sentinelayer-cli 0.44.0 → 0.45.0

package/src/session/invitations.js

@@ -3,6 +3,7 @@ import fsp from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
 
+import { checkedTransport, credentialFor, credentialHmac, isAuthenticated, isCredential } from "../auth/credential-destinations.js";
 import { requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { renderCoordinationBulletList } from "./coordination-guidance.js";
@@ -30,6 +31,16 @@ export function canonicalSessionRef(value) {
   return raw.toLowerCase();
 }
 
+function sessionMutationCsrfMessage({ sessionId, routeId, idempotencyKey } = {}) {
+  return [
+    "session-mutation-csrf:v1",
+    canonicalSessionRef(sessionId),
+    normalizeString(routeId),
+    normalizeString(idempotencyKey),
+  ].join("\0");
+}
+
+// The API's CSRF proof for a given bearer: what the server (or a test fixture) checks against.
 export function createSessionMutationCsrfToken({
   bearerToken,
   sessionId,
@@ -38,35 +49,29 @@ export function createSessionMutationCsrfToken({
 } = {}) {
   const secret = normalizeString(bearerToken);
   if (!secret) return "";
-  const message = [
-    "session-mutation-csrf:v1",
-    canonicalSessionRef(sessionId),
-    normalizeString(routeId),
-    normalizeString(idempotencyKey),
-  ].join("\0");
-  return createHmac("sha256", secret).update(message, "utf-8").digest("hex");
+  return createHmac("sha256", secret)
+    .update(sessionMutationCsrfMessage({ sessionId, routeId, idempotencyKey }), "utf-8")
+    .digest("hex");
 }
 
+// The session-mutation headers: origin and a CSRF proof derived from the credential the request
+// is sent with. The credential itself is attached by credentialedRequest, never here.
 export function createSessionMutationHeaders({
-  bearerToken,
+  credential,
   sessionId,
   routeId,
   idempotencyKey,
   origin = SESSION_MUTATION_ORIGIN,
 } = {}) {
-  const token = normalizeString(bearerToken);
   const normalizedOrigin = normalizeString(origin) || SESSION_MUTATION_ORIGIN;
   return {
-    Authorization: `Bearer ${token}`,
     Origin: normalizedOrigin,
     "Sec-Fetch-Site": "same-site",
     "X-Sentinelayer-Session-Mutation": "session-mutation",
-    "X-CSRF-Token": createSessionMutationCsrfToken({
-      bearerToken: token,
-      sessionId,
-      routeId,
-      idempotencyKey,
-    }),
+    // keyed inside src/auth/credential-destinations.js; the token never leaves it
+    "X-CSRF-Token": isCredential(credential)
+      ? credentialHmac(credential, sessionMutationCsrfMessage({ sessionId, routeId, idempotencyKey }))
+      : "",
   };
 }
 
@@ -106,10 +111,11 @@ export async function acceptSessionInvitation(
     env: process.env,
     autoRotate: false,
   });
-  if (!auth?.token || !auth?.apiUrl) {
+  if (!isAuthenticated(auth) || !auth?.apiUrl) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
 
+  const credential = await credentialFor(auth);
   const resolvedIdempotencyKey =
     normalizeString(idempotencyKey) || createSessionMutationIdempotencyKey("session-invite-accept");
   const apiUrl = normalizeString(auth.apiUrl).replace(/\/+$/, "");
@@ -121,14 +127,15 @@ export async function acceptSessionInvitation(
   if (normalizedSeatKey) body.seatKey = normalizedSeatKey;
   if (normalizedAgentId) body.agentId = normalizedAgentId;
 
-  const result = await requestMutation(
+  const result = await checkedTransport(requestMutation)(
     `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}/invitations/accept`,
     {
       method: "POST",
       operationName: "session.invitation_accept",
       idempotencyKey: resolvedIdempotencyKey,
+      credential,
       headers: createSessionMutationHeaders({
-        bearerToken: auth.token,
+        credential,
         sessionId: normalizedSessionId,
         routeId: SESSION_INVITATION_ACCEPT_ROUTE_ID,
         idempotencyKey: resolvedIdempotencyKey,

package/src/session/live-source.js

@@ -18,6 +18,7 @@
 import fs from "node:fs";
 import { setTimeout as sleep } from "node:timers/promises";
 
+import { CredentialDestinationRefused, credentialedRequest } from "../auth/credential-destinations.js";
 import { resolveSessionPaths } from "./paths.js";
 import { readStream } from "./stream.js";
 import {
@@ -155,12 +156,12 @@ export async function* watchLocalStream({
 export async function* watchRemoteStream({
   apiBaseUrl,
   sessionId,
-  token,
+  credential,
   signal,
   _sseFetch = fetch,
   reconnectBackoffMs = DEFAULT_RECONNECT_BACKOFF_MS,
 } = {}) {
-  if (!apiBaseUrl || !sessionId || !token) return;
+  if (!apiBaseUrl || !sessionId || !credential) return;
   const endpoint = `${apiBaseUrl.replace(/\/+$/, "")}/api/v1/sessions/${encodeURIComponent(
     sessionId,
   )}/stream`;
@@ -182,17 +183,16 @@ export async function* watchRemoteStream({
         ? `${endpoint}?fromSequence=${encodeURIComponent(String(resumeSequence))}`
         : endpoint;
     try {
-      response = await _sseFetch(url, {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${token}`,
-          Accept: "text/event-stream",
-        },
-        signal,
-      });
+      response = await credentialedRequest(
+        credential,
+        url,
+        { method: "GET", headers: { Accept: "text/event-stream" }, signal },
+        { fetchImpl: _sseFetch },
+      );
     } catch (err) {
       if (signal?.aborted) return;
       yield { source: "sse", error: String(err?.message || err) };
+      if (err instanceof CredentialDestinationRefused) return; // final: no reconnect can change it
       await sleep(backoff);
       backoff = Math.min(backoff * 2, MAX_RECONNECT_BACKOFF_MS);
       continue;
@@ -267,7 +267,7 @@ export async function* mergeLiveSources({
   sessionId,
   targetPath,
   apiBaseUrl,
-  token,
+  credential,
   signal,
   _localIterator,
   _remoteIterator,
@@ -278,10 +278,10 @@ export async function* mergeLiveSources({
     ? _localIterator
     : watchLocalStream({ sessionId, targetPath, signal });
   const remoteIterable =
-    _remoteIterator || (apiBaseUrl && token)
+    _remoteIterator || (apiBaseUrl && credential)
       ? _remoteIterator
         ? _remoteIterator
-        : watchRemoteStream({ apiBaseUrl, sessionId, token, signal })
+        : watchRemoteStream({ apiBaseUrl, sessionId, credential, signal })
       : null;
 
   const seen = new Map();

package/src/session/route-classes.js

@@ -0,0 +1,107 @@
+// route-classes.js -- the ONE classification of every local MCP session tool ("mcp:<tool>")
+// and every `sl session` command the MCP CLI bridge can invoke ("cli:session <path>").
+//
+// In an agent context it decides what a route may do when the session it acts in stores NO
+// admission on this machine (when the session stores one, every route binds to it or is
+// refused; see runInSessionToolContext in src/mcp/session-stdio-server.js and
+// assertDispatchMatchesScope in src/session/admission-auth.js):
+//
+//   legacy-data-plane  a compatibility list for rooms that don't require admission:
+//                      posting, replying, reading/polling, message actions and reactions,
+//                      attention requests. Runs as before; the server's admission mode
+//                      decides whether a room accepts it.
+//   control            leases, locks, guards, tickets, checkpoints, joining and leaving,
+//                      listeners, room setup and everything else that is not plain
+//                      data-plane traffic. Refused unless the session's admission binds it.
+//   owner              room owner actions. Refused in an agent context.
+//   exempt-local       sends no request (a local store or built-in constants only).
+//
+// A route missing from this table is treated as unclassified and refused like control. A
+// unit test derives every MCP tool and every bridge-invokable command from the real handlers
+// and command tree and fails when one is missing here.
+
+export const SESSION_ROUTE_CLASSES = Object.freeze({
+  // ---- local MCP session tools
+  "mcp:poll_inbox": "legacy-data-plane",
+  "mcp:read_history": "legacy-data-plane",
+  "mcp:send_message": "legacy-data-plane",
+  "mcp:attention_request": "legacy-data-plane",
+  "mcp:session_action": "legacy-data-plane",
+  "mcp:session_react": "legacy-data-plane",
+  "mcp:session_reply": "legacy-data-plane",
+  "mcp:session_lock": "control",
+  "mcp:session_unlock": "control",
+  "mcp:session_locks": "control",
+  "mcp:memory.write": "exempt-local",
+  "mcp:memory.recall": "exempt-local",
+  "mcp:memory.summarize": "exempt-local",
+
+  // ---- `sl session` commands invokable through the MCP CLI bridge
+  "cli:session say": "legacy-data-plane",
+  "cli:session post-agent": "legacy-data-plane",
+  "cli:session observe": "legacy-data-plane",
+  "cli:session reply": "legacy-data-plane",
+  "cli:session comment": "legacy-data-plane",
+  "cli:session action": "legacy-data-plane",
+  "cli:session react": "legacy-data-plane",
+  "cli:session read": "legacy-data-plane",
+  "cli:session history": "legacy-data-plane",
+  "cli:session search": "legacy-data-plane",
+  "cli:session pins": "legacy-data-plane",
+  "cli:session lock": "control",
+  "cli:session unlock": "control",
+  "cli:session locks": "control",
+  "cli:session renew": "control",
+  "cli:session guard": "control",
+  "cli:session guard-hook": "control",
+  "cli:session guard-install": "control",
+  "cli:session guard-uninstall": "control",
+  "cli:session checkpoint create": "control",
+  "cli:session checkpoint generate": "control",
+  "cli:session checkpoint list": "control",
+  "cli:session checkpoint show": "control",
+  "cli:session ticket claim": "control",
+  "cli:session ticket events": "control",
+  "cli:session ticket list": "control",
+  "cli:session ticket release": "control",
+  "cli:session ticket renew": "control",
+  "cli:session ticket submit": "control",
+  "cli:session join": "control",
+  "cli:session leave": "control",
+  "cli:session stop-listener": "control",
+  "cli:session listeners": "control",
+  "cli:session set-title": "control",
+  "cli:session start": "control",
+  "cli:session ensure": "control",
+  "cli:session continue": "control",
+  "cli:session inject-guide": "control",
+  "cli:session setup-guides": "control",
+  "cli:session sync": "control",
+  "cli:session status": "control",
+  "cli:session list": "control",
+  "cli:session usage": "control",
+  "cli:session recall": "control",
+  "cli:session recap now": "control",
+  "cli:session edit": "control",
+  "cli:session wake codex": "control",
+  "cli:session wake codex-notify": "control",
+  "cli:session wake daemon": "control",
+  "cli:session access approve": "owner",
+  "cli:session access deny": "owner",
+  "cli:session access revoke": "owner",
+  "cli:session access mode": "owner",
+  "cli:session access request": "owner",
+  "cli:session access list": "owner",
+  "cli:session access status": "owner",
+  "cli:session actions": "exempt-local",
+  "cli:session templates": "exempt-local",
+});
+
+/** The compatibility list for rooms that don't require admission, as one named view of the table. */
+export const LEGACY_DATA_PLANE_TOOLS = Object.freeze(
+  Object.keys(SESSION_ROUTE_CLASSES).filter((route) => SESSION_ROUTE_CLASSES[route] === "legacy-data-plane"),
+);
+
+export function sessionRouteClass(route) {
+  return SESSION_ROUTE_CLASSES[route] || "unclassified";
+}