@misterhuydo/sentinel 1.0.50 → 1.0.52

package/.cairn/.hint-lock

@@ -1 +1 @@
-2026-03-22T09:54:45.729Z
+2026-03-22T10:41:20.633Z

package/.cairn/session.json

@@ -1,6 +1,6 @@
 {
-  "message": "Auto-checkpoint at 2026-03-22T10:07:25.081Z",
-  "checkpoint_at": "2026-03-22T10:07:25.082Z",
+  "message": "Auto-checkpoint at 2026-03-22T10:44:11.780Z",
+  "checkpoint_at": "2026-03-22T10:44:11.781Z",
   "active_files": [],
   "notes": [],
   "mtime_snapshot": {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@misterhuydo/sentinel",
-  "version": "1.0.50",
+  "version": "1.0.52",
   "description": "Sentinel — Autonomous DevOps Agent installer and manager",
   "bin": {
     "sentinel": "./bin/sentinel.js"

package/python/sentinel/config_loader.py

@@ -60,6 +60,8 @@ class SentinelConfig:
     slack_bot_token: str = ""        # xoxb-...
     slack_app_token: str = ""        # xapp-... (Socket Mode)
     slack_channel: str = ""          # optional: restrict to one channel ID or name
+    slack_watch_channels: list[str] = field(default_factory=list)  # channels to passively monitor for bot errors
+    slack_watch_bot_ids: list[str] = field(default_factory=list)   # optional: only watch these bot IDs
     project_name: str = ""           # optional: friendly name used by Sentinel Boss (e.g. "1881")
 
 
@@ -153,6 +155,8 @@ class ConfigLoader:
         c.slack_bot_token = d.get("SLACK_BOT_TOKEN", "")
         c.slack_app_token = d.get("SLACK_APP_TOKEN", "")
         c.slack_channel = d.get("SLACK_CHANNEL", "")
+        c.slack_watch_channels = _csv(d.get("SLACK_WATCH_CHANNELS", ""))
+        c.slack_watch_bot_ids = _csv(d.get("SLACK_WATCH_BOT_IDS", ""))
         c.project_name = d.get("PROJECT_NAME", "")
         self.sentinel = c
 

package/python/sentinel/fix_engine.py

@@ -124,7 +124,7 @@ def generate_fix(
         env["ANTHROPIC_API_KEY"] = cfg.anthropic_api_key
     try:
         result = subprocess.run(
-            [cfg.claude_code_bin, "--print", prompt],
+            [cfg.claude_code_bin, "--dangerously-skip-permissions", "--print", prompt],
             capture_output=True, text=True, timeout=SUBPROCESS_TIMEOUT, env=env,
         )
     except subprocess.TimeoutExpired:

package/python/sentinel/sentinel_boss.py

@@ -771,7 +771,7 @@ async def _handle_with_cli(
 
     try:
         result = subprocess.run(
-            [cfg.claude_code_bin, "--print", prompt],
+            [cfg.claude_code_bin, "--dangerously-skip-permissions", "--print", prompt],
             capture_output=True, text=True, timeout=180, env=env,
         )
         output = (result.stdout or "").strip()

package/python/sentinel/slack_bot.py

@@ -164,19 +164,133 @@ async def run_slack_bot(cfg_loader, store) -> None:
         if _allowed(event.get("channel", "")):
             await _dispatch(event, client, cfg_loader, store)
 
+    # ── Watch-channel resolver ────────────────────────────────────────────────
+    # Lazily resolves SLACK_WATCH_CHANNELS names → IDs on first message event
+    _watch_ids: set[str] = set()
+    _watch_resolved = [False]  # mutable cell (closure-friendly)
+
+    async def _resolve_watch_channels(client):
+        if _watch_resolved[0]:
+            return
+        _watch_resolved[0] = True
+        if not cfg.slack_watch_channels:
+            return
+        try:
+            resp = await client.conversations_list(
+                types="public_channel,private_channel", limit=1000
+            )
+            name_to_id = {ch["name"]: ch["id"] for ch in (resp.get("channels") or [])}
+        except Exception as e:
+            logger.warning("Could not list channels for watch resolution: %s", e)
+            name_to_id = {}
+        for raw in cfg.slack_watch_channels:
+            raw = raw.lstrip("#")
+            if raw.upper().startswith("C") and len(raw) >= 9:
+                _watch_ids.add(raw.upper())
+                logger.info("Sentinel watching channel (ID): %s", raw.upper())
+            elif raw in name_to_id:
+                _watch_ids.add(name_to_id[raw])
+                logger.info("Sentinel watching channel: #%s → %s", raw, name_to_id[raw])
+            else:
+                logger.warning("Watch channel '%s' not found — skipping", raw)
+
+    def _is_watch_channel(channel: str) -> bool:
+        return bool(_watch_ids) and channel in _watch_ids
+
     @app.event("message")
     async def on_message(event, client):
-        # DMs are always allowed regardless of SLACK_CHANNEL restriction
+        # DMs from humans → Boss conversation
         if event.get("channel_type") == "im" and not event.get("bot_id"):
             await _dispatch(event, client, cfg_loader, store)
+            return
+
+        # Passive bot watcher — bot messages in watched channels
+        if event.get("bot_id") and event.get("channel"):
+            if not _watch_resolved[0]:
+                await _resolve_watch_channels(client)
+            if _is_watch_channel(event["channel"]):
+                await _handle_bot_message(event, client, cfg_loader, store)
 
     # ── Start ─────────────────────────────────────────────────────────────────
 
     handler = AsyncSocketModeHandler(app, cfg.slack_app_token)
     logger.info("Sentinel Boss connected to Slack (Socket Mode)")
+    if cfg.slack_watch_channels:
+        logger.info("Sentinel will passively watch for bot errors in: %s", cfg.slack_watch_channels)
     await handler.start_async()
 
 
+# ── Bot-message watcher ───────────────────────────────────────────────────────
+
+import re as _re
+import uuid as _uuid
+from pathlib import Path as _Path
+
+# Patterns that indicate an error report worth queuing
+_ERROR_RE = _re.compile(
+    r"(?:exception|error|failed|failure|fatal|traceback|stacktrace"
+    r"|null\s*pointer|out\s*of\s*memory|stack\s*overflow"
+    r"|5\d\d\b.*(?:error|failed)"  # HTTP 5xx
+    r"|WARN|ERROR|FATAL|CRITICAL)",
+    _re.IGNORECASE,
+)
+
+
+def _looks_like_error(text: str) -> bool:
+    """Return True if the bot message appears to be an error report."""
+    return bool(_ERROR_RE.search(text))
+
+
+async def _handle_bot_message(event: dict, client, cfg_loader, store) -> None:
+    """
+    Called when a bot posts in a watched channel.
+    If the message looks like an error, auto-queue it as a Sentinel issue.
+    """
+    cfg     = cfg_loader.sentinel
+    bot_id  = event.get("bot_id", "")
+    channel = event.get("channel", "")
+    ts      = event.get("ts", "")
+
+    # Optional bot-ID filter: skip bots not on the allow-list
+    if cfg.slack_watch_bot_ids and bot_id not in cfg.slack_watch_bot_ids:
+        return
+
+    # Flatten text (handle block-kit attachments too)
+    text = event.get("text", "")
+    for att in event.get("attachments", []):
+        text += "\n" + att.get("text", "") + "\n" + att.get("fallback", "")
+    text = text.strip()
+
+    if not text or not _looks_like_error(text):
+        return
+
+    # Avoid duplicate issues — skip if we've seen this exact ts from this bot
+    dedup_key = f"slack-watch:{channel}:{ts}"
+    if store.is_seen_dedup(dedup_key):
+        return
+    store.mark_seen_dedup(dedup_key)
+
+    # Write the issue file so Sentinel picks it up on the next poll
+    issues_dir = _Path("issues")
+    issues_dir.mkdir(exist_ok=True)
+    fname = f"slack-watch-{_uuid.uuid4().hex[:8]}.txt"
+    content = (
+        f"SOURCE: Slack bot {bot_id} in channel {channel}\n"
+        f"SLACK_TS: {ts}\n\n"
+        f"{text}"
+    )
+    (issues_dir / fname).write_text(content, encoding="utf-8")
+    _Path("SENTINEL_POLL_NOW").touch()
+    logger.info("Bot watcher queued issue from %s: %s", bot_id, fname)
+
+    # React with 👀 so the team knows Sentinel noticed it
+    if ts:
+        try:
+            await client.reactions_add(channel=channel, timestamp=ts, name="eyes")
+        except Exception:
+            pass  # reactions:write scope may not be granted — non-fatal
+
+
 # ── Dispatcher ────────────────────────────────────────────────────────────────
 
 async def _dispatch(event: dict, client, cfg_loader, store) -> None:

package/python/sentinel/state_store.py

@@ -273,3 +273,29 @@ class StateStore:
             if row:
                 return datetime.fromisoformat(row["sent_at"])
             return None
+
+    # ── Dedup store (used by Slack bot watcher) ───────────────────────────────
+
+    def is_seen_dedup(self, key: str) -> bool:
+        """Return True if this dedup key has already been processed."""
+        with self._conn() as conn:
+            conn.execute(
+                "CREATE TABLE IF NOT EXISTS dedup "
+                "(key TEXT PRIMARY KEY, seen_at TEXT)"
+            )
+            row = conn.execute(
+                "SELECT key FROM dedup WHERE key = ?", (key,)
+            ).fetchone()
+            return row is not None
+
+    def mark_seen_dedup(self, key: str):
+        """Record a dedup key so it won't be processed again."""
+        with self._conn() as conn:
+            conn.execute(
+                "CREATE TABLE IF NOT EXISTS dedup "
+                "(key TEXT PRIMARY KEY, seen_at TEXT)"
+            )
+            conn.execute(
+                "INSERT OR IGNORE INTO dedup (key, seen_at) VALUES (?, ?)",
+                (key, _now()),
+            )

package/templates/sentinel.properties

@@ -27,7 +27,7 @@ WORKSPACE_DIR=./workspace
 
 # Slack Bot (optional) — Sentinel Boss conversational interface
 # Create a Slack App at api.slack.com, enable Socket Mode, add scopes:
-#   app_mentions:read, chat:write, im:history, channels:history, users:read
+#   app_mentions:read, chat:write, im:history, channels:history, users:read, reactions:write
 # Then install to workspace and paste both tokens here.
 # SLACK_BOT_TOKEN=xoxb-...
 # SLACK_APP_TOKEN=xapp-...
@@ -35,3 +35,13 @@ WORKSPACE_DIR=./workspace
 # Use the channel name (e.g. devops-sentinel) or the Slack channel ID (e.g. C01AB2CD3EF)
 # Note: requires conversations:read scope on the Slack App if using channel name
 # SLACK_CHANNEL=devops-sentinel
+
+# Passive bot watcher (optional) — Sentinel silently monitors these channels for error
+# reports from other bots (e.g. an app alerting bot on a secured server you can't SSH into).
+# When it detects an error message it auto-queues an issue — no @Sentinel mention needed.
+# It reacts with 👀 so the team sees Sentinel noticed it.
+# Comma-separated list of channel names or IDs.
+# SLACK_WATCH_CHANNELS=alerts-1881, errors-prod
+# Optional: only watch messages from specific bot IDs (comma-separated Slack bot IDs).
+# Omit to watch all bots in the channel.
+# SLACK_WATCH_BOT_IDS=B12345678, B87654321