sentinelayer-cli 0.44.0 → 0.46.0

package/src/mcp/session-stdio-server.js

@@ -13,7 +13,14 @@ import { eventMatchesAgent } from "../session/listener.js";
 import { isSessionControlEvent } from "../session/control-events.js";
 import { buildObservations } from "../session/recall/observations.js";
 import { createMemoryService } from "../engram/index.js";
-import { assertCanonicalAgentId, canonicalAgentId, withAgentAdmission } from "../session/admission-auth.js";
+import {
+  AdmissionCredentialRefused,
+  assertCanonicalAgentId,
+  canonicalAgentId,
+  withAgentAdmission,
+} from "../session/admission-auth.js";
+import { hasStoredAdmissionCredentials, storedAdmissionAgentsForSession } from "../session/admission.js";
+import { sessionRouteClass } from "../session/route-classes.js";
 import {
   SESSION_REACTION_TYPES,
   isSessionReactionType,
@@ -886,43 +893,63 @@ async function persistSessionEvent({
   };
 }
 
-// Local MCP tools that act AS an agent: post, raise attention, react, reply, act on a
-// message, lease files, or advance that agent's read cursor. Each runs inside the
-// agent's admission scope, the same canonical path native `sl session` actor commands
-// use. A live stored admission is the only credential its requests carry; an expired,
-// malformed or mis-bound one is refused before any request; a credential the API
-// refuses (401/403) is final. With no stored admission a tool behaves as before.
-export const SESSION_MCP_ACTOR_TOOLS = Object.freeze([
-  "poll_inbox",
-  "read_history",
-  "send_message",
-  "attention_request",
-  "session_action",
-  "session_react",
-  "session_reply",
-  "session_lock",
-  "session_unlock",
-]);
+function refuseOutsideAdmission(reason) {
+  throw new AdmissionCredentialRefused(
+    `This tool runs for an agent on this machine and needs an admission it can bind to: ${reason}. ` +
+      `It will not fall back to other credentials.`,
+    { reason: "session_admission_not_bound" },
+  );
+}
 
-function actorAgentId(toolName, input = {}) {
-  const raw =
-    normalizeString(input.agentId || input.agent_id || input.agent) ||
-    (toolName === "read_history" ? normalizeString(process.env.SENTINELAYER_AGENT_ID) : "");
-  if (!raw) return "";
+/**
+ * An agent context is a process that acts for an agent: SENTINELAYER_AGENT_ID is set, or
+ * this machine stores any agent admission credential (usable or not).
+ */
+export async function isAgentContext({ env = process.env } = {}) {
+  return Boolean(normalizeString(env.SENTINELAYER_AGENT_ID)) || (await hasStoredAdmissionCredentials());
+}
+
+/**
+ * The one credential policy for local MCP session tools, by the tool's class in
+ * SESSION_ROUTE_CLASSES (src/session/route-classes.js):
+ *   - exempt-local tools, and every tool outside an agent context: run as before
+ *   - owner tools: refused in an agent context
+ *   - the session stores an admission on this machine (in any state): the tool binds to the
+ *     admission of the agent it names (input agentId, else SENTINELAYER_AGENT_ID) and runs
+ *     inside its scope; naming no agent, an agent holding none of the session's admissions,
+ *     or an expired, malformed or mis-bound admission is refused before any request
+ *   - the session stores none: legacy-data-plane tools run as before; control, owner and
+ *     unclassified (including newly added) tools are refused before any request
+ */
+export async function runInSessionToolContext(name, input = {}, run, { env = process.env } = {}) {
+  const routeClass = sessionRouteClass(`mcp:${name}`);
+  if (routeClass === "exempt-local") return run(input);
+  if (!(await isAgentContext({ env }))) return run(input);
+  if (routeClass === "owner") refuseOutsideAdmission("owner actions are not available to agents");
+  const sessionId = normalizeString(input.sessionId || input.session_id || input.session);
+  if (!sessionId) refuseOutsideAdmission("no session id was given");
+  const stored = await storedAdmissionAgentsForSession(sessionId);
+  if (stored.length === 0) {
+    if (routeClass === "legacy-data-plane") return run(input);
+    refuseOutsideAdmission(`session ${sessionId} stores no admission on this machine and "${name}" needs one`);
+  }
+  const raw = normalizeString(input.agentId || input.agent_id || input.agent) || normalizeString(env.SENTINELAYER_AGENT_ID);
+  if (!raw) refuseOutsideAdmission("no agent id was given");
   // One canonical identity for authorisation and execution (see admission-auth.js).
   assertCanonicalAgentId(raw, "agentId");
-  return canonicalAgentId(raw);
+  const agentId = canonicalAgentId(raw);
+  if (!stored.includes(agentId)) {
+    refuseOutsideAdmission(`agent "${agentId}" holds none of the admissions stored for session ${sessionId}`);
+  }
+  // live: runs inside the admission scope; an expired, malformed or mis-bound one is refused there.
+  // The file was seen above, so one removed since then refuses too: never a fallback.
+  return withAgentAdmission(sessionId, agentId, () => run(input), { requireStored: true });
 }
 
-function routeActorToolsThroughAdmission(handlers) {
-  for (const name of SESSION_MCP_ACTOR_TOOLS) {
+export function routeAgentToolsThroughAdmission(handlers, { env = process.env } = {}) {
+  for (const name of Object.keys(handlers)) {
     const run = handlers[name];
-    handlers[name] = async (input = {}) => {
-      const agentId = actorAgentId(name, input);
-      // No agent named: the tool's own validation reports it (read_history reads as the user).
-      if (!agentId) return run(input);
-      return withAgentAdmission(requireSessionId(input), agentId, () => run(input));
-    };
+    handlers[name] = (input = {}) => runInSessionToolContext(name, input, run, { env });
   }
   return handlers;
 }
@@ -1336,7 +1363,7 @@ export function createSessionMcpToolHandlers({
       });
     },
   };
-  return routeActorToolsThroughAdmission(handlers);
+  return routeAgentToolsThroughAdmission(handlers);
 }
 
 export const SESSION_MCP_TOOLS = Object.freeze([
@@ -1625,13 +1652,14 @@ export const SESSION_MCP_TOOLS = Object.freeze([
     name: "session_locks",
     title: "List Senti File Locks",
     description:
-      "List active authoritative file leases for a session.",
+      "List active authoritative file leases for a session. In an agent context it runs on the agent's admission (agentId, else SENTINELAYER_AGENT_ID).",
     inputSchema: {
       type: "object",
       additionalProperties: false,
       required: ["sessionId"],
       properties: {
         sessionId: { type: "string", minLength: 1 },
+        agentId: { type: "string", minLength: 1 },
       },
     },
   },
@@ -1712,6 +1740,45 @@ function jsonRpcError(id, code, message, data = undefined) {
   });
 }
 
+// The dispatcher enforces each tool's published policy before its handler runs. A tool that
+// requires human approval is refused: approval would have to be server-validated and bound to the
+// call's arguments, and no such approval exists yet. A runtime-blocked tool is refused too. Refused
+// tools are not advertised by tools/list, and a call to one gets a specific JSON-RPC error.
+export const MCP_HUMAN_APPROVAL_REQUIRED = Object.freeze({ code: -32001, reason: "human_approval_required" });
+export const MCP_TOOL_BLOCKED = Object.freeze({ code: -32002, reason: "tool_blocked" });
+
+function toolRefusal(tool) {
+  const security = isPlainObject(tool?.security) ? tool.security : {};
+  if (security.requires_human_approval === true) return MCP_HUMAN_APPROVAL_REQUIRED.reason;
+  if (tool?.metadata?.bridge === "cli-command" && security.requires_human_approval !== false) {
+    return MCP_HUMAN_APPROVAL_REQUIRED.reason;
+  }
+  if (security.runtime_blocked === true || tool?.metadata?.blocked === true) return MCP_TOOL_BLOCKED.reason;
+  return "";
+}
+
+function terminalCommandFor(tool, toolName) {
+  const cliPath = Array.isArray(tool?.metadata?.cliPath) ? tool.metadata.cliPath : toolName.replace(/^sl\./, "").split(".");
+  return `sl ${cliPath.join(" ")}`;
+}
+
+function refusalError(id, toolName, tool, reason) {
+  if (reason === MCP_HUMAN_APPROVAL_REQUIRED.reason) {
+    return jsonRpcError(
+      id,
+      MCP_HUMAN_APPROVAL_REQUIRED.code,
+      `Human approval is required for ${toolName}. It is not available over the MCP bridge in this version; run \`${terminalCommandFor(tool, toolName)}\` in a terminal instead.`,
+      { reason, tool: toolName },
+    );
+  }
+  return jsonRpcError(
+    id,
+    MCP_TOOL_BLOCKED.code,
+    `${toolName} is not available over the MCP bridge; run \`${terminalCommandFor(tool, toolName)}\` in a terminal instead.`,
+    { reason, tool: toolName },
+  );
+}
+
 export async function handleMcpJsonRpcMessage(
   message,
   {
@@ -1761,7 +1828,7 @@ export async function handleMcpJsonRpcMessage(
   if (method === "tools/list") {
     if (isNotification) return null;
     return jsonRpcSuccess(id, {
-      tools: tools.map((tool) => toMcpTool(tool)),
+      tools: tools.filter((tool) => !toolRefusal(tool)).map((tool) => toMcpTool(tool)),
     });
   }
 
@@ -1770,6 +1837,18 @@ export async function handleMcpJsonRpcMessage(
     const toolName = normalizeString(message.params?.name);
     const args = isPlainObject(message.params?.arguments) ? message.params.arguments : {};
     const handler = handlers[toolName];
+    const tool = (Array.isArray(tools) ? tools : []).find((candidate) => normalizeString(candidate?.name) === toolName);
+    const refusal = typeof handler === "function" && tool ? toolRefusal(tool) : "";
+    if (refusal) {
+      return refusalError(id, toolName, tool, refusal);
+    }
+    if (typeof handler === "function" && !tool) {
+      // a handler without a published definition has no policy to check: refused
+      return jsonRpcSuccess(
+        id,
+        buildToolResult({ ok: false, reason: "unknown_tool", tool: toolName }, { isError: true }),
+      );
+    }
     if (typeof handler !== "function") {
       return jsonRpcSuccess(
         id,

package/src/mcp/smoke.js

@@ -1,5 +1,11 @@
 import process from "node:process";
 
+import {
+  CredentialDestinationRefused,
+  credentialedRequest,
+  isCredential,
+  userCredential,
+} from "../auth/credential-destinations.js";
 import { DEFAULT_REQUEST_TIMEOUT_MS } from "../auth/http.js";
 import { requestHostedMcpAccessToken } from "./token-service.js";
 
@@ -75,7 +81,7 @@ function summarizeJsonRpcError(error, secrets = []) {
 async function postJsonRpc({
   fetchImpl,
   url,
-  accessToken,
+  credential,
   payload,
   timeoutMs,
   redactionSecrets = [],
@@ -83,15 +89,18 @@ async function postJsonRpc({
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetchImpl(url, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json",
+    // fetchImpl is the transport credentialedRequest calls, after its origin check.
+    const response = await credentialedRequest(
+      credential,
+      url,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+        signal: controller.signal,
       },
-      body: JSON.stringify(payload),
-      signal: controller.signal,
-    });
+      { fetchImpl },
+    );
     const text = await response.text().catch(() => "");
     let json = null;
     if (text) {
@@ -108,6 +117,7 @@ async function postJsonRpc({
       detail: json ? "" : redactMcpSmokeText(text, redactionSecrets),
     };
   } catch (error) {
+    if (error instanceof CredentialDestinationRefused) throw error;
     const aborted = Boolean(error) && error.name === "AbortError";
     return {
       reached: false,
@@ -172,6 +182,12 @@ export async function runHostedMcpSmoke({
   if (!accessToken) {
     throw new Error("Hosted MCP token mint succeeded but returned no access token.");
   }
+  // The minted bearer as a credential: the mint's own hosted MCP credential, or the bare token bound
+  // to the configured API. Any other credential (an agent's admission, say) is not accepted here.
+  if (minted.credential !== undefined && !(isCredential(minted.credential) && minted.credential.source === "hosted_mcp")) {
+    throw new TypeError("The hosted MCP mint must return a hosted MCP credential.");
+  }
+  const credential = minted.credential || (await userCredential(accessToken, { env, homeDir, source: "hosted_mcp" }));
   const redactionSecrets = [accessToken];
 
   const mcpUrl = joinUrl(minted.apiUrl, "/mcp");
@@ -181,7 +197,7 @@ export async function runHostedMcpSmoke({
   const toolsResponse = await postJsonRpc({
     fetchImpl,
     url: mcpUrl,
-    accessToken,
+    credential,
     timeoutMs: normalizedTimeoutMs,
     redactionSecrets,
     payload: {
@@ -247,7 +263,7 @@ export async function runHostedMcpSmoke({
       const eventsResponse = await postJsonRpc({
         fetchImpl,
         url: mcpUrl,
-        accessToken,
+        credential,
         timeoutMs: normalizedTimeoutMs,
         redactionSecrets,
         payload: {

package/src/mcp/token-service.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 
+import { credentialFor, isAuthenticated, userCredential } from "../auth/credential-destinations.js";
 import { DEFAULT_REQUEST_TIMEOUT_MS, requestJsonMutation } from "../auth/http.js";
 import {
   DEFAULT_API_TOKEN_TTL_DAYS,
@@ -39,12 +40,6 @@ function buildApiPath(apiUrl, pathSuffix) {
   return `${base}/${suffix}`;
 }
 
-function toAuthHeader(token) {
-  return {
-    Authorization: `Bearer ${String(token || "").trim()}`,
-  };
-}
-
 function applyScope(body, { scope = "", scopes } = {}) {
   const normalizedScope = String(scope || "").trim();
   const normalizedScopes = Array.isArray(scopes)
@@ -118,7 +113,7 @@ export async function requestHostedMcpAccessToken({
     tokenTtlDays,
     homeDir,
   });
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     throw new Error(`Not authenticated. Run \`${authLoginHint()}\` first.`);
   }
 
@@ -135,17 +130,20 @@ export async function requestHostedMcpAccessToken({
     {
       method: "POST",
       operationName: "mcp-token-mint",
-      headers: toAuthHeader(session.token),
+      credential: await credentialFor(session, { env, homeDir }),
       body,
       timeoutMs: normalizedTimeoutMs,
     }
   );
+  const accessToken = String(response.access_token || "");
 
   return {
     apiUrl: session.apiUrl,
     authSource: session.source,
     rotated: Boolean(session.rotated),
-    accessToken: String(response.access_token || ""),
+    accessToken,
+    // the minted bearer, bound to the configured API like the token that minted it
+    credential: await userCredential(accessToken, { env, homeDir, source: "hosted_mcp" }),
     tokenType: String(response.token_type || "Bearer"),
     expiresIn: Number(response.expires_in || 0),
     expiresAt: String(response.expires_at || ""),

package/src/memory/retrieval.js

@@ -1,6 +1,8 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { credentialedRequest } from "../auth/credential-destinations.js";
+
 function normalizeString(value) {
   return String(value || "").trim();
 }
@@ -506,6 +508,7 @@ export async function queryHybridRetriever({
   provider = "local",
   apiEndpoint = "",
   apiKey = "",
+  credential = null,
   fetchImpl = globalThis.fetch,
 } = {}) {
   const normalizedProvider = normalizeString(provider).toLowerCase() || "local";
@@ -534,12 +537,18 @@ export async function queryHybridRetriever({
   }
 
   try {
-    const response = await fetchImpl(String(apiEndpoint), {
+    // The user's credential goes only to its own origin (credentialedRequest); a dedicated memory
+    // API key is that service's own key, sent to the endpoint configured for it.
+    const send = (init) =>
+      credential
+        ? credentialedRequest(credential, String(apiEndpoint), init, { fetchImpl })
+        : fetchImpl(String(apiEndpoint), {
+            ...init,
+            headers: { ...init.headers, ...(normalizeString(apiKey) ? { authorization: `Bearer ${apiKey}` } : {}) },
+          });
+    const response = await send({
       method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...(normalizeString(apiKey) ? { authorization: `Bearer ${apiKey}` } : {}),
-      },
+      headers: { "content-type": "application/json" },
       body: JSON.stringify({
         query: normalizeString(query),
         limit: Math.max(1, Math.floor(normalizeNumber(limit, 12))),

package/src/pocket/ring-owner.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 
+import { checkedTransport, credentialFor, gatewayCredential, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 
@@ -16,14 +17,12 @@ function normalizeString(value) {
 
 /**
  * Resolve the pocket-gateway base URL — DISTINCT from the senti apiUrl (do NOT reuse resolveApiUrl; that is the API host).
- * Precedence: env SENTI_POCKET_URL -> env POCKET_GATEWAY_URL -> a config value if the caller passed one. Absent -> "".
+ * Precedence: env SENTI_POCKET_URL -> a config value if the caller passed one. Absent -> "". The user's token is only
+ * sent to the SENTI_POCKET_URL origin (src/auth/credential-destinations.js).
  * A present value MUST be an http(s) URL (fail-closed on a bogus scheme). Trailing slashes trimmed.
  */
 export function resolvePocketGatewayUrl({ env = process.env, configUrl = "" } = {}) {
-  const raw =
-    normalizeString(env.SENTI_POCKET_URL) ||
-    normalizeString(env.POCKET_GATEWAY_URL) ||
-    normalizeString(configUrl);
+  const raw = normalizeString(env.SENTI_POCKET_URL) || normalizeString(configUrl);
   if (!raw) return "";
   if (!/^https?:\/\//i.test(raw)) throw new Error("pocket gateway URL must be an http(s) URL");
   return raw.replace(/\/+$/, "");
@@ -74,9 +73,15 @@ export async function ringOwner(
   }
 
   const auth = await resolveAuthSession({ cwd, env, autoRotate: false });
-  if (!auth?.token) {
+  if (!isAuthenticated(auth)) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
+  // The user's token, bound to the gateway SENTI_POCKET_URL names; a --gateway-url on any other
+  // origin is refused when the request is sent.
+  const credential = await gatewayCredential(await credentialFor(auth, { env }), { env });
+  if (!credential) {
+    throw new Error("pocket gateway URL not configured. Set SENTI_POCKET_URL to the pocket-gateway base URL.");
+  }
 
   const context = { sessionId: sid };
   if (normalizeString(whatWeNeed)) context.whatWeNeed = normalizeString(whatWeNeed);
@@ -88,10 +93,10 @@ export async function ringOwner(
 
   // requestJsonMutation auto-derives a transport Idempotency-Key from operationName (retry-safe at the wire); the
   // gateway's own ring-level dedupe (PR-B4) keys on body.idempotencyKey OR a content hash, so an identical retry rings once.
-  return requestMutation(`${gw}/dial/ring-owner`, {
+  return checkedTransport(requestMutation)(`${gw}/dial/ring-owner`, {
     method: "POST",
     operationName: "pocket.ring_owner",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential,
     body,
   });
 }

package/src/program-lookup.js

@@ -0,0 +1,54 @@
+import process from "node:process";
+
+// Windows looks up a program named without a path in the working directory before PATH. The CLI
+// runs git, gh, python, npm and other tools by name, often from inside a repository, so it turns
+// that lookup off with NoDefaultCurrentDirectoryInExePath. Node.js spawns through libuv, which
+// honours that variable from libuv 1.48.0 (Node.js 22); an older libuv ignores it. On such a
+// runtime the CLI does not run at all on Windows, rather than run with the lookup on.
+export const MIN_WINDOWS_LIBUV = Object.freeze([1, 48, 0]);
+
+function parseVersion(value) {
+  const parts = String(value || "").split(".");
+  if (parts.length < 2 || parts.length > 3) {
+    return null;
+  }
+  const numbers = parts.map((part) => (/^\d+$/.test(part) ? Number(part) : NaN));
+  return numbers.every(Number.isInteger) ? [...numbers, 0].slice(0, 3) : null;
+}
+
+function atLeast(version, minimum) {
+  for (let index = 0; index < minimum.length; index += 1) {
+    if (version[index] !== minimum[index]) {
+      return version[index] > minimum[index];
+    }
+  }
+  return true;
+}
+
+/**
+ * Turn off working-directory program lookup for this process and the children that inherit its
+ * environment. Returns { ok: false, message } instead when this is Windows and the runtime would
+ * ignore the setting.
+ */
+export function restrictProgramLookupToPath({
+  platform = process.platform,
+  libuv = process.versions.uv,
+  nodeVersion = process.version,
+  env = process.env,
+} = {}) {
+  if (platform !== "win32") {
+    return { ok: true };
+  }
+  const version = parseVersion(libuv);
+  if (!version || !atLeast(version, MIN_WINDOWS_LIBUV)) {
+    return {
+      ok: false,
+      message:
+        `On Windows, sentinelayer-cli needs Node.js 22 or later (libuv ${MIN_WINDOWS_LIBUV.join(".")} or later). ` +
+        `This is Node.js ${nodeVersion} with libuv ${libuv || "unknown"}, which looks up programs in the current ` +
+        "directory before PATH. Upgrade Node.js and run the command again.",
+    };
+  }
+  env.NoDefaultCurrentDirectoryInExePath = "1";
+  return { ok: true };
+}

package/src/review/ai-review.js

@@ -10,7 +10,7 @@ import {
 import { computeProviderCost } from "../billing/price-book.js";
 import { buildBillingRunId, buildCallIdempotencyKey, sanitizeBillingMetadata } from "../billing/ledger-entry.js";
 import { recordSessionUsage } from "../billing/session-usage.js";
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateTokens } from "../cost/tokenizer.js";
@@ -534,7 +534,7 @@ export async function runAiReviewLayer({
     configModel: config.resolved.defaultModelId || DEFAULT_REVIEW_AI_MODEL,
   });
   const explicitApiKey = normalizeString(apiKey);
-  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
   const prompt = buildAiReviewPrompt({
     targetPath: normalizedTargetPath,

package/src/review/dd-report-email-client.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { requestJson } from "../auth/http.js";
 
@@ -97,7 +98,7 @@ export async function sendDdReportEmail({
     });
   }
 
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return errorResult({
       runId: normalizedRunId,
       to: normalizedTo,
@@ -116,11 +117,9 @@ export async function sendDdReportEmail({
   });
 
   try {
-    const response = await requestJsonImpl(endpoint, {
+    const response = await checkedTransport(requestJsonImpl)(endpoint, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${session.token}`,
-      },
+      credential: await credentialFor(session),
       idempotencyKey,
       body: { to: normalizedTo },
       timeoutMs,

package/src/review/local-review.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { buildScrubbedEnv } from "../agents/shared-tools/shell.js";
 import { resolveOutputRoot } from "../config/service.js";
 import { resolveCodebaseIngest } from "../ingest/engine.js";
 import { runSpecBindingChecks } from "./spec-binding.js";
@@ -844,6 +845,13 @@ function buildStaticChecks(ingest = {}) {
   ];
 }
 
+// The repository's own scripts run here (lint, typecheck, format check, tests). Running its code is
+// the point; handing it this machine's credentials is not. SentinelLayer, provider, GitHub, cloud
+// and other secret-looking variables are removed from its environment.
+export function staticCheckEnv(env = process.env) {
+  return { ...buildScrubbedEnv(env), CI: "1", FORCE_COLOR: "0" };
+}
+
 async function executeStaticCheck({ check, targetPath, runDir } = {}) {
   const checksDir = path.join(runDir, "checks");
   await fsp.mkdir(checksDir, { recursive: true });
@@ -853,11 +861,7 @@ async function executeStaticCheck({ check, targetPath, runDir } = {}) {
     cwd: targetPath,
     encoding: "utf-8",
     timeout: STATIC_CHECK_TIMEOUT_MS,
-    env: {
-      ...process.env,
-      CI: "1",
-      FORCE_COLOR: "0",
-    },
+    env: staticCheckEnv(),
   });
 
   const durationMs = Date.now() - startedAt;
@@ -927,6 +931,8 @@ async function executeStaticCheck({ check, targetPath, runDir } = {}) {
   };
 }
 
+export const __localReviewForTests = Object.freeze({ executeStaticCheck });
+
 async function runStaticAnalysisLayer({ targetPath, ingest, runDir, maxFindings = MAX_FINDINGS } = {}) {
   const checks = buildStaticChecks(ingest);
   const results = [];

package/src/session/admission-access.js

@@ -8,6 +8,7 @@
 
 import process from "node:process";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJson, requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { hasStoredAdmissionCredentials } from "./admission.js";
@@ -74,11 +75,11 @@ async function authContext(targetPath, resolveAuthSession) {
     env: process.env,
     autoRotate: false,
   });
-  if (!auth?.token || !auth?.apiUrl) {
+  if (!isAuthenticated(auth) || !auth?.apiUrl) {
     throw new Error("Not authenticated. Run `sl auth login` first.");
   }
   return {
-    token: auth.token,
+    credential: await credentialFor(auth),
     apiUrl: normalizeString(auth.apiUrl).replace(/\/+$/, ""),
   };
 }
@@ -109,12 +110,13 @@ async function mutateAdmission(
 ) {
   const key = boundedIdempotencyKey(idempotencyKey, operationName);
   const auth = await authContext(targetPath, resolveAuthSession);
-  const result = await requestMutation(admissionsUrl(auth.apiUrl, sessionId, suffix), {
+  const result = await checkedTransport(requestMutation)(admissionsUrl(auth.apiUrl, sessionId, suffix), {
     method: "POST",
     operationName,
     idempotencyKey: key,
+    credential: auth.credential,
     headers: createSessionMutationHeaders({
-      bearerToken: auth.token,
+      credential: auth.credential,
       sessionId,
       routeId,
       idempotencyKey: key,
@@ -143,9 +145,9 @@ export async function listSessionAdmissions(
   }
   const auth = await authContext(targetPath, resolveAuthSession);
   const query = normalizedStatus ? `?status=${encodeURIComponent(normalizedStatus)}` : "";
-  return requestRead(`${admissionsUrl(auth.apiUrl, sid)}${query}`, {
+  return checkedTransport(requestRead)(`${admissionsUrl(auth.apiUrl, sid)}${query}`, {
     method: "GET",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: auth.credential,
   });
 }
 
@@ -161,9 +163,9 @@ export async function getSessionAdmission(
   const sid = required(sessionId, "session id");
   const aid = required(admissionId, "admission id");
   const auth = await authContext(targetPath, resolveAuthSession);
-  return requestRead(admissionsUrl(auth.apiUrl, sid, `/${encodeURIComponent(aid)}`), {
+  return checkedTransport(requestRead)(admissionsUrl(auth.apiUrl, sid, `/${encodeURIComponent(aid)}`), {
     method: "GET",
-    headers: { Authorization: `Bearer ${auth.token}` },
+    credential: auth.credential,
   });
 }
 
@@ -264,14 +266,15 @@ export async function setSessionAdmissionMode(
   await assertOwnerAccessContext();
   const key = boundedIdempotencyKey(idempotencyKey, "session.admission_mode");
   const auth = await authContext(targetPath, resolveAuthSession);
-  const result = await requestMutation(
+  const result = await checkedTransport(requestMutation)(
     `${auth.apiUrl}/api/v1/sessions/${encodeURIComponent(sid)}/admission-mode`,
     {
       method: "POST",
       operationName: "session.admission_mode",
       idempotencyKey: key,
+      credential: auth.credential,
       headers: createSessionMutationHeaders({
-        bearerToken: auth.token,
+        credential: auth.credential,
         sessionId: sid,
         routeId: ROUTES.mode,
         idempotencyKey: key,