sentinelayer-cli 0.44.0 → 0.46.0

package/src/cli.js

@@ -2,6 +2,7 @@ import process from "node:process";
 import { Command } from "commander";
 
 import { CLI_VERSION, runLegacyCliWithErrorHandling } from "./legacy-cli.js";
+import { restrictProgramLookupToPath } from "./program-lookup.js";
 
 const COMMAND_REGISTRARS = {
   init: {
@@ -242,6 +243,20 @@ export async function buildCliProgram({
 }
 
 export async function runCli(rawArgs = process.argv.slice(2)) {
+  // Programs named without a path come from PATH only, never from the working directory, before
+  // anything is spawned. On a Windows runtime that cannot guarantee that, nothing runs.
+  const programLookup = restrictProgramLookupToPath();
+  if (!programLookup.ok) {
+    console.error(programLookup.message);
+    process.exitCode = 1;
+    return;
+  }
+
+  // Where the user's credentials may go is decided once, here, from the real environment and the
+  // global config, and frozen: nothing that changes process.env later can move it.
+  const { freezeProcessTrustContext } = await import("./auth/credential-destinations.js");
+  await freezeProcessTrustContext();
+
   // Normalize slash commands (/omargate → omargate, /audit → audit, etc.)
   const normalizedArgs = normalizeSlashArgs(rawArgs);
 
@@ -269,15 +284,18 @@ export async function runCli(rawArgs = process.argv.slice(2)) {
   // the subcommand (say, post-agent, observe, locks, checkpoints, ...), so no
   // subcommand, present or future, can reach the human token. A tombstoned
   // admission refuses here, before any request.
-  const { assertDispatchMatchesScope, resolveAgentAdmissionTarget, withAgentAdmission } = await import(
-    "./session/admission-auth.js"
-  );
+  const { assertDispatchMatchesScope, resolveAgentAdmissionTarget, withAgentAdmission } =
+    await import("./session/admission-auth.js");
   const target = await resolveAgentAdmissionTarget(normalizedArgs);
-  // Execution must match authorization: before ANY action runs, re-derive the identity
-  // from Commander's resolved options and compare it with the scope in force.
+  // Execution must match authorization: before ANY action runs, decide on Commander's parsed
+  // arguments and options -- the values the action will use. Through the MCP CLI bridge in an
+  // agent context the action binds to its session's admission, runs a legacy data-plane route
+  // as before, or is refused (src/session/route-classes.js); and the identity it resolves must
+  // be the one whose scope is in force.
   program.hook("preAction", (_hooked, actionCommand) => assertDispatchMatchesScope(actionCommand));
   if (target) {
-    await withAgentAdmission(target.sessionId, target.agentId, dispatch);
+    // An admission seen above that is gone by the time it is read refuses: never a fallback.
+    await withAgentAdmission(target.sessionId, target.agentId, dispatch, { requireStored: true });
     return;
   }
   await dispatch();

package/src/commands/ai/provision-governance.js

@@ -25,8 +25,7 @@ import {
 import { listSites, recordTemporarySite } from "../../ai/site-store.js";
 import { getIdentityById, recordProvisionedIdentity } from "../../ai/identity-store.js";
 import { resolveOutputRoot } from "../../config/service.js";
-import { readStoredSession } from "../../auth/session-store.js";
-import { fetchAidenIdCredentials } from "../../auth/service.js";
+import { fetchAidenIdCredentials, resolveActiveAuthSession } from "../../auth/service.js";
 import {
   buildCurlPreview,
   normalizeIdempotencyKey,
@@ -37,6 +36,7 @@ import {
   stableTimestampForFile,
   writeArtifact,
 } from "./shared.js";
+import { isAuthenticated } from "../../auth/credential-destinations.js";
 
 function addProvisionEmailOptions(cmd) {
   return cmd
@@ -92,12 +92,13 @@ async function provisionEmailAction(options, command) {
       payload,
     });
 
-    let session = null;
-    try { session = await readStoredSession(); } catch { /* no session */ }
+    const session = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
+      () => null,
+    );
 
     const makeFetcher = () => {
-      if (!session || !session.token) return null;
-      return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, token: session.token });
+      if (!isAuthenticated(session)) return null;
+      return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, auth: session });
     };
 
     const resolvedCredentials = await resolveAidenIdCredentials({

package/src/commands/init.js

@@ -1,25 +1,26 @@
 import process from "node:process";
 
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 
-function applyConfigEnvDefaults(resolvedConfig) {
-  if (!process.env.SENTINELAYER_API_URL && resolvedConfig.apiUrl) {
-    process.env.SENTINELAYER_API_URL = resolvedConfig.apiUrl;
-  }
+// Config values the scaffold flow reads from the environment. The API it talks to and the token
+// it sends are never set here: they come from the trust context and the auth service
+// (src/auth/credential-destinations.js), so a workspace .sentinelayer.yml cannot choose them,
+// and child processes inherit neither.
+// Provider keys come from the user's own config (global, or the environment), never the workspace.
+function applyConfigEnvDefaults(config) {
+  const resolvedConfig = config.resolved;
+  const userValues = userConfigValues(config);
   if (!process.env.SENTINELAYER_WEB_URL && resolvedConfig.webUrl) {
-    process.env.SENTINELAYER_WEB_URL = resolvedConfig.webUrl;
-  }
-  if (!process.env.SENTINELAYER_TOKEN && resolvedConfig.sentinelayerToken) {
-    process.env.SENTINELAYER_TOKEN = resolvedConfig.sentinelayerToken;
+    process.env.SENTINELAYER_WEB_URL = resolvedConfig.webUrl; // printed as a link only
   }
-  if (!process.env.OPENAI_API_KEY && resolvedConfig.openaiApiKey) {
-    process.env.OPENAI_API_KEY = resolvedConfig.openaiApiKey;
+  if (!process.env.OPENAI_API_KEY && userValues.openaiApiKey) {
+    process.env.OPENAI_API_KEY = userValues.openaiApiKey;
   }
-  if (!process.env.ANTHROPIC_API_KEY && resolvedConfig.anthropicApiKey) {
-    process.env.ANTHROPIC_API_KEY = resolvedConfig.anthropicApiKey;
+  if (!process.env.ANTHROPIC_API_KEY && userValues.anthropicApiKey) {
+    process.env.ANTHROPIC_API_KEY = userValues.anthropicApiKey;
   }
-  if (!process.env.GOOGLE_API_KEY && resolvedConfig.googleApiKey) {
-    process.env.GOOGLE_API_KEY = resolvedConfig.googleApiKey;
+  if (!process.env.GOOGLE_API_KEY && userValues.googleApiKey) {
+    process.env.GOOGLE_API_KEY = userValues.googleApiKey;
   }
 }
 
@@ -30,9 +31,11 @@ export function registerInitCommand(program, invokeLegacy) {
     .option("--non-interactive", "Disable prompts and require interview payload")
     .option("--interview-file <path>", "Load interview JSON from file")
     .option("--skip-browser-open", "Do not auto-open browser during auth")
+    .option("--inject-secret", "Set the project token as a GitHub Actions secret on this directory's git remote")
+    .option("--inject-openai-key", "Also set OPENAI_API_KEY from your environment as a GitHub Actions secret there")
     .action(async (projectName, options) => {
       const config = await loadConfig();
-      applyConfigEnvDefaults(config.resolved);
+      applyConfigEnvDefaults(config);
 
       const legacyArgs = [];
       const normalizedProjectName = String(projectName || "").trim();
@@ -49,6 +52,12 @@ export function registerInitCommand(program, invokeLegacy) {
       if (options.skipBrowserOpen) {
         legacyArgs.push("--skip-browser-open");
       }
+      if (options.injectSecret) {
+        legacyArgs.push("--inject-secret");
+      }
+      if (options.injectOpenaiKey) {
+        legacyArgs.push("--inject-openai-key");
+      }
 
       await invokeLegacy(legacyArgs);
     });

package/src/commands/scan.js

@@ -12,7 +12,7 @@ import {
   resolveProvider,
 } from "../ai/client.js";
 import { recordCliLlmSessionUsage, usageNumber } from "../billing/llm-session-usage.js";
-import { loadConfig, resolveOutputRoot } from "../config/service.js";
+import { loadConfig, resolveOutputRoot, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateModelCost } from "../cost/tracker.js";
@@ -34,6 +34,7 @@ import { detectRepoSlug, setupSecrets } from "../scan/gh-secrets.js";
 import { appendRunEvent, deriveStopClassFromBudget } from "../telemetry/ledger.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { authLoginHint } from "../ui/command-hints.js";
+import { exportCredentialToken, isAuthenticated } from "../auth/credential-destinations.js";
 
 const LEGACY_SCAN_WORKFLOW_PATH = ".github/workflows/security-review.yml";
 
@@ -578,7 +579,7 @@ export function registerScanCommand(program) {
         configModel: config.resolved.defaultModelId,
       });
       const explicitApiKey = String(options.apiKey || "").trim();
-      const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+      const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
       const prompt = buildAiPreScanPrompt({
         targetPath,
@@ -856,8 +857,9 @@ export function registerScanCommand(program) {
           env: process.env,
           autoRotate: false,
         });
-        if (session && session.token) {
-          tokenValue = session.token;
+        if (isAuthenticated(session)) {
+          // the one reviewed export of the token: to a GitHub Actions secret, through gh
+          tokenValue = exportCredentialToken(session.credential, { purpose: "github-actions-secret" });
         }
       } catch {
         /* no active auth session */

package/src/commands/session.js

@@ -7,6 +7,7 @@ import { spawn as defaultSpawn } from "node:child_process";
 
 import pc from "picocolors";
 
+import { credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { SentinelayerApiError, requestJsonMutation } from "../auth/http.js";
 import {
   buildProvisionEmailPayload,
@@ -15,7 +16,6 @@ import {
   resolveAidenIdCredentials,
 } from "../ai/aidenid.js";
 import { recordProvisionedIdentity } from "../ai/identity-store.js";
-import { readStoredSession } from "../auth/session-store.js";
 import { fetchAidenIdCredentials } from "../auth/service.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { resolveOutputRoot } from "../config/service.js";
@@ -1322,19 +1322,11 @@ async function resolveSessionRemoteSyncState({ dashboardUrl } = {}) {
     };
   }
 
-  let storedSession = null;
-  try {
-    storedSession = await readStoredSession();
-  } catch {
-    storedSession = null;
-  }
-  const apiUrl =
-    normalizeString(storedSession?.apiUrl) ||
-    normalizeString(process.env.SENTINELAYER_API_URL) ||
-    "https://api.sentinelayer.com";
-  const hasToken = Boolean(
-    normalizeString(storedSession?.token) || normalizeString(process.env.SENTINELAYER_TOKEN),
+  const auth = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
+    () => null,
   );
+  const apiUrl = normalizeString(auth?.apiUrl) || "https://api.sentinelayer.com";
+  const hasToken = isAuthenticated(auth);
   if (!hasToken) {
     return {
       status: "auth_required",
@@ -1458,12 +1450,12 @@ async function findReusableSessionCandidate({
 //   - When `SENTINELAYER_SKIP_REMOTE_SYNC=1` (test bootstrap), short-circuits
 //     to `{ ok: true, source: "skipped", session: null }` so unit tests
 //     can exercise the local materialization path without a real API.
-async function fetchRemoteSessionDetail(endpoint, headers) {
+async function fetchRemoteSessionDetail(endpoint, credential) {
   let response;
   let payload;
   try {
     ({ response, payload } = await fetchJsonWithFullTimeout(
-      endpoint, { method: "GET", headers, redirect: "error" }, 2_000,
+      endpoint, { method: "GET", credential, redirect: "error" }, 2_000,
     ));
   } catch (err) {
     return {
@@ -1516,7 +1508,7 @@ async function verifyRemoteSession(sessionId, { targetPath } = {}) {
   } catch {
     return { ok: false, reason: "no_session" };
   }
-  if (!auth || !auth.token) {
+  if (!isAuthenticated(auth)) {
     return { ok: false, reason: "not_authenticated", status: 401 };
   }
   const apiUrl = String(auth.apiUrl || "").replace(/\/+$/, "");
@@ -1524,10 +1516,10 @@ async function verifyRemoteSession(sessionId, { targetPath } = {}) {
     return { ok: false, reason: "no_api_url" };
   }
   const endpoint = `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}`;
-  const headers = { Authorization: `Bearer ${auth.token}` };
-  const firstAttempt = await fetchRemoteSessionDetail(endpoint, headers);
+  const credential = await credentialFor(auth);
+  const firstAttempt = await fetchRemoteSessionDetail(endpoint, credential);
   const detail = firstAttempt.retryable
-    ? await fetchRemoteSessionDetail(endpoint, headers)
+    ? await fetchRemoteSessionDetail(endpoint, credential)
     : firstAttempt;
   if (detail.ok) {
     return {
@@ -2782,7 +2774,7 @@ async function resolveAdminApiSession({ targetPath, explicitApiUrl }) {
     explicitApiUrl,
     autoRotate: true,
   });
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     throw new Error(`No active auth token found. Run \`${authLoginHint()}\` first.`);
   }
   return session;
@@ -2802,10 +2794,8 @@ async function postAdminSessionMutation({
   return requestJsonMutation(`${apiUrl}${pathSuffix}`, {
     method: "POST",
     operationName,
-    headers: {
-      Authorization: `Bearer ${normalizeString(session.token)}`,
-      ...headers,
-    },
+    credential: await credentialFor(session),
+    headers,
     body,
   });
 }
@@ -3306,7 +3296,7 @@ export function registerSessionCommand(program) {
         env: process.env,
         autoRotate: false,
       });
-      if (!session?.token || !session?.apiUrl) {
+      if (!isAuthenticated(session) || !session?.apiUrl) {
         throw new Error(`Not authenticated. Run \`${authLoginHint()}\` first.`);
       }
       const apiUrl = String(session.apiUrl).replace(/\/+$/, "");
@@ -3315,7 +3305,7 @@ export function registerSessionCommand(program) {
         {
           method: "POST",
           operationName: "session.set_title",
-          headers: { Authorization: `Bearer ${session.token}` },
+          credential: session.credential,
           body: { title: normalizedTitle },
         },
       );
@@ -3356,7 +3346,7 @@ export function registerSessionCommand(program) {
         env: process.env,
         autoRotate: false,
       });
-      if (!session?.token || !session?.apiUrl) {
+      if (!isAuthenticated(session) || !session?.apiUrl) {
         throw new Error(`Not authenticated. Run \`${authLoginHint()}\` first.`);
       }
       const apiUrl = String(session.apiUrl).replace(/\/+$/, "");
@@ -3365,7 +3355,7 @@ export function registerSessionCommand(program) {
         {
           method: "POST",
           operationName: "session.sweep_empty",
-          headers: { Authorization: `Bearer ${session.token}` },
+          credential: session.credential,
           body: {
             cutoffMinutes,
             maxEvents,
@@ -6400,7 +6390,7 @@ export function registerSessionCommand(program) {
           env: process.env,
           autoRotate: false,
         });
-        if (!authSession || !authSession.token) {
+        if (!isAuthenticated(authSession)) {
           throw new Error(`Remote session read requires authentication. Run \`${authLoginHint()}\` first.`);
         }
         hydration = await hydrateSessionFromRemote({
@@ -6674,13 +6664,13 @@ export function registerSessionCommand(program) {
           autoRotate: false,
         }).catch(() => null);
         const apiBaseUrl = session?.apiUrl || "";
-        const token = session?.token || "";
+        const credential = session?.credential || null;
         try {
           for await (const item of mergeLiveSources({
             sessionId: normalizedSessionId,
             targetPath,
             apiBaseUrl: apiBaseUrl || undefined,
-            token: token || undefined,
+            credential: credential || undefined,
             signal: ac.signal,
           })) {
             if (item.event) {
@@ -8603,21 +8593,19 @@ export function registerSessionCommand(program) {
         return;
       }
 
-      let storedSession = null;
-      try {
-        storedSession = await readStoredSession();
-      } catch {
-        storedSession = null;
-      }
+      const storedSession = await resolveActiveAuthSession({
+        cwd: process.cwd(),
+        env: process.env,
+        autoRotate: false,
+      }).catch(() => null);
 
-      const fetchCredentials =
-        storedSession && storedSession.token
-          ? () =>
-              fetchAidenIdCredentials({
-                apiUrl: storedSession.apiUrl,
-                token: storedSession.token,
-              })
-          : null;
+      const fetchCredentials = isAuthenticated(storedSession)
+        ? () =>
+            fetchAidenIdCredentials({
+              apiUrl: storedSession.apiUrl,
+              auth: storedSession,
+            })
+        : null;
       const credentials = await resolveAidenIdCredentials({
         apiKey: options.apiKey,
         orgId: options.orgId,

package/src/commands/spec.js

@@ -10,7 +10,7 @@ import {
   resolveProvider,
 } from "../ai/client.js";
 import { recordCliLlmSessionUsage, usageNumber } from "../billing/llm-session-usage.js";
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateModelCost } from "../cost/tracker.js";
@@ -265,7 +265,7 @@ async function maybeEnhanceSpecWithAi({
     configModel: config.resolved.defaultModelId,
   });
   const explicitApiKey = String(options.apiKey || "").trim();
-  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
   const prompt = buildAiSpecPrompt({
     baseSpecMarkdown,

package/src/commands/watch.js

@@ -13,6 +13,7 @@ import {
 } from "../auth/service.js";
 import { resolveOutputRoot } from "../config/service.js";
 import { authLoginHint } from "../ui/command-hints.js";
+import { isAuthenticated } from "../auth/credential-destinations.js";
 
 const TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "cancelled"]);
 
@@ -369,7 +370,7 @@ export function registerWatchCommand(program) {
         throw new Error(formatApiError(error));
       }
 
-      if (!session || !session.token) {
+      if (!isAuthenticated(session)) {
         throw new Error(`No active auth token found. Run \`${authLoginHint()}\` first.`);
       }
 
@@ -395,7 +396,7 @@ export function registerWatchCommand(program) {
         while (true) {
           const response = await listRuntimeRunEvents({
             apiUrl: session.apiUrl,
-            authToken: session.token,
+            credential: session.credential,
             runId,
             afterEventId,
           });
@@ -428,7 +429,7 @@ export function registerWatchCommand(program) {
 
           const statusResponse = await getRuntimeRunStatus({
             apiUrl: session.apiUrl,
-            authToken: session.token,
+            credential: session.credential,
             runId,
           });
           latestStatus = String(statusResponse?.status || "unknown").trim().toLowerCase();

package/src/config/service.js

@@ -67,12 +67,49 @@ function normalizeLayerScope(scope, { allowResolved = true } = {}) {
   return normalized;
 }
 
+// Values a workspace .sentinelayer.yml may not set for the user: where the user's token goes, the
+// token itself, provider keys, and where alerts are sent. They come from the environment (where a
+// variable is named) or the global config only.
+const USER_ONLY_KEYS = Object.freeze({
+  apiUrl: "SENTINELAYER_API_URL",
+  sentinelayerToken: "SENTINELAYER_TOKEN",
+  openaiApiKey: "OPENAI_API_KEY",
+  anthropicApiKey: "ANTHROPIC_API_KEY",
+  googleApiKey: "GOOGLE_API_KEY",
+  "alerts.channels": "",
+});
+const noticedProjectFiles = new Set();
+
+function workspaceSets(projectConfig, key) {
+  const [head, field] = key.split(".");
+  const value = projectConfig?.[head];
+  return field ? value?.[field] !== undefined : value !== undefined;
+}
+
+// One notice per workspace config that sets any of them, so an ignored value is never silent.
+function noticeIgnoredWorkspaceValues(projectPath, projectConfig) {
+  const keys = Object.keys(USER_ONLY_KEYS).filter((key) => workspaceSets(projectConfig, key));
+  if (keys.length === 0 || noticedProjectFiles.has(projectPath)) return;
+  noticedProjectFiles.add(projectPath);
+  const envs = keys.map((key) => USER_ONLY_KEYS[key]).filter(Boolean);
+  const instead = envs.length > 0 ? `set ${envs.join(", ")} or the global config` : "set them in the global config";
+  process.stderr.write(
+    `NOTICE: workspace .sentinelayer.yml ${keys.join(", ")} ignored; ${instead} (~/.sentinelayer/config.yml).\n`,
+  );
+}
+
+/** The user's own config values (global, then environment), never the workspace's. */
+export function userConfigValues(config) {
+  return { ...(config?.layers?.global || {}), ...(config?.layers?.env || {}) };
+}
+
 export async function loadConfig({ cwd = process.cwd(), env = process.env, homeDir } = {}) {
   const paths = getConfigPaths({ cwd, homeDir });
   const [globalConfig, projectConfig] = await Promise.all([
     readConfigFile(paths.global),
     readConfigFile(paths.project),
   ]);
+  noticeIgnoredWorkspaceValues(paths.project, projectConfig);
 
   const envConfig = buildEnvLayer(env);
   const resolved = configSchema.parse(mergeLayers(globalConfig, projectConfig, envConfig));

package/src/daemon/ast-parser-layer.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
-import { extname } from "node:path";
+import os from "node:os";
+import { extname, resolve as resolvePath } from "node:path";
 import { promisify } from "node:util";
 
 import { parse } from "@babel/parser";
@@ -149,7 +150,7 @@ async function resolvePythonExecutable() {
     pythonExecutablePromise = (async () => {
       for (const executable of PYTHON_EXECUTABLE_CANDIDATES) {
         try {
-          await execFileAsync(executable, ["--version"], { timeout: 5000 });
+          await execFileAsync(executable, ["--version"], { timeout: 5000, cwd: os.tmpdir() });
           return executable;
         } catch {
           continue;
@@ -193,9 +194,13 @@ async function parsePythonAstSpecifiers(absolutePath = "") {
     };
   }
   try {
-    const { stdout } = await execFileAsync(executable, ["-c", PYTHON_AST_SCRIPT, absolutePath], {
+    // Isolated (-I: no script or working directory on sys.path, no PYTHON* variables) and run from
+    // a neutral directory, so a repository's own ast.py or json.py is never imported; the file to
+    // parse is passed as an argument.
+    const { stdout } = await execFileAsync(executable, ["-I", "-c", PYTHON_AST_SCRIPT, resolvePath(absolutePath)], {
       timeout: 10000,
       maxBuffer: 1024 * 1024,
+      cwd: os.tmpdir(),
     });
     const parsed = JSON.parse(String(stdout || "{}"));
     const specifiers = Array.isArray(parsed.specifiers) ? parsed.specifiers : [];

package/src/daemon/callgraph-overlay.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import fsp from "node:fs/promises";
+import os from "node:os";
 import path, { extname } from "node:path";
 import { promisify } from "node:util";
 
@@ -370,7 +371,7 @@ async function resolvePythonExecutable() {
     pythonExecutablePromise = (async () => {
       for (const executable of PYTHON_EXECUTABLE_CANDIDATES) {
         try {
-          await execFileAsync(executable, ["--version"], { timeout: 5000 });
+          await execFileAsync(executable, ["--version"], { timeout: 5000, cwd: os.tmpdir() });
           return executable;
         } catch {
           continue;
@@ -454,9 +455,13 @@ async function parsePythonCallgraph(absolutePath = "", content = "", normalizedL
     };
   }
   try {
-    const { stdout } = await execFileAsync(executable, ["-c", PYTHON_CALLGRAPH_SCRIPT, absolutePath], {
+    // Isolated (-I: no script or working directory on sys.path, no PYTHON* variables) and run from
+    // a neutral directory, so a repository's own ast.py or json.py is never imported; the file to
+    // parse is passed as an argument.
+    const { stdout } = await execFileAsync(executable, ["-I", "-c", PYTHON_CALLGRAPH_SCRIPT, path.resolve(absolutePath)], {
       timeout: 15000,
       maxBuffer: 1024 * 1024,
+      cwd: os.tmpdir(),
     });
     const parsed = JSON.parse(String(stdout || "{}"));
     return {

package/src/daemon/pulse.js

@@ -226,7 +226,8 @@ export function buildHealthSummary(agentStates) {
 
 /**
  * Send an alert to configured Slack/Telegram webhooks.
- * Reads config from env or .sentinelayer.yml.
+ * Channels come from the caller or the environment (SENTINELAYER_SLACK_WEBHOOK_URL,
+ * SENTINELAYER_TELEGRAM_BOT_TOKEN, SENTINELAYER_TELEGRAM_CHAT_ID), never a workspace file.
  * Fails silently — alert delivery must never block agent work.
  *
  * @param {object} alert - { headline, body, severity } from buildAlertPayload