sentinelayer-cli 0.43.0 → 0.45.0

package/README.md

@@ -164,11 +164,13 @@ sl session action <session-id> working_on --target-sequence <n>
 ```
 
 For a room that requires agent admission, the agent declares its goal, requested
-actions, and TTL. The CLI creates an agent-held Ed25519 identity, waits for a
-human decision, then waits for the minted AIdenID email and verified signed
-purpose receipt. Only after that evidence is ready does it claim the approved
-grant with proof of possession and join. The private key and scoped credential
-are stored locally and are never printed:
+actions, and TTL. The CLI creates an agent-held Ed25519 identity and waits for a
+human decision. When the API reports identity readiness on the approved
+admission, the CLI also waits for the minted AIdenID email and verified signed
+purpose receipt before it claims; when the API does not report it, the approved
+grant is claimed directly. The claim uses proof of possession, then the agent
+joins. The private key and scoped credential are stored locally and are never
+printed:
 
 ```bash
 # Agent: request and wait for the owner's decision (maximum grant TTL is 24h).
@@ -190,20 +192,27 @@ sl session access approve <session-id> <admission-id> \
 # sl session access revoke <session-id> <admission-id> --reason "work complete"
 ```
 
-Approval queues the AIdenID email and purpose-receipt work. `session access
-list --json` reports the real `email`, `purpose`, and Jev status; it does not
-invent successful issuance while those jobs are pending or unavailable, and
-the API withholds the claim challenge until both identity artifacts are ready.
+`session access list --json` reports the `email`, `purpose`, and Jev status the
+API returns; the CLI does not invent successful issuance. On an API that gates
+the claim on identity evidence, approval queues the AIdenID email and
+purpose-receipt work and the claim challenge is withheld until both are ready.
+On an API that does not, approval issues the claim challenge directly.
 The agent must re-run `session join` with the same goal, scope, and TTL after an
 asynchronous request so it can claim and verify its live session-bound receipt.
-New rooms default to fail-closed `required` mode. Existing rooms retain their
-stored `legacy` mode until an owner explicitly sets `required`; the mode command
-is the activation step for those pre-existing rooms.
+A room's admission mode is whatever the API stored for it; `session access list`
+shows it, and an owner changes it with `session access mode <session-id>
+required` (or `legacy`).
+
+The owner actions (`approve`, `deny`, `revoke`, `mode`) run on the owner's own
+session. They are unavailable in an agent context, meaning `SENTINELAYER_AGENT_ID`
+is set or agent admission credentials are stored on the machine; owners use the
+web dashboard from such machines. `session access` commands are not callable
+through the MCP CLI bridge.
 
 Sentinelayer includes a deterministic session coordination surface for multi-agent coding loops:
 
 - session event stream and replay (`start`, `join`, `say`, `read`, `status`, `leave`, `list`, `kill`)
-- low-noise message actions (`react ack|like|dislike`, `action working_on|disregard`, `reply`/`comment`, `actions`) plus one monotonic per-agent read cursor (`view`)
+- low-noise message actions (`react ack|like|dislike|unlike|undislike`, `action working_on|disregard`, `reply`/`comment`, `actions`) plus one monotonic per-agent read cursor (`view`)
 - agent lifecycle controls (join/ephemeral TTL presence/leave/kill); listener liveness never enters the durable transcript
 - recap and context briefing for late-joining agents
 - analytics + lineage artifacts at session closeout
@@ -750,7 +759,7 @@ Use `init-aidenid-adapter` to scaffold a deterministic AIdenID provisioning API
 Use `token mint` to request a short-lived hosted MCP bearer token from the Sentinelayer API. Text output hides the bearer value; `--json` is the explicit operator path that includes `accessToken`. The command is blocked from the generated CLI MCP bridge.
 Use `smoke` to verify the hosted MCP resource without printing the bearer. The canonical remote MCP paste URL is `https://api.sentinelayer.com/mcp`; the token audience/resource value is `https://mcp.sentinelayer.com` and is handled by the OAuth/MCP flow. `sl mcp smoke` works today through the CLI direct-mint path; third-party browser connectors such as Claude.ai still require the OAuth browser-flow and connector-registration work to complete before users can authenticate from that product.
 Use `init-session` plus `server run` for the local stdio Senti MCP server. It exposes session inbox, durable posts, actions/replies/reactions, API-authoritative file leases, and attention requests to local MCP clients. File-lease lifecycle operations never write session events; install edit preflights with `sl session guard-install` and remove them with `sl session guard-uninstall` before any CLI rollback. Hosted Claude-web/ChatGPT connectors need a separate HTTPS/OAuth service and are not shipped by the local stdio server. See [docs/mcp.md](docs/mcp.md) and [docs/file-leases.md](docs/file-leases.md).
-Use `init-cli` to generate a bridge registry for every `sl` leaf command from Commander metadata. This exposes the full CLI surface as `sl.<command.path>` tool schemas, but execution still requires a bridge-capable MCP host with OAuth/session-seat policy and human approval enforcement. The hosted connector target contract is documented in [docs/mcp-hosted-connector.md](docs/mcp-hosted-connector.md).
+Use `init-cli` to generate a bridge registry for every `sl` leaf command from Commander metadata. This exposes the full CLI surface as `sl.<command.path>` tool schemas, but execution still requires a bridge-capable MCP host with OAuth/session-seat policy and human approval enforcement. The MCP bridge now enforces the human-approval requirement on CLI tools; they are unavailable over MCP until approval is supported. Senti session tools are unaffected. The local stdio server does not list the `sl.*` tools, and a call to one returns a JSON-RPC error (code `-32001`, `data.reason` `human_approval_required`) that says to run the `sl` command in a terminal. A file or directory input to a bridged command must stay inside the workspace (no absolute path, no `..` or symlink out of it). The hosted connector target contract is documented in [docs/mcp-hosted-connector.md](docs/mcp-hosted-connector.md).
 
 MCP operator verification:
 
@@ -761,7 +770,7 @@ MCP operator verification:
    `sl mcp smoke --session <senti-session-id> --json`. The smoke mints the
    short-lived bearer in memory, calls `/mcp`, and prints only redacted proof.
 3. Kill switch: set `SENTINELAYER_MCP_CLI_BRIDGE_DISABLED=1` and restart the
-   MCP host if a CLI bridge or bearer credential is exposed.
+   MCP host if a CLI bridge or bearer credential is exposed. In this version the MCP server already refuses every `sl.*` call for human approval, so the switch does not change MCP responses; it is defence in depth for the CLI bridge handler and for approved execution in a future version.
 
 Architecture references: local stdio runtime and incident response live in
 [docs/mcp.md](docs/mcp.md); hosted OAuth/session-seat requirements live in
@@ -808,7 +817,7 @@ Architecture decisions:
 If a hosted MCP bearer or bridge command output is exposed:
 
 1. Set `SENTINELAYER_MCP_CLI_BRIDGE_DISABLED=1`.
-2. Restart the MCP host process so the generated CLI bridge cannot execute.
+2. Restart the MCP host process. In this version the MCP server already refuses every `sl.*` call for human approval, so the switch does not change MCP responses; it is defence in depth for the CLI bridge handler and for approved execution in a future version.
 3. Run `sentinelayer-cli auth revoke` or revoke the requesting session from the
    dashboard, then re-authenticate with `sentinelayer-cli auth login`.
 4. Remove the exposed value from local logs/transcripts where possible.
@@ -903,6 +912,10 @@ gh secret list --repo <owner/repo>
 - `SENTINELAYER_DISABLE_KEYRING=1` (force file-based credential storage)
 - `AIDENID_API_KEY`, `AIDENID_ORG_ID`, `AIDENID_PROJECT_ID` (used by `sl ai provision-email --execute`)
 
+When the CLI sends your SentinelLayer token over HTTP, it sends it only to the API named by `SENTINELAYER_API_URL` (else by `apiUrl` in `~/.sentinelayer/config.yml`, else the default API), or to the pocket gateway named by `SENTI_POCKET_URL`. `POCKET_GATEWAY_URL` is no longer read. The CLI decides this once, when it starts. Custom API origins must be configured: an `--api-url` or `--gateway-url` that names another origin is refused for any request that would carry the token. A project `.sentinelayer.yml` chooses neither the API nor the token: its `apiUrl` and `sentinelayerToken` are not used, nor are its provider keys (`openaiApiKey`, `anthropicApiKey`, `googleApiKey`), which come from the environment or the global config. Watchdog alert channels (`alerts.channels`) also come from the global config only; a channel's `${NAME}` placeholders are filled only from `SLACK_WEBHOOK_URL`, `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` or `SENTINELAYER_ALERT_*` (any other name, or an unset one, refuses the channel), and Slack alerts go only to `https://hooks.slack.com/`. When a project config sets any of these, the CLI prints one notice saying what to set instead. Requests that carry the token do not follow redirects.
+
+The token leaves the CLI in other ways only through operator commands, none of which is available through the MCP bridge: `sl scan setup-secrets` writes it to a GitHub Actions secret with the `gh` CLI (or to the file named by `SENTINELAYER_SECRET_SINK_FILE`, used in tests), and `sl mcp token mint --json` prints a short-lived hosted MCP bearer minted from it. The project token that `sl init` receives for a new scaffold (not your login token) is written to the project's `.env`, its `.sentinelayer/config.json` lockfile and, only when you pass `--inject-secret` (or set `injectSecret` in the interview), a GitHub Actions secret on this directory's own git remote, after `gh` confirms you can write to it. `OPENAI_API_KEY` from your environment is set there only with `--inject-openai-key`. Neither is available through the MCP bridge. Other services' keys (model providers, AIdenID, a memory or embedding service) are sent to their own endpoints.
+
 ## Layered config (PR 0.2)
 
 The CLI supports layered config resolution:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/agents/jules/tools/aidenid-email.js

@@ -11,8 +11,8 @@ import {
   resolveAidenIdCredentials,
   normalizeAidenIdApiUrl,
 } from "../../../ai/aidenid.js";
-import { readStoredSession } from "../../../auth/session-store.js";
 import { fetchAidenIdCredentials } from "../../../auth/service.js";
+import { isAuthenticated } from "../../../auth/credential-destinations.js";
 
 /**
  * AIdenID email tool definition for agent dispatch.
@@ -57,16 +57,14 @@ export const AIDENID_EMAIL_TOOL = {
 export async function executeAidenIdEmailTool(input, ctx = {}) {
   const operation = String(input.operation || "").trim();
 
-  let session = null;
-  try {
-    session = await readStoredSession();
-  } catch {
-    // no session
-  }
+  const { resolveActiveAuthSession } = await import("../../../auth/service.js");
+  const session = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
+    () => null,
+  );
 
   const makeFetcher = () => {
-    if (!session || !session.token) return null;
-    return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, token: session.token });
+    if (!isAuthenticated(session)) return null;
+    return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, auth: session });
   };
 
   const credentials = await resolveAidenIdCredentials({

package/src/agents/jules/tools/frontend-analyze.js

@@ -4,6 +4,7 @@ import { execFileSync } from "node:child_process";
 import { glob as globTool } from "./glob.js";
 import { grep as grepTool } from "./grep.js";
 import { fileRead } from "./file-read.js";
+import { buildScrubbedEnv } from "../../shared-tools/shell.js";
 
 /**
  * FrontendAnalyze — 24 deterministic operations for the Jules Tanaka persona.
@@ -346,11 +347,22 @@ function checkErrorBoundaries(rootPath) {
   };
 }
 
+// npm runs in the repository with credentials removed from its environment, so the repository's
+// .npmrc cannot place them in a request.
+function npmAuditInvocation(rootPath, env = process.env) {
+  return {
+    file: "npm",
+    args: ["audit", "--json", "--production"],
+    options: { cwd: rootPath, encoding: "utf-8", timeout: 30000, stdio: ["pipe", "pipe", "pipe"], env: buildScrubbedEnv(env) },
+  };
+}
+
+export const __frontendAnalyzeForTests = Object.freeze({ npmAuditInvocation });
+
 function auditNpmDeps(rootPath) {
   try {
-    const output = execFileSync("npm", ["audit", "--json", "--production"], {
-      cwd: rootPath, encoding: "utf-8", timeout: 30000, stdio: ["pipe", "pipe", "pipe"],
-    });
+    const invocation = npmAuditInvocation(rootPath);
+    const output = execFileSync(invocation.file, invocation.args, invocation.options);
     const audit = JSON.parse(output);
     return {
       vulnerabilities: audit.metadata?.vulnerabilities || {},

package/src/agents/jules/tools/runtime-audit.js

@@ -3,7 +3,9 @@ import path from "node:path";
 import fs from "node:fs";
 import os from "node:os";
 import { randomUUID } from "node:crypto";
+import { credentialedRequest, isAuthenticated } from "../../../auth/credential-destinations.js";
 import { assertPermittedAuditTarget } from "./url-policy.js";
+import { buildScrubbedEnv } from "../../shared-tools/shell.js";
 
 /**
  * Jules Tanaka — Runtime Audit Tool
@@ -46,6 +48,37 @@ const RUNTIME_DISPATCH = {
   check_dom_stats: checkDomStats,
 };
 
+/**
+ * How Lighthouse runs. No shell: the target URL can come from the repository (package.json,
+ * vercel.json, .env files), and a shell would expand variables and operators inside it. Credentials
+ * are removed from npx's environment, so a repository .npmrc cannot place them in a request.
+ * On Windows, where npx is a .cmd file, npm's npx script runs under this Node.js instead.
+ */
+function lighthouseInvocation(
+  targetUrl,
+  outputPath,
+  { platform = process.platform, execPath = process.execPath, exists = fs.existsSync, env = process.env } = {},
+) {
+  const args = [
+    "--yes", "lighthouse@12", targetUrl,
+    "--output", "json", "--output-path", outputPath,
+    "--chrome-flags=--headless --no-sandbox --disable-gpu", "--quiet",
+  ];
+  const options = {
+    encoding: "utf-8",
+    timeout: LIGHTHOUSE_TIMEOUT_MS,
+    stdio: ["pipe", "pipe", "pipe"],
+    env: buildScrubbedEnv(env),
+  };
+  if (platform !== "win32") {
+    return { file: "npx", args, options };
+  }
+  const npxCli = path.join(path.dirname(execPath), "node_modules", "npm", "bin", "npx-cli.js");
+  return exists(npxCli) ? { file: execPath, args: [npxCli, ...args], options } : null;
+}
+
+export const __runtimeAuditForTests = Object.freeze({ lighthouseInvocation, detectDeployedUrl });
+
 /**
  * Run Lighthouse via npx (no install required).
  * Returns performance, accessibility, best-practices, SEO scores + key metrics.
@@ -74,16 +107,11 @@ async function lighthouseScan(input) {
     const outputDir = path.dirname(outputPath);
     if (!fs.existsSync(outputDir)) fs.mkdirSync(outputDir, { recursive: true });
 
-    execFileSync("npx", [
-      "--yes", "lighthouse@12", targetUrl,
-      "--output", "json", "--output-path", outputPath,
-      "--chrome-flags=--headless --no-sandbox --disable-gpu", "--quiet",
-    ], {
-      encoding: "utf-8",
-      timeout: LIGHTHOUSE_TIMEOUT_MS,
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: true, // Windows: npx is npx.cmd, needs shell resolution
-    });
+    const invocation = lighthouseInvocation(targetUrl, outputPath);
+    if (!invocation) {
+      return { available: false, reason: "npx is not available next to this Node.js" };
+    }
+    execFileSync(invocation.file, invocation.args, invocation.options);
 
     if (!fs.existsSync(outputPath)) {
       return { available: false, reason: "Lighthouse produced no output" };
@@ -437,7 +465,7 @@ async function callScannerApi(url) {
     });
   } catch { /* session read failed */ }
 
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { available: false, reason: "Not authenticated — run sl auth login" };
   }
 
@@ -445,14 +473,16 @@ async function callScannerApi(url) {
   const scanEndpoint = apiUrl + "/api/v1/scan/url";
 
   // Submit scan
-  const submitResponse = await fetchWithTimeout(scanEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": "Bearer " + session.token,
+  const submitResponse = await credentialedRequest(
+    session.credential,
+    scanEndpoint,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ url, scan_type: "lighthouse" }),
     },
-    body: JSON.stringify({ url, scan_type: "lighthouse" }),
-  }, 15000);
+    { fetchImpl: (target, init) => fetchWithTimeout(target, init, 15000) },
+  );
 
   if (!submitResponse.ok) {
     return { available: false, reason: "Scanner API returned " + submitResponse.status };
@@ -469,9 +499,9 @@ async function callScannerApi(url) {
   for (let attempt = 0; attempt < 30; attempt++) {
     await new Promise(r => setTimeout(r, 3000));
     try {
-      const pollResponse = await fetchWithTimeout(pollUrl, {
-        headers: { "Authorization": "Bearer " + session.token },
-      }, 10000);
+      const pollResponse = await credentialedRequest(session.credential, pollUrl, {}, {
+        fetchImpl: (target, init) => fetchWithTimeout(target, init, 10000),
+      });
       if (!pollResponse.ok) continue;
       const pollData = await pollResponse.json();
       if (pollData.status === "completed" || pollData.status === "complete") {

package/src/ai/aidenid.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 import { authLoginHint } from "../ui/command-hints.js";
+import { isAuthenticated } from "../auth/credential-destinations.js";
 
 export const DEFAULT_AIDENID_API_URL = "https://api.aidenid.com";
 
@@ -179,14 +180,14 @@ async function resolveSessionCredentialContext({
       env,
       autoRotate: false,
     });
-    if (activeSession && activeSession.token) {
+    if (isAuthenticated(activeSession)) {
       resolvedSession = activeSession;
     }
-    if (resolvedSession && resolvedSession.token && (!resolvedFetcher || activeSession?.token)) {
+    if (isAuthenticated(resolvedSession) && (!resolvedFetcher || isAuthenticated(activeSession))) {
       resolvedFetcher = () =>
         fetchAidenIdCredentials({
           apiUrl: resolvedSession.apiUrl || "https://api.sentinelayer.com",
-          token: resolvedSession.token,
+          auth: resolvedSession,
         });
     }
   } catch {
@@ -230,7 +231,7 @@ export async function resolveAidenIdCredentials(
   const activeSession = sessionContext.session;
   const activeFetchCredentials = sessionContext.fetchCredentials;
   const sessionAidenId = activeSession && activeSession.aidenid ? activeSession.aidenid : null;
-  const hasSessionToken = Boolean(String(activeSession && activeSession.token ? activeSession.token : "").trim());
+  const hasSessionToken = isAuthenticated(activeSession);
 
   let resolvedApiKey = String(apiKey || env.AIDENID_API_KEY || "").trim();
   let resolvedOrgId = String(orgId || env.AIDENID_ORG_ID || (sessionAidenId && sessionAidenId.orgId) || "").trim();

package/src/ai/proxy.js

@@ -8,6 +8,7 @@
  * Response: { content, usage: { model, provider, tokens_in, tokens_out, cost_usd, latency_ms } }
  */
 
+import { CredentialDestinationRefused, credentialedRequest, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { authLoginHint } from "../ui/command-hints.js";
 
@@ -318,7 +319,7 @@ function buildProxyError(status, parsed) {
  * @param {number} [options.maxTokens] - Max output tokens (default: 4096)
  * @param {number} [options.temperature] - Temperature (default: 0.1)
  * @param {string} [options.apiUrl] - Override API URL
- * @param {string} [options.token] - Override Bearer token
+ * @param {string} [options.token] - The user's token, if the caller holds it: bound to the configured API
  * @param {string} [options.sessionId] - Optional Senti session id for server-side usage metering
  * @param {string} [options.agentId] - Optional session agent id for server-side usage metering
  * @param {string} [options.action] - Optional metered action, defaults server-side when omitted
@@ -346,23 +347,24 @@ export async function invokeViaProxy({
   metadata = null,
   fetchImpl = fetch,
 } = {}) {
-  // Resolve credentials from session if not provided
+  // Resolve credentials from session if not provided. A passed token is bound to the configured
+  // API (src/auth/credential-destinations.js), so an apiUrl on any other origin is refused.
   let resolvedApiUrl = String(apiUrl || "").trim();
-  let resolvedToken = String(token || "").trim();
+  let credential = String(token || "").trim() ? await credentialFor({ token }) : null;
 
-  if (!resolvedApiUrl || !resolvedToken) {
+  if (!resolvedApiUrl || !credential) {
     const session = await resolveActiveAuthSession({
       cwd: process.cwd(),
       env: process.env,
       autoRotate: false,
     });
-    if (!session || !session.token) {
+    if (!isAuthenticated(session)) {
       throw new Error(
         `SentinelLayer LLM proxy requires authentication. Run '${authLoginHint()}' first.`
       );
     }
     if (!resolvedApiUrl) resolvedApiUrl = String(session.apiUrl || "https://api.sentinelayer.com").trim();
-    if (!resolvedToken) resolvedToken = String(session.token).trim();
+    if (!credential) credential = await credentialFor(session);
   }
 
   const url = `${resolvedApiUrl.replace(/\/+$/, "")}/api/v1/proxy/llm`;
@@ -393,7 +395,6 @@ export async function invokeViaProxy({
 
   const headers = {
     "Content-Type": "application/json",
-    Authorization: `Bearer ${resolvedToken}`,
     Accept: "application/json",
   };
   if (normalizedUsageIdempotencyKey) {
@@ -410,12 +411,12 @@ export async function invokeViaProxy({
       const controller = new AbortController();
       const timeoutHandle = setTimeout(() => controller.abort(), PROXY_TIMEOUT_MS);
       try {
-        response = await fetchImpl(url, {
-          method: "POST",
-          headers,
-          body,
-          signal: controller.signal,
-        });
+        response = await credentialedRequest(
+          credential,
+          url,
+          { method: "POST", headers, body, signal: controller.signal },
+          { fetchImpl },
+        );
       } finally {
         clearTimeout(timeoutHandle);
       }
@@ -436,7 +437,7 @@ export async function invokeViaProxy({
 
       throw buildProxyError(response.status, parsedError);
     } catch (err) {
-      if (err instanceof SentinelayerProxyError) {
+      if (err instanceof SentinelayerProxyError || err instanceof CredentialDestinationRefused) {
         throw err;
       }
       lastError = err;

package/src/audit/orchestrator.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { userCredential } from "../auth/credential-destinations.js";
 import { resolveOutputRoot } from "../config/service.js";
 import { createAgentEvent } from "../events/schema.js";
 import { resolveCodebaseIngest } from "../ingest/engine.js";
@@ -566,11 +567,12 @@ export async function runAuditOrchestrator({
   }
   const memoryProvider = resolveMemoryProvider(process.env);
   const memoryApiEndpoint = normalizeString(process.env.SENTINELAYER_MEMORY_API_ENDPOINT);
-  const memoryApiKey = normalizeString(
-    process.env.SENTINELAYER_MEMORY_API_KEY ||
-      process.env.SENTINELAYER_TOKEN ||
-      process.env.SENTINELAYER_API_TOKEN
-  );
+  // The memory service's own key, if configured; otherwise the user's token as a credential, which
+  // reaches the memory endpoint only if it is on the configured API's origin.
+  const memoryApiKey = normalizeString(process.env.SENTINELAYER_MEMORY_API_KEY);
+  const memoryCredential = memoryApiKey
+    ? null
+    : await userCredential(process.env.SENTINELAYER_TOKEN || process.env.SENTINELAYER_API_TOKEN, { source: "env" });
   const sharedMemoryCorpus = await buildSharedMemoryCorpus({
     outputRoot,
     targetPath: normalizedTargetPath,
@@ -628,6 +630,7 @@ export async function runAuditOrchestrator({
       provider: memoryProvider,
       apiEndpoint: memoryApiEndpoint,
       apiKey: memoryApiKey,
+      credential: memoryCredential,
     });
     sharedMemoryQueries.push({
       agentId: agent.id,

package/src/auth/admission-scope.js

@@ -8,11 +8,13 @@
 // from inside the scope, so no human-authenticated subrequest can hide behind a
 // scoped main request.
 //
-// It imports nothing from this codebase, so the auth service can depend on it
-// without an import cycle.
+// It imports only the credential module, so the auth service can depend on it without an
+// import cycle.
 
 import { AsyncLocalStorage } from "node:async_hooks";
 
+import { admissionCredential } from "./credential-destinations.js";
+
 export const admittedAgentScope = new AsyncLocalStorage();
 
 /**
@@ -26,7 +28,7 @@ export function scopedAdmissionAuth() {
   if (!(credential.expiresAt * 1000 > Date.now())) return null;
   return {
     apiUrl: credential.apiUrl,
-    token: credential.token,
+    credential: admissionCredential(credential), // bound to the API that issued it; its token stays inside
     source: "session_admission",
     user: null,
     admissionId: credential.admissionId,