sentinelayer-cli 0.44.0 → 0.45.0

package/src/auth/gate.js

@@ -7,6 +7,7 @@ import pc from "picocolors";
 import { resolveActiveAuthSession } from "./service.js";
 import { resolveAgentAdmissionTarget } from "../session/admission-auth.js";
 import { authLoginHint } from "../ui/command-hints.js";
+import { isAuthenticated } from "./credential-destinations.js";
 
 /**
  * Auth gate — ensures user is logged in before running any command.
@@ -316,12 +317,11 @@ function isSessionUnexpired(tokenExpiresAt) {
 // without fixing anything.
 //
 // So the gate checks:
-//   - session.token is present and non-empty
+//   - the session carries a credential
 //   - for source === "session", expiry is in the future
 //   - for source === "env" or "config", the downstream API call is the gate
 function isAuthenticatedSessionValid(session) {
-  const token = String(session?.token || "").trim();
-  if (!token) {
+  if (!isAuthenticated(session)) {
     return false;
   }
   if (String(session?.source || "").trim() === "session") {
@@ -369,7 +369,7 @@ export async function checkAuthGate(args) {
     }
     if (session) {
       // Session resolved but failed validation (empty token or expired).
-      const tokenPresent = Boolean(String(session?.token || "").trim());
+      const tokenPresent = isAuthenticated(session);
       if (!tokenPresent) {
         resolveError = "session_token_missing";
       } else if (String(session?.source || "").trim() === "session" && !isSessionUnexpired(session?.tokenExpiresAt)) {

package/src/auth/http.js

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { installTestEgressGuard } from "../net/test-egress-guard.js";
+import { CredentialDestinationRefused, credentialedRequest, isCredential } from "./credential-destinations.js";
 
 // No-op outside tests; see src/net/test-egress-guard.js.
 installTestEgressGuard();
@@ -20,7 +21,10 @@ export const CIRCUIT_BREAKER_THRESHOLD = 5;
 export const CIRCUIT_BREAKER_COOLDOWN_MS = 30_000;
 
 const RETRYABLE_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
-const CIRCUIT_TRACK_STATUS_CODES = new Set([401, 403, 408, 425, 429, 500, 502, 503, 504]);
+// 401 and 403 are not tracked: they refuse one credential (for example an expired or
+// revoked agent admission) and say nothing about the origin's health, so they must not
+// open the per-origin breaker for every other credential on this machine.
+const CIRCUIT_TRACK_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
 const circuitStateByScope = new Map();
 
 // File-backed cache. Lets cooldown + failure counts survive across CLI
@@ -422,7 +426,8 @@ export function __resetRequestCircuitForTests(scope) {
  *   maxRetries?: number,
  *   retryDelayMs?: number
  *   allowEmptyBody?: boolean
- * }} [options]
+ *   credential?: object
+ * }} [options] `credential` (src/auth/credential-destinations.js) is sent with credentialedRequest.
  * @returns {Promise<any>}
  */
 export async function requestJson(
@@ -430,6 +435,7 @@ export async function requestJson(
   {
     method = "GET",
     headers = {},
+    credential = null,
     body,
     idempotencyKey = null,
     allowNonIdempotent = false,
@@ -439,6 +445,13 @@ export async function requestJson(
     allowEmptyBody = false,
   } = {}
 ) {
+  if (credential && !isCredential(credential)) {
+    throw new TypeError("requestJson: credential must come from src/auth/credential-destinations.js.");
+  }
+  // Without a credential, nothing here attaches one: a caller-built Authorization header is refused.
+  if (Object.keys(headers || {}).some((name) => /^(?:proxy-)?authorization$/i.test(name))) {
+    throw new TypeError("requestJson: send a credential with { credential }, not an Authorization header.");
+  }
   const normalizedMethod = String(method || "GET").trim().toUpperCase();
   const explicitIdempotencyKey = String(idempotencyKey || "").trim() || null;
   const existingIdempotencyKey = explicitIdempotencyKey || resolveIdempotencyKey(headers);
@@ -492,13 +505,14 @@ export async function requestJson(
     }, normalizedTimeoutMs);
 
     try {
-      const response = await fetch(String(url), {
+      const init = {
         method: normalizedMethod,
         headers: outgoingHeaders,
         body: body === undefined ? undefined : JSON.stringify(body),
         redirect: "error",
         signal: controller.signal,
-      });
+      };
+      const response = credential ? await credentialedRequest(credential, url, init) : await fetch(String(url), init);
 
       const rawBody = await response.text();
       const trimmedBody = rawBody.trim();
@@ -575,7 +589,8 @@ export async function requestJson(
       await sleep(delayMs);
       continue;
     } catch (error) {
-      if (error instanceof SentinelayerApiError) {
+      // A refused destination is final: nothing was sent, so no retry and no breaker count.
+      if (error instanceof SentinelayerApiError || error instanceof CredentialDestinationRefused) {
         throw error;
       }
 
@@ -647,6 +662,7 @@ export async function requestJsonMutation(
   {
     method = "POST",
     headers = {},
+    credential = null,
     body,
     idempotencyKey = null,
     operationName,
@@ -675,6 +691,7 @@ export async function requestJsonMutation(
   return requestJson(url, {
     method: normalizedMethod,
     headers,
+    credential,
     body,
     idempotencyKey: resolvedIdempotencyKey,
     timeoutMs,

package/src/auth/service.js

@@ -6,6 +6,14 @@ import open from "open";
 
 import { loadConfig } from "../config/service.js";
 import { scopedAdmissionAuth } from "./admission-scope.js";
+import {
+  DEFAULT_API_URL,
+  assertTrustedApiUrl,
+  credentialFor,
+  isAuthenticated,
+  resolveTrustContext,
+  userCredential,
+} from "./credential-destinations.js";
 import { SentinelayerApiError, requestJson, requestJsonMutation } from "./http.js";
 import {
   clearStoredSession,
@@ -15,7 +23,6 @@ import {
 } from "./session-store.js";
 import { authLoginHint } from "../ui/command-hints.js";
 
-const DEFAULT_API_URL = "https://api.sentinelayer.com";
 /** Default maximum wall-clock wait for browser-based CLI auth approval (ms). */
 export const DEFAULT_AUTH_TIMEOUT_MS = 10 * 60 * 1000;
 /** Default lifetime for issued API tokens used by CLI sessions (days). */
@@ -57,12 +64,6 @@ function normalizePositiveNumber(rawValue, field, fallbackValue) {
   return normalized;
 }
 
-function toAuthHeader(token) {
-  return {
-    Authorization: `Bearer ${String(token || "").trim()}`,
-  };
-}
-
 function normalizeUser(user = {}) {
   return {
     id: String(user.id || "").trim(),
@@ -171,7 +172,6 @@ function isNearExpiry(tokenExpiresAt, thresholdDays) {
  * @returns {Promise<string>}
  */
 export async function resolveApiUrl({
-  cwd = process.cwd(),
   env = process.env,
   explicitApiUrl = "",
   homeDir,
@@ -180,19 +180,9 @@ export async function resolveApiUrl({
   if (overrideUrl) {
     return normalizeApiUrl(overrideUrl);
   }
-
-  const envUrl = String(env.SENTINELAYER_API_URL || "").trim();
-  if (envUrl) {
-    return normalizeApiUrl(envUrl);
-  }
-
-  const config = await loadConfig({ cwd, env, homeDir });
-  const configuredApiUrl = String(config.resolved.apiUrl || "").trim();
-  if (configuredApiUrl) {
-    return normalizeApiUrl(configuredApiUrl);
-  }
-
-  return normalizeApiUrl(DEFAULT_API_URL);
+  // The trust context's API (SENTINELAYER_API_URL, else the global config, else the default). A
+  // workspace .sentinelayer.yml does not choose the API.
+  return normalizeApiUrl((await resolveTrustContext({ env, homeDir })).apiOrigin);
 }
 
 async function startCliAuthSession({ apiUrl, challenge, ide, cliVersion, flowRequestId }) {
@@ -379,20 +369,21 @@ async function pollCliAuthSession({
   });
 }
 
-async function fetchCurrentUser({ apiUrl, token, flowRequestId }) {
+async function fetchCurrentUser({ apiUrl, credential, flowRequestId }) {
   return requestAuthJson(
     flowRequestId,
     buildApiPath(apiUrl, "/api/v1/auth/me"),
     {
       method: "GET",
-      headers: withFlowRequestHeaders(toAuthHeader(token), flowRequestId),
+      credential,
+      headers: withFlowRequestHeaders({}, flowRequestId),
     }
   );
 }
 
 async function issueApiToken({
   apiUrl,
-  authToken,
+  credential,
   tokenLabel,
   tokenTtlDays,
   flowRequestId,
@@ -406,12 +397,8 @@ async function issueApiToken({
     {
       method: "POST",
       operationName: "issue-token",
-      headers: withFlowRequestHeaders(
-        {
-          ...toAuthHeader(authToken),
-        },
-        flowRequestId
-      ),
+      credential,
+      headers: withFlowRequestHeaders({}, flowRequestId),
       body: {
         label: String(tokenLabel || "").trim() || defaultTokenLabel(),
         scope: "cli",
@@ -422,7 +409,7 @@ async function issueApiToken({
   );
 }
 
-async function revokeApiToken({ apiUrl, authToken, tokenId }) {
+async function revokeApiToken({ apiUrl, credential, tokenId }) {
   const normalizedTokenId = String(tokenId || "").trim();
   if (!normalizedTokenId) {
     return false;
@@ -430,9 +417,7 @@ async function revokeApiToken({ apiUrl, authToken, tokenId }) {
   await requestJsonMutation(buildApiPath(apiUrl, `/api/v1/auth/api-tokens/${encodeURIComponent(normalizedTokenId)}`), {
     method: "DELETE",
     operationName: "revoke-token",
-    headers: {
-      ...toAuthHeader(authToken),
-    },
+    credential,
   });
   return true;
 }
@@ -443,6 +428,7 @@ async function rotateStoredApiTokenIfNeeded({
   tokenLabel,
   tokenTtlDays,
   homeDir,
+  context,
 }) {
   if (!session || !session.token || !session.tokenExpiresAt) {
     return { session, rotated: false };
@@ -453,7 +439,7 @@ async function rotateStoredApiTokenIfNeeded({
 
   const issued = await issueApiToken({
     apiUrl: session.apiUrl,
-    authToken: session.token,
+    credential: await userCredential(session.token, { context, source: "session" }),
     tokenLabel,
     tokenTtlDays,
   });
@@ -475,7 +461,7 @@ async function rotateStoredApiTokenIfNeeded({
     try {
       await revokeApiToken({
         apiUrl: session.apiUrl,
-        authToken: nextSession.token,
+        credential: await userCredential(nextSession.token, { context, source: "session" }),
         tokenId: session.tokenId,
       });
     } catch (error) {
@@ -536,6 +522,10 @@ export async function loginAndPersistSession({
   homeDir,
 } = {}) {
   const apiUrl = await resolveApiUrl({ cwd, env, explicitApiUrl, homeDir });
+  // The token this flow issues is the user's, so the API that issues it must be the configured
+  // one: refuse any other before the browser step. Resolution and trust share env and homeDir.
+  const context = await resolveTrustContext({ env, homeDir });
+  await assertTrustedApiUrl(apiUrl, { context });
   const challenge = generateChallenge();
   const flowRequestId = createFlowRequestId();
   const session = await startCliAuthSession({
@@ -574,13 +564,14 @@ export async function loginAndPersistSession({
       requestId: flowRequestId || null,
     });
   }
+  const approvalCredential = await userCredential(approvalToken, { context, source: "login_approval" });
 
   const user = normalizeUser(
-    approval.user || (await fetchCurrentUser({ apiUrl, token: approvalToken, flowRequestId }))
+    approval.user || (await fetchCurrentUser({ apiUrl, credential: approvalCredential, flowRequestId }))
   );
   const issuedApiToken = await issueApiToken({
     apiUrl,
-    authToken: approvalToken,
+    credential: approvalCredential,
     tokenLabel,
     tokenTtlDays,
     flowRequestId,
@@ -641,7 +632,7 @@ export async function loginAndPersistSession({
  * }} [options]
  * @returns {Promise<null | {
  *   apiUrl: string,
- *   token: string,
+ *   credential: object,
  *   source: "env" | "config" | "session",
  *   user: {
  *     id: string,
@@ -674,12 +665,15 @@ export async function resolveActiveAuthSession({
   if (scoped !== undefined) return scoped;
 
   const apiUrl = await resolveApiUrl({ cwd, env, explicitApiUrl, homeDir });
+  // Each token below is bound to the configured API by the one trust context; `apiUrl` may name
+  // another origin (--api-url, a project config), and then a request carrying it is refused.
+  const context = await resolveTrustContext({ env, homeDir });
 
   const envToken = String(env.SENTINELAYER_TOKEN || "").trim();
   if (envToken) {
     return {
       apiUrl,
-      token: envToken,
+      credential: await userCredential(envToken, { context, source: "env" }),
       source: "env",
       user: null,
       aidenid: null,
@@ -692,12 +686,13 @@ export async function resolveActiveAuthSession({
     };
   }
 
+  // The user's own config only: a workspace .sentinelayer.yml does not choose whose token is used.
   const config = await loadConfig({ cwd, env, homeDir });
-  const configuredToken = String(config.resolved.sentinelayerToken || "").trim();
+  const configuredToken = String(config.layers.global.sentinelayerToken || "").trim();
   if (configuredToken) {
     return {
       apiUrl,
-      token: configuredToken,
+      credential: await userCredential(configuredToken, { context, source: "config" }),
       source: "config",
       user: null,
       aidenid: null,
@@ -725,6 +720,7 @@ export async function resolveActiveAuthSession({
         tokenLabel,
         tokenTtlDays,
         homeDir,
+        context,
       });
       active = rotateResult.session;
       rotated = rotateResult.rotated;
@@ -743,7 +739,7 @@ export async function resolveActiveAuthSession({
 
   return {
     apiUrl,
-    token: active.token,
+    credential: await userCredential(active.token, { context, source: "session" }),
     source: "session",
     user: normalizeUser(active.user || {}),
     aidenid: active.aidenid || null,
@@ -829,7 +825,7 @@ export async function getAuthStatus({
   let remoteError = null;
   if (checkRemote) {
     try {
-      remoteUser = normalizeUser(await fetchCurrentUser({ apiUrl: session.apiUrl, token: session.token }));
+      remoteUser = normalizeUser(await fetchCurrentUser({ apiUrl: session.apiUrl, credential: session.credential }));
     } catch (error) {
       remoteError =
         error instanceof SentinelayerApiError
@@ -938,7 +934,7 @@ export async function revokeAuthToken({
     autoRotate: false,
     homeDir,
   });
-  if (!active || !active.token) {
+  if (!isAuthenticated(active)) {
     throw new SentinelayerApiError(`No active auth token found. Run \`${authLoginHint()}\` first.`, {
       status: 401,
       code: "AUTH_REQUIRED",
@@ -954,7 +950,7 @@ export async function revokeAuthToken({
 
   await revokeApiToken({
     apiUrl: active.apiUrl,
-    authToken: active.token,
+    credential: active.credential,
     tokenId: targetTokenId,
   });
 
@@ -1020,7 +1016,7 @@ export async function logoutSession({
     try {
       await revokeApiToken({
         apiUrl: await resolveApiUrl({ cwd, env, explicitApiUrl, homeDir }),
-        authToken: stored.token,
+        credential: await userCredential(stored.token, { env, homeDir, source: "session" }),
         tokenId: stored.tokenId,
       });
       revokedRemote = true;
@@ -1043,15 +1039,15 @@ export async function logoutSession({
  *
  * @param {{
  *   apiUrl: string,
- *   authToken: string,
+ *   credential: object,
  *   runId: string,
  *   afterEventId?: string | null
- * }} [options]
+ * }} [options] credential: the resolved auth's `credential` (src/auth/credential-destinations.js)
  * @returns {Promise<any>}
  */
 export async function listRuntimeRunEvents({
   apiUrl,
-  authToken,
+  credential,
   runId,
   afterEventId = null,
 } = {}) {
@@ -1062,7 +1058,7 @@ export async function listRuntimeRunEvents({
     buildApiPath(apiUrl, `/api/v1/runtime/runs/${encodeURIComponent(String(runId || ""))}/events/list${query}`),
     {
       method: "GET",
-      headers: toAuthHeader(authToken),
+      credential,
     }
   );
 }
@@ -1070,7 +1066,7 @@ export async function listRuntimeRunEvents({
 /**
  * Fetch runtime run status snapshot from the Sentinelayer API.
  *
- * @param {{ apiUrl: string, authToken: string, runId: string }} [options]
+ * @param {{ apiUrl: string, credential: object, runId: string }} [options]
  * @returns {Promise<any>}
  */
 /**
@@ -1079,13 +1075,13 @@ export async function listRuntimeRunEvents({
  */
 export async function fetchAidenIdCredentials({
   apiUrl = DEFAULT_API_URL,
-  token = "",
+  auth = null,
 } = {}) {
   const response = await requestJson(
     buildApiPath(apiUrl, "/api/v1/aidenid/credentials"),
     {
       method: "GET",
-      headers: toAuthHeader(token),
+      credential: await credentialFor(auth),
     }
   );
   return {
@@ -1099,14 +1095,14 @@ export async function fetchAidenIdCredentials({
 
 export async function getRuntimeRunStatus({
   apiUrl,
-  authToken,
+  credential,
   runId,
 } = {}) {
   return requestJson(
     buildApiPath(apiUrl, `/api/v1/runtime/runs/${encodeURIComponent(String(runId || ""))}/status`),
     {
       method: "GET",
-      headers: toAuthHeader(authToken),
+      credential,
     }
   );
 }

package/src/cli.js

@@ -242,6 +242,11 @@ export async function buildCliProgram({
 }
 
 export async function runCli(rawArgs = process.argv.slice(2)) {
+  // Where the user's credentials may go is decided once, here, from the real environment and the
+  // global config, and frozen: nothing that changes process.env later can move it.
+  const { freezeProcessTrustContext } = await import("./auth/credential-destinations.js");
+  await freezeProcessTrustContext();
+
   // Normalize slash commands (/omargate → omargate, /audit → audit, etc.)
   const normalizedArgs = normalizeSlashArgs(rawArgs);
 
@@ -269,15 +274,18 @@ export async function runCli(rawArgs = process.argv.slice(2)) {
   // the subcommand (say, post-agent, observe, locks, checkpoints, ...), so no
   // subcommand, present or future, can reach the human token. A tombstoned
   // admission refuses here, before any request.
-  const { assertDispatchMatchesScope, resolveAgentAdmissionTarget, withAgentAdmission } = await import(
-    "./session/admission-auth.js"
-  );
+  const { assertDispatchMatchesScope, resolveAgentAdmissionTarget, withAgentAdmission } =
+    await import("./session/admission-auth.js");
   const target = await resolveAgentAdmissionTarget(normalizedArgs);
-  // Execution must match authorization: before ANY action runs, re-derive the identity
-  // from Commander's resolved options and compare it with the scope in force.
+  // Execution must match authorization: before ANY action runs, decide on Commander's parsed
+  // arguments and options -- the values the action will use. Through the MCP CLI bridge in an
+  // agent context the action binds to its session's admission, runs a legacy data-plane route
+  // as before, or is refused (src/session/route-classes.js); and the identity it resolves must
+  // be the one whose scope is in force.
   program.hook("preAction", (_hooked, actionCommand) => assertDispatchMatchesScope(actionCommand));
   if (target) {
-    await withAgentAdmission(target.sessionId, target.agentId, dispatch);
+    // An admission seen above that is gone by the time it is read refuses: never a fallback.
+    await withAgentAdmission(target.sessionId, target.agentId, dispatch, { requireStored: true });
     return;
   }
   await dispatch();

package/src/commands/ai/provision-governance.js

@@ -25,8 +25,7 @@ import {
 import { listSites, recordTemporarySite } from "../../ai/site-store.js";
 import { getIdentityById, recordProvisionedIdentity } from "../../ai/identity-store.js";
 import { resolveOutputRoot } from "../../config/service.js";
-import { readStoredSession } from "../../auth/session-store.js";
-import { fetchAidenIdCredentials } from "../../auth/service.js";
+import { fetchAidenIdCredentials, resolveActiveAuthSession } from "../../auth/service.js";
 import {
   buildCurlPreview,
   normalizeIdempotencyKey,
@@ -37,6 +36,7 @@ import {
   stableTimestampForFile,
   writeArtifact,
 } from "./shared.js";
+import { isAuthenticated } from "../../auth/credential-destinations.js";
 
 function addProvisionEmailOptions(cmd) {
   return cmd
@@ -92,12 +92,13 @@ async function provisionEmailAction(options, command) {
       payload,
     });
 
-    let session = null;
-    try { session = await readStoredSession(); } catch { /* no session */ }
+    const session = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
+      () => null,
+    );
 
     const makeFetcher = () => {
-      if (!session || !session.token) return null;
-      return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, token: session.token });
+      if (!isAuthenticated(session)) return null;
+      return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, auth: session });
     };
 
     const resolvedCredentials = await resolveAidenIdCredentials({

package/src/commands/init.js

@@ -1,25 +1,26 @@
 import process from "node:process";
 
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 
-function applyConfigEnvDefaults(resolvedConfig) {
-  if (!process.env.SENTINELAYER_API_URL && resolvedConfig.apiUrl) {
-    process.env.SENTINELAYER_API_URL = resolvedConfig.apiUrl;
-  }
+// Config values the scaffold flow reads from the environment. The API it talks to and the token
+// it sends are never set here: they come from the trust context and the auth service
+// (src/auth/credential-destinations.js), so a workspace .sentinelayer.yml cannot choose them,
+// and child processes inherit neither.
+// Provider keys come from the user's own config (global, or the environment), never the workspace.
+function applyConfigEnvDefaults(config) {
+  const resolvedConfig = config.resolved;
+  const userValues = userConfigValues(config);
   if (!process.env.SENTINELAYER_WEB_URL && resolvedConfig.webUrl) {
-    process.env.SENTINELAYER_WEB_URL = resolvedConfig.webUrl;
-  }
-  if (!process.env.SENTINELAYER_TOKEN && resolvedConfig.sentinelayerToken) {
-    process.env.SENTINELAYER_TOKEN = resolvedConfig.sentinelayerToken;
+    process.env.SENTINELAYER_WEB_URL = resolvedConfig.webUrl; // printed as a link only
   }
-  if (!process.env.OPENAI_API_KEY && resolvedConfig.openaiApiKey) {
-    process.env.OPENAI_API_KEY = resolvedConfig.openaiApiKey;
+  if (!process.env.OPENAI_API_KEY && userValues.openaiApiKey) {
+    process.env.OPENAI_API_KEY = userValues.openaiApiKey;
   }
-  if (!process.env.ANTHROPIC_API_KEY && resolvedConfig.anthropicApiKey) {
-    process.env.ANTHROPIC_API_KEY = resolvedConfig.anthropicApiKey;
+  if (!process.env.ANTHROPIC_API_KEY && userValues.anthropicApiKey) {
+    process.env.ANTHROPIC_API_KEY = userValues.anthropicApiKey;
   }
-  if (!process.env.GOOGLE_API_KEY && resolvedConfig.googleApiKey) {
-    process.env.GOOGLE_API_KEY = resolvedConfig.googleApiKey;
+  if (!process.env.GOOGLE_API_KEY && userValues.googleApiKey) {
+    process.env.GOOGLE_API_KEY = userValues.googleApiKey;
   }
 }
 
@@ -30,9 +31,11 @@ export function registerInitCommand(program, invokeLegacy) {
     .option("--non-interactive", "Disable prompts and require interview payload")
     .option("--interview-file <path>", "Load interview JSON from file")
     .option("--skip-browser-open", "Do not auto-open browser during auth")
+    .option("--inject-secret", "Set the project token as a GitHub Actions secret on this directory's git remote")
+    .option("--inject-openai-key", "Also set OPENAI_API_KEY from your environment as a GitHub Actions secret there")
     .action(async (projectName, options) => {
       const config = await loadConfig();
-      applyConfigEnvDefaults(config.resolved);
+      applyConfigEnvDefaults(config);
 
       const legacyArgs = [];
       const normalizedProjectName = String(projectName || "").trim();
@@ -49,6 +52,12 @@ export function registerInitCommand(program, invokeLegacy) {
       if (options.skipBrowserOpen) {
         legacyArgs.push("--skip-browser-open");
       }
+      if (options.injectSecret) {
+        legacyArgs.push("--inject-secret");
+      }
+      if (options.injectOpenaiKey) {
+        legacyArgs.push("--inject-openai-key");
+      }
 
       await invokeLegacy(legacyArgs);
     });

package/src/commands/scan.js

@@ -12,7 +12,7 @@ import {
   resolveProvider,
 } from "../ai/client.js";
 import { recordCliLlmSessionUsage, usageNumber } from "../billing/llm-session-usage.js";
-import { loadConfig, resolveOutputRoot } from "../config/service.js";
+import { loadConfig, resolveOutputRoot, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateModelCost } from "../cost/tracker.js";
@@ -34,6 +34,7 @@ import { detectRepoSlug, setupSecrets } from "../scan/gh-secrets.js";
 import { appendRunEvent, deriveStopClassFromBudget } from "../telemetry/ledger.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { authLoginHint } from "../ui/command-hints.js";
+import { exportCredentialToken, isAuthenticated } from "../auth/credential-destinations.js";
 
 const LEGACY_SCAN_WORKFLOW_PATH = ".github/workflows/security-review.yml";
 
@@ -578,7 +579,7 @@ export function registerScanCommand(program) {
         configModel: config.resolved.defaultModelId,
       });
       const explicitApiKey = String(options.apiKey || "").trim();
-      const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+      const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
       const prompt = buildAiPreScanPrompt({
         targetPath,
@@ -856,8 +857,9 @@ export function registerScanCommand(program) {
           env: process.env,
           autoRotate: false,
         });
-        if (session && session.token) {
-          tokenValue = session.token;
+        if (isAuthenticated(session)) {
+          // the one reviewed export of the token: to a GitHub Actions secret, through gh
+          tokenValue = exportCredentialToken(session.credential, { purpose: "github-actions-secret" });
         }
       } catch {
         /* no active auth session */