sentinel-verify 1.0.0

package/dist/mcp/server.js

@@ -0,0 +1,141 @@
+// Purpose: Sentinel's MCP server — in agent mode the tools return deterministic EVIDENCE for the calling agent to judge; Sentinel makes no model calls here.
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { SENTINEL_VERSION } from "../version.js";
+import { gatherTaskMatchEvidence, TOOL_NAME } from "../verify/taskMatch.js";
+import { gatherHallucinationEvidence, HALLUCINATION_TOOL_NAME } from "../verify/hallucination.js";
+import { gatherSecurityEvidence, SECURITY_TOOL_NAME } from "../verify/security.js";
+import { gatherStyleEvidence, STYLE_TOOL_NAME } from "../verify/style.js";
+import { loadLocalEnv } from "../config/env.js";
+import { loadSentinelrc, isToolEnabled } from "../config/sentinelrc.js";
+export const SERVER_NAME = "sentinel";
+const diffInput = z
+    .string()
+    .describe("The code diff to check (unified diff format, e.g. output of `git diff`).");
+// Shared evidence fields, present on every tool's output.
+const evidenceBaseSchema = {
+    mode: z.literal("evidence"),
+    instruction: z.string(),
+    projectContext: z.string(),
+    projectRules: z.array(z.string()),
+};
+const findingSchema = z.object({
+    location: z.string(),
+    reason: z.string(),
+    source: z.literal("static"),
+});
+/** Wraps a synchronous evidence function into an MCP handler with error reporting. */
+function evidenceHandler(toolName, gather) {
+    return async (args) => {
+        try {
+            const evidence = gather(args);
+            return {
+                content: [{ type: "text", text: JSON.stringify(evidence, null, 2) }],
+                // The cast is safe: every evidence payload is a plain JSON object.
+                structuredContent: { ...evidence },
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                content: [{ type: "text", text: `${toolName} failed: ${message}` }],
+                isError: true,
+            };
+        }
+    };
+}
+/**
+ * Starts the MCP server on stdio and keeps running until the client disconnects.
+ *
+ * Agent-native design: an MCP client is itself a capable model, so Sentinel
+ * returns structured evidence and the judgment instruction instead of calling
+ * a second model. No provider (Ollama/Anthropic) is ever contacted from here.
+ *
+ * Important: when speaking MCP over stdio, stdout belongs to the protocol.
+ * Any human-facing logging from this process must go to stderr.
+ */
+export async function startMcpServer() {
+    // The MCP client launches this process in the project directory.
+    loadLocalEnv(process.cwd());
+    // Fail fast on a malformed .sentinelrc — a broken config must never be
+    // silently ignored. Tools disabled there are not registered at all.
+    const config = loadSentinelrc(process.cwd());
+    const server = new McpServer({
+        name: SERVER_NAME,
+        version: SENTINEL_VERSION,
+    });
+    const enabledTools = [];
+    if (isToolEnabled(config, TOOL_NAME)) {
+        enabledTools.push(TOOL_NAME);
+        server.registerTool(TOOL_NAME, {
+            title: "Verify task match (evidence)",
+            description: "Call this after making changes to self-check that the diff actually accomplishes the stated task. " +
+                "Returns evidence (diff statistics, project context and rules) plus an instruction — YOU judge " +
+                "whether the diff functionally matches the task; Sentinel does not run its own model in agent mode.",
+            inputSchema: {
+                task: z
+                    .string()
+                    .describe("The task or intent the change was supposed to accomplish, in plain language."),
+                diff: diffInput,
+            },
+            outputSchema: {
+                ...evidenceBaseSchema,
+                diffFiles: z.array(z.string()),
+                addedLineCount: z.number(),
+            },
+        }, evidenceHandler(TOOL_NAME, ({ task, diff }) => gatherTaskMatchEvidence(process.cwd(), task, diff)));
+    }
+    if (isToolEnabled(config, HALLUCINATION_TOOL_NAME)) {
+        enabledTools.push(HALLUCINATION_TOOL_NAME);
+        server.registerTool(HALLUCINATION_TOOL_NAME, {
+            title: "Check for hallucinations (evidence)",
+            description: "Call this after making changes to catch hallucinated code. Returns filesystem-verified evidence: " +
+                "imported packages missing from package.json/node_modules, imported files or symbols that do not " +
+                "exist (JS/TS), plus the declared dependency list. The staticFindings are facts — combine them with " +
+                "your own judgment of API usage per the instruction in the response.",
+            inputSchema: { diff: diffInput },
+            outputSchema: {
+                ...evidenceBaseSchema,
+                staticFindings: z.array(findingSchema),
+                declaredDependencies: z.array(z.string()).nullable(),
+            },
+        }, evidenceHandler(HALLUCINATION_TOOL_NAME, ({ diff }) => gatherHallucinationEvidence(process.cwd(), diff)));
+    }
+    if (isToolEnabled(config, SECURITY_TOOL_NAME)) {
+        enabledTools.push(SECURITY_TOOL_NAME);
+        server.registerTool(SECURITY_TOOL_NAME, {
+            title: "Check for security risks (evidence)",
+            description: "Call this after making changes to catch security risks. Returns deterministic evidence: leaked " +
+                "secrets (masked — API keys, tokens, private keys, connection strings) and unsafe patterns (eval, " +
+                "shell injection, disabled TLS verification, hardcoded credentials). Combine the staticFindings with " +
+                "your own judgment of context-dependent risks per the instruction in the response.",
+            inputSchema: { diff: diffInput },
+            outputSchema: {
+                ...evidenceBaseSchema,
+                staticFindings: z.array(findingSchema),
+            },
+        }, evidenceHandler(SECURITY_TOOL_NAME, ({ diff }) => gatherSecurityEvidence(process.cwd(), diff)));
+    }
+    if (isToolEnabled(config, STYLE_TOOL_NAME)) {
+        enabledTools.push(STYLE_TOOL_NAME);
+        server.registerTool(STYLE_TOOL_NAME, {
+            title: "Check style consistency (evidence)",
+            description: "Call this after making changes to check the diff against this project's real conventions. Returns " +
+                "the measured style profile (indentation, quotes, semicolons, naming, module style — possibly pinned " +
+                "by .sentinelrc) and deterministic diff-vs-profile findings. Judge unmeasured dimensions yourself " +
+                "per the instruction in the response.",
+            inputSchema: { diff: diffInput },
+            outputSchema: {
+                ...evidenceBaseSchema,
+                profile: z.string(),
+                staticFindings: z.array(findingSchema),
+            },
+        }, evidenceHandler(STYLE_TOOL_NAME, ({ diff }) => gatherStyleEvidence(process.cwd(), diff)));
+    }
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error(`[sentinel] MCP server running on stdio (${SERVER_NAME} v${SENTINEL_VERSION}, agent-native evidence mode). ` +
+        `Tools: ${enabledTools.join(", ") || "(all disabled by .sentinelrc)"}`);
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,6JAA6J;AAE7J,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExE,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,QAAQ,CAAC,0EAA0E,CAAC,CAAC;AAExF,0DAA0D;AAC1D,MAAM,kBAAkB,GAAG;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC5B,CAAC,CAAC;AAEH,sFAAsF;AACtF,SAAS,eAAe,CACtB,QAAgB,EAChB,MAAsB;IAMtB,OAAO,KAAK,EAAE,IAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7E,mEAAmE;gBACnE,iBAAiB,EAAE,EAAE,GAAG,QAAQ,EAA6B;aAC9D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,QAAQ,YAAY,OAAO,EAAE,EAAE,CAAC;gBAC5E,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,iEAAiE;IACjE,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5B,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC;IAEH,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;YACE,KAAK,EAAE,8BAA8B;YACrC,WAAW,EACT,oGAAoG;gBACpG,gGAAgG;gBAChG,oGAAoG;YACtG,WAAW,EAAE;gBACX,IAAI,EAAE,CAAC;qBACJ,MAAM,EAAE;qBACR,QAAQ,CAAC,8EAA8E,CAAC;gBAC3F,IAAI,EAAE,SAAS;aAChB;YACD,YAAY,EAAE;gBACZ,GAAG,kBAAkB;gBACrB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;aAC3B;SACF,EACD,eAAe,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAkC,EAAE,EAAE,CAC5E,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CACnD,CACF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACnD,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;YACE,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EACT,mGAAmG;gBACnG,kGAAkG;gBAClG,qGAAqG;gBACrG,qEAAqE;YACvE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,GAAG,kBAAkB;gBACrB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;gBACtC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;aACrD;SACF,EACD,eAAe,CAAC,uBAAuB,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CACtE,2BAA2B,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CACjD,CACF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC9C,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;YACE,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EACT,iGAAiG;gBACjG,mGAAmG;gBACnG,sGAAsG;gBACtG,mFAAmF;YACrF,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,GAAG,kBAAkB;gBACrB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;aACvC;SACF,EACD,eAAe,CAAC,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CACjE,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAC5C,CACF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QAC3C,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;YACE,KAAK,EAAE,oCAAoC;YAC3C,WAAW,EACT,oGAAoG;gBACpG,sGAAsG;gBACtG,mGAAmG;gBACnG,sCAAsC;YACxC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAChC,YAAY,EAAE;gBACZ,GAAG,kBAAkB;gBACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;gBACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;aACvC;SACF,EACD,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE,CAC9D,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CACzC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,KAAK,CACX,2CAA2C,WAAW,KAAK,gBAAgB,iCAAiC;QAC1G,UAAU,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,+BAA+B,EAAE,CACzE,CAAC;AACJ,CAAC"}

package/dist/providers/anthropic.js

@@ -0,0 +1,72 @@
+// Purpose: Anthropic implementation of the LlmProvider interface — talks to the user's own Anthropic account via the official SDK.
+import Anthropic from "@anthropic-ai/sdk";
+import { zodOutputFormat } from "@anthropic-ai/sdk/helpers/zod";
+/** Default verification model. Override with the SENTINEL_MODEL environment variable. */
+const DEFAULT_MODEL = "claude-opus-4-8";
+export class AnthropicProvider {
+    name = "anthropic";
+    model;
+    client;
+    constructor(model) {
+        this.model = model ?? DEFAULT_MODEL;
+        // The zero-argument constructor resolves credentials from the environment:
+        // ANTHROPIC_API_KEY (including one loaded from the project's .env file),
+        // or a locally stored Anthropic auth profile if one exists.
+        this.client = new Anthropic();
+    }
+    async completeStructured(request) {
+        let response;
+        try {
+            response = await this.client.messages.parse({
+                model: this.model,
+                max_tokens: 16000,
+                thinking: { type: "adaptive" },
+                system: request.system,
+                messages: [{ role: "user", content: request.prompt }],
+                output_config: {
+                    format: zodOutputFormat(request.schema),
+                },
+            });
+        }
+        catch (error) {
+            throw new Error(friendlyApiError(error), { cause: error });
+        }
+        if (response.stop_reason === "refusal") {
+            throw new Error("The model declined to process this request (safety refusal). Try rephrasing the task description.");
+        }
+        if (response.parsed_output == null) {
+            throw new Error(`The model did not return a valid structured answer (stop reason: ${response.stop_reason}).`);
+        }
+        // The SDK validated the output against request.schema; the generic just
+        // doesn't survive the indirection through our provider interface.
+        return response.parsed_output;
+    }
+}
+/** Translates SDK errors into messages a user can act on, most specific first. */
+function friendlyApiError(error) {
+    // No credentials at all — the SDK raises a plain Error for this, so we match its message.
+    if (error instanceof Error &&
+        error.message.startsWith("Could not resolve authentication method")) {
+        return ("No Anthropic API credentials found. Set ANTHROPIC_API_KEY in your shell, " +
+            "or put ANTHROPIC_API_KEY=sk-ant-... in a .env file in your project root " +
+            "(Sentinel loads it automatically and it stays out of git).");
+    }
+    if (error instanceof Anthropic.AuthenticationError) {
+        return ("Anthropic rejected the API credentials. Check that your ANTHROPIC_API_KEY " +
+            "is valid and has not been revoked, then try again.");
+    }
+    if (error instanceof Anthropic.NotFoundError) {
+        return `Model not found. Check the SENTINEL_MODEL value (currently requested model was rejected by the API).`;
+    }
+    if (error instanceof Anthropic.RateLimitError) {
+        return "Anthropic rate limit reached. Wait a moment and try again.";
+    }
+    if (error instanceof Anthropic.APIConnectionError) {
+        return "Could not reach the Anthropic API. Check your network connection.";
+    }
+    if (error instanceof Anthropic.APIError) {
+        return `Anthropic API error (${error.status ?? "unknown status"}): ${error.message}`;
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../src/providers/anthropic.ts"],"names":[],"mappings":"AAAA,mIAAmI;AAEnI,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,yFAAyF;AACzF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,WAAW,CAAC;IACnB,KAAK,CAAS;IACN,MAAM,CAAY;IAEnC,YAAY,KAAc;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,aAAa,CAAC;QACpC,2EAA2E;QAC3E,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAI,OAA6B;QACvD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBACrD,aAAa,EAAE;oBACb,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;iBACxC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,oEAAoE,QAAQ,CAAC,WAAW,IAAI,CAC7F,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,kEAAkE;QAClE,OAAO,QAAQ,CAAC,aAAkB,CAAC;IACrC,CAAC;CACF;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,KAAc;IACtC,0FAA0F;IAC1F,IACE,KAAK,YAAY,KAAK;QACtB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,yCAAyC,CAAC,EACnE,CAAC;QACD,OAAO,CACL,2EAA2E;YAC3E,0EAA0E;YAC1E,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,SAAS,CAAC,mBAAmB,EAAE,CAAC;QACnD,OAAO,CACL,4EAA4E;YAC5E,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,SAAS,CAAC,aAAa,EAAE,CAAC;QAC7C,OAAO,sGAAsG,CAAC;IAChH,CAAC;IACD,IAAI,KAAK,YAAY,SAAS,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO,4DAA4D,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,YAAY,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAClD,OAAO,mEAAmE,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,YAAY,SAAS,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,wBAAwB,KAAK,CAAC,MAAM,IAAI,gBAAgB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/providers/index.js

@@ -0,0 +1,37 @@
+// Purpose: picks the LLM provider — free local Ollama by default; Anthropic only when the user explicitly provides an API key or sets SENTINEL_PROVIDER.
+import { AnthropicProvider } from "./anthropic.js";
+import { OllamaProvider } from "./ollama.js";
+/**
+ * Resolves the provider to use for verification calls.
+ *
+ * Selection order:
+ * 1. SENTINEL_PROVIDER, if set ("ollama" or "anthropic"; "openai" is planned).
+ * 2. Otherwise, ANTHROPIC_API_KEY present -> Anthropic (opt-in via the key).
+ * 3. Otherwise -> Ollama: fully local, fully free, no key required.
+ *
+ * Other variables:
+ * - SENTINEL_MODEL: optional model override for whichever provider is chosen.
+ * - OLLAMA_HOST: where Ollama listens (default http://127.0.0.1:11434).
+ */
+export function resolveProvider() {
+    const requested = process.env.SENTINEL_PROVIDER?.toLowerCase();
+    const model = process.env.SENTINEL_MODEL;
+    if (requested) {
+        switch (requested) {
+            case "ollama":
+                return new OllamaProvider(model);
+            case "anthropic":
+                return new AnthropicProvider(model);
+            case "openai":
+                throw new Error('Provider "openai" is planned but not implemented yet. ' +
+                    "Unset SENTINEL_PROVIDER to use free local Ollama, or set it to \"anthropic\".");
+            default:
+                throw new Error(`Unknown provider "${requested}". Supported values for SENTINEL_PROVIDER: ollama, anthropic.`);
+        }
+    }
+    if (process.env.ANTHROPIC_API_KEY) {
+        return new AnthropicProvider(model);
+    }
+    return new OllamaProvider(model);
+}
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,yJAAyJ;AAGzJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAEzC,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,QAAQ;gBACX,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;YACnC,KAAK,WAAW;gBACd,OAAO,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACtC,KAAK,QAAQ;gBACX,MAAM,IAAI,KAAK,CACb,wDAAwD;oBACtD,+EAA+E,CAClF,CAAC;YACJ;gBACE,MAAM,IAAI,KAAK,CACb,qBAAqB,SAAS,+DAA+D,CAC9F,CAAC;QACN,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/providers/ollama.js

@@ -0,0 +1,102 @@
+// Purpose: Ollama implementation of the LlmProvider interface — fully local, fully free verification with no API key.
+import { z } from "zod/v4";
+/** Default local model. Recommended: code-tuned and small enough to download quickly. */
+export const DEFAULT_OLLAMA_MODEL = "qwen2.5-coder";
+const DEFAULT_HOST = "http://127.0.0.1:11434";
+/** Generous ceiling for one verification on slow hardware. */
+const REQUEST_TIMEOUT_MS = 150_000;
+export class OllamaProvider {
+    name = "ollama";
+    model;
+    host;
+    constructor(model) {
+        this.model = model ?? DEFAULT_OLLAMA_MODEL;
+        // OLLAMA_HOST follows Ollama's own convention and may omit the scheme.
+        let host = process.env.OLLAMA_HOST ?? DEFAULT_HOST;
+        if (!/^https?:\/\//.test(host)) {
+            host = `http://${host}`;
+        }
+        this.host = host.replace(/\/+$/, "");
+    }
+    async completeStructured(request) {
+        try {
+            return await this.requestOnce(request, 0);
+        }
+        catch (error) {
+            // Small local models occasionally produce malformed output — one retry
+            // with a little sampling variety usually recovers; then we give up.
+            if (error instanceof MalformedOutputError) {
+                return await this.requestOnce(request, 0.4);
+            }
+            throw error;
+        }
+    }
+    async requestOnce(request, temperature) {
+        let response;
+        try {
+            response = await fetch(`${this.host}/api/chat`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                // Small models can get stuck generating forever under a schema
+                // constraint — cap the wait instead of hanging indefinitely.
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                body: JSON.stringify({
+                    model: this.model,
+                    stream: false,
+                    // Ollama constrains the output to this JSON schema.
+                    format: z.toJSONSchema(request.schema),
+                    // num_predict caps runaway generation; verdicts are short.
+                    options: { temperature, num_predict: 2048 },
+                    messages: [
+                        { role: "system", content: request.system },
+                        { role: "user", content: request.prompt },
+                    ],
+                }),
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === "TimeoutError") {
+                throw new Error(`The local model "${this.model}" took longer than ${REQUEST_TIMEOUT_MS / 1000}s to answer. ` +
+                    `Try again, or use a stronger model (e.g. ollama pull ${DEFAULT_OLLAMA_MODEL}).`, { cause: error });
+            }
+            throw new Error(unreachableMessage(this.host), { cause: error });
+        }
+        if (!response.ok) {
+            const body = await response.text();
+            if (response.status === 404 && body.includes("not found")) {
+                throw new Error(`Ollama is running, but the model "${this.model}" is not installed. ` +
+                    `Run: ollama pull ${this.model}`);
+            }
+            throw new Error(`Ollama returned an error (HTTP ${response.status}): ${body}`);
+        }
+        const data = (await response.json());
+        const content = data.message?.content ?? "";
+        let json;
+        try {
+            json = JSON.parse(content);
+        }
+        catch {
+            throw new MalformedOutputError(`The local model "${this.model}" did not return valid JSON. ` +
+                `Smaller models occasionally do this — try again, or use a stronger model ` +
+                `(e.g. ollama pull ${DEFAULT_OLLAMA_MODEL}).`);
+        }
+        const parsed = request.schema.safeParse(json);
+        if (!parsed.success) {
+            throw new MalformedOutputError(`The local model "${this.model}" returned JSON in an unexpected shape. ` +
+                `Try again, or use a stronger model (e.g. ollama pull ${DEFAULT_OLLAMA_MODEL}).`);
+        }
+        return parsed.data;
+    }
+}
+/** The model answered, but not with usable JSON — worth exactly one retry. */
+class MalformedOutputError extends Error {
+}
+function unreachableMessage(host) {
+    return (`Could not reach Ollama at ${host}. Sentinel is free by default and uses a local model via Ollama.\n` +
+        `To fix, either:\n` +
+        `  1. Install Ollama from https://ollama.com, then run:\n` +
+        `       ollama pull ${DEFAULT_OLLAMA_MODEL}\n` +
+        `     and make sure the Ollama app (or \`ollama serve\`) is running.\n` +
+        `  2. Or set ANTHROPIC_API_KEY (shell env or a git-ignored .env file) to use Anthropic instead.`);
+}
+//# sourceMappingURL=ollama.js.map

package/dist/providers/ollama.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ollama.js","sourceRoot":"","sources":["../../src/providers/ollama.ts"],"names":[],"mappings":"AAAA,sHAAsH;AAEtH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAG3B,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACpD,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAC9C,8DAA8D;AAC9D,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,QAAQ,CAAC;IAChB,KAAK,CAAS;IACN,IAAI,CAAS;IAE9B,YAAY,KAAc;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,oBAAoB,CAAC;QAC3C,uEAAuE;QACvE,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,YAAY,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,GAAG,UAAU,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAI,OAA6B;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAI,OAA6B,EAAE,WAAmB;QAC7E,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,WAAW,EAAE;gBAC9C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,+DAA+D;gBAC/D,6DAA6D;gBAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,KAAK;oBACb,oDAAoD;oBACpD,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;oBACtC,2DAA2D;oBAC3D,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE;oBAC3C,QAAQ,EAAE;wBACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;wBAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;qBAC1C;iBACF,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,KAAK,sBAAsB,kBAAkB,GAAG,IAAI,eAAe;oBAC1F,wDAAwD,oBAAoB,IAAI,EAClF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,KAAK,sBAAsB;oBACnE,oBAAoB,IAAI,CAAC,KAAK,EAAE,CACnC,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuC,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QAE5C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,IAAI,CAAC,KAAK,+BAA+B;gBAC3D,2EAA2E;gBAC3E,qBAAqB,oBAAoB,IAAI,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,IAAI,CAAC,KAAK,0CAA0C;gBACtE,wDAAwD,oBAAoB,IAAI,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,oBAAqB,SAAQ,KAAK;CAAG;AAE3C,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,CACL,6BAA6B,IAAI,oEAAoE;QACrG,mBAAmB;QACnB,0DAA0D;QAC1D,sBAAsB,oBAAoB,IAAI;QAC9C,uEAAuE;QACvE,gGAAgG,CACjG,CAAC;AACJ,CAAC"}

package/dist/providers/types.js

@@ -0,0 +1,3 @@
+// Purpose: defines the provider-agnostic LLM interface so Anthropic, OpenAI, and Ollama can be swapped without touching the verification tools.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/providers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/providers/types.ts"],"names":[],"mappings":"AAAA,gJAAgJ"}

package/dist/storage/db.js

@@ -0,0 +1,123 @@
+// Purpose: opens (and migrates) Sentinel's local SQLite database at .sentinel/sentinel.db — all persistence is local, nothing leaves the machine.
+import { DatabaseSync } from "node:sqlite";
+import { mkdirSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+export const SENTINEL_DIR = ".sentinel";
+export const DB_FILENAME = "sentinel.db";
+/**
+ * Migrations, applied in order. MIGRATIONS[n] upgrades a database from schema
+ * version n to n+1. The current schema version is simply MIGRATIONS.length.
+ */
+const MIGRATIONS = [
+    // 0 -> 1: table for verification results (Phase 1: verify_task_match).
+    `
+  CREATE TABLE IF NOT EXISTS verifications (
+    id         INTEGER PRIMARY KEY AUTOINCREMENT,
+    tool       TEXT NOT NULL,
+    task       TEXT NOT NULL,
+    diff_hash  TEXT NOT NULL,
+    verdict    TEXT NOT NULL,
+    reason     TEXT NOT NULL,
+    provider   TEXT NOT NULL,
+    model      TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+  );
+  `,
+    // 1 -> 2: optional JSON details (Phase 2: per-issue breakdown for check_hallucination).
+    `ALTER TABLE verifications ADD COLUMN details TEXT;`,
+];
+export const CURRENT_SCHEMA_VERSION = MIGRATIONS.length;
+/**
+ * Ensures the .sentinel/ folder exists inside the given project directory.
+ * Also drops a .gitignore inside it so the local database is never committed.
+ * Returns the absolute path to the .sentinel/ folder.
+ */
+export function ensureSentinelDir(projectDir) {
+    const dir = join(projectDir, SENTINEL_DIR);
+    mkdirSync(dir, { recursive: true });
+    // Self-ignoring folder (same trick as .terraform/): keeps local data out of git
+    // without touching the user's own .gitignore.
+    const gitignorePath = join(dir, ".gitignore");
+    if (!existsSync(gitignorePath)) {
+        writeFileSync(gitignorePath, "# Sentinel local data — never commit.\n*\n");
+    }
+    return dir;
+}
+/**
+ * Opens the local SQLite database for a project, creating the file on first
+ * run and applying any pending schema migrations. Callers must close() the
+ * returned handle.
+ */
+export function openDatabase(projectDir) {
+    const dir = ensureSentinelDir(projectDir);
+    const db = new DatabaseSync(join(dir, DB_FILENAME));
+    // WAL mode: safer concurrent reads while a verification is being written.
+    db.exec("PRAGMA journal_mode = WAL;");
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS meta (
+      key   TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+  `);
+    db.prepare("INSERT OR IGNORE INTO meta (key, value) VALUES ('schema_version', '0')").run();
+    // Apply pending migrations, one version at a time.
+    let version = getSchemaVersion(db);
+    while (version < CURRENT_SCHEMA_VERSION) {
+        db.exec("BEGIN");
+        try {
+            db.exec(MIGRATIONS[version]);
+            version += 1;
+            db.prepare("UPDATE meta SET value = ? WHERE key = 'schema_version'").run(String(version));
+            db.exec("COMMIT");
+        }
+        catch (error) {
+            db.exec("ROLLBACK");
+            db.close();
+            throw error;
+        }
+    }
+    return db;
+}
+/** Reads the schema version stored in the database. */
+export function getSchemaVersion(db) {
+    const row = db
+        .prepare("SELECT value FROM meta WHERE key = 'schema_version'")
+        .get();
+    return row ? Number(row.value) : -1;
+}
+/**
+ * Aggregates run counts per tool. "Flagged" means something was found: a
+ * non-clean verdict in standalone mode, or an evidence handoff whose stored
+ * findings list is non-empty (Sentinel didn't judge, but it found things).
+ */
+export function getToolSummary(db) {
+    return db
+        .prepare(`SELECT tool,
+              COUNT(*) AS total,
+              SUM(CASE
+                    WHEN verdict IN ('match', 'no_issues') THEN 0
+                    WHEN verdict = 'evidence_provided' THEN
+                      CASE WHEN details IS NOT NULL AND json_valid(details) AND json_array_length(details) > 0
+                           THEN 1 ELSE 0 END
+                    ELSE 1
+                  END) AS flagged,
+              SUM(CASE WHEN verdict = 'evidence_provided' THEN 1 ELSE 0 END) AS evidence
+       FROM verifications GROUP BY tool ORDER BY tool`)
+        .all();
+}
+/** Most recent verifications, newest first. */
+export function getRecentVerifications(db, limit = 200) {
+    return db
+        .prepare(`SELECT id, tool, task, verdict, reason, details, provider, model, created_at
+       FROM verifications ORDER BY id DESC LIMIT ?`)
+        .all(limit);
+}
+/** Persists one verification result and returns its row id. */
+export function insertVerification(db, record) {
+    const result = db
+        .prepare(`INSERT INTO verifications (tool, task, diff_hash, verdict, reason, details, provider, model)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(record.tool, record.task, record.diffHash, record.verdict, record.reason, record.details ?? null, record.provider, record.model);
+    return Number(result.lastInsertRowid);
+}
+//# sourceMappingURL=db.js.map

package/dist/storage/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/storage/db.ts"],"names":[],"mappings":"AAAA,kJAAkJ;AAElJ,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,GAAa;IAC3B,uEAAuE;IACvE;;;;;;;;;;;;GAYC;IACD,wFAAwF;IACxF,oDAAoD;CACrD,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC,MAAM,CAAC;AAexD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,gFAAgF;IAChF,8CAA8C;IAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,aAAa,EAAE,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAEtC,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IACH,EAAE,CAAC,OAAO,CACR,wEAAwE,CACzE,CAAC,GAAG,EAAE,CAAC;IAER,mDAAmD;IACnD,IAAI,OAAO,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,OAAO,GAAG,sBAAsB,EAAE,CAAC;QACxC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC,CAAC;YACb,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CACtE,MAAM,CAAC,OAAO,CAAC,CAChB,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,EAAgB;IAC/C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,qDAAqD,CAAC;SAC9D,GAAG,EAAmC,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgB;IAC7C,OAAO,EAAE;SACN,OAAO,CACN;;;;;;;;;;sDAUgD,CACjD;SACA,GAAG,EAAiC,CAAC;AAC1C,CAAC;AAeD,+CAA+C;AAC/C,MAAM,UAAU,sBAAsB,CAAC,EAAgB,EAAE,KAAK,GAAG,GAAG;IAClE,OAAO,EAAE;SACN,OAAO,CACN;mDAC6C,CAC9C;SACA,GAAG,CAAC,KAAK,CAAiC,CAAC;AAChD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,EAAgB,EAChB,MAA0B;IAE1B,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CACN;uCACiC,CAClC;SACA,GAAG,CACF,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,IAAI,IAAI,EACtB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AACxC,CAAC"}

package/dist/verify/combine.js

@@ -0,0 +1,42 @@
+// Purpose: shared combiner logic — static findings are authoritative, and model findings that duplicate them are removed deterministically (never by prompt instruction alone).
+/** Normalizes an issue location to a comparable "file:line" key, or null if it has none. */
+export function locationKey(location) {
+    const match = /([\w@$./-]+:\d+)/.exec(location);
+    return match ? match[1] : null;
+}
+/**
+ * Drops model issues that duplicate a static finding:
+ * 1. pointing at an already-flagged file:line, or
+ * 2. mentioning an identifier the static check already flagged (static
+ *    reasons quote their identifiers with double quotes), or
+ * 3. having no line number while quoting only identifiers that appear on
+ *    statically-flagged lines — the typical vague echo of a static finding.
+ *    (A line-less issue that names at least one new identifier survives.)
+ */
+export function dropDuplicateModelIssues(staticIssues, modelIssues) {
+    const staticKeys = new Set(staticIssues.map((issue) => locationKey(issue.location)));
+    const staticIdentifiers = [
+        ...new Set(staticIssues.flatMap((issue) => [...issue.reason.matchAll(/"([^"]+)"/g)].map((m) => m[1]))),
+    ];
+    // Identifiers occurring in the code snippets of statically-flagged lines.
+    const flaggedLineIdentifiers = new Set(staticIssues.flatMap((issue) => {
+        const snippet = issue.location.split(" — ")[1] ?? "";
+        return [...snippet.matchAll(/[A-Za-z_$][\w$]{2,}/g)].map((m) => m[0]);
+    }));
+    return modelIssues.filter((issue) => {
+        const key = locationKey(issue.location);
+        if (key !== null && staticKeys.has(key))
+            return false;
+        const text = `${issue.location} ${issue.reason}`;
+        if (staticIdentifiers.some((identifier) => text.includes(identifier)))
+            return false;
+        if (key === null) {
+            const quoted = [...text.matchAll(/[`'"]([A-Za-z_$][\w$]{2,})[`'"]/g)].map((m) => m[1]);
+            if (quoted.length > 0 && quoted.every((name) => flaggedLineIdentifiers.has(name))) {
+                return false;
+            }
+        }
+        return true;
+    });
+}
+//# sourceMappingURL=combine.js.map

package/dist/verify/combine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"combine.js","sourceRoot":"","sources":["../../src/verify/combine.ts"],"names":[],"mappings":"AAAA,gLAAgL;AAUhL,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAiC,EACjC,WAAgC;IAEhC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,iBAAiB,GAAG;QACxB,GAAG,IAAI,GAAG,CACR,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3F;KACF,CAAC;IACF,0EAA0E;IAC1E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CACpC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACpF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAClF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/verify/diff.js

@@ -0,0 +1,27 @@
+// Purpose: shared unified-diff parsing — extracts added lines with file and line number for the verification tools.
+/** Extracts the added lines of a unified diff, with their file and line number. */
+export function parseDiff(diff) {
+    const added = [];
+    const touchedFiles = new Set();
+    let currentFile = "";
+    let lineNo = 0;
+    for (const raw of diff.split("\n")) {
+        if (raw.startsWith("+++ ")) {
+            currentFile = raw.replace(/^\+\+\+ (b\/)?/, "").trim();
+            touchedFiles.add(currentFile);
+        }
+        else if (raw.startsWith("@@")) {
+            const match = /\+(\d+)/.exec(raw);
+            lineNo = match ? Number(match[1]) - 1 : 0;
+        }
+        else if (raw.startsWith("+")) {
+            lineNo += 1;
+            added.push({ file: currentFile, lineNo, text: raw.slice(1) });
+        }
+        else if (!raw.startsWith("-")) {
+            lineNo += 1; // context line
+        }
+    }
+    return { added, touchedFiles };
+}
+//# sourceMappingURL=diff.js.map

package/dist/verify/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/verify/diff.ts"],"names":[],"mappings":"AAAA,oHAAoH;AAQpH,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC,CAAC,eAAe;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC"}

package/dist/verify/evidence.js

@@ -0,0 +1,25 @@
+// Purpose: shared pieces of agent-native evidence mode — in MCP mode Sentinel gathers deterministic evidence and the calling agent does the judgment; no model call is ever made here.
+import { createHash } from "node:crypto";
+import { openDatabase, insertVerification } from "../storage/db.js";
+/** Stored in place of a verdict when Sentinel handed evidence to the calling agent instead of judging. */
+export const EVIDENCE_VERDICT = "evidence_provided";
+/** Logs an evidence handoff locally (findings only — Sentinel made no judgment). */
+export function storeEvidence(projectDir, tool, diff, findings) {
+    const db = openDatabase(projectDir);
+    try {
+        insertVerification(db, {
+            tool,
+            task: "",
+            diffHash: createHash("sha256").update(diff).digest("hex"),
+            verdict: EVIDENCE_VERDICT,
+            reason: `Evidence returned to the calling agent: ${findings.length} static finding(s). Judgment was the agent's.`,
+            details: JSON.stringify(findings),
+            provider: "agent",
+            model: "agent",
+        });
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=evidence.js.map

package/dist/verify/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/verify/evidence.ts"],"names":[],"mappings":"AAAA,uLAAuL;AAEvL,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGpE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAcpD,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAAY,EACZ,IAAY,EACZ,QAA6B;IAE7B,MAAM,EAAE,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,kBAAkB,CAAC,EAAE,EAAE;YACrB,IAAI;YACJ,IAAI,EAAE,EAAE;YACR,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACzD,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,2CAA2C,QAAQ,CAAC,MAAM,+CAA+C;YACjH,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YACjC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}