sentinel-verify 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,84 @@
+# Changelog
+
+All notable changes to Sentinel are documented here.
+
+## 1.0.0 — 2026-07-10 (Phase 9 — first public release)
+
+### Added
+- MIT `LICENSE` file, `prepublishOnly` build script, and packaging hygiene (`files` limits the published package to `dist/` + `CHANGELOG.md`).
+- "Sentinel Verified ✅" README badge snippet for projects that gate their commits/agents with Sentinel.
+
+### Changed
+- Package name finalized: **`sentinel-verify`** (confirmed available on npm).
+- README rewritten for first-time visitors: what it is → quickstart → the two modes → features → configuration reference.
+- Internal planning documents moved out of the repo root into `docs/internal/`.
+
+## 0.10.0 — 2026-07-10 (Phase 8 — git pre-commit hook)
+
+### Added
+- `sentinel install-hook` / `sentinel uninstall-hook`: a marker-signed pre-commit hook that checks `git diff --cached` in standalone mode before every commit. Runs `check_security` by default; configure with the new `hook.tools` field in `.sentinelrc` (`check_hallucination` and `check_style_consistency` may be added; `verify_task_match` cannot run in a hook). Findings block the commit with a printed summary; `git commit --no-verify` bypasses once. Fail-closed: if the model layer is unavailable, the commit is blocked with setup instructions rather than silently allowed.
+- Install refuses to overwrite a pre-commit hook Sentinel didn't create; uninstall refuses to delete one.
+
+## 0.9.0 — 2026-07-10 (Phase 7 — agent-native judgment mode)
+
+### Changed
+- **MCP tools no longer make model calls.** The agent calling them (Claude Code, Cursor, …) is itself a capable model, so each tool now returns deterministic evidence — static findings, the style profile, declared dependencies, `.sentinelrc` context and rules — plus an instruction telling the agent how to judge. No Ollama and no API key are needed in agent mode.
+- MCP-mode runs are logged as `evidence_provided` (Sentinel didn't judge); the dashboard shows these with an informational chip and counts them as flagged only when the handed-over findings list was non-empty.
+- Standalone CLI mode (`sentinel test-*`) is unchanged: with no agent present, the configured provider (Ollama by default, Anthropic with a key) still does the judgment.
+
+## 0.8.0 — 2026-07-08 (Phase 6)
+
+### Added
+- `sentinel dashboard` command: a local-only web dashboard (binds to 127.0.0.1, default port 4747, `--port` to change) showing total verifications and per-tool breakdown, flag rate per tool, recent history newest-first, and click-to-expand details for every stored verification. One self-contained HTML page — no CDN assets, no telemetry, no analytics; auto-refreshes every 10 seconds with a manual refresh button; Ctrl+C stops it cleanly.
+
+## 0.7.0 — 2026-07-08 (Phase 5)
+
+### Added
+- Optional `.sentinelrc` (or `.sentinelrc.json`) project config, validated strictly on load (unknown keys and type errors fail with a clear message, never silently ignored):
+  - `context` — free-text tech-stack description fed into all four tools' model prompts.
+  - `style` — convention overrides (`indent`, `quotes`, `semicolons`, `naming`, `moduleStyle`) that replace inference; pinned conventions are enforced even in projects too new to profile.
+  - `tools` — per-tool enable/disable; disabled tools are not registered on the MCP server and their CLI commands print a skip notice.
+  - `rules` — plain-language project policies fed to the model layer of every tool.
+- Zero-config unchanged: without the file, behavior is identical to 0.6.0.
+
+## 0.6.0 — 2026-07-08 (Phase 4 — completes the four core tools)
+
+### Added
+- `check_style_consistency` MCP tool: profiles the existing codebase's conventions (indent character/width, quotes, semicolons, naming, ESM/CommonJS) from sampled files — excluding files the diff touches — then flags clear deviations. Dominant conventions (≥80%) violated repeatedly are flagged deterministically; the model adds advisory findings, deduplicated and filtered to actual style topics. Verdict: `no_issues` or `style_mismatch`; the detected profile is returned with every result.
+- `sentinel test-style` CLI command (`--diff-file` or piped stdin, exit 1 on findings).
+
+## 0.5.0 — 2026-07-08 (Phase 3)
+
+### Added
+- `check_security` MCP tool: flags leaked secrets (AWS/GitHub/Slack/Google/Stripe/Anthropic/OpenAI/npm keys, private key blocks, JWTs, connection strings with embedded passwords, entropy-gated hardcoded credentials) and unsafe patterns (`eval`, `new Function`, shell command injection, `shell: true`/`shell=True`, disabled TLS verification) via deterministic rules, plus advisory model judgment for context-dependent risks. Verdict: `no_issues` or `security_risk`.
+- `sentinel test-security` CLI command (`--diff-file` or piped stdin, exit 1 on findings).
+- Detected secrets are **masked** (first 4 characters + `…`) in all output and in the local database — Sentinel never stores or prints a whole secret.
+- Shared internals: diff parsing and the static/model combiner extracted to `src/verify/diff.ts` and `src/verify/combine.ts` (no behavior change).
+
+## 0.4.0 — 2026-07-08 (Phase 2)
+
+### Added
+- `check_hallucination` MCP tool: flags hallucinated code in a diff by combining a static evidence check (imported packages verified against package.json/node_modules, imported files and symbols verified against the actual filesystem — JS/TS) with model judgment (made-up methods, invented API usage). Verdict: `no_issues` or `possible_hallucination` with per-issue location, reason, and source.
+- `sentinel test-hallucination` CLI command (`--diff-file` or piped stdin).
+- `details` column on the `verifications` table (JSON per-issue breakdown). Schema version 1 → 2, migrated automatically.
+
+## 0.3.0 — 2026-07-08 (Phase 1 fix: free by default)
+
+### Changed
+- **Ollama is now the default provider** — Sentinel works fully locally and fully free with no API key. Default local model: `qwen2.5-coder`.
+- Anthropic is now opt-in: used only when `ANTHROPIC_API_KEY` is set (or `SENTINEL_PROVIDER=anthropic`). With no key set, Sentinel silently uses Ollama.
+- If Ollama is unreachable and no API key is set, the error explains exactly how to fix it (install Ollama + pull the model, or set a key).
+
+## 0.2.0 — 2026-07-08 (Phase 1)
+
+### Added
+- `verify_task_match` MCP tool: checks whether a code diff functionally accomplishes a stated task using the user's own LLM provider. Returns `match` / `partial_match` / `no_match` plus a reason.
+- Provider layer with Anthropic support (official `@anthropic-ai/sdk`, credentials via `ANTHROPIC_API_KEY` or a git-ignored `.env`). OpenAI and Ollama slots reserved for later phases.
+- `sentinel test-verify` CLI command for running the check manually (`--task`, `--diff-file` or piped stdin).
+- `verifications` table in the local SQLite store (task, diff hash, verdict, reason, provider, model, timestamp). Schema version bumped 0 → 1 with automatic migration.
+- `.env` loading from the project directory (existing shell variables always win).
+
+## 0.1.0 — 2026-07-08 (Phase 0)
+
+### Added
+- Project scaffold: TypeScript, CLI entry point (`sentinel init`, `sentinel mcp`), MCP server skeleton over stdio, local SQLite storage via `node:sqlite` (zero native dependencies), base README.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Abhinav Bansal (AutomateIQ)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,127 @@
+# Sentinel
+
+**A fully local verification layer for AI coding agents.** Sentinel plugs into any MCP-compatible agent (Claude Code, Cursor, Copilot, OpenCode, …) and lets it self-check its own work — does the diff actually do the task, does the code it references exist, did it leak a secret, does it match your codebase's style — before a human ever sees it. Everything runs on your machine: no cloud backend, no telemetry, no account.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-1a1a19)](LICENSE)
+
+## Quickstart
+
+```bash
+# Requires Node.js 24+ (Sentinel uses Node's built-in SQLite — nothing to compile)
+npm install -g sentinel-verify
+
+cd your-project
+sentinel init                              # creates the local .sentinel/ data folder
+
+# Connect your agent (example: Claude Code)
+claude mcp add sentinel -- sentinel mcp
+```
+
+That's it. Your agent now has four verification tools it can call after making changes. In agent mode Sentinel needs **no API key and no local model** — see the two modes below.
+
+Optional extras:
+
+```bash
+sentinel install-hook       # block bad commits at git pre-commit time
+sentinel dashboard          # local-only web UI over your verification history
+```
+
+## The four checks
+
+| Tool | Question it answers |
+|---|---|
+| `verify_task_match` | Does the diff **functionally** accomplish the stated task — not just superficially? |
+| `check_hallucination` | Do the packages, files, and symbols the diff references actually **exist**? (verified against `package.json`, `node_modules`, and the real filesystem) |
+| `check_security` | Any leaked secrets (AWS/GitHub/Slack/Stripe/… keys, private keys, connection strings — detected and **masked**), `eval`, shell injection, disabled TLS, hardcoded credentials? |
+| `check_style_consistency` | Does the diff write code the way **this** project already does? (indentation, quotes, semicolons, naming, module style — measured from your real files) |
+
+Every check combines **deterministic evidence** (filesystem checks, pattern rules, style measurement — authoritative) with **model judgment** (for what rules can't prove). Every result is stored locally in `.sentinel/sentinel.db`.
+
+## Two modes, one important idea
+
+**Agent mode (MCP)** — when an AI agent calls Sentinel's tools, Sentinel does **not** run a model of its own. The calling agent is already a powerful, already-paid-for model; a second, weaker judge adds cost and noise. Instead each tool returns structured **evidence** — the deterministic findings, the measured style profile, your project rules — plus an instruction telling the agent how to judge. Requires nothing: no key, no Ollama.
+
+**Standalone mode (CLI)** — running checks yourself in a terminal, there's no agent to judge, so Sentinel uses its own model layer: **free local Ollama by default** (recommended model: `ollama pull qwen2.5-coder`), or your own Anthropic API key if you set one.
+
+```bash
+git diff | sentinel test-security                       # standalone check, judged locally
+git diff | sentinel test-hallucination
+git diff | sentinel test-style
+sentinel test-verify --task "Add rate limiting" --diff-file change.diff
+```
+
+All `test-*` commands exit non-zero on findings, so they compose into scripts.
+
+| | Agent mode (MCP) | Standalone mode (CLI) |
+|---|---|---|
+| Who judges | The calling agent | Sentinel's configured model |
+| Requirements | Nothing | Ollama running, **or** `ANTHROPIC_API_KEY` |
+| Result | Evidence + judgment instruction | Final verdict (exit code) |
+
+Standalone settings: `SENTINEL_PROVIDER` (`ollama`/`anthropic`; default auto — Anthropic if a key is set, else Ollama), `SENTINEL_MODEL` (model override), `OLLAMA_HOST`, `ANTHROPIC_API_KEY` (env or a git-ignored `.env` in your project root).
+
+## The pre-commit hook
+
+```bash
+sentinel install-hook      # sentinel uninstall-hook to remove
+```
+
+Every `git commit` checks the **staged** diff — `check_security` by default. Findings block the commit with a printed summary; bypass one commit with `git commit --no-verify`. **Fail-closed:** if the model layer is unavailable the commit is blocked with setup instructions — a broken setup never silently waves commits through. Install refuses to overwrite a hook Sentinel didn't create, and uninstall refuses to delete one.
+
+## The local dashboard
+
+```bash
+sentinel dashboard              # http://127.0.0.1:4747   (--port to change)
+```
+
+Totals, per-tool flag rates, and full history with click-to-expand details, served from one self-contained page bound to `127.0.0.1` — no external assets, no analytics. Secrets are masked before storage, so the dashboard can never display one.
+
+## Configuration: `.sentinelrc` (optional)
+
+Zero config is the default. An optional `.sentinelrc` (JSON, strictly validated — typos fail loudly) in your project root adds team standards:
+
+```json
+{
+  "context": "React + TypeScript SPA using GSAP for animations. Modern browsers only.",
+  "style": { "indent": 2, "quotes": "single", "semicolons": "always", "naming": "camelCase", "moduleStyle": "esm" },
+  "tools": { "check_style_consistency": false },
+  "rules": [
+    "Never suggest React class components — function components and hooks only.",
+    "No new npm dependencies without discussion."
+  ],
+  "hook": { "tools": ["check_security", "check_hallucination"] }
+}
+```
+
+| Field | Effect |
+|---|---|
+| `context` | Free-text project description fed to all model prompts (max 2000 chars). |
+| `style` | Convention overrides that **replace** inference — enforced even in brand-new projects. `indent` is `"tabs"` or a number of spaces. |
+| `tools` | Disable any tool: it leaves the MCP server and its CLI command prints a skip notice. |
+| `rules` | Plain-language policies (max 20 × 500 chars) the model layer flags violations of. Short and concrete works best. |
+| `hook.tools` | What the pre-commit hook runs (default `["check_security"]`; `verify_task_match` can't run in a hook). |
+
+## Show you're covered
+
+Integrated Sentinel in your project? Add the badge to your README:
+
+```markdown
+[![Sentinel Verified ✅](https://img.shields.io/badge/Sentinel-Verified%20%E2%9C%85-2a78d6)](https://www.npmjs.com/package/sentinel-verify)
+```
+
+[![Sentinel Verified ✅](https://img.shields.io/badge/Sentinel-Verified%20%E2%9C%85-2a78d6)](https://www.npmjs.com/package/sentinel-verify)
+
+## Design principles
+
+- **100% local** — no Sentinel-owned backend, no telemetry; nothing leaves your machine except your own optional API calls to your own provider.
+- **Free by default** — agent mode needs no model at all; standalone mode runs on local Ollama.
+- **Deterministic first** — filesystem checks, pattern rules, and measurements are authoritative; model judgment fills the gaps and never overrides them.
+- **Agent-agnostic** — plain MCP; not locked to any vendor.
+
+## Language coverage
+
+The deterministic halves of `check_hallucination` and `check_style_consistency` cover JavaScript/TypeScript; `check_security`'s rules cover Node, Python, Go, and shell patterns. Other languages get the model-judgment half of every tool.
+
+## Contributing
+
+Issues and PRs welcome. The codebase is deliberately small and readable: `src/verify/` holds the four tools plus shared diff/combine logic, `src/providers/` the model layer (Ollama, Anthropic — an OpenAI provider is a welcome contribution), `src/mcp/` the server, `src/cli/` the commands, `src/dashboard/` the UI. Keep dependencies minimal (currently three), keep secrets masked, and keep everything local. Licensed MIT.

package/dist/cli/commands/hook.js

@@ -0,0 +1,133 @@
+// Purpose: implements the git pre-commit hook — install/uninstall the marker-signed hook script, and hook-run which checks the staged diff and blocks bad commits.
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadSentinelrc, isToolEnabled, DEFAULT_HOOK_TOOLS, } from "../../config/sentinelrc.js";
+import { loadLocalEnv } from "../../config/env.js";
+import { checkHallucination } from "../../verify/hallucination.js";
+import { checkSecurity } from "../../verify/security.js";
+import { checkStyleConsistency } from "../../verify/style.js";
+/** Present in every hook Sentinel writes — install/uninstall refuse to touch files without it. */
+const SENTINEL_MARKER = "# sentinel-hook";
+const HOOK_RUNNERS = {
+    check_hallucination: checkHallucination,
+    check_security: checkSecurity,
+    check_style_consistency: checkStyleConsistency,
+};
+function git(args, cwd) {
+    return execFileSync("git", args, { encoding: "utf8", cwd }).trim();
+}
+/** Resolves the repo's hooks directory (respects core.hooksPath), or throws a friendly error. */
+function hooksDir() {
+    let out;
+    try {
+        out = git(["rev-parse", "--git-path", "hooks"]);
+    }
+    catch {
+        throw new Error("Not a git repository — run this inside the repo you want the hook in.");
+    }
+    const dir = resolve(process.cwd(), out);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/** Builds the hook script: prefer `sentinel` on PATH, fall back to the absolute paths captured at install time. */
+function hookScript() {
+    const cliEntry = resolve(dirname(fileURLToPath(import.meta.url)), "..", "index.js");
+    return `#!/bin/sh
+${SENTINEL_MARKER} v1 — installed by Sentinel. Remove with: sentinel uninstall-hook. Bypass once with: git commit --no-verify
+if command -v sentinel >/dev/null 2>&1; then
+  exec sentinel hook-run
+fi
+exec "${process.execPath}" "${cliEntry}" hook-run
+`;
+}
+/** `sentinel install-hook` — writes .git/hooks/pre-commit, never overwriting a foreign hook. */
+export function runInstallHook() {
+    const hookPath = join(hooksDir(), "pre-commit");
+    if (existsSync(hookPath) && !readFileSync(hookPath, "utf8").includes(SENTINEL_MARKER)) {
+        throw new Error(`A pre-commit hook already exists at ${hookPath} and it was not created by Sentinel. ` +
+            `Not overwriting it. To combine them, add this line to your existing hook manually: sentinel hook-run`);
+    }
+    writeFileSync(hookPath, hookScript(), { mode: 0o755 });
+    const config = loadSentinelrc(process.cwd());
+    const tools = config?.hook?.tools ?? DEFAULT_HOOK_TOOLS;
+    console.log(`Pre-commit hook installed at ${hookPath}`);
+    console.log(`It checks staged changes with: ${tools.join(", ")} (configure via "hook".tools in .sentinelrc).`);
+    console.log("Findings block the commit. Bypass a single commit with: git commit --no-verify");
+}
+/** `sentinel uninstall-hook` — removes the hook only if Sentinel created it. */
+export function runUninstallHook() {
+    const hookPath = join(hooksDir(), "pre-commit");
+    if (!existsSync(hookPath)) {
+        console.log("No pre-commit hook installed — nothing to remove.");
+        return;
+    }
+    if (!readFileSync(hookPath, "utf8").includes(SENTINEL_MARKER)) {
+        throw new Error(`The pre-commit hook at ${hookPath} was not created by Sentinel — leaving it untouched.`);
+    }
+    unlinkSync(hookPath);
+    console.log("Sentinel pre-commit hook removed.");
+}
+/**
+ * `sentinel hook-run` — what the hook script executes. Checks the staged diff
+ * in standalone mode. Exit 0 allows the commit; anything else blocks it.
+ * Fail-closed: if the model layer is unavailable, the commit is blocked with
+ * instructions rather than silently allowed through.
+ */
+export async function runHook() {
+    let projectDir;
+    try {
+        projectDir = git(["rev-parse", "--show-toplevel"]);
+    }
+    catch {
+        throw new Error("Not a git repository — the Sentinel hook only runs inside one.");
+    }
+    loadLocalEnv(projectDir);
+    const diff = git(["diff", "--cached"], projectDir);
+    if (diff.trim().length === 0) {
+        return; // nothing staged (e.g. empty or amend-only commit) — nothing to check
+    }
+    const config = loadSentinelrc(projectDir);
+    const tools = (config?.hook?.tools ?? DEFAULT_HOOK_TOOLS).filter((tool) => isToolEnabled(config, tool));
+    if (tools.length === 0) {
+        console.log("Sentinel pre-commit: all hook tools are disabled in .sentinelrc — skipping.");
+        return;
+    }
+    console.log(`Sentinel pre-commit: checking staged changes (${tools.join(", ")})…`);
+    let blocked = false;
+    for (const tool of tools) {
+        let outcome;
+        try {
+            outcome = await HOOK_RUNNERS[tool](projectDir, diff);
+        }
+        catch (error) {
+            // Fail closed: a broken setup must not silently wave commits through.
+            const message = error instanceof Error ? error.message : String(error);
+            console.error(`\n🚫 ${tool} could not run: ${message}`);
+            console.error("\nThe commit is blocked because Sentinel could not verify it. " +
+                "Fix the setup above, or bypass this one commit with: git commit --no-verify");
+            process.exitCode = 1;
+            return;
+        }
+        if (outcome.verdict === "no_issues") {
+            console.log(`  ✅ ${tool}: clean`);
+        }
+        else {
+            blocked = true;
+            console.log(`  🚨 ${tool}: ${outcome.issues.length} issue(s)`);
+            outcome.issues.forEach((issue, index) => {
+                console.log(`     ${index + 1}. [${issue.source}] ${issue.location}`);
+                console.log(`        ${issue.reason}`);
+            });
+        }
+    }
+    if (blocked) {
+        console.log("\nCommit blocked by Sentinel. Fix the issues above, or bypass this one commit with: git commit --no-verify");
+        process.exitCode = 1;
+    }
+    else {
+        console.log("Sentinel pre-commit: all checks clean — commit allowed.");
+    }
+}
+//# sourceMappingURL=hook.js.map

package/dist/cli/commands/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/cli/commands/hook.ts"],"names":[],"mappings":"AAAA,mKAAmK;AAEnK,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,cAAc,EACd,aAAa,EACb,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,kGAAkG;AAClG,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAO1C,MAAM,YAAY,GAAoF;IACpG,mBAAmB,EAAE,kBAAkB;IACvC,cAAc,EAAE,aAAa;IAC7B,uBAAuB,EAAE,qBAAqB;CAC/C,CAAC;AAEF,SAAS,GAAG,CAAC,IAAc,EAAE,GAAY;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ;IACf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACxC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mHAAmH;AACnH,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACpF,OAAO;EACP,eAAe;;;;QAIT,OAAO,CAAC,QAAQ,MAAM,QAAQ;CACrC,CAAC;AACF,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CACb,uCAAuC,QAAQ,uCAAuC;YACpF,sGAAsG,CACzG,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,kBAAkB,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC/G,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;AAChG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;IAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,sDAAsD,CACzF,CAAC;IACJ,CAAC;IACD,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,YAAY,CAAC,UAAU,CAAC,CAAC;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,sEAAsE;IAChF,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACxE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC5B,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,iDAAiD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEnF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,mBAAmB,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,gEAAgE;gBAC9D,6EAA6E,CAChF,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CACT,4GAA4G,CAC7G,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/cli/commands/init.js

@@ -0,0 +1,21 @@
+// Purpose: implements `sentinel init` — sets up the local .sentinel/ folder and SQLite database in the current project.
+import { openDatabase, getSchemaVersion, SENTINEL_DIR, DB_FILENAME } from "../../storage/db.js";
+/**
+ * Initializes Sentinel in the given project directory.
+ * Phase 0 placeholder: creates .sentinel/, the local database, and nothing else.
+ */
+export function runInit(projectDir) {
+    const db = openDatabase(projectDir);
+    const version = getSchemaVersion(db);
+    db.close();
+    console.log("Sentinel initialized.");
+    console.log(`  Created ${SENTINEL_DIR}/ with a local SQLite database (${SENTINEL_DIR}/${DB_FILENAME}).`);
+    console.log(`  Schema version: ${version}`);
+    console.log("");
+    console.log("Everything Sentinel stores stays in this folder, on this machine.");
+    console.log(`A .gitignore inside ${SENTINEL_DIR}/ keeps it out of version control automatically.`);
+    console.log("");
+    console.log("Next step: connect your AI coding agent to the Sentinel MCP server.");
+    console.log("  Example (Claude Code):  claude mcp add sentinel -- sentinel mcp");
+}
+//# sourceMappingURL=init.js.map

package/dist/cli/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA,wHAAwH;AAExH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEhG;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,UAAkB;IACxC,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrC,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,aAAa,YAAY,mCAAmC,YAAY,IAAI,WAAW,IAAI,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,uBAAuB,YAAY,kDAAkD,CAAC,CAAC;IACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;AACnF,CAAC"}

package/dist/cli/commands/testHallucination.js

@@ -0,0 +1,35 @@
+// Purpose: implements `sentinel test-hallucination` — runs the check_hallucination tool from the command line, without needing an agent.
+import { checkHallucination, HALLUCINATION_TOOL_NAME } from "../../verify/hallucination.js";
+import { loadLocalEnv } from "../../config/env.js";
+import { loadSentinelrc, isToolEnabled } from "../../config/sentinelrc.js";
+import { readDiffInput } from "../diffInput.js";
+import { SENTINEL_DIR, DB_FILENAME } from "../../storage/db.js";
+/** Reads the diff, runs the hallucination check, and prints a human-readable report. */
+export async function runTestHallucination(projectDir, options) {
+    loadLocalEnv(projectDir);
+    if (!isToolEnabled(loadSentinelrc(projectDir), HALLUCINATION_TOOL_NAME)) {
+        console.log(`Skipped: ${HALLUCINATION_TOOL_NAME} is disabled in .sentinelrc.`);
+        return;
+    }
+    const diff = readDiffInput("test-hallucination", options.diffFile);
+    console.log("Checking for hallucinated packages, files, and APIs…");
+    const result = await checkHallucination(projectDir, diff);
+    console.log("");
+    if (result.verdict === "no_issues") {
+        console.log("✅ NO ISSUES — nothing in the diff looks hallucinated");
+    }
+    else {
+        console.log(`🚨 POSSIBLE HALLUCINATION — ${result.issues.length} issue(s) found`);
+        result.issues.forEach((issue, index) => {
+            console.log(`  ${index + 1}. [${issue.source}] ${issue.location}`);
+            console.log(`     ${issue.reason}`);
+        });
+    }
+    console.log("");
+    console.log(`Checked by ${result.provider} (${result.model}).`);
+    console.log(`Result saved locally to ${SENTINEL_DIR}/${DB_FILENAME}.`);
+    if (result.verdict === "possible_hallucination") {
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=testHallucination.js.map

package/dist/cli/commands/testHallucination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testHallucination.js","sourceRoot":"","sources":["../../../src/cli/commands/testHallucination.ts"],"names":[],"mappings":"AAAA,yIAAyI;AAEzI,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMhE,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,OAAiC;IAEjC,YAAY,CAAC,UAAU,CAAC,CAAC;IACzB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,YAAY,uBAAuB,8BAA8B,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,2BAA2B,YAAY,IAAI,WAAW,GAAG,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/commands/testSecurity.js

@@ -0,0 +1,35 @@
+// Purpose: implements `sentinel test-security` — runs the check_security tool from the command line, without needing an agent.
+import { checkSecurity, SECURITY_TOOL_NAME } from "../../verify/security.js";
+import { loadLocalEnv } from "../../config/env.js";
+import { loadSentinelrc, isToolEnabled } from "../../config/sentinelrc.js";
+import { readDiffInput } from "../diffInput.js";
+import { SENTINEL_DIR, DB_FILENAME } from "../../storage/db.js";
+/** Reads the diff, runs the security check, and prints a human-readable report. */
+export async function runTestSecurity(projectDir, options) {
+    loadLocalEnv(projectDir);
+    if (!isToolEnabled(loadSentinelrc(projectDir), SECURITY_TOOL_NAME)) {
+        console.log(`Skipped: ${SECURITY_TOOL_NAME} is disabled in .sentinelrc.`);
+        return;
+    }
+    const diff = readDiffInput("test-security", options.diffFile);
+    console.log("Checking for leaked secrets and unsafe patterns…");
+    const result = await checkSecurity(projectDir, diff);
+    console.log("");
+    if (result.verdict === "no_issues") {
+        console.log("✅ NO ISSUES — no security risks found in the diff");
+    }
+    else {
+        console.log(`🚨 SECURITY RISK — ${result.issues.length} issue(s) found`);
+        result.issues.forEach((issue, index) => {
+            console.log(`  ${index + 1}. [${issue.source}] ${issue.location}`);
+            console.log(`     ${issue.reason}`);
+        });
+    }
+    console.log("");
+    console.log(`Checked by ${result.provider} (${result.model}). Secrets are masked in output and storage.`);
+    console.log(`Result saved locally to ${SENTINEL_DIR}/${DB_FILENAME}.`);
+    if (result.verdict === "security_risk") {
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=testSecurity.js.map

package/dist/cli/commands/testSecurity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testSecurity.js","sourceRoot":"","sources":["../../../src/cli/commands/testSecurity.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAE/H,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMhE,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,OAA4B;IAE5B,YAAY,CAAC,UAAU,CAAC,CAAC;IACzB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,YAAY,kBAAkB,8BAA8B,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,8CAA8C,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,CAAC,2BAA2B,YAAY,IAAI,WAAW,GAAG,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/commands/testStyle.js

@@ -0,0 +1,41 @@
+// Purpose: implements `sentinel test-style` — runs the check_style_consistency tool from the command line, without needing an agent.
+import { checkStyleConsistency, STYLE_TOOL_NAME } from "../../verify/style.js";
+import { loadLocalEnv } from "../../config/env.js";
+import { loadSentinelrc, isToolEnabled } from "../../config/sentinelrc.js";
+import { readDiffInput } from "../diffInput.js";
+import { SENTINEL_DIR, DB_FILENAME } from "../../storage/db.js";
+/** Reads the diff, runs the style check, and prints the profile plus a report. */
+export async function runTestStyle(projectDir, options) {
+    loadLocalEnv(projectDir);
+    if (!isToolEnabled(loadSentinelrc(projectDir), STYLE_TOOL_NAME)) {
+        console.log(`Skipped: ${STYLE_TOOL_NAME} is disabled in .sentinelrc.`);
+        return;
+    }
+    const diff = readDiffInput("test-style", options.diffFile);
+    console.log("Profiling the project's style and checking the diff against it…");
+    const result = await checkStyleConsistency(projectDir, diff);
+    console.log("");
+    console.log("Project conventions detected:");
+    for (const line of result.profile.split("\n"))
+        console.log(`  ${line}`);
+    console.log("");
+    if (result.verdict === "no_issues") {
+        console.log("✅ NO ISSUES — the diff is consistent with the project's style");
+    }
+    else {
+        console.log(`🎨 STYLE MISMATCH — ${result.issues.length} inconsistency(ies) found`);
+        result.issues.forEach((issue, index) => {
+            console.log(`  ${index + 1}. [${issue.source}] ${issue.location}`);
+            console.log(`     ${issue.reason}`);
+        });
+    }
+    console.log("");
+    if (result.provider !== "none") {
+        console.log(`Checked by ${result.provider} (${result.model}).`);
+    }
+    console.log(`Result saved locally to ${SENTINEL_DIR}/${DB_FILENAME}.`);
+    if (result.verdict === "style_mismatch") {
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=testStyle.js.map

package/dist/cli/commands/testStyle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testStyle.js","sourceRoot":"","sources":["../../../src/cli/commands/testStyle.ts"],"names":[],"mappings":"AAAA,qIAAqI;AAErI,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMhE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,OAAyB;IAC9E,YAAY,CAAC,UAAU,CAAC,CAAC;IACzB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,YAAY,eAAe,8BAA8B,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3D,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,MAAM,CAAC,MAAM,2BAA2B,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACrC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,2BAA2B,YAAY,IAAI,WAAW,GAAG,CAAC,CAAC;IAEvE,IAAI,MAAM,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/commands/testVerify.js

@@ -0,0 +1,36 @@
+// Purpose: implements `sentinel test-verify` — runs the verify_task_match tool from the command line, without needing an agent connected.
+import { verifyTaskMatch, TOOL_NAME } from "../../verify/taskMatch.js";
+import { loadLocalEnv } from "../../config/env.js";
+import { loadSentinelrc, isToolEnabled } from "../../config/sentinelrc.js";
+import { readDiffInput } from "../diffInput.js";
+import { SENTINEL_DIR, DB_FILENAME } from "../../storage/db.js";
+const VERDICT_LABELS = {
+    match: "✅ MATCH — the diff accomplishes the stated task",
+    partial_match: "⚠️  PARTIAL MATCH — the diff only partly accomplishes the task",
+    no_match: "❌ NO MATCH — the diff does not accomplish the task",
+};
+/**
+ * Reads the diff (from --diff-file or piped stdin), runs the verification,
+ * and prints a human-readable verdict.
+ */
+export async function runTestVerify(projectDir, options) {
+    loadLocalEnv(projectDir);
+    if (!isToolEnabled(loadSentinelrc(projectDir), TOOL_NAME)) {
+        console.log(`Skipped: ${TOOL_NAME} is disabled in .sentinelrc.`);
+        return;
+    }
+    const diff = readDiffInput('test-verify --task "..."', options.diffFile);
+    console.log("Verifying task match…");
+    const result = await verifyTaskMatch(projectDir, options.task, diff);
+    console.log("");
+    console.log(VERDICT_LABELS[result.verdict]);
+    console.log(`Reason: ${result.reason}`);
+    console.log("");
+    console.log(`Checked by ${result.provider} (${result.model}).`);
+    console.log(`Result saved locally to ${SENTINEL_DIR}/${DB_FILENAME}.`);
+    // Non-zero exit on no_match so this command can be used in scripts later.
+    if (result.verdict === "no_match") {
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=testVerify.js.map

package/dist/cli/commands/testVerify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testVerify.js","sourceRoot":"","sources":["../../../src/cli/commands/testVerify.ts"],"names":[],"mappings":"AAAA,0IAA0I;AAE1I,OAAO,EAAE,eAAe,EAAE,SAAS,EAAgB,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEhE,MAAM,cAAc,GAA4B;IAC9C,KAAK,EAAE,iDAAiD;IACxD,aAAa,EAAE,gEAAgE;IAC/E,QAAQ,EAAE,oDAAoD;CAC/D,CAAC;AAOF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,OAA0B;IAE1B,YAAY,CAAC,UAAU,CAAC,CAAC;IACzB,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,YAAY,SAAS,8BAA8B,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAErE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,2BAA2B,YAAY,IAAI,WAAW,GAAG,CAAC,CAAC;IAEvE,0EAA0E;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/diffInput.js

@@ -0,0 +1,17 @@
+// Purpose: shared helper for CLI commands that accept a diff via --diff-file or piped stdin.
+import { readFileSync } from "node:fs";
+/**
+ * Reads the diff to check: from the given file path if provided, otherwise
+ * from piped stdin (e.g. `git diff | sentinel ...`). Throws a friendly error
+ * when neither is available.
+ */
+export function readDiffInput(commandName, diffFile) {
+    if (diffFile) {
+        return readFileSync(diffFile, "utf8");
+    }
+    if (!process.stdin.isTTY) {
+        return readFileSync(0, "utf8");
+    }
+    throw new Error(`No diff provided. Pass one with --diff-file <path>, or pipe it in: git diff | sentinel ${commandName} ...`);
+}
+//# sourceMappingURL=diffInput.js.map

package/dist/cli/diffInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diffInput.js","sourceRoot":"","sources":["../../src/cli/diffInput.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAE7F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,QAAiB;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,KAAK,CACb,0FAA0F,WAAW,MAAM,CAC5G,CAAC;AACJ,CAAC"}