v5.2.2  ·  macOS Session Protection  ·  RISE Studio Labs
01

Overview

SENTINEL is a lightweight macOS session protection utility designed for professionals who run long operations — overnight renders, ML training, large transfers, CI pipelines, DJ sets, or any workflow where your machine sleeping means lost work.

With one click, SENTINEL prevents idle sleep, monitors system health in real time, manages timed sessions, and gives you a live dashboard — all without opening Terminal or babysitting caffeinate commands.

🛡
Architecture
Python stdlib only
🔒
Network
Localhost Only
Footprint
~4 MB Total
Key Principles

Privacy-first — SENTINEL runs entirely on your machine. No cloud, no telemetry, no network exposure. The HTTP server binds to 127.0.0.1 only.

No extra packages — Built on Python 3 standard library only. No pip packages, no npm, no build tools. Requires macOS 13+ and Python 3.10+. No pip installs required.

Non-destructive — Safe Mode is enabled by default. SENTINEL monitors and protects — it never takes aggressive action unless you explicitly configure it.

02

System Requirements

RequirementDetail
Operating SystemmacOS 13.0 (Ventura) or later
Python3.10 or higher (Homebrew or system)
BrowserOpens in your default browser (Chrome, Safari, Chromium, or system default)
Disk Space~4 MB for the application
NetworkNone required — fully offline capable
ArchitectureApple Silicon (M1/M2/M3/M4) and Intel x86_64
Python Detection

SENTINEL automatically searches for Python 3.10+ at Homebrew paths (/opt/homebrew/bin/python3, /usr/local/bin/python3) and falls back to the system python3. No manual configuration needed. If Python is missing, download the free installer from python.org/downloads.

03

Installation

1
Download SENTINEL
Download the SENTINEL package from the official distribution source. The package contains the Sentinel.app bundle, launcher scripts, and the daemon.
2
Place in your preferred directory
Move the SENTINEL folder to your desired location. The app dynamically resolves its own path — no hardcoded directories.
3
Verify Python 3.10+
Open Terminal and run python3 --version. If below 3.10, download the free installer from python.org/downloads. If you use Homebrew: brew install python@3.12
4
Launch
Double-click Sentinel.app in Finder, or run ./sentinel.sh from Terminal. The dashboard opens automatically in your default browser.
First Launch

Because SENTINEL is distributed directly outside the App Store, macOS Gatekeeper will block it on first launch. To allow it: double-click the app (macOS will show a warning — click Done), then go to System Settings → Privacy & Security, scroll down, and click Open Anyway next to SENTINEL. Enter your password when prompted. This only happens once — after approving, SENTINEL opens normally every time.

04

Launching SENTINEL

SENTINEL offers three launch methods. All resolve to the same daemon — choose based on your preference.

MethodHowBest For
Sentinel.app Double-click in Finder or Dock Daily use — one-click launch with native error alerts
sentinel.sh Run ./sentinel.sh in Terminal Power users — full console output, ASCII banner, verbose diagnostics
Sentinel.command Double-click in Finder Finder users who want terminal output visible

What Happens at Launch

1
Preflight Check
SENTINEL locates Python 3.10+, checks port 8766 for conflicts, and gracefully handles any stale daemon processes.
2
Daemon Start
The daemon (sentinel_daemon.py) starts an HTTP server on 127.0.0.1:8766 and begins system monitoring.
3
Readiness Probe
The launcher polls /ping to confirm the daemon is ready before proceeding.
4
Dashboard Opens
Your default browser opens (520×780 window) displaying the SENTINEL dashboard.
05

Session Modes

SENTINEL operates in four modes. Transitions are controlled via the dashboard buttons.

⏸ Standby
Default state. Daemon is running and monitoring system stats, but sleep prevention is not active. Your Mac follows its normal energy settings.
🛡 Protected
Active session protection. Caffeinate is engaged to prevent display sleep, idle sleep, system sleep, and disk sleep. Your Mac will not sleep until you deactivate.
🌙 Away
Away mode. Protection remains active but the dashboard indicates you've stepped away. Use for overnight runs, long renders, or unattended operations.
⏱ Timed Session
Time-limited protection. Set a duration and SENTINEL auto-deactivates when the timer expires. Ideal for scheduled tasks with known completion times.
Mode Transitions

Standby → Protected: Click the PROTECT button. Caffeinate starts immediately.

Protected → Away: Click AWAY. Protection continues, status indicator changes.

Protected / Away → Standby: Click DEACTIVATE. Caffeinate terminates, Mac resumes normal sleep behavior.

Timed Session: Set duration in seconds when activating. Auto-deactivates to Standby when the timer completes.

06

Session Presets

Session Presets are one-click session profiles that combine a protection mode, optional duration, and optional reminder into a single action. Click a preset and SENTINEL configures everything for you.

Built-In Presets

PresetIconDurationReminderAwayTier
Quick ProtectIndefiniteFree
Download Session📥2 hours1h 45mPro
Study Night📚4 hours3h 30mPro
Overnight Run🌙8 hoursAutoPro
Movie Night🎬3 hoursPro

Using Presets

Presets appear as a horizontal bar at the top of the dashboard during standby. Click any preset to instantly activate that session profile. Pro-locked presets display a lock icon on the Free tier. Presets are also available in the menu bar dropdown under Quick Start.

Custom Presets (Pro)

Pro users can create unlimited custom presets. In the dashboard settings area, click Manage Presets to create, edit, or delete custom profiles. Each custom preset lets you configure a name, icon, duration, reminder, and auto-away behavior. Custom presets are saved to ~/.sentinel/presets.json and persist across sessions.

API Commands

CommandDescription
ACTIVATE_PRESETActivate a preset by ID — {"preset_id": "quick_protect"}
LIST_PRESETSReturns all available presets (built-in and custom)
SAVE_PRESETCreate or update a custom preset (Pro)
DELETE_PRESETDelete a custom preset by ID (Pro)
07

Dashboard Guide

The SENTINEL dashboard is a single-page web interface served by the local daemon. It polls the daemon every 3–5 seconds for real-time data and requires no internet connection.

Dashboard Indicators

IndicatorLocationMeaning
Daemon DotTop areaGreen = daemon connected. Grey = daemon offline.
Session ModeHeaderCurrent mode: STANDBY, PROTECTED, AWAY, or TIMED
Session TimerHeaderElapsed time in current protected session
CPU / Memory / DiskStats panelReal-time system resource utilization
BatteryStats panelCurrent charge level and power source (AC/Battery)
NetworkStats panelInternet connectivity status via 1.1.1.1 probe
Safe Mode BadgeControlsIndicates whether Safe Mode is active
Daemon Offline Banner

If the daemon becomes unreachable (process crash, manual kill, port conflict), the dashboard displays a prominent "DAEMON OFFLINE — Restart Required" banner. This banner auto-dismisses when the connection is restored. If you see this, relaunch SENTINEL using any of the three launch methods.

Dashboard Controls

ButtonAction
PROTECTStart a protected session (prevents all sleep types)
AWAYSwitch to away mode while maintaining protection
DEACTIVATEEnd the current session, return to standby
Safe Mode ToggleEnable/disable safe mode (controls aggressive features)
Dry Run ToggleWhen enabled, logs actions without executing them

Session Stats

Below the main controls, five stat cards display cumulative session analytics: total sessions, total hours, sessions this week, average duration, and longest session. These stats update every 30 seconds from the daemon's session history.

Session History (Pro)

Click View Session History to expand a scrollable log of recent sessions. Each entry shows date/time, duration, mode, preset used, session name (if set), and how the session ended. Pro users can view the full list and name active sessions using the pencil icon. Free users see the stats bar only — the full session list requires Pro.

About Panel

At the bottom of the dashboard, a compact info bar shows the current version, license tier, and company name. Click it to expand a detail panel with the daemon PID, config path, session count, and links to the Operations Guide, gotsentinel.com, and issue reporting.

First-Launch Welcome

When you open SENTINEL for the first time, a welcome overlay introduces the product with three quick-start steps. Click Get Started to dismiss it. The overlay never shows again after dismissal.

08

System Monitoring

SENTINEL continuously monitors your Mac's vital signs. Stats update every 3 seconds during active sessions and every 10 seconds in standby.

MetricSourceDetail
CPU Usagetop -l 1System + user CPU percentage
Memoryvm_statActive, wired, compressed memory + swap usage
Total RAMsysctl hw.memsizeHardware memory capacity
Disk Usagedf -g /Used/available space on root volume
Batterypmset -g battCharge percentage, power source, charging state
Networknc -z 1.1.1.1 53Internet connectivity probe (1-second timeout)
Battery Warnings

When battery drops below 20% (configurable), SENTINEL flags a low-battery warning in the dashboard. This threshold is set via battery_low_threshold in the config file.

09

Notifications

SENTINEL sends native macOS notifications for key session events. Notifications appear in Notification Center and play the Glass sound (configurable). Enable or disable notifications via the notifications_enabled config key.

Notification Events

EventTitleMessage
Session startSENTINEL — ProtectedSession started. Your Mac will not sleep.
Timed session startSENTINEL — ProtectedTimed session started: Xh.
Session endSENTINEL — StandbySession ended. Normal sleep behavior restored.
Timed session completeSENTINEL — StandbyTimed session complete.
Away modeSENTINEL — AwayAway mode active. Protection continues.
Time Guardian reminderSENTINEL — Time CheckYou have been in session for X. Time to wrap up?
Low batterySENTINEL — Low BatteryBattery at X%. Consider plugging in.
Preset activationSENTINEL — Protected{Preset Name} activated.

Configuration

KeyDefaultDescription
notifications_enabledtrueMaster toggle for all macOS notifications
reminder_soundtruePlay sound on Time Guardian reminders
Local Only

Notifications are local-only. They use macOS osascript display notification — no network calls, no push servers, no third-party services.

10

Connected Services

SENTINEL can optionally monitor local services (development servers, databases, AI backends) to give you visibility into what's running alongside your protected session.

Adding a Service

Edit ~/.sentinel/config.json and add entries to the connected_services array:

{
  "connected_services": [
    {
      "name": "Ollama",
      "url": "http://localhost:11434",
      "health_path": "/"
    },
    {
      "name": "FastAPI Backend",
      "url": "http://localhost:8000",
      "health_path": "/health"
    }
  ]
}

SENTINEL polls each service every 10–15 seconds and displays its status (online/offline) in the dashboard's services panel.

Security Note

Only http:// and https:// URLs are accepted. Other URL schemes are rejected at startup to prevent unintended access to local file paths or other protocols.

11

Configuration

SENTINEL stores its runtime configuration at ~/.sentinel/config.json. This file is created automatically on first run with safe defaults.

KeyDefaultDescription
safe_modetruePrevents aggressive actions (kill list, screen saver). Recommended to leave on.
dry_runfalseLogs all actions without executing. Use for testing configurations.
port8766Local HTTP server port. Change only if 8766 conflicts.
poll_interval_stats3Seconds between system stats updates.
poll_interval_health10Seconds between service health checks.
battery_low_threshold20Battery percentage that triggers a low-battery warning.
browser"chrome"Preferred browser: chrome, chromium, safari, or default.
connected_services[]Array of local services to monitor (see Section 10).
check_for_updatestrueCheck gotsentinel.com for new versions (every 24 hours).

Update Checker

SENTINEL checks gotsentinel.com once every 24 hours for new versions. If an update is available, a banner appears in the dashboard and menu bar with a download link. The first check runs 30 seconds after daemon startup.

This check fetches a single static JSON file — zero user data is transmitted. No user agent, no cookies, no query parameters, no identifying information of any kind. If you are offline, the check is silently skipped.

To disable update checks entirely, set check_for_updates to false in ~/.sentinel/config.json.

Config Changes

Configuration changes require a daemon restart to take effect. Deactivate any active session, close SENTINEL, and relaunch.

12

Licensing & Activation

SENTINEL uses a freemium model. The Free tier includes full session protection, system monitoring, timed sessions, away mode, Quick Protect preset, 2 connected services, auto-start on login, macOS notifications, session history stats, and update checker. Pro unlocks Time Guardian reminders, session presets, menu bar quick-toggle, unlimited connected services, custom presets, and auto-protect rules (planned — not yet available).

Feature Comparison

FeatureFreePro
One-click session protection
System monitoring dashboard
Timed sessions
Away mode
Quick Protect preset
2 connected services
Auto-start on login
macOS notifications
Session history stats
Update checker
Time Guardian reminders
5 built-in session presets
Custom presets
Menu bar quick-toggle
Unlimited connected services
Auto-protect rulesPlanned — not yet available

Activating a License

  1. Purchase a Pro license from gotsentinel.com
  2. Receive your license key via email or download
  3. Open the SENTINEL dashboard
  4. Scroll to the bottom and click Activate License
  5. Paste your full license key into the activation field
  6. All Pro features unlock immediately — no restart required
Offline Verification

License keys are verified offline using Ed25519 cryptographic signatures — the same algorithm used by SSH, Signal, and WireGuard. No internet connection is required to activate. Your key is intended for personal use across your own machines.

Trial Licenses

Trial keys provide full Pro access for a limited duration (typically 14 or 30 days). The dashboard displays a TRIAL badge with days remaining. When the trial expires, all features revert to the Free tier. You can upgrade to Pro at any time by purchasing and activating a permanent key.

Deactivating a License

To deactivate your license (for example, when moving to a new Mac), scroll to the license section in the dashboard and click Deactivate License. This removes the key from the current machine. You can reactivate on another machine using the same key.

Key Security

Never share your license key publicly. SENTINEL will never ask for your full key via email. If you need support, contact chase@risestudiolabs.com with your order confirmation — not your key.

13

Auto-Start on Login

SENTINEL can start automatically when you log into your Mac. This is a free-tier feature — no Pro license required. Once enabled, the daemon launches in the background at login and is ready to protect when you are.

Enabling Auto-Start

  1. Open the SENTINEL dashboard
  2. Find the Start on Login toggle in the settings area
  3. Click to enable — SENTINEL creates a LaunchAgent at:
    ~/Library/LaunchAgents/com.risestudiolabs.sentinel.plist
  4. On your next login, SENTINEL starts automatically

The toggle is also available in the menu bar dropdown (Pro).

Disabling Auto-Start

Click the toggle again to disable. SENTINEL removes the LaunchAgent plist automatically. You can also disable manually from Terminal:

launchctl unload ~/Library/LaunchAgents/com.risestudiolabs.sentinel.plist

Troubleshooting

Auto-Start Not Working

If SENTINEL does not start on login, verify the plist exists:

ls ~/Library/LaunchAgents/com.risestudiolabs.sentinel.plist

If the file is missing, toggle Auto-Start off and on again in the dashboard. If the daemon starts but the dashboard does not open, the daemon may be running headless. Check with:

curl -s http://127.0.0.1:8766/ping

If the daemon is responsive, open http://127.0.0.1:8766 in any browser to access the dashboard.

API Commands

CommandDescription
ENABLE_AUTOSTARTCreate the LaunchAgent plist and enable auto-start
DISABLE_AUTOSTARTRemove the LaunchAgent plist and disable auto-start
AUTOSTART_STATUSReturns whether auto-start is currently enabled
14

API Reference

SENTINEL's daemon exposes a simple HTTP API on 127.0.0.1:8766. All responses are JSON. The API is designed for the dashboard but can be called by scripts, automations, or other local tools.

GET Endpoints

EndpointResponse
GET  /Serves the dashboard HTML
GET  /pingLiveness probe — returns {pong, pid, version}
GET  /statusFull daemon state — mode, stats, timers, health
GET  /logLast 60 log entries
GET  /configCurrent runtime configuration
GET  /updateUpdate status — current version, available update, last checked
GET  /historySession history — last 20 sessions and cumulative stats
GET  /activityStructured activity log — last 100 JSONL entries (Pro)

POST Commands

EndpointPayloadAction
POST  /cmd{"cmd": "PROTECT"}Start protected session
POST  /cmd{"cmd": "PROTECT", "duration_s": 3600}Start timed session (1 hour)
POST  /cmd{"cmd": "AWAY"}Enter away mode
POST  /cmd{"cmd": "DEACTIVATE"}End session, return to standby
POST  /cmd{"cmd": "SET_SAFE_MODE", "value": true}Toggle safe mode
POST  /cmd{"cmd": "SET_DRY_RUN", "value": true}Toggle dry run
POST  /cmd{"command": "SESSION_HISTORY", "limit": 20}Session list with pagination
POST  /cmd{"command": "NAME_SESSION", "name": "..."}Label active session (Pro)
POST  /cmd{"command": "CLEAR_HISTORY", "confirm": true}Delete all session history
POST  /cmd{"command": "DISMISS_WELCOME"}Dismiss first-launch overlay

Example: Script-Based Activation

# Start a 4-hour protected session from Terminal
curl -X POST http://127.0.0.1:8766/cmd \
  -H "Content-Type: application/json" \
  -d '{"cmd": "PROTECT", "duration_s": 14400}'

# Check current status
curl -s http://127.0.0.1:8766/status | python3 -m json.tool

# Deactivate
curl -X POST http://127.0.0.1:8766/cmd \
  -H "Content-Type: application/json" \
  -d '{"cmd": "DEACTIVATE"}'
Payload Limit

POST requests are capped at 4,096 bytes. Unknown commands return a 400 response listing valid commands.

15

Time Guardian (Session Reminder)

The Time Guardian is an optional reminder system that nudges you after a set duration — without stopping your session. It's designed for professionals who lose track of time during deep work.

How It Works

When a protected session is active, you can arm a reminder from the dashboard. When the timer fires, SENTINEL shows a prominent banner and sends a macOS native notification with sound. The session continues — nothing is interrupted.

ActionBehavior
Set ReminderChoose a preset (30m, 1h, 2h, 4h) or set via API. Countdown begins immediately.
SnoozeWhen fired, click SNOOZE for 30 more minutes. Resets the countdown.
DismissClears the reminder entirely. No further nudges.
Auto-ClearAll reminder state is automatically cleared when a session is deactivated.

Daemon Commands

CommandPayloadDescription
SET_REMINDER{"duration_s": 3600}Arm a reminder (60s–86400s). Requires active session.
SNOOZE_REMINDER{"snooze_s": 1800}Snooze for specified seconds (60s–7200s, default 1800).
CLEAR_REMINDERnoneClear all reminder state immediately.

Configuration

Optional keys in ~/.sentinel/config.json:

KeyDefaultDescription
default_reminder_snullIf set, automatically arm a reminder of this duration when PROTECT starts.
reminder_soundtruePlay macOS Glass sound when reminder fires.
Design Note

The reminder is a nudge, not a deadline. It never stops your session, kills processes, or takes destructive action. It simply says: "Hey, you've been at this for a while."

16

Troubleshooting

Dashboard Shows "DAEMON OFFLINE"

The daemon process has stopped or crashed. Relaunch SENTINEL using any launch method. If the issue persists, check for port conflicts:

lsof -i :8766

If another process holds port 8766, either stop that process or change the SENTINEL port in ~/.sentinel/config.json.

Mac Still Sleeps While Protected

Verify caffeinate is running:

pgrep -x caffeinate

If no process is found, deactivate and re-protect from the dashboard. Check /log for caffeinate start errors. On some machines, certain energy settings override caffeinate — check System Settings → Energy Saver.

Python Version Error

SENTINEL requires Python 3.10+. If you see a version error:

python3 --version
# If below 3.10, download the installer from python.org/downloads
# Or if you use Homebrew:
brew install python@3.12
Orphaned Caffeinate Process

If SENTINEL was force-killed (kill -9), caffeinate may survive as an orphan. Clean it up:

pkill -x caffeinate

Under normal shutdown (closing the app, Ctrl+C, or DEACTIVATE), SENTINEL handles caffeinate cleanup automatically.

Browser Doesn't Open

SENTINEL tries Chrome → Chromium → Safari → system default. If no browser opens, the daemon is still running — access the dashboard manually at http://127.0.0.1:8766 in any browser.

Log Access

View the last 60 log entries via the dashboard's log panel or directly:

curl -s http://127.0.0.1:8766/log | python3 -m json.tool

Log files rotate automatically (max 10 files). Log buffer caps at 500 entries in memory.

Uninstalling SENTINEL

To completely remove SENTINEL from your Mac:

  1. Quit SENTINEL — deactivate any active session first, then close the app.
  2. Disable auto-start if enabled — toggle it off in the dashboard, or run:
    launchctl unload ~/Library/LaunchAgents/com.risestudiolabs.sentinel.plist
  3. Delete Sentinel.app from Applications (or wherever you installed it).
  4. Remove config and data (optional):
    rm -rf ~/.sentinel

    This removes config, license, session history, and logs.

  5. Remove LaunchAgent (optional):
    rm ~/Library/LaunchAgents/com.risestudiolabs.sentinel.plist

Your license key remains valid and can be reactivated on a fresh install.

17

Architecture

SENTINEL follows a single-daemon architecture. All entry points resolve to one Python process serving both the API and the dashboard.

ComponentFileRole
Daemonsentinel_daemon.pyHTTP server, system monitoring, caffeinate management, all business logic (~1,036 lines)
Dashboardsentinel.htmlSingle-file frontend — all HTML/CSS/JS inline, no build step (~773 lines)
App BundleSentinel.app/macOS .app wrapper with icon, Info.plist, and launch script
Terminal Launchersentinel.shFull-featured terminal launcher with diagnostics
Finder LauncherSentinel.commandDouble-click Finder shim → delegates to sentinel.sh
Daemon-Onlysentinel_daemon.shStarts daemon without opening a browser
Config~/.sentinel/config.jsonUser configuration (created automatically on first run)
VersionVERSIONSingle source of truth for the current version number
Security Architecture

Network isolation: HTTP server binds to 127.0.0.1 only — inaccessible from LAN or internet.

No CORS headers: Dashboard is same-origin; external pages cannot call the API.

No shell injection: All subprocess calls use list form (no shell=True).

Payload protection: POST requests capped at 4,096 bytes with strict command validation.

Zero credentials: No API keys, tokens, or secrets anywhere in the codebase.

18

Product Roadmap

SENTINEL is evolving from a personal utility into a professional macOS product. Below is the four-phase plan.

Phase A — Production Release (Target: Q2 2026)

Phase B — Feature Expansion (Q3–Q4 2026)

Phase C — Native Swift Rewrite (2027)

Phase D — Platform Expansion (2027+)

Revenue Model

TierPriceFeatures
Free$0 foreverCore protection, monitoring, timed sessions, away mode, 2 services, auto-start
Pro Lifetime$24.99 one-timeTime Guardian, presets, menu bar, unlimited services, custom presets
Pro Monthly$3.99/mo ($29/yr)Everything in Pro + ongoing updates, early access, priority support
TeamTBDFleet management, centralized dashboard, webhook integrations (Phase D)
Current Status

v5.2.2 — Beta release. Fully functional with Free and Pro tiers live. Available at gotsentinel.com and Gumroad. Code signing and notarization pending Apple Developer enrollment.