sentinel-verify 1.0.0

package/dist/cli/index.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+// Purpose: CLI entry point for the `sentinel` command — wires subcommands (init, mcp, test-verify) to their implementations.
+import { Command } from "commander";
+import { runInit } from "./commands/init.js";
+import { runTestVerify } from "./commands/testVerify.js";
+import { runTestHallucination } from "./commands/testHallucination.js";
+import { runTestSecurity } from "./commands/testSecurity.js";
+import { runTestStyle } from "./commands/testStyle.js";
+import { startMcpServer } from "../mcp/server.js";
+import { startDashboard, DEFAULT_DASHBOARD_PORT } from "../dashboard/server.js";
+import { runInstallHook, runUninstallHook, runHook } from "./commands/hook.js";
+import { SENTINEL_VERSION } from "../version.js";
+const program = new Command();
+program
+    .name("sentinel")
+    .description("Fully local verification layer for AI coding agents.")
+    .version(SENTINEL_VERSION);
+program
+    .command("init")
+    .description("Set up Sentinel in the current project (creates a local .sentinel/ folder).")
+    .action(() => {
+    runInit(process.cwd());
+});
+program
+    .command("mcp")
+    .description("Start the Sentinel MCP server on stdio (used by your AI coding agent, not run by hand).")
+    .action(async () => {
+    await startMcpServer();
+});
+program
+    .command("test-verify")
+    .description("Manually run the verify_task_match check against a diff, without an agent.")
+    .requiredOption("--task <description>", "The task the change was supposed to accomplish.")
+    .option("--diff-file <path>", "Path to a diff file. If omitted, the diff is read from stdin.")
+    .action(async (options) => {
+    await runTestVerify(process.cwd(), options);
+});
+program
+    .command("test-hallucination")
+    .description("Manually run the check_hallucination check against a diff, without an agent.")
+    .option("--diff-file <path>", "Path to a diff file. If omitted, the diff is read from stdin.")
+    .action(async (options) => {
+    await runTestHallucination(process.cwd(), options);
+});
+program
+    .command("test-security")
+    .description("Manually run the check_security check against a diff, without an agent.")
+    .option("--diff-file <path>", "Path to a diff file. If omitted, the diff is read from stdin.")
+    .action(async (options) => {
+    await runTestSecurity(process.cwd(), options);
+});
+program
+    .command("test-style")
+    .description("Manually run the check_style_consistency check against a diff, without an agent.")
+    .option("--diff-file <path>", "Path to a diff file. If omitted, the diff is read from stdin.")
+    .action(async (options) => {
+    await runTestStyle(process.cwd(), options);
+});
+program
+    .command("dashboard")
+    .description("Open a local-only dashboard showing this project's verification history.")
+    .option("--port <number>", "Port to listen on (127.0.0.1 only).", String(DEFAULT_DASHBOARD_PORT))
+    .action((options) => {
+    const port = Number(options.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid port "${options.port}" — use a number between 1 and 65535.`);
+    }
+    startDashboard(process.cwd(), port);
+});
+program
+    .command("install-hook")
+    .description("Install a git pre-commit hook that checks staged changes before every commit.")
+    .action(() => {
+    runInstallHook();
+});
+program
+    .command("uninstall-hook")
+    .description("Remove the Sentinel pre-commit hook (refuses to touch hooks Sentinel didn't create).")
+    .action(() => {
+    runUninstallHook();
+});
+program
+    .command("hook-run", { hidden: true })
+    .description("Internal: executed by the pre-commit hook to check the staged diff.")
+    .action(async () => {
+    await runHook();
+});
+program.parseAsync().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`sentinel: ${message}`);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,6HAA6H;AAE7H,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE7B,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,6EAA6E,CAAC;KAC1F,MAAM,CAAC,GAAG,EAAE;IACX,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yFAAyF,CAAC;KACtG,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,cAAc,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,4EAA4E,CAAC;KACzF,cAAc,CAAC,sBAAsB,EAAE,iDAAiD,CAAC;KACzF,MAAM,CAAC,oBAAoB,EAAE,+DAA+D,CAAC;KAC7F,MAAM,CAAC,KAAK,EAAE,OAA4C,EAAE,EAAE;IAC7D,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,oBAAoB,CAAC;KAC7B,WAAW,CAAC,8EAA8E,CAAC;KAC3F,MAAM,CAAC,oBAAoB,EAAE,+DAA+D,CAAC;KAC7F,MAAM,CAAC,KAAK,EAAE,OAA8B,EAAE,EAAE;IAC/C,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,yEAAyE,CAAC;KACtF,MAAM,CAAC,oBAAoB,EAAE,+DAA+D,CAAC;KAC7F,MAAM,CAAC,KAAK,EAAE,OAA8B,EAAE,EAAE;IAC/C,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,kFAAkF,CAAC;KAC/F,MAAM,CAAC,oBAAoB,EAAE,+DAA+D,CAAC;KAC7F,MAAM,CAAC,KAAK,EAAE,OAA8B,EAAE,EAAE;IAC/C,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;KAChG,MAAM,CAAC,CAAC,OAAyB,EAAE,EAAE;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,IAAI,uCAAuC,CAAC,CAAC;IACxF,CAAC;IACD,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,cAAc,CAAC;KACvB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,GAAG,EAAE;IACX,cAAc,EAAE,CAAC;AACnB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,sFAAsF,CAAC;KACnG,MAAM,CAAC,GAAG,EAAE;IACX,gBAAgB,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KACrC,WAAW,CAAC,qEAAqE,CAAC;KAClF,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC5C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config/env.js

@@ -0,0 +1,16 @@
+// Purpose: loads a git-ignored .env file from the project directory so API keys never need to live in the repo.
+import { join } from "node:path";
+/**
+ * Loads environment variables from <projectDir>/.env if the file exists.
+ * Variables already set in the real environment always win — the .env file
+ * only fills in gaps. Silently does nothing when no .env file is present.
+ */
+export function loadLocalEnv(projectDir) {
+    try {
+        process.loadEnvFile(join(projectDir, ".env"));
+    }
+    catch {
+        // No .env file — that's fine; keys may come from the shell environment.
+    }
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAEhH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;IAC1E,CAAC;AACH,CAAC"}

package/dist/config/sentinelrc.js

@@ -0,0 +1,104 @@
+// Purpose: loads and validates the optional .sentinelrc project config — tech-stack context, style overrides, per-tool toggles, and custom rules.
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod/v4";
+export const TOOL_KEYS = [
+    "verify_task_match",
+    "check_hallucination",
+    "check_security",
+    "check_style_consistency",
+];
+/** Tools that can run in the pre-commit hook — verify_task_match needs a task description, which doesn't exist at commit time. */
+export const HOOK_TOOL_KEYS = [
+    "check_hallucination",
+    "check_security",
+    "check_style_consistency",
+];
+/** What the pre-commit hook runs when .sentinelrc doesn't say otherwise. */
+export const DEFAULT_HOOK_TOOLS = ["check_security"];
+// Strict objects: unknown keys are validation errors, so typos fail loudly
+// instead of being silently ignored.
+const styleSchema = z
+    .strictObject({
+    indent: z.union([z.literal("tabs"), z.number().int().min(1).max(8)]).optional(),
+    quotes: z.enum(["single", "double"]).optional(),
+    semicolons: z.enum(["always", "never"]).optional(),
+    naming: z.enum(["camelCase", "snake_case"]).optional(),
+    moduleStyle: z.enum(["esm", "commonjs"]).optional(),
+})
+    .optional();
+const configSchema = z.strictObject({
+    /** Free-text description of the project's tech stack, fed to all model prompts. */
+    context: z.string().max(2000, "context must be at most 2000 characters").optional(),
+    /** Style conventions that REPLACE inference for the given dimension. */
+    style: styleSchema,
+    /** Per-tool toggles; a missing entry means enabled. */
+    tools: z
+        .strictObject({
+        verify_task_match: z.boolean().optional(),
+        check_hallucination: z.boolean().optional(),
+        check_security: z.boolean().optional(),
+        check_style_consistency: z.boolean().optional(),
+    })
+        .optional(),
+    /** Project-specific policies, in plain language, fed to the model layer. */
+    rules: z
+        .array(z.string().max(500, "each rule must be at most 500 characters"))
+        .max(20, "at most 20 rules")
+        .optional(),
+    /** Pre-commit hook settings. */
+    hook: z
+        .strictObject({
+        /** Which tools the hook runs (default: check_security only). verify_task_match cannot run in a hook. */
+        tools: z.array(z.enum(HOOK_TOOL_KEYS)).min(1, "hook.tools must list at least one tool").optional(),
+    })
+        .optional(),
+});
+const CONFIG_FILENAMES = [".sentinelrc", ".sentinelrc.json"];
+/**
+ * Loads .sentinelrc from the project root. Returns null when no config file
+ * exists (zero-config default). Throws a clear error when the file is
+ * malformed — a broken config must never be silently ignored.
+ */
+export function loadSentinelrc(projectDir) {
+    const filename = CONFIG_FILENAMES.find((name) => existsSync(join(projectDir, name)));
+    if (!filename)
+        return null;
+    const path = join(projectDir, filename);
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`${filename} is not valid JSON: ${error instanceof Error ? error.message : String(error)}. ` +
+            `Fix the file (or delete it to run with defaults).`);
+    }
+    const parsed = configSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new Error(`${filename} is invalid:\n${z.prettifyError(parsed.error)}\n` +
+            `Fix the file (or delete it to run with defaults).`);
+    }
+    return parsed.data;
+}
+/** True unless the config explicitly disables the tool. */
+export function isToolEnabled(config, tool) {
+    return config?.tools?.[tool] !== false;
+}
+/**
+ * Renders the config's context and rules as prompt blocks, prepended to each
+ * tool's user prompt. Empty string when there is nothing to add — prompts
+ * stay byte-identical to zero-config behavior.
+ */
+export function configPromptBlocks(config) {
+    let blocks = "";
+    if (config?.context) {
+        blocks += `<project_context>\n${config.context}\n</project_context>\n\n`;
+    }
+    if (config?.rules && config.rules.length > 0) {
+        blocks += `<project_rules>\nProject-specific rules — flag clear violations:\n${config.rules
+            .map((rule) => `- ${rule}`)
+            .join("\n")}\n</project_rules>\n\n`;
+    }
+    return blocks;
+}
+//# sourceMappingURL=sentinelrc.js.map

package/dist/config/sentinelrc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinelrc.js","sourceRoot":"","sources":["../../src/config/sentinelrc.ts"],"names":[],"mappings":"AAAA,kJAAkJ;AAElJ,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,yBAAyB;CACjB,CAAC;AAGX,kIAAkI;AAClI,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,qBAAqB;IACrB,gBAAgB;IAChB,yBAAyB;CACjB,CAAC;AAGX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAkB,CAAC,gBAAgB,CAAC,CAAC;AAEpE,2EAA2E;AAC3E,qCAAqC;AACrC,MAAM,WAAW,GAAG,CAAC;KAClB,YAAY,CAAC;IACZ,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,QAAQ,EAAE,CAAC;AAEd,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC,QAAQ,EAAE;IACnF,wEAAwE;IACxE,KAAK,EAAE,WAAW;IAClB,uDAAuD;IACvD,KAAK,EAAE,CAAC;SACL,YAAY,CAAC;QACZ,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACtC,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,QAAQ,EAAE;IACb,4EAA4E;IAC5E,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;SACtE,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC;SAC3B,QAAQ,EAAE;IACb,gCAAgC;IAChC,IAAI,EAAE,CAAC;SACJ,YAAY,CAAC;QACZ,wGAAwG;QACxG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC,QAAQ,EAAE;KACnG,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC1F,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,iBAAiB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC3D,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAA6B,EAAE,IAAa;IACxE,OAAO,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA6B;IAC9D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,sBAAsB,MAAM,CAAC,OAAO,0BAA0B,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,qEAAqE,MAAM,CAAC,KAAK;aACxF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aAC1B,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/dashboard/page.js

@@ -0,0 +1,270 @@
+// Purpose: the dashboard's single self-contained HTML page — inline CSS/JS only, no external assets, no telemetry; all data comes from the local /api/data endpoint.
+export const DASHBOARD_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sentinel — local dashboard</title>
+<style>
+  :root {
+    --surface: #fcfcfb;
+    --surface-2: #f2f1ee;
+    --border: #e3e2de;
+    --text-primary: #0b0b0b;
+    --text-secondary: #52514e;
+    --accent: #2a78d6;
+    --good: #0ca30c;
+    --warning: #fab219;
+    --critical: #d03b3b;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --surface: #1a1a19;
+      --surface-2: #242423;
+      --border: #383835;
+      --text-primary: #ffffff;
+      --text-secondary: #c3c2b7;
+      --accent: #3987e5;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; padding: 24px;
+    background: var(--surface); color: var(--text-primary);
+    font: 14px/1.5 system-ui, -apple-system, sans-serif;
+    max-width: 960px; margin-inline: auto;
+  }
+  header { display: flex; align-items: baseline; gap: 12px; flex-wrap: wrap; margin-bottom: 20px; }
+  h1 { font-size: 18px; margin: 0; }
+  h2 { font-size: 13px; margin: 28px 0 10px; color: var(--text-secondary); text-transform: uppercase; letter-spacing: 0.06em; }
+  .muted { color: var(--text-secondary); font-size: 12px; }
+  .spacer { flex: 1; }
+  button {
+    background: var(--surface-2); color: var(--text-primary);
+    border: 1px solid var(--border); border-radius: 6px;
+    padding: 5px 12px; font: inherit; font-size: 13px; cursor: pointer;
+  }
+  button:hover { border-color: var(--text-secondary); }
+
+  .tiles { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 10px; }
+  .tile { background: var(--surface-2); border: 1px solid var(--border); border-radius: 8px; padding: 12px 14px; }
+  .tile .num { font-size: 26px; font-weight: 650; letter-spacing: -0.02em; }
+  .tile .lbl { font-size: 12px; color: var(--text-secondary); margin-top: 2px; }
+
+  .meter-row { display: grid; grid-template-columns: 170px 1fr 110px; gap: 10px; align-items: center; margin: 8px 0; }
+  .meter-label { font-size: 13px; }
+  .meter-track { background: var(--surface-2); border-radius: 4px; height: 14px; position: relative; overflow: hidden; }
+  .meter-fill { background: var(--accent); height: 100%; border-radius: 4px 0 0 4px; min-width: 0; }
+  .meter-value { font-size: 12px; color: var(--text-secondary); text-align: right; font-variant-numeric: tabular-nums; }
+
+  table { width: 100%; border-collapse: collapse; }
+  th { text-align: left; font-size: 11px; color: var(--text-secondary); text-transform: uppercase; letter-spacing: 0.05em; padding: 6px 8px; border-bottom: 1px solid var(--border); }
+  td { padding: 7px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
+  tr.row { cursor: pointer; }
+  tr.row:hover td { background: var(--surface-2); }
+  .chip { display: inline-flex; align-items: center; gap: 6px; white-space: nowrap; }
+  .dot { width: 8px; height: 8px; border-radius: 50%; flex: none; }
+  .time { font-variant-numeric: tabular-nums; white-space: nowrap; color: var(--text-secondary); }
+
+  .details { background: var(--surface-2); border-radius: 8px; padding: 12px 14px; }
+  .details dt { font-size: 11px; color: var(--text-secondary); text-transform: uppercase; letter-spacing: 0.05em; margin-top: 10px; }
+  .details dt:first-child { margin-top: 0; }
+  .details dd { margin: 2px 0 0; }
+  .issue { border-left: 3px solid var(--border); padding: 4px 10px; margin: 8px 0; }
+  .issue .loc { font-family: ui-monospace, monospace; font-size: 12px; word-break: break-all; }
+  .issue .src { font-size: 11px; color: var(--text-secondary); }
+  .empty { text-align: center; padding: 48px 0; color: var(--text-secondary); }
+</style>
+</head>
+<body>
+<header>
+  <h1>Sentinel</h1>
+  <span class="muted">local verification dashboard — data never leaves this machine</span>
+  <span class="spacer"></span>
+  <span class="muted" id="updated"></span>
+  <button id="refresh">Refresh</button>
+</header>
+<div id="app"><div class="empty">Loading…</div></div>
+
+<script>
+"use strict";
+
+const TOOL_NAMES = {
+  verify_task_match: "Task match",
+  check_hallucination: "Hallucination",
+  check_security: "Security",
+  check_style_consistency: "Style",
+};
+const CLEAN = new Set(["match", "no_issues"]);
+const WARN = new Set(["partial_match"]);
+const EVIDENCE = "evidence_provided";
+
+// All rendering uses createElement/textContent — stored data (diff snippets,
+// reasons) is never injected as HTML.
+function el(tag, className, text) {
+  const node = document.createElement(tag);
+  if (className) node.className = className;
+  if (text !== undefined) node.textContent = text;
+  return node;
+}
+
+function verdictChip(verdict) {
+  const chip = el("span", "chip");
+  const dot = el("span", "dot");
+  // Evidence handoffs are informational (accent), not good/bad — the calling
+  // agent judged, not Sentinel.
+  dot.style.background = verdict === EVIDENCE
+    ? "var(--accent)"
+    : CLEAN.has(verdict)
+      ? "var(--good)" : WARN.has(verdict) ? "var(--warning)" : "var(--critical)";
+  chip.append(dot, el("span", null, verdict.replace(/_/g, " ")));
+  return chip;
+}
+
+function fmtTime(iso) {
+  const d = new Date(iso);
+  return isNaN(d) ? iso : d.toLocaleString();
+}
+
+let expandedId = null;
+
+function renderDetails(row) {
+  const box = el("div", "details");
+  const dl = el("dl");
+  const add = (label, value) => {
+    dl.append(el("dt", null, label), el("dd", null, value));
+  };
+  if (row.task) add("Task", row.task);
+  add("Reason", row.reason);
+  let issues = null;
+  try { issues = row.details ? JSON.parse(row.details) : null; } catch { /* show raw below */ }
+  if (Array.isArray(issues) && issues.length > 0) {
+    dl.append(el("dt", null, "Issues (" + issues.length + ")"));
+    const dd = el("dd");
+    for (const issue of issues) {
+      const item = el("div", "issue");
+      item.append(el("div", "loc", issue.location ?? ""));
+      item.append(el("div", null, issue.reason ?? ""));
+      item.append(el("div", "src", "source: " + (issue.source ?? "?")));
+      dd.append(item);
+    }
+    dl.append(dd);
+  } else if (row.details && issues === null) {
+    add("Details", row.details);
+  }
+  add("Checked by", row.provider + " (" + row.model + ")");
+  box.append(dl);
+  return box;
+}
+
+function render(data) {
+  const app = document.getElementById("app");
+  app.textContent = "";
+
+  const totalRuns = data.summary.reduce((n, s) => n + s.total, 0);
+  const totalFlagged = data.summary.reduce((n, s) => n + s.flagged, 0);
+
+  if (totalRuns === 0) {
+    app.append(el("div", "empty",
+      "No verifications yet. Run a check (e.g. git diff | sentinel test-security) and refresh."));
+    return;
+  }
+
+  // Overview tiles
+  app.append(el("h2", null, "Overview"));
+  const tiles = el("div", "tiles");
+  const tile = (num, lbl) => {
+    const t = el("div", "tile");
+    t.append(el("div", "num", String(num)), el("div", "lbl", lbl));
+    return t;
+  };
+  tiles.append(tile(totalRuns, "Total verifications"), tile(totalFlagged, "Flagged"));
+  const totalEvidence = data.summary.reduce((n, s) => n + (s.evidence ?? 0), 0);
+  if (totalEvidence > 0) tiles.append(tile(totalEvidence, "Agent evidence handoffs"));
+  for (const s of data.summary) {
+    tiles.append(tile(s.total, TOOL_NAMES[s.tool] ?? s.tool));
+  }
+  app.append(tiles);
+
+  // Flag rate meters
+  app.append(el("h2", null, "Flag rate per tool"));
+  for (const s of data.summary) {
+    const pct = s.total === 0 ? 0 : Math.round((s.flagged / s.total) * 100);
+    const row = el("div", "meter-row");
+    row.append(el("div", "meter-label", TOOL_NAMES[s.tool] ?? s.tool));
+    const track = el("div", "meter-track");
+    const fill = el("div", "meter-fill");
+    fill.style.width = pct + "%";
+    track.append(fill);
+    row.append(track);
+    row.append(el("div", "meter-value", s.flagged + " / " + s.total + " (" + pct + "%)"));
+    app.append(row);
+  }
+
+  // History
+  app.append(el("h2", null, "Recent verifications (click a row for details)"));
+  const table = el("table");
+  const thead = el("thead");
+  const headRow = el("tr");
+  for (const h of ["When", "Tool", "Verdict", "Summary"]) headRow.append(el("th", null, h));
+  thead.append(headRow);
+  const tbody = el("tbody");
+  for (const row of data.history) {
+    const tr = el("tr", "row");
+    tr.append(el("td", "time", fmtTime(row.created_at)));
+    tr.append(el("td", null, TOOL_NAMES[row.tool] ?? row.tool));
+    const verdictTd = el("td");
+    verdictTd.append(verdictChip(row.verdict));
+    tr.append(verdictTd);
+    tr.append(el("td", "muted", row.reason.length > 90 ? row.reason.slice(0, 90) + "…" : row.reason));
+    tr.setAttribute("role", "button");
+    tr.setAttribute("tabindex", "0");
+    tr.setAttribute("aria-expanded", String(expandedId === row.id));
+    const toggle = () => {
+      expandedId = expandedId === row.id ? null : row.id;
+      render(data);
+    };
+    tr.addEventListener("click", toggle);
+    tr.addEventListener("keydown", (event) => {
+      if (event.key === "Enter" || event.key === " ") {
+        event.preventDefault();
+        toggle();
+      }
+    });
+    tbody.append(tr);
+    if (expandedId === row.id) {
+      const dtr = el("tr");
+      const dtd = el("td");
+      dtd.colSpan = 4;
+      dtd.append(renderDetails(row));
+      dtr.append(dtd);
+      tbody.append(dtr);
+    }
+  }
+  table.append(thead, tbody);
+  app.append(table);
+}
+
+async function load() {
+  try {
+    const res = await fetch("/api/data");
+    if (!res.ok) throw new Error("HTTP " + res.status);
+    const data = await res.json();
+    render(data);
+    document.getElementById("updated").textContent =
+      "updated " + new Date().toLocaleTimeString() + " · auto-refreshes every 10s";
+  } catch (error) {
+    document.getElementById("app").textContent = "";
+    document.getElementById("app").append(
+      el("div", "empty", "Could not load data (" + error.message + "). Is the server still running?"));
+  }
+}
+
+document.getElementById("refresh").addEventListener("click", load);
+setInterval(load, 10_000);
+load();
+</script>
+</body>
+</html>
+`;
+//# sourceMappingURL=page.js.map

package/dist/dashboard/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../src/dashboard/page.ts"],"names":[],"mappings":"AAAA,qKAAqK;AAErK,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Q7B,CAAC"}

package/dist/dashboard/server.js

@@ -0,0 +1,65 @@
+// Purpose: the local dashboard server — binds to 127.0.0.1 only and serves the self-contained page plus a JSON endpoint over the local SQLite store.
+import { createServer } from "node:http";
+import { openDatabase, getToolSummary, getRecentVerifications } from "../storage/db.js";
+import { DASHBOARD_HTML } from "./page.js";
+export const DEFAULT_DASHBOARD_PORT = 4747;
+/**
+ * Starts the dashboard on 127.0.0.1:<port> and runs until Ctrl+C.
+ * Data is read fresh from .sentinel/sentinel.db on every request, so checks
+ * running in parallel show up on the next refresh.
+ */
+export function startDashboard(projectDir, port) {
+    const server = createServer((req, res) => {
+        const path = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+        if (path === "/") {
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(DASHBOARD_HTML);
+            return;
+        }
+        if (path === "/api/data") {
+            try {
+                const db = openDatabase(projectDir);
+                try {
+                    const payload = {
+                        summary: getToolSummary(db),
+                        history: getRecentVerifications(db),
+                    };
+                    res.writeHead(200, { "content-type": "application/json" });
+                    res.end(JSON.stringify(payload));
+                }
+                finally {
+                    db.close();
+                }
+            }
+            catch (error) {
+                res.writeHead(500, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+            }
+            return;
+        }
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("Not found");
+    });
+    server.on("error", (error) => {
+        if (error.code === "EADDRINUSE") {
+            console.error(`Port ${port} is already in use. Pick another one: sentinel dashboard --port ${port + 1}`);
+        }
+        else {
+            console.error(`Dashboard failed to start: ${error.message}`);
+        }
+        process.exit(1);
+    });
+    server.listen(port, "127.0.0.1", () => {
+        console.log(`Sentinel dashboard running at http://127.0.0.1:${port}`);
+        console.log("Local only — nothing is exposed to the network. Press Ctrl+C to stop.");
+    });
+    const shutdown = () => {
+        console.log("\nStopping dashboard…");
+        server.close(() => process.exit(0));
+        // Failsafe: exit even if a connection lingers (e.g. an open browser tab).
+        setTimeout(() => process.exit(0), 1000).unref();
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+}
+//# sourceMappingURL=server.js.map

package/dist/dashboard/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAAA,qJAAqJ;AAErJ,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QAElE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG;wBACd,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;wBAC3B,OAAO,EAAE,sBAAsB,CAAC,EAAE,CAAC;qBACpC,CAAC;oBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnC,CAAC;wBAAS,CAAC;oBACT,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,QAAQ,IAAI,mEAAmE,IAAI,GAAG,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACpC,OAAO,CAAC,GAAG,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,0EAA0E;QAC1E,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC"}