sentinelayer-cli 0.30.0 → 0.30.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.30.0",
+  "version": "0.30.2",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/commands/session.js

@@ -42,7 +42,9 @@ import {
 import { listRuntimeRuns } from "../session/runtime-bridge.js";
 import {
   listFileLocks,
+  lockFile,
   releaseFileLocksForAgent,
+  unlockFile,
 } from "../session/file-locks.js";
 import {
   injectSessionGuides,
@@ -2014,30 +2016,6 @@ export function buildSessionLockDirective(verb, file, intent = "") {
   return normalizedIntent ? `lock: ${normalizedFile} - ${normalizedIntent}` : `lock: ${normalizedFile}`;
 }
 
-// Posts a coordination directive (e.g. "lock: <file> - <intent>") as a session
-// message so the session daemon processes it into the authoritative file-lock
-// registry. Used by `session lock`/`unlock` as ergonomic sugar over the
-// say-convention; locks are advisory + daemon-enforced with TTL auto-release,
-// so this is a best-effort post.
-async function postSessionDirectiveMessage(sessionId, message, {
-  agentId,
-  targetPath = process.cwd(),
-} = {}) {
-  const clientMessageId = `cli-${randomUUID()}`;
-  const agent = await resolveSessionAgentEnvelope(sessionId, agentId, { targetPath });
-  await ensureSessionSayAgentRegistered(sessionId, agent, { targetPath });
-  const event = createAgentEvent({
-    event: "session_message",
-    agent,
-    sessionId,
-    payload: { message, channel: "session", clientMessageId },
-  });
-  event.eventId = clientMessageId;
-  event.idempotencyToken = clientMessageId;
-  const result = await syncSessionEventToApi(sessionId, event, { targetPath });
-  return { event, result };
-}
-
 async function runWithConcurrency(items = [], concurrency = 1, worker = async () => null) {
   const normalizedItems = Array.isArray(items) ? items : [];
   const normalizedConcurrency = Math.max(
@@ -3672,7 +3650,7 @@ export function registerSessionCommand(program) {
       return payload;
     });
 
-  const runLockDirectiveCommand = async (verb, sessionId, files, options, command) => {
+  const runFileLockCommand = async (verb, sessionId, files, options, command) => {
     const normalizedSessionId = normalizeString(sessionId);
     if (!normalizedSessionId) {
       throw new Error("session id is required.");
@@ -3698,20 +3676,68 @@ export function registerSessionCommand(program) {
       );
     }
     const intent = normalizeString(options.intent);
+    const results = [];
     const processed = [];
+    const skipped = [];
+    const failed = [];
     for (const file of fileList) {
-      const directive = buildSessionLockDirective(verb, file, intent);
-      await postSessionDirectiveMessage(normalizedSessionId, directive, {
-        agentId: identity.agentId,
+      if (verb === "lock") {
+        const result = await lockFile(normalizedSessionId, identity.agentId, file, {
+          intent,
+          targetPath,
+          awaitRemoteSync: true,
+        });
+        const record = {
+          file: result.file || file,
+          locked: Boolean(result.locked),
+          reason: result.reason || (result.locked ? "locked" : "held_by_other_agent"),
+          heldBy: result.heldBy || null,
+          since: result.since || null,
+        };
+        results.push(record);
+        if (result.locked) {
+          processed.push(record.file);
+        } else {
+          failed.push(record);
+        }
+        continue;
+      }
+
+      const result = await unlockFile(normalizedSessionId, identity.agentId, file, {
+        reason: intent || "manual_release",
         targetPath,
+        awaitRemoteSync: true,
       });
-      processed.push(file);
+      const record = {
+        file: result.file || file,
+        unlocked: Boolean(result.unlocked),
+        reason: result.reason || (result.unlocked ? "unlocked" : "not_locked"),
+        heldBy: result.heldBy || null,
+        since: result.since || null,
+      };
+      results.push(record);
+      if (result.unlocked) {
+        processed.push(record.file);
+      } else if (record.reason === "not_locked") {
+        skipped.push(record);
+      } else {
+        failed.push(record);
+      }
+    }
+
+    if (failed.length > 0) {
+      const summary = failed
+        .map((item) => `${item.file}${item.heldBy ? ` held by ${item.heldBy}` : ""}`)
+        .join(", ");
+      throw new Error(`session ${verb} failed for ${summary}`);
     }
     const payload = {
       command: `session ${verb}`,
       sessionId: normalizedSessionId,
       agentId: identity.agentId,
       files: processed,
+      results,
+      skipped,
     };
     if (shouldEmitJson(options, command)) {
       console.log(JSON.stringify(payload, null, 2));
@@ -3735,7 +3761,7 @@ export function registerSessionCommand(program) {
     .option("--path <path>", "Workspace path for the session", ".")
     .option("--json", "Emit machine-readable output")
     .action(async (sessionId, files, options, command) => {
-      await runLockDirectiveCommand("lock", sessionId, files, options, command);
+      await runFileLockCommand("lock", sessionId, files, options, command);
     });
 
   session
@@ -3746,7 +3772,7 @@ export function registerSessionCommand(program) {
     .option("--path <path>", "Workspace path for the session", ".")
     .option("--json", "Emit machine-readable output")
     .action(async (sessionId, files, options, command) => {
-      await runLockDirectiveCommand("unlock", sessionId, files, options, command);
+      await runFileLockCommand("unlock", sessionId, files, options, command);
     });
 
   session

package/src/review/investor-dd-devtestbot.js

@@ -10,6 +10,7 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
 
 import { recordProvisionedIdentity } from "../ai/identity-store.js";
 import { runDevTestBotSession } from "../agents/devtestbot/tool.js";
@@ -67,6 +68,26 @@ function parsePlannerJson(text) {
   }
 }
 
+// Derive a stable repo key for the managed-proxy DD entitlement gate (#94651):
+// owner/repo from the git remote when present, else a non-identifying local key
+// (hash of the absolute repo root — no raw path leak). Fail-safe to the local key.
+function deriveRepoKey(rootPath) {
+  try {
+    const remote = spawnSync("git", ["-C", rootPath || ".", "remote", "get-url", "origin"], {
+      encoding: "utf-8",
+    });
+    if (remote.status === 0) {
+      const url = String(remote.stdout || "").trim();
+      const match = url.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/);
+      if (match && match[1]) return match[1].toLowerCase();
+    }
+  } catch {
+    // fall through to the local key
+  }
+  const abs = path.resolve(rootPath || ".");
+  return `local/${crypto.createHash("sha256").update(abs).digest("hex").slice(0, 12)}`;
+}
+
 function buildPlannerPrompt({ rootPath, files = [], findings = [], budget = {} }) {
   const severityCounts = {};
   for (const finding of findings || []) {
@@ -86,9 +107,22 @@ function buildPlannerPrompt({ rootPath, files = [], findings = [], budget = {} }
   ].join("\n");
 }
 
-async function callPlannerClient({ plannerClient, rootPath, files, findings, budget, sessionUsage }) {
+export async function callPlannerClient({ plannerClient, rootPath, files, findings, budget, sessionUsage }) {
   if (!plannerClient) return { planned: {}, usageLedger: null };
   const prompt = buildPlannerPrompt({ rootPath, files, findings, budget });
+  // DD entitlement gate metadata (#94651): only label proxy calls when there
+  // is a real session usage anchor. API-side DD actions are fail-closed and
+  // reject incomplete session context before provider spend.
+  const sessionId = String(sessionUsage?.sessionId || "").trim();
+  const ddProxyFields = sessionId
+    ? {
+        action: INVESTOR_DD_USAGE_ACTIONS.devTestBotPlanner,
+        sessionId,
+        agentId: "investor-dd-devtestbot-planner",
+        usageIdempotencyKey: `investor-dd-devtestbot-${crypto.randomUUID()}`,
+        metadata: { repoKey: deriveRepoKey(rootPath), phase: "devtestbot" },
+      }
+    : {};
   if (typeof plannerClient.decideDevTestBotPhase === "function") {
     return {
       planned: await plannerClient.decideDevTestBotPhase({ rootPath, files, findings, budget, prompt }),
@@ -105,7 +139,7 @@ async function callPlannerClient({ plannerClient, rootPath, files, findings, bud
   }
   const startedAtIso = new Date().toISOString();
   if (typeof plannerClient.invoke === "function") {
-    const response = await plannerClient.invoke({ prompt, stream: false });
+    const response = await plannerClient.invoke({ prompt, stream: false, ...ddProxyFields });
     const usageLedger = sessionUsage
       ? await recordInvestorDdLlmUsage({
           usageContext: sessionUsage,
@@ -128,6 +162,7 @@ async function callPlannerClient({ plannerClient, rootPath, files, findings, bud
   if (typeof plannerClient.generatePlan === "function") {
     const response = await plannerClient.generatePlan([{ role: "user", content: prompt }], {
       phase: "devtestbot",
+      ...ddProxyFields,
     });
     const usageLedger = sessionUsage
       ? await recordInvestorDdLlmUsage({

package/src/session/file-locks.js

@@ -260,6 +260,8 @@ async function appendLockEvent(
   {
     targetPath = process.cwd(),
     nowIso = new Date().toISOString(),
+    syncRemote = true,
+    awaitRemoteSync = false,
   } = {}
 ) {
   return appendToStream(
@@ -273,6 +275,8 @@ async function appendLockEvent(
     }),
     {
       targetPath,
+      syncRemote,
+      awaitRemoteSync,
     }
   );
 }
@@ -371,6 +375,8 @@ export async function lockFile(
     ttlSeconds = DEFAULT_FILE_LOCK_TTL_SECONDS,
     targetPath = process.cwd(),
     nowIso = new Date().toISOString(),
+    syncRemote = true,
+    awaitRemoteSync = false,
   } = {}
 ) {
   const normalizedAgentId = normalizeAgentId(agentId);
@@ -437,6 +443,8 @@ export async function lockFile(
       {
         targetPath,
         nowIso: normalizedNow,
+        syncRemote,
+        awaitRemoteSync,
       }
     );
     return {
@@ -462,6 +470,8 @@ export async function unlockFile(
     targetPath = process.cwd(),
     nowIso = new Date().toISOString(),
     actorAgentId = null,
+    syncRemote = true,
+    awaitRemoteSync = false,
   } = {}
 ) {
   const normalizedAgentId = normalizeAgentId(agentId);
@@ -527,6 +537,8 @@ export async function unlockFile(
     {
       targetPath,
       nowIso: normalizedNow,
+      syncRemote,
+      awaitRemoteSync,
     }
   );