seisin 0.7.0 → 0.7.1

package/README.md

@@ -524,8 +524,8 @@ of them. **[Each one, and why not a container →](https://github.com/carlostapi
 ## Status
 
 CI runs the full suite on macOS and `ubuntu-latest`, Node 18/20/22/24, on every pull request and
-push to `main`. On 2026-11-04, on Node 24: macOS **1134 tests, 1125 passing, 9 skipped**;
-Linux **1133, 1104 passing, 29 skipped**. The skips are platform tests; the job fails if the 26
+push to `main`. On 2026-11-04, on Node 24: macOS **1135 tests, 1126 passing, 9 skipped**;
+Linux **1134, 1105 passing, 29 skipped**. The skips are platform tests; the job fails if the 26
 core boundary tests in `test/sandbox.test.js` skip. A release is published only from CI, after
 that passes, with npm provenance. [Which claim was measured where](https://github.com/carlostapiacl/seisin/blob/main/docs/what-it-has-been-put-through.md#where-each-claim-was-actually-run),
 and [what running agents behind it cost](https://github.com/carlostapiacl/seisin/blob/main/docs/field-notes.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seisin",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "A permission layer for AI coding agents: role-scoped folders and keys, enforced by the OS, and when it denies something it tells you whose file it was.",
   "keywords": [
     "ai-agents",
@@ -42,7 +42,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@carlostapiacl/tartaros": "0.1.0-alpha.23"
+    "@carlostapiacl/tartaros": "0.1.0-alpha.24"
   },
   "devDependencies": {
     "@anthropic-ai/sandbox-runtime": "0.0.81"

package/src/commands/run.js

@@ -32,6 +32,7 @@ import { EXPECTED } from "../kinds.js";
 import { toolchainBins } from "../territory.js";
 import { writePathsOf, realOrSelf, SOCKET_MAX } from "../grants.js";
 import { runCanary, CANARY_EXIT } from "../canary.js";
+import { scratchWarnings } from "../inspect/machine.js";
 import { append, logPath } from "../log.js";
 import { flagsOf } from "../help.js";
 import { WILD } from "../paths.js";
@@ -317,6 +318,12 @@ export async function run(config, argv) {
     `env ${Object.keys(env).length} kept, ${dropped.length} dropped · read ${config.read}` +
     `${observe ? ` · ${C.yellow}OBSERVING — the repo is writable, the network is NOT${C.off}${C.dim}` : ""}${C.off}\n`
   );
+  // `check` says this, and a run is where it costs: the role writes another role's
+  // files and the banner above reads as if it could not.
+  if (!observe) {
+    const around = scratchWarnings(config).find((w) => w.kind === "scratch");
+    if (around) err(`${C.yellow}seisin: ${around.headline}. ${around.detail}${C.off}\n`);
+  }
 
   // Redaction needs the output to pass through this process, and piping breaks
   // anything that draws its own screen. So it turns itself off on a terminal