seisin 0.6.3 → 0.6.5

package/src/toml.js

@@ -0,0 +1,250 @@
+/**
+ * The TOML subset seisin.toml is written in: `[table.name]` headers, and
+ * `key = ["a", "b"]` / `key = "a"` values, with a line number on every error.
+ *
+ * Kept in-house so installing seisin pulls in no parser. If a config outgrows
+ * this subset, the config is doing too much.
+ */
+import { CONFIG_NAME } from "./layout.js";
+
+const RE_TABLE = /^\[([A-Za-z0-9_.\-]+)\]$/;
+const RE_PAIR = /^([A-Za-z0-9_\-]+)\s*=\s*(.+)$/;
+
+/**
+ * Names a table or key may not have.
+ *
+ * `[roles.__proto__]` does not show up in `Object.keys(roles)`, so `check`
+ * prints the roles that exist and says nothing — while every other role
+ * inherits whatever it declared. A config reading `[roles.frontend]` with no
+ * `writes` came out of the parser owning the entire repo and holding
+ * GITHUB_TOKEN, and no amount of reading the file would show it.
+ *
+ * The tables below are made with a null prototype, which stops the inheritance
+ * on its own. The names are refused as well, because a config containing them
+ * is not a config with a mistake in it.
+ */
+export const FORBIDDEN = new Set(["__proto__", "prototype", "constructor"]);
+
+/** A table with no prototype, so nothing is inherited into it. */
+export function dict() {
+  return Object.create(null);
+}
+
+export const isTable = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** Read a property only if the object actually has it. */
+export function own(obj, key) {
+  return obj && Object.prototype.hasOwnProperty.call(obj, key) ? obj[key] : undefined;
+}
+
+/**
+ * Where each table and key of a parsed file was written, by dotted name.
+ *
+ * Kept beside the result rather than in it, so the object stays exactly the
+ * data that was written; loadConfig reads it to put a line number on a name it
+ * does not know.
+ */
+export const LINES = new WeakMap();
+
+/** Minimal TOML subset -> plain object. Throws with a line number on bad input. */
+export function parseToml(text) {
+  const out = dict();
+  const where = new Map();
+  LINES.set(out, where);
+  let table = out;
+  let tableName = "";
+  // "Last one wins" is TOML-ish and wrong for a permission file. A policy can
+  // look restrictive at the top and be cancelled forty lines down, and the
+  // person reviewing it reads the first block. Both shapes are refused.
+  const seenTables = new Set();
+  const seenKeys = new Set();
+  const lines = text.split(/\r?\n/);
+
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const line = stripComment(raw).trim();
+    if (!line) continue;
+
+    const header = RE_TABLE.exec(line);
+    if (header) {
+      tableName = header[1];
+      for (const part of tableName.split("."))
+        if (FORBIDDEN.has(part))
+          throw new Error(
+            `${CONFIG_NAME}:${i + 1}: "[${tableName}]" uses the reserved name "${part}". ` +
+            `A table named that would not appear as a role and would hand its settings to ` +
+            `every other one.`);
+      if (seenTables.has(tableName))
+        throw new Error(
+          `${CONFIG_NAME}:${i + 1}: [${tableName}] appears twice. ` +
+          `A later table would silently override the earlier one — put every setting for ` +
+          `${tableName} in one place.`);
+      seenTables.add(tableName);
+      tableName.split(".").forEach((_, k, parts) => {
+        const name = parts.slice(0, k + 1).join(".");
+        if (!where.has(name)) where.set(name, i + 1);
+      });
+      table = tableName.split(".").reduce((node, key, k, parts) => {
+        if (!Object.prototype.hasOwnProperty.call(node, key)) node[key] = dict();
+        else if (!isTable(node[key]))
+          throw new Error(
+            `${CONFIG_NAME}:${i + 1}: [${tableName}] — "${parts.slice(0, k + 1).join(".")}" is already ` +
+            `a value, not a table. One name cannot be both.`);
+        return node[key];
+      }, out);
+      continue;
+    }
+
+    const pair = RE_PAIR.exec(line);
+    if (!pair) throw new Error(`${CONFIG_NAME}:${i + 1}: cannot read "${raw.trim()}"`);
+
+    let [, key, value] = pair;
+    const at = i + 1;
+    // An array may span lines; keep pulling until the brackets balance. Only
+    // the new line is searched: searching the whole growing value made an
+    // unclosed array of 100k lines take 20 s to be refused. A `]` inside a
+    // quoted item does not close it — `["a]b",` used to end the array there.
+    if (value.startsWith("[") && !closesArray(value)) {
+      const parts = [value];
+      let closed = false;
+      while (!closed && i + 1 < lines.length) {
+        const next = stripComment(lines[++i]).trim();
+        parts.push(next);
+        closed = closesArray(next);
+      }
+      value = parts.join(" ");
+    }
+    if (FORBIDDEN.has(key))
+      throw new Error(`${CONFIG_NAME}:${i + 1}: "${key}" is a reserved name and cannot be a setting.`);
+    const seen = `${tableName}.${key}`;
+    if (seenKeys.has(seen))
+      throw new Error(
+        `${CONFIG_NAME}:${i + 1}: "${key}" is set twice in [${tableName || "the root"}]. ` +
+        `The second would win, which is not a thing a permission file should do quietly.`);
+    seenKeys.add(seen);
+    where.set(tableName ? `${tableName}.${key}` : key, at);
+    /**
+     * A key may not be a table that is declared elsewhere, in either order.
+     *
+     * `[roles.a]` with `network = []`, then `[roles]` and `a = true` forty lines
+     * down, used to replace the whole role with `true`: its `network = []` came
+     * back as "not set", which means the global allow list. `check` said
+     * nothing. It is the "last one wins" this parser refuses everywhere else,
+     * arriving by a different spelling.
+     */
+    if (Object.prototype.hasOwnProperty.call(table, key))
+      throw new Error(
+        `${CONFIG_NAME}:${i + 1}: "${key}" in [${tableName || "the root"}] is already the table ` +
+        `[${tableName ? tableName + "." : ""}${key}]. One name cannot be both — the value would replace ` +
+        `everything that table says.`);
+    table[key] = readValue(value, i + 1);
+  }
+  return out;
+}
+
+/** Is there a `]` on this line outside a quoted string? Strings do not span lines. */
+export function closesArray(line) {
+  let quoted = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (c === '"') quoted = !quoted;
+    else if (c === "]" && !quoted) return true;
+  }
+  return false;
+}
+
+/** Strips a trailing `#` comment, but not one inside a quoted string. */
+export function stripComment(line) {
+  let quoted = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (c === '"') quoted = !quoted;
+    else if (c === "#" && !quoted) return line.slice(0, i);
+  }
+  return line;
+}
+
+/**
+ * One value, read strictly.
+ *
+ * Strict is the whole point, and it was not before. The array reader used to
+ * pick quoted runs out of the line with a regex and ignore everything between
+ * them, so `["a" GARBAGE "b"]` parsed as `["a","b"]` and an unterminated string
+ * parsed as `""`. A permission file that is half-understood is worse than one
+ * that is rejected: the half that was dropped is the half you meant.
+ *
+ * So this scans rather than matches, and anything it does not recognise is an
+ * error with a line number. There are no escapes — a `"` ends the string. If a
+ * path of yours needs a quote in it, that is outside this subset and the
+ * message says so instead of guessing.
+ */
+function readValue(value, lineNo) {
+  const v = value.trim();
+  const bad = (msg) => { throw new Error(`${CONFIG_NAME}:${lineNo}: ${msg}`); };
+
+  if (v === "true") return true;
+  if (v === "false") return false;
+
+  if (v.startsWith('"')) {
+    const end = v.indexOf('"', 1);
+    if (end === -1) bad(`unterminated string — no closing quote in ${v}`);
+    const rest = v.slice(end + 1).trim();
+    if (rest) bad(`unexpected ${JSON.stringify(rest)} after the string`);
+    return v.slice(1, end);
+  }
+
+  if (v.startsWith("[")) {
+    if (!v.endsWith("]")) bad("unterminated array — no closing bracket");
+    const items = [];
+    let i = 1;
+    const body = v.slice(0, -1);          // everything up to the closing bracket
+    let expectItem = true;                // a list alternates item, comma, item…
+
+    while (i < body.length) {
+      const c = body[i];
+      if (c === " " || c === "\t") { i++; continue; }
+
+      if (c === ",") {
+        if (expectItem) bad("empty array slot — two commas in a row, or a leading comma");
+        expectItem = true; i++; continue;
+      }
+      if (!expectItem) bad(`missing comma before ${JSON.stringify(body.slice(i, i + 12))}`);
+      // Whole numbers, for `local_ports`. Digits only: no sign, no decimal, no
+      // underscore — a port is none of those, and every other key still
+      // refuses a number through asArray.
+      const digits = /^\d+/.exec(body.slice(i));
+      if (digits) {
+        const after = body[i + digits[0].length];
+        if (after !== undefined && after !== "," && after !== " " && after !== "\t")
+          bad(`${JSON.stringify(body.slice(i, i + 12))} is not a whole number`);
+        items.push(Number(digits[0]));
+        i += digits[0].length;
+        expectItem = false;
+        continue;
+      }
+      if (c !== '"') bad(`array items must be double-quoted, found ${JSON.stringify(body.slice(i, i + 12))}`);
+
+      const end = body.indexOf('"', i + 1);
+      if (end === -1) bad("unterminated string inside the array");
+      // A backslash before the closing quote means somebody wrote `\"` and
+      // expected an escape. There are none — the quote just ended the string,
+      // and the error they get otherwise is about a missing comma somewhere in
+      // the middle of a shell pipeline, which names the symptom and hides the
+      // cause. Measured while writing the docs: every attempt at a one-line
+      // provider command landed here.
+      if (body[end - 1] === "\\")
+        bad(`there are no escapes in this format, so the \\" in ` +
+            `${JSON.stringify(body.slice(i, Math.min(end + 2, i + 40)))} ended the string early.\n` +
+            `  A value cannot contain a double quote. If this is a shell command, put it in a ` +
+            `script and name the script instead — which is also how it stops being unreadable.`);
+      items.push(body.slice(i + 1, end));
+      i = end + 1;
+      expectItem = false;                 // a trailing comma is fine; a trailing item is not
+    }
+    return items;
+  }
+
+  if (/^\d+$/.test(v)) return Number(v);
+
+  bad("value must be a string, an array of strings, a whole number, or a boolean");
+}

package/src/violations.js

@@ -42,9 +42,13 @@
  * per run is a line nobody can act on — and `seisin check` says it, with the
  * platform's other standing limits.
  */
-import { spawn, execFileSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { statSync } from "node:fs";
 import { basename } from "node:path";
+import { createDenialAttribution, processTree, TREE_MS } from "./denial-attribution.js";
+
+// Keep the existing helper imports available to callers and tests.
+export { shellSplit, isOurs, descends, processTree, underAnotherRun } from "./denial-attribution.js";
 
 /** Only sandbox-runtime tags its violations this way. Everything else on the
  *  machine — Safari, mDNSResponder, Spotlight — is filtered out by the OS
@@ -197,134 +201,6 @@ function decode(b64) {
   }
 }
 
-/**
- * Split a POSIX shell word list, the way a shell would.
- *
- * This reads the runtime's attribution tag, which carries the wrapped command
- * re-quoted for `sh -c` and truncated to 100 characters. Parsing it beats
- * re-generating it: any correct quoting of the same argument list parses back to
- * that list, so this keeps matching if the runtime changes how it quotes, which
- * re-implementing its `quote()` would not.
- *
- * Truncation means the last word is usually a fragment and the closing quote is
- * usually missing. That is expected, not an error — an unterminated word is
- * returned as far as it got, and {@link isOurs} treats the final word as a
- * prefix.
- */
-export function shellSplit(line) {
-  const words = [];
-  let word = null;
-  let quote = null;
-  for (let i = 0; i < line.length; i++) {
-    const c = line[i];
-    if (quote) {
-      if (c === quote) quote = null;
-      else word += c;
-      continue;
-    }
-    if (c === "'" || c === '"') { quote = c; word ??= ""; continue; }
-    if (c === "\\" && i + 1 < line.length) { word = (word ?? "") + line[++i]; continue; }
-    if (/\s/.test(c)) { if (word !== null) { words.push(word); word = null; } continue; }
-    word = (word ?? "") + c;
-  }
-  if (word !== null) words.push(word);
-  return words;
-}
-
-/**
- * Was this tagged command the one this run launched?
- *
- * The second of two anchors, and it exists because the first one is racy: a
- * refused `sh -c` can be dead before `ps` runs, and then a process tree proves
- * nothing. This one does not depend on the process still existing.
- *
- * Compared as a *prefix*, because the tag holds only the first 100 characters:
- * every complete word must match exactly, and the last word — the one the
- * truncation cut — only has to start the same way. A command that agrees with
- * ours for 100 characters and then differs would be credited to us, which is a
- * wrong attribution we accept: it requires another sandbox on the same machine
- * launching a command that matches ours to the byte for 100 bytes.
- */
-export function isOurs(tagged, argv) {
-  if (!tagged) return false;
-  const words = shellSplit(tagged);
-  if (words.length === 0 || words.length > argv.length) return false;
-  for (let i = 0; i < words.length - 1; i++) if (words[i] !== argv[i]) return false;
-  const last = words[words.length - 1];
-  return argv[words.length - 1]?.startsWith(last) ?? false;
-}
-
-/**
- * Is `pid` a descendant of `root`?
- *
- * This is the anchor for attribution, and it is the reason a denial from
- * somebody else's sandbox never lands in this repo's log. The alternative was
- * matching the decoded command against the one we launched, which would mean
- * reimplementing the runtime's shell quoting and inheriting its bugs; a process
- * tree is a fact the OS already holds.
- *
- * At most one `ps` per TREE_MS, and only until the session suffix is learned —
- * after that the suffix alone is exact, because it is generated once per `srt`
- * process. In practice that is one `ps` per run.
- */
-export function descends(pid, root, snapshot) {
-  const parent = new Map(snapshot);
-  const seen = new Set();
-  let at = pid;
-  while (at && at !== 1 && !seen.has(at)) {
-    if (at === root) return true;
-    seen.add(at);
-    at = parent.get(at);
-  }
-  return false;
-}
-
-/**
- * pid → ppid for every process this user can see, and in `tree.roots` the
- * pids that are a sandbox run's root: an `srt`, or a `seisin run`.
- *
- * The roots are what makes "not ours" provable. A process outside our tree is
- * someone else's only if its ancestry reaches another run; one whose ancestry
- * ends at init was orphaned — `cmd &`, a build daemon, git's fsmonitor — and
- * may well be ours, reparented when the shell that started it exited.
- */
-export function processTree(run = execFileSync) {
-  const tree = new Map();
-  tree.roots = new Set();
-  try {
-    const out = run("/bin/ps", ["-Ao", "pid=,ppid=,args="], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-    for (const line of out.split("\n")) {
-      const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.*))?$/);
-      if (!m) continue;
-      tree.set(Number(m[1]), Number(m[2]));
-      if (m[3] && RUN_ROOT.test(m[3])) tree.roots.add(Number(m[1]));
-    }
-  } catch {
-    // No tree means nothing can be attributed, which the caller handles by
-    // recording nothing. A permission tool does not invent an owner.
-  }
-  return tree;
-}
-
-/** The command line of an `srt` (however it was installed) or of `seisin run`. */
-const RUN_ROOT = /(?:^|[\s/])srt(?:\s|$)|sandbox-runtime\/dist\/cli\.js(?:\s|$)|(?:^|[\s/])(?:seisin|cli\.js)\s+run\s/;
-
-/**
- * Does `pid` descend from a run root other than `root`?
- *
- * A table without command lines (`roots` absent) cannot tell an orphan from a
- * stranger, and answers as before: alive and not ours is someone else's.
- */
-export function underAnotherRun(pid, root, snapshot) {
-  if (!snapshot.roots) return true;
-  const seen = new Set();
-  for (let at = pid; at && at !== 1 && !seen.has(at); at = snapshot.get(at)) {
-    if (at !== root && snapshot.roots.has(at)) return true;
-    seen.add(at);
-  }
-  return false;
-}
-
 /**
  * Did this refusal reach for content, or just walk past the door?
  *
@@ -442,143 +318,15 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
       close: () => Promise.resolve(stats),
     };
 
-  let suffix = null;               // learned once, exact from then on
-  let tree = null;                 // refreshed only while still learning
-  let treeAt = -Infinity;          // when `tree` was taken
-  let root = pid;                  // the srt pid; not known until after spawn
-  const mine = new Set();          // pids already proven to be ours
-  const held = [];                 // denials seen before they could be attributed
-  const foreignSuffixes = new Set(); // other sandboxes, proven while they were alive
   let recheck = null;              // a deferred look, when a snapshot was refused
-
-  /**
-   * One `ps` per TREE_MS at most, and a later look instead of a skipped one.
-   *
-   * `ps` is synchronous and it was taken for every denial from another sandbox
-   * while this run had not learned its own suffix — which, for a run that is
-   * never refused anything, is the whole run. Several cells at once is exactly
-   * that: 83 ms of blocked event loop per foreign line, measured. A line whose
-   * process may be younger than the last snapshot is not decided on it; it is
-   * held, and looked at again once the window has passed.
-   */
-  const snapshot = () => { tree = treeFn(); treeAt = now(); };
-  const later = () => {
-    if (recheck) return;
-    recheck = setTimeout(() => { recheck = null; if (!suffix && held.length) revisit(); }, TREE_MS);
-    recheck.unref?.();
-  };
-
-  /**
-   * Two anchors, and either one is enough.
-   *
-   * Neither works alone. The process tree is exact while the process exists and
-   * proves nothing once it has exited — which, for the short commands that get
-   * refused most, is by the time the line arrives. The command tag survives the
-   * process but depends on the runtime's quoting staying recognisable.
-   *
-   * Whichever answers first hands over the session suffix, and from that point
-   * attribution is one string comparison: the suffix is generated once per `srt`
-   * process, so it separates this run from every other sandbox on the machine
-   * exactly. In practice the tag settles it on the first denial and the tree is
-   * never consulted.
-   */
-  const attribute = (d) => {
-    if (suffix) return d.suffix === suffix;
-    if (argv && isOurs(d.command, argv)) {
-      if (d.suffix) suffix = d.suffix;
-      return true;
-    }
-    if (root === null) return false;   // nothing to descend from yet
-    if (mine.has(d.pid)) return true;
-    // A suffix already proven foreign needs no `ps`: the suffix is per `srt`.
-    if (d.suffix && foreignSuffixes.has(d.suffix)) return false;
-    if (tree === null) snapshot();
-    if (!descends(d.pid, root, tree)) {
-      // A pid the snapshot does not have may simply be younger than it.
-      // Refresh once, then believe the answer — unless the last refresh was
-      // moments ago, and then look again later rather than refresh now. A pid
-      // it does have is answered: its parents do not change into ours.
-      if (treeAt < d.seen && !tree.has(d.pid)) {
-        if (now() - treeAt < TREE_MS) { later(); return LATER; }
-        snapshot();
-      }
-      if (!descends(d.pid, root, tree)) {
-        // Alive, not ours by either anchor, and under another run — the tag
-        // did not match above. Every later line from that `srt` is someone
-        // else's without asking. Alive but under no run at all is an orphan
-        // (`cmd &`, a daemon): possibly ours, so its suffix stays undecided
-        // rather than turning this run's own later lines into strangers.
-        if (d.suffix && tree.has(d.pid) && underAnotherRun(d.pid, root, tree)) foreignSuffixes.add(d.suffix);
-        return false;
-      }
-    }
-    mine.add(d.pid);
-    // The first proven denial hands us the suffix for every later one.
-    if (d.suffix) suffix = d.suffix;
-    return true;
-  };
-
-  /**
-   * The same refusal, reported twice.
-   *
-   * macOS emits a violation from `kernel` and, for some of them, a second
-   * extended report from `sandboxd` carrying the identical `Sandbox:` line.
-   * They are one event and the log has to say so — `review` counts lines, and a
-   * denial that shows as two is a policy that looks twice as wrong as it is.
-   * Measured on the first real run: 31 doubled events out of 730.
-   *
-   * Keyed on what the kernel said, not on when we read it: two deliveries of one
-   * event agree on pid, operation and path and disagree on arrival time.
-   */
-  const recent = new Map();
-  const isRepeat = (d) => {
-    const key = `${d.pid}|${d.operation}|${d.path}`;
-    const now = Date.now();
-    for (const [k, t] of recent) if (now - t > REPEAT_MS) recent.delete(k); else break;
-    if (recent.has(key)) return true;
-    recent.set(key, now);
-    return false;
-  };
-
-  const consider = (d) => {
-    const verdict = attribute(d);
-    if (verdict === true) {
-      stats.attributed++;
-      onDeny(d);
-      // Learning the suffix makes every held line decidable. Without this,
-      // denials that arrived while the first process was being identified —
-      // which on a fast command is all of them — are lost.
-      if (suffix && held.length) revisit();
-      return;
-    }
-    // Not ours *yet*. Two reasons, both temporary: the run has not spawned the
-    // child whose pid anchors attribution, or the process died before `ps`
-    // could see it. Either way a foreign sandbox and one of ours look the same
-    // from here, so hold the line rather than credit or discard it.
-    // A line put off to the next snapshot is held with or without a suffix:
-    // the look it is waiting for is the only thing that can decide it.
-    if (verdict === LATER || (!suffix && d.suffix && !foreignSuffixes.has(d.suffix))) {
-      stats.unattributed++;
-      held.push(d);
-      // Bounded, because the common case on a busy machine is a run that is
-      // never refused anything: it never learns its own suffix, so every
-      // denial from every other sandbox lands here and nothing ever drains it.
-      // Several cells running at once for hours is exactly that shape, and an
-      // unbounded array is how an instrument becomes the leak.
-      //
-      // Dropping the oldest is the right end to drop. What is still worth
-      // replaying is whatever arrived near the run's own first refusal; a
-      // denial from an hour ago that is still unattributed is not ours.
-      while (held.length > HELD_MAX) { held.shift(); stats.unattributed--; stats.foreign++; }
-      return;
-    }
-    stats.foreign++;
-  };
-
-  /** Re-examine what was held, now that something new is known. */
-  const revisit = () => {
-    for (const h of held.splice(0)) { stats.unattributed--; consider(h); }
-  };
+  const attribution = createDenialAttribution(onDeny, {
+    pid, argv, treeFn, now, stats,
+    requestRecheck() {
+      if (recheck) return;
+      recheck = setTimeout(() => { recheck = null; attribution.revisitPending(); }, TREE_MS);
+      recheck.unref?.();
+    },
+  });
 
   let child;
   try {
@@ -607,12 +355,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
       // in `buf`, which close() counts.
       stats.dropped += droppedIn(chunk);
       const d = parseChunk(chunk);
-      if (d) d.seen = now();
-      // Deduplicated here and not in consider(), because a held denial goes
-      // through consider() a second time when it is finally attributed. Doing
-      // this there would drop every line that arrived before the child had a
-      // pid — which, on a short command, is all of them.
-      if (d && !isRepeat(d)) consider(d);
+      if (d) attribution.accept(d);
     }
     // A stream we cannot parse is not a leak. A flooded one is mostly markers
     // with no tag between them, so they are counted before they go.
@@ -627,19 +370,8 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     reason: null,
     stats,
 
-    /**
-     * Name the process whose descendants count as ours.
-     *
-     * Separate from the constructor because the stream has to be listening
-     * *before* the child starts. A short command — the kind an agent runs
-     * hundreds of times — is refused and gone in single-digit milliseconds, so
-     * a monitor started after the spawn misses precisely the denials it exists
-     * to catch. Measured: with the stream started afterwards, a one-line `sh -c`
-     * refusal recorded nothing at all.
-     */
     attributeTo(childPid) {
-      root = childPid;
-      if (held.length) revisit();
+      attribution.attributeTo(childPid);
     },
 
     /**
@@ -652,6 +384,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
      * nothing pending — costs one tick rather than the full window.
      */
     close({ drain = 0 } = {}) {
+      // Cancel before draining without resetting the handle: preserve replay scheduling.
       clearTimeout(recheck);
       const stop = () => ended(child).then(() => { stats.dropped += droppedIn(buf); buf = ""; return stats; });
       if (drain <= 0) return stop();
@@ -698,38 +431,6 @@ const END_MS = 1000;
  */
 const QUIET_MS = 60;
 
-/**
- * The shortest time between two `ps` snapshots while attribution is learning.
- *
- * Long enough that a burst of foreign denials costs one snapshot, not one
- * each; short enough that a line held for a younger process is decided before
- * anyone reads the log.
- */
-const TREE_MS = 250;
-
-/** What `attribute` answers for a line it has put off to the next snapshot. */
-const LATER = "later";
-
-/**
- * How many undecided denials to keep while waiting to learn our own suffix.
- *
- * Generous enough to cover the startup window — where every denial arrives
- * before there is anything to attribute it to — and small enough that a run
- * which is never refused anything cannot accumulate another sandbox's traffic
- * for the length of an agent session.
- */
-const HELD_MAX = 500;
-
-/**
- * How long two reports of one refusal can be apart and still be one event.
- *
- * The second copy — `sandboxd`'s extended report — follows the kernel's within
- * milliseconds. Kept short so that a role genuinely retrying the same path a
- * second later is still recorded as a second attempt, which is what makes
- * `asked 3×` mean anything.
- */
-const REPEAT_MS = 1000;
-
 /**
  * Is the system log dropping messages right now, and who is writing the most?
  *

package/src/walls.js

@@ -138,10 +138,12 @@ export function hitsOf(file, role, action, target, run = null) {
   // the cut, so a cut on a boundary keeps it). Comparing the file's byte size
   // with the text's UTF-16 length used to decide that, and with any multibyte
   // character in the tail it kept the fragment of a line or dropped a whole one.
-  const id = run ? String(run).slice(0, 8) : null;
+  // The canary carries the run's label: the launcher's --run-id whole, or the
+  // first 8 characters of seisin's own id (older runs exported the whole id).
+  const id = run ? String(run) : null;
   let total = 0, inRun = null;
   for (const e of readEntries(file, { tail: TAIL_BYTES })) {
-    if (id && e.event === "canary" && e.role === role && e.run === id) inRun = 0;
+    if (id && e.event === "canary" && e.role === role && (e.run === id || e.run === id.slice(0, 8))) inRun = 0;
     if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) {
       total++;
       if (inRun !== null) inRun++;