sentinelayer-cli 0.44.0 → 0.45.0

package/src/legacy-cli.js

@@ -20,6 +20,12 @@ import {
   listSupportedCodingAgents,
   resolveCodingAgent,
 } from "./config/agent-dictionary.js";
+import {
+  CredentialDestinationRefused,
+  credentialedRequest,
+  resolveTrustContext,
+  userCredential,
+} from "./auth/credential-destinations.js";
 import { resolveOutputRoot } from "./config/service.js";
 import { normalizeAgentEvent } from "./events/schema.js";
 import { collectCodebaseIngest, formatIngestSummary } from "./ingest/engine.js";
@@ -143,6 +149,8 @@ function parseCliArgs(argv) {
   let interviewFile = "";
   let nonInteractive = boolFromEnv(process.env.SENTINELAYER_CLI_NON_INTERACTIVE);
   let skipBrowserOpen = boolFromEnv(process.env.SENTINELAYER_CLI_SKIP_BROWSER_OPEN);
+  let injectSecret = false;
+  let injectOpenAiKey = false;
   let showHelp = false;
   let showVersion = false;
 
@@ -165,6 +173,14 @@ function parseCliArgs(argv) {
       skipBrowserOpen = true;
       continue;
     }
+    if (arg === "--inject-secret") {
+      injectSecret = true;
+      continue;
+    }
+    if (arg === "--inject-openai-key") {
+      injectOpenAiKey = true;
+      continue;
+    }
     if (arg === "--interview-file") {
       const next = String(argv[i + 1] || "").trim();
       if (!next) {
@@ -189,6 +205,8 @@ function parseCliArgs(argv) {
     interviewFile,
     nonInteractive,
     skipBrowserOpen,
+    injectSecret,
+    injectOpenAiKey,
     showHelp,
     showVersion,
   };
@@ -290,6 +308,8 @@ function printUsage() {
   console.log("  --json                 Machine-readable JSON output");
   console.log("  --path PATH            Target workspace path");
   console.log("  --non-interactive      Disable prompts (require --interview-file)");
+  console.log("  --inject-secret        init: set the project token as a GitHub Actions secret on this directory's git remote");
+  console.log("  --inject-openai-key    init: also set OPENAI_API_KEY from your environment as a secret there");
   console.log("");
   console.log("Quickstart:");
   console.log("  sl auth login && npx create-sentinelayer my-app && cd my-app");
@@ -450,11 +470,18 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-async function requestJson(url, { method = "GET", headers = {}, body, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS } = {}) {
+async function requestJson(
+  url,
+  { method = "GET", headers = {}, body, credential = null, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS } = {},
+) {
+  // Without a credential, nothing here attaches one: a caller-built Authorization header is refused.
+  if (Object.keys(headers || {}).some((name) => /^(?:proxy-)?authorization$/i.test(name))) {
+    throw new TypeError("requestJson: send a credential with { credential }, not an Authorization header.");
+  }
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetch(url, {
+    const init = {
       method,
       headers: {
         "Content-Type": "application/json",
@@ -462,7 +489,9 @@ async function requestJson(url, { method = "GET", headers = {}, body, timeoutMs
       },
       body: body === undefined ? undefined : JSON.stringify(body),
       signal: controller.signal,
-    });
+    };
+    // A credential (src/auth/credential-destinations.js) goes only to its own origin.
+    const response = credential ? await credentialedRequest(credential, url, init) : await fetch(url, init);
 
     const text = await response.text();
     let payload = null;
@@ -491,7 +520,7 @@ async function requestJson(url, { method = "GET", headers = {}, body, timeoutMs
     }
     return payload;
   } catch (error) {
-    if (error instanceof SentinelayerApiError) {
+    if (error instanceof SentinelayerApiError || error instanceof CredentialDestinationRefused) {
       throw error;
     }
     if (error instanceof Error && error.name === "AbortError") {
@@ -551,26 +580,25 @@ async function pollCliSession({
   });
 }
 
-async function generateArtifacts({ apiUrl, authToken, payload }) {
+async function generateArtifacts({ apiUrl, credential, payload }) {
   return requestJson(`${apiUrl}/api/v1/builder/generate`, {
     method: "POST",
-    headers: {
-      Authorization: `Bearer ${authToken}`,
-    },
+    credential,
     body: payload,
     timeoutMs: 180_000,
   });
 }
 
-async function issueBootstrapToken({ apiUrl, authToken }) {
+async function issueBootstrapToken({ apiUrl, credential }) {
   return requestJson(`${apiUrl}/api/v1/builder/bootstrap-token`, {
     method: "POST",
-    headers: {
-      Authorization: `Bearer ${authToken}`,
-    },
+    credential,
   });
 }
 
+// The init flow's credential steps, for tests.
+export const __legacyCredentialFlowForTests = Object.freeze({ pollCliSession, generateArtifacts, issueBootstrapToken, requestJson });
+
 function detectRepoSlug(cwd) {
   const gitRemote = spawnSync("git", ["config", "--get", "remote.origin.url"], {
     cwd,
@@ -2748,6 +2776,35 @@ Continue autonomously unless blocked by missing credentials or permissions.`,
   };
 }
 
+// The repository that receives GitHub Actions secrets is shown, and gh must confirm that the
+// signed-in user can write to it.
+function confirmSecretsRepository(repoSlug) {
+  printInfo(`GitHub Actions secrets target: ${repoSlug} (the git remote of ${process.cwd()})`);
+  if (!isValidRepoSlug(repoSlug)) {
+    return { ok: false, reason: "Invalid repo format. Use owner/repo." };
+  }
+  const ghCommand = getGhCommand();
+  try {
+    ensureGhCliAvailable(ghCommand);
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  const view = spawnSync(ghCommand, ["api", `repos/${repoSlug}`], { encoding: "utf-8" });
+  if (view.status !== 0) {
+    return { ok: false, reason: `gh could not read ${repoSlug}: ${String(view.stderr || view.stdout || "").trim()}` };
+  }
+  let permissions = {};
+  try {
+    permissions = JSON.parse(String(view.stdout || "{}")).permissions || {};
+  } catch {
+    // unreadable output: not confirmed
+  }
+  if (!(permissions.admin || permissions.maintain || permissions.push)) {
+    return { ok: false, reason: `the signed-in gh user cannot write to ${repoSlug}.` };
+  }
+  return { ok: true };
+}
+
 function runGhSecretSet({ repoSlug, secretName, secretValue }) {
   const normalizedRepo = normalizeRepoSlug(repoSlug);
   const ghCommand = getGhCommand();
@@ -3097,8 +3154,10 @@ async function collectInterview({ initialProjectName, detectedRepo, detectedCodi
           {
             type: base.authMode === "sentinelayer" ? "toggle" : null,
             name: "injectSecret",
-            message: "Inject SENTINELAYER_TOKEN into GitHub Actions secrets now?",
-            initial: true,
+            message: `Set the project token as a GitHub Actions secret on this directory's git remote${
+              detectedRepo ? ` (${detectedRepo})` : ""
+            }?`,
+            initial: false,
             active: "yes",
             inactive: "no",
           },
@@ -3192,6 +3251,9 @@ function printInfo(message) {
 
 export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
   refreshRuntimeDefaults();
+  // The API this flow talks to is the trust context's (environment, then global config): the token
+  // it is issued may only be sent there, and a workspace .sentinelayer.yml does not choose it.
+  DEFAULT_API_URL = (await resolveTrustContext()).apiOrigin;
   const commandExitCode = await tryRunLocalCommandMode(rawArgs);
   if (commandExitCode !== null) {
     if (commandExitCode !== 0) {
@@ -3243,6 +3305,15 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
     );
   }
   validateInterviewInput(interview);
+  const secretsOptIn = {
+    projectToken: Boolean(args.injectSecret || interview.injectSecret),
+    openAiKey: Boolean(args.injectOpenAiKey),
+  };
+  if ((secretsOptIn.projectToken || secretsOptIn.openAiKey) && process.env.SENTINELAYER_MCP_BRIDGE === "1") {
+    throw new Error(
+      "GitHub Actions secrets are not set through the MCP bridge. Run `sl init --inject-secret` in your own terminal."
+    );
+  }
 
   const workspace = await resolveProjectDirectory({
     cwd: process.cwd(),
@@ -3264,7 +3335,7 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
   }
 
   const requestedAuthMode = interview.authMode === "byok" ? "byok" : "sentinelayer";
-  let authToken = "";
+  let authCredential = null;
 
   printSection("Authentication");
   if (requestedAuthMode === "byok") {
@@ -3304,8 +3375,8 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       timeoutMs: DEFAULT_AUTH_TIMEOUT_MS,
     });
 
-    authToken = String(approval.auth_token || "").trim();
-    if (!authToken) {
+    authCredential = await userCredential(approval.auth_token, { source: "init_approval" });
+    if (!authCredential) {
       throw new Error("Authentication completed but no auth token was returned.");
     }
   }
@@ -3343,7 +3414,7 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
   } else {
     generated = await generateArtifacts({
       apiUrl: DEFAULT_API_URL,
-      authToken,
+      credential: authCredential,
       payload: generatePayload,
     });
 
@@ -3352,7 +3423,7 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       try {
         bootstrapToken = await issueBootstrapToken({
           apiUrl: DEFAULT_API_URL,
-          authToken,
+          credential: authCredential,
         });
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -3538,24 +3609,30 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
     repoSlug: interview.connectRepo ? interview.repoSlug : "",
   });
 
-  const repoSlugForSecrets = normalizeRepoSlug(interview.repoSlug || detectRepoSlug(projectDir) || "");
-  const openAiApiKey = String(process.env.OPENAI_API_KEY || "").trim();
+  // GitHub Actions secrets are set only on an explicit opt-in (--inject-secret, or injectSecret in
+  // the interview, outside the MCP bridge), only on this directory's own git remote (never a slug
+  // from the interview), and only after gh confirms the signed-in user can write to it.
+  // OPENAI_API_KEY is set only with its own --inject-openai-key.
   const secretTargets = [];
-  if (sentinelayerToken) {
+  if (sentinelayerToken && secretsOptIn.projectToken) {
     secretTargets.push({
       secretName,
       secretValue: sentinelayerToken,
       placeholder: "<sentinelayer-token>",
     });
   }
-  secretTargets.push({
-    secretName: "OPENAI_API_KEY",
-    secretValue: openAiApiKey,
-    placeholder: "<your-openai-api-key>",
-  });
+  if (secretsOptIn.openAiKey) {
+    secretTargets.push({
+      secretName: "OPENAI_API_KEY",
+      secretValue: String(process.env.OPENAI_API_KEY || "").trim(),
+      placeholder: "<your-openai-api-key>",
+    });
+  }
+  const repoSlugForSecrets = secretTargets.length > 0 ? normalizeRepoSlug(detectedRepo || "") : "";
+  const secretsRepoCheck = repoSlugForSecrets ? confirmSecretsRepository(repoSlugForSecrets) : null;
 
   const githubSecretResults = [];
-  if (repoSlugForSecrets) {
+  if (repoSlugForSecrets && secretsRepoCheck.ok) {
     for (const target of secretTargets) {
       const value = String(target.secretValue || "").trim();
       if (!value) {
@@ -3627,14 +3704,14 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       pc.green(`✔ ${codingAgentConfig.agent.name} config scaffolded at ${codingAgentConfig.path}`)
     );
   }
-  if (repoSlugForSecrets) {
+  if (repoSlugForSecrets && secretsRepoCheck.ok) {
     for (const result of githubSecretResults) {
       if (result.ok) {
-        console.log(pc.green(`✔ ${result.secretName} injected into GitHub repo secret (${repoSlugForSecrets})`));
+        console.log(pc.green(`✔ ${result.secretName} set as a GitHub Actions secret on ${repoSlugForSecrets}`));
         continue;
       }
       const stateLabel = result.skipped ? "skipped" : "failed";
-      console.log(pc.yellow(`! GitHub secret injection ${stateLabel} for ${result.secretName}: ${result.reason}`));
+      console.log(pc.yellow(`! GitHub secret ${stateLabel} for ${result.secretName}: ${result.reason}`));
       console.log(
         pc.yellow(
           `  Run manually: gh secret set ${result.secretName} --repo ${repoSlugForSecrets} --body ${result.placeholder}`
@@ -3642,18 +3719,21 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       );
     }
   } else if (secretTargets.length > 0) {
-    console.log(
-      pc.yellow(
-        "! GitHub secret auto-injection skipped: no repo slug detected. Connect a repo or run manual secret commands."
-      )
-    );
+    const reason = repoSlugForSecrets
+      ? secretsRepoCheck.reason
+      : "this directory has no GitHub git remote.";
+    console.log(pc.yellow(`! GitHub Actions secrets not set: ${reason}`));
     for (const target of secretTargets) {
       console.log(
-        pc.yellow(
-          `  Run manually: gh secret set ${target.secretName} --repo <owner/repo> --body ${target.placeholder}`
-        )
+        pc.yellow(`  Run manually: gh secret set ${target.secretName} --repo <owner/repo> --body ${target.placeholder}`)
       );
     }
+  } else if (sentinelayerToken) {
+    console.log(
+      pc.gray(
+        `GitHub Actions secrets were not set. To set ${secretName} on this directory's git remote, rerun with --inject-secret, or run: gh secret set ${secretName} --repo <owner/repo>`
+      )
+    );
   }
 
   console.log("\nNext:");

package/src/mcp/bridge-inputs.js

@@ -0,0 +1,223 @@
+// bridge-inputs.js -- the inputs the MCP CLI bridge exposes, command by command.
+//
+// Default-deny. An input not listed for its command is not exposed; a command with no entry,
+// or with an argument or a required option that is not listed, is not exposed at all. Commands
+// the bridge blocks outright (src/mcp/cli-command-tools.js) need no entry. DENIED records each
+// input deliberately left out, and why. A unit test walks the command tree and fails on any
+// input of an exposed command that is in neither list, and on entries that name nothing.
+//
+// Nothing that names where a request goes (a URL, host, origin, endpoint or gateway) is allowed:
+// a tool caller never chooses a destination for this machine's credentials. Those commands use
+// the configured API and pocket gateway. Nor is anything that names a program to run (an
+// executable, binary, shell, command or script) or turns off a safety check (a sandbox, approval
+// or similar bypass): a tool caller never chooses what this machine executes, or how freely.
+
+/** Command path (dotted, as in the tool name after "sl.") -> its exposed inputs, space-separated. */
+export const BRIDGE_ALLOWED_INPUTS = Object.freeze({
+  "ai.identity.audit": "path outputDir stale json",
+  "ai.identity.lineage": "identityId path outputDir apiKey orgId projectId json",
+  "ai.identity.list": "path outputDir json",
+  "ai.identity.show": "identityId path outputDir json",
+  "apply": "plan path outputDir json",
+  "audit.architecture": "path registryFile outputDir refresh dryRun json",
+  "audit.compliance": "path registryFile outputDir refresh dryRun json",
+  "audit.diff": "baseRunId candidateRunId path outputDir json",
+  "audit.documentation": "path registryFile outputDir refresh dryRun json",
+  "audit.frontend": "path mode maxCost maxTurns provider model apiKey stream refresh skipBaseline skipRuntime outputDir json",
+  "audit.local": "path outputDir reuseOmargate json",
+  "audit.package": "path runId outputDir json",
+  "audit.performance": "path registryFile outputDir refresh dryRun json",
+  "audit.registry": "registryFile json",
+  "audit.replay": "runId path registryFile outputDir refresh json",
+  "audit.security": "path registryFile outputDir refresh dryRun json",
+  "audit.testing": "path registryFile outputDir refresh dryRun json",
+  "board.check": "file json",
+  "chat.ask": "prompt provider model apiKey path outputDir sessionId dryRun stream json",
+  "cost.record": "path outputDir sessionId provider model inputTokens outputTokens cacheReadTokens cacheWriteTokens durationMs toolCalls costUsd progressScore maxCost maxTokens maxRuntimeMs maxToolCalls maxNoProgress warnAtPercent json",
+  "cost.show": "path outputDir json",
+  "daemon.assign.claim": "workItemId path outputDir agent leaseTtlSeconds stage runId jiraIssueKey budgetSnapshotJson json",
+  "daemon.assign.heartbeat": "workItemId path outputDir agent leaseTtlSeconds stage runId jiraIssueKey budgetSnapshotJson json",
+  "daemon.assign.list": "path outputDir status agent includeExpired limit json",
+  "daemon.assign.reassign": "workItemId path outputDir fromAgent toAgent leaseTtlSeconds stage runId jiraIssueKey budgetSnapshotJson json",
+  "daemon.assign.release": "workItemId path outputDir agent status stage runId jiraIssueKey reason budgetSnapshotJson json",
+  "daemon.budget.check": "workItemId path outputDir usageJson budgetJson nowIso json",
+  "daemon.budget.status": "path outputDir workItemId lifecycleState limit json",
+  "daemon.control.snapshot": "path outputDir status agent limit nowIso json",
+  "daemon.error.queue": "path outputDir status limit json",
+  // endpoint: a route label written to the local error intake; nothing is sent to it
+  "daemon.error.record": "path outputDir source service endpoint errorCode severity message stack commitSha metadataJson json",
+  "daemon.error.worker": "path outputDir maxEvents json",
+  "daemon.jira.comment": "path outputDir workItemId issueKey actor type message json",
+  "daemon.jira.list": "path outputDir workItemId issueKey status limit json",
+  "daemon.jira.open": "workItemId path outputDir summary description labels assignee issueKey issueKeyPrefix actor json",
+  "daemon.jira.start": "workItemId plan path outputDir actor assignee summary description labels issueKey issueKeyPrefix json",
+  "daemon.jira.transition": "path outputDir workItemId issueKey to actor reason json",
+  "daemon.lineage.build": "path outputDir nowIso json",
+  "daemon.lineage.list": "path outputDir status workItemId limit json",
+  "daemon.lineage.show": "workItemId path outputDir json",
+  "daemon.maintenance.off": "path outputDir reason message actor json",
+  "daemon.maintenance.on": "path outputDir reason message actor json",
+  "daemon.maintenance.status": "path outputDir json",
+  "daemon.map.handoff": "workItemId path outputDir runId assignee maxFiles nowIso json",
+  "daemon.map.handoff-list": "path outputDir workItemId limit json",
+  "daemon.map.handoff-show": "workItemId path outputDir handoffRunId json",
+  "daemon.map.list": "path outputDir workItemId limit json",
+  "daemon.map.scope": "workItemId path outputDir maxFiles graphDepth nowIso json",
+  "daemon.map.show": "workItemId path outputDir runId json",
+  "daemon.reliability.run": "path outputDir region timezone simulateFailure checks maintenanceAutoOpen clearMaintenanceOnPass nowIso json",
+  "daemon.reliability.status": "path outputDir limit json",
+  "daemon.watchdog.run": "path outputDir toolCallSeconds repeatedFileReadsThreshold budgetWarningThreshold turnStallTurns limit execute nowIso json",
+  "daemon.watchdog.status": "path outputDir limit json",
+  "guide.export": "format path specFile outputFile enrich provider model apiKey maxPhases maxPrsPerPhase json",
+  "guide.generate": "path specFile outputFile json",
+  "guide.show": "path file plain json",
+  "ingest.map": "path outputFile outputDir json",
+  "init": "projectName nonInteractive interviewFile skipBrowserOpen",
+  "mcp.bridge.init-vscode": "serverId serverConfig path force json",
+  "mcp.doctor": "timeoutMs json",
+  "mcp.list": "path json",
+  "mcp.registry.init-aidenid": "path outputDir force json",
+  "mcp.registry.init-aidenid-adapter": "registryFile path outputDir force json",
+  "mcp.registry.init-cli": "path outputDir force json",
+  "mcp.registry.init-hosted-session-connector": "registryFile path outputDir force json",
+  "mcp.registry.init-senti-session": "path outputDir force json",
+  "mcp.registry.init-session": "path outputDir force json",
+  "mcp.registry.validate": "file json",
+  "mcp.registry.validate-aidenid-adapter": "file registryFile json",
+  "mcp.registry.validate-hosted-session-connector": "file registryFile json",
+  "mcp.schema.show": "json",
+  "mcp.schema.write": "path outputDir force json",
+  "mcp.server.init": "id registryFile path outputDir force json",
+  "mcp.server.validate": "file json",
+  "mcp.smoke": "session limit scope ttlSeconds timeoutMs autoRotate json",
+  "omargate.deep": "path outputDir ai aiDryRun scopeMode diff staged scanMode maxParallel model provider maxCost notifySession requireUsageLedger persona skipPersona stream json",
+  "persona.orchestrator": "mode path outputDir json",
+  "persona.run": "personaId mode path files json",
+  "plugin.init": "id packType stage path outputDir force json",
+  "plugin.list": "path outputDir json",
+  "plugin.order": "path stage outputDir json",
+  "plugin.validate": "file json",
+  "policy.list": "path outputDir json",
+  "prompt.generate": "path specFile agent outputFile outputDir refresh json",
+  "prompt.preview": "path specFile agent maxLines outputDir refresh plain json",
+  "prompt.show": "path file agent plain json",
+  "review.accept": "findingId runId path outputDir note actor json",
+  "review.defer": "findingId runId path outputDir note actor json",
+  "review.diff": "baseRunId candidateRunId path outputDir outputFile json",
+  "review.reject": "findingId runId path outputDir note actor json",
+  "review.replay": "runId path spec outputDir refresh ai aiDryRun json",
+  "review.scan": "mode diff staged path spec outputDir refresh json",
+  "ring-owner": "question session kind option whatWeNeed checkpoint idempotencyKey json",
+  "scan.init": "path specFile workflowFile secretName hasE2eTests playwrightMode nonInteractive json",
+  "scan.precheck": "path specFile outputFile outputDir hasE2eTests playwrightMode provider model apiKey sessionId maxCost maxTokens maxRuntimeMs maxToolCalls maxNoProgress warnAtPercent json",
+  "scan.validate": "path specFile workflowFile secretName hasE2eTests playwrightMode json",
+  "session.action": "sessionId actionType targetSequence targetCursor targetActionId note agent idempotencyKey path json",
+  "session.actions": "json",
+  "session.checkpoint.create": "sessionId startSequence endSequence title summary summaryFile kind checkpointId agent tokenStart tokenEnd path json",
+  "session.checkpoint.generate": "sessionId minEvents maxEvents catchUp maxCheckpoints operationId agent path json",
+  "session.checkpoint.list": "sessionId limit path json",
+  "session.checkpoint.show": "sessionId checkpointId contextEvents maxEvents path json",
+  "session.comment": "sessionId targetSequenceId message agent idempotencyKey path json",
+  "session.continue": "path title json",
+  "session.edit": "sessionId target message agent expectedRevision idempotencyKey path json",
+  "session.ensure": "path session title ttlSeconds forceNew resume reuseWindowSeconds json",
+  "session.guard": "sessionId files agent path json",
+  "session.guard-hook": "sessionId agent path",
+  "session.guard-install": "sessionId agent path json",
+  "session.guard-uninstall": "sessionId agent path json",
+  "session.history": "limit preview path json",
+  "session.inject-guide": "sessionId path json",
+  "session.join": "sessionId name agent inviteToken seatKey idempotencyKey role model path goal deliverable stopWhen scope ttl provider wait waitSeconds cancelAdmission json",
+  "session.leave": "sessionId agent reason path json",
+  "session.list": "remote includeArchived limit path json",
+  "session.listeners": "sessionId path limit maxPages json",
+  "session.lock": "sessionId files intent ttl agent path json",
+  "session.locks": "sessionId path json",
+  "session.observe": "sessionId summary agent model displayName role kind severity owner batch targetSequence targetCursor proposal messageFile stdin path json",
+  "session.pins": "sessionId path json",
+  "session.post-agent": "sessionId message agent model displayName role to path json",
+  "session.react": "sessionId reaction targetSequence targetCursor targetActionId agent idempotencyKey path json",
+  "session.read": "sessionId tail follow live remote beforeSequence actions agent view includeControlEvents path json",
+  "session.recall": "need session role k path remote includeControlEvents json",
+  "session.recap.now": "sessionId session remote agent maxEvents path json",
+  "session.renew": "sessionId files ttl agent path json",
+  "session.reply": "sessionId targetSequenceId message agent idempotencyKey path json",
+  "session.say": "sessionId message agent model displayName role to replyTo replyCursor messageFile stdin forceCliUser localOnly path json",
+  "session.search": "sessionId query beforeSequence limit path json",
+  "session.set-title": "sessionId title path json",
+  "session.setup-guides": "sessionId path json",
+  "session.start": "path title template ttlSeconds forceNew force resume reuseWindowSeconds daemon json",
+  "session.status": "sessionId path json",
+  "session.stop-listener": "sessionId agent path json",
+  "session.sync": "sessionId since path json",
+  "session.templates": "json",
+  "session.ticket.claim": "sessionId ticketId expectedVersion agent path json",
+  "session.ticket.events": "sessionId after agent path json",
+  "session.ticket.list": "sessionId available agent path json",
+  "session.ticket.release": "sessionId ticketId reason agent path json",
+  "session.ticket.renew": "sessionId ticketId agent path json",
+  "session.ticket.submit": "sessionId ticketId sha evidenceFile agent path json",
+  "session.unlock": "sessionId files intent agent path json",
+  "session.usage": "sessionId remote recent format out path json",
+  "session.wake.codex-notify": "sessionId notificationJson session agent notification path json",
+  // host and resumeSession: the local host adapter (claude|codex) and its session to resume
+  "session.wake.daemon": "sessionId session agent host resumeSession cwd idleMs maxAttempts once json",
+  "spec.generate": "path template description projectType outputFile outputDir refresh ai provider model apiKey sessionId maxCost maxTokens maxRuntimeMs maxToolCalls maxNoProgress warnAtPercent json",
+  "spec.list-templates": "json",
+  "spec.regenerate": "path file template description projectType refresh dryRun diff plain maxDiffLines preserveManual json",
+  "spec.show": "path file plain json",
+  "spec.show-template": "templateId json",
+  "swarm.create": "path outputDir scenario penTestScenario targetId execute json",
+  "swarm.dashboard": "path runId outputDir watch pollSeconds maxIdleSeconds json",
+  "swarm.plan": "targetPath path registryFile agents scenario objective maxParallel maxCostUsd maxOutputTokens maxRuntimeMs maxToolCalls warningThresholdPercent outputDir json",
+  "swarm.registry": "registryFile json",
+  "swarm.report": "path runId planFile outputDir json",
+  "swarm.run": "targetPath path planFile playbookFile scenarioFile registryFile agents agent scope identityId scenario objective maxParallel maxSteps engine execute maxCostUsd maxOutputTokens maxRuntimeMs maxToolCalls warningThresholdPercent outputDir json",
+  "swarm.scenario.init": "scenarioId path output json",
+  "swarm.scenario.validate": "file json",
+  "telemetry.record": "path outputDir sessionId runId eventType inputTokens outputTokens cacheReadTokens cacheWriteTokens costUsd durationMs toolCalls stopClass blocking reasonCodes metadataJson json",
+  "telemetry.show": "path outputDir json",
+  "watch.history": "runId path outputDir limit json",
+  "watch.run-events": "runId path outputDir pollSeconds maxIdleSeconds saveArtifacts json",
+});
+
+/** Command path -> { input: why it is not exposed }. */
+export const BRIDGE_DENIED_INPUTS = Object.freeze({
+  "ai.identity.lineage": {
+    apiUrl: "the AIdenID API that receives this command's API key",
+  },
+  "audit.frontend": {
+    url: "a deployed site that this command fetches and audits",
+  },
+  "init": {
+    injectSecret: "sets the project token as a GitHub Actions secret on a repository",
+    injectOpenaiKey: "sets OPENAI_API_KEY as a GitHub Actions secret on a repository",
+  },
+  "mcp.doctor": {
+    apiUrl: "the API that this command probes",
+  },
+  "mcp.smoke": {
+    apiUrl: "the API that receives the user's token",
+  },
+  "ring-owner": {
+    gatewayUrl: "the gateway that receives the user's token",
+  },
+  "swarm.create": {
+    target: "the site that this plan tests",
+  },
+  "swarm.run": {
+    startUrl: "the page that the browser opens",
+  },
+  "swarm.scenario.init": {
+    startUrl: "the page that a later swarm run opens",
+  },
+  "watch.run-events": {
+    apiUrl: "the API that receives the user's token",
+  },
+});
+
+/** The inputs a command exposes through the bridge, or null if it has no entry. */
+export function bridgeAllowedInputs(commandPath) {
+  const listed = BRIDGE_ALLOWED_INPUTS[commandPath];
+  return typeof listed === "string" ? new Set(listed.split(/\s+/).filter(Boolean)) : null;
+}