sentinelayer-cli 0.46.5 → 0.48.0

package/src/commands/ai/provision-governance.js

@@ -24,7 +24,7 @@ import {
 } from "../../ai/domain-target-store.js";
 import { listSites, recordTemporarySite } from "../../ai/site-store.js";
 import { getIdentityById, recordProvisionedIdentity } from "../../ai/identity-store.js";
-import { resolveOutputRoot } from "../../config/service.js";
+import { resolveOutputRoot, resolveOutputContext } from "../../config/service.js";
 import { fetchAidenIdCredentials, resolveActiveAuthSession } from "../../auth/service.js";
 import {
   buildCurlPreview,
@@ -76,7 +76,7 @@ async function provisionEmailAction(options, command) {
       extractionTypes: options.extractionTypes,
     });
 
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -90,7 +90,7 @@ async function provisionEmailAction(options, command) {
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const session = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
       () => null,
@@ -170,10 +170,11 @@ async function provisionEmailAction(options, command) {
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const responseIdentity = execution.response || {};
     const registryUpdate = await recordProvisionedIdentity({
+      outputFs,
       outputRoot,
       response: execution.response || {},
       context: {
@@ -259,7 +260,7 @@ domain
   .action(async (domainName, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -287,7 +288,7 @@ domain
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -355,10 +356,11 @@ domain
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordDomainProofResponse({
+      outputFs,
       outputRoot,
       domain: proofResponse.domain || {},
       proof: proofResponse,
@@ -416,7 +418,7 @@ domain
   .action(async (domainId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -451,7 +453,7 @@ domain
       idempotencyKey,
       domainId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -511,10 +513,11 @@ domain
       idempotencyKey,
       domainId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordDomainProofResponse({
+      outputFs,
       outputRoot,
       domain: proofResponse.domain || {},
       proof: proofResponse,
@@ -571,7 +574,7 @@ domain
   .action(async (domainId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -593,7 +596,7 @@ domain
       idempotencyKey,
       domainId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -653,9 +656,10 @@ domain
       idempotencyKey,
       domainId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordDomainProofResponse({
+      outputFs,
       outputRoot,
       domain: execution.response || {},
       proof: {},
@@ -712,7 +716,7 @@ target
   .action(async (host, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -745,7 +749,7 @@ target
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -802,10 +806,11 @@ target
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordTargetProofResponse({
+      outputFs,
       outputRoot,
       target: proofResponse.target || {},
       proof: proofResponse,
@@ -862,7 +867,7 @@ target
   .action(async (targetId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -897,7 +902,7 @@ target
       idempotencyKey,
       targetId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -957,10 +962,11 @@ target
       idempotencyKey,
       targetId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordTargetProofResponse({
+      outputFs,
       outputRoot,
       target: proofResponse.target || {},
       proof: proofResponse,
@@ -1012,7 +1018,7 @@ target
   .action(async (targetId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1041,9 +1047,10 @@ target
       generatedAt: new Date().toISOString(),
       targetId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordTargetProofResponse({
+      outputFs,
       outputRoot,
       target: execution.response || {},
       proof: {},
@@ -1098,7 +1105,7 @@ site
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1132,7 +1139,7 @@ site
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -1190,9 +1197,10 @@ site
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordTemporarySite({
+      outputFs,
       outputRoot,
       site: execution.response || {},
       context: {

package/src/commands/ai/shared.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import fsp from "node:fs/promises";
+
 import path from "node:path";
+import { requireOutputFileSystem } from "../../config/output-filesystem.js";
 
 // Shared helper utilities for ai command modules.
 
@@ -128,9 +129,10 @@ export function renderLineageRows(lineage = {}) {
     });
 }
 
-export async function writeArtifact(filePath, payload) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+export async function writeArtifact(filePath, payload, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
 }
 
 export function buildCurlPreview({ apiUrl, idempotencyKey, requestPath }) {

package/src/commands/audit.js

@@ -7,7 +7,7 @@ import { runAuditOrchestrator } from "../audit/orchestrator.js";
 import { loadAuditRunReport, resolveAuditRunDirectory, writeDdPackage } from "../audit/package.js";
 import { writeAuditComparisonArtifact } from "../audit/replay.js";
 import { loadAuditRegistry, selectAuditAgents } from "../audit/registry.js";
-import { resolveOutputRoot } from "../config/service.js";
+import { resolveOutputContext } from "../config/service.js";
 import { createAgentEvent } from "../events/schema.js";
 import { createAuditSessionReporter, resolveAuditSessionId } from "../session/audit-reporter.js";
 import { resolveActionOptions } from "./action-options.js";
@@ -217,7 +217,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const actionOptions = resolveActionOptions(options, command);
       const emitJson = shouldEmitJson(actionOptions, command);
       const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot, outputFs } = await resolveOutputContext({
         cwd: targetPath,
         outputDirOverride: actionOptions.outputDir,
         env: process.env,
@@ -228,6 +228,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       });
       const { report } = await loadAuditRunReport(runDirectory);
       const ddPackage = await writeDdPackage({
+        outputFs,
         report,
         runDirectory,
       });
@@ -269,7 +270,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const actionOptions = resolveActionOptions(options, command);
       const emitJson = shouldEmitJson(actionOptions, command);
       const initialTargetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot } = await resolveOutputContext({
         cwd: initialTargetPath,
         outputDirOverride: actionOptions.outputDir,
         env: process.env,
@@ -306,6 +307,7 @@ export function registerAuditCommand(program, invokeLegacy) {
         baseReport,
         candidateReport: replayResult,
         outputDirectory: replayResult.runDirectory,
+        outputFs: replayResult.outputFs,
       });
 
       const payload = {
@@ -347,7 +349,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const actionOptions = resolveActionOptions(options, command);
       const emitJson = shouldEmitJson(actionOptions, command);
       const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot, outputFs } = await resolveOutputContext({
         cwd: targetPath,
         outputDirOverride: actionOptions.outputDir,
         env: process.env,
@@ -366,6 +368,7 @@ export function registerAuditCommand(program, invokeLegacy) {
         baseReport,
         candidateReport,
         outputDirectory: candidateRunDirectory,
+        outputFs,
       });
 
       const payload = {
@@ -869,14 +872,12 @@ export function registerAuditCommand(program, invokeLegacy) {
       const { julesAuditLoop } = await import("../agents/jules/loop.js");
       const { JULES_DEFINITION } = await import("../agents/jules/config/definition.js");
       const { collectCodebaseIngest, generateCodebaseIngest } = await import("../ingest/engine.js");
-      const { resolveOutputRoot: resolveOut } = await import("../config/service.js");
       const { createBlackboard } = await import("../memory/blackboard.js");
       const { runDeterministicReviewPipeline } = await import("../review/local-review.js");
-      const fsp = await import("node:fs/promises");
 
-      const outputRoot = await resolveOut({ targetPath, outputDir: actionOptions.outputDir });
+      const { outputRoot, outputFs } = await resolveOutputContext({ cwd: targetPath, outputDirOverride: actionOptions.outputDir });
       const artifactDir = path.join(outputRoot, "reports", "jules-" + Date.now());
-      await fsp.mkdir(artifactDir, { recursive: true });
+      await outputFs.mkdir(artifactDir, { recursive: true });
 
       // Build event handler
       const onEvent = buildEventHandler(emitStream, emitJson, JULES_DEFINITION);
@@ -888,7 +889,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       let ingest;
       try {
         ingest = await generateCodebaseIngest({
-          rootPath: targetPath, outputDir: outputRoot,
+          rootPath: targetPath, outputDir: actionOptions.outputDir,
           refresh: Boolean(actionOptions.refresh),
         });
       } catch {
@@ -907,6 +908,7 @@ export function registerAuditCommand(program, invokeLegacy) {
             targetPath,
             mode: "full",
             outputDir: artifactDir,
+            outputFs,
           });
           emitProgress(onEvent, JULES_DEFINITION,
             "Baseline complete: P0=" + (omarBaseline?.summary?.P0 || 0) +
@@ -1085,21 +1087,21 @@ export function registerAuditCommand(program, invokeLegacy) {
         signature: JULES_DEFINITION.signature,
       };
 
-      await fsp.writeFile(
+      await outputFs.writeFile(
         path.join(artifactDir, "JULES_AUDIT.json"),
         JSON.stringify(reportPayload, null, 2),
       );
 
       // Write baseline artifact if it exists
       if (omarBaseline) {
-        await fsp.writeFile(
+        await outputFs.writeFile(
           path.join(artifactDir, "OMAR_BASELINE.json"),
           JSON.stringify(omarBaseline, null, 2),
         );
       }
 
       // Write reconciliation artifact
-      await fsp.writeFile(
+      await outputFs.writeFile(
         path.join(artifactDir, "RECONCILIATION.json"),
         JSON.stringify(reconciliation, null, 2),
       );

package/src/commands/board.js

@@ -104,10 +104,10 @@ export function registerBoardCommand(program) {
     .description("Check whether a ticket's evidence holds (done | not-done | cannot-verify)")
     .requiredOption("--file <path>", "Ticket JSON file with an `evidence` array")
     .option("--json", "Emit machine-readable output")
-    .action(async (options) => {
+    .action(async (options, command) => {
       const code = await runBoardCheck({
         file: path.resolve(process.cwd(), String(options.file)),
-        emitJson: Boolean(options.json),
+        emitJson: Boolean(options.json || command.optsWithGlobals().json),
       });
       process.exitCode = code;
     });

package/src/commands/chat.js

@@ -1,4 +1,4 @@
-import fsp from "node:fs/promises";
+import { requireOutputFileSystem } from "../config/output-filesystem.js";
 import path from "node:path";
 import process from "node:process";
 
@@ -10,7 +10,7 @@ import {
   resolveProvider,
 } from "../ai/client.js";
 import { recordCliLlmSessionUsage, usageNumber } from "../billing/llm-session-usage.js";
-import { resolveOutputRoot } from "../config/service.js";
+import { resolveOutputContext } from "../config/service.js";
 import { estimateModelCost } from "../cost/tracker.js";
 import { estimateTokens } from "../cost/tokenizer.js";
 import { normalizeSessionId } from "../session/paths.js";
@@ -43,10 +43,11 @@ async function readPromptFromStdin() {
   });
 }
 
-async function appendTranscriptEntries({ transcriptPath, entries } = {}) {
-  await fsp.mkdir(path.dirname(transcriptPath), { recursive: true });
+async function appendTranscriptEntries({ transcriptPath, entries, outputFs } = {}) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(transcriptPath), { recursive: true });
   const rows = entries.map((entry) => JSON.stringify(entry)).join("\n");
-  await fsp.appendFile(transcriptPath, `${rows}\n`, "utf-8");
+  await outputFs.appendFile(transcriptPath, `${rows}\n`, "utf-8");
 }
 
 export function registerChatCommand(program) {
@@ -77,7 +78,7 @@ export function registerChatCommand(program) {
       }
 
       const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot, outputFs } = await resolveOutputContext({
         cwd: targetPath,
         outputDirOverride: options.outputDir,
         env: process.env,
@@ -159,6 +160,7 @@ export function registerChatCommand(program) {
           });
 
       await appendTranscriptEntries({
+        outputFs,
         transcriptPath,
         entries: [
           {

package/src/commands/judge.js

@@ -0,0 +1,125 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+
+import { formatJudgeVerdictErrors, renderJudgeVerdictMessage, validateJudgeVerdict } from "../judge/verdict.js";
+
+function shouldEmitJson(options, command) {
+  if (options && options.json) return true;
+  return typeof command?.optsWithGlobals === "function" ? Boolean(command.optsWithGlobals().json) : false;
+}
+
+async function readStdinText() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+async function readVerdictDocument(options) {
+  if (options.file && options.stdin) throw new Error("Use --file or --stdin, not both.");
+  if (!options.file && !options.stdin) throw new Error("Give the verdict with --file <path> or --stdin.");
+  const raw = options.stdin
+    ? await readStdinText()
+    : await fsp.readFile(path.resolve(process.cwd(), String(options.file)), "utf8");
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`The verdict is not valid JSON: ${error.message}`);
+  }
+}
+
+function report(emitJson, payload, text) {
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+  } else {
+    process.stdout.write(`${text}\n`);
+  }
+}
+
+function fail(emitJson, command, error) {
+  const message = error && error.message ? error.message : String(error);
+  if (emitJson) {
+    process.stdout.write(`${JSON.stringify({ command, ok: false, reason: message }, null, 2)}\n`);
+  } else {
+    process.stderr.write(`${command} failed: ${message}\n`);
+  }
+  process.exitCode = 1;
+}
+
+export function registerJudgeCommand(program) {
+  const judge = program
+    .command("judge")
+    .description("Judge a coding agent's work and send the verdict back (LLM-as-a-judge loop)");
+
+  judge
+    .command("check")
+    .description("Validate a judge-verdict offline and print the message the coder will receive")
+    .option("--file <path>", "Verdict JSON file")
+    .option("--stdin", "Read the verdict JSON from stdin")
+    .option("--escalate-to <handle...>", "Human handle(s) to mention when the verdict escalates")
+    .option("--json", "Emit machine-readable output")
+    .action(async (options, command) => {
+      const emitJson = shouldEmitJson(options, command);
+      try {
+        const checked = validateJudgeVerdict(await readVerdictDocument(options));
+        if (!checked.ok) {
+          report(emitJson, { command: "judge check", ok: false, errors: checked.errors },
+            `Invalid verdict: ${formatJudgeVerdictErrors(checked.errors)}`);
+          process.exitCode = 1;
+          return;
+        }
+        const message = renderJudgeVerdictMessage(checked.verdict, { escalateTo: options.escalateTo || [] });
+        report(emitJson, { command: "judge check", ok: true, verdict: checked.verdict, message }, message);
+      } catch (error) {
+        fail(emitJson, "judge check", error);
+      }
+    });
+
+  judge
+    .command("verdict <sessionId>")
+    .description("Send a judge-verdict to the room: the coder is mentioned and woken, and the verdict is recorded")
+    .option("--agent <id>", "Your judge agent id (default: SENTINELAYER_AGENT_ID)")
+    .option("--file <path>", "Verdict JSON file")
+    .option("--stdin", "Read the verdict JSON from stdin")
+    .option("--via <transport>", "auto (the API route when the server has it, else a room message), api, or room", "auto")
+    .option("--escalate-to <handle...>", "Human handle(s) to mention when the verdict escalates")
+    .option("--path <path>", "Workspace path for the session", ".")
+    .option("--dry-run", "Validate and print the message without sending it")
+    .option("--json", "Emit machine-readable output")
+    .action(async (sessionId, options, command) => {
+      const emitJson = shouldEmitJson(options, command);
+      try {
+        const verdict = await readVerdictDocument(options);
+        const agentId = String(options.agent || process.env.SENTINELAYER_AGENT_ID || "").trim();
+        if (!agentId) throw new Error("Name your judge agent with --agent <id> or SENTINELAYER_AGENT_ID.");
+        const targetPath = path.resolve(process.cwd(), String(options.path || "."));
+        // One implementation for the CLI and MCP: the native judge_verdict tool, which already runs
+        // under the admission policy every local session tool uses.
+        const { createSessionMcpToolHandlers } = await import("../mcp/session-stdio-server.js");
+        const handlers = createSessionMcpToolHandlers({ targetPath });
+        const result = await handlers.judge_verdict({
+          sessionId,
+          agentId,
+          verdict,
+          via: options.via,
+          escalateTo: options.escalateTo || [],
+          dryRun: Boolean(options.dryRun),
+        });
+        const payload = { command: "judge verdict", ...result };
+        if (!result.ok) {
+          const why = result.errors ? formatJudgeVerdictErrors(result.errors) : result.reason;
+          report(emitJson, payload, `Verdict not sent: ${why}`);
+          process.exitCode = 1;
+          return;
+        }
+        if (result.dryRun) {
+          report(emitJson, payload, result.message);
+          return;
+        }
+        report(emitJson, payload,
+          `Verdict ${result.verdict.verdict} (round ${result.verdict.round}) sent to @${result.verdict.coder} via ${result.transport}.`);
+      } catch (error) {
+        fail(emitJson, "judge verdict", error);
+      }
+    });
+}

package/src/commands/legacy-args.js

@@ -57,6 +57,7 @@ export function buildLegacyArgs(baseArgs, { commandOptions = {}, command } = {})
   appendPassthroughFlag(args, "--max-runtime-minutes", commandOptions.maxRuntimeMinutes);
   appendPassthroughFlag(args, "--model", commandOptions.model);
   appendPassthroughFlag(args, "--provider", commandOptions.provider);
+  if (commandOptions.severityClassifier && commandOptions.severityClassifier !== "off") appendPassthroughFlag(args, "--severity-classifier", commandOptions.severityClassifier);
   appendPassthroughFlag(args, "--reuse-omargate", commandOptions.reuseOmargate);
   appendPassthroughFlag(args, "--scope-mode", commandOptions.scopeMode);
   appendBooleanFlag(args, "--diff", commandOptions.diff);