sentinelayer-cli 0.32.3 → 0.32.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.32.3",
+  "version": "0.32.5",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/mcp/cli-command-tools.js

@@ -29,7 +29,41 @@ const SENSITIVE_COMMAND_PATHS = new Set([
   "session.kill",
   "session.listen",
   "session.provision-emails",
+  "daemon.control.stop",
+  "omargate.investor-dd",
+  // Token-handling (same class as auth.*): writes the live SentinelLayer token into a
+  // caller-specified GitHub repo's secrets — a token-misplacement/exfil vector via the bridge.
+  "scan.setup-secrets",
+  // Bulk session-content exfil (same rationale that blocks config.*): full transcript dumps
+  // can carry arbitrary sensitive content that output-redaction does not mask. `session read`
+  // (normal recent-message reads) stays available for legitimate agent use.
+  "session.export",
+  "session.download",
+  "review.show",
+  "review.export",
+  // Identity/state mutation (same class as session.kill): create/revoke/kill AIdenIDs +
+  // provision emails (cost + side effects) should not be driven by an untrusted LLM via the bridge.
+  "ai.identity.provision",
+  "ai.identity.revoke",
+  "ai.identity.kill-all",
+  "ai.identity.create-child",
+  "ai.identity.revoke-children",
+  "ai.provision-email",
+  // Inbound AIdenID extraction surfaces can expose OTPs, action links, or raw events.
+  "ai.identity.events",
+  "ai.identity.latest",
+  "ai.identity.wait-for-otp",
 ]);
+
+// Whole governance sub-trees under ai.identity (domain/target/site/legal-hold) are live
+// identity-governance mutations (create/verify/freeze/etc.); block the entire prefix so the
+// bridge stays complete + future-proof as new leaves are added. Operators use the direct CLI.
+const SENSITIVE_COMMAND_PREFIXES = [
+  "ai.identity.domain.",
+  "ai.identity.target.",
+  "ai.identity.site.",
+  "ai.identity.legal-hold.",
+];
 const REDACTION_MARKER = "[REDACTED]";
 
 function normalizeString(value) {
@@ -129,6 +163,9 @@ function blockedReasonForCommandPath(commandPathKey) {
   if (SENSITIVE_COMMAND_PATHS.has(commandPathKey)) {
     return "blocked_sensitive_cli_command";
   }
+  if (SENSITIVE_COMMAND_PREFIXES.some((prefix) => commandPathKey.startsWith(prefix))) {
+    return "blocked_sensitive_cli_command";
+  }
   return "";
 }
 
@@ -164,7 +201,17 @@ function validateCliOptionSpecs(optionSpecs = []) {
 
 function validateBridgeToolDefinition(tool = {}) {
   const metadata = tool.metadata || {};
-  return validateCliPathSegments(metadata.cliPath) || validateCliOptionSpecs(metadata.options);
+  const shapeError = validateCliPathSegments(metadata.cliPath) || validateCliOptionSpecs(metadata.options);
+  if (shapeError) return shapeError;
+  if (metadata.generated_from !== "commander" || metadata.execution !== "bridge") {
+    return "untrusted_cli_bridge_definition";
+  }
+  const commandPathKey = metadata.cliPath.map(normalizeString).filter(Boolean).join(".");
+  const namePathKey = registryToolNameToCliPath(tool.name).join(".");
+  if (namePathKey && namePathKey !== commandPathKey) {
+    return "cli_path_name_mismatch";
+  }
+  return "";
 }
 
 function isAllowedInputValue(value) {

package/src/session/usage-report.js

@@ -124,7 +124,7 @@ function hostedRollupToJson(rollup, fallbackLabel = "") {
   const hasCustomerCost = Boolean(bag.hasCustomerCost ?? bag.has_customer_cost ?? bag.customerCostUsd != null ?? bag.customer_cost_usd != null);
   return {
     label: normalize(bag.label ?? bag.agentId ?? bag.agent_id ?? bag.action ?? fallbackLabel) || "unknown",
-    entries: nonNegativeInt(bag.entries ?? bag.count),
+    entries: nonNegativeInt(bag.entries ?? bag.entryCount ?? bag.entry_count ?? bag.count ?? bag.interactions),
     inputTokens: nonNegativeInt(bag.inputTokens ?? bag.input_tokens),
     outputTokens: nonNegativeInt(bag.outputTokens ?? bag.output_tokens),
     totalTokens: nonNegativeInt(bag.totalTokens ?? bag.total_tokens),
@@ -249,11 +249,24 @@ export function buildSessionUsageReportFromLedgerPayload({
     ? embedded
     : root;
   const entries = sourceArray(source.entries).map(hostedEntryToJson);
-  const totals = hostedRollupToJson(object(source.totals), "session");
-  const priceBookVersions = sourceArray(source.priceBooks || source.price_books || source.priceBookVersions || source.price_book_versions)
+  const sourceTotals = object(source.totals);
+  const totals = hostedRollupToJson(sourceTotals, "session");
+  const priceBookVersions = sourceArray(
+    source.priceBooks ||
+      source.price_books ||
+      source.priceBookVersions ||
+      source.price_book_versions ||
+      sourceTotals.priceBooks ||
+      sourceTotals.price_books ||
+      sourceTotals.priceBookVersions ||
+      sourceTotals.price_book_versions,
+  )
     .map(normalize)
     .filter(Boolean)
     .sort();
+  const resolvedPriceBookVersions = priceBookVersions.length
+    ? priceBookVersions
+    : [...new Set(entries.map((entry) => normalize(entry.priceBookVersion)).filter(Boolean))].sort();
   const limit = clampRecentLimit(recentLimit);
   return {
     schema: SESSION_USAGE_REPORT_SCHEMA,
@@ -268,12 +281,28 @@ export function buildSessionUsageReportFromLedgerPayload({
       providerCostUsd: totals.providerCostUsd,
       customerCostUsd: totals.customerCostUsd,
       unpriced: totals.unpriced,
-      priceBookVersions,
+      priceBookVersions: resolvedPriceBookVersions,
     },
-    perAgent: sourceArray(source.agents || source.perAgent || source.per_agent || source.agentsById || source.agents_by_id)
+    perAgent: sourceArray(
+      source.agents ||
+        source.perAgent ||
+        source.per_agent ||
+        source.byAgent ||
+        source.by_agent ||
+        source.agentsById ||
+        source.agents_by_id,
+    )
       .map((rollup) => hostedRollupToJson(rollup))
       .sort((a, b) => b.providerCostUsd - a.providerCostUsd || b.totalTokens - a.totalTokens || a.label.localeCompare(b.label)),
-    perAction: sourceArray(source.actions || source.perAction || source.per_action || source.actionsById || source.actions_by_id)
+    perAction: sourceArray(
+      source.actions ||
+        source.perAction ||
+        source.per_action ||
+        source.byAction ||
+        source.by_action ||
+        source.actionsById ||
+        source.actions_by_id,
+    )
       .map((rollup) => hostedRollupToJson(rollup))
       .sort((a, b) => b.providerCostUsd - a.providerCostUsd || b.totalTokens - a.totalTokens || a.label.localeCompare(b.label)),
     recentEntries: recentReportEntries(entries, limit),