sentinelayer-cli 0.45.0 → 0.46.0

package/README.md

@@ -1080,7 +1080,8 @@ Ledger contract:
 
 ## Requirements
 
-- Node `>=20.0`
+- Node.js `^20.0.0 || ^22.0.0` (the package `engines`)
+- on Windows, Node.js 22 (libuv 1.48.0 or later): the CLI looks up the programs it runs (git, gh, python, npm and others) on `PATH` only, and an older runtime cannot do that, so on Windows the CLI exits with an error before running anything under Node.js 20
 - network access to Sentinelayer API/web
 - optional: GitHub CLI (`gh`) authenticated for secret injection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/agents/shared-tools/shell.js

@@ -93,6 +93,9 @@ const EXACT_ENV_KEYS_TO_STRIP = new Set([
   "MONGODB_URI",
   "SSH_SIGNING_KEY",
   "SSH_PRIVATE_KEY",
+  "SSH_AUTH_SOCK",
+  "PGPASSWORD",
+  "MYSQL_PWD",
   "KUBECONFIG",
   "KUBE_CONFIG_DATA",
 ]);
@@ -114,6 +117,7 @@ const ENV_KEY_PREFIX_PATTERNS = [
   /^TWILIO_/i,
   /^SENDGRID_/i,
   /^RESEND_/i,
+  /^NPM_CONFIG_.*_AUTH(TOKEN)?$/i, // npm's _auth and _authToken, global or per registry
 ];
 
 const ENV_KEY_SUFFIX_PATTERNS = [
@@ -126,6 +130,11 @@ const ENV_KEY_SUFFIX_PATTERNS = [
   /_ACCESS_KEY$/i,
   /_AUTH_TOKEN$/i,
   /_SESSION_TOKEN$/i,
+  /_KEY$/i,
+  /_DSN$/i,
+  /_PASS$/i,
+  /_CREDENTIALS?$/i,
+  /_CONNECTION_STRING$/i,
 ];
 
 /**

package/src/cli.js

@@ -2,6 +2,7 @@ import process from "node:process";
 import { Command } from "commander";
 
 import { CLI_VERSION, runLegacyCliWithErrorHandling } from "./legacy-cli.js";
+import { restrictProgramLookupToPath } from "./program-lookup.js";
 
 const COMMAND_REGISTRARS = {
   init: {
@@ -242,6 +243,15 @@ export async function buildCliProgram({
 }
 
 export async function runCli(rawArgs = process.argv.slice(2)) {
+  // Programs named without a path come from PATH only, never from the working directory, before
+  // anything is spawned. On a Windows runtime that cannot guarantee that, nothing runs.
+  const programLookup = restrictProgramLookupToPath();
+  if (!programLookup.ok) {
+    console.error(programLookup.message);
+    process.exitCode = 1;
+    return;
+  }
+
   // Where the user's credentials may go is decided once, here, from the real environment and the
   // global config, and frozen: nothing that changes process.env later can move it.
   const { freezeProcessTrustContext } = await import("./auth/credential-destinations.js");

package/src/daemon/ast-parser-layer.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
-import { extname } from "node:path";
+import os from "node:os";
+import { extname, resolve as resolvePath } from "node:path";
 import { promisify } from "node:util";
 
 import { parse } from "@babel/parser";
@@ -149,7 +150,7 @@ async function resolvePythonExecutable() {
     pythonExecutablePromise = (async () => {
       for (const executable of PYTHON_EXECUTABLE_CANDIDATES) {
         try {
-          await execFileAsync(executable, ["--version"], { timeout: 5000 });
+          await execFileAsync(executable, ["--version"], { timeout: 5000, cwd: os.tmpdir() });
           return executable;
         } catch {
           continue;
@@ -193,9 +194,13 @@ async function parsePythonAstSpecifiers(absolutePath = "") {
     };
   }
   try {
-    const { stdout } = await execFileAsync(executable, ["-c", PYTHON_AST_SCRIPT, absolutePath], {
+    // Isolated (-I: no script or working directory on sys.path, no PYTHON* variables) and run from
+    // a neutral directory, so a repository's own ast.py or json.py is never imported; the file to
+    // parse is passed as an argument.
+    const { stdout } = await execFileAsync(executable, ["-I", "-c", PYTHON_AST_SCRIPT, resolvePath(absolutePath)], {
       timeout: 10000,
       maxBuffer: 1024 * 1024,
+      cwd: os.tmpdir(),
     });
     const parsed = JSON.parse(String(stdout || "{}"));
     const specifiers = Array.isArray(parsed.specifiers) ? parsed.specifiers : [];

package/src/daemon/callgraph-overlay.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import fsp from "node:fs/promises";
+import os from "node:os";
 import path, { extname } from "node:path";
 import { promisify } from "node:util";
 
@@ -370,7 +371,7 @@ async function resolvePythonExecutable() {
     pythonExecutablePromise = (async () => {
       for (const executable of PYTHON_EXECUTABLE_CANDIDATES) {
         try {
-          await execFileAsync(executable, ["--version"], { timeout: 5000 });
+          await execFileAsync(executable, ["--version"], { timeout: 5000, cwd: os.tmpdir() });
           return executable;
         } catch {
           continue;
@@ -454,9 +455,13 @@ async function parsePythonCallgraph(absolutePath = "", content = "", normalizedL
     };
   }
   try {
-    const { stdout } = await execFileAsync(executable, ["-c", PYTHON_CALLGRAPH_SCRIPT, absolutePath], {
+    // Isolated (-I: no script or working directory on sys.path, no PYTHON* variables) and run from
+    // a neutral directory, so a repository's own ast.py or json.py is never imported; the file to
+    // parse is passed as an argument.
+    const { stdout } = await execFileAsync(executable, ["-I", "-c", PYTHON_CALLGRAPH_SCRIPT, path.resolve(absolutePath)], {
       timeout: 15000,
       maxBuffer: 1024 * 1024,
+      cwd: os.tmpdir(),
     });
     const parsed = JSON.parse(String(stdout || "{}"));
     return {

package/src/program-lookup.js

@@ -0,0 +1,54 @@
+import process from "node:process";
+
+// Windows looks up a program named without a path in the working directory before PATH. The CLI
+// runs git, gh, python, npm and other tools by name, often from inside a repository, so it turns
+// that lookup off with NoDefaultCurrentDirectoryInExePath. Node.js spawns through libuv, which
+// honours that variable from libuv 1.48.0 (Node.js 22); an older libuv ignores it. On such a
+// runtime the CLI does not run at all on Windows, rather than run with the lookup on.
+export const MIN_WINDOWS_LIBUV = Object.freeze([1, 48, 0]);
+
+function parseVersion(value) {
+  const parts = String(value || "").split(".");
+  if (parts.length < 2 || parts.length > 3) {
+    return null;
+  }
+  const numbers = parts.map((part) => (/^\d+$/.test(part) ? Number(part) : NaN));
+  return numbers.every(Number.isInteger) ? [...numbers, 0].slice(0, 3) : null;
+}
+
+function atLeast(version, minimum) {
+  for (let index = 0; index < minimum.length; index += 1) {
+    if (version[index] !== minimum[index]) {
+      return version[index] > minimum[index];
+    }
+  }
+  return true;
+}
+
+/**
+ * Turn off working-directory program lookup for this process and the children that inherit its
+ * environment. Returns { ok: false, message } instead when this is Windows and the runtime would
+ * ignore the setting.
+ */
+export function restrictProgramLookupToPath({
+  platform = process.platform,
+  libuv = process.versions.uv,
+  nodeVersion = process.version,
+  env = process.env,
+} = {}) {
+  if (platform !== "win32") {
+    return { ok: true };
+  }
+  const version = parseVersion(libuv);
+  if (!version || !atLeast(version, MIN_WINDOWS_LIBUV)) {
+    return {
+      ok: false,
+      message:
+        `On Windows, sentinelayer-cli needs Node.js 22 or later (libuv ${MIN_WINDOWS_LIBUV.join(".")} or later). ` +
+        `This is Node.js ${nodeVersion} with libuv ${libuv || "unknown"}, which looks up programs in the current ` +
+        "directory before PATH. Upgrade Node.js and run the command again.",
+    };
+  }
+  env.NoDefaultCurrentDirectoryInExePath = "1";
+  return { ok: true };
+}

package/src/review/local-review.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { buildScrubbedEnv } from "../agents/shared-tools/shell.js";
 import { resolveOutputRoot } from "../config/service.js";
 import { resolveCodebaseIngest } from "../ingest/engine.js";
 import { runSpecBindingChecks } from "./spec-binding.js";
@@ -844,6 +845,13 @@ function buildStaticChecks(ingest = {}) {
   ];
 }
 
+// The repository's own scripts run here (lint, typecheck, format check, tests). Running its code is
+// the point; handing it this machine's credentials is not. SentinelLayer, provider, GitHub, cloud
+// and other secret-looking variables are removed from its environment.
+export function staticCheckEnv(env = process.env) {
+  return { ...buildScrubbedEnv(env), CI: "1", FORCE_COLOR: "0" };
+}
+
 async function executeStaticCheck({ check, targetPath, runDir } = {}) {
   const checksDir = path.join(runDir, "checks");
   await fsp.mkdir(checksDir, { recursive: true });
@@ -853,11 +861,7 @@ async function executeStaticCheck({ check, targetPath, runDir } = {}) {
     cwd: targetPath,
     encoding: "utf-8",
     timeout: STATIC_CHECK_TIMEOUT_MS,
-    env: {
-      ...process.env,
-      CI: "1",
-      FORCE_COLOR: "0",
-    },
+    env: staticCheckEnv(),
   });
 
   const durationMs = Date.now() - startedAt;
@@ -927,6 +931,8 @@ async function executeStaticCheck({ check, targetPath, runDir } = {}) {
   };
 }
 
+export const __localReviewForTests = Object.freeze({ executeStaticCheck });
+
 async function runStaticAnalysisLayer({ targetPath, ingest, runDir, maxFindings = MAX_FINDINGS } = {}) {
   const checks = buildStaticChecks(ingest);
   const results = [];