles) {
@@ -27,14 +28,24 @@ export function injectWarnings(config, roles) {
     if (inject.length === 0) continue;
     const allowed = r.network ?? config.allowedDomains ?? [];
 
-    if (process.platform !== "linux")
+    // Which sandbox masks is the sandbox's to say (sandboxes/, `masks`): on macOS
+    // only tartaros does, so a provider list without it cannot run the role here.
+    const names = sandboxesOf(config).map((s) => s.name);
+    if (process.platform === "darwin" && !names.includes("tartaros"))
       out.push({
         kind: "inject-platform",
         role: r.name,
-        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform} — it is Linux-only for now`,
-        detail: `On this machine the role will not run. Masked injection on macOS is tracked upstream ` +
-          `(anthropics/sandbox-runtime#593) and enables once that lands. Run this role on Linux, or ` +
-          `use "env"/"run-file" here.`,
+        headline: `${r.name}: key_mode = "inject" needs tartaros on macOS — [sandbox] provider is ${names.join(", ")}`,
+        detail: `On macOS sandbox-runtime does not mask credentials yet (anthropics/sandbox-runtime#593), so ` +
+          `this role will not run here. Add tartaros: [sandbox] provider = ["tartaros", "srt"]. Or run it on ` +
+          `Linux, or use "env"/"run-file" here.`,
+      });
+    else if (process.platform !== "linux" && process.platform !== "darwin")
+      out.push({
+        kind: "inject-platform",
+        role: r.name,
+        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform}`,
+        detail: `No sandbox seisin runs here masks credentials. Run this role on Linux or macOS, or use "env"/"run-file".`,
       });
 
     for (const c of inject) {

package/src/keys.js

@@ -30,8 +30,8 @@
  * policy holds a reviewable reference instead of a path, and every resolution
  * is logged without its value (`event: "key"`, see commands/run.js) — but it is not "the agent never sees it". That
  * is `inject`, which costs terminating the role's TLS with a CA of your own and
- * is Linux-only for now (see `injectGate` and `injectKeysOf` below); off Linux
- * `modeOf` holds it, with the reason in the message.
+ * needs a sandbox that masks credentials: srt on Linux, tartaros on Linux and
+ * macOS (see `injectGate` below, and `masks` on each sandbox).
  *
  * ## Why the value is never written down
  *
@@ -522,23 +522,22 @@ export function modeOf(config, role, entry) {
 }
 
 /**
- * `inject` is the mode where the agent never sees the value: the runtime hands
- * the sandbox a sentinel and substitutes the real value on egress to the
- * credential's declared hosts. It is Linux-only in this version — masked
- * delivery is validated on the Linux backend; the macOS path is not enabled
- * yet and is tracked upstream, where the fit for it is a credential computed
- * per run rather than read from the environment
- * (anthropics/sandbox-runtime#593). Until that lands, macOS `inject` is held
- * rather than offered, with the alternatives in the message.
+ * `inject` is the mode where the agent never sees the value: the sandbox hands
+ * the agent a sentinel and substitutes the real value on egress to the
+ * credential's declared hosts. Which sandbox can do that is the sandbox's to
+ * say (`masks` in sandboxes/): srt on Linux, tartaros on Linux and macOS
+ * (srt's macOS path is tracked upstream, anthropics/sandbox-runtime#593). A
+ * sandbox that does not mask is never handed the role, because the real value
+ * is in the environment it is started with. Here only the platforms where no
+ * sandbox masks are refused outright.
  */
 function injectGate(role) {
-  if (process.platform === "linux") return;
+  if (process.platform === "linux" || process.platform === "darwin") return;
   throw new Error(
-    `roles.${role.name}: key_mode = "inject" is not available on ${process.platform} yet.\n` +
-    `  It is Linux-only for now; masked injection on macOS is tracked upstream ` +
-    `(anthropics/sandbox-runtime#593) and enables once that lands.\n` +
-    `  Use "env" or "run-file" here, or run this role on Linux. ` +
-    `See https://github.com/carlostapiacl/seisin/blob/main/docs/decisions.md.`);
+    `roles.${role.name}: key_mode = "inject" is not available on ${process.platform}.\n` +
+    `  No sandbox seisin runs here masks credentials: srt does on Linux, tartaros on Linux and macOS.\n` +
+    `  Use "env" or "run-file" here, or run this role on Linux or macOS. ` +
+    `See https://github.com/carlostapiacl/seisin/blob/main/docs/keys.md.`);
 }
 
 /**

package/src/runs.js

@@ -0,0 +1,298 @@
+/**
+ * `seisin ui --runs <dir>`: the console over many runs, each with its own policy.
+ *
+ * A launcher that lends each run a territory of its own (wapentake does) has no
+ * single seisin.toml to open: every run gets one written for it at the root of
+ * a worktree, runs there, and the worktree is gone a day or two later. What is
+ * worth keeping is copied out — the policy, the `.seisin/` beside it and a
+ * `run.json` the launcher writes — one folder per run, under one directory.
+ * This reads that directory. The contract is docs/runs.md.
+ *
+ * Read only, on purpose. The territory is the launcher's to lend: a grant
+ * written into an archived run's seisin.toml changes nothing anywhere, so the
+ * console in this mode offers none and the server refuses every write.
+ *
+ * A run that is archived does not change, so what is worked out from it is
+ * kept for as long as its files' signature stays the same — the poll every two
+ * seconds over hundreds of runs re-reads a directory listing and some stats,
+ * not every log.
+ */
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { loadConfig } from "./config.js";
+import { read, logPath } from "./log.js";
+import { requestsPath } from "./requests.js";
+
+/** The name a run's folder may have: what becomes `run=` in a link. */
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+/** The fields of run.json the console reads; anything else in it is ignored. */
+const META = ["run_id", "team", "work_item", "role", "repo", "started_at", "ended_at", "status", "launcher"];
+
+/** How many causes the global view is sent, summed over the runs shown. */
+const CAUSES_SHOWN = 50;
+
+/** How many of a run's own causes travel with it in the list. */
+const RUN_CAUSES = 5;
+
+export function isRunId(id) {
+  return typeof id === "string" && RUN_ID.test(id) && id !== "." && id !== "..";
+}
+
+function statSig(p) {
+  try { const s = statSync(p); return `${s.ino}:${s.size}:${s.mtimeMs}`; } catch { return "-"; }
+}
+
+/** The run folders under `dir`, by name; a file or a name that is not a run id is skipped. */
+export function runFolders(dir) {
+  let names;
+  try { names = readdirSync(dir, { withFileTypes: true }); }
+  catch (e) { throw Object.assign(new Error(`cannot read the runs directory ${dir}: ${e.message}`), { status: 500 }); }
+  return names.filter((d) => d.isDirectory() && isRunId(d.name)).map((d) => d.name).sort();
+}
+
+/** Where a run's policy is. */
+export function runPolicy(dir, id) {
+  return join(dir, id, "seisin.toml");
+}
+
+/**
+ * What a run's summary is made from, as stats only: the policy, run.json, the
+ * queue, the current log and the `.seisin/` directory itself, whose mtime
+ * moves when a segment is rotated in or out. No directory is listed: six
+ * hundred `readdir`s were most of a warm poll (~0.7 s).
+ */
+function signatureOf(dir, id) {
+  const root = join(dir, id);
+  const log = logPath(root);
+  return [
+    statSig(join(root, "seisin.toml")),
+    statSig(join(root, "run.json")),
+    statSig(requestsPath(root)),
+    statSig(log),
+    statSig(dirname(log)),
+  ].join("|");
+}
+
+/** run.json, the launcher's word on the run — or null when it is missing or not JSON. */
+function metaOf(dir, id) {
+  let raw;
+  try { raw = JSON.parse(readFileSync(join(dir, id, "run.json"), "utf8")); } catch { return null; }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const out = {};
+  for (const k of META) if (raw[k] !== undefined && raw[k] !== null) out[k] = typeof raw[k] === "string" ? raw[k] : String(raw[k]);
+  return out;
+}
+
+/**
+ * What one run comes to: who it was, what it was denied, what the denials
+ * cost in retries (every denial after the first of the same thing, system
+ * denials aside), and whether it was let start at all.
+ *
+ * `outcome` is seisin's word, beside the launcher's `status`:
+ *   refused — its canary failed, so nothing ran;
+ *   denied  — it ran and was denied a file or a host;
+ *   clean   — it ran and was denied neither (system denials, the OS's own
+ *             housekeeping, and the canary's expected probes do not count);
+ *   unread  — its policy could not be read.
+ */
+function summarize(dir, id) {
+  const meta = metaOf(dir, id);
+  const base = {
+    id,
+    run_id: meta?.run_id ?? id,
+    team: meta?.team ?? null,
+    work_item: meta?.work_item ?? null,
+    role: meta?.role ?? null,
+    repo: meta?.repo ?? null,
+    started_at: meta?.started_at ?? null,
+    ended_at: meta?.ended_at ?? null,
+    status: meta?.status ?? null,
+    launcher: meta?.launcher ?? null,
+    meta: meta !== null,
+  };
+  let cfg;
+  try { cfg = loadConfig(runPolicy(dir, id)); }
+  catch (e) {
+    return { ...base, outcome: "unread", error: e.code === "ENOENT" ? "no seisin.toml in this run's folder" : e.message,
+      roles: [], denied: 0, byKind: {}, expected: 0, retried: 0, causes: [], hosts: [], entries: 0, canary: null };
+  }
+  const all = read(logPath(cfg.root));
+  /**
+   * Grouped here, by what was denied, rather than through causesOf and walls:
+   * those ask the policy and the disk about every path (~130 ms a run on the
+   * pilot's logs, a minute and more over six hundred), to say whether a
+   * denial would still be one today. An archived run's policy does not change,
+   * so every repeat of a denial is a retry against a standing wall, and the
+   * per-run view, which is one run, still gets the full answer from state().
+   */
+  const byKind = {};
+  let denied = 0, expected = 0;
+  const groups = new Map();
+  for (const e of all) {
+    if (e.verdict !== "denied") continue;
+    if (e.expected === true) { expected++; continue; }
+    const k = e.kind ?? "file";
+    byKind[k] = (byKind[k] ?? 0) + 1;
+    if (k !== "system") denied++;
+    if (!e.action || !e.target) continue;
+    const key = `${e.action}\u0000${e.target}`;
+    const g = groups.get(key) ?? { about: k, action: e.action, target: e.target, times: 0, owners: e.owners ?? [] };
+    g.times++;
+    groups.set(key, g);
+  }
+  const causes = [...groups.values()].sort((a, b) => b.times - a.times);
+  const retried = causes.reduce((n, g) => n + (g.about === "system" ? 0 : g.times - 1), 0);
+  const hosts = causes.filter((g) => g.about === "network").slice(0, 10).map(({ target, times }) => ({ target, times }));
+  const canaries = all.filter((e) => e.event === "canary");
+  const canary = canaries.length ? canaries[canaries.length - 1] : null;
+  const outcome = canaries.some((e) => e.confined === false) ? "refused" : denied ? "denied" : "clean";
+  return {
+    ...base,
+    // A run.json that did not say when it started: the log's first line did.
+    started_at: base.started_at ?? all.find((e) => e.at)?.at ?? null,
+    ended_at: base.ended_at ?? [...all].reverse().find((e) => e.at)?.at ?? null,
+    outcome,
+    roles: Object.keys(cfg.roles),
+    sandbox: canary?.sandbox ?? null,
+    entries: all.length,
+    denied,
+    expected,
+    byKind,
+    retried,
+    hosts,
+    // Kept whole for the sum across runs, cut to RUN_CAUSES when sent.
+    causes,
+    canary: canary ? { confined: canary.confined !== false, reasons: canary.reasons ?? [] } : null,
+  };
+}
+
+/** Summaries kept by run id, with the signature they were made from. */
+const cache = new Map();
+
+/** Every run under `dir`, summarized, re-read only where a file moved. */
+export function scanRuns(dir) {
+  const ids = runFolders(dir);
+  const seen = new Set(ids);
+  for (const k of cache.keys()) if (k.startsWith(`${dir}\u0000`) && !seen.has(k.slice(dir.length + 1))) cache.delete(k);
+  const sigs = [];
+  const runs = ids.map((id) => {
+    const sig = signatureOf(dir, id);
+    sigs.push(`${id}=${sig}`);
+    const k = `${dir}\u0000${id}`;
+    const hit = cache.get(k);
+    if (hit && hit.sig === sig) return hit.summary;
+    const summary = summarize(dir, id);
+    cache.set(k, { sig, summary });
+    return summary;
+  });
+  return { runs, sig: sigs.join("\n") };
+}
+
+/** The filters the global view takes, from a query string. Unknown keys are ignored. */
+export const FILTERS = ["team", "role", "work_item", "status", "outcome"];
+
+export function filtersOf(query) {
+  const q = new URLSearchParams(query ?? "");
+  const out = {};
+  for (const f of FILTERS) { const v = q.get(f); if (v) out[f] = v; }
+  const text = q.get("q");
+  if (text) out.q = text.toLowerCase();
+  return out;
+}
+
+function matches(run, filters) {
+  for (const f of FILTERS) if (filters[f] !== undefined && (run[f] ?? "") !== filters[f]) return false;
+  if (filters.q) {
+    const hay = [run.id, run.run_id, run.work_item, run.repo, run.team, run.role].filter(Boolean).join(" ").toLowerCase();
+    if (!hay.includes(filters.q)) return false;
+  }
+  return true;
+}
+
+/** How many runs have each value of each filter — over every run, so a filter never hides its siblings. */
+function facetsOf(runs) {
+  const out = {};
+  for (const f of FILTERS) {
+    const m = new Map();
+    for (const r of runs) { const v = r[f]; if (v) m.set(v, (m.get(v) ?? 0) + 1); }
+    out[f] = [...m].sort((a, b) => b[1] - a[1] || String(a[0]).localeCompare(String(b[0]))).map(([value, runs]) => ({ value, runs }));
+  }
+  return out;
+}
+
+/**
+ * The same refusal across runs is one cause: summed by what was refused, with
+ * how many runs hit it and which teams and roles they were.
+ */
+function causesAcross(runs) {
+  const by = new Map();
+  for (const r of runs) {
+    for (const c of r.causes) {
+      const k = `${c.action}\u0000${c.target}`;
+      const g = by.get(k) ?? { action: c.action, target: c.target, about: c.about, owners: c.owners, times: 0, runs: 0, teams: new Set(), roles: new Set(), last: null };
+      g.times += c.times;
+      g.runs++;
+      if (r.team) g.teams.add(r.team);
+      if (r.role) g.roles.add(r.role);
+      if (!g.last || (r.started_at && r.started_at > g.last.at)) g.last = { run: r.id, at: r.started_at };
+      by.set(k, g);
+    }
+  }
+  return [...by.values()]
+    // The OS's own housekeeping last: it is in every run and nobody grants it.
+    .sort((a, b) => (a.about === "system") - (b.about === "system") || b.runs - a.runs || b.times - a.times)
+    .slice(0, CAUSES_SHOWN)
+    .map((g) => ({ ...g, teams: [...g.teams], roles: [...g.roles], last: g.last?.run ?? null }));
+}
+
+const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+
+/** The global view: the runs that pass the filters, newest first, and what they add up to. */
+const views = new Map();
+
+export function runsView(dir, filters = {}, { scanned = scanRuns(dir) } = {}) {
+  // The same runs and the same filters are the same answer: the poll asks
+  // every two seconds, and summing the causes of six hundred runs was most
+  // of what it cost once the runs themselves were remembered.
+  const key = `${dir}\u0000${JSON.stringify(filters)}\u0000${scanned.sig}`;
+  const hit = views.get(key);
+  if (hit) return hit;
+  const view = viewOf(dir, filters, scanned.runs);
+  views.set(key, view);
+  while (views.size > 8) views.delete(views.keys().next().value);
+  return view;
+}
+
+function viewOf(dir, filters, every) {
+  const shown = every.filter((r) => matches(r, filters))
+    .sort((a, b) => cmp(b.started_at ?? "", a.started_at ?? "") || cmp(b.id, a.id));
+  const totals = { runs: shown.length, denied: 0, retried: 0, expected: 0, byKind: {}, outcome: {} };
+  for (const r of shown) {
+    totals.denied += r.denied;
+    totals.retried += r.retried;
+    totals.expected += r.expected;
+    for (const [k, n] of Object.entries(r.byKind)) totals.byKind[k] = (totals.byKind[k] ?? 0) + n;
+    totals.outcome[r.outcome] = (totals.outcome[r.outcome] ?? 0) + 1;
+  }
+  return {
+    mode: "runs",
+    dir,
+    filters,
+    total: every.length,
+    facets: facetsOf(every),
+    totals,
+    causes: causesAcross(shown),
+    runs: shown.map((r) => ({ ...r, causes: r.causes.slice(0, RUN_CAUSES) })),
+    readOnly: true,
+  };
+}
+
+/** One run's summary, by id; throws 404 for a name that is not a run here. */
+export function runOf(dir, id) {
+  if (!isRunId(id)) throw Object.assign(new Error(`not a run id: ${JSON.stringify(id)}`), { status: 400 });
+  if (!runFolders(dir).includes(id)) throw Object.assign(new Error(`no run ${id} in ${dir}`), { status: 404 });
+  const { runs } = scanRuns(dir);
+  const r = runs.find((x) => x.id === id);
+  return { ...r, causes: r.causes.slice(0, RUN_CAUSES) };
+}

package/src/sandboxes/command.js

@@ -85,6 +85,9 @@ export function commandSandbox(name, command, check = null, { tagsDenials = fals
     assess,
     unmet: (settings, ctx) => assess(settings, ctx).unmet,
     wrap: (bin, file, _settings, inner) => [bin, ...withPolicy(command.slice(1), file), ...inner],
+    // A sandbox of your own is not known to mask credentials, and it is started
+    // with the real value in its environment: an inject role is never its.
+    masks: () => `masked credentials (key_mode = "inject"): ${name} is not known to mask them, and it would start with the real value in its environment`,
     // Declared, not detected: `tags_denials = true` says its Seatbelt denials
     // carry sandbox-runtime's tag (docs/sandboxes.md). Without it, on macOS,
     // none of the kernel's refusals under it reach the log.

package/src/sandboxes/index.js

@@ -71,10 +71,14 @@ export function weigh(config, settings, { platform = process.platform, role = nu
       // `browsers`: a Mach service to register. srt's schema has no field for it
       // (srt-mach.mjs adds it); tartaros takes it as network.allowMachRegister
       // (adapt). A sandbox that is given it neither way cannot hold the role.
+      // `inject`: the real value is in the environment the sandbox starts with,
+      // so only one that masks credentials may be handed the role.
+      const masked = (own.credentials?.envVars ?? []).length > 0;
+      const masking = masked ? (sandbox.masks ? sandbox.masks(platform) : `masked credentials: ${sandbox.name} does not mask them`) : null;
       const browser = register.length && !sandbox.machRegister
         ? [`a Mach service to register (${register.join(", ")}, for browsers): ${sandbox.name} is not given it, only srt and tartaros are`]
         : [];
-      return { sandbox, bin, unmet: [...unmet, ...browser], warnings, missing: bin ? null : sandbox.missing() };
+      return { sandbox, bin, unmet: [...(masking ? [masking] : []), ...unmet, ...browser], warnings, missing: bin ? null : sandbox.missing() };
     });
     const chosen = options.find((o) => o.bin && o.unmet.length === 0) ?? null;
     return { chosen, options };