sentinelayer-cli 0.44.0 → 0.46.0

package/src/daemon/watchdog.js

@@ -1,8 +1,7 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
-import { parse as parseYaml } from "yaml";
-
+import { loadConfig } from "../config/service.js";
 import { listAssignments, resolveAssignmentLedgerStorage } from "./assignment-ledger.js";
 import { listBudgetStates } from "./budget-governor.js";
 import { listErrorQueue, resolveErrorDaemonStorage } from "./error-worker.js";
@@ -95,12 +94,48 @@ function normalizeBoolean(value, fallbackValue = false) {
   return fallbackValue;
 }
 
-function resolveEnvTemplate(value, env) {
-  const normalized = normalizeString(value);
-  if (!normalized) {
-    return "";
+// An alert channel may name its own settings by environment variable, and nothing else: a template
+// never reaches the user's token or a provider key, and a channel whose template cannot be filled
+// is refused rather than sent with a blank.
+const ALERT_TEMPLATE_NAMES = new Set(["SLACK_WEBHOOK_URL", "TELEGRAM_BOT_TOKEN", "TELEGRAM_CHAT_ID"]);
+const ALERT_TEMPLATE_PREFIX = /^SENTINELAYER_ALERT_[A-Z0-9_]+$/;
+const SLACK_WEBHOOK_HOST = "hooks.slack.com";
+const TELEGRAM_API_HOST = "api.telegram.org";
+const TELEGRAM_BOT_TOKEN_RE = /^\d+:[A-Za-z0-9_-]+$/;
+const TELEGRAM_CHAT_ID_RE = /^(?:-?\d+|@[A-Za-z0-9_]+)$/;
+
+class AlertChannelRefused extends Error {}
+
+function isAlertTemplateName(name) {
+  return ALERT_TEMPLATE_NAMES.has(name) || ALERT_TEMPLATE_PREFIX.test(name);
+}
+
+function resolveAlertTemplate(value, env) {
+  return normalizeString(value).replace(/\$\{([^}]*)\}/g, (_, name) => {
+    if (!isAlertTemplateName(name)) {
+      throw new AlertChannelRefused(
+        `\${${name}} is not an alert setting; alert channels may use SLACK_WEBHOOK_URL, TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID or SENTINELAYER_ALERT_* only.`
+      );
+    }
+    const resolved = normalizeString(env?.[name]);
+    if (!resolved) {
+      throw new AlertChannelRefused(`\${${name}} is not set.`);
+    }
+    return resolved;
+  });
+}
+
+function slackWebhookUrl(value) {
+  let url = null;
+  try {
+    url = new URL(value);
+  } catch {
+    // refused below
   }
-  return normalized.replace(/\$\{([A-Z0-9_]+)\}/g, (_, key) => normalizeString(env[key]));
+  if (!url || url.protocol !== "https:" || url.hostname !== SLACK_WEBHOOK_HOST || url.port || url.username || url.password) {
+    throw new AlertChannelRefused(`Slack alerts are sent only to https://${SLACK_WEBHOOK_HOST}/.`);
+  }
+  return url.href;
 }
 
 function computeSecondsSince(previousIso, nowIso) {
@@ -282,72 +317,71 @@ function buildRunId(nowIso, count) {
   return `watchdog-${token}-${String(count).padStart(4, "0")}`;
 }
 
+// A refused channel stays in the list with its reason, so it is reported and never sent.
 function normalizeChannel(channel = {}, env = process.env) {
   const type = normalizeString(channel.type).toLowerCase();
-  if (type === "slack") {
-    const webhookUrl = resolveEnvTemplate(
-      channel.webhook_url || channel.webhookUrl || channel.url || "",
-      env
-    );
-    return webhookUrl
-      ? {
-          type: "slack",
-          webhookUrl,
-        }
-      : null;
-  }
-  if (type === "telegram") {
-    const botToken = resolveEnvTemplate(channel.bot_token || channel.botToken || "", env);
-    const chatId = resolveEnvTemplate(channel.chat_id || channel.chatId || "", env);
-    return botToken && chatId
-      ? {
-          type: "telegram",
-          botToken,
-          chatId,
-        }
-      : null;
-  }
-  return null;
-}
-
-async function loadWatchdogConfig({ targetPath = ".", env = process.env } = {}) {
-  const configPath = path.join(path.resolve(String(targetPath || ".")), ".sentinelayer.yml");
-  const fallback = {
-    channels: [],
-    frequency: "smart",
-    events: ["agent_stuck", "budget_warning", "alert_recovered"],
-  };
   try {
-    const parsed = parseYaml(await fsp.readFile(configPath, "utf-8")) || {};
-    const alerts = parsed && typeof parsed === "object" ? normalizeObject(parsed.alerts) : {};
-    const channels = Array.isArray(alerts.channels)
-      ? alerts.channels.map((channel) => normalizeChannel(channel, env)).filter(Boolean)
-      : [];
-    const events = Array.isArray(alerts.events)
-      ? alerts.events
-          .map((eventType) => normalizeString(eventType))
-          .filter((eventType) => WATCHDOG_EVENT_SET.has(eventType))
-      : fallback.events;
-    const frequency = normalizeString(alerts.frequency).toLowerCase() || fallback.frequency;
-    return {
-      configPath,
-      exists: true,
-      channels,
-      frequency,
-      events: events.length > 0 ? events : fallback.events,
-    };
+    if (type === "slack") {
+      const webhookUrl = resolveAlertTemplate(
+        channel.webhook_url || channel.webhookUrl || channel.url || "",
+        env
+      );
+      return webhookUrl ? { type: "slack", webhookUrl: slackWebhookUrl(webhookUrl) } : null;
+    }
+    if (type === "telegram") {
+      const botToken = resolveAlertTemplate(channel.bot_token || channel.botToken || "", env);
+      const chatId = resolveAlertTemplate(channel.chat_id || channel.chatId || "", env);
+      if (!botToken || !chatId) {
+        return null;
+      }
+      if (!TELEGRAM_BOT_TOKEN_RE.test(botToken) || !TELEGRAM_CHAT_ID_RE.test(chatId)) {
+        throw new AlertChannelRefused("The Telegram bot token or chat id is not in Telegram's format.");
+      }
+      return { type: "telegram", botToken, chatId };
+    }
   } catch (error) {
-    if (error && typeof error === "object" && error.code === "ENOENT") {
-      return {
-        configPath,
-        exists: false,
-        channels: [],
-        frequency: fallback.frequency,
-        events: fallback.events,
-      };
+    if (error instanceof AlertChannelRefused) {
+      return { type, error: error.message };
     }
     throw error;
   }
+  return null;
+}
+
+// What a channel is, without its secrets (webhook URLs and bot tokens are credentials).
+function describeChannel(channel) {
+  if (channel.error) {
+    return { type: channel.type, error: channel.error };
+  }
+  return {
+    type: channel.type,
+    destination: channel.type === "slack" ? SLACK_WEBHOOK_HOST : TELEGRAM_API_HOST,
+  };
+}
+
+// Where alerts are sent comes from the user's own config (~/.sentinelayer/config.yml) only; a
+// workspace .sentinelayer.yml may choose which events alert, not where they go.
+async function loadWatchdogConfig({ targetPath = ".", env = process.env, homeDir } = {}) {
+  const config = await loadConfig({ cwd: path.resolve(String(targetPath || ".")), env, homeDir });
+  const configPath = config.paths.global;
+  const fallbackEvents = ["agent_stuck", "budget_warning", "alert_recovered"];
+  const userAlerts = normalizeObject(config.layers.global?.alerts);
+  const alerts = normalizeObject(config.resolved.alerts);
+  const channels = Array.isArray(userAlerts.channels)
+    ? userAlerts.channels.map((channel) => normalizeChannel(channel, env)).filter(Boolean)
+    : [];
+  const events = Array.isArray(alerts.events)
+    ? alerts.events
+        .map((eventType) => normalizeString(eventType))
+        .filter((eventType) => WATCHDOG_EVENT_SET.has(eventType))
+    : fallbackEvents;
+  return {
+    configPath,
+    exists: await fsp.access(configPath).then(() => true, () => false),
+    channels,
+    frequency: normalizeString(alerts.frequency).toLowerCase() || "smart",
+    events: events.length > 0 ? events : fallbackEvents,
+  };
 }
 
 function buildDetection({
@@ -581,6 +615,7 @@ function formatAlertMessage(alert = {}) {
 async function sendSlackAlert(channel, message, fetchImpl) {
   const response = await fetchImpl(channel.webhookUrl, {
     method: "POST",
+    redirect: "error",
     headers: {
       "content-type": "application/json",
     },
@@ -594,9 +629,10 @@ async function sendSlackAlert(channel, message, fetchImpl) {
 }
 
 async function sendTelegramAlert(channel, message, fetchImpl) {
-  const endpoint = `https://api.telegram.org/bot${channel.botToken}/sendMessage`;
+  const endpoint = `https://${TELEGRAM_API_HOST}/bot${channel.botToken}/sendMessage`;
   const response = await fetchImpl(endpoint, {
     method: "POST",
+    redirect: "error",
     headers: {
       "content-type": "application/json",
     },
@@ -618,6 +654,17 @@ async function dispatchAlertToChannel({
   fetchImpl = globalThis.fetch,
 }) {
   const message = formatAlertMessage(alert);
+  if (channel.error) {
+    return {
+      channelType: channel.type,
+      alertId: alert.alertId,
+      eventType: alert.eventType,
+      sent: false,
+      dryRun: false,
+      message,
+      error: channel.error,
+    };
+  }
   if (!execute) {
     return {
       channelType: channel.type,
@@ -750,6 +797,7 @@ export async function runWatchdogTick({
   const config = await loadWatchdogConfig({
     targetPath,
     env,
+    homeDir,
   });
 
   const [assignments, queue, budgets, previousState] = await Promise.all([
@@ -916,6 +964,7 @@ export async function getWatchdogStatus({
   const config = await loadWatchdogConfig({
     targetPath,
     env,
+    homeDir,
   });
   const state = await readJsonFile(storage.watchdogStatePath, () =>
     createInitialState(normalizedNow)
@@ -959,7 +1008,7 @@ export async function getWatchdogStatus({
     ...storage,
     configPath: config.configPath,
     configExists: config.exists,
-    config,
+    config: { ...config, channels: config.channels.map(describeChannel) },
     statePath: storage.watchdogStatePath,
     eventsPath: storage.watchdogEventsPath,
     state,

package/src/legacy-cli.js

@@ -20,6 +20,12 @@ import {
   listSupportedCodingAgents,
   resolveCodingAgent,
 } from "./config/agent-dictionary.js";
+import {
+  CredentialDestinationRefused,
+  credentialedRequest,
+  resolveTrustContext,
+  userCredential,
+} from "./auth/credential-destinations.js";
 import { resolveOutputRoot } from "./config/service.js";
 import { normalizeAgentEvent } from "./events/schema.js";
 import { collectCodebaseIngest, formatIngestSummary } from "./ingest/engine.js";
@@ -143,6 +149,8 @@ function parseCliArgs(argv) {
   let interviewFile = "";
   let nonInteractive = boolFromEnv(process.env.SENTINELAYER_CLI_NON_INTERACTIVE);
   let skipBrowserOpen = boolFromEnv(process.env.SENTINELAYER_CLI_SKIP_BROWSER_OPEN);
+  let injectSecret = false;
+  let injectOpenAiKey = false;
   let showHelp = false;
   let showVersion = false;
 
@@ -165,6 +173,14 @@ function parseCliArgs(argv) {
       skipBrowserOpen = true;
       continue;
     }
+    if (arg === "--inject-secret") {
+      injectSecret = true;
+      continue;
+    }
+    if (arg === "--inject-openai-key") {
+      injectOpenAiKey = true;
+      continue;
+    }
     if (arg === "--interview-file") {
       const next = String(argv[i + 1] || "").trim();
       if (!next) {
@@ -189,6 +205,8 @@ function parseCliArgs(argv) {
     interviewFile,
     nonInteractive,
     skipBrowserOpen,
+    injectSecret,
+    injectOpenAiKey,
     showHelp,
     showVersion,
   };
@@ -290,6 +308,8 @@ function printUsage() {
   console.log("  --json                 Machine-readable JSON output");
   console.log("  --path PATH            Target workspace path");
   console.log("  --non-interactive      Disable prompts (require --interview-file)");
+  console.log("  --inject-secret        init: set the project token as a GitHub Actions secret on this directory's git remote");
+  console.log("  --inject-openai-key    init: also set OPENAI_API_KEY from your environment as a secret there");
   console.log("");
   console.log("Quickstart:");
   console.log("  sl auth login && npx create-sentinelayer my-app && cd my-app");
@@ -450,11 +470,18 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-async function requestJson(url, { method = "GET", headers = {}, body, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS } = {}) {
+async function requestJson(
+  url,
+  { method = "GET", headers = {}, body, credential = null, timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS } = {},
+) {
+  // Without a credential, nothing here attaches one: a caller-built Authorization header is refused.
+  if (Object.keys(headers || {}).some((name) => /^(?:proxy-)?authorization$/i.test(name))) {
+    throw new TypeError("requestJson: send a credential with { credential }, not an Authorization header.");
+  }
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetch(url, {
+    const init = {
       method,
       headers: {
         "Content-Type": "application/json",
@@ -462,7 +489,9 @@ async function requestJson(url, { method = "GET", headers = {}, body, timeoutMs
       },
       body: body === undefined ? undefined : JSON.stringify(body),
       signal: controller.signal,
-    });
+    };
+    // A credential (src/auth/credential-destinations.js) goes only to its own origin.
+    const response = credential ? await credentialedRequest(credential, url, init) : await fetch(url, init);
 
     const text = await response.text();
     let payload = null;
@@ -491,7 +520,7 @@ async function requestJson(url, { method = "GET", headers = {}, body, timeoutMs
     }
     return payload;
   } catch (error) {
-    if (error instanceof SentinelayerApiError) {
+    if (error instanceof SentinelayerApiError || error instanceof CredentialDestinationRefused) {
       throw error;
     }
     if (error instanceof Error && error.name === "AbortError") {
@@ -551,26 +580,25 @@ async function pollCliSession({
   });
 }
 
-async function generateArtifacts({ apiUrl, authToken, payload }) {
+async function generateArtifacts({ apiUrl, credential, payload }) {
   return requestJson(`${apiUrl}/api/v1/builder/generate`, {
     method: "POST",
-    headers: {
-      Authorization: `Bearer ${authToken}`,
-    },
+    credential,
     body: payload,
     timeoutMs: 180_000,
   });
 }
 
-async function issueBootstrapToken({ apiUrl, authToken }) {
+async function issueBootstrapToken({ apiUrl, credential }) {
   return requestJson(`${apiUrl}/api/v1/builder/bootstrap-token`, {
     method: "POST",
-    headers: {
-      Authorization: `Bearer ${authToken}`,
-    },
+    credential,
   });
 }
 
+// The init flow's credential steps, for tests.
+export const __legacyCredentialFlowForTests = Object.freeze({ pollCliSession, generateArtifacts, issueBootstrapToken, requestJson });
+
 function detectRepoSlug(cwd) {
   const gitRemote = spawnSync("git", ["config", "--get", "remote.origin.url"], {
     cwd,
@@ -2748,6 +2776,35 @@ Continue autonomously unless blocked by missing credentials or permissions.`,
   };
 }
 
+// The repository that receives GitHub Actions secrets is shown, and gh must confirm that the
+// signed-in user can write to it.
+function confirmSecretsRepository(repoSlug) {
+  printInfo(`GitHub Actions secrets target: ${repoSlug} (the git remote of ${process.cwd()})`);
+  if (!isValidRepoSlug(repoSlug)) {
+    return { ok: false, reason: "Invalid repo format. Use owner/repo." };
+  }
+  const ghCommand = getGhCommand();
+  try {
+    ensureGhCliAvailable(ghCommand);
+  } catch (error) {
+    return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+  }
+  const view = spawnSync(ghCommand, ["api", `repos/${repoSlug}`], { encoding: "utf-8" });
+  if (view.status !== 0) {
+    return { ok: false, reason: `gh could not read ${repoSlug}: ${String(view.stderr || view.stdout || "").trim()}` };
+  }
+  let permissions = {};
+  try {
+    permissions = JSON.parse(String(view.stdout || "{}")).permissions || {};
+  } catch {
+    // unreadable output: not confirmed
+  }
+  if (!(permissions.admin || permissions.maintain || permissions.push)) {
+    return { ok: false, reason: `the signed-in gh user cannot write to ${repoSlug}.` };
+  }
+  return { ok: true };
+}
+
 function runGhSecretSet({ repoSlug, secretName, secretValue }) {
   const normalizedRepo = normalizeRepoSlug(repoSlug);
   const ghCommand = getGhCommand();
@@ -3097,8 +3154,10 @@ async function collectInterview({ initialProjectName, detectedRepo, detectedCodi
           {
             type: base.authMode === "sentinelayer" ? "toggle" : null,
             name: "injectSecret",
-            message: "Inject SENTINELAYER_TOKEN into GitHub Actions secrets now?",
-            initial: true,
+            message: `Set the project token as a GitHub Actions secret on this directory's git remote${
+              detectedRepo ? ` (${detectedRepo})` : ""
+            }?`,
+            initial: false,
             active: "yes",
             inactive: "no",
           },
@@ -3192,6 +3251,9 @@ function printInfo(message) {
 
 export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
   refreshRuntimeDefaults();
+  // The API this flow talks to is the trust context's (environment, then global config): the token
+  // it is issued may only be sent there, and a workspace .sentinelayer.yml does not choose it.
+  DEFAULT_API_URL = (await resolveTrustContext()).apiOrigin;
   const commandExitCode = await tryRunLocalCommandMode(rawArgs);
   if (commandExitCode !== null) {
     if (commandExitCode !== 0) {
@@ -3243,6 +3305,15 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
     );
   }
   validateInterviewInput(interview);
+  const secretsOptIn = {
+    projectToken: Boolean(args.injectSecret || interview.injectSecret),
+    openAiKey: Boolean(args.injectOpenAiKey),
+  };
+  if ((secretsOptIn.projectToken || secretsOptIn.openAiKey) && process.env.SENTINELAYER_MCP_BRIDGE === "1") {
+    throw new Error(
+      "GitHub Actions secrets are not set through the MCP bridge. Run `sl init --inject-secret` in your own terminal."
+    );
+  }
 
   const workspace = await resolveProjectDirectory({
     cwd: process.cwd(),
@@ -3264,7 +3335,7 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
   }
 
   const requestedAuthMode = interview.authMode === "byok" ? "byok" : "sentinelayer";
-  let authToken = "";
+  let authCredential = null;
 
   printSection("Authentication");
   if (requestedAuthMode === "byok") {
@@ -3304,8 +3375,8 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       timeoutMs: DEFAULT_AUTH_TIMEOUT_MS,
     });
 
-    authToken = String(approval.auth_token || "").trim();
-    if (!authToken) {
+    authCredential = await userCredential(approval.auth_token, { source: "init_approval" });
+    if (!authCredential) {
       throw new Error("Authentication completed but no auth token was returned.");
     }
   }
@@ -3343,7 +3414,7 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
   } else {
     generated = await generateArtifacts({
       apiUrl: DEFAULT_API_URL,
-      authToken,
+      credential: authCredential,
       payload: generatePayload,
     });
 
@@ -3352,7 +3423,7 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       try {
         bootstrapToken = await issueBootstrapToken({
           apiUrl: DEFAULT_API_URL,
-          authToken,
+          credential: authCredential,
         });
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -3538,24 +3609,30 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
     repoSlug: interview.connectRepo ? interview.repoSlug : "",
   });
 
-  const repoSlugForSecrets = normalizeRepoSlug(interview.repoSlug || detectRepoSlug(projectDir) || "");
-  const openAiApiKey = String(process.env.OPENAI_API_KEY || "").trim();
+  // GitHub Actions secrets are set only on an explicit opt-in (--inject-secret, or injectSecret in
+  // the interview, outside the MCP bridge), only on this directory's own git remote (never a slug
+  // from the interview), and only after gh confirms the signed-in user can write to it.
+  // OPENAI_API_KEY is set only with its own --inject-openai-key.
   const secretTargets = [];
-  if (sentinelayerToken) {
+  if (sentinelayerToken && secretsOptIn.projectToken) {
     secretTargets.push({
       secretName,
       secretValue: sentinelayerToken,
       placeholder: "<sentinelayer-token>",
     });
   }
-  secretTargets.push({
-    secretName: "OPENAI_API_KEY",
-    secretValue: openAiApiKey,
-    placeholder: "<your-openai-api-key>",
-  });
+  if (secretsOptIn.openAiKey) {
+    secretTargets.push({
+      secretName: "OPENAI_API_KEY",
+      secretValue: String(process.env.OPENAI_API_KEY || "").trim(),
+      placeholder: "<your-openai-api-key>",
+    });
+  }
+  const repoSlugForSecrets = secretTargets.length > 0 ? normalizeRepoSlug(detectedRepo || "") : "";
+  const secretsRepoCheck = repoSlugForSecrets ? confirmSecretsRepository(repoSlugForSecrets) : null;
 
   const githubSecretResults = [];
-  if (repoSlugForSecrets) {
+  if (repoSlugForSecrets && secretsRepoCheck.ok) {
     for (const target of secretTargets) {
       const value = String(target.secretValue || "").trim();
       if (!value) {
@@ -3627,14 +3704,14 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       pc.green(`✔ ${codingAgentConfig.agent.name} config scaffolded at ${codingAgentConfig.path}`)
     );
   }
-  if (repoSlugForSecrets) {
+  if (repoSlugForSecrets && secretsRepoCheck.ok) {
     for (const result of githubSecretResults) {
       if (result.ok) {
-        console.log(pc.green(`✔ ${result.secretName} injected into GitHub repo secret (${repoSlugForSecrets})`));
+        console.log(pc.green(`✔ ${result.secretName} set as a GitHub Actions secret on ${repoSlugForSecrets}`));
         continue;
       }
       const stateLabel = result.skipped ? "skipped" : "failed";
-      console.log(pc.yellow(`! GitHub secret injection ${stateLabel} for ${result.secretName}: ${result.reason}`));
+      console.log(pc.yellow(`! GitHub secret ${stateLabel} for ${result.secretName}: ${result.reason}`));
       console.log(
         pc.yellow(
           `  Run manually: gh secret set ${result.secretName} --repo ${repoSlugForSecrets} --body ${result.placeholder}`
@@ -3642,18 +3719,21 @@ export async function runLegacyCli(rawArgs = process.argv.slice(2)) {
       );
     }
   } else if (secretTargets.length > 0) {
-    console.log(
-      pc.yellow(
-        "! GitHub secret auto-injection skipped: no repo slug detected. Connect a repo or run manual secret commands."
-      )
-    );
+    const reason = repoSlugForSecrets
+      ? secretsRepoCheck.reason
+      : "this directory has no GitHub git remote.";
+    console.log(pc.yellow(`! GitHub Actions secrets not set: ${reason}`));
     for (const target of secretTargets) {
       console.log(
-        pc.yellow(
-          `  Run manually: gh secret set ${target.secretName} --repo <owner/repo> --body ${target.placeholder}`
-        )
+        pc.yellow(`  Run manually: gh secret set ${target.secretName} --repo <owner/repo> --body ${target.placeholder}`)
       );
     }
+  } else if (sentinelayerToken) {
+    console.log(
+      pc.gray(
+        `GitHub Actions secrets were not set. To set ${secretName} on this directory's git remote, rerun with --inject-secret, or run: gh secret set ${secretName} --repo <owner/repo>`
+      )
+    );
   }
 
   console.log("\nNext:");