sentinelayer-cli 0.34.3 → 0.34.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.34.3",
+  "version": "0.34.5",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/commands/session.js

@@ -783,9 +783,14 @@ function mergeSessionActionEvents(events = [], actionEvents = []) {
   return dedupeSessionEvents([...(Array.isArray(events) ? events : []), ...actionEvents])
     .map((event, index) => ({ event, index }))
     .sort((left, right) => {
+      const leftSequence = eventSequenceNumber(left.event);
+      const rightSequence = eventSequenceNumber(right.event);
+      if (leftSequence > 0 && rightSequence > 0 && leftSequence !== rightSequence) {
+        return leftSequence - rightSequence;
+      }
       const timeDiff = eventTimestampMs(left.event) - eventTimestampMs(right.event);
       if (timeDiff !== 0) return timeDiff;
-      const sequenceDiff = eventSequenceNumber(left.event) - eventSequenceNumber(right.event);
+      const sequenceDiff = leftSequence - rightSequence;
       if (sequenceDiff !== 0) return sequenceDiff;
       return left.index - right.index;
     })
@@ -5574,6 +5579,9 @@ export function registerSessionCommand(program) {
         const rawActionEvents = remoteActions?.ok
           ? buildSessionActionEvents(normalizedSessionId, remoteActions.actions)
           : [];
+        const visibleActionEvents = includeControlEvents
+          ? rawActionEvents
+          : rawActionEvents.filter((event) => !isSessionControlEvent(event));
         const unacknowledgedHumanMessages = remoteActions?.ok
           ? readProjectionUnacknowledgedHumanMessages(remoteActions)
           : [];
@@ -5593,8 +5601,8 @@ export function registerSessionCommand(program) {
           : sourceEvents.filter((event) => !isSessionControlEvent(event));
         const hiddenControlEventCount = sourceEvents.length - transcriptEvents.length;
         const actionEvents = remoteWindowRead
-          ? filterSessionActionEventsForTranscriptWindow(rawActionEvents, transcriptEvents)
-          : rawActionEvents;
+          ? filterSessionActionEventsForTranscriptWindow(visibleActionEvents, transcriptEvents)
+          : visibleActionEvents;
         const events = mergeSessionActionEvents(transcriptEvents, actionEvents).slice(-tail);
         const autoView = recordSessionReadViews(normalizedSessionId, events, {
           targetPath,
@@ -6245,15 +6253,19 @@ export function registerSessionCommand(program) {
           limit: 5_000,
         }),
       ]);
-      const actionEvents = remoteActions?.ok
+      const includeControlEvents = Boolean(options.includeControlEvents);
+      const rawActionEvents = remoteActions?.ok
         ? buildSessionActionEvents(normalizedSessionId, remoteActions.actions)
         : [];
-      const includeControlEvents = Boolean(options.includeControlEvents);
+      const actionEvents = includeControlEvents
+        ? rawActionEvents
+        : rawActionEvents.filter((event) => !isSessionControlEvent(event));
       const dedupedEvents = dedupeSessionEvents(events);
       const transcriptBaseEvents = includeControlEvents
         ? dedupedEvents
         : filterSessionMaterialEvents(dedupedEvents);
-      const hiddenControlEventCount = dedupedEvents.length - transcriptBaseEvents.length;
+      const hiddenControlEventCount =
+        dedupedEvents.length - transcriptBaseEvents.length + rawActionEvents.length - actionEvents.length;
       const exportEvents = mergeSessionActionEvents(transcriptBaseEvents, actionEvents);
       const stats = computeTranscriptStats({
         sessionMeta: sessionPayload,
@@ -6400,15 +6412,19 @@ export function registerSessionCommand(program) {
         listAgents(normalizedSessionId, { targetPath, includeInactive: true }),
         readStream(normalizedSessionId, { targetPath, tail: 0 }),
       ]);
-      const actionEvents = remoteActions?.ok
+      const includeControlEvents = Boolean(options.includeControlEvents);
+      const rawActionEvents = remoteActions?.ok
         ? buildSessionActionEvents(normalizedSessionId, remoteActions.actions)
         : [];
-      const includeControlEvents = Boolean(options.includeControlEvents);
+      const actionEvents = includeControlEvents
+        ? rawActionEvents
+        : rawActionEvents.filter((event) => !isSessionControlEvent(event));
       const dedupedEvents = dedupeSessionEvents(events);
       const transcriptBaseEvents = includeControlEvents
         ? dedupedEvents
         : filterSessionMaterialEvents(dedupedEvents);
-      const hiddenControlEventCount = dedupedEvents.length - transcriptBaseEvents.length;
+      const hiddenControlEventCount =
+        dedupedEvents.length - transcriptBaseEvents.length + rawActionEvents.length - actionEvents.length;
       const transcriptEvents = mergeSessionActionEvents(transcriptBaseEvents, actionEvents);
 
       // Pull GitHub/Google avatar + display name from the active auth

package/src/legacy-cli.js

@@ -2520,16 +2520,22 @@ jobs:
         uses: mrrCarter/sentinelayer-v1-action@03d7369cba7de2e9f15b959275c982111f0ee493
         with:
           github_token: \${{ github.token }}
+          openai_api_key: \${{ secrets.OPENAI_API_KEY }}
+          google_api_key: \${{ secrets.GOOGLE_API_KEY }}
+          llm_provider: \${{ secrets.GOOGLE_API_KEY != '' && 'google' || 'openai' }}
           sentinelayer_token: \${{ secrets.${normalizedSecret} }}${specIdBindingLine}
-          sentinelayer_managed_llm: "true"
+          sentinelayer_managed_llm: \${{ secrets.GOOGLE_API_KEY == '' && secrets.OPENAI_API_KEY == '' && secrets.${normalizedSecret} != '' }}
           scan_mode: \${{ github.event_name == 'workflow_dispatch' && inputs.scan_mode || 'deep' }}
           severity_gate: \${{ github.event_name == 'workflow_dispatch' && inputs.severity_gate || 'P1' }}
-          model: gpt-5.3-codex
+          model: \${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-pro' || 'gpt-5.3-codex' }}
           codex_model: gpt-5.3-codex
-          model_fallback: gpt-4.1-mini
-          use_codex: "true"
+          model_fallback: \${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-flash' || 'gpt-4.1-mini' }}
+          use_codex: \${{ secrets.GOOGLE_API_KEY == '' }}
           codex_only: "false"
           llm_failure_policy: block
+          max_daily_scans: \${{ vars.OMAR_MAX_DAILY_SCANS || '200' }}
+          min_scan_interval_minutes: \${{ vars.OMAR_MIN_SCAN_INTERVAL_MINUTES || '0' }}
+          rate_limit_fail_mode: closed
       - name: Enforce Omar reviewer merge thresholds
         shell: bash
         env:
@@ -2575,6 +2581,12 @@ jobs:
           OMAR_SCAN_MODE: \${{ github.event_name == 'workflow_dispatch' && inputs.scan_mode || 'deep' }}
           OMAR_SEVERITY_GATE: \${{ github.event_name == 'workflow_dispatch' && inputs.severity_gate || 'P1' }}
           OMAR_P2_MAX_ALLOWED: \${{ github.event_name == 'workflow_dispatch' && inputs.p2_max_allowed || '5' }}
+          OMAR_OPENAI_KEY_PRESENT: \${{ secrets.OPENAI_API_KEY != '' }}
+          OMAR_GOOGLE_KEY_PRESENT: \${{ secrets.GOOGLE_API_KEY != '' }}
+          OMAR_MANAGED_LLM: \${{ secrets.GOOGLE_API_KEY == '' && secrets.OPENAI_API_KEY == '' && secrets.${normalizedSecret} != '' }}
+          OMAR_LLM_PROVIDER: \${{ secrets.GOOGLE_API_KEY != '' && 'google' || 'openai' }}
+          OMAR_MODEL: \${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-pro' || 'gpt-5.3-codex' }}
+          OMAR_MODEL_FALLBACK: \${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-flash' || 'gpt-4.1-mini' }}
         run: |
           set -euo pipefail
           mkdir -p omar-artifacts
@@ -2590,6 +2602,9 @@ jobs:
               value = env(name, "0").strip()
               return int(value) if value.isdigit() else 0
 
+          def bool_env(name):
+              return env(name).strip().lower() == "true"
+
           github_run_id = env("GITHUB_RUN_ID")
           server_url = env("GITHUB_SERVER_URL", "https://github.com").rstrip("/")
           repository = env("GITHUB_REPOSITORY")
@@ -2612,7 +2627,13 @@ jobs:
               "scan": {
                   "mode": env("OMAR_SCAN_MODE", "deep"),
                   "action_ref": "mrrCarter/sentinelayer-v1-action@03d7369cba7de2e9f15b959275c982111f0ee493",
-                  "managed_llm": True,
+                  "llm_provider": env("OMAR_LLM_PROVIDER", "openai"),
+                  "model": env("OMAR_MODEL", "gpt-5.3-codex"),
+                  "model_fallback": env("OMAR_MODEL_FALLBACK", "gpt-4.1-mini"),
+                  "llm_route": "google_api_key" if bool_env("OMAR_GOOGLE_KEY_PRESENT") else ("openai_api_key" if bool_env("OMAR_OPENAI_KEY_PRESENT") else "sentinelayer_managed"),
+                  "google_key_present": bool_env("OMAR_GOOGLE_KEY_PRESENT"),
+                  "openai_key_present": bool_env("OMAR_OPENAI_KEY_PRESENT"),
+                  "managed_llm": bool_env("OMAR_MANAGED_LLM"),
                   "llm_failure_policy": "block",
               },
               "github": {

package/src/review/local-review.js

@@ -95,6 +95,7 @@ const REVIEW_RULES = Object.freeze([
     regex: /\b(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,})\b/,
   },
   {
+    id: "SL-SEC-005",
     severity: "P2",
     message: "Possible hardcoded credential literal.",
     regex: /(api[_-]?key|secret|token)\s*[:=]\s*['\"][^'\"]{20,}['\"]/i,
@@ -336,6 +337,16 @@ function regexMatches(regex, input) {
   return new RegExp(regex.source, flags).test(input);
 }
 
+function isGitHubActionsContextExpressionLiteral(line) {
+  return /(?:[:=]\s*)['"]?\s*\$\{\{\s*(?:github|secrets|vars|env|inputs|steps|needs|matrix|runner|strategy)\.[^}]+\}\}\s*['"]?/i.test(
+    String(line || "")
+  );
+}
+
+function shouldSuppressRuleLine(rule, line) {
+  return rule.id === "SL-SEC-005" && isGitHubActionsContextExpressionLiteral(line);
+}
+
 function sanitizeLineForExcerpt(line) {
   return String(line || "")
     .trim()
@@ -590,6 +601,9 @@ async function scanRulesForFiles({ rootPath, filePaths, rules, maxFindings = MAX
         if (!regexMatches(rule.regex, line)) {
           continue;
         }
+        if (shouldSuppressRuleLine(rule, line)) {
+          continue;
+        }
         const pushed = tryPushFinding(
           findings,
           createFinding({

package/src/scan/generator.js

@@ -226,16 +226,22 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
             uses: SENTINELAYER_ACTION_REF,
             with: {
               github_token: "${{ github.token }}",
+              openai_api_key: "${{ secrets.OPENAI_API_KEY }}",
+              google_api_key: "${{ secrets.GOOGLE_API_KEY }}",
+              llm_provider: "${{ secrets.GOOGLE_API_KEY != '' && 'google' || 'openai' }}",
               sentinelayer_token: `\${{ secrets.${normalizedSecret} }}`,
-              sentinelayer_managed_llm: "true",
+              sentinelayer_managed_llm: `\${{ secrets.GOOGLE_API_KEY == '' && secrets.OPENAI_API_KEY == '' && secrets.${normalizedSecret} != '' }}`,
               scan_mode: profile.scanMode || "deep",
               severity_gate: profile.severityGate || "P1",
-              model: "gpt-5.3-codex",
+              model: "${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-pro' || 'gpt-5.3-codex' }}",
               codex_model: "gpt-5.3-codex",
-              model_fallback: "gpt-4.1-mini",
-              use_codex: "true",
+              model_fallback: "${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-flash' || 'gpt-4.1-mini' }}",
+              use_codex: "${{ secrets.GOOGLE_API_KEY == '' }}",
               codex_only: "false",
               llm_failure_policy: "block",
+              max_daily_scans: "${{ vars.OMAR_MAX_DAILY_SCANS || '200' }}",
+              min_scan_interval_minutes: "${{ vars.OMAR_MIN_SCAN_INTERVAL_MINUTES || '0' }}",
+              rate_limit_fail_mode: "closed",
               playwright_mode: profile.playwrightMode || "off",
               sbom_mode: profile.sbomMode || "off",
               wait_for_completion: "true",
@@ -288,6 +294,12 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
               OMAR_SCAN_MODE: "${{ github.event_name == 'workflow_dispatch' && inputs.scan_mode || 'deep' }}",
               OMAR_SEVERITY_GATE: "${{ github.event_name == 'workflow_dispatch' && inputs.severity_gate || 'P1' }}",
               OMAR_P2_MAX_ALLOWED: "${{ github.event_name == 'workflow_dispatch' && inputs.p2_max_allowed || '5' }}",
+              OMAR_OPENAI_KEY_PRESENT: "${{ secrets.OPENAI_API_KEY != '' }}",
+              OMAR_GOOGLE_KEY_PRESENT: "${{ secrets.GOOGLE_API_KEY != '' }}",
+              OMAR_MANAGED_LLM: `\${{ secrets.GOOGLE_API_KEY == '' && secrets.OPENAI_API_KEY == '' && secrets.${normalizedSecret} != '' }}`,
+              OMAR_LLM_PROVIDER: "${{ secrets.GOOGLE_API_KEY != '' && 'google' || 'openai' }}",
+              OMAR_MODEL: "${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-pro' || 'gpt-5.3-codex' }}",
+              OMAR_MODEL_FALLBACK: "${{ secrets.GOOGLE_API_KEY != '' && 'gemini-2.5-flash' || 'gpt-4.1-mini' }}",
             },
             run: [
               "set -euo pipefail",
@@ -304,6 +316,9 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
               "    value = env(name, '0').strip()",
               "    return int(value) if value.isdigit() else 0",
               "",
+              "def bool_env(name):",
+              "    return env(name).strip().lower() == 'true'",
+              "",
               "github_run_id = env('GITHUB_RUN_ID')",
               "server_url = env('GITHUB_SERVER_URL', 'https://github.com').rstrip('/')",
               "repository = env('GITHUB_REPOSITORY')",
@@ -326,7 +341,13 @@ export function buildSecurityReviewWorkflow({ secretName = DEFAULT_SCAN_SECRET_N
               "    'scan': {",
               "        'mode': env('OMAR_SCAN_MODE', 'deep'),",
               `        'action_ref': '${SENTINELAYER_ACTION_REF}',`,
-              "        'managed_llm': True,",
+              "        'llm_provider': env('OMAR_LLM_PROVIDER', 'openai'),",
+              "        'model': env('OMAR_MODEL', 'gpt-5.3-codex'),",
+              "        'model_fallback': env('OMAR_MODEL_FALLBACK', 'gpt-4.1-mini'),",
+              "        'llm_route': 'google_api_key' if bool_env('OMAR_GOOGLE_KEY_PRESENT') else ('openai_api_key' if bool_env('OMAR_OPENAI_KEY_PRESENT') else 'sentinelayer_managed'),",
+              "        'google_key_present': bool_env('OMAR_GOOGLE_KEY_PRESENT'),",
+              "        'openai_key_present': bool_env('OMAR_OPENAI_KEY_PRESENT'),",
+              "        'managed_llm': bool_env('OMAR_MANAGED_LLM'),",
               "        'llm_failure_policy': 'block',",
               "    },",
               "    'github': {",

package/src/session/control-events.js

@@ -1,8 +1,20 @@
 const SESSION_CONTROL_EVENT_TYPES = new Set([
+  "file_lock",
+  "file_unlock",
+  "file_lock_expired",
   "listener_stop",
   "session_coaching",
   "session_listen_catchup",
   "session_listen_error",
+  "session_reaction",
+]);
+
+const QUIET_SESSION_ACTION_TYPES = new Set([
+  "ack",
+  "dislike",
+  "disregard",
+  "like",
+  "view",
 ]);
 
 function normalizeString(value) {
@@ -28,8 +40,13 @@ export function isSessionListenerLifecycleEvent(event = {}) {
 
 export function isSessionControlEvent(event = {}) {
   const type = eventType(event);
+  const payload = event?.payload && typeof event.payload === "object" && !Array.isArray(event.payload)
+    ? event.payload
+    : {};
+  const actionType = normalizeString(payload.actionType || payload.action_type || payload.reaction).toLowerCase();
   return (
     isSessionListenerLifecycleEvent(event) ||
+    (type === "session_action" && QUIET_SESSION_ACTION_TYPES.has(actionType)) ||
     type.startsWith("session_listen_") ||
     SESSION_CONTROL_EVENT_TYPES.has(type)
   );

package/src/session/sync.js

@@ -253,9 +253,14 @@ function chronologicalSessionEvents(events = []) {
   return (Array.isArray(events) ? events : [])
     .map((event, index) => ({ event, index }))
     .sort((left, right) => {
+      const leftSequence = eventSequenceNumber(left.event);
+      const rightSequence = eventSequenceNumber(right.event);
+      if (leftSequence > 0 && rightSequence > 0 && leftSequence !== rightSequence) {
+        return leftSequence - rightSequence;
+      }
       const timeDiff = eventTimestampMs(left.event) - eventTimestampMs(right.event);
       if (timeDiff !== 0) return timeDiff;
-      const sequenceDiff = eventSequenceNumber(left.event) - eventSequenceNumber(right.event);
+      const sequenceDiff = leftSequence - rightSequence;
       if (sequenceDiff !== 0) return sequenceDiff;
       return left.index - right.index;
     })