@secondlayer/sentinel 0.1.0 → 0.1.1

package/README.md

@@ -31,7 +31,7 @@ Anything that spends balance or changes monitoring shows what it would do first
 claude mcp add sentinel -- npx -y -p @secondlayer/sentinel sentinel-mcp
 ```
 
-Uses your login, or add `--env SENTINEL_API_KEY=sk-sl_…` for a scoped key. Every write tool takes `confirm`; without it you get what would happen and nothing changes.
+Uses your login, or add `--env SENTINEL_API_KEY=sk-snt_…` for a scoped key. A secondlayer API key won't work here; Sentinel keys start `sk-snt_`. Every write tool takes `confirm`; without it you get what would happen and nothing changes.
 
 ## SDK
 

package/dist/cli.js

@@ -279,6 +279,16 @@ async function planOfContract(client, contractId) {
 }
 
 // cli/auth.ts
+var NEEDS_TTY = 'sentinel login needs an interactive terminal. In CI: echo "$KEY" | sentinel login --with-token';
+var API_KEY_LOGIN = "Your secondlayer login is an API key Sentinel can't use. Run: sentinel login --force";
+
+class PromptClosedError extends Error {
+  constructor() {
+    super(NEEDS_TTY);
+    this.name = "PromptClosedError";
+  }
+}
+var isOtherProductKey = (message) => message.startsWith("This is a secondlayer API key");
 var sessionExpiry = () => new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
 async function post(doFetch, path, body) {
   try {
@@ -324,9 +334,39 @@ async function login(flags, io) {
   }
   const existing = await readSession();
   if (existing && !flags.includes("--force")) {
-    io.out(`Already logged in as ${existing.email}. Run again with --force to switch accounts.`);
-    return 0;
+    const r = await check(auth.clientFor(existing.token));
+    if (!("error" in r)) {
+      io.out(`Already logged in as ${r.email ?? existing.email}. Run again with --force to switch accounts.`);
+      return 0;
+    }
+    if (r.status === 401 && (existing.token.startsWith("sk-sl_") || isOtherProductKey(r.error))) {
+      io.err(API_KEY_LOGIN);
+      return 1;
+    }
+    if (r.status === 403) {
+      io.err(r.error);
+      return 0;
+    }
+    if (r.status !== 401) {
+      io.err(r.error);
+      return 1;
+    }
   }
+  if (!auth.interactive) {
+    io.err(NEEDS_TTY);
+    return 2;
+  }
+  try {
+    return await promptLogin(io);
+  } catch (e) {
+    if (!(e instanceof PromptClosedError))
+      throw e;
+    io.err(NEEDS_TTY);
+    return 2;
+  }
+}
+async function promptLogin(io) {
+  const { auth } = io;
   const doFetch = auth.fetch ?? globalThis.fetch;
   const email = (await auth.prompt("Email: ")).trim();
   if (!/^.+@.+\..+$/.test(email)) {
@@ -383,6 +423,22 @@ async function whoami(client, io) {
   return 0;
 }
 
+// client/labels.ts
+var isPrelaunchKey = (id) => id.startsWith("github:") || id.startsWith("gist:");
+function contractName(id) {
+  if (isPrelaunchKey(id))
+    return id.split(":").pop()?.split("/").pop()?.replace(/\.clar$/, "") ?? id;
+  return id.split(".")[1] ?? id;
+}
+var MONITOR_LABELS = {
+  draft: "not on yet",
+  requested: "setting up",
+  live: "watching",
+  armed: "armed for launch",
+  stale: "deploy didn't match"
+};
+var monitoringLabel = (status) => status ? MONITOR_LABELS[status] ?? status : "not on yet";
+
 // cli/sentinel.ts
 var USAGE = `sentinel <command>
 
@@ -484,8 +540,8 @@ ${USAGE}` : USAGE);
           io.out(JSON.stringify(plans, null, 2));
         else {
           const rows = plans.map((p) => [
-            p.contractId,
-            cell(p.monitoring, "none"),
+            contractName(p.contractId),
+            monitoringLabel(p.monitoring),
             p.evidence?.worst ? `${p.evidence.worst.severity} ${p.evidence.worst.evidence}` : null,
             p.planId
           ]);
@@ -893,7 +949,10 @@ async function readStdin() {
 async function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   try {
-    return await rl.question(question);
+    return await new Promise((resolve, reject) => {
+      rl.once("close", () => reject(new PromptClosedError));
+      rl.question(question).then(resolve, reject);
+    });
   } finally {
     rl.close();
   }
@@ -913,7 +972,13 @@ async function main() {
     client: clientFor(credential?.token ?? ""),
     out: console.log,
     err: console.error,
-    auth: { source: credential?.source ?? null, clientFor, prompt, readStdin }
+    auth: {
+      source: credential?.source ?? null,
+      interactive: Boolean(process.stdin.isTTY),
+      clientFor,
+      prompt,
+      readStdin
+    }
   });
 }
 process.exit(await main());

package/dist/mcp.js

@@ -20713,7 +20713,7 @@ async function runTool(tool, args) {
   }
 }
 function buildServer(client) {
-  const server = new McpServer({ name: "sentinel", version: "0.1.0" });
+  const server = new McpServer({ name: "sentinel", version: "0.1.1" });
   for (const [name, tool] of Object.entries(buildTools(client))) {
     server.registerTool(name, { description: tool.description, inputSchema: tool.input }, (args) => runTool(tool, args));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secondlayer/sentinel",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Sentinel from a terminal or an agent: the CLI, an MCP server and a client for your Stacks contract monitoring.",
   "license": "MIT",
   "repository": "https://runsentinel.app/docs",