sentinelayer-cli 0.32.0 → 0.32.2

package/README.md

@@ -929,6 +929,18 @@ Ledger contract:
 - network access to Sentinelayer API/web
 - optional: GitHub CLI (`gh`) authenticated for secret injection
 
+## Operator and architecture references
+
+- First-run engineering onboarding: `docs/ENGINEERING_ONBOARDING.md`
+- Senti session operations, coordination, kill, and rollback conventions: `docs/sessions.md`
+- Release workflow map and rollback drill ownership: `docs/workflow-matrix.md`
+- Release rollback execution: `.github/workflows/rollback.yml` and `.github/scripts/release-rollback-readiness.sh`
+- Architecture and decision records for major surfaces:
+  - Hosted MCP connector boundary: `docs/mcp-hosted-connector.md`
+  - MCP local/runtime entry points: `docs/mcp.md`
+  - Investor-DD architecture: `docs/INVESTOR_DD_ARCHITECTURE.md`
+  - CI/CD acknowledged release risks: `.github/policies/cicd-acknowledged-risks.md`
+
 ## Release to npm
 
 This repo includes `.github/workflows/release.yml`.
@@ -949,14 +961,15 @@ Release flow:
 
 1. Merge to `main` and let `Release Please` open/update the release PR.
 2. Merge the release PR after Omar, Quality Gates, and Attestation are green.
-3. From a clean checkout of the release commit, run the guarded release command:
+3. Wait for the main-branch `Release Please` workflow run on that merge commit to complete successfully.
+4. From a clean checkout of the release commit, run the guarded release command:
    ```bash
    git fetch origin main --tags
    git checkout main && git pull --ff-only
    npm run release:publish -- --tag v0.1.1 --notes-file release-notes.md
    ```
-4. The guarded command creates the tag with `git tag -s`, verifies it with `git tag -v`, pushes it, confirms the remote GitHub tag object is annotated and cryptographically verified by an allowlisted signer, then creates the GitHub release with `gh release create --verify-tag`.
-5. The tag push triggers `Release`, which re-verifies upstream checks, release artifact attestations, rollback readiness, protected `package-release` approval, and npm trusted publishing OIDC before publishing.
+5. The guarded command confirms the exact release commit has one successful main `Release Please` run, creates the tag with `git tag -s`, verifies it with `git tag -v`, pushes it, confirms the remote GitHub tag object is annotated and cryptographically verified by an allowlisted signer, then creates the GitHub release with `gh release create --verify-tag`.
+6. The tag push triggers `Release`, which re-verifies upstream checks, release artifact attestations, rollback readiness, protected `package-release` approval, and npm trusted publishing OIDC before publishing.
 
 Do not run `gh release create v0.1.1` before pushing the signed tag. GitHub release creation creates a lightweight tag when the tag does not already exist, and the Release workflow intentionally fails closed for lightweight tags. If a remote tag already exists as a lightweight tag, `npm run release:publish` refuses to create the GitHub release.
 
@@ -964,6 +977,7 @@ Release publish now enforces tarball checksum-manifest validation and attestatio
 
 Release guardrails now require successful upstream checks on the target commit:
 
+- `Release Please`
 - `Quality Summary`
 - `Omar Gate`
 - `Attestation Summary`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.32.0",
+  "version": "0.32.2",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/commands/config.js

@@ -13,6 +13,14 @@ import {
 } from "../config/service.js";
 
 const SCOPES = "global|project|env|resolved";
+const REDACTION_MARKER = "[REDACTED]";
+const SENSITIVE_TOP_LEVEL_KEYS = new Set([
+  "sentinelayerToken",
+  "openaiApiKey",
+  "anthropicApiKey",
+  "googleApiKey",
+]);
+const SENSITIVE_KEY_RE = /(authorization|cookie|set-cookie|x-api-key|api[_-]?key|secret|password|credential|token|webhook[_-]?url)/i;
 
 function shouldEmitJson(options, command) {
   const local = Boolean(options && options.json);
@@ -21,14 +29,59 @@ function shouldEmitJson(options, command) {
   return local || globalFromCommand;
 }
 
-function displayValue(value) {
+function isPlainObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+function isSensitiveConfigPath(pathParts = []) {
+  const lastKey = String(pathParts[pathParts.length - 1] || "");
+  if (!lastKey) return false;
+  if (pathParts.length === 1 && SENSITIVE_TOP_LEVEL_KEYS.has(lastKey)) return true;
+  if (SENSITIVE_KEY_RE.test(lastKey)) return true;
+  if (pathParts.includes("alerts") && lastKey.replace(/[_-]/g, "").toLowerCase() === "url") {
+    return true;
+  }
+  return false;
+}
+
+function redactConfigValue(value, pathParts = [], depth = 0) {
+  if (value === undefined) return undefined;
+  if (isSensitiveConfigPath(pathParts)) return REDACTION_MARKER;
+  if (depth > 8) return REDACTION_MARKER;
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactConfigValue(entry, pathParts, depth + 1));
+  }
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, inner]) => [
+        key,
+        redactConfigValue(inner, [...pathParts, key], depth + 1),
+      ])
+    );
+  }
+  return value;
+}
+
+function redactConfigLayer(layer = {}) {
+  return redactConfigValue(layer, []);
+}
+
+function redactConfigResult(result = {}) {
+  return {
+    ...result,
+    value: redactConfigValue(result.value, [result.key]),
+  };
+}
+
+function displayValue(key, value) {
+  const safeValue = redactConfigValue(value, [key]);
   if (value === undefined) {
     return "";
   }
-  if (typeof value === "string") {
-    return value;
+  if (typeof safeValue === "string") {
+    return safeValue;
   }
-  return JSON.stringify(value);
+  return JSON.stringify(safeValue);
 }
 
 function assertKnownKey(key) {
@@ -61,7 +114,7 @@ export function registerConfigCommand(program) {
           JSON.stringify(
             {
               scope,
-              config: layer,
+              config: redactConfigLayer(layer),
               paths: payload.paths,
             },
             null,
@@ -78,7 +131,7 @@ export function registerConfigCommand(program) {
         return;
       }
       for (const [key, value] of entries) {
-        console.log(`${key}: ${displayValue(value)}`);
+        console.log(`${key}: ${displayValue(key, value)}`);
       }
     });
 
@@ -103,7 +156,7 @@ export function registerConfigCommand(program) {
             {
               key: normalizedKey,
               scope,
-              value,
+              value: redactConfigValue(value, [normalizedKey]),
               source,
             },
             null,
@@ -119,7 +172,7 @@ export function registerConfigCommand(program) {
         return;
       }
 
-      console.log(displayValue(value));
+      console.log(displayValue(normalizedKey, value));
     });
 
   config
@@ -137,13 +190,13 @@ export function registerConfigCommand(program) {
       });
 
       if (shouldEmitJson(options, command)) {
-        console.log(JSON.stringify(result, null, 2));
+        console.log(JSON.stringify(redactConfigResult(result), null, 2));
         return;
       }
 
       console.log(pc.green(`Updated ${result.key} in ${result.scope} config.`));
       console.log(pc.gray(`Path: ${result.path}`));
-      console.log(`${result.key}: ${displayValue(result.value)}`);
+      console.log(`${result.key}: ${displayValue(result.key, result.value)}`);
     });
 
   config