sentinelayer-cli 0.44.0 → 0.45.0

package/src/pocket/ring-owner.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 
+import { checkedTransport, credentialFor, gatewayCredential, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 
@@ -16,14 +17,12 @@ function normalizeString(value) {
 
 /**
  * Resolve the pocket-gateway base URL — DISTINCT from the senti apiUrl (do NOT reuse resolveApiUrl; that is the API host).
- * Precedence: env SENTI_POCKET_URL -> env POCKET_GATEWAY_URL -> a config value if the caller passed one. Absent -> "".
+ * Precedence: env SENTI_POCKET_URL -> a config value if the caller passed one. Absent -> "". The user's token is only
+ * sent to the SENTI_POCKET_URL origin (src/auth/credential-destinations.js).
  * A present value MUST be an http(s) URL (fail-closed on a bogus scheme). Trailing slashes trimmed.
  */
 export function resolvePocketGatewayUrl({ env = process.env, configUrl = "" } = {}) {
-  const raw =
-    normalizeString(env.SENTI_POCKET_URL) ||
-    normalizeString(env.POCKET_GATEWAY_URL) ||
-    normalizeString(configUrl);
+  const raw = normalizeString(env.SENTI_POCKET_URL) || normalizeString(configUrl);
   if (!raw) return "";
   if (!/^https?:\/\//i.test(raw)) throw new Error("pocket gateway URL must be an http(s) URL");
   return raw.replace(/\/+$/, "");
@@ -74,9 +73,15 @@ export async function ringOwner(
   }
 
   const auth = await resolveAuthSession({ cwd, env, autoRotate: false });
-  if (!auth?.token) {
+  if (!isAuthenticated(auth)) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
+  // The user's token, bound to the gateway SENTI_POCKET_URL names; a --gateway-url on any other
+  // origin is refused when the request is sent.
+  const credential = await gatewayCredential(await credentialFor(auth, { env }), { env });
+  if (!credential) {
+    throw new Error("pocket gateway URL not configured. Set SENTI_POCKET_URL to the pocket-gateway base URL.");
+  }
 
   const context = { sessionId: sid };
   if (normalizeString(whatWeNeed)) context.whatWeNeed = normalizeString(whatWeNeed);
@@ -88,10 +93,10 @@ export async function ringOwner(
 
   // requestJsonMutation auto-derives a transport Idempotency-Key from operationName (retry-safe at the wire); the
   // gateway's own ring-level dedupe (PR-B4) keys on body.idempotencyKey OR a content hash, so an identical retry rings once.
-  return requestMutation(`${gw}/dial/ring-owner`, {
+  return checkedTransport(requestMutation)(`${gw}/dial/ring-owner`, {
     method: "POST",
     operationName: "pocket.ring_owner",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential,
     body,
   });
 }

package/src/review/ai-review.js

@@ -10,7 +10,7 @@ import {
 import { computeProviderCost } from "../billing/price-book.js";
 import { buildBillingRunId, buildCallIdempotencyKey, sanitizeBillingMetadata } from "../billing/ledger-entry.js";
 import { recordSessionUsage } from "../billing/session-usage.js";
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateTokens } from "../cost/tokenizer.js";
@@ -534,7 +534,7 @@ export async function runAiReviewLayer({
     configModel: config.resolved.defaultModelId || DEFAULT_REVIEW_AI_MODEL,
   });
   const explicitApiKey = normalizeString(apiKey);
-  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
   const prompt = buildAiReviewPrompt({
     targetPath: normalizedTargetPath,

package/src/review/dd-report-email-client.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { requestJson } from "../auth/http.js";
 
@@ -97,7 +98,7 @@ export async function sendDdReportEmail({
     });
   }
 
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return errorResult({
       runId: normalizedRunId,
       to: normalizedTo,
@@ -116,11 +117,9 @@ export async function sendDdReportEmail({
   });
 
   try {
-    const response = await requestJsonImpl(endpoint, {
+    const response = await checkedTransport(requestJsonImpl)(endpoint, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${session.token}`,
-      },
+      credential: await credentialFor(session),
       idempotencyKey,
       body: { to: normalizedTo },
       timeoutMs,

package/src/session/admission-access.js

@@ -8,6 +8,7 @@
 
 import process from "node:process";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJson, requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { hasStoredAdmissionCredentials } from "./admission.js";
@@ -74,11 +75,11 @@ async function authContext(targetPath, resolveAuthSession) {
     env: process.env,
     autoRotate: false,
   });
-  if (!auth?.token || !auth?.apiUrl) {
+  if (!isAuthenticated(auth) || !auth?.apiUrl) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
   return {
-    token: auth.token,
+    credential: await credentialFor(auth),
     apiUrl: normalizeString(auth.apiUrl).replace(/\/+$/, ""),
   };
 }
@@ -109,12 +110,13 @@ async function mutateAdmission(
 ) {
   const key = boundedIdempotencyKey(idempotencyKey, operationName);
   const auth = await authContext(targetPath, resolveAuthSession);
-  const result = await requestMutation(admissionsUrl(auth.apiUrl, sessionId, suffix), {
+  const result = await checkedTransport(requestMutation)(admissionsUrl(auth.apiUrl, sessionId, suffix), {
     method: "POST",
     operationName,
     idempotencyKey: key,
+    credential: auth.credential,
     headers: createSessionMutationHeaders({
-      bearerToken: auth.token,
+      credential: auth.credential,
       sessionId,
       routeId,
       idempotencyKey: key,
@@ -143,9 +145,9 @@ export async function listSessionAdmissions(
   }
   const auth = await authContext(targetPath, resolveAuthSession);
   const query = normalizedStatus ? `?status=${encodeURIComponent(normalizedStatus)}` : "";
-  return requestRead(`${admissionsUrl(auth.apiUrl, sid)}${query}`, {
+  return checkedTransport(requestRead)(`${admissionsUrl(auth.apiUrl, sid)}${query}`, {
     method: "GET",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: auth.credential,
   });
 }
 
@@ -161,9 +163,9 @@ export async function getSessionAdmission(
   const sid = required(sessionId, "session id");
   const aid = required(admissionId, "admission id");
   const auth = await authContext(targetPath, resolveAuthSession);
-  return requestRead(admissionsUrl(auth.apiUrl, sid, `/${encodeURIComponent(aid)}`), {
+  return checkedTransport(requestRead)(admissionsUrl(auth.apiUrl, sid, `/${encodeURIComponent(aid)}`), {
     method: "GET",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: auth.credential,
   });
 }
 
@@ -264,14 +266,15 @@ export async function setSessionAdmissionMode(
   await assertOwnerAccessContext();
   const key = boundedIdempotencyKey(idempotencyKey, "session.admission_mode");
   const auth = await authContext(targetPath, resolveAuthSession);
-  const result = await requestMutation(
+  const result = await checkedTransport(requestMutation)(
     `${auth.apiUrl}/api/v1/sessions/${encodeURIComponent(sid)}/admission-mode`,
     {
       method: "POST",
       operationName: "session.admission_mode",
       idempotencyKey: key,
+      credential: auth.credential,
       headers: createSessionMutationHeaders({
-        bearerToken: auth.token,
+        credential: auth.credential,
         sessionId: sid,
         routeId: ROUTES.mode,
         idempotencyKey: key,

package/src/session/admission-auth.js

@@ -25,7 +25,12 @@ import path from "node:path";
 import process from "node:process";
 
 import { admittedAgentScope } from "../auth/admission-scope.js";
-import { readAdmissionCredentialState } from "./admission.js";
+import {
+  hasStoredAdmissionCredentials,
+  readAdmissionCredentialState,
+  storedAdmissionAgentsForSession,
+} from "./admission.js";
+import { sessionRouteClass } from "./route-classes.js";
 
 export class AdmissionCredentialRefused extends Error {
   constructor(message, { reason, sessionId, agentId } = {}) {
@@ -238,26 +243,89 @@ export async function resolveAgentAdmissionTarget(args = [], { env = process.env
   return null;
 }
 
-/**
- * preAction guard: the identity Commander ACTUALLY resolved for this action must be
- * the one whose admission scope (if any) the dispatch was wrapped in. Computed from
- * Commander's own resolved options -- counting only values given on the command line,
- * not defaults such as read's `--agent cli-user` -- so no argv reading of ours can
- * disagree with execution. A mismatch refuses before the action runs.
- */
-export async function assertDispatchMatchesScope(actionCommand, { env = process.env, homeDir } = {}) {
+// What Commander parsed for the action about to run: its `session` command path, its
+// options (and which of them were given on the command line, not defaulted, such as read's
+// `--agent cli-user`), and its operands. The preAction guard reads only these, the same values
+// the action itself uses, so no reading of the raw argv can disagree with execution.
+function parsedSessionAction(actionCommand) {
   const names = [];
   for (let cmd = actionCommand; cmd && cmd.parent; cmd = cmd.parent) names.unshift(cmd.name());
-  if (String(names[0] || "").toLowerCase() !== "session") return;
-  const command = names.slice(1).join(" ").toLowerCase();
-  const principal = SESSION_AGENT_PRINCIPAL[command];
+  if (String(names[0] || "").toLowerCase() !== "session") return null;
   const opts = actionCommand.opts();
   const given = (key) =>
     actionCommand.getOptionValueSource?.(key) === "cli" ? String(opts[key] ?? "").trim() : "";
+  const processed = Array.isArray(actionCommand.processedArgs) ? actionCommand.processedArgs : [];
+  return {
+    route: `cli:${names.join(" ").toLowerCase()}`,
+    command: names.slice(1).join(" ").toLowerCase(),
+    opts,
+    given,
+    first: String(processed[0] ?? "").trim(),
+    operands: processed.flat().map((value) => String(value ?? "").trim()).filter(Boolean),
+  };
+}
+
+// Through the MCP CLI bridge (which marks its child processes with SENTINELAYER_MCP_BRIDGE=1)
+// in an agent context (SENTINELAYER_AGENT_ID is set, or this machine stores any agent
+// admission), by the command's class in SESSION_ROUTE_CLASSES:
+//   - exempt-local: runs as before
+//   - owner: refused
+//   - a session the command will use (its --session or --id value, given or defaulted, or any
+//     operand) stores an admission, in any state: the action must be running in that
+//     session's admission scope, or it is refused before it runs
+//   - no session it uses stores one: legacy-data-plane runs as before; control and
+//     unclassified commands are refused
+async function assertBridgedRoute(action, { env, homeDir }) {
+  if (env.SENTINELAYER_MCP_BRIDGE !== "1") return;
+  const agentContext =
+    Boolean(String(env.SENTINELAYER_AGENT_ID || "").trim()) || (await hasStoredAdmissionCredentials({ homeDir }));
+  if (!agentContext) return;
+  const routeClass = sessionRouteClass(action.route);
+  const refuse = (why) => {
+    throw new AdmissionCredentialRefused(
+      `\`sl ${action.route.slice("cli:".length)}\` runs for an agent here and needs an admission it can bind to: ` +
+        `${why}. It will not fall back to other credentials.`,
+      { reason: "bridged_route_refused" },
+    );
+  };
+  if (routeClass === "exempt-local") return;
+  if (routeClass === "owner") refuse("owner actions are not available to agents");
+  const named = [action.opts.session, action.opts.id, ...action.operands]
+    .map((value) => String(value ?? "").trim())
+    .filter(Boolean);
+  const admitted = [];
+  for (const sessionId of named) {
+    if ((await storedAdmissionAgentsForSession(sessionId, { homeDir })).length > 0) admitted.push(sessionId);
+  }
+  if (admitted.length > 0) {
+    const bound = String(currentAdmittedAgent()?.sessionId || "").toLowerCase();
+    if (!bound || !admitted.some((sid) => sid.toLowerCase() === bound)) {
+      refuse(`session ${admitted[0]} stores an admission and this command's agent is not bound to it`);
+    }
+    return;
+  }
+  if (routeClass === "legacy-data-plane") return;
+  refuse(routeClass === "control" ? "it is a control operation" : "it is not classified for agents");
+}
+
+/**
+ * preAction guard, run before ANY action, on Commander's parsed values only:
+ *   1. a bridged command in an agent context binds to its session's admission, runs as a
+ *      legacy data-plane route, or is refused (assertBridgedRoute above);
+ *   2. the identity Commander resolved for the action must be the one whose admission scope
+ *      (if any) the dispatch was wrapped in.
+ * Either refusal happens before the action runs, so before any request.
+ */
+export async function assertDispatchMatchesScope(actionCommand, { env = process.env, homeDir } = {}) {
+  const action = parsedSessionAction(actionCommand);
+  if (!action) return;
+  await assertBridgedRoute(action, { env, homeDir });
+  const { command, given } = action;
+  const principal = SESSION_AGENT_PRINCIPAL[command];
   let actual = null;
   if (principal === "actor" || (!principal && given("agent"))) {
-    const sessionId = given("session") || given("id") || String(actionCommand.processedArgs?.[0] ?? "").trim();
-    const targetPath = path.resolve(process.cwd(), String(opts.path || "."));
+    const sessionId = given("session") || given("id") || action.first;
+    const targetPath = path.resolve(process.cwd(), String(action.opts.path || "."));
     const agentId =
       given("agent") ||
       String(env.SENTINELAYER_AGENT_ID || "").trim() ||
@@ -279,9 +347,20 @@ export async function assertDispatchMatchesScope(actionCommand, { env = process.
 }
 
 /** Run `fn` with the right credential for (sessionId, agentId). See the module header. */
-export async function withAgentAdmission(sessionId, agentId, fn, { homeDir, now } = {}) {
+export async function withAgentAdmission(sessionId, agentId, fn, { homeDir, now, requireStored = false } = {}) {
   const held = await readAdmissionCredentialState(sessionId, agentId, { homeDir, now });
-  if (held.state === "none") return fn({ admitted: false });
+  if (held.state === "none") {
+    // A caller that already decided this must bind (it saw a stored admission) never runs
+    // without one: a credential file that vanished in between is a refusal, not absence.
+    if (requireStored) {
+      throw new AdmissionCredentialRefused(
+        `Agent "${agentId}"'s stored admission for session ${sessionId} is no longer present. ` +
+          `It will not fall back to your own credentials.`,
+        { reason: "admission_removed", sessionId, agentId },
+      );
+    }
+    return fn({ admitted: false });
+  }
   if (held.state !== "live") {
     const why = REFUSAL_HINT[held.reason] || `its stored admission is unusable (${held.reason})`;
     throw new AdmissionCredentialRefused(

package/src/session/admission.js

@@ -30,6 +30,7 @@ import path from "node:path";
 import process from "node:process";
 import { setTimeout as sleepMs } from "node:timers/promises";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJson, requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { canonicalize } from "../engram/canonical.js";
@@ -271,6 +272,39 @@ export async function hasStoredAdmissionCredentials({ homeDir } = {}) {
   return false;
 }
 
+/**
+ * The agents for which this machine stores an admission credential file for this
+ * session, usable or not (`<home>/.sentinelayer/agents/<agent>/admissions/<session>.json`).
+ * An unreadable agents directory is reported as a stored entry, never as absence.
+ */
+export async function storedAdmissionAgentsForSession(sessionId, { homeDir } = {}) {
+  let sessionFile;
+  try {
+    sessionFile = `${safeSegment(sessionId, "sessionId")}.json`;
+  } catch {
+    return []; // not a storable session id, so nothing can be stored for it
+  }
+  const agentsDir = path.join(sentinelayerHome(homeDir), "agents");
+  let agents;
+  try {
+    agents = await fsp.readdir(agentsDir, { withFileTypes: true });
+  } catch (error) {
+    if (error && error.code === "ENOENT") return [];
+    return ["(unreadable)"];
+  }
+  const found = [];
+  for (const agent of agents) {
+    if (!agent.isDirectory()) continue;
+    try {
+      await fsp.access(path.join(agentsDir, agent.name, "admissions", sessionFile));
+      found.push(agent.name.replace(/%3a/g, ":"));
+    } catch (error) {
+      if (!(error && error.code === "ENOENT")) found.push(agent.name.replace(/%3a/g, ":"));
+    }
+  }
+  return found;
+}
+
 /**
  * What this machine holds for (session, agent):
  *   { state: "none" }                        -- never admitted here: the legacy path applies
@@ -333,10 +367,10 @@ function requestFingerprint({ apiUrl, agentId, publicKey, goal, actions, ttlSeco
 
 async function authContext({ targetPath, resolveAuthSession }) {
   const auth = await resolveAuthSession({ cwd: targetPath, env: process.env, autoRotate: false });
-  if (!auth?.token || !auth?.apiUrl) {
+  if (!isAuthenticated(auth) || !auth?.apiUrl) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
-  return { token: auth.token, apiUrl: normalizeString(auth.apiUrl).replace(/\/+$/, "") };
+  return { credential: await credentialFor(auth), apiUrl: normalizeString(auth.apiUrl).replace(/\/+$/, "") };
 }
 
 function admissionUrl(apiUrl, sessionId, suffix = "") {
@@ -345,12 +379,13 @@ function admissionUrl(apiUrl, sessionId, suffix = "") {
 
 async function mutate(auth, sessionId, routeId, url, body, { requestMutation, operationName, origin }) {
   const idempotencyKey = createSessionMutationIdempotencyKey(operationName);
-  return requestMutation(url, {
+  return checkedTransport(requestMutation)(url, {
     method: "POST",
     operationName,
     idempotencyKey,
+    credential: auth.credential,
     headers: createSessionMutationHeaders({
-      bearerToken: auth.token,
+      credential: auth.credential,
       sessionId,
       routeId,
       idempotencyKey,
@@ -495,9 +530,9 @@ export async function runAdmissionJoin(
   const deadline = now() + Math.max(0, waitTimeoutMs);
   let polled;
   for (;;) {
-    polled = await requestRead(admissionUrl(auth.apiUrl, sid, `/${encodeURIComponent(state.admissionId)}`), {
+    polled = await checkedTransport(requestRead)(admissionUrl(auth.apiUrl, sid, `/${encodeURIComponent(state.admissionId)}`), {
       method: "GET",
-      headers: { Authorization: `Bearer ${auth.token}` },
+      credential: auth.credential,
     });
     state.status = polled.status;
     // Identity readiness is a server capability: a server that gates the claim on
@@ -635,13 +670,13 @@ export async function fetchOwnAdmissionReceipt(
 ) {
   const sid = normalizeString(sessionId);
   const auth = await resolveAuthSession({ cwd: targetPath, env: process.env, autoRotate: false });
-  if (!auth?.token || auth.source !== "session_admission") {
+  if (!isAuthenticated(auth) || auth.source !== "session_admission") {
     throw new Error("The admission receipt must be fetched with the admission credential.");
   }
   const apiUrl = normalizeString(auth.apiUrl).replace(/\/+$/, "");
-  return requestRead(admissionUrl(apiUrl, sid, "/self"), {
+  return checkedTransport(requestRead)(admissionUrl(apiUrl, sid, "/self"), {
     method: "GET",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: await credentialFor(auth),
   });
 }
 

package/src/session/checkpoints.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import process from "node:process";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { SentinelayerApiError, requestJson, requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { pollSessionEventsBefore } from "./sync.js";
@@ -419,12 +420,12 @@ async function resolveCheckpointApi({
     env: process.env,
     autoRotate: false,
   });
-  if (!auth || !auth.token) {
+  if (!isAuthenticated(auth)) {
     throw new Error("Sentinelayer auth is required. Run `sl auth login` first.");
   }
   return {
     apiUrl: normalizeApiUrl(auth.apiUrl),
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: await credentialFor(auth),
   };
 }
 
@@ -438,11 +439,11 @@ export async function listSessionCheckpoints(sessionId, {
   if (!normalizedSessionId) {
     throw new Error("session id is required.");
   }
-  const { apiUrl, headers } = await resolveCheckpointApi({ targetPath, resolveAuthSession });
+  const { apiUrl, credential } = await resolveCheckpointApi({ targetPath, resolveAuthSession });
   const params = new URLSearchParams({ limit: String(normalizeLimit(limit)) });
   const response = await request(
     `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}/checkpoints?${params.toString()}`,
-    { method: "GET", headers },
+    { method: "GET", credential },
   );
   const checkpoints = Array.isArray(response?.checkpoints) ? response.checkpoints : [];
   return {
@@ -519,12 +520,12 @@ export async function createSessionCheckpoint(sessionId, options = {}) {
     requestMutation = requestJsonMutation,
   } = options;
   const { body, idempotencyKey } = buildManualCheckpointPayload(normalizedSessionId, options);
-  const { apiUrl, headers } = await resolveCheckpointApi({ targetPath, resolveAuthSession });
-  const response = await requestMutation(
+  const { apiUrl, credential } = await resolveCheckpointApi({ targetPath, resolveAuthSession });
+  const response = await checkedTransport(requestMutation)(
     `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}/checkpoints`,
     {
       operationName: "session-checkpoint-create",
-      headers,
+      credential,
       body,
       idempotencyKey,
     },
@@ -546,12 +547,12 @@ export async function generateSessionCheckpoint(sessionId, options = {}) {
     requestMutation = requestJsonMutation,
   } = options;
   const { body, idempotencyKey } = buildGenerateCheckpointPayload(normalizedSessionId, options);
-  const { apiUrl, headers } = await resolveCheckpointApi({ targetPath, resolveAuthSession });
-  const response = await requestMutation(
+  const { apiUrl, credential } = await resolveCheckpointApi({ targetPath, resolveAuthSession });
+  const response = await checkedTransport(requestMutation)(
     `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}/checkpoints/generate`,
     {
       operationName: "session-checkpoint-generate",
-      headers,
+      credential,
       body,
       idempotencyKey,
     },

package/src/session/file-locks.js

@@ -9,6 +9,7 @@ import {
   requestJson,
   requestJsonMutation,
 } from "../auth/http.js";
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { resolveSessionPaths } from "./paths.js";
 
@@ -477,14 +478,14 @@ async function resolveLeaseApi({
     env: process.env,
     autoRotate: false,
   });
-  if (!auth?.token || !auth?.apiUrl) {
+  if (!isAuthenticated(auth) || !auth?.apiUrl) {
     throw new Error(
       "Authoritative session file leases require Sentinelayer auth. Run `sl auth login` first.",
     );
   }
   return {
     apiUrl: normalizeApiUrl(auth.apiUrl),
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: await credentialFor(auth),
   };
 }
 
@@ -505,10 +506,10 @@ async function listRemoteLeases(
   } = {},
 ) {
   const normalizedSessionId = normalizeSessionId(sessionId);
-  const { apiUrl, headers } = await resolveLeaseApi({ targetPath, resolveAuthSession });
+  const { apiUrl, credential } = await resolveLeaseApi({ targetPath, resolveAuthSession });
   const response = await request(leaseCollectionUrl(apiUrl, normalizedSessionId), {
     method: "GET",
-    headers,
+    credential,
   });
   if (response?.authoritative !== true || !Array.isArray(response?.leases)) {
     throw new Error("File-lease authority returned an invalid list response; refusing local fallback.");
@@ -529,13 +530,13 @@ async function guardRemoteClaims(
 ) {
   const normalizedSessionId = normalizeSessionId(sessionId);
   const normalizedHolderId = normalizeAgentId(holderId);
-  const { apiUrl, headers } = await resolveLeaseApi({ targetPath, resolveAuthSession });
-  const response = await requestMutation(
+  const { apiUrl, credential } = await resolveLeaseApi({ targetPath, resolveAuthSession });
+  const response = await checkedTransport(requestMutation)(
     `${leaseCollectionUrl(apiUrl, normalizedSessionId)}/guard`,
     {
       method: "POST",
       operationName: "session-file-lease-guard",
-      headers,
+      credential,
       body: {
         holderId: normalizedHolderId,
         claims: paths.map((file, index) => ({
@@ -712,15 +713,15 @@ export async function lockFile(
   }
 
   const leaseToken = exactClaim?.leaseToken || newCapabilityToken();
-  const { apiUrl, headers } = await resolveLeaseApi({ targetPath, resolveAuthSession });
+  const { apiUrl, credential } = await resolveLeaseApi({ targetPath, resolveAuthSession });
   let response;
   try {
-    response = await requestMutation(
+    response = await checkedTransport(requestMutation)(
       leaseCollectionUrl(apiUrl, normalizedSessionId),
       {
         method: "POST",
         operationName: "session-file-lease-acquire",
-        headers,
+        credential,
         body: {
           path: normalizedFilePath,
           holderId: normalizedAgentId,
@@ -792,12 +793,12 @@ export async function lockFile(
   } catch (cacheError) {
     let compensated = false;
     try {
-      const release = await requestMutation(
+      const release = await checkedTransport(requestMutation)(
         leaseMemberUrl(apiUrl, normalizedSessionId, lease.leaseId, "release"),
         {
           method: "POST",
           operationName: "session-file-lease-acquire-compensation",
-          headers,
+          credential,
           body: {
             holderId: normalizedAgentId,
             leaseToken,
@@ -845,15 +846,15 @@ async function releaseCapabilityClaim(
     requestMutation,
   },
 ) {
-  const { apiUrl, headers } = await resolveLeaseApi({ targetPath, resolveAuthSession });
+  const { apiUrl, credential } = await resolveLeaseApi({ targetPath, resolveAuthSession });
   let response;
   try {
-    response = await requestMutation(
+    response = await checkedTransport(requestMutation)(
       leaseMemberUrl(apiUrl, sessionId, claim.leaseId, "release"),
       {
         method: "POST",
         operationName: "session-file-lease-release",
-        headers,
+        credential,
         body: {
           holderId: agentId,
           leaseToken: claim.leaseToken,
@@ -1007,13 +1008,13 @@ export async function renewFileLease(
     };
   }
 
-  const { apiUrl, headers } = await resolveLeaseApi({ targetPath, resolveAuthSession });
-  const response = await requestMutation(
+  const { apiUrl, credential } = await resolveLeaseApi({ targetPath, resolveAuthSession });
+  const response = await checkedTransport(requestMutation)(
     leaseMemberUrl(apiUrl, normalizedSessionId, claim.leaseId, "renew"),
     {
       method: "POST",
       operationName: "session-file-lease-renew",
-      headers,
+      credential,
       body: {
         holderId: normalizedAgentId,
         leaseToken: claim.leaseToken,