Install

Supported release platforms

Published binaries are currently available for:

<version> looks like 0.1.0+8.

One-command install for macOS, Linux, and bash on Windows

curl -fsSL https://github.com/aneesahammed/sentinel-dist/releases/latest/download/sentinel.sh | bash

The installer:

• detects macOS, Linux, or Windows bash environments like Git Bash, MSYS2, and Cygwin
• downloads the matching release asset from aneesahammed/sentinel-dist
• verifies the binary with checksums.txt
• installs sentinel into a writable bin directory

If you run that command from Git Bash, MSYS2, or Cygwin on Windows, Sentinel installs the Windows .exe build for you.

Native Windows install

Download the latest .exe from the public release page and place it on your PATH:

https://github.com/aneesahammed/sentinel-dist/releases

Optional overrides

Install to a specific directory:

curl -fsSL https://github.com/aneesahammed/sentinel-dist/releases/latest/download/sentinel.sh | \
  env SENTINEL_INSTALL_DIR="$HOME/bin" bash

Pin to a specific published version:

curl -fsSL https://github.com/aneesahammed/sentinel-dist/releases/latest/download/sentinel.sh | \
  env SENTINEL_VERSION="0.1.0+42" bash

Manual binary download

If you do not want to use the installer script, download the asset that matches your OS and CPU from the latest release and place it on your PATH.

Put Sentinel on your PATH

macOS and Linux

mkdir -p ~/bin
mv ~/Downloads/<downloaded-file> ~/bin/sentinel
chmod +x ~/bin/sentinel

# zsh
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

Windows (PowerShell)

New-Item -ItemType Directory -Force "$env:USERPROFILE\bin" | Out-Null
Move-Item "$env:USERPROFILE\Downloads\<downloaded-file>.exe" "$env:USERPROFILE\bin\sentinel.exe"
[Environment]::SetEnvironmentVariable("Path", $env:Path + ";$env:USERPROFILE\bin", "User")

If Windows SmartScreen appears, click More info and then Run anyway once. If macOS blocks first launch, allow it in System Settings -> Privacy & Security.

Verify the install

sentinel --help
sentinel check --offline

Where Sentinel stores things

Override --db per command, or move ~/.sentinel to another location and point at it consistently. The master key file lives next to the database, so moving the database means moving the key file too.

Settings, secrets, and live reload

Sentinel reads configuration from these places, in order. Higher entries win.

1. CLI flags (--offline, --model, --api-key, …)
2. SENTINEL_API_KEY, for the API key only
3. The Settings page in sentinel ui, persisted in SQLite
4. Built-in defaults

The only environment variable Sentinel reads is SENTINEL_API_KEY. When set, it overrides the encrypted API key from the Settings page, unless --api-key is passed explicitly for that command. SENTINEL_API_KEY is the recommended way to provide the key in CI or any place where shell history matters.

API key storage

The Settings page never returns the decrypted API key to the browser. The field is masked and write-only: you can update it, you cannot read it back.

The key itself is stored encrypted (AES-256-GCM) in the SQLite database. The encryption key is the master key file mentioned above. If you delete sentinel-master.key, you lose access to the stored API key and Sentinel falls back to whatever is in SENTINEL_API_KEY or --api-key.

Live reload of running processes (Unix)

When you save changes on the Settings page, Sentinel can signal already-running ingest processes (sentinel watch, sentinel stdin, sentinel run, sentinel analyze, sentinel check) to pick up the new values without a restart. There is a checkbox on the Settings page for this. The mechanism is a SIGHUP to known PIDs, so it is Unix-only. On Windows, restart the relevant command for new settings to take effect.

Upgrade later

After first install, upgrades should go through Sentinel itself:

sentinel update