sentinelayer-cli 0.44.0 → 0.46.0

package/src/mcp/bridge-inputs.js

@@ -0,0 +1,223 @@
+// bridge-inputs.js -- the inputs the MCP CLI bridge exposes, command by command.
+//
+// Default-deny. An input not listed for its command is not exposed; a command with no entry,
+// or with an argument or a required option that is not listed, is not exposed at all. Commands
+// the bridge blocks outright (src/mcp/cli-command-tools.js) need no entry. DENIED records each
+// input deliberately left out, and why. A unit test walks the command tree and fails on any
+// input of an exposed command that is in neither list, and on entries that name nothing.
+//
+// Nothing that names where a request goes (a URL, host, origin, endpoint or gateway) is allowed:
+// a tool caller never chooses a destination for this machine's credentials. Those commands use
+// the configured API and pocket gateway. Nor is anything that names a program to run (an
+// executable, binary, shell, command or script) or turns off a safety check (a sandbox, approval
+// or similar bypass): a tool caller never chooses what this machine executes, or how freely.
+
+/** Command path (dotted, as in the tool name after "sl.") -> its exposed inputs, space-separated. */
+export const BRIDGE_ALLOWED_INPUTS = Object.freeze({
+  "ai.identity.audit": "path outputDir stale json",
+  "ai.identity.lineage": "identityId path outputDir apiKey orgId projectId json",
+  "ai.identity.list": "path outputDir json",
+  "ai.identity.show": "identityId path outputDir json",
+  "apply": "plan path outputDir json",
+  "audit.architecture": "path registryFile outputDir refresh dryRun json",
+  "audit.compliance": "path registryFile outputDir refresh dryRun json",
+  "audit.diff": "baseRunId candidateRunId path outputDir json",
+  "audit.documentation": "path registryFile outputDir refresh dryRun json",
+  "audit.frontend": "path mode maxCost maxTurns provider model apiKey stream refresh skipBaseline skipRuntime outputDir json",
+  "audit.local": "path outputDir reuseOmargate json",
+  "audit.package": "path runId outputDir json",
+  "audit.performance": "path registryFile outputDir refresh dryRun json",
+  "audit.registry": "registryFile json",
+  "audit.replay": "runId path registryFile outputDir refresh json",
+  "audit.security": "path registryFile outputDir refresh dryRun json",
+  "audit.testing": "path registryFile outputDir refresh dryRun json",
+  "board.check": "file json",
+  "chat.ask": "prompt provider model apiKey path outputDir sessionId dryRun stream json",
+  "cost.record": "path outputDir sessionId provider model inputTokens outputTokens cacheReadTokens cacheWriteTokens durationMs toolCalls costUsd progressScore maxCost maxTokens maxRuntimeMs maxToolCalls maxNoProgress warnAtPercent json",
+  "cost.show": "path outputDir json",
+  "daemon.assign.claim": "workItemId path outputDir agent leaseTtlSeconds stage runId jiraIssueKey budgetSnapshotJson json",
+  "daemon.assign.heartbeat": "workItemId path outputDir agent leaseTtlSeconds stage runId jiraIssueKey budgetSnapshotJson json",
+  "daemon.assign.list": "path outputDir status agent includeExpired limit json",
+  "daemon.assign.reassign": "workItemId path outputDir fromAgent toAgent leaseTtlSeconds stage runId jiraIssueKey budgetSnapshotJson json",
+  "daemon.assign.release": "workItemId path outputDir agent status stage runId jiraIssueKey reason budgetSnapshotJson json",
+  "daemon.budget.check": "workItemId path outputDir usageJson budgetJson nowIso json",
+  "daemon.budget.status": "path outputDir workItemId lifecycleState limit json",
+  "daemon.control.snapshot": "path outputDir status agent limit nowIso json",
+  "daemon.error.queue": "path outputDir status limit json",
+  // endpoint: a route label written to the local error intake; nothing is sent to it
+  "daemon.error.record": "path outputDir source service endpoint errorCode severity message stack commitSha metadataJson json",
+  "daemon.error.worker": "path outputDir maxEvents json",
+  "daemon.jira.comment": "path outputDir workItemId issueKey actor type message json",
+  "daemon.jira.list": "path outputDir workItemId issueKey status limit json",
+  "daemon.jira.open": "workItemId path outputDir summary description labels assignee issueKey issueKeyPrefix actor json",
+  "daemon.jira.start": "workItemId plan path outputDir actor assignee summary description labels issueKey issueKeyPrefix json",
+  "daemon.jira.transition": "path outputDir workItemId issueKey to actor reason json",
+  "daemon.lineage.build": "path outputDir nowIso json",
+  "daemon.lineage.list": "path outputDir status workItemId limit json",
+  "daemon.lineage.show": "workItemId path outputDir json",
+  "daemon.maintenance.off": "path outputDir reason message actor json",
+  "daemon.maintenance.on": "path outputDir reason message actor json",
+  "daemon.maintenance.status": "path outputDir json",
+  "daemon.map.handoff": "workItemId path outputDir runId assignee maxFiles nowIso json",
+  "daemon.map.handoff-list": "path outputDir workItemId limit json",
+  "daemon.map.handoff-show": "workItemId path outputDir handoffRunId json",
+  "daemon.map.list": "path outputDir workItemId limit json",
+  "daemon.map.scope": "workItemId path outputDir maxFiles graphDepth nowIso json",
+  "daemon.map.show": "workItemId path outputDir runId json",
+  "daemon.reliability.run": "path outputDir region timezone simulateFailure checks maintenanceAutoOpen clearMaintenanceOnPass nowIso json",
+  "daemon.reliability.status": "path outputDir limit json",
+  "daemon.watchdog.run": "path outputDir toolCallSeconds repeatedFileReadsThreshold budgetWarningThreshold turnStallTurns limit execute nowIso json",
+  "daemon.watchdog.status": "path outputDir limit json",
+  "guide.export": "format path specFile outputFile enrich provider model apiKey maxPhases maxPrsPerPhase json",
+  "guide.generate": "path specFile outputFile json",
+  "guide.show": "path file plain json",
+  "ingest.map": "path outputFile outputDir json",
+  "init": "projectName nonInteractive interviewFile skipBrowserOpen",
+  "mcp.bridge.init-vscode": "serverId serverConfig path force json",
+  "mcp.doctor": "timeoutMs json",
+  "mcp.list": "path json",
+  "mcp.registry.init-aidenid": "path outputDir force json",
+  "mcp.registry.init-aidenid-adapter": "registryFile path outputDir force json",
+  "mcp.registry.init-cli": "path outputDir force json",
+  "mcp.registry.init-hosted-session-connector": "registryFile path outputDir force json",
+  "mcp.registry.init-senti-session": "path outputDir force json",
+  "mcp.registry.init-session": "path outputDir force json",
+  "mcp.registry.validate": "file json",
+  "mcp.registry.validate-aidenid-adapter": "file registryFile json",
+  "mcp.registry.validate-hosted-session-connector": "file registryFile json",
+  "mcp.schema.show": "json",
+  "mcp.schema.write": "path outputDir force json",
+  "mcp.server.init": "id registryFile path outputDir force json",
+  "mcp.server.validate": "file json",
+  "mcp.smoke": "session limit scope ttlSeconds timeoutMs autoRotate json",
+  "omargate.deep": "path outputDir ai aiDryRun scopeMode diff staged scanMode maxParallel model provider maxCost notifySession requireUsageLedger persona skipPersona stream json",
+  "persona.orchestrator": "mode path outputDir json",
+  "persona.run": "personaId mode path files json",
+  "plugin.init": "id packType stage path outputDir force json",
+  "plugin.list": "path outputDir json",
+  "plugin.order": "path stage outputDir json",
+  "plugin.validate": "file json",
+  "policy.list": "path outputDir json",
+  "prompt.generate": "path specFile agent outputFile outputDir refresh json",
+  "prompt.preview": "path specFile agent maxLines outputDir refresh plain json",
+  "prompt.show": "path file agent plain json",
+  "review.accept": "findingId runId path outputDir note actor json",
+  "review.defer": "findingId runId path outputDir note actor json",
+  "review.diff": "baseRunId candidateRunId path outputDir outputFile json",
+  "review.reject": "findingId runId path outputDir note actor json",
+  "review.replay": "runId path spec outputDir refresh ai aiDryRun json",
+  "review.scan": "mode diff staged path spec outputDir refresh json",
+  "ring-owner": "question session kind option whatWeNeed checkpoint idempotencyKey json",
+  "scan.init": "path specFile workflowFile secretName hasE2eTests playwrightMode nonInteractive json",
+  "scan.precheck": "path specFile outputFile outputDir hasE2eTests playwrightMode provider model apiKey sessionId maxCost maxTokens maxRuntimeMs maxToolCalls maxNoProgress warnAtPercent json",
+  "scan.validate": "path specFile workflowFile secretName hasE2eTests playwrightMode json",
+  "session.action": "sessionId actionType targetSequence targetCursor targetActionId note agent idempotencyKey path json",
+  "session.actions": "json",
+  "session.checkpoint.create": "sessionId startSequence endSequence title summary summaryFile kind checkpointId agent tokenStart tokenEnd path json",
+  "session.checkpoint.generate": "sessionId minEvents maxEvents catchUp maxCheckpoints operationId agent path json",
+  "session.checkpoint.list": "sessionId limit path json",
+  "session.checkpoint.show": "sessionId checkpointId contextEvents maxEvents path json",
+  "session.comment": "sessionId targetSequenceId message agent idempotencyKey path json",
+  "session.continue": "path title json",
+  "session.edit": "sessionId target message agent expectedRevision idempotencyKey path json",
+  "session.ensure": "path session title ttlSeconds forceNew resume reuseWindowSeconds json",
+  "session.guard": "sessionId files agent path json",
+  "session.guard-hook": "sessionId agent path",
+  "session.guard-install": "sessionId agent path json",
+  "session.guard-uninstall": "sessionId agent path json",
+  "session.history": "limit preview path json",
+  "session.inject-guide": "sessionId path json",
+  "session.join": "sessionId name agent inviteToken seatKey idempotencyKey role model path goal deliverable stopWhen scope ttl provider wait waitSeconds cancelAdmission json",
+  "session.leave": "sessionId agent reason path json",
+  "session.list": "remote includeArchived limit path json",
+  "session.listeners": "sessionId path limit maxPages json",
+  "session.lock": "sessionId files intent ttl agent path json",
+  "session.locks": "sessionId path json",
+  "session.observe": "sessionId summary agent model displayName role kind severity owner batch targetSequence targetCursor proposal messageFile stdin path json",
+  "session.pins": "sessionId path json",
+  "session.post-agent": "sessionId message agent model displayName role to path json",
+  "session.react": "sessionId reaction targetSequence targetCursor targetActionId agent idempotencyKey path json",
+  "session.read": "sessionId tail follow live remote beforeSequence actions agent view includeControlEvents path json",
+  "session.recall": "need session role k path remote includeControlEvents json",
+  "session.recap.now": "sessionId session remote agent maxEvents path json",
+  "session.renew": "sessionId files ttl agent path json",
+  "session.reply": "sessionId targetSequenceId message agent idempotencyKey path json",
+  "session.say": "sessionId message agent model displayName role to replyTo replyCursor messageFile stdin forceCliUser localOnly path json",
+  "session.search": "sessionId query beforeSequence limit path json",
+  "session.set-title": "sessionId title path json",
+  "session.setup-guides": "sessionId path json",
+  "session.start": "path title template ttlSeconds forceNew force resume reuseWindowSeconds daemon json",
+  "session.status": "sessionId path json",
+  "session.stop-listener": "sessionId agent path json",
+  "session.sync": "sessionId since path json",
+  "session.templates": "json",
+  "session.ticket.claim": "sessionId ticketId expectedVersion agent path json",
+  "session.ticket.events": "sessionId after agent path json",
+  "session.ticket.list": "sessionId available agent path json",
+  "session.ticket.release": "sessionId ticketId reason agent path json",
+  "session.ticket.renew": "sessionId ticketId agent path json",
+  "session.ticket.submit": "sessionId ticketId sha evidenceFile agent path json",
+  "session.unlock": "sessionId files intent agent path json",
+  "session.usage": "sessionId remote recent format out path json",
+  "session.wake.codex-notify": "sessionId notificationJson session agent notification path json",
+  // host and resumeSession: the local host adapter (claude|codex) and its session to resume
+  "session.wake.daemon": "sessionId session agent host resumeSession cwd idleMs maxAttempts once json",
+  "spec.generate": "path template description projectType outputFile outputDir refresh ai provider model apiKey sessionId maxCost maxTokens maxRuntimeMs maxToolCalls maxNoProgress warnAtPercent json",
+  "spec.list-templates": "json",
+  "spec.regenerate": "path file template description projectType refresh dryRun diff plain maxDiffLines preserveManual json",
+  "spec.show": "path file plain json",
+  "spec.show-template": "templateId json",
+  "swarm.create": "path outputDir scenario penTestScenario targetId execute json",
+  "swarm.dashboard": "path runId outputDir watch pollSeconds maxIdleSeconds json",
+  "swarm.plan": "targetPath path registryFile agents scenario objective maxParallel maxCostUsd maxOutputTokens maxRuntimeMs maxToolCalls warningThresholdPercent outputDir json",
+  "swarm.registry": "registryFile json",
+  "swarm.report": "path runId planFile outputDir json",
+  "swarm.run": "targetPath path planFile playbookFile scenarioFile registryFile agents agent scope identityId scenario objective maxParallel maxSteps engine execute maxCostUsd maxOutputTokens maxRuntimeMs maxToolCalls warningThresholdPercent outputDir json",
+  "swarm.scenario.init": "scenarioId path output json",
+  "swarm.scenario.validate": "file json",
+  "telemetry.record": "path outputDir sessionId runId eventType inputTokens outputTokens cacheReadTokens cacheWriteTokens costUsd durationMs toolCalls stopClass blocking reasonCodes metadataJson json",
+  "telemetry.show": "path outputDir json",
+  "watch.history": "runId path outputDir limit json",
+  "watch.run-events": "runId path outputDir pollSeconds maxIdleSeconds saveArtifacts json",
+});
+
+/** Command path -> { input: why it is not exposed }. */
+export const BRIDGE_DENIED_INPUTS = Object.freeze({
+  "ai.identity.lineage": {
+    apiUrl: "the AIdenID API that receives this command's API key",
+  },
+  "audit.frontend": {
+    url: "a deployed site that this command fetches and audits",
+  },
+  "init": {
+    injectSecret: "sets the project token as a GitHub Actions secret on a repository",
+    injectOpenaiKey: "sets OPENAI_API_KEY as a GitHub Actions secret on a repository",
+  },
+  "mcp.doctor": {
+    apiUrl: "the API that this command probes",
+  },
+  "mcp.smoke": {
+    apiUrl: "the API that receives the user's token",
+  },
+  "ring-owner": {
+    gatewayUrl: "the gateway that receives the user's token",
+  },
+  "swarm.create": {
+    target: "the site that this plan tests",
+  },
+  "swarm.run": {
+    startUrl: "the page that the browser opens",
+  },
+  "swarm.scenario.init": {
+    startUrl: "the page that a later swarm run opens",
+  },
+  "watch.run-events": {
+    apiUrl: "the API that receives the user's token",
+  },
+});
+
+/** The inputs a command exposes through the bridge, or null if it has no entry. */
+export function bridgeAllowedInputs(commandPath) {
+  const listed = BRIDGE_ALLOWED_INPUTS[commandPath];
+  return typeof listed === "string" ? new Set(listed.split(/\s+/).filter(Boolean)) : null;
+}

package/src/mcp/cli-command-tools.js

@@ -1,8 +1,10 @@
 import { spawn } from "node:child_process";
+import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import process from "node:process";
 
+import { bridgeAllowedInputs } from "./bridge-inputs.js";
 import { buildSentinelayerCliRegistryTemplate } from "./cli-registry.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
@@ -54,6 +56,11 @@ const SENSITIVE_COMMAND_PATHS = new Set([
   "ai.identity.events",
   "ai.identity.latest",
   "ai.identity.wait-for-otp",
+  // Resumes a local Codex session: --message-file and --cwd name files it reads (a dry run returns
+  // the message), and --model and --last choose what runs. Blocked outright, not only behind the
+  // approval gate; unblocking it needs an argument-bound approval, workspace-scoped paths, and a
+  // model and session that the caller cannot choose freely.
+  "session.wake.codex",
 ]);
 
 // Whole governance sub-trees under ai.identity (domain/target/site/legal-hold) are live
@@ -70,6 +77,10 @@ const SENSITIVE_COMMAND_PREFIXES = [
 ];
 const REDACTION_MARKER = "[REDACTED]";
 
+// Which inputs each command exposes is an explicit, default-deny list: src/mcp/bridge-inputs.js.
+// Nothing there names where a request goes, so a tool caller never chooses a destination for this
+// machine's credentials.
+
 function normalizeString(value) {
   return String(value == null ? "" : value).trim();
 }
@@ -117,11 +128,21 @@ function optionFlagFromFlags(flags) {
   return short ? short[0] : "";
 }
 
+// An input that names a file or directory: by its placeholder (<path>, <file>, <dir>) or its name.
+const PATH_PLACEHOLDER_RE = /<(?:[a-z-]*-)?(?:path|file|dir|directory|folder)s?(?:\.\.\.)?>/i;
+const PATH_NAME_RE = /^(?:cwd|path|paths|file|files|dir|out|output|plan|spec)$|^(?!(?:max|min|num)[A-Z]).*(?:Path|File|Dir|Directory|Folder)s?$/;
+
+function isPathLikeInput(name, flags = "") {
+  return PATH_NAME_RE.test(String(name || "")) || PATH_PLACEHOLDER_RE.test(String(flags || ""));
+}
+
 function normalizePositionalSpec(argument = {}, index = 0) {
+  const name = normalizePropertyName(argument.name, `arg${index + 1}`);
   return {
-    name: normalizePropertyName(argument.name, `arg${index + 1}`),
+    name,
     required: Boolean(argument.required),
     variadic: Boolean(argument.variadic),
+    pathLike: Boolean(argument.pathLike) || isPathLikeInput(name),
   };
 }
 
@@ -136,6 +157,7 @@ function normalizeOptionSpec(option = {}, index = 0) {
     expectsValue,
     variadic: Boolean(option.variadic),
     json: name === "json" || flag === "--json",
+    pathLike: Boolean(option.pathLike) || (expectsValue && isPathLikeInput(name, option.flags)),
   };
 }
 
@@ -227,6 +249,52 @@ function isAllowedInputValue(value) {
   return false;
 }
 
+function realpathOfNearestExisting(target) {
+  let current = target;
+  for (;;) {
+    try {
+      return fs.realpathSync.native(current);
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return current;
+      current = parent;
+    }
+  }
+}
+
+function isInsideRoot(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+// An input that names a file or directory stays inside the workspace: it is relative, does not
+// leave the workspace with "..", and does not leave it through a symlink (the nearest existing
+// ancestor's real path is checked). Returns the offending input's name, or "".
+function workspacePathInputError(tool = {}, input = {}, targetPath = process.cwd()) {
+  const metadata = tool.metadata || {};
+  const specs = [
+    ...(Array.isArray(metadata.positional) ? metadata.positional : []),
+    ...(Array.isArray(metadata.options) ? metadata.options : []),
+  ].filter((spec) => spec.pathLike);
+  if (specs.length === 0) return "";
+  const root = realpathOfNearestExisting(path.resolve(String(targetPath || ".")));
+  for (const spec of specs) {
+    const value = input[spec.name];
+    for (const item of Array.isArray(value) ? value : [value]) {
+      if (typeof item !== "string" || !item.trim()) continue;
+      const raw = item.trim();
+      if (path.isAbsolute(raw) || path.win32.isAbsolute(raw) || /^[A-Za-z]:/.test(raw) || raw.startsWith("~")) {
+        return spec.name;
+      }
+      const resolved = path.resolve(root, raw);
+      if (!isInsideRoot(root, resolved) || !isInsideRoot(root, realpathOfNearestExisting(resolved))) {
+        return spec.name;
+      }
+    }
+  }
+  return "";
+}
+
 function validateBridgeToolInput(tool = {}, input = {}) {
   if (!isPlainObject(input)) {
     return "input_must_be_object";
@@ -241,9 +309,59 @@ function validateBridgeToolInput(tool = {}, input = {}) {
       return `unsupported_input_type:${key}`;
     }
   }
+  const dashKey = dashLeadingValueKey(tool, input);
+  if (dashKey) {
+    return `unsupported_input_value:${dashKey}`;
+  }
+  return "";
+}
+
+// Positional and option values are copied into argv verbatim, and a value that starts with
+// "-" would be parsed as command-line syntax rather than as a value. The bridge does not
+// accept such values; the direct CLI remains available for them.
+function dashLeadingValueKey(tool = {}, input = {}) {
+  const metadata = tool.metadata || {};
+  const names = [
+    ...(Array.isArray(metadata.positional) ? metadata.positional : []).map((spec) => spec.name),
+    ...(Array.isArray(metadata.options) ? metadata.options : [])
+      .filter((spec) => spec.expectsValue && !spec.json)
+      .map((spec) => spec.name),
+  ];
+  for (const name of names) {
+    const value = input[name];
+    const items = Array.isArray(value) ? value : [value];
+    if (items.some((item) => typeof item === "string" && item.trimStart().startsWith("-"))) return name;
+    if (items.some((item) => typeof item === "number" && item < 0)) return name;
+  }
   return "";
 }
 
+// The inputs a command does not expose, and whether that leaves it unusable through the bridge:
+// it has no entry, or an argument or a required option is not listed.
+function unlistedInputs(commandPathKey, schema = {}, positionalSource = [], optionSource = []) {
+  const allowed = bridgeAllowedInputs(commandPathKey);
+  const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+  const withheld = new Set();
+  let unusable = !allowed;
+  for (const argument of positionalSource) {
+    if (!allowed?.has(argument.name)) unusable = true;
+  }
+  for (const option of optionSource) {
+    const { name } = normalizeOptionSpec(option);
+    if (allowed?.has(name)) continue;
+    withheld.add(name);
+    if (required.has(name)) unusable = true;
+  }
+  return { withheld, unusable };
+}
+
+function withoutInputs(schema = {}, names = new Set()) {
+  if (names.size === 0) return schema;
+  const properties = Object.fromEntries(Object.entries(schema.properties || {}).filter(([key]) => !names.has(key)));
+  const required = (Array.isArray(schema.required) ? schema.required : []).filter((key) => !names.has(key));
+  return { ...schema, properties, ...(Array.isArray(schema.required) ? { required } : {}) };
+}
+
 function normalizeRegistryTool(tool = {}) {
   const metadata = tool.metadata || {};
   const cliPath = Array.isArray(metadata.cliPath)
@@ -258,19 +376,28 @@ function normalizeRegistryTool(tool = {}) {
       ? metadata.arguments
       : [];
   const optionSource = Array.isArray(metadata.options) ? metadata.options : [];
-  const options = optionSource.map(normalizeOptionSpec).filter((option) => option.flag);
+  const rawSchema = normalizeInputSchema(tool);
+  const { withheld, unusable } = unlistedInputs(commandPathKey, rawSchema, positionalSource, optionSource);
+  const options = optionSource
+    .map(normalizeOptionSpec)
+    .filter((option) => option.flag && !withheld.has(option.name));
   const name = normalizeToolName(tool.name || commandPathKey);
-  const blockedReason = blockedReasonForCommandPath(commandPathKey);
+  const blockedReason =
+    blockedReasonForCommandPath(commandPathKey) || (unusable ? "blocked_unlisted_input" : "");
+  // The approval flag is enforced, not described: a tool that requires human approval (or whose
+  // flag is missing) is runtime-blocked until a server-validated, argument-bound approval exists.
+  const approvalRequired = tool.security?.requires_human_approval !== false;
+  const runtimeBlockReason = blockedReason || (approvalRequired ? "approval_required" : "");
   const security = {
     ...(tool.security || {}),
-    ...(blockedReason ? { runtime_blocked: true, runtime_block_reason: blockedReason } : {}),
+    ...(runtimeBlockReason ? { runtime_blocked: true, runtime_block_reason: runtimeBlockReason } : {}),
   };
 
   return {
     name,
     title: tool.title || `sl ${cliPath.join(" ")}`.trim(),
     description: tool.description || `Run SentinelLayer CLI command sl ${cliPath.join(" ")}.`,
-    inputSchema: normalizeInputSchema(tool),
+    inputSchema: withoutInputs(rawSchema, withheld),
     security,
     annotations: {
       ...(tool.annotations || {}),
@@ -283,9 +410,11 @@ function normalizeRegistryTool(tool = {}) {
       cliPath,
       positional: positionalSource.map(normalizePositionalSpec),
       options,
+      withheldOptions: [...withheld].sort(),
       supportsJson: options.some((option) => option.json),
       blocked: Boolean(metadata.blocked) || Boolean(blockedReason),
       blockedReason: metadata.blockedReason || blockedReason,
+      approvalRequired,
     },
   };
 }
@@ -488,6 +617,10 @@ export function createCliCommandMcpToolHandlers(
     targetPath = process.cwd(),
     executeCliCommandFn = executeCliCommand,
     env = process.env,
+    // Every CLI tool requires human approval, and no server-validated, argument-bound approval
+    // exists yet, so none is approved. Tests pass a validator to exercise the bridge itself; the
+    // MCP server passes none, and its dispatcher refuses these tools before any handler runs.
+    approve = () => false,
   } = {},
 ) {
   const handlers = {};
@@ -510,6 +643,21 @@ export function createCliCommandMcpToolHandlers(
           tool: tool.name,
         };
       }
+      // a blocked tool, or one without approval, is refused before its inputs are looked at
+      if (tool.metadata.blocked) {
+        return {
+          ok: false,
+          reason: tool.metadata.blockedReason || "blocked_cli_command",
+          tool: tool.name,
+        };
+      }
+      if (tool.metadata.approvalRequired !== false && !approve(tool, input)) {
+        return {
+          ok: false,
+          reason: "approval_required",
+          tool: tool.name,
+        };
+      }
       const inputError = validateBridgeToolInput(tool, input);
       if (inputError) {
         return {
@@ -519,10 +667,12 @@ export function createCliCommandMcpToolHandlers(
           tool: tool.name,
         };
       }
-      if (tool.metadata.blocked) {
+      const pathInput = workspacePathInputError(tool, input, targetPath);
+      if (pathInput) {
         return {
           ok: false,
-          reason: tool.metadata.blockedReason || "blocked_cli_command",
+          reason: "path_outside_workspace",
+          detail: pathInput,
           tool: tool.name,
         };
       }

package/src/mcp/registry.js

@@ -896,13 +896,14 @@ export function buildSentinelayerSessionRegistryTemplate({ generatedAt = new Dat
         name: "session_locks",
         title: "List Senti File Locks",
         description:
-          "List active authoritative file leases for a session.",
+          "List active authoritative file leases for a session. In an agent context it runs on the agent's admission (agentId, else SENTINELAYER_AGENT_ID).",
         input_schema: {
           type: "object",
           additionalProperties: false,
           required: ["sessionId"],
           properties: {
             sessionId: { type: "string" },
+            agentId: { type: "string" },
           },
         },
         transport: {