Add --json output to the check command

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_check_json.py

@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""The `check --json` flag emits a parseable JSON alert array."""
+import io
+import json
+import unittest
+from contextlib import redirect_stdout
+from unittest import mock
+
+from enodia_sentinel import cli
+from enodia_sentinel.alert import Alert, Severity
+from enodia_sentinel.config import Config
+
+
+class _FakeSentinel:
+    def __init__(self, cfg):
+        self.start_time = 1.0
+        self.listener_baseline = {"x"}
+
+    def load_baselines(self):
+        pass
+
+    def build_baselines(self):
+        pass
+
+    def sweep(self, force_suid=False):
+        return [Alert(Severity.HIGH, "rsh", "rsh:1", "reverse shell", sid=1001)]
+
+
+class TestCheckJson(unittest.TestCase):
+    def test_check_json_emits_alert_array(self):
+        cfg = Config()
+        with mock.patch.object(cli, "Sentinel", _FakeSentinel):
+            buf = io.StringIO()
+            with redirect_stdout(buf):
+                rc = cli._cmd_check(cfg, True)
+        self.assertEqual(rc, 0)
+        data = json.loads(buf.getvalue())
+        self.assertEqual(len(data), 1)
+        self.assertEqual(data[0]["signature"], "rsh")
+        self.assertEqual(data[0]["sid"], 1001)