@codacy/verity-cli 0.24.0-experimental.ae62726 → 0.24.0-experimental.b35bbc7

package/bin/verity.js

@@ -10326,8 +10326,8 @@ var {
 
 // src/commands/auth.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_child_process3 = require("node:child_process");
-var import_node_path2 = require("node:path");
+var import_node_child_process4 = require("node:child_process");
+var import_node_path3 = require("node:path");
 
 // src/lib/auth.ts
 var import_promises = require("node:fs/promises");
@@ -10475,7 +10475,11 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://yykkfdexzljmmkklpgyz.supabase.co/functions/v1".length > 0 ? "https://yykkfdexzljmmkklpgyz.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var GITHUB_CLIENT_ID = "Ov23liBpj42KMTtUtN10";
+var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var GITHUB_OAUTH_SCOPES = "repo user:email";
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10641,7 +10645,8 @@ async function apiRequest(options) {
     timeout = 9e4,
     cmd = "unknown",
     retry = false,
-    encodeBody = false
+    encodeBody = false,
+    extraHeaders
   } = options;
   const url = `${serviceUrl}${path}`;
   const headers = {
@@ -10650,6 +10655,9 @@ async function apiRequest(options) {
   if (token) {
     headers["Authorization"] = `Bearer ${token}`;
   }
+  if (extraHeaders) {
+    Object.assign(headers, extraHeaders);
+  }
   const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
   if (testMockScenario) {
     headers["X-Verity-Mock-Scenario"] = testMockScenario;
@@ -10740,6 +10748,324 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/provider-auth.ts
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var form = (fields) => new URLSearchParams(fields).toString();
+async function githubDeviceFlow() {
+  const override = process.env.VERITY_PROVIDER_TOKEN;
+  if (override) return { ok: true, data: override };
+  let dc;
+  try {
+    const res = await fetch(GITHUB_DEVICE_CODE_URL, {
+      method: "POST",
+      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+      body: form({ client_id: GITHUB_CLIENT_ID, scope: GITHUB_OAUTH_SCOPES })
+    });
+    if (!res.ok) {
+      return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
+    }
+    dc = await res.json();
+  } catch (err) {
+    return { ok: false, error: `Network error contacting GitHub: ${err.message}` };
+  }
+  if (!dc.device_code || !dc.user_code) {
+    return {
+      ok: false,
+      error: "GitHub did not return a device code (is Device Flow enabled on the OAuth app?)"
+    };
+  }
+  printInfo("");
+  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
+  printInfo(`And enter the code:         ${dc.user_code}`);
+  printInfo("Waiting for authorization\u2026");
+  const deadline = Date.now() + (dc.expires_in || 900) * 1e3;
+  let interval = dc.interval || 5;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let data;
+    try {
+      const res = await fetch(GITHUB_ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+        body: form({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: dc.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      data = await res.json().catch(() => ({}));
+    } catch {
+      continue;
+    }
+    if (data.access_token) return { ok: true, data: data.access_token };
+    switch (data.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return { ok: false, error: "Authorization was denied on GitHub." };
+      case "expired_token":
+        return { ok: false, error: "The authorization code expired. Re-run register." };
+      default:
+        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
+    }
+  }
+  return { ok: false, error: "Timed out waiting for GitHub authorization." };
+}
+
+// src/lib/git.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+function resolveFile(relpath) {
+  if ((0, import_node_fs2.existsSync)(relpath)) return relpath;
+  if ((0, import_node_fs2.existsSync)(".claude/worktrees")) {
+    try {
+      const entries = (0, import_node_fs2.readdirSync)(".claude/worktrees", { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const candidate = (0, import_node_path2.join)(".claude/worktrees", entry.name, relpath);
+        if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function execGit(cmd) {
+  try {
+    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function splitLines(s) {
+  return s.split("\n").filter((l) => l.length > 0);
+}
+var SHA_RE = /^[0-9a-f]{40}$/;
+function readBaselineSha() {
+  if (!(0, import_node_fs2.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs2.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (!SHA_RE.test(sha)) return null;
+  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  if (!reachable) {
+    try {
+      (0, import_node_fs2.unlinkSync)(BASELINE_SHA_FILE);
+    } catch {
+    }
+    return null;
+  }
+  return sha;
+}
+function writeBaselineSha(sha) {
+  if (!SHA_RE.test(sha)) return;
+  try {
+    (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs2.writeFileSync)(BASELINE_SHA_FILE, sha);
+  } catch {
+  }
+}
+function getChangedFiles() {
+  const sets = /* @__PURE__ */ new Set();
+  let hasRecentCommitFiles = false;
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
+  } else {
+    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
+    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
+      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      if (recentFiles.length > 0) {
+        hasRecentCommitFiles = true;
+        for (const f of recentFiles) sets.add(f);
+      }
+    }
+  }
+  for (const f of getWorktreeFiles()) sets.add(f);
+  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return { files: filtered, hasRecentCommitFiles };
+}
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getDirtyFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function showContentAtRef(ref, repoRelPath) {
+  if (!ref || ref === "no-git") return null;
+  const normalizedPath = repoRelPath.replace(/\\/g, "/");
+  try {
+    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve of resolvers) {
+    const range = resolve();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
+function getPushRangeMessages() {
+  const { range } = getPushRangeFiles();
+  if (!range) return "";
+  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function getWorktreeFiles() {
+  const result = [];
+  const worktreeDir = ".claude/worktrees";
+  if (!(0, import_node_fs2.existsSync)(worktreeDir)) return result;
+  try {
+    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
+    const entries = (0, import_node_fs2.readdirSync)(worktreeDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const wtDir = (0, import_node_path2.join)(worktreeDir, entry.name);
+      scanDir(wtDir, wtDir, fiveMinAgo, result);
+    }
+  } catch {
+  }
+  return result;
+}
+function scanDir(baseDir, dir, minMtime, result) {
+  try {
+    const entries = (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path2.join)(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".git") continue;
+        scanDir(baseDir, fullPath, minMtime, result);
+      } else if (entry.isFile()) {
+        const ext = (0, import_node_path2.extname)(entry.name).slice(1);
+        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
+        try {
+          const stat3 = (0, import_node_fs2.statSync)(fullPath);
+          if (stat3.mtimeMs >= minMtime) {
+            const relPath = fullPath.slice(baseDir.length + 1);
+            result.push(relPath);
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function filterAnalyzable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    return ANALYZABLE_EXTENSIONS.has(ext);
+  });
+}
+function filterReviewable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
+    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
+    const basename2 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
+    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
+    return false;
+  });
+}
+function filterSecurity(files) {
+  return files.filter(
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+  );
+}
+function getCurrentCommit() {
+  return execGit("git rev-parse HEAD") || "no-git";
+}
+function detectProvider(host) {
+  const h = host.toLowerCase();
+  if (h.includes("github")) return "github";
+  if (h.includes("gitlab")) return "gitlab";
+  if (h.includes("bitbucket")) return "bitbucket";
+  return "unknown";
+}
+function parseRemote(raw) {
+  if (!raw || typeof raw !== "string") return null;
+  let s = raw.trim();
+  if (!s) return null;
+  let host = "";
+  let path = "";
+  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
+  if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    s = s.replace(/^[^/@]+@/, "");
+    const slash = s.indexOf("/");
+    if (slash === -1) return null;
+    host = s.slice(0, slash);
+    path = s.slice(slash + 1);
+  }
+  host = host.toLowerCase().trim();
+  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
+  if (!host || !path) return null;
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  const owner = segments[0];
+  const repo = segments[segments.length - 1];
+  if (!owner || !repo) return null;
+  return {
+    host,
+    owner,
+    repo,
+    provider: detectProvider(host),
+    orgUrl: `https://${host}/${owner}`,
+    orgName: owner
+  };
+}
+function listTrackedFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set);
+}
+
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage project authentication");
@@ -10749,35 +11075,65 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
       }
     }
+    const parsed = parseRemote(remote);
+    if (!parsed) {
+      printError(`Could not parse git remote: ${remote}`);
+      process.exit(1);
+    }
+    if (parsed.provider !== "github") {
+      printError(`Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.`);
+      process.exit(1);
+    }
+    const providerAuth = await githubDeviceFlow();
+    if (!providerAuth.ok) {
+      printError(providerAuth.error);
+      process.exit(1);
+    }
+    const providerToken = providerAuth.data;
     const result = await apiRequest({
       method: "POST",
       path: "/auth/register",
       serviceUrl,
       body: { project_name: opts.project, git_remote_url: remote },
+      extraHeaders: { "X-Provider-Token": providerToken },
       verbose: globals.verbose
     });
     if (!result.ok) {
       printError(result.error);
       process.exit(1);
     }
-    const { project_id, token, service_url } = result.data;
+    const { project_id, token, service_url, user } = result.data;
     await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(CREDENTIALS_FILE, `token: ${token}
+    await (0, import_promises3.writeFile)(
+      CREDENTIALS_FILE,
+      `token: ${token}
 service_url: ${service_url}
-`);
+provider_token: ${providerToken}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
+    });
     try {
-      await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-      await (0, import_promises3.appendFile)(GLOBAL_CREDENTIALS_FILE, `${remote} token: ${token}
-`);
+      await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
+      await (0, import_promises3.appendFile)(
+        GLOBAL_CREDENTIALS_FILE,
+        `${remote} token: ${token}
+${remote} provider_token: ${providerToken}
+`
+      );
+      await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
+      });
     } catch {
     }
     printInfo(`Project registered: ${project_id}`);
+    if (user?.email) printInfo(`Authenticated as: ${user.email}`);
     printJson({ project_id, service_url });
   });
   auth.command("verify").description("Verify the current token is valid").action(async () => {
@@ -10811,7 +11167,7 @@ service_url: ${service_url}
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -10839,7 +11195,7 @@ service_url: ${service_url}
 
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
+var import_node_path4 = require("node:path");
 var VERITY_STOP_HOOK = {
   type: "command",
   command: "verity analyze",
@@ -10991,19 +11347,19 @@ async function checkAllVerityHooksDetailed() {
   return { stop, intent, baseline, current: hasCurrent, legacyOnly: hasLegacy && !hasCurrent };
 }
 async function writeSettings(settings) {
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(CLAUDE_SETTINGS_FILE), { recursive: true });
+  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(CLAUDE_SETTINGS_FILE), { recursive: true });
   await (0, import_promises4.writeFile)(CLAUDE_SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path3.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  const file = (0, import_node_path3.join)(root, CLAUDE_SETTINGS_FILE);
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(file), { recursive: true });
+  const file = (0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE);
+  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
   await (0, import_promises4.writeFile)(file, JSON.stringify(settings, null, 2) + "\n");
 }
 async function hasLegacyHooksAt(root) {
@@ -11244,8 +11600,8 @@ var import_node_crypto2 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs2 = require("node:fs");
-var import_node_child_process4 = require("node:child_process");
+var import_node_fs3 = require("node:fs");
+var import_node_child_process5 = require("node:child_process");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
 }
@@ -11276,7 +11632,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs2.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs3.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -11300,7 +11656,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs2.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs3.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -11344,7 +11700,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process4.execSync)(
+    const output = (0, import_node_child_process5.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -11357,8 +11713,8 @@ function getRecentCommitMessages() {
 
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs3 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path5 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -11397,7 +11753,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs3.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs4.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -11431,12 +11787,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs3.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs4.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path4.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path5.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -11450,13 +11806,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path4.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path5.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs3.existsSync)(filePath)) {
+    if ((0, import_node_fs4.existsSync)(filePath)) {
       const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises6.readFile)(filePath, "utf-8");
@@ -11467,7 +11823,7 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs3.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
     await (0, import_promises6.writeFile)(filePath, existing + line);
   } catch {
   }
@@ -11475,8 +11831,8 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_fs4 = require("node:fs");
-var import_node_path5 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path6 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -11569,19 +11925,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  if (!(0, import_node_fs4.existsSync)(memoryDir())) return null;
+  if (!(0, import_node_fs5.existsSync)(memoryDir())) return null;
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path5.join)(memoryDir(), domain);
-    if (!(0, import_node_fs4.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path6.join)(memoryDir(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises7.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises7.readFile)((0, import_node_path5.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises7.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -11640,8 +11996,8 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 
 // src/lib/memory-sync.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs5 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path7 = require("node:path");
 var import_node_crypto = require("node:crypto");
 
 // src/lib/glob-match.ts
@@ -11712,32 +12068,32 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises8.mkdir)((0, import_node_path6.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises8.mkdir)((0, import_node_path7.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path6.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path7.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -11750,13 +12106,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises8.readFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises8.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -11767,15 +12123,15 @@ function hashContent(content) {
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises8.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -11821,8 +12177,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path6.join)(memoryDir2(), path);
-    if (!(0, import_node_fs5.existsSync)(full)) continue;
+    const full = (0, import_node_path7.join)(memoryDir2(), path);
+    if (!(0, import_node_fs6.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises8.readFile)(full, "utf-8");
@@ -11858,15 +12214,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path6.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path7.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -11876,7 +12232,7 @@ async function applyOneWrite(write, treePaths) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs5.existsSync)(fullPath)) {
+  if ((0, import_node_fs6.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises8.readFile)(fullPath, "utf-8");
@@ -11888,7 +12244,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises8.mkdir)((0, import_node_path6.dirname)(fullPath), { recursive: true });
+  await (0, import_promises8.mkdir)((0, import_node_path7.dirname)(fullPath), { recursive: true });
   await (0, import_promises8.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -11929,8 +12285,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -11940,7 +12296,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -11964,7 +12320,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path6.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path7.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
@@ -12046,9 +12402,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path6.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path7.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs5.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -12178,7 +12534,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/commands/intent.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 function registerIntentCommands(program2) {
   const intent = program2.command("intent").description("Manage intent capture");
   intent.command("capture").description("Capture user intent from stdin (used by UserPromptSubmit hook)").action(async () => {
@@ -12187,7 +12543,7 @@ function registerIntentCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs6.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs7.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       const chunks = [];
@@ -12766,215 +13122,6 @@ async function sendGeneralFeedback(message, opts, globals) {
 var import_node_fs19 = require("node:fs");
 var import_node_path14 = require("node:path");
 
-// src/lib/git.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_fs7 = require("node:fs");
-var import_node_path7 = require("node:path");
-function resolveFile(relpath) {
-  if ((0, import_node_fs7.existsSync)(relpath)) return relpath;
-  if ((0, import_node_fs7.existsSync)(".claude/worktrees")) {
-    try {
-      const entries = (0, import_node_fs7.readdirSync)(".claude/worktrees", { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const candidate = (0, import_node_path7.join)(".claude/worktrees", entry.name, relpath);
-        if ((0, import_node_fs7.existsSync)(candidate)) return candidate;
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function execGit(cmd) {
-  try {
-    return (0, import_node_child_process5.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function splitLines(s) {
-  return s.split("\n").filter((l) => l.length > 0);
-}
-var SHA_RE = /^[0-9a-f]{40}$/;
-function readBaselineSha() {
-  if (!(0, import_node_fs7.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs7.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
-    try {
-      (0, import_node_fs7.unlinkSync)(BASELINE_SHA_FILE);
-    } catch {
-    }
-    return null;
-  }
-  return sha;
-}
-function writeBaselineSha(sha) {
-  if (!SHA_RE.test(sha)) return;
-  try {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path7.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs7.writeFileSync)(BASELINE_SHA_FILE, sha);
-  } catch {
-  }
-}
-function getChangedFiles() {
-  const sets = /* @__PURE__ */ new Set();
-  let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
-    if (committed.length > 0) {
-      hasRecentCommitFiles = true;
-      for (const f of committed) sets.add(f);
-    }
-  } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
-    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
-    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
-      if (recentFiles.length > 0) {
-        hasRecentCommitFiles = true;
-        for (const f of recentFiles) sets.add(f);
-      }
-    }
-  }
-  for (const f of getWorktreeFiles()) sets.add(f);
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  return { files: filtered, hasRecentCommitFiles };
-}
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function getDirtyFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function showContentAtRef(ref, repoRelPath) {
-  if (!ref || ref === "no-git") return null;
-  const normalizedPath = repoRelPath.replace(/\\/g, "/");
-  try {
-    return (0, import_node_child_process5.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch {
-    return null;
-  }
-}
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGit("git rev-parse --abbrev-ref HEAD");
-      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve of resolvers) {
-    const range = resolve();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
-function getWorktreeFiles() {
-  const result = [];
-  const worktreeDir = ".claude/worktrees";
-  if (!(0, import_node_fs7.existsSync)(worktreeDir)) return result;
-  try {
-    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
-    const entries = (0, import_node_fs7.readdirSync)(worktreeDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const wtDir = (0, import_node_path7.join)(worktreeDir, entry.name);
-      scanDir(wtDir, wtDir, fiveMinAgo, result);
-    }
-  } catch {
-  }
-  return result;
-}
-function scanDir(baseDir, dir, minMtime, result) {
-  try {
-    const entries = (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = (0, import_node_path7.join)(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".git") continue;
-        scanDir(baseDir, fullPath, minMtime, result);
-      } else if (entry.isFile()) {
-        const ext = (0, import_node_path7.extname)(entry.name).slice(1);
-        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
-        try {
-          const stat3 = (0, import_node_fs7.statSync)(fullPath);
-          if (stat3.mtimeMs >= minMtime) {
-            const relPath = fullPath.slice(baseDir.length + 1);
-            result.push(relPath);
-          }
-        } catch {
-        }
-      }
-    }
-  } catch {
-  }
-}
-function filterAnalyzable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path7.extname)(f).slice(1);
-    return ANALYZABLE_EXTENSIONS.has(ext);
-  });
-}
-function filterReviewable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path7.extname)(f).slice(1);
-    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
-    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename2 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
-    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
-    return false;
-  });
-}
-function filterSecurity(files) {
-  return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
-  );
-}
-function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
-}
-function listTrackedFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set);
-}
-
 // src/lib/files.ts
 var import_node_fs8 = require("node:fs");
 var import_node_path8 = require("node:path");
@@ -13108,10 +13255,15 @@ function collectCodeDelta(files, opts) {
 // src/lib/debounce.ts
 var import_node_fs9 = require("node:fs");
 var import_node_crypto3 = require("node:crypto");
-function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS) {
-  if (!(0, import_node_fs9.existsSync)(DEBOUNCE_FILE)) return null;
+function scopedFile(base, sessionId) {
+  if (!sessionId) return base;
+  return `${base}.${(0, import_node_crypto3.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+}
+function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs9.existsSync)(file)) return null;
   try {
-    const lastTs = parseInt((0, import_node_fs9.readFileSync)(DEBOUNCE_FILE, "utf-8").trim(), 10);
+    const lastTs = parseInt((0, import_node_fs9.readFileSync)(file, "utf-8").trim(), 10);
     const nowTs = Math.floor(Date.now() / 1e3);
     const elapsed = nowTs - lastTs;
     if (elapsed < debounceSeconds) {
@@ -13121,12 +13273,13 @@ function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS) {
   }
   return null;
 }
-function checkMtime(files, bypassForRecentCommits) {
+function checkMtime(files, bypassForRecentCommits, sessionId) {
   if (bypassForRecentCommits) return null;
-  if (!(0, import_node_fs9.existsSync)(DEBOUNCE_FILE)) return null;
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs9.existsSync)(file)) return null;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs9.statSync)(DEBOUNCE_FILE).mtimeMs;
+    debounceTime = (0, import_node_fs9.statSync)(file).mtimeMs;
   } catch {
     return null;
   }
@@ -13158,11 +13311,12 @@ function computeContentHash(files) {
   }
   return hash.digest("hex");
 }
-function checkContentHash(files) {
+function checkContentHash(files, sessionId) {
   const hash = computeContentHash(files);
-  if ((0, import_node_fs9.existsSync)(HASH_FILE)) {
+  const file = scopedFile(HASH_FILE, sessionId);
+  if ((0, import_node_fs9.existsSync)(file)) {
     try {
-      const storedHash = (0, import_node_fs9.readFileSync)(HASH_FILE, "utf-8").trim();
+      const storedHash = (0, import_node_fs9.readFileSync)(file, "utf-8").trim();
       if (hash === storedHash) {
         return { skip: "No source changes since last analysis", hash };
       }
@@ -13171,18 +13325,19 @@ function checkContentHash(files) {
   }
   return { skip: null, hash };
 }
-function recordAnalysisStart() {
+function recordAnalysisStart(sessionId) {
   (0, import_node_fs9.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs9.writeFileSync)(DEBOUNCE_FILE, String(Math.floor(Date.now() / 1e3)));
+  (0, import_node_fs9.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
 }
-function recordPassHash(hash) {
-  (0, import_node_fs9.writeFileSync)(HASH_FILE, hash);
+function recordPassHash(hash, sessionId) {
+  (0, import_node_fs9.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
 }
-function narrowToRecent(files) {
-  if (!(0, import_node_fs9.existsSync)(DEBOUNCE_FILE)) return files;
+function narrowToRecent(files, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs9.existsSync)(file)) return files;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs9.statSync)(DEBOUNCE_FILE).mtimeMs;
+    debounceTime = (0, import_node_fs9.statSync)(file).mtimeMs;
   } catch {
     return files;
   }
@@ -14688,7 +14843,7 @@ async function runAnalyze(opts, globals) {
   let currentCommit = "";
   if (analysisMode !== "plan") {
     const debounceSeconds = parseInt(opts.debounce, 10);
-    const debounceSkip = checkDebounce(debounceSeconds);
+    const debounceSkip = checkDebounce(debounceSeconds, baselineSessionId);
     if (debounceSkip) {
       if (assistantResponse) {
         analysisMode = "plan";
@@ -14698,7 +14853,7 @@ async function runAnalyze(opts, globals) {
     }
     if (analysisMode !== "plan") {
       const allCheckable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable, ...securityFiles]));
-      const mtimeSkip = checkMtime(allCheckable, hasRecentCommitFiles);
+      const mtimeSkip = checkMtime(allCheckable, hasRecentCommitFiles, baselineSessionId);
       if (mtimeSkip) {
         if (assistantResponse) {
           analysisMode = "plan";
@@ -14708,9 +14863,9 @@ async function runAnalyze(opts, globals) {
       }
     }
     if (analysisMode !== "plan") {
-      recordAnalysisStart();
+      recordAnalysisStart(baselineSessionId);
       const allCheckable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable, ...securityFiles]));
-      const hashResult = checkContentHash(allCheckable);
+      const hashResult = checkContentHash(allCheckable, baselineSessionId);
       if (hashResult.skip) {
         if (assistantResponse) {
           analysisMode = "plan";
@@ -14722,7 +14877,7 @@ async function runAnalyze(opts, globals) {
       if (analysisMode !== "plan") {
         const agentNarrowed = narrowToAgentAuthored(allForReview, actionSummary);
         const baseForReview = agentNarrowed.length > 0 ? agentNarrowed : allForReview;
-        const recentForReview = narrowToRecent(baseForReview);
+        const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
         if (!opts.skipStatic && isCodacyAvailable()) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
           if (baseline) {
@@ -15097,7 +15252,7 @@ async function runAnalyze(opts, globals) {
     }
     case "PASS": {
       writeIteration(1, currentCommit, contentHash ?? void 0);
-      if (contentHash) recordPassHash(contentHash);
+      if (contentHash) recordPassHash(contentHash, baselineSessionId);
       if (currentCommit && currentCommit !== "no-git") writeBaselineSha(currentCommit);
       let userSummary = response.user_summary ?? "Verity: PASS";
       const viewUrl = response.view_url ?? "";
@@ -15108,7 +15263,7 @@ async function runAnalyze(opts, globals) {
       break;
     }
     case "WARN": {
-      if (contentHash) recordPassHash(contentHash);
+      if (contentHash) recordPassHash(contentHash, baselineSessionId);
       if (currentCommit && currentCommit !== "no-git") writeBaselineSha(currentCommit);
       let userSummary = response.user_summary ?? "Verity: WARN";
       const viewUrl = response.view_url ?? "";
@@ -16766,7 +16921,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.24.0-experimental.ae62726").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.24.0-experimental.b35bbc7").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);

package/data/skills/verity-setup/SKILL.md

@@ -312,18 +312,25 @@ Expected: single-digit findings per file, not hundreds. If you see 50+ issues fr
 
 ## Step 6: Register with Verity service
 
-Use the `verity` CLI to register. It handles credential storage and service URL automatically.
+Use the `verity` CLI to register. It handles provider auth, credential storage, and the service URL automatically.
 
 ```bash
 verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
 ```
 
+Registration is **provider-gated** (GitHub today): the CLI runs a GitHub OAuth
+**device flow** and prints something like *"open https://github.com/login/device
+and enter code WXYZ-1234"*. The user approves in the browser; the CLI then proves
+the user has **write access** to the repo before the service issues a token. Tell
+the user to expect this prompt and to complete it in their browser.
+
 This command:
-- **New project**: Registers, stores token + service URL in `.verity/credentials`, prints `project_id`. Continue.
-- **Already registered**: Automatically discovers the project, ensures `.verity/credentials` has the service URL. If a token already exists in credentials, it updates the file and succeeds. If no token exists, it asks you to paste one.
+- **Write access confirmed**: Registers, stores the verity token + service URL + provider token in `.verity/credentials` (perms 600), prints `project_id` and the authenticated email. Continue.
+- **No write access** (`403 NO_WRITE_ACCESS`): The user lacks push rights on the repo — they can't register it. Verity still runs locally as an anonymous gate, but no history/org/repo data is stored. Stop.
+- **Non-GitHub remote**: Only GitHub is supported for now; show the error and stop.
 - **Other errors**: Show the error and stop.
 
-After this step, `.verity/credentials` will contain both `token` and `service_url` — all subsequent `verity` commands will work.
+After this step, `.verity/credentials` will contain `token`, `service_url`, and `provider_token` — all subsequent `verity` commands will work.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.24.0-experimental.ae62726",
+  "version": "0.24.0-experimental.b35bbc7",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {