LLMs are confidently wrong about package versions in a very specific way: they remember the ecosystem as it looked when their training data froze. Ask for "the latest lodash" and you get the latest as of some unknowable yesterday. Sometimes the version never existed at all. Sometimes it's a build that was yanked for being compromised.
If an AI writes your manifests, version selection is a supply-chain decision being made from stale memory - silently. That's the gap Version-Sentinel closes.
The mechanism: block, don't advise
Claude Code fires hooks around tool calls. Version-Sentinel registers a
PreToolUse hook that inspects every edit touching a dependency manifest -
package.json, requirements.txt, pyproject.toml, Cargo.toml,
.csproj. If the edit adds, bumps or downgrades a package and there's no
fresh, source-cited check on record, the hook exits 2 and the edit never
lands.
Edit package.json: "zod": "^3.22.0"
└► BLOCKED - no fresh version check for zod.
Run a registry lookup, then /vs-record:
/vs-record zod 4.4.3 https://www.npmjs.com/package/zod
...then retry the edit.The model reacts exactly as you'd hope: it searches, records the citation, and retries with a version that's real today. The record - package, version, source URL, timestamp - doubles as an audit trail of every dependency decision in the session.
Why hard-fail matters
There's a spectrum of enforcement, and most tooling sits at the polite end: Dependabot opens PRs later; audit skills scan after the fact; a CLAUDE.md instruction says "please check versions" and hopes. Advisory guardrails share a flaw - the model can ignore them, and under context pressure it eventually will.
A blocking hook is different in kind, not degree. Exit 2 isn't feedback, it's physics: the edit cannot happen. The design bet is that mandatory friction at the moment of change beats any amount of after-the-fact review, because the cost of checking is seconds and the cost of a compromised pin is unbounded.
What it deliberately doesn't do
Version-Sentinel doesn't force upgrades. Pinning an old version on purpose is a legitimate engineering decision - the hook only requires that it be a fresh, cited decision. Guardrails that fight intent get disabled; the ones that survive encode process, not opinion.
Dogfood note
The site you're reading enforced this discipline during its own build - every package in its manifest traces to a registry check made the same day it was installed. The tool that guards the workflow was built by the workflow. That loop closing is most of why I trust it.