sentinelayer-cli 0.34.0 → 0.34.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.34.0",
+  "version": "0.34.2",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/commands/session.js

@@ -755,6 +755,14 @@ function formatHumanAskLine(event = {}) {
   return `${sequenceLabel} ${humanAskAgentId(event)}${ts ? ` ${ts}` : ""}${suffix}`;
 }
 
+function formatRemoteHydrateAppendWarning(result = {}) {
+  const count = Number(result?.appendFailureCount || 0);
+  if (!Number.isFinite(count) || count <= 0) return "";
+  const reason = normalizeString(result.appendFailureReason) || "local_append_failed";
+  const noun = count === 1 ? "event" : "events";
+  return `Remote hydrate could not persist ${count} ${noun} locally (${reason}); affected cursors were not advanced.`;
+}
+
 function eventTimestampMs(event = {}) {
   for (const key of ["ts", "timestamp", "createdAt", "at"]) {
     const epoch = Date.parse(normalizeString(event?.[key]));
@@ -5481,6 +5489,10 @@ export function registerSessionCommand(program) {
                 ),
               );
             }
+            const appendWarning = formatRemoteHydrateAppendWarning(hydration);
+            if (appendWarning) {
+              console.log(pc.yellow(appendWarning));
+            }
           } else {
             console.log(
               pc.yellow(
@@ -5847,6 +5859,8 @@ export function registerSessionCommand(program) {
         eventsCursor: result.eventsCursor,
         materializedLocalSession: result.materializedLocalSession,
         localAppendComplete: result.localAppendComplete,
+        appendFailureCount: result.appendFailureCount,
+        appendFailureReason: result.appendFailureReason,
         access: access || undefined,
       };
       if (shouldEmitJson(options, command)) {
@@ -5857,6 +5871,10 @@ export function registerSessionCommand(program) {
         console.log(
           `Hydrated session ${normalizedSessionId}: relayed=${result.relayed} dropped=${result.dropped}.`,
         );
+        const appendWarning = formatRemoteHydrateAppendWarning(result);
+        if (appendWarning) {
+          console.log(pc.yellow(appendWarning));
+        }
         if (access && !access.accessible) {
           if (access.reason === "session_not_found") {
             console.log(

package/src/legacy-cli.js

@@ -2521,14 +2521,14 @@ jobs:
         with:
           github_token: \${{ github.token }}
           sentinelayer_token: \${{ secrets.${normalizedSecret} }}${specIdBindingLine}
-          sentinelayer_managed_llm: "false"
-          openai_api_key: \${{ secrets.OPENAI_API_KEY }}
-          google_api_key: \${{ secrets.GOOGLE_API_KEY }}
+          sentinelayer_managed_llm: "true"
           scan_mode: \${{ github.event_name == 'workflow_dispatch' && inputs.scan_mode || 'deep' }}
           severity_gate: \${{ github.event_name == 'workflow_dispatch' && inputs.severity_gate || 'P1' }}
           model: gpt-5.3-codex
           codex_model: gpt-5.3-codex
-          model_fallback: gemini-2.5-flash
+          model_fallback: gpt-4.1-mini
+          use_codex: "true"
+          codex_only: "false"
           llm_failure_policy: block
       - name: Enforce Omar reviewer merge thresholds
         shell: bash
@@ -2612,7 +2612,7 @@ jobs:
               "scan": {
                   "mode": env("OMAR_SCAN_MODE", "deep"),
                   "action_ref": "mrrCarter/sentinelayer-v1-action@03d7369cba7de2e9f15b959275c982111f0ee493",
-                  "managed_llm": False,
+                  "managed_llm": True,
                   "llm_failure_policy": "block",
               },
               "github": {

package/src/scan/generator.js

@@ -227,14 +227,14 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
             with: {
               github_token: "${{ github.token }}",
               sentinelayer_token: `\${{ secrets.${normalizedSecret} }}`,
-              sentinelayer_managed_llm: "false",
-              openai_api_key: "${{ secrets.OPENAI_API_KEY }}",
-              google_api_key: "${{ secrets.GOOGLE_API_KEY }}",
+              sentinelayer_managed_llm: "true",
               scan_mode: profile.scanMode || "deep",
               severity_gate: profile.severityGate || "P1",
               model: "gpt-5.3-codex",
               codex_model: "gpt-5.3-codex",
-              model_fallback: "gemini-2.5-flash",
+              model_fallback: "gpt-4.1-mini",
+              use_codex: "true",
+              codex_only: "false",
               llm_failure_policy: "block",
               playwright_mode: profile.playwrightMode || "off",
               sbom_mode: profile.sbomMode || "off",
@@ -326,7 +326,7 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
               "    'scan': {",
               "        'mode': env('OMAR_SCAN_MODE', 'deep'),",
               `        'action_ref': '${SENTINELAYER_ACTION_REF}',`,
-              "        'managed_llm': False,",
+              "        'managed_llm': True,",
               "        'llm_failure_policy': 'block',",
               "    },",
               "    'github': {",

package/src/session/remote-hydrate.js

@@ -38,6 +38,7 @@ import { isSessionControlEvent } from "./control-events.js";
 const EVENTS_CURSOR_SUFFIX = "events";
 const DEFAULT_EVENT_PAGE_LIMIT = 200;
 const DEFAULT_MAX_EVENT_PAGES = 25;
+const MAX_APPEND_FAILURE_REASON_LENGTH = 160;
 
 function indexRelayEventIdentityKeys(indexByKey, eventList = [], event = {}, index = -1) {
   if (!indexByKey || !Array.isArray(eventList) || index < 0) return;
@@ -163,6 +164,28 @@ function normalizePositiveInteger(value, fallbackValue) {
   return Math.floor(normalized);
 }
 
+function localAppendFailureReason(error) {
+  const message = error?.message || String(error || "");
+  let reason = String(message).trim();
+  if (!reason) return "local_append_failed";
+  reason = reason.replace(
+    /(["'])(?:[A-Za-z]:\\|\/(?:Users|home|tmp|var|private|mnt|workspace)\/).*?\1/g,
+    "$1[path]$1",
+  );
+  reason = reason.replace(/[A-Za-z]:\\[^,;\r\n)]+/g, "[path]");
+  reason = reason.replace(/(^|[\s"'(])\/(?:Users|home|tmp|var|private|mnt|workspace)\/[^\s,;)"']+/g, "$1[path]");
+  reason = reason.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]");
+  reason = reason.replace(
+    /\b([A-Za-z0-9_-]*(?:api[_-]?key|authorization|password|secret|token)[A-Za-z0-9_-]*)\s*[:=]\s*(?:"[^"]+"|'[^']+'|[^\s,;]+)/gi,
+    "$1=[REDACTED]",
+  );
+  reason = reason.replace(/\b[A-Za-z0-9._~+/=-]{32,}\b/g, "[REDACTED]");
+  if (reason.length > MAX_APPEND_FAILURE_REASON_LENGTH) {
+    reason = `${reason.slice(0, MAX_APPEND_FAILURE_REASON_LENGTH - 3)}...`;
+  }
+  return reason || "local_append_failed";
+}
+
 async function pollSessionEventPages({
   sessionId,
   targetPath,
@@ -436,6 +459,8 @@ export async function hydrateSessionFromRemote({
     mergeExisting: eventsNeedingMerge.has(event),
   }));
   const failedRelayKeys = new Set();
+  let appendFailureCount = 0;
+  let appendFailureReason = "";
   for (const { event, mergeExisting } of appendEvents) {
     try {
       const persisted = await _append(sessionId, event, {
@@ -453,7 +478,11 @@ export async function hydrateSessionFromRemote({
         persistedEvent,
         existingRelayEvents.length - 1,
       );
-    } catch {
+    } catch (error) {
+      appendFailureCount += 1;
+      if (!appendFailureReason) {
+        appendFailureReason = localAppendFailureReason(error);
+      }
       addSessionEventIdentityKeys(failedRelayKeys, event);
       // Append errors are observable via the stream but should not
       // abort the rest of the batch — partial relay is still progress.
@@ -492,6 +521,8 @@ export async function hydrateSessionFromRemote({
     eventsBackfillReason: eventsResult?.complete === false ? eventsResult?.reason || "" : "",
     materializedLocalSession,
     localAppendComplete: humanCursorSafe && eventsCursorSafe,
+    appendFailureCount,
+    appendFailureReason,
     remoteStatus: remoteStatus || null,
   };
 }