Show engine progress in PR scans by javier20dev25 · Pull Request #7 · javier20dev25/sentinel-cli

javier20dev25 · 2026-10-27T20:04:07Z

Adds an analyst-facing PR progress map and wires the Cloud pulse choice to the remote scan API. Lite scans the PR diff locally; Cloud pins the PR head and sends package.json only, after capability validation. The map makes that scope and Cloud's aggregate-only response explicit. GitHub CLI calls now use argument arrays.\n\nValidation: TypeScript typecheck and guarded smoke test passed. Vitest could not run under the host runtime guard because Vite attempts a cmd.exe process and the guard blocks it.

github-actions · 2026-10-27T20:05:19Z

🟡 Sentinel PR Audit — Needs Review

Action: REQUIRES HUMAN REVIEW — Risk band SUSPICIOUS. A human must evaluate each finding before merging.


Repository	`javier20dev25/sentinel-cli`
PR	#7 by `javier20dev25`
Files Analyzed	5
Total Findings	11
Risk Band	SUSPICIOUS
Decision	REVIEW

🟠 HIGH (1)

src/cli/pr_cmd.ts:287 — POTENTIAL_SECRET

Detection: Base64 decoding detected (potential obfuscation).
Risk: Base64-decodes data — a common obfuscation technique for hiding payloads, credentials, or configuration.

const manifest = Buffer.from(content.content.replace(/\s/g, ''), 'base64').toString('utf8');

🟡 MEDIUM (10)

src/cli/pr_cmd.ts:2 — OS_CAPABILITY

Detection: OS process spawning capability introduced.
Risk: Imports OS process-spawning capabilities (spawn, exec, execSync). Allows running system commands — escalates to RCE if arguments are dynamic.

import { execFileSync, execSync } from 'child_process';

src/cli/pr_progress.test.ts:39 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousNoColor = process.env.NO_COLOR;

src/cli/pr_progress.test.ts:40 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousTerm = process.env.TERM;

src/cli/pr_progress.test.ts:41 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:42 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

process.env.TERM = 'xterm';

src/cli/pr_progress.test.ts:51 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousNoColor === undefined) delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:52 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.NO_COLOR = previousNoColor;

src/cli/pr_progress.test.ts:53 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousTerm === undefined) delete process.env.TERM;

src/cli/pr_progress.test.ts:54 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.TERM = previousTerm;

src/cli/pr_progress.ts:31 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

this.color = process.env.NO_COLOR == null && !!this.stream.isTTY && process.env.TERM !== 'dumb';

Scanned by Sentinel CLI | Hash: 9c650319e52f

github-actions · 2026-10-27T20:07:52Z

🟡 Sentinel PR Audit — Needs Review

Action: REQUIRES HUMAN REVIEW — Risk band SUSPICIOUS. A human must evaluate each finding before merging.


Repository	`javier20dev25/sentinel-cli`
PR	#7 by `javier20dev25`
Files Analyzed	5
Total Findings	11
Risk Band	SUSPICIOUS
Decision	REVIEW

🟠 HIGH (1)

src/cli/pr_cmd.ts:287 — POTENTIAL_SECRET

Detection: Base64 decoding detected (potential obfuscation).
Risk: Base64-decodes data — a common obfuscation technique for hiding payloads, credentials, or configuration.

const manifest = Buffer.from(content.content.replace(/\s/g, ''), 'base64').toString('utf8');

🟡 MEDIUM (10)

src/cli/pr_cmd.ts:2 — OS_CAPABILITY

Detection: OS process spawning capability introduced.
Risk: Imports OS process-spawning capabilities (spawn, exec, execSync). Allows running system commands — escalates to RCE if arguments are dynamic.

import { execFileSync, execSync } from 'child_process';

src/cli/pr_progress.test.ts:39 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousNoColor = process.env.NO_COLOR;

src/cli/pr_progress.test.ts:40 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousTerm = process.env.TERM;

src/cli/pr_progress.test.ts:41 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:42 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

process.env.TERM = 'xterm';

src/cli/pr_progress.test.ts:51 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousNoColor === undefined) delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:52 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.NO_COLOR = previousNoColor;

src/cli/pr_progress.test.ts:53 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousTerm === undefined) delete process.env.TERM;

src/cli/pr_progress.test.ts:54 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.TERM = previousTerm;

src/cli/pr_progress.ts:31 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

this.color = process.env.NO_COLOR == null && !!this.stream.isTTY && process.env.TERM !== 'dumb';

Scanned by Sentinel CLI | Hash: 229cda0c5450

github-actions · 2026-10-27T20:22:20Z

🟡 Sentinel PR Audit — Needs Review

Action: REQUIRES HUMAN REVIEW — Risk band SUSPICIOUS. A human must evaluate each finding before merging.


Repository	`javier20dev25/sentinel-cli`
PR	#7 by `javier20dev25`
Files Analyzed	7
Total Findings	11
Risk Band	SUSPICIOUS
Decision	REVIEW

🟡 MEDIUM (10)

src/cli/pr_cmd.ts:2 — OS_CAPABILITY

Detection: OS process spawning capability introduced.
Risk: Imports OS process-spawning capabilities (spawn, exec, execSync). Allows running system commands — escalates to RCE if arguments are dynamic.

import { execFileSync, execSync } from 'child_process';

src/cli/pr_progress.test.ts:39 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousNoColor = process.env.NO_COLOR;

src/cli/pr_progress.test.ts:40 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousTerm = process.env.TERM;

src/cli/pr_progress.test.ts:41 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:42 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

process.env.TERM = 'xterm';

src/cli/pr_progress.test.ts:51 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousNoColor === undefined) delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:52 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.NO_COLOR = previousNoColor;

src/cli/pr_progress.test.ts:53 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousTerm === undefined) delete process.env.TERM;

src/cli/pr_progress.test.ts:54 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.TERM = previousTerm;

src/cli/pr_progress.ts:31 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

this.color = process.env.NO_COLOR == null && !!this.stream.isTTY && process.env.TERM !== 'dumb';

🔵 LOW (1)

src/cli/cloud/cloud_client.ts:402 — NETWORK_ACTIVITY

Detection: Outbound network communication detected.
Risk: Makes outbound HTTP/HTTPS requests. Can exfiltrate secrets, download payloads, or phone home to a C2 server.

const res = await fetch(url, {

Scanned by Sentinel CLI | Hash: baca4b8b1afa

github-actions · 2026-10-27T20:24:18Z

🟡 Sentinel PR Audit — Needs Review

Action: REQUIRES HUMAN REVIEW — Risk band SUSPICIOUS. A human must evaluate each finding before merging.


Repository	`javier20dev25/sentinel-cli`
PR	#7 by `javier20dev25`
Files Analyzed	7
Total Findings	11
Risk Band	SUSPICIOUS
Decision	REVIEW

🟡 MEDIUM (10)

src/cli/pr_cmd.ts:2 — OS_CAPABILITY

Detection: OS process spawning capability introduced.
Risk: Imports OS process-spawning capabilities (spawn, exec, execSync). Allows running system commands — escalates to RCE if arguments are dynamic.

import { execFileSync, execSync } from 'child_process';

src/cli/pr_progress.test.ts:39 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousNoColor = process.env.NO_COLOR;

src/cli/pr_progress.test.ts:40 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousTerm = process.env.TERM;

src/cli/pr_progress.test.ts:41 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:42 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

process.env.TERM = 'xterm';

src/cli/pr_progress.test.ts:51 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousNoColor === undefined) delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:52 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.NO_COLOR = previousNoColor;

src/cli/pr_progress.test.ts:53 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousTerm === undefined) delete process.env.TERM;

src/cli/pr_progress.test.ts:54 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.TERM = previousTerm;

src/cli/pr_progress.ts:31 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

this.color = process.env.NO_COLOR == null && !!this.stream.isTTY && process.env.TERM !== 'dumb';

🔵 LOW (1)

src/cli/cloud/cloud_client.ts:402 — NETWORK_ACTIVITY

Detection: Outbound network communication detected.
Risk: Makes outbound HTTP/HTTPS requests. Can exfiltrate secrets, download payloads, or phone home to a C2 server.

const res = await fetch(url, {

Scanned by Sentinel CLI | Hash: 753b60915b76

github-actions · 2026-10-27T20:34:22Z

🟡 Sentinel PR Audit — Needs Review

Action: REQUIRES HUMAN REVIEW — Risk band SUSPICIOUS. A human must evaluate each finding before merging.


Repository	`javier20dev25/sentinel-cli`
PR	#7 by `javier20dev25`
Files Analyzed	10
Total Findings	11
Risk Band	SUSPICIOUS
Decision	REVIEW

🟡 MEDIUM (10)

src/cli/pr_cmd.ts:2 — OS_CAPABILITY

Detection: OS process spawning capability introduced.
Risk: Imports OS process-spawning capabilities (spawn, exec, execSync). Allows running system commands — escalates to RCE if arguments are dynamic.

import { execFileSync, execSync } from 'child_process';

src/cli/pr_progress.test.ts:39 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousNoColor = process.env.NO_COLOR;

src/cli/pr_progress.test.ts:40 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

const previousTerm = process.env.TERM;

src/cli/pr_progress.test.ts:41 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:42 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

process.env.TERM = 'xterm';

src/cli/pr_progress.test.ts:51 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousNoColor === undefined) delete process.env.NO_COLOR;

src/cli/pr_progress.test.ts:52 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.NO_COLOR = previousNoColor;

src/cli/pr_progress.test.ts:53 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

if (previousTerm === undefined) delete process.env.TERM;

src/cli/pr_progress.test.ts:54 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

else process.env.TERM = previousTerm;

src/cli/pr_progress.ts:31 — ENV_ACCESS

Detection: Access to system environment variables or secrets.
Risk: Reads environment variables that may hold tokens, API keys, or production secrets. If compromised, all env-scoped secrets are exfiltrable.

this.color = process.env.NO_COLOR == null && !!this.stream.isTTY && process.env.TERM !== 'dumb';

🔵 LOW (1)

src/cli/cloud/cloud_client.ts:402 — NETWORK_ACTIVITY

Detection: Outbound network communication detected.
Risk: Makes outbound HTTP/HTTPS requests. Can exfiltrate secrets, download payloads, or phone home to a C2 server.

const res = await fetch(url, {

Scanned by Sentinel CLI | Hash: e1c04436efb8

Show engine progress in PR scans

505fc75

Fix PR progress map test labels

b4f4085

fix(cli): use full Sentinel Cloud PR scans

bc02c8a

fix(cli): normalize Cloud API base URL

1d00973

chore(cli): prepare 4.3.1 release

996d02e

javier20dev25 merged commit bb0296b into master Oct 27, 2026
4 of 6 checks passed

javier20dev25 deleted the codex/terminal-progress-map branch October 27, 2026 20:41

Navigation Menu

Repository navigation

Show engine progress in PR scans - #7

Show engine progress in PR scans#7
javier20dev25 merged 5 commits into
masterfrom
codex/terminal-progress-map

javier20dev25 commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

javier20dev25 commented Oct 27, 2026

Uh oh!

github-actions Bot commented Oct 27, 2026

🟡 Sentinel PR Audit — Needs Review

🟠 HIGH (1)

🟡 MEDIUM (10)

Uh oh!

github-actions Bot commented Oct 27, 2026

🟡 Sentinel PR Audit — Needs Review

🟠 HIGH (1)

🟡 MEDIUM (10)

Uh oh!

github-actions Bot commented Oct 27, 2026

🟡 Sentinel PR Audit — Needs Review

🟡 MEDIUM (10)

🔵 LOW (1)

Uh oh!

github-actions Bot commented Oct 27, 2026

🟡 Sentinel PR Audit — Needs Review

🟡 MEDIUM (10)

🔵 LOW (1)

Uh oh!

github-actions Bot commented Oct 27, 2026

🟡 Sentinel PR Audit — Needs Review

🟡 MEDIUM (10)

🔵 LOW (1)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant