seisin 0.6.2 → 0.6.3

package/README.md

@@ -855,7 +855,7 @@ A **provider** is a command with a `{ref}` placeholder, so adding 1Password, Bit
 confined process. Nothing degrades: a provider that fails stops the run.
 
 A key reaches the role as a variable (`key_mode = "env"`), as a file in the run's private
-directory (`"run-file"`), or, on Linux, not at all: with `"inject"` the agent holds a
+directory (`"run-file"`), or not at all (on Linux, and on macOS under tartaros): with `"inject"` the agent holds a
 placeholder and the sandbox swaps in the real value only on the way to the hosts you list for
 it. That costs terminating TLS to those hosts, which `seisin check` names, and a host that
 stores what it is sent can still hand the value back — use a least-scope token.
@@ -1037,7 +1037,7 @@ the same kernel or workspace, and which one you want depends on what you are pro
 
 ## Status
 
-**1101 tests on macOS, 1094 passing and 7 platform skips** (0.6.2, 2026-10-26, local); in CI the
+**1103 tests on macOS, 1096 passing and 7 platform skips** (after 0.6.3, 2026-10-26, local); in CI the
 same day, on `ubuntu-latest` **1100, 1071 passing and 29 platform skips**, and on macOS 1101,
 1092 passing and 9 skips, Node 18/20/22/24, with the 26 core boundary tests skipping none. On 2026-10-12, 91 of the suite's tests
 needed `@anthropic-ai/sandbox-runtime` installed — counted by running it with the runtime

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it denies something it tells you whose file it was.",
   "keywords": [
     "ai-agents",
@@ -45,7 +45,7 @@
     "@anthropic-ai/sandbox-runtime": "0.0.81"
   },
   "optionalDependencies": {
-    "@carlostapiacl/tartaros": "0.1.0-alpha.15"
+    "@carlostapiacl/tartaros": "0.1.0-alpha.16"
   },
   "scripts": {
     "test": "node --test test/*.test.js",

package/src/canary.js

@@ -130,6 +130,16 @@ export async function runCanary({ srt, wrap = null, settingsFile, settings, env,
   }
 
   if (timedOut) failed.push(`the canary did not finish in ${timeoutMs / 1000}s`);
+  // tartaros refuses a run whose real value another process exposes (its exec
+  // record, which the agent can read; on macOS no sandbox hides it). That is not
+  // a boundary to fix in the policy, and its own advice names a flag seisin does
+  // not pass, so it is said apart, as the variable and the process.
+  const exposed = [...stderr.matchAll(/tartaros: secret exposed: the value of (\S+) in pid (\d+) \(([^)]*)\)/g)]
+    .map(([, name, pid, proc]) => ({ name, pid: Number(pid), proc }));
+  if (exposed.length) {
+    for (const p of [secret, outside, insideDir, shared]) if (p) try { rmSync(p, { force: true, recursive: p === insideDir }); } catch {}
+    return { ok: false, exposed, failed: exposed.map((e) => `${e.name}'s real value is readable in pid ${e.pid} (${e.proc})`), ms: Date.now() - t0 };
+  }
   if (!output.includes(`ALIVE-${nonce}`)) {
     // The runtime's own words, when it said any: a sandbox that refuses to
     // start usually says why (measured: a path the runtime read as a broken

package/src/commands/run.js

@@ -496,6 +496,14 @@ export async function run(config, argv) {
       event: "canary", role, run: theRun.id.slice(0, 8), ...trace, agent: agent ?? null, confined: false, reasons: probe.failed,
       ...(sandbox.name === DEFAULT_SANDBOX ? {} : { sandbox: sandbox.name }),
     });
+    if (probe.exposed) {
+      err(`${C.red}seisin: ${role} was NOT started — another process holds a real value the agent would see:${C.off}\n` +
+        probe.failed.map((f) => `  - ${f}\n`).join("") +
+        `  A process's environment and arguments are readable by every process of your user (on macOS no sandbox ` +
+        `hides them), so masking would hide nothing. Usually a shell that exported the token, and what it started. ` +
+        `Unset it there or end that process, and keep the value only where seisin's key points (docs/keys.md).\n`);
+      process.exit(CANARY_EXIT);
+    }
     err(`${C.red}seisin: ${role} was NOT started — the sandbox failed its canary:${C.off}\n` +
       probe.failed.map((f) => `  - ${f}\n`).join("") +
       `  The policy as generated does not hold on this machine, so no agent runs under it. ` +

package/src/inspect/inject.js

@@ -11,6 +11,7 @@
  * price printed next to the thing it buys.
  */
 import { injectKeysOf } from "../keys.js";
+import { sandboxesOf } from "../sandboxes/index.js";
 import { coversHost as covers } from "../srt.js";
 
 export function injectWarnings(config, roles) {
@@ -27,14 +28,24 @@ export function injectWarnings(config, roles) {
     if (inject.length === 0) continue;
     const allowed = r.network ?? config.allowedDomains ?? [];
 
-    if (process.platform !== "linux")
+    // Which sandbox masks is the sandbox's to say (sandboxes/, `masks`): on macOS
+    // only tartaros does, so a provider list without it cannot run the role here.
+    const names = sandboxesOf(config).map((s) => s.name);
+    if (process.platform === "darwin" && !names.includes("tartaros"))
       out.push({
         kind: "inject-platform",
         role: r.name,
-        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform} — it is Linux-only for now`,
-        detail: `On this machine the role will not run. Masked injection on macOS is tracked upstream ` +
-          `(anthropics/sandbox-runtime#593) and enables once that lands. Run this role on Linux, or ` +
-          `use "env"/"run-file" here.`,
+        headline: `${r.name}: key_mode = "inject" needs tartaros on macOS — [sandbox] provider is ${names.join(", ")}`,
+        detail: `On macOS sandbox-runtime does not mask credentials yet (anthropics/sandbox-runtime#593), so ` +
+          `this role will not run here. Add tartaros: [sandbox] provider = ["tartaros", "srt"]. Or run it on ` +
+          `Linux, or use "env"/"run-file" here.`,
+      });
+    else if (process.platform !== "linux" && process.platform !== "darwin")
+      out.push({
+        kind: "inject-platform",
+        role: r.name,
+        headline: `${r.name}: key_mode = "inject" is not available on ${process.platform}`,
+        detail: `No sandbox seisin runs here masks credentials. Run this role on Linux or macOS, or use "env"/"run-file".`,
       });
 
     for (const c of inject) {

package/src/keys.js

@@ -30,8 +30,8 @@
  * policy holds a reviewable reference instead of a path, and every resolution
  * is logged without its value (`event: "key"`, see commands/run.js) — but it is not "the agent never sees it". That
  * is `inject`, which costs terminating the role's TLS with a CA of your own and
- * is Linux-only for now (see `injectGate` and `injectKeysOf` below); off Linux
- * `modeOf` holds it, with the reason in the message.
+ * needs a sandbox that masks credentials: srt on Linux, tartaros on Linux and
+ * macOS (see `injectGate` below, and `masks` on each sandbox).
  *
  * ## Why the value is never written down
  *
@@ -522,23 +522,22 @@ export function modeOf(config, role, entry) {
 }
 
 /**
- * `inject` is the mode where the agent never sees the value: the runtime hands
- * the sandbox a sentinel and substitutes the real value on egress to the
- * credential's declared hosts. It is Linux-only in this version — masked
- * delivery is validated on the Linux backend; the macOS path is not enabled
- * yet and is tracked upstream, where the fit for it is a credential computed
- * per run rather than read from the environment
- * (anthropics/sandbox-runtime#593). Until that lands, macOS `inject` is held
- * rather than offered, with the alternatives in the message.
+ * `inject` is the mode where the agent never sees the value: the sandbox hands
+ * the agent a sentinel and substitutes the real value on egress to the
+ * credential's declared hosts. Which sandbox can do that is the sandbox's to
+ * say (`masks` in sandboxes/): srt on Linux, tartaros on Linux and macOS
+ * (srt's macOS path is tracked upstream, anthropics/sandbox-runtime#593). A
+ * sandbox that does not mask is never handed the role, because the real value
+ * is in the environment it is started with. Here only the platforms where no
+ * sandbox masks are refused outright.
  */
 function injectGate(role) {
-  if (process.platform === "linux") return;
+  if (process.platform === "linux" || process.platform === "darwin") return;
   throw new Error(
-    `roles.${role.name}: key_mode = "inject" is not available on ${process.platform} yet.\n` +
-    `  It is Linux-only for now; masked injection on macOS is tracked upstream ` +
-    `(anthropics/sandbox-runtime#593) and enables once that lands.\n` +
-    `  Use "env" or "run-file" here, or run this role on Linux. ` +
-    `See https://github.com/carlostapiacl/seisin/blob/main/docs/decisions.md.`);
+    `roles.${role.name}: key_mode = "inject" is not available on ${process.platform}.\n` +
+    `  No sandbox seisin runs here masks credentials: srt does on Linux, tartaros on Linux and macOS.\n` +
+    `  Use "env" or "run-file" here, or run this role on Linux or macOS. ` +
+    `See https://github.com/carlostapiacl/seisin/blob/main/docs/keys.md.`);
 }
 
 /**

package/src/sandboxes/command.js

@@ -85,6 +85,9 @@ export function commandSandbox(name, command, check = null, { tagsDenials = fals
     assess,
     unmet: (settings, ctx) => assess(settings, ctx).unmet,
     wrap: (bin, file, _settings, inner) => [bin, ...withPolicy(command.slice(1), file), ...inner],
+    // A sandbox of your own is not known to mask credentials, and it is started
+    // with the real value in its environment: an inject role is never its.
+    masks: () => `masked credentials (key_mode = "inject"): ${name} is not known to mask them, and it would start with the real value in its environment`,
     // Declared, not detected: `tags_denials = true` says its Seatbelt denials
     // carry sandbox-runtime's tag (docs/sandboxes.md). Without it, on macOS,
     // none of the kernel's refusals under it reach the log.

package/src/sandboxes/index.js

@@ -71,10 +71,14 @@ export function weigh(config, settings, { platform = process.platform, role = nu
       // `browsers`: a Mach service to register. srt's schema has no field for it
       // (srt-mach.mjs adds it); tartaros takes it as network.allowMachRegister
       // (adapt). A sandbox that is given it neither way cannot hold the role.
+      // `inject`: the real value is in the environment the sandbox starts with,
+      // so only one that masks credentials may be handed the role.
+      const masked = (own.credentials?.envVars ?? []).length > 0;
+      const masking = masked ? (sandbox.masks ? sandbox.masks(platform) : `masked credentials: ${sandbox.name} does not mask them`) : null;
       const browser = register.length && !sandbox.machRegister
         ? [`a Mach service to register (${register.join(", ")}, for browsers): ${sandbox.name} is not given it, only srt and tartaros are`]
         : [];
-      return { sandbox, bin, unmet: [...unmet, ...browser], warnings, missing: bin ? null : sandbox.missing() };
+      return { sandbox, bin, unmet: [...(masking ? [masking] : []), ...unmet, ...browser], warnings, missing: bin ? null : sandbox.missing() };
     });
     const chosen = options.find((o) => o.bin && o.unmet.length === 0) ?? null;
     return { chosen, options };

package/src/sandboxes/srt.js

@@ -150,6 +150,9 @@ export const srt = {
   locate: () => resolveSrt(),
   missing: () => `sandbox runtime not found. ${installHint()}`,
   unmet: () => [],
+  // Masked credentials: on Linux; on macOS not yet (anthropics/sandbox-runtime#593).
+  masks: (platform) => platform === "linux" ? null
+    : `masked credentials (key_mode = "inject") on ${platform}: sandbox-runtime does not mask them there yet (anthropics/sandbox-runtime#593); tartaros does`,
   // `--` before the command, and it is not cosmetic. Without it the runtime's
   // own argument parser reaches into what the agent was invoked with and eats
   // anything resembling one of its flags: `claude --settings`, `claude -c`.

package/src/sandboxes/tartaros.js

@@ -95,6 +95,9 @@ export const tartaros = {
   locate: () => resolveTartaros(),
   missing: () => `tartaros not found: neither ${TARTAROS_PACKAGE}, which installs with seisin unless optional dependencies are left out, nor tartaros on PATH.`,
   asksFile: true,
+  // Masked credentials: tartaros says whether it masks them, through explain
+  // (0.1.0-alpha.16 and later do; earlier ones refuse the field).
+  masks: () => null,
   adapt: tartarosSettings,
   machRegister: true,
   assess: (_settings, { bin, file, platform } = {}) => tartarosAssess(bin, file, { platform }),