sentinelayer-cli 0.46.5 → 0.48.0

package/src/mcp/bridge-inputs.js

@@ -120,6 +120,7 @@ export const BRIDGE_ALLOWED_INPUTS = Object.freeze({
   "session.comment": "sessionId targetSequenceId message agent idempotencyKey path json",
   "session.continue": "path title json",
   "session.edit": "sessionId target message agent expectedRevision idempotencyKey path json",
+  "session.events": "sessionId remote beforeSequence limit path json autoGrant",
   "session.ensure": "path session title ttlSeconds forceNew resume reuseWindowSeconds json",
   "session.guard": "sessionId files agent path json",
   "session.guard-hook": "sessionId agent path",
@@ -127,31 +128,35 @@ export const BRIDGE_ALLOWED_INPUTS = Object.freeze({
   "session.guard-uninstall": "sessionId agent path json",
   "session.history": "limit preview path json",
   "session.inject-guide": "sessionId path json",
-  "session.join": "sessionId name agent inviteToken seatKey idempotencyKey role model path goal deliverable stopWhen scope ttl provider wait waitSeconds cancelAdmission json",
+  "session.invitations.accept": "invitationId path json",
+  "session.invitations.list": "path json",
+  "session.join": "sessionId name agent inviteToken seatKey idempotencyKey role model path goal deliverable stopWhen scope ttl provider wait waitSeconds cancelAdmission autoGrant json",
   "session.leave": "sessionId agent reason path json",
   "session.list": "remote includeArchived limit path json",
   "session.listeners": "sessionId path limit maxPages json",
   "session.lock": "sessionId files intent ttl agent path json",
   "session.locks": "sessionId path json",
-  "session.observe": "sessionId summary agent model displayName role kind severity owner batch targetSequence targetCursor proposal messageFile stdin path json",
+  "session.observe": "sessionId summary agent model displayName role kind severity owner batch targetSequence targetCursor proposal messageFile stdin autoGrant path json",
   "session.pins": "sessionId path json",
-  "session.post-agent": "sessionId message agent model displayName role to path json",
+  "session.post-agent": "sessionId message agent model displayName role to autoGrant path json",
   "session.react": "sessionId reaction targetSequence targetCursor targetActionId agent idempotencyKey path json",
   "session.read": "sessionId tail follow live remote beforeSequence actions agent view includeControlEvents path json",
   "session.recall": "need session role k path remote includeControlEvents json",
   "session.recap.now": "sessionId session remote agent maxEvents path json",
   "session.renew": "sessionId files ttl agent path json",
   "session.reply": "sessionId targetSequenceId message agent idempotencyKey path json",
-  "session.say": "sessionId message agent model displayName role to replyTo replyCursor messageFile stdin forceCliUser localOnly path json",
+  "session.say": "sessionId message agent model displayName role to replyTo replyCursor messageFile stdin forceCliUser localOnly autoGrant path json",
   "session.search": "sessionId query beforeSequence limit path json",
   "session.set-title": "sessionId title path json",
   "session.setup-guides": "sessionId path json",
+  "session.standup": "sessionId since agent path json",
   "session.start": "path title template ttlSeconds forceNew force resume reuseWindowSeconds daemon json",
   "session.status": "sessionId path json",
   "session.stop-listener": "sessionId agent path json",
   "session.sync": "sessionId since path json",
   "session.templates": "json",
   "session.ticket.claim": "sessionId ticketId expectedVersion agent path json",
+  "session.ticket.create": "sessionId title body agent assignee sourceSequence idempotencyKey path json",
   "session.ticket.events": "sessionId after agent path json",
   "session.ticket.list": "sessionId available agent path json",
   "session.ticket.release": "sessionId ticketId reason agent path json",
@@ -181,6 +186,11 @@ export const BRIDGE_ALLOWED_INPUTS = Object.freeze({
   "watch.run-events": "runId path outputDir pollSeconds maxIdleSeconds saveArtifacts json",
 });
 
+// Room file downloads write to disk: agents use the native session_file_get tool, which keeps
+// the file inside the workspace and returns its path, so the bridge does not run this command.
+const ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL =
+  "room file downloads go through the native session_file_get MCP tool, which keeps the file inside the workspace";
+
 /** Command path -> { input: why it is not exposed }. */
 export const BRIDGE_DENIED_INPUTS = Object.freeze({
   "ai.identity.lineage": {
@@ -199,9 +209,20 @@ export const BRIDGE_DENIED_INPUTS = Object.freeze({
   "mcp.smoke": {
     apiUrl: "the API that receives the user's token",
   },
+  "omargate.deep": {
+    severityClassifier: "external-provider evidence evaluation is operator CLI opt-in only; never enabled by an MCP caller",
+  },
   "ring-owner": {
     gatewayUrl: "the gateway that receives the user's token",
   },
+  "session.files.get": {
+    sessionId: ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL,
+    attachmentId: ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL,
+    out: ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL,
+    force: ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL,
+    path: ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL,
+    json: ROOM_FILE_DOWNLOAD_VIA_NATIVE_TOOL,
+  },
   "session.join": {
     recoverAdmission: "restores an agent credential using the delegator's retained private key; CLI control only",
   },

package/src/mcp/cli-command-tools.js

@@ -6,6 +6,7 @@ import process from "node:process";
 
 import { bridgeAllowedInputs } from "./bridge-inputs.js";
 import { buildSentinelayerCliRegistryTemplate } from "./cli-registry.js";
+import { assertCanonicalAgentId, canonicalAgentId } from "../session/admission-auth.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_TIMEOUT_MS = 300_000;
@@ -15,7 +16,30 @@ const BRIDGE_DISABLED_ENV = "SENTINELAYER_MCP_CLI_BRIDGE_DISABLED";
 const CLI_PATH_SEGMENT_RE = /^[a-zA-Z0-9][a-zA-Z0-9-]*$/;
 const CLI_OPTION_FLAG_RE = /^--?[a-zA-Z0-9][a-zA-Z0-9-]*$/;
 const BLOCKED_COMMAND_PATHS = new Set(["mcp.server.run"]);
+const SELF_JOIN_INPUTS = new Set([
+  "sessionId", "agent", "name", "role", "model", "path", "goal", "deliverable", "stopWhen",
+  "scope", "ttl", "provider", "wait", "waitSeconds", "cancelAdmission", "autoGrant",
+  "json", "timeoutMs", "timeout_ms",
+]);
+const SELF_LEAVE_INPUTS = new Set(["sessionId", "agent", "reason", "path", "json", "timeoutMs", "timeout_ms"]);
+const SELF_JOIN_ROLES = new Set(["coder", "reviewer", "tester", "observer"]);
+
+export function selfProvisioningMcpInputSchema(tool) {
+  const allowed = tool.name === "sl.session.join" ? SELF_JOIN_INPUTS : SELF_LEAVE_INPUTS;
+  const schema = tool.inputSchema || {};
+  return {
+    ...schema,
+    properties: Object.fromEntries(Object.entries(schema.properties || {}).filter(([name]) => allowed.has(name))),
+  };
+}
 const SENSITIVE_COMMAND_PATHS = new Set([
+  // Skill installation and inspection use user-selected local paths; keep them on the direct CLI.
+  "skills.install",
+  "skills.list",
+  // Judges reach the room through the native judge_verdict tool; both commands read a
+  // caller-chosen local file.
+  "judge.check",
+  "judge.verdict",
   "auth.login",
   "auth.logout",
   "auth.revoke",
@@ -316,6 +340,52 @@ function validateBridgeToolInput(tool = {}, input = {}) {
   return "";
 }
 
+// The generated CLI registry requires human approval by default. These two commands have a
+// narrower, server-validated policy: an agent can request its own owner-approved admission or
+// unregister itself. The host supplies the caller id, never the MCP arguments. Validate again
+// in the handler after the dispatcher checks it, so neither gate alone can authorize a spawn.
+export function approvedSelfProvisioningMcpCall(tool, input, { env = process.env, forListing = false } = {}) {
+  const name = tool?.name;
+  if (name !== "sl.session.join" && name !== "sl.session.leave") return false;
+  if (validateBridgeToolDefinition(tool) || isBridgeDisabled(env)) return false;
+  if (tool.metadata?.blocked || tool.metadata?.blockedReason) return false;
+  if (tool.metadata?.approvalRequired !== true ||
+      tool.security?.requires_human_approval !== true || tool.security?.runtime_blocked !== true ||
+      tool.security?.runtime_block_reason !== "approval_required") return false;
+  if (tool.metadata.cliPath.join(".") !== name.slice(3)) return false;
+  if (tool.metadata.positional?.length !== 1 || tool.metadata.positional[0].name !== "sessionId" ||
+      !tool.metadata.options?.some((option) => option.name === "agent" && option.flag === "--agent")) return false;
+  const caller = env?.SENTINELAYER_AGENT_ID;
+  if (typeof caller !== "string" || !caller.trim()) return false;
+  try {
+    assertCanonicalAgentId(caller, "SENTINELAYER_AGENT_ID");
+  } catch {
+    return false;
+  }
+  if (forListing) return true;
+  if (!isPlainObject(input) || validateBridgeToolInput(tool, input)) return false;
+  const allowedInputs = name === "sl.session.join" ? SELF_JOIN_INPUTS : SELF_LEAVE_INPUTS;
+  if (Object.keys(input).some((key) => !allowedInputs.has(key))) return false;
+  if (typeof input.sessionId !== "string" || !input.sessionId.trim()) return false;
+  if (input.cancelAdmission !== undefined && typeof input.cancelAdmission !== "boolean") return false;
+  // --name is the legacy agent alias only without --agent. Beside --agent it becomes an
+  // untrusted display label, so the bridge refuses both together.
+  if (name === "sl.session.join" && input.agent !== undefined && input.name !== undefined) return false;
+  if (name === "sl.session.join" && input.role !== undefined && !SELF_JOIN_ROLES.has(input.role)) return false;
+  // Require one explicit identity and refuse ordinary joins without a goal.
+  const target = input.agent === undefined && name === "sl.session.join" ? input.name : input.agent;
+  if (typeof target !== "string" || !target.trim()) return false;
+  try {
+    assertCanonicalAgentId(target, "self-provisioning target");
+  } catch {
+    return false;
+  }
+  if (canonicalAgentId(target) !== canonicalAgentId(caller)) return false;
+  if (name === "sl.session.join" && input.cancelAdmission !== true &&
+      (typeof input.goal !== "string" || !input.goal.trim())) return false;
+  return true;
+}
+
 // Positional and option values are copied into argv verbatim, and a value that starts with
 // "-" would be parsed as command-line syntax rather than as a value. The bridge does not
 // accept such values; the direct CLI remains available for them.

package/src/mcp/registry.js

@@ -4,7 +4,8 @@ import process from "node:process";
 
 import { z } from "zod";
 
-import { resolveOutputRoot } from "../config/service.js";
+import { resolveOutputContext } from "../config/service.js";
+import { requireOutputFileSystem } from "../config/output-filesystem.js";
 
 /** MCP tool-registry schema version used by Sentinelayer CLI generated artifacts. */
 export const MCP_TOOL_REGISTRY_SCHEMA_VERSION = "1.0.0";
@@ -1390,14 +1391,16 @@ export function stringifyJson(value) {
  *
  * @param {string} filePath
  * @param {unknown} value
- * @param {{ force?: boolean }} [options]
+ * @param {{ force?: boolean, outputFs: ReturnType<import('../config/output-filesystem.js').createOutputFileSystem> }} options
  * @returns {Promise<string>}
  */
-export async function writeJsonFile(filePath, value, { force = false } = {}) {
+export async function writeJsonFile(filePath, value, { force = false, outputFs } = {}) {
+  requireOutputFileSystem(outputFs);
   const resolvedPath = path.resolve(filePath);
+  await outputFs.assertPath(resolvedPath);
   if (!force) {
     try {
-      await fsp.access(resolvedPath);
+      await outputFs.access(resolvedPath);
       throw new Error(`File already exists: ${resolvedPath}. Use --force to overwrite.`);
     } catch (error) {
       if (error && typeof error === "object" && error.code === "ENOENT") {
@@ -1409,8 +1412,8 @@ export async function writeJsonFile(filePath, value, { force = false } = {}) {
       }
     }
   }
-  await fsp.mkdir(path.dirname(resolvedPath), { recursive: true });
-  await fsp.writeFile(resolvedPath, stringifyJson(value), "utf-8");
+  await outputFs.mkdir(path.dirname(resolvedPath), { recursive: true });
+  await outputFs.writeFile(resolvedPath, stringifyJson(value), "utf-8");
   return resolvedPath;
 }
 
@@ -1435,8 +1438,8 @@ export async function readJsonFile(filePath) {
  * @param {{ cwd?: string, outputDir?: string, env?: NodeJS.ProcessEnv }} [options]
  * @returns {Promise<string>}
  */
-export async function resolveDefaultMcpOutputPath({ cwd, outputDir, env } = {}) {
-  const outputRoot = await resolveOutputRoot({
+export async function resolveDefaultMcpOutputPath({ cwd, outputDir, env, outputContext } = {}) {
+  const { outputRoot } = outputContext || await resolveOutputContext({
     cwd,
     outputDirOverride: outputDir,
     env,
@@ -1450,8 +1453,8 @@ export async function resolveDefaultMcpOutputPath({ cwd, outputDir, env } = {})
  * @param {{ cwd?: string, outputDir?: string, env?: NodeJS.ProcessEnv }} [options]
  * @returns {Promise<string>}
  */
-export async function resolveDefaultAidenIdAdapterContractPath({ cwd, outputDir, env } = {}) {
-  const outputRoot = await resolveOutputRoot({
+export async function resolveDefaultAidenIdAdapterContractPath({ cwd, outputDir, env, outputContext } = {}) {
+  const { outputRoot } = outputContext || await resolveOutputContext({
     cwd,
     outputDirOverride: outputDir,
     env,
@@ -1465,8 +1468,8 @@ export async function resolveDefaultAidenIdAdapterContractPath({ cwd, outputDir,
  * @param {{ cwd?: string, outputDir?: string, env?: NodeJS.ProcessEnv }} [options]
  * @returns {Promise<string>}
  */
-export async function resolveDefaultHostedSentiSessionConnectorContractPath({ cwd, outputDir, env } = {}) {
-  const outputRoot = await resolveOutputRoot({
+export async function resolveDefaultHostedSentiSessionConnectorContractPath({ cwd, outputDir, env, outputContext } = {}) {
+  const { outputRoot } = outputContext || await resolveOutputContext({
     cwd,
     outputDirOverride: outputDir,
     env,
@@ -1485,8 +1488,9 @@ export async function resolveDefaultMcpServerConfigPath({
   outputDir,
   env,
   serverId,
+  outputContext,
 } = {}) {
-  const outputRoot = await resolveOutputRoot({
+  const { outputRoot } = outputContext || await resolveOutputContext({
     cwd,
     outputDirOverride: outputDir,
     env,