DEV Community

jackymenCZ (jackymenCZ)
jackymenCZ (jackymenCZ)

Posted on

Sentinel-IR on Android: Install It in Termux Mobile and Verify the Output, Step by Step

#agents #architecture #termux #javascript

From a fresh Termux terminal to a real, inspectable JavaScript analysis report. No desktop computer, no API key, no AI account required.

What this guide does: installs the published sentinel-ir@0.1.1 package, initializes its bundled WebAssembly parser, analyzes a tiny JavaScript example, checks expected results, and saves a JSON report. It then shows how to analyze one JavaScript file you own and how to share sanitized findings under your own account.

What it does not do: it does not prove that a program is secure, scan an entire repository, analyze TypeScript/JSX reliably, or send source code to an LLM. The 0.1.1 release was tested in Termux. This walkthrough uses the published package's documented API and includes troubleshooting because Android and Termux installations can differ.

⚡ The 20-Second Version

You can run a small JavaScript structural analyzer from an Android phone. Termux gives Android a Linux-style terminal, Node.js runs JavaScript, and Sentinel-IR turns a source string into a compact JSON report with facts such as recognized routes, imports, environment variables, operations, and risk signals.

The point of this tutorial is simple: do not take my word for it. Install the exact published version, run the sample, and inspect the output yourself. If you find a problem, report it from your account, with enough detail for someone else to reproduce it.

Yes, this is the kind of project you can experiment with from bed instead of spending the entire evening scrolling. Your phone is not a magic workstation, and not every idea becomes a product. But it can be enough to run a real, testable experiment.

🗺️ Quick Navigation

Tap any link below to jump directly to that section. At the end of each phase, use Contents to return here or Next to continue without scrolling back to the top.

How to read the visual markers

  • 🟦 DO THIS: copy the command block into Termux and press Enter.
  • ✅ EXPECTED RESULT: compare your terminal output with this example.
  • ⚠️ IF THIS FAILS: stop at that step and use the linked troubleshooting section.
  • 🧪 OPTIONAL: skip it on your first run if you only want to verify the package.

Do one step at a time. Continue only when the expected result makes sense. The coloured code syntax and headings are part of DEV.to's normal rendering, not evidence that a test passed.

📦 Before We Start: What You Need

  • An Android phone supported by Termux.
  • A working internet connection for the initial package downloads.
  • A little free storage. Node.js and npm dependencies need room, so do not start with your storage completely full.
  • Around 10 to 20 minutes if package downloads behave. Slow mirrors or older installations can take longer.
  • No root access, no API key, no OpenAI account, and no desktop computer.

Use the official Termux sources. The maintainers document installation through F-Droid and the official GitHub repository. Avoid random APK files from chat groups or download sites. If you already have Termux installed, do not uninstall it casually: builds from different sources may use different signing keys. Update the installation you already have unless you have a specific reason to switch.

Official project references:

🧭 Phase 0: Open Termux and understand the terminal

Open Termux. You should see a terminal prompt and a blinking cursor. Type or paste a command, then press Enter. Commands in this guide should be run inside Termux unless a step explicitly says otherwise.

A few phone-specific tips:

  • Paste one code block at a time. Wait for the prompt to return before pasting the next block.
  • If you see a long stream of installation text, that is normal. Read the last few lines if a command fails.
  • Do not paste a line that begins with a prompt character such as $. The $ in documentation usually means “type the command after this symbol”. The blocks below omit it.
  • If Android closes Termux in the background, reopen it and run the last command again. Do not assume a command completed just because you switched apps.
  • You do not need to grant access to all shared phone storage for the first test. We will create everything inside Termux's private home directory.

⬆️ Contents · ➡️ Next: Phase 1

🧭 Phase 1: Update Termux packages

Run:

🟦 DO THIS · Run in Termux

pkg update && pkg upgrade -y
Enter fullscreen mode Exit fullscreen mode

pkg update refreshes the package lists. pkg upgrade -y updates installed packages and automatically accepts the package manager's normal confirmation prompt.

✅ IF IT WORKS: if the command finishes and returns to the prompt, continue.

⚠️ IF THIS FAILS: if it stops with a repository or mirror error, jump to Troubleshooting: repository errors below.

⬆️ Contents · ➡️ Next: Phase 2

🧭 Phase 2: Install Node.js and npm

Sentinel-IR requires Node.js 20 or newer. npm normally comes with the Termux Node.js package.

🟦 DO THIS · Run in Termux

pkg install nodejs -y
Enter fullscreen mode Exit fullscreen mode

Now check both tools:

🟦 DO THIS · Run in Termux

node --version
npm --version
Enter fullscreen mode Exit fullscreen mode

Node should print a version number such as v20.x, v22.x, v24.x, or newer. The exact current version depends on the Termux repository and the day you install it. npm should also print a version number.

Use this extra check to verify the Node major version numerically:

🟦 DO THIS · Run in Termux

node -e "const major = Number(process.versions.node.split('.')[0]); console.log('Node.js:', process.version); if (major < 20) { console.error('Sentinel-IR requires Node.js 20 or newer'); process.exit(1); } console.log('PASS: Node.js version is supported');"
Enter fullscreen mode Exit fullscreen mode

✅ EXPECTED RESULT

PASS: Node.js version is supported
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if Node is below 20, do not continue and hope for the best. Update Termux packages and check the available Node package again. See Troubleshooting: old Node.js.

⬆️ Contents · ➡️ Next: Phase 3

🧭 Phase 3: Create a clean test folder

Keep the experiment separate from your photos, downloads, and other projects.

🟦 DO THIS · Run in Termux

mkdir -p "$HOME/sentinel-ir-termux-test"
cd "$HOME/sentinel-ir-termux-test"
pwd
Enter fullscreen mode Exit fullscreen mode

The final command should print a path inside Termux's home directory, usually beginning with /data/data/com.termux/files/home/.

Every file created in the remaining steps will live in this folder. You can return to it later with:

🟦 DO THIS · Run in Termux

cd "$HOME/sentinel-ir-termux-test"
Enter fullscreen mode Exit fullscreen mode

⬆️ Contents · ➡️ Next: Phase 4

🧭 Phase 4: Install the exact published release

First, create a minimal local npm project:

🟦 DO THIS · Run in Termux

npm init -y
Enter fullscreen mode Exit fullscreen mode

Install the exact release covered by this guide, rather than whichever version might be published as latest in the future:

🟦 DO THIS · Run in Termux

npm install --save-exact sentinel-ir@0.1.1
Enter fullscreen mode Exit fullscreen mode

This package has a regular web-tree-sitter dependency and optional native Tree-sitter dependencies. The normal install may try to install those optional native packages too. Our test will explicitly use the bundled WebAssembly parser through analyzeAsync(), which is the intended path when native parser packages are unavailable.

Check that npm installed the exact version:

🟦 DO THIS · Run in Termux

npm ls sentinel-ir
Enter fullscreen mode Exit fullscreen mode

You should see sentinel-ir@0.1.1 in the dependency tree. The package is installed locally in this test folder. You do not need a global npm installation and should not use sudo in Termux.

You can independently ask the public registry which version it serves:

🟦 DO THIS · Run in Termux

npm view sentinel-ir@0.1.1 version
Enter fullscreen mode Exit fullscreen mode

✅ EXPECTED RESULT

0.1.1
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if this command says it cannot reach the registry, that is a network or registry access issue, not evidence that the analyzer failed. Check your connection and use the troubleshooting section.

⬆️ Contents · ➡️ Next: Phase 5

🧭 Phase 5: Check that the public API exists

Run this block exactly as shown:

🟦 DO THIS · Run in Termux

node - <<'NODE'
const sentinel = require('sentinel-ir');

for (const name of ['analyzeAsync', 'compress', 'initializeWasm']) {
  console.log(`${name}: ${typeof sentinel[name]}`);
  if (typeof sentinel[name] !== 'function') {
    console.error(`FAIL: missing function ${name}`);
    process.exitCode = 1;
  }
}

if (!process.exitCode) {
  console.log('PASS: expected Sentinel-IR functions are exported');
}
NODE
Enter fullscreen mode Exit fullscreen mode

The three lines should end in function, followed by:

✅ EXPECTED RESULT

PASS: expected Sentinel-IR functions are exported
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if you see Cannot find module, check that your terminal is still in the test directory and run npm ls sentinel-ir again. If the installed version is not 0.1.1, return to Phase 4.

⬆️ Contents · ➡️ Next: Phase 6

🧭 Phase 6: Initialize the bundled WebAssembly parser

This is a direct check of the WebAssembly initialization path, before we analyze a file.

🟦 DO THIS · Run in Termux

node - <<'NODE'
const { initializeWasm } = require('sentinel-ir');

initializeWasm()
  .then(() => {
    console.log('PASS: Sentinel-IR WebAssembly parser initialized');
  })
  .catch((error) => {
    console.error('FAIL: WebAssembly initialization failed');
    console.error(error);
    process.exitCode = 1;
  });
NODE
Enter fullscreen mode Exit fullscreen mode

✅ EXPECTED RESULT

PASS: Sentinel-IR WebAssembly parser initialized
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if initialization fails, do not quietly move to the next step. See Troubleshooting: WebAssembly initialization. The usual checks are whether the package finished installing, whether the packaged WASM file exists, and whether the exact version is installed.

⬆️ Contents · ➡️ Next: Phase 7

🧭 Phase 7: Create a harmless JavaScript sample

We will analyze text that looks like a tiny Express-style server. Sentinel-IR analyzes the source text; this guide does not run the server. You do not need to install Express because the code is only the input to the parser.

Create the sample:

🟦 DO THIS · Run in Termux

cat > sample.js <<'JS'
const express = require("express");
const fs = require("fs");

const app = express();

app.post("/upload", (req, res) => {
  fs.writeFileSync("/tmp/upload", req.body);
  res.end();
});

app.listen(process.env.PORT);
JS
Enter fullscreen mode Exit fullscreen mode

Check the file was created:

🟦 DO THIS · Run in Termux

cat sample.js
Enter fullscreen mode Exit fullscreen mode

You should see the JavaScript block you just pasted. You can also check its syntax with Node.js without executing the server:

🟦 DO THIS · Run in Termux

node --check sample.js
Enter fullscreen mode Exit fullscreen mode

If the syntax check succeeds, Node normally prints nothing and returns to the prompt. If it reports a syntax error, recreate the file using the full cat block above. Be careful not to include the Markdown code fences in the file.

⬆️ Contents · ➡️ Next: Phase 8

🧭 Phase 8: Create a small analysis program

Now create a reusable script. It reads one JavaScript file, passes the text to analyzeAsync(), compresses the result, and prints JSON. It does not execute the input file, call an LLM, or upload the input.

🟦 DO THIS · Run in Termux

cat > analyze.js <<'JS'
const fs = require('node:fs/promises');
const path = require('node:path');
const { analyzeAsync, compress } = require('sentinel-ir');

async function main() {
  const inputPath = process.argv[2];

  if (!inputPath) {
    console.error('Usage: node analyze.js <file.js>');
    process.exitCode = 1;
    return;
  }

  const source = await fs.readFile(inputPath, 'utf8');
  const ir = await analyzeAsync(source, {
    // Use only the filename in the report, not the full private device path.
    target: path.basename(inputPath),
  });
  const report = compress(ir);

  console.log(JSON.stringify(report, null, 2));

  if (report.analysisStatus !== 'complete') {
    console.error(
      'WARNING: analysisStatus is not complete. Do not treat this result as a complete structural analysis.'
    );
    process.exitCode = 2;
  }
}

main().catch((error) => {
  console.error('ERROR: analysis could not finish.');
  console.error(error && error.stack ? error.stack : error);
  process.exitCode = 1;
});
JS
Enter fullscreen mode Exit fullscreen mode

Check the wrapper's own syntax:

🟦 DO THIS · Run in Termux

node --check analyze.js
Enter fullscreen mode Exit fullscreen mode

Again, a successful syntax check normally prints nothing. This tests the small wrapper, not Sentinel-IR's accuracy.

⬆️ Contents · ➡️ Next: Phase 9

🧭 Phase 9: Run the analysis and save a report

Run:

🟦 DO THIS · Run in Termux

node analyze.js sample.js > report.json
rc=$?
printf 'Analyzer exit code: %s\n' "$rc"
Enter fullscreen mode Exit fullscreen mode

The JSON is saved in report.json, not lost in a wall of terminal output. The exit code means:

  • 0: the script produced a result whose analysisStatus is complete.
  • 2: a result was produced, but the analysis status was not complete. Read the warning and do not count this as a successful complete analysis.
  • 1: the wrapper could not finish, for example because it could not read the input or initialize the parser.

Display the report:

🟦 DO THIS · Run in Termux

cat report.json
Enter fullscreen mode Exit fullscreen mode

The report is JSON. Its exact formatting and some values can vary with the input, but for the supplied valid JavaScript sample you should expect structural facts resembling these:

  • analysisStatus should be complete.
  • facts.ast should be true.
  • facts.routes should include POST /upload.
  • facts.imports should include express and fs.
  • facts.env should include PORT.
  • The report should include recognized operations and risk signals related to the route and file write.

The report's risk estimate is not a verdict that this example is safe or unsafe. The sample deliberately includes an HTTP route and a filesystem write so there is something tangible to inspect.

⬆️ Contents · ➡️ Next: Phase 10

🧭 Phase 10: Verify the findings instead of just looking at a JSON blob

Run an automatic check against the results we expect from the sample:

🟦 DO THIS · Run in Termux

node - <<'NODE'
const report = require('./report.json');
const failures = [];

if (report.analysisStatus !== 'complete') {
  failures.push(`analysisStatus expected complete, got ${report.analysisStatus}`);
}
if (report.facts?.ast !== true) {
  failures.push('facts.ast expected true');
}
if (!Array.isArray(report.facts?.routes) || !report.facts.routes.includes('POST /upload')) {
  failures.push('expected route POST /upload was not found');
}
if (!Array.isArray(report.facts?.imports) || !report.facts.imports.includes('express')) {
  failures.push('expected import express was not found');
}
if (!Array.isArray(report.facts?.imports) || !report.facts.imports.includes('fs')) {
  failures.push('expected import fs was not found');
}
if (!Array.isArray(report.facts?.env) || !report.facts.env.includes('PORT')) {
  failures.push('expected environment variable PORT was not found');
}

if (failures.length) {
  console.error('FAIL: sample analysis did not match expectations');
  for (const failure of failures) console.error(`- ${failure}`);
  process.exitCode = 1;
} else {
  console.log('PASS: the sample produced the expected structural facts');
}
NODE
Enter fullscreen mode Exit fullscreen mode

✅ EXPECTED RESULT

PASS: the sample produced the expected structural facts
Enter fullscreen mode Exit fullscreen mode

This is a reproducible smoke test. It shows that this installed package can parse this particular sample and return the facts checked by the script. It is not a broad benchmark, a full test suite, or proof that every JavaScript pattern is recognized correctly.

You can also print the most useful fields without dumping the whole report:

🟦 DO THIS · Run in Termux

node - <<'NODE'
const r = require('./report.json');
console.log('analysisStatus:', r.analysisStatus);
console.log('routes:', r.facts.routes);
console.log('imports:', r.facts.imports);
console.log('environment variables:', r.facts.env);
console.log('operations:', r.facts.operations);
console.log('risk signals:', r.facts.riskSignals);
NODE
Enter fullscreen mode Exit fullscreen mode

⬆️ Contents · ➡️ Next: Phase 11

🧭 Phase 11: Try a JavaScript File of Your Own · 🧪 OPTIONAL

You have already tested the package with a known sample. Only now try your own input.

Only analyze code you own or are authorized to inspect. Start with one .js file, not an entire repository. Sentinel-IR analyzes one JavaScript file at a time; it does not combine calls or data flow across files.

📁 Option A: The file is already inside Termux

Copy your file into the test directory, or run the analyzer with its path:

🟦 DO THIS · Run in Termux

node analyze.js ./your-file.js > your-file-report.json
rc=$?
printf 'Analyzer exit code: %s\n' "$rc"
Enter fullscreen mode Exit fullscreen mode

Replace your-file.js with the real filename. If you need to keep a report, give it a different name so you do not overwrite report.json.

📱 Option B: The file is in Android Downloads

For this optional path, grant Termux shared-storage access only if you need it:

🟦 DO THIS · Run in Termux

termux-setup-storage
Enter fullscreen mode Exit fullscreen mode

Android may show a permission dialog. Approve it if you want Termux to read your shared files. Then list Downloads:

🟦 DO THIS · Run in Termux

ls "$HOME/storage/downloads"
Enter fullscreen mode Exit fullscreen mode

Copy one JavaScript file into the private test folder, replacing example.js with its exact filename:

🟦 DO THIS · Run in Termux

cp "$HOME/storage/downloads/example.js" "$HOME/sentinel-ir-termux-test/your-file.js"
cd "$HOME/sentinel-ir-termux-test"
node analyze.js your-file.js > your-file-report.json
rc=$?
printf 'Analyzer exit code: %s\n' "$rc"
Enter fullscreen mode Exit fullscreen mode

💡 TIP: if the filename contains spaces, keep the quotation marks. If the file is not listed in Downloads, check the correct folder name with ls. You do not need to enable this permission for the earlier sample test.

A file can be JavaScript-shaped but still use syntax that Sentinel-IR does not support. The package currently targets JavaScript, including CommonJS and ESM. It does not claim general TypeScript, JSX-heavy, or other-language support.

⬆️ Contents · ➡️ Next: Phase 12

🧭 Phase 12: Understand analysisStatus

This field is one of the most important parts of the output.

  • complete means AST extraction succeeded and the source parsed without syntax errors. It does not mean every security issue was found.
  • incomplete means AST extraction was unavailable or the source did not parse cleanly. The output may rely on text-based fallback heuristics, which can be wrong in either direction.

⚠️ IF THIS FAILS: if a report is incomplete, do not write “Sentinel-IR cleared this file” or “the code is safe”. Instead, report that the result was incomplete and explain which input you used. Depending on the file, check the syntax, make sure it is plain supported JavaScript, and try a smaller reproducible example.

Even complete has strict limits:

  1. It is a syntax-based structural report, not full semantic analysis.
  2. It examines one file at a time.
  3. It may not resolve aliases, computed properties, or behavior passed between modules.
  4. It does not prove the application is secure.
  5. It reduces some untrusted text passed onward, but it does not eliminate prompt injection.
  6. It does not run your app or decide what an AI agent should do.

Do not treat values such as world.confidence as calibrated probabilities. They are configuration or metadata fields, not a validated guarantee that the output is correct.

⬆️ Contents · ➡️ Next: Phase 13

🧭 Phase 13: Share a result without leaking your code

Now for the part that matters if you want to publish a finding.

The JSON report may contain names of imported packages, route paths, environment-variable names, operation names, risk signals, and the target filename you supplied. Those can reveal internal architecture. Even if a secret value is not intentionally extracted, never assume any generated report is automatically safe to publish.

Before posting:

  1. Open the report and review every field.
  2. Remove or generalize private route names, internal package names, filenames, customer information, and anything that reveals a secret or proprietary design.
  3. Do not publish private source code or a report from somebody else's code without permission.
  4. Prefer the small synthetic sample from this guide when demonstrating basic behavior.
  5. State clearly whether you tested the synthetic sample or your own project.
  6. Include the exact version, Node version, command, expected result, actual result, and error text if something failed. Remove access tokens and personal filesystem paths.
  7. Do not claim that a single smoke test proves the analyzer is secure or accurate in all cases.

You can check the environment before writing your report:

🟦 DO THIS · Run in Termux

node --version
npm --version
npm ls sentinel-ir
Enter fullscreen mode Exit fullscreen mode

Here is a report template you can adapt for DEV Community, GitLab, a discussion thread, or your own blog:

📝 COPY THIS TEMPLATE AND FILL IT IN

Title: Sentinel-IR 0.1.1 Termux smoke test

Device/OS: [Android version and device, if you want to share]
Termux source: [F-Droid or official GitHub]
Node.js: [output of node --version]
Sentinel-IR: 0.1.1
Input: [synthetic sample / my own authorized JavaScript file]
Command: node analyze.js sample.js
Expected: analysisStatus=complete, route POST /upload, imports express and fs, env PORT
Actual: [what really happened]
Result: [PASS / FAIL / INCOMPLETE]
Notes: [reproducible error or unexpected field, without secrets]
Enter fullscreen mode Exit fullscreen mode

Use your own DEV Community or GitLab account to publish your own test result. You do not need access to the maintainer's account. A useful bug report includes a minimal input that you are allowed to share, the exact version, what you expected, what happened, and whether analysisStatus was complete.

⬆️ Contents · ➡️ Next: Troubleshooting

🧰 Troubleshooting: If Something Goes Wrong

Repository errors when running pkg update

⚠️ IF THIS FAILS: if Termux reports that a repository is unreachable or under maintenance, check your connection and change the Termux mirror:

🟦 DO THIS · Run in Termux

termux-change-repo
Enter fullscreen mode Exit fullscreen mode

Choose an available official mirror in the interface, then run:

🟦 DO THIS · Run in Termux

pkg update && pkg upgrade -y
Enter fullscreen mode Exit fullscreen mode

The Termux maintainers document repository and mirror fixes in their Package Management guide. Do not paste commands from unrelated download sites just because a mirror timed out.

⬆️ Troubleshooting index

node: command not found

Install Node.js again from Termux:

🟦 DO THIS · Run in Termux

pkg update
pkg install nodejs -y
node --version
npm --version
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if the package manager itself is broken, resolve the repository issue first.

⬆️ Troubleshooting index

Node.js is older than version 20

Run:

🟦 DO THIS · Run in Termux

pkg update && pkg upgrade -y
pkg install nodejs -y
node --version
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if the installed version is still below 20, do not continue with this release. Check the available packages in your Termux repository and follow the official Termux package guidance. Do not install two alternative Node packages blindly; they can conflict.

⬆️ Troubleshooting index

npm install shows native build warnings or errors

Sentinel-IR's native Tree-sitter packages are optional. This guide uses the bundled WASM parser, so retry the installation without optional dependencies:

🟦 DO THIS · Run in Termux

cd "$HOME/sentinel-ir-termux-test"
rm -rf node_modules package-lock.json
npm install --save-exact --omit=optional sentinel-ir@0.1.1
Enter fullscreen mode Exit fullscreen mode

This deliberately skips optional native parser packages. It does not skip the regular web-tree-sitter dependency needed by the WASM path. Then repeat Phase 5 and Phase 6.

Only run the cleanup command in the dedicated test folder created by this guide. Do not run rm -rf node_modules in a project where you need to preserve the current installation.

⬆️ Troubleshooting index

Cannot find module 'sentinel-ir'

Check your location and installation:

🟦 DO THIS · Run in Termux

cd "$HOME/sentinel-ir-termux-test"
npm ls sentinel-ir
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if it is missing, install the pinned release again:

🟦 DO THIS · Run in Termux

npm install --save-exact sentinel-ir@0.1.1
Enter fullscreen mode Exit fullscreen mode

⬆️ Troubleshooting index

WebAssembly initialization failed

First verify the package and WASM file are present:

🟦 DO THIS · Run in Termux

cd "$HOME/sentinel-ir-termux-test"
npm ls sentinel-ir web-tree-sitter
ls -lh node_modules/sentinel-ir/wasm/
Enter fullscreen mode Exit fullscreen mode

The published package should include tree-sitter-javascript.wasm. If the folder or file is missing, retry the install in the test directory. Check that the install finished and that the package version is 0.1.1.

⚠️ IF THIS FAILS: if it still fails, keep the complete error message and your Node version. Do not replace the WASM file with an unrelated binary from a random website.

⬆️ Troubleshooting index

analysisStatus is incomplete

The package may have been unable to perform AST extraction, or the file did not parse cleanly. Check:

🟦 DO THIS · Run in Termux

node --check sample.js
Enter fullscreen mode Exit fullscreen mode

Remember that the basic test expects JavaScript. TypeScript, JSX-heavy syntax, or other programming languages are outside the documented support claim. Do not treat fallback results as an equivalent structural parse.

⬆️ Troubleshooting index

The expected route or import is missing

First confirm that you are analyzing the sample from this guide, not another file:

🟦 DO THIS · Run in Termux

cat sample.js
node analyze.js sample.js > report.json
Enter fullscreen mode Exit fullscreen mode

Then inspect report.json. If the sample is exactly as shown, analysisStatus is complete, and the expected fact is still absent, preserve a sanitized copy of the sample and report the mismatch with package version and Node version. That is a useful reproducible issue. Do not change the expected output just to force a pass.

⬆️ Troubleshooting index

npm cannot reach the registry

Check connectivity, then retry:

🟦 DO THIS · Run in Termux

npm ping
npm view sentinel-ir@0.1.1 version
Enter fullscreen mode Exit fullscreen mode

⚠️ IF THIS FAILS: if the registry is temporarily unavailable on your connection, retry later or switch between Wi-Fi and mobile data. Do not post an installation timeout as an analyzer defect until the registry request itself works.

⬆️ Troubleshooting index

✅ What Counts as a Successful Finish?

By the end, all of these should be true:

  • node --version is at least 20.
  • npm ls sentinel-ir shows version 0.1.1.
  • The expected exported functions are present.
  • initializeWasm() finishes successfully.
  • node analyze.js sample.js writes report.json.
  • The report says analysisStatus: "complete" for the sample.
  • The verification script prints PASS: the sample produced the expected structural facts.
  • You understand that this is a smoke test, not a security certification.

✅ IF ALL CHECKS PASS: you have reproduced a small test of the published package on your phone. That is already useful: you did not need to trust a screenshot or a claim, because you ran the commands and inspected the output yourself.

⚠️ IF THIS FAILS: if a check fails, that is not a personal failure. Keep the error, report the environment, and share only sanitized reproducible details. A failed reproducible test is more useful than a vague statement that something “doesn't work”.

⬆️ Contents · ➡️ Final invitation

🚀 One Final Invitation

Try it with the sample first. Then, if you have a JavaScript file you own and are comfortable inspecting, try that one. Check whether the facts match what the code actually contains. Look for missing facts and false positives. Tell me what you found, including the parts that did not work.

This is a small structural analyzer, not an oracle. The interesting part begins when more people can run the same experiment, compare observations, and challenge the claims with evidence.

Built and released from a phone-friendly workflow. Verified by your own terminal.

Top comments (0)