@brokkai/slopcop 0.0.4 → 0.0.5

package/README.md

@@ -110,9 +110,12 @@ harness is present, and names what it did:
 | `~/.claude/skills/slopcop/` | Claude Code, opencode |
 | `$CODEX_HOME/skills/slopcop/`, or `~/.codex/skills/slopcop/` | Codex home |
 
-A skill that is already there is left alone, so local edits survive and running
-init again is safe. `slopcop init --no-skill` skips the install and any update
-of it.
+A skill that is already there is left alone by init, so running it again is
+safe. `slopcop login` and every check also install the skill in those
+directories, rewriting one that differs from the skill bundled into the binary,
+so an agent follows the instructions of the slopcop version it runs; local
+edits to an installed skill do not survive them. `slopcop init --no-skill`
+skips the install and any update of it.
 
 ## Sign in
 
@@ -192,17 +195,35 @@ already in the code are counted, never fail the check, and are listed only with
 `--show-existing`. A change that introduces nothing exits `0`, however many
 findings the repository already holds.
 
+### Ignore a false positive
+
+Each finding a check reports carries an `id`. When a finding is a false
+positive, ignore it:
+
+```console
+slopcop ignore 0f8fad5b-d9cb-469f-a165-70867728950e
+```
+
+That finding is not reported again for this repository. Ignoring covers that
+one finding, its rule plus its place in the code, in its repository for your
+workspace; the rule keeps reporting everything else. Ignoring a finding twice
+is fine. `ignore` uses the same login and service URL as a check, exits `0`
+with a one-line confirmation, and otherwise exits `2` with the service's
+message and remedy; `finding_not_found` means the id is unknown or comes from a
+check outside your workspace.
+
 ### Output and exit codes
 
 The service answers structured data; the CLI renders it. `human` prints one
-block per new finding, then the pre-existing ones with `--show-existing`, a
+block per new finding, with an `ID:` line when the service names one, then the
+pre-existing ones with `--show-existing`, a
 summary line such as `1 new finding across 1 file(s); 72 already in the code
 (--show-existing lists them) | Analysis complete`, and any omitted or
 incomplete checks. `json` prints `status`, `baseCommit`, `summary`
 (`newFindings` and `existingFindings` count the split), `findings` (each with
-`new`), `incomplete`, and `failure` when the analysis did not complete. `sarif`
-prints a SARIF 2.1.0 log whose results carry `baselineState` `new` or
-`unchanged`. `--format` and `--show-existing` only change the rendering, never
+`new` and its `id`), `incomplete`, and `failure` when the analysis did not
+complete. `sarif` prints a SARIF 2.1.0 log whose results carry `baselineState`
+`new` or `unchanged` and the finding id in `properties["slopcop.findingId"]`. `--format` and `--show-existing` only change the rendering, never
 the request, so the service answers the same check whichever is used.
 
 | Exit | Meaning |
@@ -243,10 +264,6 @@ rewrite them. The remedies name no client, so when one says to sign in the CLI
 adds the `slopcop login` command after it. A failed request prints no report
 on stdout.
 
-While SlopCop is still indexing the repository, the service answers
-`indexing_in_progress` at once instead of running the check. The CLI prints it
-and exits `2` without waiting or retrying.
-
 ## API
 
 The CLI calls `POST <service>/v1/check` with a bearer token:
@@ -268,6 +285,14 @@ were marked `new`, the CLI treats every finding as new, as that service gated
 on all of them. Non-2xx responses carry `code`, `message`,
 `remedy`, `retryable`, and an optional `installUrl`.
 
+Each finding in the response carries an `id`; a service from before findings
+could be ignored omits it.
+
+`slopcop ignore <id>` calls `POST <service>/v1/ignore` with the same bearer
+token and `{"findingId": "<id>"}`, and gets back
+`{"findingId": "<id>", "status": "ignored"}`. Failures use the same closed
+contract, including `finding_not_found`.
+
 `slopcop login` uses the device flow: `POST /api/device` returns a
 `deviceCode`, `userCode`, `verificationUri`, `expiresIn`, and `interval`, and
 `POST /api/token` returns `202` while pending or `200` with a `token` once

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brokkai/slopcop",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Static analysis for coding agents and CI: check a change through the hosted SlopCop API",
   "keywords": [
     "agents",