sentinelayer-cli 0.39.1 → 0.40.0

package/src/agents/supply-chain/tools/base.js

@@ -1,151 +1,22 @@
-// Shared helpers for Nora's (supply-chain) domain tools (#A22).
+// Shared helpers for Dima's (supply-chain) domain tools (#A22).
 
-import fsp from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
+import {
+  createFinding as createDomainFinding,
+  toPosix,
+  walkRepoFiles as walkDomainRepoFiles,
+} from "../../shared-tools/domain-base.js";
 
-import ignore from "ignore";
+const DEFAULT_PERSONA = "supply-chain";
 
-const DEFAULT_IGNORED_DIRS = new Set([
-  ".git",
-  "node_modules",
-  ".venv",
-  ".next",
-  "dist",
-  "build",
-  "coverage",
-  ".sentinelayer",
-  ".sentinel",
-  ".turbo",
-  ".idea",
-  ".vscode",
-  "__pycache__",
-  ".cache",
-]);
-const MAX_FILE_SIZE_BYTES = 1024 * 1024;
-const SEVERITIES = Object.freeze(["P0", "P1", "P2", "P3"]);
+export { toPosix };
 
-export function toPosix(value) {
-  return String(value || "").replace(/\\/g, "/");
+export function createFinding(options = {}) {
+  return createDomainFinding(options, {
+    defaultPersona: DEFAULT_PERSONA,
+    defaultKind: DEFAULT_PERSONA,
+  });
 }
 
-export function createFinding({
-  severity,
-  kind,
-  file,
-  line = 0,
-  evidence = "",
-  rootCause = "",
-  recommendedFix = "",
-  confidence = null,
-  tool = "",
-  persona = "supply-chain",
-} = {}) {
-  const normalizedSeverity = SEVERITIES.includes(String(severity || "").toUpperCase())
-    ? String(severity).toUpperCase()
-    : "P2";
-  return {
-    persona,
-    tool: String(tool || "").trim(),
-    kind: String(kind || "").trim() || "supply-chain",
-    severity: normalizedSeverity,
-    file: toPosix(file || ""),
-    line: Number.isFinite(Number(line)) ? Math.max(0, Math.floor(Number(line))) : 0,
-    evidence: String(evidence || "").trim().slice(0, 400),
-    rootCause: String(rootCause || "").trim(),
-    recommendedFix: String(recommendedFix || "").trim(),
-    confidence:
-      confidence === null || confidence === undefined
-        ? null
-        : Math.max(0, Math.min(1, Number(confidence) || 0)),
-  };
-}
-
-async function readIgnorePatterns(filePath) {
-  try {
-    const raw = await fsp.readFile(filePath, "utf-8");
-    return String(raw || "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line && !line.startsWith("#"));
-  } catch (err) {
-    if (err && typeof err === "object" && err.code === "ENOENT") {
-      return [];
-    }
-    throw err;
-  }
-}
-
-async function createIgnoreMatcher(rootPath) {
-  const matcher = ignore();
-  const gitignore = await readIgnorePatterns(path.join(rootPath, ".gitignore"));
-  const sentinel = await readIgnorePatterns(
-    path.join(rootPath, ".sentinelayerignore")
-  );
-  matcher.add([...gitignore, ...sentinel]);
-  return (relativePath, isDirectory) => {
-    const normalized = toPosix(relativePath);
-    if (!normalized) {
-      return false;
-    }
-    const candidate = isDirectory ? `${normalized}/` : normalized;
-    return matcher.ignores(candidate);
-  };
-}
-
-export async function* walkRepoFiles({
-  rootPath = process.cwd(),
-  extensions = new Set(),
-  maxFileSize = MAX_FILE_SIZE_BYTES,
-} = {}) {
-  const resolvedRoot = path.resolve(rootPath);
-  const ignoreMatcher = await createIgnoreMatcher(resolvedRoot);
-  const wantedExtensions =
-    extensions instanceof Set
-      ? extensions
-      : new Set(Array.isArray(extensions) ? extensions : []);
-  const stack = [resolvedRoot];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    let entries = [];
-    try {
-      entries = await fsp.readdir(current, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const fullPath = path.join(current, entry.name);
-      const relativePath = toPosix(path.relative(resolvedRoot, fullPath));
-      if (entry.isDirectory()) {
-        if (!relativePath || DEFAULT_IGNORED_DIRS.has(entry.name)) {
-          continue;
-        }
-        if (ignoreMatcher(relativePath, true)) {
-          continue;
-        }
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile()) {
-        continue;
-      }
-      if (ignoreMatcher(relativePath, false)) {
-        continue;
-      }
-      const ext = path.extname(entry.name).toLowerCase();
-      if (wantedExtensions.size > 0 && !wantedExtensions.has(ext) && !wantedExtensions.has("")) {
-        continue;
-      }
-      let stat = null;
-      try {
-        stat = await fsp.stat(fullPath);
-      } catch {
-        stat = null;
-      }
-      if (!stat || stat.size > maxFileSize) {
-        continue;
-      }
-      yield { fullPath, relativePath };
-    }
-  }
+export async function* walkRepoFiles(options = {}) {
+  yield* walkDomainRepoFiles(options);
 }

package/src/agents/testing/tools/base.js

@@ -1,188 +1,18 @@
 // Shared helpers for Priya's (testing) domain tools (#A15).
-// Same pattern as security/tools/base.js and backend/tools/base.js — default
-// persona is "testing". Later refactor (#A25+) can hoist to shared-tools/.
 
-import fsp from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
+import {
+  DEFAULT_IGNORED_DIRS,
+  MAX_FILE_SIZE_BYTES,
+  SEVERITIES,
+  createFinding as createDomainFinding,
+  findLineMatches,
+  getLineContent,
+  normalizeSeverity,
+  toPosix,
+  walkRepoFiles as walkDomainRepoFiles,
+} from "../../shared-tools/domain-base.js";
 
-import ignore from "ignore";
-
-const DEFAULT_IGNORED_DIRS = new Set([
-  ".git",
-  "node_modules",
-  ".venv",
-  ".next",
-  "dist",
-  "build",
-  "coverage",
-  ".sentinelayer",
-  ".sentinel",
-  ".turbo",
-  ".idea",
-  ".vscode",
-  "__pycache__",
-  ".cache",
-]);
-const MAX_FILE_SIZE_BYTES = 1024 * 1024;
-const SEVERITIES = Object.freeze(["P0", "P1", "P2", "P3"]);
-
-export function toPosix(value) {
-  return String(value || "").replace(/\\/g, "/");
-}
-
-export function normalizeSeverity(value) {
-  const normalized = String(value || "").trim().toUpperCase();
-  if (SEVERITIES.includes(normalized)) {
-    return normalized;
-  }
-  return "P2";
-}
-
-export function createFinding({
-  severity,
-  kind,
-  file,
-  line = 0,
-  evidence = "",
-  rootCause = "",
-  recommendedFix = "",
-  confidence = null,
-  tool = "",
-  persona = "testing",
-} = {}) {
-  return {
-    persona,
-    tool: String(tool || "").trim(),
-    kind: String(kind || "").trim() || "testing",
-    severity: normalizeSeverity(severity),
-    file: toPosix(file || ""),
-    line: Number.isFinite(Number(line)) ? Math.max(0, Math.floor(Number(line))) : 0,
-    evidence: String(evidence || "").trim().slice(0, 400),
-    rootCause: String(rootCause || "").trim(),
-    recommendedFix: String(recommendedFix || "").trim(),
-    confidence:
-      confidence === null || confidence === undefined
-        ? null
-        : Math.max(0, Math.min(1, Number(confidence) || 0)),
-  };
-}
-
-async function readIgnorePatterns(filePath) {
-  try {
-    const raw = await fsp.readFile(filePath, "utf-8");
-    return String(raw || "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line && !line.startsWith("#"));
-  } catch (err) {
-    if (err && typeof err === "object" && err.code === "ENOENT") {
-      return [];
-    }
-    throw err;
-  }
-}
-
-async function createIgnoreMatcher(rootPath) {
-  const matcher = ignore();
-  const gitignore = await readIgnorePatterns(path.join(rootPath, ".gitignore"));
-  const sentinel = await readIgnorePatterns(
-    path.join(rootPath, ".sentinelayerignore")
-  );
-  matcher.add([...gitignore, ...sentinel]);
-  return (relativePath, isDirectory) => {
-    const normalized = toPosix(relativePath);
-    if (!normalized) {
-      return false;
-    }
-    const candidate = isDirectory ? `${normalized}/` : normalized;
-    return matcher.ignores(candidate);
-  };
-}
-
-export async function* walkRepoFiles({
-  rootPath = process.cwd(),
-  extensions = new Set(),
-  maxFileSize = MAX_FILE_SIZE_BYTES,
-} = {}) {
-  const resolvedRoot = path.resolve(rootPath);
-  const ignoreMatcher = await createIgnoreMatcher(resolvedRoot);
-  const wantedExtensions =
-    extensions instanceof Set
-      ? extensions
-      : new Set(Array.isArray(extensions) ? extensions : []);
-  const stack = [resolvedRoot];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    let entries = [];
-    try {
-      entries = await fsp.readdir(current, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const fullPath = path.join(current, entry.name);
-      const relativePath = toPosix(path.relative(resolvedRoot, fullPath));
-      if (entry.isDirectory()) {
-        if (!relativePath || DEFAULT_IGNORED_DIRS.has(entry.name)) {
-          continue;
-        }
-        if (ignoreMatcher(relativePath, true)) {
-          continue;
-        }
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile()) {
-        continue;
-      }
-      if (ignoreMatcher(relativePath, false)) {
-        continue;
-      }
-      const ext = path.extname(entry.name).toLowerCase();
-      if (wantedExtensions.size > 0 && !wantedExtensions.has(ext) && !wantedExtensions.has("")) {
-        continue;
-      }
-      let stat = null;
-      try {
-        stat = await fsp.stat(fullPath);
-      } catch {
-        stat = null;
-      }
-      if (!stat || stat.size > maxFileSize) {
-        continue;
-      }
-      yield { fullPath, relativePath, stat };
-    }
-  }
-}
-
-export function findLineMatches(content, pattern) {
-  const text = String(content || "");
-  if (!pattern) {
-    return [];
-  }
-  const global = new RegExp(
-    pattern.source,
-    pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`
-  );
-  const matches = [];
-  let match;
-  while ((match = global.exec(text)) !== null) {
-    const lineIndex = text.slice(0, match.index).split(/\r?\n/).length;
-    matches.push({
-      index: match.index,
-      line: lineIndex,
-      match: match[0],
-    });
-  }
-  return matches;
-}
-
-export function getLineContent(content, line) {
-  const lines = String(content || "").split(/\r?\n/);
-  return (lines[Math.max(0, (Number(line) || 1) - 1)] || "").trim();
-}
+const DEFAULT_PERSONA = "testing";
 
 const TEST_FILE_PATTERNS = [
   /\.test\.(js|jsx|ts|tsx|mjs|cjs)$/,
@@ -194,9 +24,28 @@ const TEST_FILE_PATTERNS = [
   /(^|\/)tests?\/[^/]*\.py$/,
 ];
 
+export {
+  DEFAULT_IGNORED_DIRS,
+  MAX_FILE_SIZE_BYTES,
+  SEVERITIES,
+  findLineMatches,
+  getLineContent,
+  normalizeSeverity,
+  toPosix,
+};
+
+export function createFinding(options = {}) {
+  return createDomainFinding(options, {
+    defaultPersona: DEFAULT_PERSONA,
+    defaultKind: DEFAULT_PERSONA,
+  });
+}
+
+export async function* walkRepoFiles(options = {}) {
+  yield* walkDomainRepoFiles(options, { entryMetadata: "stat" });
+}
+
 export function isTestFile(relativePath) {
   const normalized = toPosix(relativePath);
   return TEST_FILE_PATTERNS.some((pattern) => pattern.test(normalized));
 }
-
-export { DEFAULT_IGNORED_DIRS, MAX_FILE_SIZE_BYTES, SEVERITIES };

package/src/cli.js

@@ -124,6 +124,11 @@ const COMMAND_REGISTRARS = {
     exportName: "registerSessionCommand",
     needsLegacy: false,
   },
+  "ring-owner": {
+    loader: () => import("./commands/ring-owner.js"),
+    exportName: "registerRingOwnerCommand",
+    needsLegacy: false,
+  },
 };
 
 const COMMAND_SET = new Set(Object.keys(COMMAND_REGISTRARS));

package/src/commands/mcp.js

@@ -236,7 +236,7 @@ Docs: https://github.com/mrrCarter/create-sentinelayer/blob/main/docs/mcp.md`,
     .description(
       "Smoke the hosted MCP resource with an in-memory bearer; prints only redacted proof"
     )
-    .option("--session <id>", "Optional Senti session id to read through sessions.events.list")
+    .option("--session <id>", "Optional Senti session id to read through sessions_events_list")
     .option("--limit <n>", "Maximum session events to read when --session is set", "5")
     .option(
       "--scope <scopes>",

package/src/commands/ring-owner.js

@@ -0,0 +1,58 @@
+import process from "node:process";
+
+import { ringOwner } from "../pocket/ring-owner.js";
+
+function shouldEmitJson(options, command) {
+  if (options && options.json) return true;
+  return typeof command?.optsWithGlobals === "function" ? Boolean(command.optsWithGlobals().json) : false;
+}
+
+export function registerRingOwnerCommand(program) {
+  program
+    .command("ring-owner")
+    .description("Ring the owner's phone about a decision that needs them (Senti Pocket dial)")
+    .argument("<question>", "The question / decision to put to the owner")
+    .requiredOption("--session <id>", "The session this decision belongs to")
+    .option("--kind <kind>", "decisionYours | pickOption | go | info | checkpointReady", "decisionYours")
+    .option(
+      "--option <label>",
+      "A pickOption choice (repeat for multiple)",
+      (value, acc) => { acc.push(value); return acc; },
+      [],
+    )
+    .option("--what-we-need <text>", "A short 'what we need' lead-in for the ring")
+    .option("--checkpoint <id>", "An optional checkpoint id for jump-to context")
+    .option("--idempotency-key <key>", "Dedupe key so an accidental retry rings only once")
+    .option("--gateway-url <url>", "Pocket gateway base URL (else the SENTI_POCKET_URL env var)")
+    .option("--json", "Emit machine-readable output")
+    .action(async (question, options, command) => {
+      const emitJson = shouldEmitJson(options, command);
+      try {
+        const result = await ringOwner(question, {
+          kind: options.kind,
+          sessionId: options.session,
+          options: options.option || [],
+          whatWeNeed: options.whatWeNeed,
+          checkpointId: options.checkpoint,
+          idempotencyKey: options.idempotencyKey,
+          gatewayUrl: options.gatewayUrl,
+          env: process.env,
+        });
+        if (emitJson) {
+          process.stdout.write(`${JSON.stringify(result)}\n`);
+          return;
+        }
+        if (result && result.dispatched) {
+          const replay = result.idempotent ? " (idempotent replay — already ringing)" : "";
+          process.stdout.write(`Ringing the owner — dialId ${result.dialId}${replay}\n`);
+        } else {
+          const reason = result && result.reason ? `: ${result.reason}` : "";
+          process.stdout.write(`Not dispatched${reason} (dialId ${(result && result.dialId) || "n/a"})\n`);
+          process.exitCode = 1;
+        }
+      } catch (err) {
+        process.stderr.write(`ring-owner failed: ${err && err.message ? err.message : String(err)}\n`);
+        process.exitCode = 1;
+      }
+    });
+}

package/src/commands/session.js

@@ -138,6 +138,7 @@ import {
   generateSessionCheckpoint,
   generateSessionCheckpointBatch,
   listSessionCheckpoints,
+  showSessionCheckpoint,
 } from "../session/checkpoints.js";
 import {
   buildCodexExecResumeInvocation,
@@ -2317,7 +2318,7 @@ export async function resolveMessageActionIdentity({
   return resolveSessionSayIdentity({ sessionId, agentId: agentSeed, targetPath, env });
 }
 
-async function ensureSessionSayAgentRegistered(
+async function recordPublishedSessionAgentActivity(
   sessionId,
   agent = {},
   { targetPath = process.cwd() } = {},
@@ -2328,33 +2329,27 @@ async function ensureSessionSayAgentRegistered(
   }
 
   try {
-    const activeAgents = await listAgents(sessionId, { targetPath, includeInactive: false });
-    if (
-      activeAgents.some(
-        (existing) => normalizeString(existing.agentId).toLowerCase() === agentId.toLowerCase(),
-      )
-    ) {
-      return { persisted: false, reason: "already_registered" };
-    }
-  } catch {
-    // If the local registry is unreadable, let rememberAgentIdentity surface the
-    // filesystem problem with its normal error message.
+    const snapshot = await rememberAgentIdentity(sessionId, {
+      agentId,
+      model: normalizeString(agent.model) || "cli",
+      displayName: normalizeString(agent.displayName),
+      provider: normalizeString(agent.provider),
+      clientKind: normalizeString(agent.clientKind) || "cli",
+      role: sessionSayRegistryRole(agent.role),
+      targetPath,
+    });
+    return {
+      persisted: true,
+      agentId: snapshot.agentId,
+      lastActivityAt: snapshot.lastActivityAt,
+    };
+  } catch (error) {
+    return {
+      persisted: false,
+      reason: "activity_update_failed",
+      detail: normalizeString(error?.message),
+    };
   }
-
-  const registered = await rememberAgentIdentity(sessionId, {
-    agentId,
-    model: normalizeString(agent.model) || "cli",
-    displayName: normalizeString(agent.displayName),
-    provider: normalizeString(agent.provider),
-    clientKind: normalizeString(agent.clientKind) || "cli",
-    role: sessionSayRegistryRole(agent.role),
-    targetPath,
-  });
-
-  return {
-    persisted: true,
-    agentId: registered.agentId,
-  };
 }
 
 async function resolveSessionAgentEnvelope(
@@ -3645,9 +3640,6 @@ export function registerSessionCommand(program) {
         role: options.role,
         displayName: options.displayName,
       });
-      const agentRegistration = await ensureSessionSayAgentRegistered(normalizedSessionId, agent, {
-        targetPath,
-      });
       const event = createAgentEvent({
         event: "session_message",
         agent,
@@ -3699,6 +3691,10 @@ export function registerSessionCommand(program) {
         targetPath,
         syncRemote: false,
       });
+      const agentActivity = await recordPublishedSessionAgentActivity(normalizedSessionId, agent, {
+        targetPath,
+      });
+      const agentRegistration = agentActivity;
       const payload = {
         command: "session say",
         targetPath,
@@ -3710,6 +3706,7 @@ export function registerSessionCommand(program) {
         identitySource: identity.source,
         identityWarning: identity.identityWarning || undefined,
         agentRegistration,
+        agentActivity,
         remoteSync: remoteSync || undefined,
         remoteConfirmationAnchor: remoteConfirmationAnchor || undefined,
         remoteConfirmation: remoteConfirmation || undefined,
@@ -3822,6 +3819,9 @@ export function registerSessionCommand(program) {
         targetPath,
         syncRemote: false,
       });
+      const agentActivity = await recordPublishedSessionAgentActivity(normalizedSessionId, agent, {
+        targetPath,
+      });
       const payload = {
         command: "session post-agent",
         targetPath,
@@ -3830,6 +3830,7 @@ export function registerSessionCommand(program) {
         event: persisted,
         materializedLocalSession: localSession.materialized,
         refreshedLocalSession: Boolean(localSession.refreshed),
+        agentActivity,
         remoteSync,
         remoteConfirmationAnchor,
         remoteConfirmation,
@@ -6151,7 +6152,7 @@ export function registerSessionCommand(program) {
 
   const checkpoint = session
     .command("checkpoint")
-    .description("List, create, and generate durable session checkpoints");
+    .description("List, show, create, and generate durable session checkpoints");
 
   checkpoint
     .command("list <sessionId>")
@@ -6187,6 +6188,66 @@ export function registerSessionCommand(program) {
       }
     });
 
+  checkpoint
+    .command("show <sessionId> <checkpointId>")
+    .description("Show a checkpoint and a bounded read-only source event window")
+    .option("--context-events <n>", "Adjacent events to include before/after the checkpoint range (default 3)", "3")
+    .option("--max-events <n>", "Maximum events to fetch for restore context (default 120, max 200)", "120")
+    .option("--path <path>", "Workspace path for auth/session context", ".")
+    .option("--json", "Emit machine-readable output")
+    .action(async (sessionId, checkpointId, options, command) => {
+      const normalizedSessionId = normalizeString(sessionId);
+      const normalizedCheckpointId = normalizeString(checkpointId);
+      if (!normalizedSessionId) {
+        throw new Error("session id is required.");
+      }
+      if (!normalizedCheckpointId) {
+        throw new Error("checkpoint id is required.");
+      }
+      const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+      const result = await showSessionCheckpoint(normalizedSessionId, normalizedCheckpointId, {
+        targetPath,
+        contextEvents: options.contextEvents,
+        maxEvents: options.maxEvents,
+      });
+      const payload = {
+        command: "session checkpoint show",
+        targetPath,
+        ...result,
+      };
+      if (shouldEmitJson(options, command)) {
+        console.log(JSON.stringify(payload, null, 2));
+        return;
+      }
+
+      console.log(pc.bold(`Checkpoint ${result.checkpointId}`));
+      console.log(formatCheckpointLine(result.checkpoint));
+      const sourceRange = `#${result.window.startSequence}-${result.window.endSequence}`;
+      const contextSummary =
+        `${result.window.sourceEventCount}/${result.window.sourceEventCountExpected} source` +
+        `, ${result.window.beforeContextCount} before` +
+        `, ${result.window.afterContextCount} after`;
+      console.log(pc.gray(`Read-only restore window ${sourceRange}: ${contextSummary}.`));
+      if (!result.ok) {
+        console.log(pc.yellow(`Remote event window unavailable: ${result.reason || "unknown"}`));
+        return;
+      }
+      if (result.window.partial) {
+        const missing = result.window.missingSourceEvents
+          ? ` missing=${result.window.missingSourceEvents}`
+          : "";
+        const truncated = result.window.truncatedByLimit ? " truncated-by-limit" : "";
+        console.log(pc.yellow(`Partial checkpoint source range:${missing}${truncated}`.trim()));
+      }
+      for (const event of result.window.events) {
+        const sequence = eventSequenceNumber(event);
+        const inSource =
+          sequence >= result.window.startSequence &&
+          sequence <= result.window.endSequence;
+        console.log(`${inSource ? "*" : " "} ${formatEventLine(event)}`);
+      }
+    });
+
   checkpoint
     .command("create <sessionId>")
     .description("Create a durable checkpoint anchored to a canonical sequence range")

package/src/legacy-cli.js

@@ -2517,7 +2517,7 @@ jobs:
           fi
       - name: Run Omar Gate
         id: omar
-        uses: mrrCarter/sentinelayer-v1-action@a496be33a466c0cc3f8616d66bbd7d78f7d3c31d
+        uses: mrrCarter/sentinelayer-v1-action@8afb7dbb42a5e1c25233d422c4cabe401ba02380
         with:
           github_token: \${{ github.token }}
           openai_api_key: \${{ secrets.OPENAI_API_KEY }}
@@ -2626,7 +2626,7 @@ jobs:
               },
               "scan": {
                   "mode": env("OMAR_SCAN_MODE", "deep"),
-                  "action_ref": "mrrCarter/sentinelayer-v1-action@a496be33a466c0cc3f8616d66bbd7d78f7d3c31d",
+                  "action_ref": "mrrCarter/sentinelayer-v1-action@8afb7dbb42a5e1c25233d422c4cabe401ba02380",
                   "llm_provider": env("OMAR_LLM_PROVIDER", "openai"),
                   "model": env("OMAR_MODEL", "gpt-5.3-codex"),
                   "model_fallback": env("OMAR_MODEL_FALLBACK", "gpt-4.1-mini"),