sentinelayer-cli 0.9.7 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.9.7",
+  "version": "0.10.0",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/ai/proxy.js

@@ -27,7 +27,15 @@ const PROXY_RETRY_STATUSES = new Set([429, 502, 503, 504]);
  * @param {number} [options.temperature] - Temperature (default: 0.1)
  * @param {string} [options.apiUrl] - Override API URL
  * @param {string} [options.token] - Override Bearer token
- * @returns {Promise<{ text: string, usage: { inputTokens: number, outputTokens: number, costUsd: number, model: string, provider: string, latencyMs: number } }>}
+ * @param {string} [options.sessionId] - Optional Senti session id for server-side usage metering
+ * @param {string} [options.agentId] - Optional session agent id for server-side usage metering
+ * @param {string} [options.action] - Optional metered action, defaults server-side when omitted
+ * @param {string} [options.usageIdempotencyKey] - Stable per-intent key for proxy + ledger idempotency
+ * @param {string} [options.billingTier] - Optional billing tier hint
+ * @param {string} [options.customerPricingPolicy] - Optional customer pricing policy hint
+ * @param {object} [options.metadata] - Optional allowlisted billing metadata
+ * @param {Function} [options.fetchImpl] - Optional fetch implementation for tests
+ * @returns {Promise<{ text: string, usage: { inputTokens: number, outputTokens: number, costUsd: number, model: string, provider: string, latencyMs: number }, usageLedger: object | null }>}
  */
 export async function invokeViaProxy({
   prompt,
@@ -37,6 +45,14 @@ export async function invokeViaProxy({
   temperature = 0.1,
   apiUrl = "",
   token = "",
+  sessionId = "",
+  agentId = "",
+  action = "",
+  usageIdempotencyKey = "",
+  billingTier = "",
+  customerPricingPolicy = "",
+  metadata = null,
+  fetchImpl = fetch,
 } = {}) {
   // Resolve credentials from session if not provided
   let resolvedApiUrl = String(apiUrl || "").trim();
@@ -59,13 +75,40 @@ export async function invokeViaProxy({
 
   const url = `${resolvedApiUrl.replace(/\/+$/, "")}/api/v1/proxy/llm`;
 
-  const body = JSON.stringify({
+  const requestBody = {
     model,
     system_prompt: systemPrompt || "You are a code reviewer.",
     user_content: String(prompt || ""),
     max_tokens: maxTokens,
     temperature,
-  });
+  };
+
+  const normalizedSessionId = String(sessionId || "").trim();
+  const normalizedAgentId = String(agentId || "").trim();
+  const normalizedAction = String(action || "").trim();
+  const normalizedUsageIdempotencyKey = String(usageIdempotencyKey || "").trim();
+  const normalizedBillingTier = String(billingTier || "").trim();
+  const normalizedCustomerPricingPolicy = String(customerPricingPolicy || "").trim();
+  if (normalizedSessionId) requestBody.session_id = normalizedSessionId;
+  if (normalizedAgentId) requestBody.agent_id = normalizedAgentId;
+  if (normalizedAction) requestBody.action = normalizedAction;
+  if (normalizedUsageIdempotencyKey) requestBody.usage_idempotency_key = normalizedUsageIdempotencyKey;
+  if (normalizedBillingTier) requestBody.billing_tier = normalizedBillingTier;
+  if (normalizedCustomerPricingPolicy) requestBody.customer_pricing_policy = normalizedCustomerPricingPolicy;
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    requestBody.metadata = metadata;
+  }
+
+  const headers = {
+    "Content-Type": "application/json",
+    Authorization: `Bearer ${resolvedToken}`,
+    Accept: "application/json",
+  };
+  if (normalizedUsageIdempotencyKey) {
+    headers["Idempotency-Key"] = normalizedUsageIdempotencyKey;
+  }
+
+  const body = JSON.stringify(requestBody);
 
   let response = null;
   let lastError = null;
@@ -75,13 +118,9 @@ export async function invokeViaProxy({
       const controller = new AbortController();
       const timeoutHandle = setTimeout(() => controller.abort(), PROXY_TIMEOUT_MS);
       try {
-        response = await fetch(url, {
+        response = await fetchImpl(url, {
           method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${resolvedToken}`,
-            Accept: "application/json",
-          },
+          headers,
           body,
           signal: controller.signal,
         });
@@ -131,6 +170,7 @@ export async function invokeViaProxy({
       provider: result.usage?.provider || "sentinelayer",
       latencyMs: result.usage?.latency_ms || 0,
     },
+    usageLedger: result.usageLedger || result.usage_ledger || null,
   };
 }
 

package/src/auth/session-store.js

@@ -17,6 +17,8 @@ const SESSION_WARNING_ALLOWED_FIELDS = new Set([
   "codeHint",
   "requestIdHash",
 ]);
+const emittedSessionWarningKeys = new Set();
+let keytarClientOverrideForTests;
 
 function nowIso() {
   return new Date().toISOString();
@@ -69,26 +71,45 @@ function sanitizeSessionWarningDetails(details) {
 
 function emitSessionWarning(code, details = {}) {
   const sanitizedDetails = sanitizeSessionWarningDetails(details);
+  const normalizedCode = String(code || "SESSION_WARNING").toUpperCase();
+  const allowedDetails = {};
+  for (const [key, value] of Object.entries(sanitizedDetails)) {
+    allowedDetails[key] = SESSION_WARNING_ALLOWED_FIELDS.has(key) ? value : "[OMITTED]";
+  }
+  const warningKey = `${normalizedCode}:${JSON.stringify(allowedDetails)}`;
+  if (emittedSessionWarningKeys.has(warningKey)) {
+    return;
+  }
+  emittedSessionWarningKeys.add(warningKey);
+
   const payload = {
     level: "warn",
-    code: String(code || "SESSION_WARNING").toUpperCase(),
+    code: normalizedCode,
     warningId: createSessionWarningId(),
     timestamp: nowIso(),
   };
-  for (const [key, value] of Object.entries(sanitizedDetails)) {
-    if (SESSION_WARNING_ALLOWED_FIELDS.has(key)) {
-      payload[key] = value;
-    } else {
-      payload[key] = "[OMITTED]";
-    }
+  for (const [key, value] of Object.entries(allowedDetails)) {
+    payload[key] = value;
   }
   try {
-    console.warn(`${SESSION_WARNING_PREFIX} ${JSON.stringify(payload)}`);
+    process.stderr.write(`${SESSION_WARNING_PREFIX} ${JSON.stringify(payload)}\n`);
   } catch {
-    console.warn(`${SESSION_WARNING_PREFIX} ${payload.code}`);
+    console.error(`${SESSION_WARNING_PREFIX} ${payload.code}`);
   }
 }
 
+export function resetSessionWarningsForTests() {
+  emittedSessionWarningKeys.clear();
+}
+
+export function setKeytarClientForTests(client) {
+  const previous = keytarClientOverrideForTests;
+  keytarClientOverrideForTests = client || null;
+  return () => {
+    keytarClientOverrideForTests = previous;
+  };
+}
+
 function resolveHomeDir(homeDir) {
   return path.resolve(String(homeDir || os.homedir()));
 }
@@ -356,7 +377,10 @@ async function replaceWithBackup(tmpPath, filePath) {
   }
 }
 
-async function loadKeytarClient() {
+async function loadKeytarClient({ allowImplicit = false } = {}) {
+  if (keytarClientOverrideForTests !== undefined) {
+    return keytarClientOverrideForTests;
+  }
   const disableKeyring = String(process.env.SENTINELAYER_DISABLE_KEYRING || "")
     .trim()
     .toLowerCase();
@@ -372,7 +396,7 @@ async function loadKeytarClient() {
     keyringMode === "on" ||
     keyringMode === "true" ||
     keyringMode === "1";
-  if (!enableKeyring) {
+  if (!enableKeyring && !allowImplicit) {
     return null;
   }
   try {
@@ -394,6 +418,20 @@ async function loadKeytarClient() {
   }
 }
 
+async function encryptTokenForFileFallback(token, { homeDir } = {}) {
+  const key = await loadOrCreateFileKey({ homeDir });
+  return encryptToken(token, key);
+}
+
+async function attachEncryptedTokenFallback(metadata, token, { homeDir } = {}) {
+  const encrypted = await encryptTokenForFileFallback(token, { homeDir });
+  metadata.tokenEncrypted = encrypted.tokenEncrypted;
+  metadata.tokenIv = encrypted.tokenIv;
+  metadata.tokenTag = encrypted.tokenTag;
+  metadata.token = null;
+  return metadata;
+}
+
 async function readMetadata({ homeDir } = {}) {
   const filePath = resolveCredentialsFilePath({ homeDir });
   try {
@@ -480,20 +518,12 @@ async function migratePlaintextTokenIfNeeded({ metadata, filePath, homeDir } = {
     nextMetadata.storage = "keyring";
     nextMetadata.keyringService = KEYRING_SERVICE;
     nextMetadata.keyringAccount = keyringAccount;
-    const key = await loadOrCreateFileKey({ homeDir });
-    const encrypted = encryptToken(plaintextToken, key);
-    nextMetadata.tokenEncrypted = encrypted.tokenEncrypted;
-    nextMetadata.tokenIv = encrypted.tokenIv;
-    nextMetadata.tokenTag = encrypted.tokenTag;
+    await attachEncryptedTokenFallback(nextMetadata, plaintextToken, { homeDir });
   } else {
-    const key = await loadOrCreateFileKey({ homeDir });
-    const encrypted = encryptToken(plaintextToken, key);
     nextMetadata.storage = "file";
     nextMetadata.keyringService = KEYRING_SERVICE;
     nextMetadata.keyringAccount = "";
-    nextMetadata.tokenEncrypted = encrypted.tokenEncrypted;
-    nextMetadata.tokenIv = encrypted.tokenIv;
-    nextMetadata.tokenTag = encrypted.tokenTag;
+    await attachEncryptedTokenFallback(nextMetadata, plaintextToken, { homeDir });
   }
 
   await writeMetadata(filePath, nextMetadata);
@@ -570,7 +600,7 @@ export async function readStoredSession({ homeDir } = {}) {
   }
 
   if (metadata.storage === "keyring") {
-    const keytar = await loadKeytarClient();
+    const keytar = await loadKeytarClient({ allowImplicit: true });
     let keyringError = null;
     if (keytar && metadata.keyringAccount) {
       try {
@@ -763,17 +793,12 @@ export async function writeStoredSession(
     nextMetadata.storage = "keyring";
     nextMetadata.keyringService = KEYRING_SERVICE;
     nextMetadata.keyringAccount = keyringAccount;
-    nextMetadata.token = null;
+    await attachEncryptedTokenFallback(nextMetadata, normalizedToken, { homeDir });
   } else {
     nextMetadata.storage = "file";
     nextMetadata.keyringService = KEYRING_SERVICE;
     nextMetadata.keyringAccount = "";
-    const key = await loadOrCreateFileKey({ homeDir });
-    const encrypted = encryptToken(normalizedToken, key);
-    nextMetadata.token = null;
-    nextMetadata.tokenEncrypted = encrypted.tokenEncrypted;
-    nextMetadata.tokenIv = encrypted.tokenIv;
-    nextMetadata.tokenTag = encrypted.tokenTag;
+    await attachEncryptedTokenFallback(nextMetadata, normalizedToken, { homeDir });
   }
 
   await writeMetadata(filePath, nextMetadata);
@@ -794,7 +819,7 @@ export async function writeStoredSession(
 export async function clearStoredSession({ homeDir } = {}) {
   const { filePath, metadata } = await readMetadata({ homeDir });
   if (metadata && metadata.storage === "keyring") {
-    const keytar = await loadKeytarClient();
+    const keytar = await loadKeytarClient({ allowImplicit: true });
     if (keytar && metadata.keyringAccount) {
       await keytar.deletePassword(metadata.keyringService || KEYRING_SERVICE, metadata.keyringAccount);
     }

package/src/commands/session.js

@@ -1690,6 +1690,14 @@ export function registerSessionCommand(program) {
       let hydration = null;
       let remoteTail = null;
       if (options.remote) {
+        const authSession = await resolveActiveAuthSession({
+          cwd: targetPath,
+          env: process.env,
+          autoRotate: false,
+        });
+        if (!authSession || !authSession.token) {
+          throw new Error(`Remote session read requires authentication. Run \`${authLoginHint()}\` first.`);
+        }
         hydration = await hydrateSessionFromRemote({
           sessionId: normalizedSessionId,
           targetPath,

package/src/session/daemon.js

@@ -453,6 +453,10 @@ async function buildHelpResponseMessage(
       normalizePositiveInteger(daemonState.helpRequestTimeoutMs, HELP_REQUEST_TIMEOUT_MS) * 2
     )
   );
+  const requestCorrelationId =
+    normalizeString(requestEvent?.payload?.requestId) ||
+    normalizeString(requestEvent?.requestId) ||
+    normalizeIsoTimestamp(requestEvent?.ts, daemonState.startedAt);
 
   try {
     const llmResult = await runWithTimeout(
@@ -463,6 +467,15 @@ async function buildHelpResponseMessage(
           prompt: userPrompt,
           maxTokens: 320,
           temperature: 0.1,
+          sessionId: daemonState.sessionId,
+          agentId: SENTI_IDENTITY.id,
+          action: "proxy_llm",
+          usageIdempotencyKey: `senti:${daemonState.sessionId}:help:${requestCorrelationId}`,
+          billingTier: "internal",
+          metadata: {
+            purpose: "senti_help_response",
+            runId: requestCorrelationId,
+          },
         })
       ),
       llmTimeoutMs,