@misterhuydo/sentinel 1.4.81 → 1.4.82

package/.cairn/session.json

@@ -1,6 +1,6 @@
 {
-  "message": "Auto-checkpoint at 2026-03-27T02:09:31.962Z",
-  "checkpoint_at": "2026-03-27T02:09:31.963Z",
+  "message": "Auto-checkpoint at 2026-03-27T02:10:14.448Z",
+  "checkpoint_at": "2026-03-27T02:10:14.449Z",
   "active_files": [],
   "notes": [],
   "mtime_snapshot": {}

package/lib/add.js

@@ -616,23 +616,34 @@ async function addFromGit(gitUrl, workspace) {
     generateWorkspaceScripts(workspace, {}, {}, {}, effectiveToken);
   }
 
-  // Write project-level Slack tokens if collected
+  // Write private Slack tokens to slack.properties (gitignored) + set PRIVATE_SLACK=true
   if (projectSlackBotToken || projectSlackAppToken) {
+    // Write slack.properties (never committed — tokens stay off git)
+    const slackProps = path.join(projectDir, 'slack.properties');
+    const lines = ['# Private Slack tokens for this project — DO NOT COMMIT'];
+    if (projectSlackBotToken) lines.push(`SLACK_BOT_TOKEN=${projectSlackBotToken}`);
+    if (projectSlackAppToken) lines.push(`SLACK_APP_TOKEN=${projectSlackAppToken}`);
+    fs.writeFileSync(slackProps, lines.join('\n') + '\n');
+    ok('Private Slack tokens → slack.properties (local only)');
+
+    // Ensure slack.properties is gitignored
+    const gitignore = path.join(projectDir, '.gitignore');
+    const ignoreEntry = 'slack.properties';
+    const existing = fs.existsSync(gitignore) ? fs.readFileSync(gitignore, 'utf8') : '';
+    if (!existing.includes(ignoreEntry)) {
+      fs.writeFileSync(gitignore, existing.trimEnd() + `\n${ignoreEntry}\n`);
+      ok('.gitignore updated — slack.properties will not be committed');
+    }
+
+    // Set PRIVATE_SLACK=true in config/sentinel.properties
     const projProps = path.join(projectDir, 'config', 'sentinel.properties');
     if (fs.existsSync(projProps)) {
       let props = fs.readFileSync(projProps, 'utf8');
-      if (projectSlackBotToken) {
-        props = /^#?\s*SLACK_BOT_TOKEN\s*=/m.test(props)
-          ? props.replace(/^#?\s*SLACK_BOT_TOKEN\s*=.*/m, `SLACK_BOT_TOKEN=${projectSlackBotToken}`)
-          : props.trimEnd() + `\nSLACK_BOT_TOKEN=${projectSlackBotToken}\n`;
-      }
-      if (projectSlackAppToken) {
-        props = /^#?\s*SLACK_APP_TOKEN\s*=/m.test(props)
-          ? props.replace(/^#?\s*SLACK_APP_TOKEN\s*=.*/m, `SLACK_APP_TOKEN=${projectSlackAppToken}`)
-          : props.trimEnd() + `\nSLACK_APP_TOKEN=${projectSlackAppToken}\n`;
-      }
+      props = /^#?\s*PRIVATE_SLACK\s*=/m.test(props)
+        ? props.replace(/^#?\s*PRIVATE_SLACK\s*=.*/m, 'PRIVATE_SLACK=true')
+        : props.trimEnd() + '\nPRIVATE_SLACK=true\n';
       fs.writeFileSync(projProps, props);
-      ok('Project-level Slack tokens saved to config/sentinel.properties');
+      ok('PRIVATE_SLACK=true set in config/sentinel.properties');
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@misterhuydo/sentinel",
-  "version": "1.4.81",
+  "version": "1.4.82",
   "description": "Sentinel — Autonomous DevOps Agent installer and manager",
   "bin": {
     "sentinel": "./bin/sentinel.js"

package/python/sentinel/config_loader.py

@@ -151,6 +151,17 @@ class ConfigLoader:
             project_d = _parse_properties(str(path))
             d.update({k: v for k, v in project_d.items() if v})
 
+        # If PRIVATE_SLACK=true, load Slack tokens from <projectDir>/slack.properties
+        # (gitignored — tokens never live in the config repo).
+        if d.get("PRIVATE_SLACK", "").lower() == "true":
+            slack_props = self.config_dir.parent / "slack.properties"
+            if slack_props.exists():
+                slack_d = _parse_properties(str(slack_props))
+                d.update({k: v for k, v in slack_d.items() if v})
+                logger.debug("Loaded private Slack config from %s", slack_props)
+            else:
+                logger.warning("PRIVATE_SLACK=true but %s not found — run `sentinel add` to create it", slack_props)
+
         c = SentinelConfig()
         c.poll_interval_seconds = int(d.get("POLL_INTERVAL_SECONDS", 120))
         c.smtp_host = d.get("SMTP_HOST", "")

package/templates/sentinel.properties

@@ -42,33 +42,12 @@ WORKSPACE_DIR=./workspace
 # this key instead of the shared Claude Pro subscription.
 # ANTHROPIC_API_KEY=sk-ant-...
 
-# Slack Bot (optional) — Sentinel Boss conversational interface
-# Create a Slack App at api.slack.com, enable Socket Mode, add scopes:
-#   app_mentions:read, chat:write, im:history, channels:history, users:read, reactions:write
-# Then install to workspace and paste both tokens here.
-# SLACK_BOT_TOKEN=xoxb-...
-# SLACK_APP_TOKEN=xapp-...
-# Restrict Sentinel Boss to one channel (optional — omit to allow all channels + DMs)
-# Use the channel name (e.g. devops-sentinel) or the Slack channel ID (e.g. C01AB2CD3EF)
-# Note: requires conversations:read scope on the Slack App if using channel name
-# SLACK_CHANNEL=devops-sentinel
-
-# DM the submitter directly when a fix is applied or blocked (default: true).
-# Set to false to only mention them in the channel, without a private DM.
-# SLACK_DM_SUBMITTER=true
-
-# Allowlist of Slack user IDs permitted to give Sentinel Boss commands (RECOMMENDED).
-# If set, all other users are silently ignored — even in the configured channel.
-# Find a user ID in Slack: click their profile → ⋯ More → Copy member ID (starts with U).
-# Comma-separated. Leave unset to allow anyone who can reach the bot (less secure).
-# SLACK_ALLOWED_USERS=U01AB2CD3EF, U09GH8IJ7KL
-
-# Passive bot watcher — seed the watch list on startup with known bot IDs.
-# Sentinel will passively queue every message from these bots as issues (no @mention needed).
-# You can also add bots at runtime: "@Sentinel listen to @alertbot for project 1881"
-# Use "@Sentinel list watched bots" to see the current list.
-# Comma-separated list of Slack bot IDs (starts with B, not U).
-# SLACK_WATCH_BOT_IDS=B12345678, B87654321
+# Private Slack — set to true if this project uses a different Slack workspace
+# than the shared one configured in the workspace sentinel.properties.
+# When true, Sentinel loads Slack tokens from slack.properties in this project
+# directory (gitignored — tokens never committed to the config repo).
+# Run `sentinel add` to generate slack.properties interactively.
+# PRIVATE_SLACK=false
 
 # Boss mode override — overrides the workspace-level BOSS_MODE for this project only.
 # Options: standard (default) | strict | fun