@goliapkg/sentori-cli 1.8.0 → 1.10.0

package/src/__tests__/lint.test.ts

@@ -0,0 +1,185 @@
+import { describe, expect, test, beforeEach, afterEach } from 'bun:test'
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync, readFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { resolve, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { isTest, parseConfig, selected } from '../lint/config.js'
+import { initBaseline, lowerBaseline, makeReport, validateBaseline, validateResponse, sarif } from '../lint/report.js'
+import { swiftRuleset as ruleset, kotlinRuleset } from '../lint/rules.js'
+
+const config = () => parseConfig('version = 1\ninclude = ["**"]')
+const finding = (rule = 'SWSAFE001', path = 'App.swift', line = 1) => ({ rule, path, line, column: 1 })
+
+describe('lint policy', () => {
+  test('insight scopes keep test functions and skip generated paths case insensitively', () => {
+    const c = parseConfig(readFileSync(resolve(import.meta.dir, '../../examples/insight-lint.toml'), 'utf8'))
+    expect(selected('insight-common-ios/App.swift', c)).toBe(true)
+    for (const p of ['insight-consumer-ios/A.swift', 'insight-common-ios/Theme/gEnErAtEd/Foo.swift', 'insight-ios/IconGenerated.swift']) expect(selected(p, c)).toBe(false)
+    expect(selected('insight-common-ios/Tests/A.swift', c)).toBe(true)
+    expect(isTest('insight-ios/FooTest.swift', c)).toBe(true)
+  })
+  test('allows require known rules, paths and meaningful reasons', () => {
+    const prefix = 'version = 1\n[[allow]]\nrule = "SWCON001"\npath = "App.swift"\n'
+    expect(() => parseConfig(prefix)).toThrow('nonempty reason')
+    expect(() => parseConfig(prefix + 'reason = "   "')).toThrow('nonempty reason')
+    expect(parseConfig(prefix + 'reason = "Protected by a lock # verified"').allow[0].reason).toContain('# verified')
+    expect(() => parseConfig(prefix.replace('SWCON001', 'TYPO') + 'reason = "reviewed"')).toThrow('known rule')
+  })
+  test('rejects unsupported and duplicate configuration rather than silently weakening policy', () => {
+    for (const text of ['version = 1\nversion = 1', 'version = 1\nunknown = "x"', 'version = 1\n[rules]\nTYPO = "off"', 'version = 1\n[rules]\nSWCON001 = "off"', 'version = 1\nexcludePathRegex = ["("]']) expect(() => parseConfig(text)).toThrow()
+  })
+  test('counts by rule and file, new files start at zero, warning is non-blocking', () => {
+    const c = config(), old = makeReport(['App.swift'], [finding()], c)
+    const b = initBaseline(old, c)
+    expect(makeReport(['App.swift'], [finding()], c, b).regressions).toHaveLength(0)
+    expect(makeReport(['App.swift'], [finding(), finding('SWSAFE001', 'App.swift', 2)], c, b).regressions).toHaveLength(1)
+    expect(makeReport(['New.swift'], [finding('SWSAFE001', 'New.swift')], c, b).regressions[0].allowed).toBe(0)
+    c.rules.SWSAFE001 = 'warn'
+    expect(makeReport(['App.swift'], [finding()], c).regressions).toHaveLength(0)
+  })
+  test('baseline updates cannot add debt, and cannot absorb concurrency escape hatches', () => {
+    const c = config(), b = initBaseline(makeReport(['App.swift'], [finding()], c), c)
+    const clean = makeReport(['App.swift'], [], c, b)
+    expect(clean.baselineCanDecrease).toBe(true)
+    expect(lowerBaseline(clean, b).counts).toEqual({})
+    expect(() => lowerBaseline(makeReport(['New.swift'], [finding('SWSAFE001', 'New.swift')], c, b), b)).toThrow('exceed')
+    expect(() => initBaseline(makeReport(['App.swift'], [finding('SWCON001')], c), c)).toThrow('allowance')
+  })
+  test('configuration changes and forged baseline entries are rejected', () => {
+    const c = config(), b = initBaseline(makeReport(['App.swift'], [finding()], c), c)
+    expect(validateBaseline(b, c)).toEqual(b)
+    expect(() => validateBaseline(b, { ...c, exclude: ['App.swift'] })).toThrow('scope')
+    expect(() => validateBaseline({ ...b, counts: { 'App.swift': { SWCON001: 3 } } }, c)).toThrow('invalid baseline')
+  })
+  test('length targets ratchet but crossing a hard limit fails even at the same count', () => {
+    const c = config(), length = { ...finding('SWMAINT001'), measured: 51 }
+    const b = initBaseline(makeReport(['App.swift'], [length], c), c)
+    expect(makeReport(['App.swift'], [{ ...length, measured: 200 }], c, b).regressions).toHaveLength(0)
+    const hard = makeReport(['App.swift'], [{ ...length, measured: 201 }], c, b)
+    expect(hard.regressions[0].kind).toBe('hard-limit')
+    expect(() => initBaseline(hard, c)).toThrow('hard limits')
+    expect(() => lowerBaseline(hard, b)).toThrow('exceed')
+    const warningConfig = { ...c, rules: { SWMAINT001: 'warn' as const } }
+    expect(makeReport(['App.swift'], [length], warningConfig).regressions).toHaveLength(0)
+    expect(makeReport(['App.swift'], [{ ...length, measured: 201 }], warningConfig).regressions[0].kind).toBe('hard-limit')
+  })
+  test('tests participate only in function length, and Bool parameters default to warnings', () => {
+    const c = parseConfig('version = 1\ntests = ["**/*Test.swift"]')
+    const path = 'AppTest.swift'
+    const report = makeReport([path], [finding('SWCON001', path), { ...finding('SWMAINT001', path), measured: 51 }, { ...finding('SWMAINT002', path), measured: 501 }, finding('SWAPI002', path)], c)
+    expect(report.results.map(r => r.rule)).toEqual(['SWMAINT001'])
+    const bool = makeReport(['App.swift'], [finding('SWAPI002')], c)
+    expect(bool.results[0].level).toBe('warn')
+    expect(bool.regressions).toHaveLength(0)
+    const parameters = { ...finding('SWAPI001'), measured: 6 }
+    const warning = makeReport(['App.swift'], [parameters], c)
+    expect(warning.results[0].level).toBe('warn')
+    expect(warning.regressions).toHaveLength(0)
+    expect(makeReport(['App.swift'], [parameters], { ...c, rules: { SWAPI001: 'error' } }).regressions).toHaveLength(1)
+  })
+  test('analyzer measurements are required for threshold rules', () => {
+    const response = (diagnostics: unknown[]) => ({ version: 1, ruleset, files: ['App.swift'], diagnostics })
+    expect(() => validateResponse(response([finding('SWMAINT001')]), ['App.swift'])).toThrow('measurement')
+    expect(() => validateResponse(response([{ ...finding('SWMAINT001'), measured: 50 }]), ['App.swift'])).toThrow('measurement')
+    expect(validateResponse(response([{ ...finding('SWMAINT001'), measured: 51 }]), ['App.swift'])).toHaveLength(1)
+  })
+  test('allowance remains visible in SARIF with UTF-16 columns and escaped URI', () => {
+    const c = parseConfig('version = 1\n[[allow]]\nrule = "SWCON001"\npath = "A #é.swift"\nreason = "Protected by Lock"')
+    const r = makeReport(['A #é.swift'], [finding('SWCON001', 'A #é.swift')], c)
+    expect(r.regressions).toHaveLength(0)
+    const s = sarif(r) as any
+    expect(s.runs[0].columnKind).toBe('utf16CodeUnits')
+    expect(s.runs[0].results[0].locations[0].physicalLocation.artifactLocation.uri).toBe('A%20%23%C3%A9.swift')
+    expect(s.runs[0].results[0].suppressions[0].justification).toBe('Protected by Lock')
+  })
+  test('analyzer omission, duplicate diagnostics and unknown rules fail closed', () => {
+    const good = { version: 1, ruleset, files: ['App.swift'], diagnostics: [finding()] }
+    expect(validateResponse(good, ['App.swift'])).toEqual([finding()])
+    for (const bad of [{ ...good, files: [] }, { ...good, diagnostics: [finding(), finding()] }, { ...good, diagnostics: [finding('UNKNOWN')] }, { ...good, diagnostics: [{ ...finding(), line: 0 }] }]) expect(() => validateResponse(bad, ['App.swift'])).toThrow()
+  })
+})
+
+let dir: string
+const entry = resolve(import.meta.dir, '../index.ts')
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'sentori-lint-'))
+  spawnSync('git', ['init', '-q', dir])
+  writeFileSync(join(dir, 'sentori-lint.toml'), 'version = 1\n')
+  // This protocol peer intentionally uses markers, not Swift parsing. Actual
+  // grammar and source locations are exercised by the Swift package tests.
+  writeFileSync(join(dir, 'analyzer.cjs'), `#!${process.execPath}
+const fs = require('node:fs'); const request = JSON.parse(fs.readFileSync(0, 'utf8'));
+if (process.env.LINT_TEST_CRASH) process.exit(2);
+if (process.env.LINT_TEST_ADD_FILE) fs.writeFileSync('Added.swift', 'BAD');
+const diagnostics = request.files.flatMap(path => fs.readFileSync(path, 'utf8').split('\\n').flatMap((line, i) => line.startsWith('BAD') ? [{path, rule: 'SWSAFE001', line: i + 1, column: 1}] : []));
+console.log(JSON.stringify({version: 1, ruleset: ${JSON.stringify(ruleset)}, files: request.files, diagnostics}));
+`, { mode: 0o755 })
+})
+afterEach(() => rmSync(dir, { recursive: true, force: true }))
+function cli(args: string[], env: Record<string, string> = {}) {
+  return spawnSync(process.execPath, [entry, 'lint', '--swift-analyzer', join(dir, 'analyzer.cjs'), '--format', 'json', ...args], { cwd: dir, encoding: 'utf8', env: { ...process.env, ...env } })
+}
+describe('lint CLI failure and baseline contracts', () => {
+  test('untracked new files fail; initialize once, then only lower', () => {
+    writeFileSync(join(dir, 'App.swift'), 'BAD\nBAD\n')
+    expect(cli([]).status).toBe(1)
+    expect(cli(['--baseline', 'baseline.json', '--init-baseline']).status).toBe(0)
+    const original = readFileSync(join(dir, 'baseline.json'), 'utf8')
+    expect(cli(['--baseline', 'baseline.json', '--init-baseline']).status).toBe(2)
+    writeFileSync(join(dir, 'New.swift'), 'BAD\n')
+    expect(cli(['--baseline', 'baseline.json', '--update-baseline']).status).toBe(1)
+    expect(readFileSync(join(dir, 'baseline.json'), 'utf8')).toBe(original)
+    rmSync(join(dir, 'New.swift'))
+    writeFileSync(join(dir, 'App.swift'), 'BAD\n')
+    expect(cli(['--baseline', 'baseline.json', '--update-baseline']).status).toBe(0)
+    expect(JSON.parse(readFileSync(join(dir, 'baseline.json'), 'utf8')).counts['App.swift'].SWSAFE001).toBe(1)
+  })
+  test('partial scan or analyzer failure never writes a baseline', () => {
+    writeFileSync(join(dir, 'App.swift'), 'BAD\n')
+    expect(cli(['App.swift', '--baseline', 'base.json', '--init-baseline']).status).toBe(2)
+    expect(cli(['--changed', 'HEAD', '--baseline', 'base.json', '--init-baseline']).status).toBe(2)
+    expect(cli(['--baseline', 'base.json', '--init-baseline'], { LINT_TEST_CRASH: '1' }).status).toBe(2)
+    expect(existsSync(join(dir, 'base.json'))).toBe(false)
+  })
+  test('changed scan includes untracked files even with no tracked diff', () => {
+    writeFileSync(join(dir, 'App.swift'), 'clean\n')
+    spawnSync('git', ['add', '.'], { cwd: dir })
+    spawnSync('git', ['-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '-qm', 'initial'], { cwd: dir })
+    writeFileSync(join(dir, 'New.swift'), 'BAD\n')
+    const r = cli(['--changed', 'HEAD'])
+    expect(r.status).toBe(1)
+    expect(JSON.parse(r.stdout).files).toEqual(['New.swift'])
+  })
+  test('source added during analysis prevents an incomplete baseline snapshot', () => {
+    writeFileSync(join(dir, 'App.swift'), 'clean\n')
+    expect(cli(['--baseline', 'base.json', '--init-baseline'], { LINT_TEST_ADD_FILE: '1' }).status).toBe(2)
+    expect(existsSync(join(dir, 'base.json'))).toBe(false)
+  })
+  test('selected Kotlin files require a Kotlin analyzer', () => {
+    mkdirSync(join(dir, 'src'))
+    writeFileSync(join(dir, 'src/App.kt'), 'class App')
+    expect(cli(['--kotlin-analyzer', join(dir, 'missing-analyzer')]).status).toBe(2)
+  })
+})
+
+describe('Kotlin protocol and policy', () => {
+  test('rejects cross-language diagnostics and mismatched analyzers', () => {
+    const files = ['App.kt']
+    const response = { version: 1, ruleset: kotlinRuleset, files, diagnostics: [finding('KTSAFE001', 'App.kt')] }
+    expect(validateResponse(response, files, 'kotlin')).toHaveLength(1)
+    expect(() => validateResponse(response, files, 'swift')).toThrow()
+    expect(() => validateResponse({ ...response, diagnostics: [finding('SWSAFE001', 'App.kt')] }, files, 'kotlin')).toThrow()
+  })
+  test('test functions retain hard limits while main-source concurrency cannot be baselined', () => {
+    const c = parseConfig('version = 1\ntests = ["**/src/test/**"]')
+    const path = 'app/src/test/Test.kt'
+    const r = makeReport([path], [finding('KTCON002', path), finding('KTSAFE001', path), { ...finding('KTMAINT001', path), measured: 201 }], c)
+    expect(r.results).toHaveLength(1)
+    expect(r.regressions[0].kind).toBe('hard-limit')
+    expect(() => initBaseline(makeReport(['Main.kt'], [finding('KTCON001', 'Main.kt')], c), c)).toThrow('allowance')
+    const report = makeReport(['Main.kt'], [finding('KTSAFE001', 'Main.kt')], c)
+    const baseline = initBaseline(report, c)
+    expect(validateBaseline(baseline, c)).toEqual(baseline)
+    expect(makeReport(['Main.kt'], report.results, c, baseline).regressions).toHaveLength(0)
+  })
+})

package/src/__tests__/mcp.test.ts

@@ -3,16 +3,20 @@
 import { describe, expect, test } from 'bun:test'
 
 import { buildTools } from '../mcp.js'
+import { fileURLToPath } from 'node:url'
 
 describe('mcp tools', () => {
   const tools = buildTools()
 
-  test('exactly the four closed-loop tools exist', () => {
+  test('the closed loop includes durable watch', () => {
     expect(tools.map((t) => t.name).sort()).toEqual([
+      'sentori_issue_attachment',
       'sentori_issue_bundle',
       'sentori_issue_list',
       'sentori_issue_note',
+      'sentori_issue_read',
       'sentori_issue_resolve',
+      'sentori_issue_watch',
     ])
   })
 
@@ -30,3 +34,126 @@ describe('mcp tools', () => {
     }
   })
 })
+
+test('watch and evidence use the project API with credentials and lossless cursors', async () => {
+  const requests: { url: URL; auth: string | null }[] = []
+  const server = Bun.serve({
+    port: 0,
+    fetch(req) {
+      const url = new URL(req.url)
+      requests.push({ url, auth: req.headers.get('authorization') })
+      if (url.searchParams.get('format') === 'json') return Response.json({ schemaVersion: 1, evidence: { missing: ['stack'] } })
+      if (url.pathname.endsWith('/bundle')) return new Response('# Evidence')
+      return Response.json({ changes: [], nextCursor: 'v1:test:9223372036854775807', hasMore: false })
+    },
+  })
+  try {
+    const tools = buildTools()
+    const ctx = { apiUrl: server.url.toString(), token: 'test-only' }
+    const watch = tools.find((t) => t.name === 'sentori_issue_watch')!
+    const bundle = tools.find((t) => t.name === 'sentori_issue_bundle')!
+    const cursor = 'v1:test:9223372036854775807'
+    const result = await watch.handler({ cursor, limit: 17, waitSeconds: 25 }, ctx)
+    expect(result).toEqual({ changes: [], nextCursor: cursor, hasMore: false })
+    expect(requests[0].url.pathname).toBe('/api/issues/watch')
+    expect(requests[0].url.searchParams.get('cursor')).toBe(cursor)
+    expect(requests[0].url.searchParams.get('waitSeconds')).toBe('25')
+    expect(requests[0].auth).toBe('Bearer test-only')
+    await bundle.handler({ issueId: 'a/b', format: 'json' }, ctx)
+    expect(requests[1].url.pathname).toBe('/api/issues/a%2Fb/bundle')
+    expect(requests[1].url.searchParams.get('format')).toBe('json')
+    expect(await bundle.handler({ issueId: 'test' }, ctx)).toBe('# Evidence')
+    for (const args of [{ waitSeconds: 26 }, { limit: 0 }, { limit: 1.5 }]) {
+      await expect(watch.handler(args, ctx)).rejects.toThrow()
+    }
+    expect(requests).toHaveLength(3)
+  } finally { server.stop(true) }
+})
+
+test('stdio negotiates, stays responsive during watch, and separates protocol and tool errors', async () => {
+  const server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      if (new URL(req.url).pathname.endsWith('/attachments/test')) {
+        return new Response(Buffer.from('R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==', 'base64'), { headers: { 'Content-Type': 'image/gif' } })
+      }
+      if (new URL(req.url).pathname.endsWith('/watch')) {
+        await Bun.sleep(200)
+        return Response.json({ schemaVersion: 1, changes: [], nextCursor: 'v1:test:0', hasMore: false })
+      }
+      return Response.json({ error: 'database_unavailable' }, { status: 503 })
+    },
+  })
+  const source = fileURLToPath(new URL('../mcp.ts', import.meta.url))
+  const requests = [
+    { id: 0, method: 'initialize', params: { protocolVersion: '2025-11-25' } },
+    { id: 1, method: 'tools/call', params: { name: 'sentori_issue_watch', arguments: { waitSeconds: 1 } } },
+    { id: 2, method: 'ping' },
+    { id: 3, method: 'tools/call', params: { name: 'sentori_issue_list' } },
+    { id: 4, method: 'tools/call', params: { name: 'sentori_issue_watch', arguments: { waitSeconds: 26 } } },
+    { id: 5, method: 'unknown' },
+    { id: 6, method: 'tools/call', params: { name: 'missing' } },
+    { id: 7, method: 'tools/list' },
+    { id: 8, method: 'tools/call', params: { name: 'sentori_issue_attachment', arguments: { issueId: 'issue', attachmentRef: 'test' } } },
+  ].map((r) => JSON.stringify({ jsonrpc: '2.0', ...r })).join('\n') + '\nnull\n{broken\n'
+  try {
+    const child = Bun.spawn([process.execPath, '-e', `import {runMcpServer} from ${JSON.stringify(source)}; await runMcpServer({apiUrl: ${JSON.stringify(server.url.toString())}, token: 'test-only'})`], {
+      stdin: new Blob([requests]), stdout: 'pipe', stderr: 'pipe',
+    })
+    const output = await new Response(child.stdout).text()
+    expect(await child.exited).toBe(0)
+    const responses = output.trim().split('\n').map((line) => JSON.parse(line))
+    const byId = (id: number) => responses.find((r) => r.id === id)
+    expect(byId(0).result.protocolVersion).toBe('2025-11-25')
+    expect(byId(1).result.structuredContent.nextCursor).toBe('v1:test:0')
+    expect(responses.indexOf(byId(2))).toBeLessThan(responses.indexOf(byId(1)))
+    expect(byId(3).result.isError).toBe(true)
+    expect(byId(3).result.structuredContent.error).toEqual({ code: 'database_unavailable', status: 503, retryable: true })
+    expect(byId(4).result.isError).toBe(true)
+    expect(byId(5).error.code).toBe(-32601)
+    expect(byId(6).error.code).toBe(-32602)
+    expect(byId(7).result.tools.find((t: { name: string }) => t.name === 'sentori_issue_watch').annotations.readOnlyHint).toBe(true)
+    expect(byId(8).result.content[0]).toEqual({ type: 'image', mimeType: 'image/gif', data: 'R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==' })
+    expect(responses.filter((r) => r.id === null).map((r) => r.error.code)).toEqual([-32600, -32700])
+  } finally { server.stop(true) }
+})
+
+test('attachment reads are bounded even without Content-Length', async () => {
+  const server = Bun.serve({
+    port: 0,
+    fetch() {
+      return new Response(new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array(1024 * 1024))
+          controller.enqueue(new Uint8Array(1))
+          controller.close()
+        },
+      }), { headers: { 'Content-Type': 'text/plain' } })
+    },
+  })
+  try {
+    const tool = buildTools().find((t) => t.name === 'sentori_issue_attachment')!
+    await expect(tool.handler({ issueId: 'i', attachmentRef: 'r' }, { apiUrl: server.url.toString(), token: 'test-only' })).rejects.toThrow('1 MiB')
+  } finally { server.stop(true) }
+})
+
+test('a cancelled watch releases the request without blocking subsequent calls', async () => {
+  const server = Bun.serve({ port: 0, fetch: () => new Promise<Response>(() => {}) })
+  const source = fileURLToPath(new URL('../mcp.ts', import.meta.url))
+  const input = [
+    { id: 1, method: 'tools/call', params: { name: 'sentori_issue_watch', arguments: { waitSeconds: 25 } } },
+    { method: 'notifications/cancelled', params: { requestId: 1, reason: 'test cancellation' } },
+    { id: 2, method: 'ping' },
+  ].map((r) => JSON.stringify({ jsonrpc: '2.0', ...r })).join('\n') + '\n'
+  try {
+    const child = Bun.spawn([process.execPath, '-e', `import {runMcpServer} from ${JSON.stringify(source)}; await runMcpServer({apiUrl: ${JSON.stringify(server.url.toString())}, token: 'test-only'})`], {
+      stdin: new Blob([input]), stdout: 'pipe', stderr: 'pipe',
+    })
+    const output = await new Response(child.stdout).text()
+    expect(await child.exited).toBe(0)
+    const responses = output.trim().split('\n').map((line) => JSON.parse(line))
+    expect(responses).toHaveLength(2)
+    expect(responses.find((r) => r.id === 1).result.isError).toBe(true)
+    expect(responses.find((r) => r.id === 2).result).toEqual({})
+  } finally { server.stop(true) }
+})

package/src/__tests__/workflow.test.ts

@@ -42,7 +42,8 @@ describe('unified release upload', () => {
         const bytes = gunzipSync(Buffer.from(await file.arrayBuffer()))
         const kind = String(form.get('kind'))
         if (kind === 'srcbundle') expect(inspectSourceArchive(bytes, 'app@1+7').files).toEqual(['src/a.ts'])
-        uploaded.push({ kind, name: file.name.replace(/\.gz$/, ''), usable: true, contentHash: createHash('sha256').update(bytes).digest('hex') })
+        const contentHash = createHash('sha256').update(bytes).digest('hex')
+        uploaded.push({ kind, name: file.name.replace(/\.gz$/, ''), usable: true, contentHash, storageVerification: { integrity: 'verified', actualContentHash: contentHash, actualSizeBytes: bytes.length, usable: true } })
         return reply({ id: String(uploaded.length), usable: true }, 201)
       }
       return reply({ release: 'app@1+7', known: uploaded.length > 0, artifacts: uploaded,
@@ -135,3 +136,42 @@ test('matching project is verified before artifact compatibility and upload', as
   expect(calls[0]).toBe('https://upload.test/api/project')
   expect(calls).toHaveLength(2)
 })
+
+
+test('verification fails closed for stale metadata and corrupted or missing stored bytes', async () => {
+  writeFileSync(join(root, 'mapping.txt'), 'A -> a:\n')
+  const plan = prepareUploadPlan(config({ mapping: ['mapping.txt'] }))
+  const file = plan.files[0]!
+  const row = { kind: file.kind, name: file.name, contentHash: file.hash, usable: true }
+  for (const storageVerification of [undefined,
+    { integrity: 'mismatch', actualContentHash: file.hash, actualSizeBytes: 0, usable: true },
+    { integrity: 'unavailable' },
+    { integrity: 'verified', actualContentHash: 'wrong', actualSizeBytes: file.bytes, usable: true },
+  ]) {
+    globalThis.fetch = (async url => {
+      expect(String(url)).toEndWith('?verify=true')
+      return reply({ known: true, release: plan.release, artifacts: [{ ...row, storageVerification }] })
+    }) as typeof fetch
+    expect((await verifyUploadPlan(plan, 't'))[0]).toContain('stored bytes not verified')
+  }
+})
+
+
+test('strict upload preserves HTTP failure details even when verification also fails', async () => {
+  writeFileSync(join(root, 'mapping.txt'), 'A -> a:\n')
+  const path = config({ mapping: ['mapping.txt'] })
+  let posted = false
+  globalThis.fetch = (async (_url, init) => {
+    if (init?.method === 'POST') { posted = true; return reply({ error: 'upstream unavailable' }, 502) }
+    if (posted) return reply({ error: 'verification unavailable' }, 503)
+    return reply({ known: false, release: 'app@1+7', artifacts: [] })
+  }) as typeof fetch
+  const originalError = console.error, messages: string[] = []
+  console.error = (...args) => { messages.push(args.join(' ')) }
+  try { expect(await runWorkflow('upload', ['--config', path, '--strict'])).toBe(1) }
+  finally { console.error = originalError }
+  expect(messages.join('\n')).toContain('mapping.txt: 502')
+  expect(messages.join('\n')).toContain('upstream unavailable')
+  expect(messages.join('\n')).toContain('verification request failed: 503')
+  expect(messages.join('\n')).not.toContain('api-test')
+})

package/src/artifacts.ts

@@ -31,6 +31,7 @@ export type ArtifactRow = {
    *  the check existed — "never looked at", not "looked at and
    *  fine". `false` means it stored and will symbolicate nothing. */
   usable?: boolean | null
+  storageVerification?: { integrity: string; actualContentHash?: string; actualSizeBytes?: number; usable?: boolean | null }
 }
 
 export type ArtifactsResponse = {
@@ -55,10 +56,11 @@ export async function fetchArtifacts(opts: {
   apiUrl: string
   release: string
   token: string
+  verify?: boolean
 }): Promise<ArtifactsResponse> {
   const url =
     `${opts.apiUrl.replace(/\/+$/, '')}/v1/releases/` +
-    `${encodeURIComponent(opts.release)}/artifacts`
+    `${encodeURIComponent(opts.release)}/artifacts${opts.verify ? "?verify=true" : ""}`
   const resp = await fetch(url, {
     headers: { Authorization: `Bearer ${opts.token}` },
   })

package/src/compatibility.ts

@@ -9,7 +9,7 @@ export function checkCompatibility(result: ArtifactsResponse, sourceZip: boolean
   const info = result.compatibility
   if (info === undefined) {
     if (sourceZip) throw new Error('This server does not advertise source ZIP support. No files were uploaded. Upgrade the Sentori server to a build advertising artifact protocol 1 and sourceBundleFormats: ["zip"], then run sentori doctor. Existing CLI 1.5 pipelines may continue using legacy JSON sources.')
-    return 'Legacy artifact API: server capabilities are not advertised. Source maps, dSYM and mapping uploads remain available; verification still requires matching SHA-256 bytes and usable: true.'
+    return 'Legacy artifact API: server capabilities are not advertised. Source maps, dSYM and mapping uploads remain available; verification requires a server that supplies fresh storageVerification proof; inventory metadata alone cannot pass.'
   }
   if (!info || typeof info.serverVersion !== 'string' || info.artifactProtocol !== 1
     || !Array.isArray(info.sourceBundleFormats) || !Array.isArray(info.verification)

package/src/index.ts

@@ -8,7 +8,7 @@ import { listApps, showProject } from './apps.js'
 import {
   fetchBundle,
   formatIssueLine,
-  listIssues,
+  listIssuesPage,
   noteIssue,
   resolveIssue,
 } from './issue.js'
@@ -49,6 +49,9 @@ Legacy kind-presence gate (use verify for exact planned files):
       catches the case a local "we ran the upload" ledger cannot:
       the upload step that stopped being called at all.
 
+Local Swift and Kotlin quality gate (fails on regressions or tool errors):
+  sentori lint [paths...] --help
+
 Regression tripwires (design: probes):
   sentori probes sync --release <r> --token <t> [--dir .]
       Statically scans source for sentori.probe('REF') call sites and
@@ -58,7 +61,7 @@ CI triage (the same /api surface an AI agent uses):
   sentori project show [--json]       project selected by the API token
   sentori app list [--json]           apps within that project
   sentori issue list [--status open] [--kind error] [--app <uuid>]
-      [--platform <platform>] [--environment <env>] [--release <release>] [--json]
+      [--platform <platform>] [--environment <env>] [--release <release>] [--limit 50] [--offset 0] [--json]
   sentori issue resolve <issue-id> [--in-release <r>]
   sentori issue note <issue-id> --body "fixed in abc123"
   sentori issue bundle <issue-id>
@@ -466,7 +469,7 @@ async function cmdIssueList(argv: string[]): Promise<number> {
   try {
     parsed = parseArgs({
       args: argv,
-      options: { ...ISSUE_OPTS, kind: { type: 'string' }, status: { type: 'string' }, app: { type: 'string' }, platform: { type: 'string' }, environment: { type: 'string' }, release: { type: 'string' }, json: { type: 'boolean' } },
+      options: { ...ISSUE_OPTS, kind: { type: 'string' }, status: { type: 'string' }, app: { type: 'string' }, platform: { type: 'string' }, environment: { type: 'string' }, release: { type: 'string' }, limit: { type: 'string' }, offset: { type: 'string' }, json: { type: 'boolean' } },
     })
   } catch (e) {
     console.error(`error: ${(e as Error).message}\n${HELP}`)
@@ -479,15 +482,18 @@ async function cmdIssueList(argv: string[]): Promise<number> {
   const cfg = parseApiCfg(parsed.values)
   if (!cfg) return 2
   try {
-    const rows = await listIssues(cfg, {
+    const page = await listIssuesPage(cfg, {
       kind: parsed.values.kind as string | undefined,
       status: (parsed.values.status as string | undefined) ?? 'open',
       app: parsed.values.app,
       platform: parsed.values.platform,
       environment: parsed.values.environment,
       release: parsed.values.release,
+      limit: parsed.values.limit === undefined ? undefined : Number(parsed.values.limit),
+      offset: parsed.values.offset === undefined ? undefined : Number(parsed.values.offset),
     })
-    if (parsed.values.json) { console.log(JSON.stringify({ issues: rows }, null, 2)); return 0 }
+    if (parsed.values.json) { console.log(JSON.stringify(page, null, 2)); return 0 }
+    const rows = page.issues
     if (rows.length === 0) {
       console.log('(no matching issues)')
       return 0
@@ -721,6 +727,7 @@ async function main(argv: string[]): Promise<number> {
     console.log(HELP)
     return 0
   }
+  if (argv[0] === 'lint') return (await import('./lint/index.js')).cmdLint(argv.slice(1))
   const [a, b, ...rest] = argv
   if (a === 'web') return runWeb(argv.slice(1))
   if (a === 'project' && b === 'show') return cmdProjectApps(rest, false)

package/src/issue.ts

@@ -37,10 +37,19 @@ async function apiFetch<T>(c: ApiConfig, path: string, init?: RequestInit): Prom
   return (await resp.json()) as T
 }
 
-export async function listIssues(
+export type IssueListOptions = { status?: string; kind?: string; app?: string; platform?: string; environment?: string; release?: string; limit?: number; offset?: number }
+export type IssuePage = { issues: Issue[]; total?: number; limit?: number; offset?: number; nextOffset?: number | null }
+
+export async function listIssues(c: ApiConfig, opts: IssueListOptions = {}): Promise<Issue[]> {
+  return (await listIssuesPage(c, opts)).issues
+}
+
+export async function listIssuesPage(
   c: ApiConfig,
-  opts: { status?: string; kind?: string; app?: string; platform?: string; environment?: string; release?: string } = {},
-): Promise<Issue[]> {
+  opts: IssueListOptions = {},
+): Promise<IssuePage> {
+  if (opts.limit !== undefined && (!Number.isSafeInteger(opts.limit) || opts.limit < 1 || opts.limit > 200)) throw new Error('--limit must be an integer from 1 to 200')
+  if (opts.offset !== undefined && (!Number.isSafeInteger(opts.offset) || opts.offset < 0)) throw new Error('--offset must be a non-negative safe integer')
   const q = new URLSearchParams()
   if (opts.status) q.set('status', opts.status)
   if (opts.kind) q.set('kind', opts.kind)
@@ -48,9 +57,11 @@ export async function listIssues(
   if (opts.platform) q.set('platform', opts.platform)
   if (opts.environment) q.set('environment', opts.environment)
   if (opts.release) q.set('release', opts.release)
+  if (opts.limit !== undefined) q.set('limit', String(opts.limit))
+  if (opts.offset !== undefined) q.set('offset', String(opts.offset))
   const qs = q.toString()
-  const body = await apiFetch<{ issues: Issue[] }>(c, `/api/issues${qs ? `?${qs}` : ''}`)
-  return body.issues
+  const body = await apiFetch<IssuePage>(c, `/api/issues${qs ? `?${qs}` : ''}`)
+  return body
 }
 
 export async function resolveIssue(

package/src/lint/config.ts

@@ -0,0 +1,102 @@
+import { ruleById, rules, ruleLanguage, fileLanguage } from './rules.js'
+import type { Level } from './rules.js'
+export type Config = {
+  version: 1; include: string[]; exclude: string[]; tests: string[]
+  excludePathRegex: string[]; rules: Record<string, Level>
+  allow: { rule: string; path: string; reason: string }[]
+}
+// Deliberately small TOML schema: scalar strings/integers, single-line string
+// arrays, [rules], and [[allow]]. Reject unsupported TOML rather than guessing.
+export function parseConfig(source: string): Config {
+  const result: Config = { version: 1, include: ['**'], exclude: [], tests: [], excludePathRegex: [], rules: {}, allow: [] }
+  const seen = new Set<string>()
+  let section = ''
+  let allow: Record<string, unknown> | undefined
+  const allowances: Record<string, unknown>[] = []
+  const stringValue = (raw: string): string => {
+    if (raw.startsWith("'") && raw.endsWith("'") && !raw.slice(1, -1).includes("'")) return raw.slice(1, -1)
+    const value: unknown = JSON.parse(raw)
+    if (typeof value !== 'string') throw Error('expected a string')
+    return value
+  }
+  for (const [index, rawLine] of source.split(/\r?\n/).entries()) {
+    try {
+      // Comments are removed only outside quoted strings.
+      let quote = '', escaped = false, line = ''
+      for (const char of rawLine) {
+        if (!quote && char === '#') break
+        line += char
+        if (escaped) { escaped = false; continue }
+        if (quote === '"' && char === '\\') { escaped = true; continue }
+        if (quote === char) quote = ''
+        else if (!quote && (char === '"' || char === "'")) quote = char
+      }
+      line = line.trim()
+      if (!line) continue
+      if (line === '[rules]') {
+        if (seen.has('[rules]')) throw Error('duplicate [rules]')
+        seen.add('[rules]'); section = 'rules'; continue
+      }
+      if (line === '[[allow]]') { section = 'allow'; allow = {}; allowances.push(allow); continue }
+      const match = /^([A-Za-z][A-Za-z0-9_-]*)\s*=\s*(.+)$/.exec(line)
+      if (!match) throw Error('unsupported TOML; use single-line values, [rules], or [[allow]]')
+      const [, key, raw] = match
+      const identity = section === 'allow' ? `allow.${allowances.length}.${key}` : `${section}.${key}`
+      if (seen.has(identity)) throw Error(`duplicate key ${key}`)
+      seen.add(identity)
+      if (section === 'allow') {
+        if (!['rule', 'path', 'reason'].includes(key)) throw Error(`unknown allowance key ${key}`)
+        allow![key] = stringValue(raw)
+      } else if (section === 'rules') {
+        const rule = ruleById.get(key)
+        if (!rule) throw Error(`unknown rule ${key}`)
+        const level = stringValue(raw)
+        if (!['off', 'warn', 'error'].includes(level)) throw Error(`invalid severity ${level}`)
+        if (rule.allowlistOnly && level !== 'error') throw Error(`${key} requires error severity; use an allowance`)
+        result.rules[key] = level as Level
+      } else if (key === 'version') {
+        if (raw !== '1') throw Error('unsupported config version')
+      } else if (['include', 'exclude', 'tests', 'excludePathRegex'].includes(key)) {
+        // Arrays use TOML basic strings, also valid JSON. No multiline arrays.
+        const value: unknown = JSON.parse(raw)
+        if (!Array.isArray(value) || value.some(v => typeof v !== 'string' || !v)) throw Error(`${key} requires nonempty strings`)
+        ;(result[key as 'include'] as string[]) = value
+      } else throw Error(`unknown configuration key ${key}`)
+    } catch (error) { throw Error(`config line ${index + 1}: ${(error as Error).message}`) }
+  }
+  if (!seen.has('.version')) throw Error('config version = 1 is required')
+  if (!result.include.length) throw Error('include must not be empty')
+  result.allow = allowances.map(a => {
+    if (typeof a.rule !== 'string' || !ruleById.has(a.rule)) throw Error('allowance needs a known rule')
+    if (typeof a.path !== 'string' || !a.path.trim() || a.path.startsWith('/') || a.path.split('/').includes('..')) throw Error('allowance needs a repository-relative path pattern')
+    if (typeof a.reason !== 'string' || !a.reason.trim()) throw Error('allowance needs a nonempty reason')
+    return { rule: a.rule, path: a.path, reason: a.reason.trim() }
+  })
+  for (const pattern of [...result.include, ...result.exclude, ...result.tests, ...result.allow.map(a => a.path)]) glob(pattern)
+  for (const pattern of result.excludePathRegex) new RegExp(pattern, 'i')
+  return result
+}
+export function glob(pattern: string): RegExp {
+  if (pattern.startsWith('/') || pattern.includes('\\') || pattern.split('/').includes('..') || /[\[\]{}]/.test(pattern)) throw Error(`unsupported path glob: ${pattern}`)
+  let regex = '^'
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i]
+    if (c === '*' && pattern[i + 1] === '*') {
+      i++
+      if (pattern[i + 1] === '/') { regex += '(?:.*/)?'; i++ } else regex += '.*'
+    } else if (c === '*') regex += '[^/]*'
+    else if (c === '?') regex += '[^/]'
+    else regex += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  }
+  return new RegExp(regex + '$')
+}
+export function selected(path: string, config: Config): boolean {
+  const any = (patterns: string[]) => patterns.some(p => glob(p).test(path))
+  return any(config.include) && !any(config.exclude)
+    && (!any(config.tests) || rules.some(rule => ruleLanguage(rule.id) === fileLanguage(path) && rule.tests && (config.rules[rule.id] ?? rule.level) !== 'off'))
+    && !config.excludePathRegex.some(p => new RegExp(p, 'i').test(path))
+}
+
+export function isTest(path: string, config: Config): boolean {
+  return config.tests.some(pattern => glob(pattern).test(path))
+}