seisin 0.6.4 → 0.7.0

package/src/violations.js

@@ -42,9 +42,13 @@
  * per run is a line nobody can act on — and `seisin check` says it, with the
  * platform's other standing limits.
  */
-import { spawn, execFileSync } from "node:child_process";
+import { spawn } from "node:child_process";
 import { statSync } from "node:fs";
 import { basename } from "node:path";
+import { createDenialAttribution, processTree, TREE_MS } from "./denial-attribution.js";
+
+// Keep the existing helper imports available to callers and tests.
+export { shellSplit, isOurs, descends, processTree, underAnotherRun } from "./denial-attribution.js";
 
 /** Only sandbox-runtime tags its violations this way. Everything else on the
  *  machine — Safari, mDNSResponder, Spotlight — is filtered out by the OS
@@ -197,134 +201,6 @@ function decode(b64) {
   }
 }
 
-/**
- * Split a POSIX shell word list, the way a shell would.
- *
- * This reads the runtime's attribution tag, which carries the wrapped command
- * re-quoted for `sh -c` and truncated to 100 characters. Parsing it beats
- * re-generating it: any correct quoting of the same argument list parses back to
- * that list, so this keeps matching if the runtime changes how it quotes, which
- * re-implementing its `quote()` would not.
- *
- * Truncation means the last word is usually a fragment and the closing quote is
- * usually missing. That is expected, not an error — an unterminated word is
- * returned as far as it got, and {@link isOurs} treats the final word as a
- * prefix.
- */
-export function shellSplit(line) {
-  const words = [];
-  let word = null;
-  let quote = null;
-  for (let i = 0; i < line.length; i++) {
-    const c = line[i];
-    if (quote) {
-      if (c === quote) quote = null;
-      else word += c;
-      continue;
-    }
-    if (c === "'" || c === '"') { quote = c; word ??= ""; continue; }
-    if (c === "\\" && i + 1 < line.length) { word = (word ?? "") + line[++i]; continue; }
-    if (/\s/.test(c)) { if (word !== null) { words.push(word); word = null; } continue; }
-    word = (word ?? "") + c;
-  }
-  if (word !== null) words.push(word);
-  return words;
-}
-
-/**
- * Was this tagged command the one this run launched?
- *
- * The second of two anchors, and it exists because the first one is racy: a
- * refused `sh -c` can be dead before `ps` runs, and then a process tree proves
- * nothing. This one does not depend on the process still existing.
- *
- * Compared as a *prefix*, because the tag holds only the first 100 characters:
- * every complete word must match exactly, and the last word — the one the
- * truncation cut — only has to start the same way. A command that agrees with
- * ours for 100 characters and then differs would be credited to us, which is a
- * wrong attribution we accept: it requires another sandbox on the same machine
- * launching a command that matches ours to the byte for 100 bytes.
- */
-export function isOurs(tagged, argv) {
-  if (!tagged) return false;
-  const words = shellSplit(tagged);
-  if (words.length === 0 || words.length > argv.length) return false;
-  for (let i = 0; i < words.length - 1; i++) if (words[i] !== argv[i]) return false;
-  const last = words[words.length - 1];
-  return argv[words.length - 1]?.startsWith(last) ?? false;
-}
-
-/**
- * Is `pid` a descendant of `root`?
- *
- * This is the anchor for attribution, and it is the reason a denial from
- * somebody else's sandbox never lands in this repo's log. The alternative was
- * matching the decoded command against the one we launched, which would mean
- * reimplementing the runtime's shell quoting and inheriting its bugs; a process
- * tree is a fact the OS already holds.
- *
- * At most one `ps` per TREE_MS, and only until the session suffix is learned —
- * after that the suffix alone is exact, because it is generated once per `srt`
- * process. In practice that is one `ps` per run.
- */
-export function descends(pid, root, snapshot) {
-  const parent = new Map(snapshot);
-  const seen = new Set();
-  let at = pid;
-  while (at && at !== 1 && !seen.has(at)) {
-    if (at === root) return true;
-    seen.add(at);
-    at = parent.get(at);
-  }
-  return false;
-}
-
-/**
- * pid → ppid for every process this user can see, and in `tree.roots` the
- * pids that are a sandbox run's root: an `srt`, or a `seisin run`.
- *
- * The roots are what makes "not ours" provable. A process outside our tree is
- * someone else's only if its ancestry reaches another run; one whose ancestry
- * ends at init was orphaned — `cmd &`, a build daemon, git's fsmonitor — and
- * may well be ours, reparented when the shell that started it exited.
- */
-export function processTree(run = execFileSync) {
-  const tree = new Map();
-  tree.roots = new Set();
-  try {
-    const out = run("/bin/ps", ["-Ao", "pid=,ppid=,args="], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-    for (const line of out.split("\n")) {
-      const m = line.trim().match(/^(\d+)\s+(\d+)(?:\s+(.*))?$/);
-      if (!m) continue;
-      tree.set(Number(m[1]), Number(m[2]));
-      if (m[3] && RUN_ROOT.test(m[3])) tree.roots.add(Number(m[1]));
-    }
-  } catch {
-    // No tree means nothing can be attributed, which the caller handles by
-    // recording nothing. A permission tool does not invent an owner.
-  }
-  return tree;
-}
-
-/** The command line of an `srt` (however it was installed) or of `seisin run`. */
-const RUN_ROOT = /(?:^|[\s/])srt(?:\s|$)|sandbox-runtime\/dist\/cli\.js(?:\s|$)|(?:^|[\s/])(?:seisin|cli\.js)\s+run\s/;
-
-/**
- * Does `pid` descend from a run root other than `root`?
- *
- * A table without command lines (`roots` absent) cannot tell an orphan from a
- * stranger, and answers as before: alive and not ours is someone else's.
- */
-export function underAnotherRun(pid, root, snapshot) {
-  if (!snapshot.roots) return true;
-  const seen = new Set();
-  for (let at = pid; at && at !== 1 && !seen.has(at); at = snapshot.get(at)) {
-    if (at !== root && snapshot.roots.has(at)) return true;
-    seen.add(at);
-  }
-  return false;
-}
-
 /**
  * Did this refusal reach for content, or just walk past the door?
  *
@@ -442,143 +318,15 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
       close: () => Promise.resolve(stats),
     };
 
-  let suffix = null;               // learned once, exact from then on
-  let tree = null;                 // refreshed only while still learning
-  let treeAt = -Infinity;          // when `tree` was taken
-  let root = pid;                  // the srt pid; not known until after spawn
-  const mine = new Set();          // pids already proven to be ours
-  const held = [];                 // denials seen before they could be attributed
-  const foreignSuffixes = new Set(); // other sandboxes, proven while they were alive
   let recheck = null;              // a deferred look, when a snapshot was refused
-
-  /**
-   * One `ps` per TREE_MS at most, and a later look instead of a skipped one.
-   *
-   * `ps` is synchronous and it was taken for every denial from another sandbox
-   * while this run had not learned its own suffix — which, for a run that is
-   * never refused anything, is the whole run. Several cells at once is exactly
-   * that: 83 ms of blocked event loop per foreign line, measured. A line whose
-   * process may be younger than the last snapshot is not decided on it; it is
-   * held, and looked at again once the window has passed.
-   */
-  const snapshot = () => { tree = treeFn(); treeAt = now(); };
-  const later = () => {
-    if (recheck) return;
-    recheck = setTimeout(() => { recheck = null; if (!suffix && held.length) revisit(); }, TREE_MS);
-    recheck.unref?.();
-  };
-
-  /**
-   * Two anchors, and either one is enough.
-   *
-   * Neither works alone. The process tree is exact while the process exists and
-   * proves nothing once it has exited — which, for the short commands that get
-   * refused most, is by the time the line arrives. The command tag survives the
-   * process but depends on the runtime's quoting staying recognisable.
-   *
-   * Whichever answers first hands over the session suffix, and from that point
-   * attribution is one string comparison: the suffix is generated once per `srt`
-   * process, so it separates this run from every other sandbox on the machine
-   * exactly. In practice the tag settles it on the first denial and the tree is
-   * never consulted.
-   */
-  const attribute = (d) => {
-    if (suffix) return d.suffix === suffix;
-    if (argv && isOurs(d.command, argv)) {
-      if (d.suffix) suffix = d.suffix;
-      return true;
-    }
-    if (root === null) return false;   // nothing to descend from yet
-    if (mine.has(d.pid)) return true;
-    // A suffix already proven foreign needs no `ps`: the suffix is per `srt`.
-    if (d.suffix && foreignSuffixes.has(d.suffix)) return false;
-    if (tree === null) snapshot();
-    if (!descends(d.pid, root, tree)) {
-      // A pid the snapshot does not have may simply be younger than it.
-      // Refresh once, then believe the answer — unless the last refresh was
-      // moments ago, and then look again later rather than refresh now. A pid
-      // it does have is answered: its parents do not change into ours.
-      if (treeAt < d.seen && !tree.has(d.pid)) {
-        if (now() - treeAt < TREE_MS) { later(); return LATER; }
-        snapshot();
-      }
-      if (!descends(d.pid, root, tree)) {
-        // Alive, not ours by either anchor, and under another run — the tag
-        // did not match above. Every later line from that `srt` is someone
-        // else's without asking. Alive but under no run at all is an orphan
-        // (`cmd &`, a daemon): possibly ours, so its suffix stays undecided
-        // rather than turning this run's own later lines into strangers.
-        if (d.suffix && tree.has(d.pid) && underAnotherRun(d.pid, root, tree)) foreignSuffixes.add(d.suffix);
-        return false;
-      }
-    }
-    mine.add(d.pid);
-    // The first proven denial hands us the suffix for every later one.
-    if (d.suffix) suffix = d.suffix;
-    return true;
-  };
-
-  /**
-   * The same refusal, reported twice.
-   *
-   * macOS emits a violation from `kernel` and, for some of them, a second
-   * extended report from `sandboxd` carrying the identical `Sandbox:` line.
-   * They are one event and the log has to say so — `review` counts lines, and a
-   * denial that shows as two is a policy that looks twice as wrong as it is.
-   * Measured on the first real run: 31 doubled events out of 730.
-   *
-   * Keyed on what the kernel said, not on when we read it: two deliveries of one
-   * event agree on pid, operation and path and disagree on arrival time.
-   */
-  const recent = new Map();
-  const isRepeat = (d) => {
-    const key = `${d.pid}|${d.operation}|${d.path}`;
-    const now = Date.now();
-    for (const [k, t] of recent) if (now - t > REPEAT_MS) recent.delete(k); else break;
-    if (recent.has(key)) return true;
-    recent.set(key, now);
-    return false;
-  };
-
-  const consider = (d) => {
-    const verdict = attribute(d);
-    if (verdict === true) {
-      stats.attributed++;
-      onDeny(d);
-      // Learning the suffix makes every held line decidable. Without this,
-      // denials that arrived while the first process was being identified —
-      // which on a fast command is all of them — are lost.
-      if (suffix && held.length) revisit();
-      return;
-    }
-    // Not ours *yet*. Two reasons, both temporary: the run has not spawned the
-    // child whose pid anchors attribution, or the process died before `ps`
-    // could see it. Either way a foreign sandbox and one of ours look the same
-    // from here, so hold the line rather than credit or discard it.
-    // A line put off to the next snapshot is held with or without a suffix:
-    // the look it is waiting for is the only thing that can decide it.
-    if (verdict === LATER || (!suffix && d.suffix && !foreignSuffixes.has(d.suffix))) {
-      stats.unattributed++;
-      held.push(d);
-      // Bounded, because the common case on a busy machine is a run that is
-      // never refused anything: it never learns its own suffix, so every
-      // denial from every other sandbox lands here and nothing ever drains it.
-      // Several cells running at once for hours is exactly that shape, and an
-      // unbounded array is how an instrument becomes the leak.
-      //
-      // Dropping the oldest is the right end to drop. What is still worth
-      // replaying is whatever arrived near the run's own first refusal; a
-      // denial from an hour ago that is still unattributed is not ours.
-      while (held.length > HELD_MAX) { held.shift(); stats.unattributed--; stats.foreign++; }
-      return;
-    }
-    stats.foreign++;
-  };
-
-  /** Re-examine what was held, now that something new is known. */
-  const revisit = () => {
-    for (const h of held.splice(0)) { stats.unattributed--; consider(h); }
-  };
+  const attribution = createDenialAttribution(onDeny, {
+    pid, argv, treeFn, now, stats,
+    requestRecheck() {
+      if (recheck) return;
+      recheck = setTimeout(() => { recheck = null; attribution.revisitPending(); }, TREE_MS);
+      recheck.unref?.();
+    },
+  });
 
   let child;
   try {
@@ -607,12 +355,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
       // in `buf`, which close() counts.
       stats.dropped += droppedIn(chunk);
       const d = parseChunk(chunk);
-      if (d) d.seen = now();
-      // Deduplicated here and not in consider(), because a held denial goes
-      // through consider() a second time when it is finally attributed. Doing
-      // this there would drop every line that arrived before the child had a
-      // pid — which, on a short command, is all of them.
-      if (d && !isRepeat(d)) consider(d);
+      if (d) attribution.accept(d);
     }
     // A stream we cannot parse is not a leak. A flooded one is mostly markers
     // with no tag between them, so they are counted before they go.
@@ -627,19 +370,8 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
     reason: null,
     stats,
 
-    /**
-     * Name the process whose descendants count as ours.
-     *
-     * Separate from the constructor because the stream has to be listening
-     * *before* the child starts. A short command — the kind an agent runs
-     * hundreds of times — is refused and gone in single-digit milliseconds, so
-     * a monitor started after the spawn misses precisely the denials it exists
-     * to catch. Measured: with the stream started afterwards, a one-line `sh -c`
-     * refusal recorded nothing at all.
-     */
     attributeTo(childPid) {
-      root = childPid;
-      if (held.length) revisit();
+      attribution.attributeTo(childPid);
     },
 
     /**
@@ -652,6 +384,7 @@ export function watchDenials(onDeny, { pid = null, argv = null, platform = proce
      * nothing pending — costs one tick rather than the full window.
      */
     close({ drain = 0 } = {}) {
+      // Cancel before draining without resetting the handle: preserve replay scheduling.
       clearTimeout(recheck);
       const stop = () => ended(child).then(() => { stats.dropped += droppedIn(buf); buf = ""; return stats; });
       if (drain <= 0) return stop();
@@ -698,38 +431,6 @@ const END_MS = 1000;
  */
 const QUIET_MS = 60;
 
-/**
- * The shortest time between two `ps` snapshots while attribution is learning.
- *
- * Long enough that a burst of foreign denials costs one snapshot, not one
- * each; short enough that a line held for a younger process is decided before
- * anyone reads the log.
- */
-const TREE_MS = 250;
-
-/** What `attribute` answers for a line it has put off to the next snapshot. */
-const LATER = "later";
-
-/**
- * How many undecided denials to keep while waiting to learn our own suffix.
- *
- * Generous enough to cover the startup window — where every denial arrives
- * before there is anything to attribute it to — and small enough that a run
- * which is never refused anything cannot accumulate another sandbox's traffic
- * for the length of an agent session.
- */
-const HELD_MAX = 500;
-
-/**
- * How long two reports of one refusal can be apart and still be one event.
- *
- * The second copy — `sandboxd`'s extended report — follows the kernel's within
- * milliseconds. Kept short so that a role genuinely retrying the same path a
- * second later is still recorded as a second attempt, which is what makes
- * `asked 3×` mean anything.
- */
-const REPEAT_MS = 1000;
-
 /**
  * Is the system log dropping messages right now, and who is writing the most?
  *

package/src/walls.js

@@ -138,10 +138,12 @@ export function hitsOf(file, role, action, target, run = null) {
   // the cut, so a cut on a boundary keeps it). Comparing the file's byte size
   // with the text's UTF-16 length used to decide that, and with any multibyte
   // character in the tail it kept the fragment of a line or dropped a whole one.
-  const id = run ? String(run).slice(0, 8) : null;
+  // The canary carries the run's label: the launcher's --run-id whole, or the
+  // first 8 characters of seisin's own id (older runs exported the whole id).
+  const id = run ? String(run) : null;
   let total = 0, inRun = null;
   for (const e of readEntries(file, { tail: TAIL_BYTES })) {
-    if (id && e.event === "canary" && e.role === role && e.run === id) inRun = 0;
+    if (id && e.event === "canary" && e.role === role && (e.run === id || e.run === id.slice(0, 8))) inRun = 0;
     if (e.role === role && e.verdict === "denied" && e.action === action && e.target === target) {
       total++;
       if (inRun !== null) inRun++;

package/ui/index.html

@@ -2088,9 +2088,9 @@ table.runs tr.sys td{color:var(--dim)}
    * that was gone or had a new token. After two failed polls in a row the page
    * says which of the two it is, since when, and turns the writes off. */
   var FAILS = 0, OFFLINE = null;
-  function setOffline(kind){
-    if (kind && OFFLINE && OFFLINE.kind === kind) return;
-    OFFLINE = kind ? { kind: kind, since: (OFFLINE && OFFLINE.since) || new Date() } : null;
+  function setOffline(kind, why){
+    if (kind && OFFLINE && OFFLINE.kind === kind && OFFLINE.why === why) return;
+    OFFLINE = kind ? { kind: kind, why: why || null, since: (OFFLINE && OFFLINE.since) || new Date() } : null;
     var label = document.getElementById("source");
     var ban = document.getElementById("off-banner");
     if (!OFFLINE) {
@@ -2099,7 +2099,11 @@ table.runs tr.sys td{color:var(--dim)}
     } else {
       var t = pad(OFFLINE.since.getHours()) + ":" + pad(OFFLINE.since.getMinutes());
       label.style.color = "var(--amber)";
-      if (kind === "expired") {
+      if (kind === "policy") {
+        label.textContent = "seisin.toml cannot be read";
+        ban.innerHTML = "<b>seisin.toml cannot be read</b> (since " + t + "): " + esc(OFFLINE.why) + " " +
+          "What is on screen is the last policy that loaded. Decisions and saves are off until the file is fixed.";
+      } else if (kind === "expired") {
         label.textContent = "link expired — open the new one";
         ban.innerHTML = "<b>This tab's link has expired</b> (since " + t + "): the console was restarted with a new one. " +
           "Open the new link — run <code>seisin ui --link</code> in the repository. Decisions and saves are off in this tab.";
@@ -2184,7 +2188,13 @@ table.runs tr.sys td{color:var(--dim)}
     if (!fresh && LAST.etag && LAST.url === url) h["if-none-match"] = LAST.etag;
     var r = await fetch(url, { cache: "no-store", headers: h });
     if (r.status === 304) return { same: true };
-    if (!r.ok) return { status: r.status };
+    // A refusal carries the server's reason (a seisin.toml that no longer
+    // parses): kept, so it is shown instead of reading as the server gone.
+    if (!r.ok) {
+      var why = null;
+      try { why = (await r.json()).error || null; } catch (_) { /* no body */ }
+      return { status: r.status, error: why };
+    }
     var s = await r.json();
     if (s.error) return { status: r.status, error: s.error };
     LAST = { url: url, etag: r.headers.get("etag") };
@@ -2311,6 +2321,16 @@ table.runs tr.sys td{color:var(--dim)}
         'passes the example policy off as yours.</p></div>';
       return;
     }
+    if (!s && got && got.error) {
+      label.textContent = "seisin.toml cannot be read";
+      label.style.color = "var(--amber)";
+      document.querySelector("main").innerHTML =
+        '<div class="box" style="padding:22px 24px;max-width:640px">' +
+        '<h2 style="margin:0 0 8px;font-size:17px">The console cannot read this repository\'s policy</h2>' +
+        '<p style="margin:0 0 8px" class="err">' + esc(got.error) + '</p>' +
+        '<p style="margin:0;color:var(--mid)">Fix the file and reload. <code>seisin check</code> says the same in a terminal.</p></div>';
+      return;
+    }
     if (!s) {
       label.textContent = location.protocol.startsWith("http") && !TOKEN
         ? "no token — showing an example"
@@ -2632,6 +2652,8 @@ table.runs tr.sys td{color:var(--dim)}
       if (got.s) applyState(got.s);
       return;
     }
+    // The server answered, with the reason it cannot: said at once, not as an outage.
+    if (got.error && got.status !== 401 && got.status !== 403) { FAILS = 0; setOffline("policy", got.error); return; }
     FAILS++;
     if (FAILS >= 2) setOffline(got.status === 401 || got.status === 403 ? "expired" : "down");
   }