receipt-explorer

TUI for browsing Sentinel receipt chains. Think lazygit but for audit trails.

Install

npm install -g receipt-explorer

Usage

# Browse default Sentinel receipts
receipt-explorer

# Browse a specific JSONL file
receipt-explorer /path/to/receipts.jsonl

Features

Browse Receipts

Scrollable list with columns: sequence number, timestamp, tool name, event type, and FSM state. Color-coded events (green = allow, red = deny, blue = post_receipt, yellow = transition).

Filter

Filter receipts by:

• Tool name (t) — cycle through unique tools
• Event type (e) — gate_allow, gate_deny, post_receipt, transition
• State (s) — idle, planning, developing, testing, reviewing
• Clear filters (c)

Detail View

Press Enter on any receipt to see all fields: ID (UUIDv7), sequence number, timestamp, tool name, event, state, input hash, output hash, previous hash, and Ed25519 signature.

Chain Verification

Press v to verify the entire receipt chain:

• Checks SHA-256 hash links between consecutive receipts
• Verifies Ed25519 signatures using the Sentinel public key
• Reports any broken links or invalid signatures

Keyboard Shortcuts

| Key | Action | |-----|--------| | j / ↓ | Move down | | k / ↑ | Move up | | g | Jump to top | | G | Jump to bottom | | Enter | Open detail view | | Esc | Back / close | | t | Filter by tool | | e | Filter by event | | s | Filter by state | | c | Clear filters | | v | Verify chain | | ? | Show help | | q | Quit |

Data Format

Reads Sentinel receipt chains in JSONL format. Each line is a JSON object with:

| Field | Description | |-------|-------------| | id | UUIDv7 (time-ordered) | | seq | Monotonic sequence number | | timestamp | Unix timestamp | | tool_name | Tool that was called | | tool_input_hash | SHA-256 of tool input | | tool_output_hash | SHA-256 of tool output (null for gate events) | | state | FSM state at time of receipt | | prev_hash | SHA-256 of previous receipt (hash chain link) | | event | gate_allow, gate_deny, post_receipt, transition | | signature | Ed25519 signature (base64) |

Default receipt path: ~/.config/sentinel/data/receipts.jsonl

Dependencies

• chainproof — SHA-256 hashing and Ed25519 verification
• @valencets/resultkit — Result monad error handling

Requirements

• Node.js >= 22
• ESM only

License

MIT