sentinelayer-cli 0.39.2 → 0.41.0

package/README.md

@@ -142,14 +142,14 @@ Then point your agents at it:
 
 ```bash
 sl session join <session-id> --agent <agent-name>
-sl session say <session-id> "status: starting on auth middleware" --agent <agent-name>
+sl session action <session-id> working_on --target-sequence <n>
 ```
 
 Sentinelayer includes a deterministic session coordination surface for multi-agent coding loops:
 
 - session event stream and replay (`start`, `join`, `say`, `read`, `status`, `leave`, `list`, `kill`)
-- low-noise message actions (`react ack|like|dislike`, `action working_on|disregard`, `reply`/`comment`, `view`, `actions`)
-- agent lifecycle controls (join/heartbeat/leave/kill)
+- low-noise message actions (`react ack|like|dislike`, `action working_on|disregard`, `reply`/`comment`, `actions`) plus one monotonic per-agent read cursor (`view`)
+- agent lifecycle controls (join/ephemeral TTL presence/leave/kill); listener liveness never enters the durable transcript
 - recap and context briefing for late-joining agents
 - analytics + lineage artifacts at session closeout
 
@@ -694,7 +694,7 @@ Use `init-aidenid` to scaffold an Anthropic-compatible tool schema wrapper for A
 Use `init-aidenid-adapter` to scaffold a deterministic AIdenID provisioning API contract (tool binding -> HTTP path/method -> response field mapping) and cross-check it against the registry with `validate-aidenid-adapter`.
 Use `token mint` to request a short-lived hosted MCP bearer token from the Sentinelayer API. Text output hides the bearer value; `--json` is the explicit operator path that includes `accessToken`. The command is blocked from the generated CLI MCP bridge.
 Use `smoke` to verify the hosted MCP resource without printing the bearer. The canonical remote MCP paste URL is `https://api.sentinelayer.com/mcp`; the token audience/resource value is `https://mcp.sentinelayer.com` and is handled by the OAuth/MCP flow. `sl mcp smoke` works today through the CLI direct-mint path; third-party browser connectors such as Claude.ai still require the OAuth browser-flow and connector-registration work to complete before users can authenticate from that product.
-Use `init-session` plus `server run` for the local stdio Senti MCP server. It exposes session inbox, durable posts, actions/replies/reactions, file locks, and attention requests to local MCP clients. Hosted Claude-web/ChatGPT connectors need a separate HTTPS/OAuth service and are not shipped by the local stdio server. See [docs/mcp.md](docs/mcp.md).
+Use `init-session` plus `server run` for the local stdio Senti MCP server. It exposes session inbox, durable posts, actions/replies/reactions, API-authoritative file leases, and attention requests to local MCP clients. File-lease lifecycle operations never write session events; install edit preflights with `sl session guard-install` and remove them with `sl session guard-uninstall` before any CLI rollback. Hosted Claude-web/ChatGPT connectors need a separate HTTPS/OAuth service and are not shipped by the local stdio server. See [docs/mcp.md](docs/mcp.md) and [docs/file-leases.md](docs/file-leases.md).
 Use `init-cli` to generate a bridge registry for every `sl` leaf command from Commander metadata. This exposes the full CLI surface as `sl.<command.path>` tool schemas, but execution still requires a bridge-capable MCP host with OAuth/session-seat policy and human approval enforcement. The hosted connector target contract is documented in [docs/mcp-hosted-connector.md](docs/mcp-hosted-connector.md).
 
 MCP operator verification:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.39.2",
+  "version": "0.41.0",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {
@@ -66,8 +66,7 @@
     "zod": "4.1.12"
   },
   "devDependencies": {
-    "c8": "10.1.3",
-    "license-checker-rseidelsohn": "4.4.2"
+    "c8": "11.0.0"
   },
   "overrides": {
     "lighthouse": {

package/src/agents/ai-governance/tools/base.js

@@ -1,171 +1,24 @@
 // Shared helpers for Amina's (ai-governance) domain tools (#A24).
 
-import fsp from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-
-import ignore from "ignore";
-
-const DEFAULT_IGNORED_DIRS = new Set([
-  ".git",
-  "node_modules",
-  ".venv",
-  ".next",
-  "dist",
-  "build",
-  "coverage",
-  ".sentinelayer",
-  ".sentinel",
-  ".turbo",
-  ".idea",
-  ".vscode",
-  "__pycache__",
-  ".cache",
-]);
-const MAX_FILE_SIZE_BYTES = 1024 * 1024;
-const SEVERITIES = Object.freeze(["P0", "P1", "P2", "P3"]);
-
-export function toPosix(value) {
-  return String(value || "").replace(/\\/g, "/");
-}
-
-export function createFinding({
-  severity,
-  kind,
-  file,
-  line = 0,
-  evidence = "",
-  rootCause = "",
-  recommendedFix = "",
-  confidence = null,
-  tool = "",
-  persona = "ai-governance",
-} = {}) {
-  const normalizedSeverity = SEVERITIES.includes(String(severity || "").toUpperCase())
-    ? String(severity).toUpperCase()
-    : "P2";
-  return {
-    persona,
-    tool: String(tool || "").trim(),
-    kind: String(kind || "").trim() || "ai-governance",
-    severity: normalizedSeverity,
-    file: toPosix(file || ""),
-    line: Number.isFinite(Number(line)) ? Math.max(0, Math.floor(Number(line))) : 0,
-    evidence: String(evidence || "").trim().slice(0, 400),
-    rootCause: String(rootCause || "").trim(),
-    recommendedFix: String(recommendedFix || "").trim(),
-    confidence:
-      confidence === null || confidence === undefined
-        ? null
-        : Math.max(0, Math.min(1, Number(confidence) || 0)),
-  };
-}
-
-async function readIgnorePatterns(filePath) {
-  try {
-    const raw = await fsp.readFile(filePath, "utf-8");
-    return String(raw || "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line && !line.startsWith("#"));
-  } catch (err) {
-    if (err && typeof err === "object" && err.code === "ENOENT") {
-      return [];
-    }
-    throw err;
-  }
-}
-
-async function createIgnoreMatcher(rootPath) {
-  const matcher = ignore();
-  const gitignore = await readIgnorePatterns(path.join(rootPath, ".gitignore"));
-  const sentinel = await readIgnorePatterns(
-    path.join(rootPath, ".sentinelayerignore")
-  );
-  matcher.add([...gitignore, ...sentinel]);
-  return (relativePath, isDirectory) => {
-    const normalized = toPosix(relativePath);
-    if (!normalized) {
-      return false;
-    }
-    const candidate = isDirectory ? `${normalized}/` : normalized;
-    return matcher.ignores(candidate);
-  };
-}
-
-export function findLineMatches(content, pattern) {
-  const text = String(content || "");
-  const global = new RegExp(
-    pattern.source,
-    pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`
-  );
-  const matches = [];
-  let match;
-  while ((match = global.exec(text)) !== null) {
-    const lineIndex = text.slice(0, match.index).split(/\r?\n/).length;
-    matches.push({ index: match.index, line: lineIndex, match: match[0] });
-  }
-  return matches;
-}
-
-export function getLineContent(content, line) {
-  const lines = String(content || "").split(/\r?\n/);
-  return (lines[Math.max(0, (Number(line) || 1) - 1)] || "").trim();
+import {
+  createFinding as createDomainFinding,
+  findLineMatches,
+  getLineContent,
+  toPosix,
+  walkRepoFiles as walkDomainRepoFiles,
+} from "../../shared-tools/domain-base.js";
+
+const DEFAULT_PERSONA = "ai-governance";
+
+export { findLineMatches, getLineContent, toPosix };
+
+export function createFinding(options = {}) {
+  return createDomainFinding(options, {
+    defaultPersona: DEFAULT_PERSONA,
+    defaultKind: DEFAULT_PERSONA,
+  });
 }
 
-export async function* walkRepoFiles({
-  rootPath = process.cwd(),
-  extensions = new Set(),
-  maxFileSize = MAX_FILE_SIZE_BYTES,
-} = {}) {
-  const resolvedRoot = path.resolve(rootPath);
-  const ignoreMatcher = await createIgnoreMatcher(resolvedRoot);
-  const wantedExtensions =
-    extensions instanceof Set
-      ? extensions
-      : new Set(Array.isArray(extensions) ? extensions : []);
-  const stack = [resolvedRoot];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    let entries = [];
-    try {
-      entries = await fsp.readdir(current, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const fullPath = path.join(current, entry.name);
-      const relativePath = toPosix(path.relative(resolvedRoot, fullPath));
-      if (entry.isDirectory()) {
-        if (!relativePath || DEFAULT_IGNORED_DIRS.has(entry.name)) {
-          continue;
-        }
-        if (ignoreMatcher(relativePath, true)) {
-          continue;
-        }
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile()) {
-        continue;
-      }
-      if (ignoreMatcher(relativePath, false)) {
-        continue;
-      }
-      const ext = path.extname(entry.name).toLowerCase();
-      if (wantedExtensions.size > 0 && !wantedExtensions.has(ext) && !wantedExtensions.has("")) {
-        continue;
-      }
-      let stat = null;
-      try {
-        stat = await fsp.stat(fullPath);
-      } catch {
-        stat = null;
-      }
-      if (!stat || stat.size > maxFileSize) {
-        continue;
-      }
-      yield { fullPath, relativePath, stat };
-    }
-  }
+export async function* walkRepoFiles(options = {}) {
+  yield* walkDomainRepoFiles(options, { entryMetadata: "stat" });
 }

package/src/agents/backend/tools/base.js

@@ -1,189 +1,36 @@
 // Shared helpers for Maya's (backend) domain tools (#A14).
-// Mirrors src/agents/security/tools/base.js but with persona defaulting to
-// "backend". Intentional per-persona copy — a later refactor (#A25+) can
-// hoist this to src/agents/shared-tools/ once the 12 persona modules are
-// shipped and the common surface is stable.
 
-import fsp from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-
-import ignore from "ignore";
-
-const DEFAULT_IGNORED_DIRS = new Set([
-  ".git",
-  "node_modules",
-  ".venv",
-  ".next",
-  "dist",
-  "build",
-  "coverage",
-  ".sentinelayer",
-  ".sentinel",
-  ".turbo",
-  ".idea",
-  ".vscode",
-  "__pycache__",
-  ".cache",
-]);
-const MAX_FILE_SIZE_BYTES = 1024 * 1024;
-const SEVERITIES = Object.freeze(["P0", "P1", "P2", "P3"]);
-
-export function toPosix(value) {
-  return String(value || "").replace(/\\/g, "/");
-}
-
-export function normalizeSeverity(value) {
-  const normalized = String(value || "").trim().toUpperCase();
-  if (SEVERITIES.includes(normalized)) {
-    return normalized;
-  }
-  return "P2";
-}
-
-export function createFinding({
-  severity,
-  kind,
-  file,
-  line = 0,
-  evidence = "",
-  rootCause = "",
-  recommendedFix = "",
-  confidence = null,
-  tool = "",
-  persona = "backend",
-} = {}) {
-  return {
-    persona,
-    tool: String(tool || "").trim(),
-    kind: String(kind || "").trim() || "backend",
-    severity: normalizeSeverity(severity),
-    file: toPosix(file || ""),
-    line: Number.isFinite(Number(line)) ? Math.max(0, Math.floor(Number(line))) : 0,
-    evidence: String(evidence || "").trim().slice(0, 400),
-    rootCause: String(rootCause || "").trim(),
-    recommendedFix: String(recommendedFix || "").trim(),
-    confidence:
-      confidence === null || confidence === undefined
-        ? null
-        : Math.max(0, Math.min(1, Number(confidence) || 0)),
-  };
-}
-
-async function readIgnorePatterns(filePath) {
-  try {
-    const raw = await fsp.readFile(filePath, "utf-8");
-    return String(raw || "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line && !line.startsWith("#"));
-  } catch (err) {
-    if (err && typeof err === "object" && err.code === "ENOENT") {
-      return [];
-    }
-    throw err;
-  }
+import {
+  DEFAULT_IGNORED_DIRS,
+  MAX_FILE_SIZE_BYTES,
+  SEVERITIES,
+  createFinding as createDomainFinding,
+  findLineMatches,
+  getLineContent,
+  normalizeSeverity,
+  toPosix,
+  walkRepoFiles as walkDomainRepoFiles,
+} from "../../shared-tools/domain-base.js";
+
+const DEFAULT_PERSONA = "backend";
+
+export {
+  DEFAULT_IGNORED_DIRS,
+  MAX_FILE_SIZE_BYTES,
+  SEVERITIES,
+  findLineMatches,
+  getLineContent,
+  normalizeSeverity,
+  toPosix,
+};
+
+export function createFinding(options = {}) {
+  return createDomainFinding(options, {
+    defaultPersona: DEFAULT_PERSONA,
+    defaultKind: DEFAULT_PERSONA,
+  });
+}
+
+export async function* walkRepoFiles(options = {}) {
+  yield* walkDomainRepoFiles(options);
 }
-
-async function createIgnoreMatcher(rootPath) {
-  const matcher = ignore();
-  const gitignore = await readIgnorePatterns(path.join(rootPath, ".gitignore"));
-  const sentinel = await readIgnorePatterns(
-    path.join(rootPath, ".sentinelayerignore")
-  );
-  matcher.add([...gitignore, ...sentinel]);
-  return (relativePath, isDirectory) => {
-    const normalized = toPosix(relativePath);
-    if (!normalized) {
-      return false;
-    }
-    const candidate = isDirectory ? `${normalized}/` : normalized;
-    return matcher.ignores(candidate);
-  };
-}
-
-export async function* walkRepoFiles({
-  rootPath = process.cwd(),
-  extensions = new Set(),
-  maxFileSize = MAX_FILE_SIZE_BYTES,
-} = {}) {
-  const resolvedRoot = path.resolve(rootPath);
-  const ignoreMatcher = await createIgnoreMatcher(resolvedRoot);
-  const wantedExtensions =
-    extensions instanceof Set
-      ? extensions
-      : new Set(Array.isArray(extensions) ? extensions : []);
-  const stack = [resolvedRoot];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    let entries = [];
-    try {
-      entries = await fsp.readdir(current, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const fullPath = path.join(current, entry.name);
-      const relativePath = toPosix(path.relative(resolvedRoot, fullPath));
-      if (entry.isDirectory()) {
-        if (!relativePath || DEFAULT_IGNORED_DIRS.has(entry.name)) {
-          continue;
-        }
-        if (ignoreMatcher(relativePath, true)) {
-          continue;
-        }
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile()) {
-        continue;
-      }
-      if (ignoreMatcher(relativePath, false)) {
-        continue;
-      }
-      const ext = path.extname(entry.name).toLowerCase();
-      if (wantedExtensions.size > 0 && !wantedExtensions.has(ext) && !wantedExtensions.has("")) {
-        continue;
-      }
-      let stat = null;
-      try {
-        stat = await fsp.stat(fullPath);
-      } catch {
-        stat = null;
-      }
-      if (!stat || stat.size > maxFileSize) {
-        continue;
-      }
-      yield { fullPath, relativePath };
-    }
-  }
-}
-
-export function findLineMatches(content, pattern) {
-  const text = String(content || "");
-  if (!pattern) {
-    return [];
-  }
-  const global = new RegExp(
-    pattern.source,
-    pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`
-  );
-  const matches = [];
-  let match;
-  while ((match = global.exec(text)) !== null) {
-    const lineIndex = text.slice(0, match.index).split(/\r?\n/).length;
-    matches.push({
-      index: match.index,
-      line: lineIndex,
-      match: match[0],
-    });
-  }
-  return matches;
-}
-
-export function getLineContent(content, line) {
-  const lines = String(content || "").split(/\r?\n/);
-  return (lines[Math.max(0, (Number(line) || 1) - 1)] || "").trim();
-}
-
-export { DEFAULT_IGNORED_DIRS, MAX_FILE_SIZE_BYTES, SEVERITIES };

package/src/agents/code-quality/tools/base.js

@@ -1,159 +1,32 @@
 // Shared helpers for Ethan's (code-quality) domain tools (#A16).
-// Same per-persona base pattern as security / backend / testing.
 
-import fsp from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
-
-import ignore from "ignore";
-
-const DEFAULT_IGNORED_DIRS = new Set([
-  ".git",
-  "node_modules",
-  ".venv",
-  ".next",
-  "dist",
-  "build",
-  "coverage",
-  ".sentinelayer",
-  ".sentinel",
-  ".turbo",
-  ".idea",
-  ".vscode",
-  "__pycache__",
-  ".cache",
-]);
-const MAX_FILE_SIZE_BYTES = 1024 * 1024;
-const SEVERITIES = Object.freeze(["P0", "P1", "P2", "P3"]);
-
-export function toPosix(value) {
-  return String(value || "").replace(/\\/g, "/");
-}
-
-export function normalizeSeverity(value) {
-  const normalized = String(value || "").trim().toUpperCase();
-  if (SEVERITIES.includes(normalized)) {
-    return normalized;
-  }
-  return "P2";
-}
-
-export function createFinding({
-  severity,
-  kind,
-  file,
-  line = 0,
-  evidence = "",
-  rootCause = "",
-  recommendedFix = "",
-  confidence = null,
-  tool = "",
-  persona = "code-quality",
-} = {}) {
-  return {
-    persona,
-    tool: String(tool || "").trim(),
-    kind: String(kind || "").trim() || "code-quality",
-    severity: normalizeSeverity(severity),
-    file: toPosix(file || ""),
-    line: Number.isFinite(Number(line)) ? Math.max(0, Math.floor(Number(line))) : 0,
-    evidence: String(evidence || "").trim().slice(0, 400),
-    rootCause: String(rootCause || "").trim(),
-    recommendedFix: String(recommendedFix || "").trim(),
-    confidence:
-      confidence === null || confidence === undefined
-        ? null
-        : Math.max(0, Math.min(1, Number(confidence) || 0)),
-  };
-}
-
-async function readIgnorePatterns(filePath) {
-  try {
-    const raw = await fsp.readFile(filePath, "utf-8");
-    return String(raw || "")
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line && !line.startsWith("#"));
-  } catch (err) {
-    if (err && typeof err === "object" && err.code === "ENOENT") {
-      return [];
-    }
-    throw err;
-  }
+import {
+  DEFAULT_IGNORED_DIRS,
+  MAX_FILE_SIZE_BYTES,
+  SEVERITIES,
+  createFinding as createDomainFinding,
+  normalizeSeverity,
+  toPosix,
+  walkRepoFiles as walkDomainRepoFiles,
+} from "../../shared-tools/domain-base.js";
+
+const DEFAULT_PERSONA = "code-quality";
+
+export {
+  DEFAULT_IGNORED_DIRS,
+  MAX_FILE_SIZE_BYTES,
+  SEVERITIES,
+  normalizeSeverity,
+  toPosix,
+};
+
+export function createFinding(options = {}) {
+  return createDomainFinding(options, {
+    defaultPersona: DEFAULT_PERSONA,
+    defaultKind: DEFAULT_PERSONA,
+  });
 }
 
-async function createIgnoreMatcher(rootPath) {
-  const matcher = ignore();
-  const gitignore = await readIgnorePatterns(path.join(rootPath, ".gitignore"));
-  const sentinel = await readIgnorePatterns(
-    path.join(rootPath, ".sentinelayerignore")
-  );
-  matcher.add([...gitignore, ...sentinel]);
-  return (relativePath, isDirectory) => {
-    const normalized = toPosix(relativePath);
-    if (!normalized) {
-      return false;
-    }
-    const candidate = isDirectory ? `${normalized}/` : normalized;
-    return matcher.ignores(candidate);
-  };
+export async function* walkRepoFiles(options = {}) {
+  yield* walkDomainRepoFiles(options);
 }
-
-export async function* walkRepoFiles({
-  rootPath = process.cwd(),
-  extensions = new Set(),
-  maxFileSize = MAX_FILE_SIZE_BYTES,
-} = {}) {
-  const resolvedRoot = path.resolve(rootPath);
-  const ignoreMatcher = await createIgnoreMatcher(resolvedRoot);
-  const wantedExtensions =
-    extensions instanceof Set
-      ? extensions
-      : new Set(Array.isArray(extensions) ? extensions : []);
-  const stack = [resolvedRoot];
-  while (stack.length > 0) {
-    const current = stack.pop();
-    let entries = [];
-    try {
-      entries = await fsp.readdir(current, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const fullPath = path.join(current, entry.name);
-      const relativePath = toPosix(path.relative(resolvedRoot, fullPath));
-      if (entry.isDirectory()) {
-        if (!relativePath || DEFAULT_IGNORED_DIRS.has(entry.name)) {
-          continue;
-        }
-        if (ignoreMatcher(relativePath, true)) {
-          continue;
-        }
-        stack.push(fullPath);
-        continue;
-      }
-      if (!entry.isFile()) {
-        continue;
-      }
-      if (ignoreMatcher(relativePath, false)) {
-        continue;
-      }
-      const ext = path.extname(entry.name).toLowerCase();
-      if (wantedExtensions.size > 0 && !wantedExtensions.has(ext) && !wantedExtensions.has("")) {
-        continue;
-      }
-      let stat = null;
-      try {
-        stat = await fsp.stat(fullPath);
-      } catch {
-        stat = null;
-      }
-      if (!stat || stat.size > maxFileSize) {
-        continue;
-      }
-      yield { fullPath, relativePath };
-    }
-  }
-}
-
-export { DEFAULT_IGNORED_DIRS, MAX_FILE_SIZE_BYTES, SEVERITIES };