@codacy/verity-cli 0.24.0 → 0.25.0-experimental.56ef7d8

package/bin/verity.js

@@ -10325,9 +10325,7 @@ var {
 } = import_index.default;
 
 // src/commands/auth.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_child_process3 = require("node:child_process");
-var import_node_path2 = require("node:path");
+var import_node_child_process4 = require("node:child_process");
 
 // src/lib/auth.ts
 var import_promises = require("node:fs/promises");
@@ -10379,6 +10377,7 @@ var MAX_PLAN_FILES = 3;
 var MAX_PLAN_FILE_BYTES = 10240;
 var MAX_INTENT_CHARS = 2e3;
 var SNAPSHOT_DIR = `${VERITY_DIR}/.snapshot`;
+var BASELINE_DIR = `${VERITY_DIR}/.baseline`;
 var CONVERSATION_BUFFER_FILE = `${VERITY_DIR}/.conversation-buffer`;
 var CONVERSATION_MAX_ENTRIES = 10;
 var CONVERSATION_WINDOW_MINUTES = 15;
@@ -10473,7 +10472,12 @@ var SECURITY_PATTERNS = [
   /Cargo\.lock$/,
   /Dockerfile/
 ];
-var DEFAULT_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
+var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
+var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var GITHUB_CLIENT_ID = "Ov23liBpj42KMTtUtN10";
+var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var GITHUB_OAUTH_SCOPES = "repo user:email";
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10639,7 +10643,8 @@ async function apiRequest(options) {
     timeout = 9e4,
     cmd = "unknown",
     retry = false,
-    encodeBody = false
+    encodeBody = false,
+    extraHeaders
   } = options;
   const url = `${serviceUrl}${path}`;
   const headers = {
@@ -10648,6 +10653,9 @@ async function apiRequest(options) {
   if (token) {
     headers["Authorization"] = `Bearer ${token}`;
   }
+  if (extraHeaders) {
+    Object.assign(headers, extraHeaders);
+  }
   const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
   if (testMockScenario) {
     headers["X-Verity-Mock-Scenario"] = testMockScenario;
@@ -10738,6 +10746,388 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/register.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
+
+// src/lib/provider-auth.ts
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var form = (fields) => new URLSearchParams(fields).toString();
+async function githubDeviceFlow() {
+  const override = process.env.VERITY_PROVIDER_TOKEN;
+  if (override) return { ok: true, data: override };
+  let dc;
+  try {
+    const res = await fetch(GITHUB_DEVICE_CODE_URL, {
+      method: "POST",
+      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+      body: form({ client_id: GITHUB_CLIENT_ID, scope: GITHUB_OAUTH_SCOPES })
+    });
+    if (!res.ok) {
+      return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
+    }
+    dc = await res.json();
+  } catch (err) {
+    return { ok: false, error: `Network error contacting GitHub: ${err.message}` };
+  }
+  if (!dc.device_code || !dc.user_code) {
+    return {
+      ok: false,
+      error: "GitHub did not return a device code (is Device Flow enabled on the OAuth app?)"
+    };
+  }
+  printInfo("");
+  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
+  printInfo(`And enter the code:         ${dc.user_code}`);
+  printInfo("Waiting for authorization\u2026");
+  const deadline = Date.now() + (dc.expires_in || 900) * 1e3;
+  let interval = dc.interval || 5;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let data;
+    try {
+      const res = await fetch(GITHUB_ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+        body: form({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: dc.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      data = await res.json().catch(() => ({}));
+    } catch {
+      continue;
+    }
+    if (data.access_token) return { ok: true, data: data.access_token };
+    switch (data.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return { ok: false, error: "Authorization was denied on GitHub." };
+      case "expired_token":
+        return { ok: false, error: "The authorization code expired. Re-run register." };
+      default:
+        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
+    }
+  }
+  return { ok: false, error: "Timed out waiting for GitHub authorization." };
+}
+
+// src/lib/git.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+function resolveFile(relpath) {
+  if ((0, import_node_fs2.existsSync)(relpath)) return relpath;
+  if ((0, import_node_fs2.existsSync)(".claude/worktrees")) {
+    try {
+      const entries = (0, import_node_fs2.readdirSync)(".claude/worktrees", { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const candidate = (0, import_node_path2.join)(".claude/worktrees", entry.name, relpath);
+        if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function execGit(cmd) {
+  try {
+    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function splitLines(s) {
+  return s.split("\n").filter((l) => l.length > 0);
+}
+var SHA_RE = /^[0-9a-f]{40}$/;
+function readBaselineSha() {
+  if (!(0, import_node_fs2.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs2.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (!SHA_RE.test(sha)) return null;
+  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  if (!reachable) {
+    try {
+      (0, import_node_fs2.unlinkSync)(BASELINE_SHA_FILE);
+    } catch {
+    }
+    return null;
+  }
+  return sha;
+}
+function writeBaselineSha(sha) {
+  if (!SHA_RE.test(sha)) return;
+  try {
+    (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs2.writeFileSync)(BASELINE_SHA_FILE, sha);
+  } catch {
+  }
+}
+function getChangedFiles() {
+  const sets = /* @__PURE__ */ new Set();
+  let hasRecentCommitFiles = false;
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
+  } else {
+    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
+    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
+      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      if (recentFiles.length > 0) {
+        hasRecentCommitFiles = true;
+        for (const f of recentFiles) sets.add(f);
+      }
+    }
+  }
+  for (const f of getWorktreeFiles()) sets.add(f);
+  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return { files: filtered, hasRecentCommitFiles };
+}
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getDirtyFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function showContentAtRef(ref, repoRelPath) {
+  if (!ref || ref === "no-git") return null;
+  const normalizedPath = repoRelPath.replace(/\\/g, "/");
+  try {
+    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve of resolvers) {
+    const range = resolve();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
+function getPushRangeMessages() {
+  const { range } = getPushRangeFiles();
+  if (!range) return "";
+  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function getWorktreeFiles() {
+  const result = [];
+  const worktreeDir = ".claude/worktrees";
+  if (!(0, import_node_fs2.existsSync)(worktreeDir)) return result;
+  try {
+    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
+    const entries = (0, import_node_fs2.readdirSync)(worktreeDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const wtDir = (0, import_node_path2.join)(worktreeDir, entry.name);
+      scanDir(wtDir, wtDir, fiveMinAgo, result);
+    }
+  } catch {
+  }
+  return result;
+}
+function scanDir(baseDir, dir, minMtime, result) {
+  try {
+    const entries = (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path2.join)(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".git") continue;
+        scanDir(baseDir, fullPath, minMtime, result);
+      } else if (entry.isFile()) {
+        const ext = (0, import_node_path2.extname)(entry.name).slice(1);
+        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
+        try {
+          const stat3 = (0, import_node_fs2.statSync)(fullPath);
+          if (stat3.mtimeMs >= minMtime) {
+            const relPath = fullPath.slice(baseDir.length + 1);
+            result.push(relPath);
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function filterAnalyzable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    return ANALYZABLE_EXTENSIONS.has(ext);
+  });
+}
+function filterReviewable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
+    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
+    const basename3 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
+    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
+    return false;
+  });
+}
+function filterSecurity(files) {
+  return files.filter(
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+  );
+}
+function getCurrentCommit() {
+  return execGit("git rev-parse HEAD") || "no-git";
+}
+function detectProvider(host) {
+  const h = host.toLowerCase();
+  if (h.includes("github")) return "github";
+  if (h.includes("gitlab")) return "gitlab";
+  if (h.includes("bitbucket")) return "bitbucket";
+  return "unknown";
+}
+function parseRemote(raw) {
+  if (!raw || typeof raw !== "string") return null;
+  let s = raw.trim();
+  if (!s) return null;
+  let host = "";
+  let path = "";
+  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
+  if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    s = s.replace(/^[^/@]+@/, "");
+    const slash = s.indexOf("/");
+    if (slash === -1) return null;
+    host = s.slice(0, slash);
+    path = s.slice(slash + 1);
+  }
+  host = host.toLowerCase().trim();
+  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
+  if (!host || !path) return null;
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  const owner = segments[0];
+  const repo = segments[segments.length - 1];
+  if (!owner || !repo) return null;
+  return {
+    host,
+    owner,
+    repo,
+    provider: detectProvider(host),
+    orgUrl: `https://${host}/${owner}`,
+    orgName: owner
+  };
+}
+function listTrackedFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set);
+}
+
+// src/lib/register.ts
+async function registerProject(opts) {
+  const parsed = parseRemote(opts.remote);
+  if (!parsed) {
+    return { ok: false, error: `Could not parse git remote: ${opts.remote}` };
+  }
+  if (parsed.provider !== "github") {
+    return { ok: false, error: `Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.` };
+  }
+  const providerAuth = await githubDeviceFlow();
+  if (!providerAuth.ok) {
+    return { ok: false, error: providerAuth.error };
+  }
+  const providerToken = providerAuth.data;
+  const result = await apiRequest({
+    method: "POST",
+    path: "/auth/register",
+    serviceUrl: opts.serviceUrl,
+    body: { project_name: opts.projectName, git_remote_url: opts.remote },
+    extraHeaders: { "X-Provider-Token": providerToken },
+    verbose: opts.verbose
+  });
+  if (!result.ok) {
+    return { ok: false, error: result.error };
+  }
+  const { project_id, token, service_url, user } = result.data;
+  try {
+    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises3.writeFile)(
+      CREDENTIALS_FILE,
+      `token: ${token}
+service_url: ${service_url}
+provider_token: ${providerToken}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Registered with the Verity service, but could not save credentials to ${CREDENTIALS_FILE}: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
+    };
+  }
+  try {
+    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
+    await (0, import_promises3.appendFile)(
+      GLOBAL_CREDENTIALS_FILE,
+      `${opts.remote} token: ${token}
+${opts.remote} provider_token: ${providerToken}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch {
+  }
+  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email: user?.email } };
+}
+
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage project authentication");
@@ -10747,36 +11137,26 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
       }
     }
-    const result = await apiRequest({
-      method: "POST",
-      path: "/auth/register",
+    const result = await registerProject({
+      projectName: opts.project,
+      remote,
       serviceUrl,
-      body: { project_name: opts.project, git_remote_url: remote },
       verbose: globals.verbose
     });
     if (!result.ok) {
       printError(result.error);
       process.exit(1);
     }
-    const { project_id, token, service_url } = result.data;
-    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(CREDENTIALS_FILE, `token: ${token}
-service_url: ${service_url}
-`);
-    try {
-      await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-      await (0, import_promises3.appendFile)(GLOBAL_CREDENTIALS_FILE, `${remote} token: ${token}
-`);
-    } catch {
-    }
-    printInfo(`Project registered: ${project_id}`);
-    printJson({ project_id, service_url });
+    const { projectId, serviceUrl: resolvedUrl, email } = result.data;
+    printInfo(`Project registered: ${projectId}`);
+    if (email) printInfo(`Authenticated as: ${email}`);
+    printJson({ project_id: projectId, service_url: resolvedUrl });
   });
   auth.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
@@ -10809,7 +11189,7 @@ service_url: ${service_url}
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -10837,7 +11217,7 @@ service_url: ${service_url}
 
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
+var import_node_path4 = require("node:path");
 var VERITY_STOP_HOOK = {
   type: "command",
   command: "verity analyze",
@@ -10848,6 +11228,10 @@ var VERITY_INTENT_HOOK = {
   type: "command",
   command: "verity intent capture"
 };
+var VERITY_BASELINE_HOOK = {
+  type: "command",
+  command: "verity baseline capture"
+};
 var GUARD_TIMEOUT = 300;
 function buildGuardHook(on) {
   return {
@@ -10860,9 +11244,13 @@ function buildGuardHook(on) {
 var VERITY_STOP_RE = /(?:^|[\/\s"'])verity\s+analyze\b/;
 var VERITY_INTENT_RE = /(?:^|[\/\s"'])verity\s+intent\s+capture\b/;
 var VERITY_GUARD_RE = /(?:^|[\/\s"'])verity\s+guard\b/;
+var VERITY_BASELINE_RE = /(?:^|[\/\s"'])verity\s+baseline\s+capture\b/;
 function isVerityGuardHook(entry) {
   return VERITY_GUARD_RE.test(entry.command ?? "");
 }
+function isVerityBaselineHook(entry) {
+  return VERITY_BASELINE_RE.test(entry.command ?? "");
+}
 var LEGACY_STOP_RE = /(?:^|[\/\s"'])gate\s+analyze\b/;
 var LEGACY_INTENT_RE = /(?:^|[\/\s"'])gate\s+intent\s+capture\b/;
 function isVerityStopHook(entry) {
@@ -10874,7 +11262,7 @@ function isVerityIntentHook(entry) {
   return VERITY_INTENT_RE.test(c) || LEGACY_INTENT_RE.test(c) || c.includes(".verity/hooks/capture-intent.sh") || c.includes(".gate/hooks/capture-intent.sh");
 }
 function isVerityHook(entry) {
-  return isVerityStopHook(entry) || isVerityIntentHook(entry) || isVerityGuardHook(entry);
+  return isVerityStopHook(entry) || isVerityIntentHook(entry) || isVerityGuardHook(entry) || isVerityBaselineHook(entry);
 }
 function isCurrentVerityStopHook(entry) {
   const c = entry.command ?? "";
@@ -10885,7 +11273,7 @@ function isCurrentVerityIntentHook(entry) {
   return VERITY_INTENT_RE.test(c) || c.includes(".verity/hooks/capture-intent.sh");
 }
 function isCurrentVerityHook(entry) {
-  return isCurrentVerityStopHook(entry) || isCurrentVerityIntentHook(entry) || isVerityGuardHook(entry);
+  return isCurrentVerityStopHook(entry) || isCurrentVerityIntentHook(entry) || isVerityGuardHook(entry) || isVerityBaselineHook(entry);
 }
 function settingsHasLegacyHook(settings) {
   for (const groups of Object.values(settings.hooks ?? {})) {
@@ -10927,16 +11315,18 @@ async function readAllSettings() {
 async function checkAllVerityHooks() {
   let stop = false;
   let intent = false;
+  let baseline = false;
   let guard = false;
   let guardOn = [];
   for (const settings of await readAllSettings()) {
     const r = checkVerityHooks(settings);
     stop = stop || r.stop;
     intent = intent || r.intent;
+    baseline = baseline || r.baseline;
     guard = guard || r.guard;
     if (r.guardOn.length > guardOn.length) guardOn = r.guardOn;
   }
-  return { stop, intent, guard, guardOn };
+  return { stop, intent, baseline, guard, guardOn };
 }
 async function checkExternalVerityHooks() {
   let stop = false;
@@ -10959,12 +11349,14 @@ async function checkExternalVerityHooks() {
 async function checkAllVerityHooksDetailed() {
   let stop = false;
   let intent = false;
+  let baseline = false;
   let hasCurrent = false;
   let hasLegacy = false;
   for (const settings of await readAllSettings()) {
     const r = checkVerityHooks(settings);
     stop = stop || r.stop;
     intent = intent || r.intent;
+    baseline = baseline || r.baseline;
     for (const groups of Object.values(settings.hooks ?? {})) {
       for (const g of groups ?? []) {
         for (const h of g.hooks ?? []) {
@@ -10974,22 +11366,22 @@ async function checkAllVerityHooksDetailed() {
       }
     }
   }
-  return { stop, intent, current: hasCurrent, legacyOnly: hasLegacy && !hasCurrent };
+  return { stop, intent, baseline, current: hasCurrent, legacyOnly: hasLegacy && !hasCurrent };
 }
 async function writeSettings(settings) {
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(CLAUDE_SETTINGS_FILE), { recursive: true });
+  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(CLAUDE_SETTINGS_FILE), { recursive: true });
   await (0, import_promises4.writeFile)(CLAUDE_SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path3.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  const file = (0, import_node_path3.join)(root, CLAUDE_SETTINGS_FILE);
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(file), { recursive: true });
+  const file = (0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE);
+  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
   await (0, import_promises4.writeFile)(file, JSON.stringify(settings, null, 2) + "\n");
 }
 async function hasLegacyHooksAt(root) {
@@ -11017,6 +11409,10 @@ function checkVerityHooks(settings) {
   const hasIntent = intentGroups.some(
     (g) => g.hooks?.some((h) => isCurrentVerityIntentHook(h))
   );
+  const sessionStartGroups = hooks["SessionStart"] ?? [];
+  const hasBaseline = sessionStartGroups.some(
+    (g) => g.hooks?.some((h) => isVerityBaselineHook(h))
+  );
   let guard = false;
   let guardOn = [];
   for (const g of hooks["PreToolUse"] ?? []) {
@@ -11029,16 +11425,17 @@ function checkVerityHooks(settings) {
       }
     }
   }
-  return { stop: hasStop, intent: hasIntent, guard, guardOn };
+  return { stop: hasStop, intent: hasIntent, baseline: hasBaseline, guard, guardOn };
 }
-function installVerityHooks(settings, force, externalPresent = { stop: false, intent: false }) {
+function installVerityHooks(settings, force, externalPresent = { stop: false, intent: false, baseline: false }) {
   const local = checkVerityHooks(settings);
   const existing = {
     stop: local.stop || externalPresent.stop,
-    intent: local.intent || externalPresent.intent
+    intent: local.intent || externalPresent.intent,
+    baseline: local.baseline || (externalPresent.baseline ?? false)
   };
   const hasLocalLegacy = settingsHasLegacyHook(settings);
-  if (existing.stop && existing.intent && !force && !hasLocalLegacy) {
+  if (existing.stop && existing.intent && existing.baseline && !force && !hasLocalLegacy) {
     return { ok: false, error: "Verity hooks already installed. Use --force to overwrite." };
   }
   const newSettings = { ...settings };
@@ -11046,7 +11443,7 @@ function installVerityHooks(settings, force, externalPresent = { stop: false, in
     newSettings.hooks = {};
   }
   const shouldStrip = force ? isVerityHook : isLegacyHook;
-  for (const key of ["Stop", "UserPromptSubmit"]) {
+  for (const key of ["Stop", "UserPromptSubmit", "SessionStart"]) {
     const groups = newSettings.hooks[key];
     if (groups) {
       newSettings.hooks[key] = groups.map((g) => ({
@@ -11073,6 +11470,15 @@ function installVerityHooks(settings, force, externalPresent = { stop: false, in
     if (!newSettings.hooks["UserPromptSubmit"]) newSettings.hooks["UserPromptSubmit"] = [];
     newSettings.hooks["UserPromptSubmit"].push({ hooks: [VERITY_INTENT_HOOK] });
   }
+  if (!existing.baseline) {
+    if (!newSettings.hooks["SessionStart"]) {
+      newSettings.hooks["SessionStart"] = [];
+    }
+    newSettings.hooks["SessionStart"].push({ hooks: [VERITY_BASELINE_HOOK] });
+  } else if (force && local.baseline) {
+    if (!newSettings.hooks["SessionStart"]) newSettings.hooks["SessionStart"] = [];
+    newSettings.hooks["SessionStart"].push({ hooks: [VERITY_BASELINE_HOOK] });
+  }
   return { ok: true, data: newSettings };
 }
 function removeVerityHooks(settings) {
@@ -11106,6 +11512,7 @@ function reconcileMomentHooks(settings, moments, externalPresent = {
     (s.hooks[event] ??= []).push(group);
   };
   if (!externalPresent.intent) push("UserPromptSubmit", { hooks: [VERITY_INTENT_HOOK] });
+  push("SessionStart", { hooks: [VERITY_BASELINE_HOOK] });
   if (moments.includes("stop") && !externalPresent.stop) {
     push("Stop", { hooks: [VERITY_STOP_HOOK] });
   }
@@ -11154,7 +11561,7 @@ function registerHooksCommands(program2) {
       return;
     }
     const detail = await checkAllVerityHooksDetailed();
-    const present = { stop: detail.stop, intent: detail.intent };
+    const present = { stop: detail.stop, intent: detail.intent, baseline: detail.baseline };
     if (detail.legacyOnly) {
       printInfo("Found a legacy GATE.md hook \u2014 upgrading it to Verity...");
       const settings2 = removeVerityHooks(await readSettings());
@@ -11167,11 +11574,12 @@ function registerHooksCommands(program2) {
       printInfo("Verity hooks installed in .claude/settings.json (legacy hook removed)");
       printInfo("  Stop hook: verity analyze");
       printInfo("  UserPromptSubmit hook: verity intent capture");
+      printInfo("  SessionStart hook: verity baseline capture");
       return;
     }
     const settings = await readSettings();
     const hasLocalLegacy = settingsHasLegacyHook(settings);
-    if (!force && present.stop && present.intent && !hasLocalLegacy) {
+    if (!force && present.stop && present.intent && present.baseline && !hasLocalLegacy) {
       printInfo("Verity hooks already installed (found in .claude/settings.json, settings.local.json, or your global settings).");
       printInfo("Use --force to rewrite the project settings.json copy.");
       return;
@@ -11185,11 +11593,13 @@ function registerHooksCommands(program2) {
     printInfo("Verity hooks installed in .claude/settings.json");
     printInfo("  Stop hook: verity analyze");
     printInfo("  UserPromptSubmit hook: verity intent capture");
+    printInfo("  SessionStart hook: verity baseline capture");
   });
   hooks.command("check").description("Check if Verity hooks are installed").action(async () => {
     const status = await checkAllVerityHooks();
     printInfo(`Stop hook (verity analyze): ${status.stop ? "installed" : "not installed"}`);
     printInfo(`Intent hook (verity intent capture): ${status.intent ? "installed" : "not installed"}`);
+    printInfo(`Baseline hook (verity baseline capture): ${status.baseline ? "installed" : "not installed"}`);
     const gates = status.guard ? status.guardOn.join(", ") : "none";
     printInfo(`Git-moment gate (verity guard): ${status.guard ? `installed [${gates}]` : "not installed"}`);
     if (!status.stop && !status.guard) {
@@ -11208,15 +11618,19 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs2 = require("node:fs");
-var import_node_child_process4 = require("node:child_process");
+var import_node_fs3 = require("node:fs");
+var import_node_child_process5 = require("node:child_process");
+var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
 }
+function bufferTmpPath() {
+  return `${CONVERSATION_BUFFER_FILE}.${process.pid}.${(0, import_node_crypto.randomBytes)(4).toString("hex")}.tmp`;
+}
 async function appendToConversationBuffer(prompt, sessionId) {
   try {
     await (0, import_promises5.mkdir)(VERITY_DIR, { recursive: true });
@@ -11236,26 +11650,39 @@ async function appendToConversationBuffer(prompt, sessionId) {
     recent.push(entry);
     const capped = recent.slice(-CONVERSATION_MAX_ENTRIES);
     const content = capped.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    const tmpFile = `${CONVERSATION_BUFFER_FILE}.tmp`;
+    const tmpFile = bufferTmpPath();
     await (0, import_promises5.writeFile)(tmpFile, content);
     await (0, import_promises5.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
   } catch {
   }
 }
-async function readAndClearConversationBuffer() {
+async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs2.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs3.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
-      await (0, import_promises5.unlink)(CONVERSATION_BUFFER_FILE).catch(() => {
-      });
-      if (entries.length > 0) {
+      let mine = entries;
+      let others = [];
+      if (currentSessionId) {
+        mine = entries.filter((e) => e.session_id === currentSessionId || !e.session_id);
+        others = entries.filter((e) => e.session_id && e.session_id !== currentSessionId);
+      }
+      if (others.length > 0) {
+        const remaining = others.map((e) => JSON.stringify(e)).join("\n") + "\n";
+        const tmpFile = bufferTmpPath();
+        await (0, import_promises5.writeFile)(tmpFile, remaining);
+        await (0, import_promises5.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
+      } else {
+        await (0, import_promises5.unlink)(CONVERSATION_BUFFER_FILE).catch(() => {
+        });
+      }
+      if (mine.length > 0) {
         return {
-          prompts: entries,
+          prompts: mine,
           recent_commits: getRecentCommitMessages()
         };
       }
     }
-    if ((0, import_node_fs2.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs3.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -11299,7 +11726,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process4.execSync)(
+    const output = (0, import_node_child_process5.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -11312,8 +11739,8 @@ function getRecentCommitMessages() {
 
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs3 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path5 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -11352,7 +11779,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs3.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs4.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -11386,12 +11813,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs3.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs4.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path4.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path5.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -11405,13 +11832,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path4.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path5.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs3.existsSync)(filePath)) {
+    if ((0, import_node_fs4.existsSync)(filePath)) {
       const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises6.readFile)(filePath, "utf-8");
@@ -11422,7 +11849,7 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs3.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
     await (0, import_promises6.writeFile)(filePath, existing + line);
   } catch {
   }
@@ -11430,8 +11857,8 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_fs4 = require("node:fs");
-var import_node_path5 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path6 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -11524,19 +11951,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  if (!(0, import_node_fs4.existsSync)(memoryDir())) return null;
+  if (!(0, import_node_fs5.existsSync)(memoryDir())) return null;
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path5.join)(memoryDir(), domain);
-    if (!(0, import_node_fs4.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path6.join)(memoryDir(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises7.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises7.readFile)((0, import_node_path5.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises7.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -11595,9 +12022,9 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 
 // src/lib/memory-sync.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs5 = require("node:fs");
-var import_node_path6 = require("node:path");
-var import_node_crypto = require("node:crypto");
+var import_node_fs6 = require("node:fs");
+var import_node_path7 = require("node:path");
+var import_node_crypto2 = require("node:crypto");
 
 // src/lib/glob-match.ts
 function globToRegex(glob) {
@@ -11667,35 +12094,35 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises8.mkdir)((0, import_node_path6.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises8.mkdir)((0, import_node_path7.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path6.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path7.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
-          const hash = (0, import_node_crypto.createHash)("sha256").update(content).digest("hex").slice(0, 16);
+          const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
         }
@@ -11705,32 +12132,32 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "index.md"), "utf-8");
-    indexHash = `sha256:${(0, import_node_crypto.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
+    const indexContent = await (0, import_promises8.readFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "utf-8");
+    indexHash = `sha256:${(0, import_node_crypto2.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises8.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
   return { schema_version: 1, nodes, index_hash: indexHash, log_length: logLength };
 }
 function hashContent(content) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
+  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises8.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -11776,8 +12203,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path6.join)(memoryDir2(), path);
-    if (!(0, import_node_fs5.existsSync)(full)) continue;
+    const full = (0, import_node_path7.join)(memoryDir2(), path);
+    if (!(0, import_node_fs6.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises8.readFile)(full, "utf-8");
@@ -11813,15 +12240,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs6.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises8.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path6.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path7.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -11831,7 +12258,7 @@ async function applyOneWrite(write, treePaths) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs5.existsSync)(fullPath)) {
+  if ((0, import_node_fs6.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises8.readFile)(fullPath, "utf-8");
@@ -11843,7 +12270,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises8.mkdir)((0, import_node_path6.dirname)(fullPath), { recursive: true });
+  await (0, import_promises8.mkdir)((0, import_node_path7.dirname)(fullPath), { recursive: true });
   await (0, import_promises8.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -11884,8 +12311,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -11895,7 +12322,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -11919,7 +12346,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path6.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path7.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
@@ -12001,9 +12428,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path6.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path7.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs5.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -12133,7 +12560,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/commands/intent.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 function registerIntentCommands(program2) {
   const intent = program2.command("intent").description("Manage intent capture");
   intent.command("capture").description("Capture user intent from stdin (used by UserPromptSubmit hook)").action(async () => {
@@ -12142,7 +12569,7 @@ function registerIntentCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs6.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs7.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       const chunks = [];
@@ -12205,7 +12632,7 @@ async function fireClassify(prompt, sessionId) {
     logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
     return;
   }
-  const promptHash = (0, import_node_crypto2.createHash)("sha256").update(prompt).digest("hex");
+  const promptHash = (0, import_node_crypto3.createHash)("sha256").update(prompt).digest("hex");
   const result = await apiRequest({
     method: "POST",
     path: "/classify-task",
@@ -12673,243 +13100,54 @@ function registerFeedbackCommand(program2) {
     if (!result.ok) {
       printError(`Couldn't submit finding feedback: ${result.error}`);
       process.exit(1);
-    }
-    const status = result.data.suppression_active ? "Suppression active \u2014 this pattern will be skipped in future runs for matching files." : "Feedback recorded.";
-    printInfo(status);
-  });
-  feedbackCmd.argument("[message]", "Feedback message (for backwards compat)").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
-    if (!message) return;
-    const globals = program2.opts();
-    await sendGeneralFeedback(message, opts, globals);
-  });
-}
-async function sendGeneralFeedback(message, opts, globals) {
-  const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    printError(tokenResult.error);
-    printInfo(`Your message: ${message}`);
-    process.exit(1);
-  }
-  const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    printError(urlResult.error);
-    printInfo(`Your message: ${message}`);
-    process.exit(1);
-  }
-  const body = { message };
-  const sessionId = opts.sessionId ?? process.env.CLAUDE_SESSION_ID;
-  const model = opts.model ?? process.env.CLAUDE_MODEL ?? "unknown";
-  if (sessionId) body.session_id = sessionId;
-  if (model) body.agent_model = model;
-  const result = await apiRequest({
-    method: "POST",
-    path: "/feedback",
-    serviceUrl: urlResult.data,
-    token: tokenResult.data.token,
-    body,
-    verbose: globals.verbose
-  });
-  if (!result.ok) {
-    printError(`Couldn't send feedback: ${result.error}`);
-    printInfo(`Your message: ${message}`);
-    process.exit(1);
-  }
-  printInfo("Thanks, feedback sent!");
-}
-
-// src/commands/analyze.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path13 = require("node:path");
-
-// src/lib/git.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_fs7 = require("node:fs");
-var import_node_path7 = require("node:path");
-function resolveFile(relpath) {
-  if ((0, import_node_fs7.existsSync)(relpath)) return relpath;
-  if ((0, import_node_fs7.existsSync)(".claude/worktrees")) {
-    try {
-      const entries = (0, import_node_fs7.readdirSync)(".claude/worktrees", { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const candidate = (0, import_node_path7.join)(".claude/worktrees", entry.name, relpath);
-        if ((0, import_node_fs7.existsSync)(candidate)) return candidate;
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function execGit(cmd) {
-  try {
-    return (0, import_node_child_process5.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function splitLines(s) {
-  return s.split("\n").filter((l) => l.length > 0);
-}
-var SHA_RE = /^[0-9a-f]{40}$/;
-function readBaselineSha() {
-  if (!(0, import_node_fs7.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs7.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
-    try {
-      (0, import_node_fs7.unlinkSync)(BASELINE_SHA_FILE);
-    } catch {
-    }
-    return null;
-  }
-  return sha;
-}
-function writeBaselineSha(sha) {
-  if (!SHA_RE.test(sha)) return;
-  try {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path7.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs7.writeFileSync)(BASELINE_SHA_FILE, sha);
-  } catch {
-  }
-}
-function getChangedFiles() {
-  const sets = /* @__PURE__ */ new Set();
-  let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
-    if (committed.length > 0) {
-      hasRecentCommitFiles = true;
-      for (const f of committed) sets.add(f);
-    }
-  } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
-    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
-    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
-      if (recentFiles.length > 0) {
-        hasRecentCommitFiles = true;
-        for (const f of recentFiles) sets.add(f);
-      }
-    }
-  }
-  for (const f of getWorktreeFiles()) sets.add(f);
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  return { files: filtered, hasRecentCommitFiles };
-}
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGit("git rev-parse --abbrev-ref HEAD");
-      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve of resolvers) {
-    const range = resolve();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
-function getWorktreeFiles() {
-  const result = [];
-  const worktreeDir = ".claude/worktrees";
-  if (!(0, import_node_fs7.existsSync)(worktreeDir)) return result;
-  try {
-    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
-    const entries = (0, import_node_fs7.readdirSync)(worktreeDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const wtDir = (0, import_node_path7.join)(worktreeDir, entry.name);
-      scanDir(wtDir, wtDir, fiveMinAgo, result);
-    }
-  } catch {
-  }
-  return result;
-}
-function scanDir(baseDir, dir, minMtime, result) {
-  try {
-    const entries = (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = (0, import_node_path7.join)(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".git") continue;
-        scanDir(baseDir, fullPath, minMtime, result);
-      } else if (entry.isFile()) {
-        const ext = (0, import_node_path7.extname)(entry.name).slice(1);
-        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
-        try {
-          const stat3 = (0, import_node_fs7.statSync)(fullPath);
-          if (stat3.mtimeMs >= minMtime) {
-            const relPath = fullPath.slice(baseDir.length + 1);
-            result.push(relPath);
-          }
-        } catch {
-        }
-      }
-    }
-  } catch {
-  }
-}
-function filterAnalyzable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path7.extname)(f).slice(1);
-    return ANALYZABLE_EXTENSIONS.has(ext);
+    }
+    const status = result.data.suppression_active ? "Suppression active \u2014 this pattern will be skipped in future runs for matching files." : "Feedback recorded.";
+    printInfo(status);
   });
-}
-function filterReviewable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path7.extname)(f).slice(1);
-    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
-    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename2 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
-    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
-    return false;
+  feedbackCmd.argument("[message]", "Feedback message (for backwards compat)").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
+    if (!message) return;
+    const globals = program2.opts();
+    await sendGeneralFeedback(message, opts, globals);
   });
 }
-function filterSecurity(files) {
-  return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
-  );
-}
-function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
-}
-function listTrackedFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set);
+async function sendGeneralFeedback(message, opts, globals) {
+  const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError(tokenResult.error);
+    printInfo(`Your message: ${message}`);
+    process.exit(1);
+  }
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!urlResult.ok) {
+    printError(urlResult.error);
+    printInfo(`Your message: ${message}`);
+    process.exit(1);
+  }
+  const body = { message };
+  const sessionId = opts.sessionId ?? process.env.CLAUDE_SESSION_ID;
+  const model = opts.model ?? process.env.CLAUDE_MODEL ?? "unknown";
+  if (sessionId) body.session_id = sessionId;
+  if (model) body.agent_model = model;
+  const result = await apiRequest({
+    method: "POST",
+    path: "/feedback",
+    serviceUrl: urlResult.data,
+    token: tokenResult.data.token,
+    body,
+    verbose: globals.verbose
+  });
+  if (!result.ok) {
+    printError(`Couldn't send feedback: ${result.error}`);
+    printInfo(`Your message: ${message}`);
+    process.exit(1);
+  }
+  printInfo("Thanks, feedback sent!");
 }
 
+// src/commands/analyze.ts
+var import_node_fs19 = require("node:fs");
+var import_node_path14 = require("node:path");
+
 // src/lib/files.ts
 var import_node_fs8 = require("node:fs");
 var import_node_path8 = require("node:path");
@@ -13042,11 +13280,16 @@ function collectCodeDelta(files, opts) {
 
 // src/lib/debounce.ts
 var import_node_fs9 = require("node:fs");
-var import_node_crypto3 = require("node:crypto");
-function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS) {
-  if (!(0, import_node_fs9.existsSync)(DEBOUNCE_FILE)) return null;
+var import_node_crypto4 = require("node:crypto");
+function scopedFile(base, sessionId) {
+  if (!sessionId) return base;
+  return `${base}.${(0, import_node_crypto4.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+}
+function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs9.existsSync)(file)) return null;
   try {
-    const lastTs = parseInt((0, import_node_fs9.readFileSync)(DEBOUNCE_FILE, "utf-8").trim(), 10);
+    const lastTs = parseInt((0, import_node_fs9.readFileSync)(file, "utf-8").trim(), 10);
     const nowTs = Math.floor(Date.now() / 1e3);
     const elapsed = nowTs - lastTs;
     if (elapsed < debounceSeconds) {
@@ -13056,12 +13299,13 @@ function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS) {
   }
   return null;
 }
-function checkMtime(files, bypassForRecentCommits) {
+function checkMtime(files, bypassForRecentCommits, sessionId) {
   if (bypassForRecentCommits) return null;
-  if (!(0, import_node_fs9.existsSync)(DEBOUNCE_FILE)) return null;
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs9.existsSync)(file)) return null;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs9.statSync)(DEBOUNCE_FILE).mtimeMs;
+    debounceTime = (0, import_node_fs9.statSync)(file).mtimeMs;
   } catch {
     return null;
   }
@@ -13080,7 +13324,7 @@ function checkMtime(files, bypassForRecentCommits) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto3.createHash)("sha1");
+  const hash = (0, import_node_crypto4.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
@@ -13093,11 +13337,12 @@ function computeContentHash(files) {
   }
   return hash.digest("hex");
 }
-function checkContentHash(files) {
+function checkContentHash(files, sessionId) {
   const hash = computeContentHash(files);
-  if ((0, import_node_fs9.existsSync)(HASH_FILE)) {
+  const file = scopedFile(HASH_FILE, sessionId);
+  if ((0, import_node_fs9.existsSync)(file)) {
     try {
-      const storedHash = (0, import_node_fs9.readFileSync)(HASH_FILE, "utf-8").trim();
+      const storedHash = (0, import_node_fs9.readFileSync)(file, "utf-8").trim();
       if (hash === storedHash) {
         return { skip: "No source changes since last analysis", hash };
       }
@@ -13106,18 +13351,19 @@ function checkContentHash(files) {
   }
   return { skip: null, hash };
 }
-function recordAnalysisStart() {
+function recordAnalysisStart(sessionId) {
   (0, import_node_fs9.mkdirSync)(VERITY_DIR, { recursive: true });
-  (0, import_node_fs9.writeFileSync)(DEBOUNCE_FILE, String(Math.floor(Date.now() / 1e3)));
+  (0, import_node_fs9.writeFileSync)(scopedFile(DEBOUNCE_FILE, sessionId), String(Math.floor(Date.now() / 1e3)));
 }
-function recordPassHash(hash) {
-  (0, import_node_fs9.writeFileSync)(HASH_FILE, hash);
+function recordPassHash(hash, sessionId) {
+  (0, import_node_fs9.writeFileSync)(scopedFile(HASH_FILE, sessionId), hash);
 }
-function narrowToRecent(files) {
-  if (!(0, import_node_fs9.existsSync)(DEBOUNCE_FILE)) return files;
+function narrowToRecent(files, sessionId) {
+  const file = scopedFile(DEBOUNCE_FILE, sessionId);
+  if (!(0, import_node_fs9.existsSync)(file)) return files;
   let debounceTime;
   try {
-    debounceTime = (0, import_node_fs9.statSync)(DEBOUNCE_FILE).mtimeMs;
+    debounceTime = (0, import_node_fs9.statSync)(file).mtimeMs;
   } catch {
     return files;
   }
@@ -13463,15 +13709,207 @@ function cleanStaleSnapshots(dir, keepSet) {
   }
 }
 
-// src/lib/offline.ts
+// src/lib/baseline.ts
 var import_node_fs13 = require("node:fs");
-var import_node_crypto4 = require("node:crypto");
+var import_node_path11 = require("node:path");
+var import_node_crypto5 = require("node:crypto");
+var BASELINE_VERSION = 1;
+var BASELINE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
+var DEFAULT_SESSION_KEY = "_default";
+function sessionKey(sessionId) {
+  if (!sessionId) return DEFAULT_SESSION_KEY;
+  return (0, import_node_crypto5.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+}
+function sessionDir(key) {
+  return (0, import_node_path11.join)(projectPath(BASELINE_DIR), key);
+}
+function manifestPath(dir) {
+  return (0, import_node_path11.join)(dir, "manifest.json");
+}
+function mirrorPath(dir, repoRelPath) {
+  return (0, import_node_path11.join)(dir, "files", repoRelPath);
+}
+function captureBaseline(opts = {}) {
+  const key = sessionKey(opts.sessionId);
+  const dir = sessionDir(key);
+  const existing = readManifest(dir);
+  const freshStart = opts.source === "startup" || opts.source === "clear";
+  if (existing && !freshStart) {
+    return { baseline: existing, created: false };
+  }
+  const head_sha = getCurrentCommit();
+  const dirty = getDirtyFiles();
+  try {
+    (0, import_node_fs13.rmSync)(dir, { recursive: true, force: true });
+  } catch {
+  }
+  const filesDir = (0, import_node_path11.join)(dir, "files");
+  const mirrored = [];
+  try {
+    (0, import_node_fs13.mkdirSync)(filesDir, { recursive: true });
+    for (const p of dirty) {
+      if (p.includes("..")) continue;
+      const content = safeReadForMirror(projectPath(p));
+      if (content === null) continue;
+      const dest = mirrorPath(dir, p);
+      try {
+        (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(dest), { recursive: true });
+        (0, import_node_fs13.writeFileSync)(dest, content);
+        mirrored.push(p);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  const baseline = {
+    session_id: opts.sessionId ?? "",
+    head_sha,
+    captured_at: Date.now(),
+    dirty_paths: mirrored,
+    version: BASELINE_VERSION
+  };
+  try {
+    (0, import_node_fs13.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs13.writeFileSync)(manifestPath(dir), JSON.stringify(baseline));
+  } catch {
+  }
+  pruneOldBaselines();
+  return { baseline, created: true };
+}
+function readBaseline(sessionId) {
+  return readManifest(sessionDir(sessionKey(sessionId)));
+}
+function readManifest(dir) {
+  const mp = manifestPath(dir);
+  if (!(0, import_node_fs13.existsSync)(mp)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(mp, "utf-8"));
+    if (typeof parsed.head_sha !== "string" || typeof parsed.captured_at !== "number" || !Array.isArray(parsed.dirty_paths) || parsed.version !== BASELINE_VERSION) {
+      return null;
+    }
+    return {
+      session_id: typeof parsed.session_id === "string" ? parsed.session_id : "",
+      head_sha: parsed.head_sha,
+      captured_at: parsed.captured_at,
+      dirty_paths: parsed.dirty_paths.filter((p) => typeof p === "string"),
+      version: parsed.version
+    };
+  } catch {
+    return null;
+  }
+}
+var preImageCache = /* @__PURE__ */ new WeakMap();
+function preImage(repoRelPath, baseline) {
+  let perBaseline = preImageCache.get(baseline);
+  if (!perBaseline) {
+    perBaseline = /* @__PURE__ */ new Map();
+    preImageCache.set(baseline, perBaseline);
+  }
+  const cached = perBaseline.get(repoRelPath);
+  if (cached) return cached;
+  const resolved = resolvePreImage(repoRelPath, baseline);
+  perBaseline.set(repoRelPath, resolved);
+  return resolved;
+}
+function resolvePreImage(repoRelPath, baseline) {
+  if (baseline.dirty_paths.includes(repoRelPath)) {
+    const mp = mirrorPath(sessionDir(sessionKey(baseline.session_id)), repoRelPath);
+    if ((0, import_node_fs13.existsSync)(mp)) {
+      try {
+        return { content: (0, import_node_fs13.readFileSync)(mp, "utf-8"), existed: true };
+      } catch {
+      }
+    }
+  }
+  const atHead = showContentAtRef(baseline.head_sha, repoRelPath);
+  if (atHead !== null) return { content: atHead, existed: true };
+  return { content: "", existed: false };
+}
+function generateBaselineDiffs(files, baseline) {
+  if (!baseline) return { diffs: [], has_baseline: false };
+  const diffs = [];
+  for (const file of files) {
+    const language = file.language ?? detectLanguage(file.path);
+    const pre = preImage(file.path, baseline);
+    if (pre.existed) {
+      if (pre.content === file.content) continue;
+      const diff = computeDiff(pre.content, file.content, file.path);
+      if (diff) diffs.push({ path: file.path, language, diff, status: "modified" });
+    } else {
+      const addedLines = file.content.split("\n").map((l) => `+${l}`).join("\n");
+      diffs.push({
+        path: file.path,
+        language,
+        diff: `--- /dev/null
++++ b/${file.path}
+@@ -0,0 +1,${file.content.split("\n").length} @@
+${addedLines}`,
+        status: "added"
+      });
+    }
+  }
+  return { diffs, has_baseline: true };
+}
+function changedSinceBaseline(repoRelPath, baseline) {
+  const pre = preImage(repoRelPath, baseline);
+  let current;
+  try {
+    current = (0, import_node_fs13.readFileSync)(projectPath(repoRelPath), "utf-8");
+  } catch {
+    return pre.existed;
+  }
+  if (!pre.existed) return true;
+  return current !== pre.content;
+}
+function safeReadForMirror(absPath) {
+  try {
+    if ((0, import_node_fs13.statSync)(absPath).size > MIRROR_MAX_BYTES) return null;
+    const buf = (0, import_node_fs13.readFileSync)(absPath);
+    if (buf.includes(0)) return null;
+    return buf.toString("utf-8");
+  } catch {
+    return null;
+  }
+}
+function pruneOldBaselines() {
+  const root = projectPath(BASELINE_DIR);
+  let entries;
+  try {
+    entries = (0, import_node_fs13.readdirSync)(root);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const name of entries) {
+    const dir = (0, import_node_path11.join)(root, name);
+    const manifest = readManifest(dir);
+    if (!manifest) {
+      try {
+        if (now - (0, import_node_fs13.statSync)(dir).mtimeMs > BASELINE_TTL_MS) {
+          (0, import_node_fs13.rmSync)(dir, { recursive: true, force: true });
+        }
+      } catch {
+      }
+      continue;
+    }
+    if (now - manifest.captured_at <= BASELINE_TTL_MS) continue;
+    try {
+      (0, import_node_fs13.rmSync)(dir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+
+// src/lib/offline.ts
+var import_node_fs14 = require("node:fs");
+var import_node_crypto6 = require("node:crypto");
 function cacheRequest(body) {
   try {
-    (0, import_node_fs13.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto4.randomBytes)(4).toString("hex");
+    (0, import_node_fs14.mkdirSync)(CACHE_DIR, { recursive: true });
+    const suffix = (0, import_node_crypto6.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs13.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(body));
+    (0, import_node_fs14.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(body));
   } catch {
   }
 }
@@ -13485,7 +13923,7 @@ function buildOfflineFallback(reason, staticResults) {
 }
 
 // src/lib/context-files.ts
-var import_node_fs14 = require("node:fs");
+var import_node_fs15 = require("node:fs");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
 var MAX_CONTEXT_TOTAL_BYTES = 51200;
@@ -13497,7 +13935,7 @@ function gatherContextFiles(contextPaths, deltaFiles) {
     if (result.length >= MAX_CONTEXT_FILES) break;
     if (deltaPaths.has(filePath)) continue;
     try {
-      const content = (0, import_node_fs14.readFileSync)(filePath, "utf8");
+      const content = (0, import_node_fs15.readFileSync)(filePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -13542,20 +13980,20 @@ function gatherContextFiles(contextPaths, deltaFiles) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path12 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs15.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs16.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path11.join)(dir, entry);
+      const path = (0, import_node_path12.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs15.statSync)(path);
+        const stat3 = (0, import_node_fs16.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs15.unlinkSync)(path);
+          (0, import_node_fs16.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -13627,10 +14065,11 @@ function reconcileAnalysisMode(predictedMode, signals) {
       signals.noFilesChanged,
       signals.assistantResponse,
       signals.conversationPrompts,
-      signals.actionSummary
+      signals.actionSummary,
+      signals.sessionAuthoredCode
     );
   }
-  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0));
+  const agentAuthoredCode = !!(signals.actionSummary && (signals.actionSummary.files_edited.length > 0 || signals.actionSummary.files_created.length > 0)) || !!signals.sessionAuthoredCode;
   const agentInvestigated = didAgentInvestigate(signals.actionSummary);
   switch (predictedMode) {
     case "skip":
@@ -13655,8 +14094,8 @@ function didAgentInvestigate(summary) {
 function isValidMode(mode) {
   return mode === "standard" || mode === "plan" || mode === "debug" || mode === "skip";
 }
-function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary) {
-  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0));
+function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPrompts, actionSummary, sessionAuthoredCode) {
+  const agentAuthoredCode = !!(actionSummary && (actionSummary.files_edited.length > 0 || actionSummary.files_created.length > 0)) || !!sessionAuthoredCode;
   if (conversationPrompts.length > 0 && conversationPrompts.every(isGitOnlyPrompt)) {
     if (!agentAuthoredCode) return "skip";
   }
@@ -13736,7 +14175,7 @@ function isMetaTaskLabel(label2) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs16 = require("node:fs");
+var import_node_fs17 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -13758,14 +14197,14 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs16.statSync)(transcriptPath).size;
+    size = (0, import_node_fs17.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
   if (size === 0) return null;
   let raw;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs16.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs17.readFileSync)(transcriptPath, "utf-8");
   } else {
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
     const fd = require("node:fs").openSync(transcriptPath, "r");
@@ -13853,6 +14292,12 @@ function buildSummary(lines) {
         case "Edit":
           addPath(filesEdited, input.file_path);
           break;
+        case "MultiEdit":
+          addPath(filesEdited, input.file_path);
+          break;
+        case "NotebookEdit":
+          addPath(filesEdited, input.notebook_path ?? input.file_path);
+          break;
         case "Write":
           addPath(filesCreated, input.file_path);
           addPath(filesEdited, input.file_path);
@@ -13936,8 +14381,8 @@ function capArray(set, max) {
 
 // src/lib/seed-runner.ts
 var import_promises11 = require("node:fs/promises");
-var import_node_fs17 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path13 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -14176,7 +14621,7 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs17.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs18.existsSync)(STANDARD_FILE)) {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
@@ -14188,7 +14633,7 @@ async function runSeed(opts) {
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs17.existsSync)("README.md")) {
+  if ((0, import_node_fs18.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises11.readFile)("README.md", "utf-8");
     } catch {
@@ -14196,7 +14641,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs17.existsSync)(p)) {
+    if ((0, import_node_fs18.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises11.readFile)(p, "utf-8");
         break;
@@ -14219,8 +14664,8 @@ async function runSeed(opts) {
   if (candidates.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path12.join)(MEMORY_DIR, "domain", "project-overview.md");
-  if ((0, import_node_fs17.existsSync)(overviewPath) && !opts.force) {
+  const overviewPath = (0, import_node_path13.join)(MEMORY_DIR, "domain", "project-overview.md");
+  if ((0, import_node_fs18.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
   if (opts.dryRun) {
@@ -14255,9 +14700,9 @@ async function runSeed(opts) {
     }
     const nodeId = res.data.node_id;
     const filePathRel = res.data.file_path;
-    const targetPath = (0, import_node_path12.join)(MEMORY_DIR, filePathRel);
+    const targetPath = (0, import_node_path13.join)(MEMORY_DIR, filePathRel);
     try {
-      await (0, import_promises11.mkdir)((0, import_node_path12.dirname)(targetPath), { recursive: true });
+      await (0, import_promises11.mkdir)((0, import_node_path13.dirname)(targetPath), { recursive: true });
       await (0, import_promises11.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
@@ -14310,6 +14755,27 @@ function passAndExit(reason) {
   printJsonCompact({ gate_decision: "PASS", systemMessage: `Verity: ${reason}` });
   process.exit(0);
 }
+var EMPTY_STATIC = {
+  tool: "@codacy/analysis-cli",
+  findings: [],
+  summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+};
+function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
+  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
+  let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
+  if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
+  if (scannable.length === 0) return EMPTY_STATIC;
+  return runCodacyAnalysis(scannable);
+}
+function localOnlyAndExit(staticResults) {
+  printJsonCompact({
+    gate_decision: "PASS",
+    systemMessage: "Verity: not authenticated \u2014 ran a local static-only check (no deep review, no upload). Run `verity init` to authenticate and enable the full quality gate.",
+    unauthenticated: true,
+    static_results: staticResults
+  });
+  process.exit(0);
+}
 function registerAnalyzeCommand(program2) {
   program2.command("analyze").description("Run Verity analysis on changed files (stop hook)").option("--debounce <seconds>", "Skip if last analysis was within N seconds", "30").option("--max-iterations <n>", "Force PASS after N FAIL cycles", "2").option("--max-files <n>", "Max files to send for review", "20").option("--max-file-size <bytes>", "Skip files larger than N bytes", "51200").option("--max-total-size <bytes>", "Stop collecting files at N total bytes", "194560").option("--skip-static", "Skip codacy-analysis").option("--mode <mode>", "Force analysis mode (standard|plan|debug|skip)").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -14327,6 +14793,15 @@ async function runAnalyze(opts, globals) {
   }
   const { assistantMessage: assistantResponse, stopReason, transcriptPath, sessionId } = await readStopHookStdin();
   const actionSummary = transcriptPath ? await extractActionSummary(transcriptPath) : null;
+  const baselineSessionId = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+  const baseline = readBaseline(baselineSessionId);
+  if (baseline) {
+    logEvent("baseline_loaded", {
+      head: baseline.head_sha.slice(0, 12),
+      dirty_count: baseline.dirty_paths.length,
+      age_ms: Date.now() - baseline.captured_at
+    });
+  }
   const { files: allChanged, hasRecentCommitFiles } = getChangedFiles();
   const analyzable = filterAnalyzable(allChanged);
   const reviewable = filterReviewable(allChanged);
@@ -14336,7 +14811,7 @@ async function runAnalyze(opts, globals) {
     passAndExit("No analyzable files changed");
   }
   const allForReview = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable]));
-  const conversation = await readAndClearConversationBuffer();
+  const conversation = await readAndClearConversationBuffer(sessionId ?? void 0);
   const specs = discoverSpecs();
   const plans = discoverPlans();
   const latestPrompt = conversation?.prompts?.[conversation.prompts.length - 1]?.prompt ?? "";
@@ -14351,12 +14826,9 @@ async function runAnalyze(opts, globals) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
   }
   const sessionIdForMemory = sessionId || process.env.CLAUDE_SESSION_ID || "";
   let contextFilePaths = [];
@@ -14386,13 +14858,14 @@ async function runAnalyze(opts, globals) {
   }
   const conversationPrompts = (conversation?.prompts ?? []).map((p) => p.prompt);
   let analysisMode;
+  const sessionAuthoredCode = !!baseline && allForReview.some((f) => changedSinceBaseline(f, baseline));
   const modeOverride = opts.mode;
   if (modeOverride && ["standard", "plan", "debug", "skip"].includes(modeOverride)) {
     analysisMode = modeOverride;
   } else {
     analysisMode = reconcileAnalysisMode(
       predictedMode,
-      { noFilesChanged, assistantResponse, actionSummary, conversationPrompts }
+      { noFilesChanged, assistantResponse, actionSummary, conversationPrompts, sessionAuthoredCode }
     );
   }
   if (analysisMode === "skip") {
@@ -14414,7 +14887,7 @@ async function runAnalyze(opts, globals) {
   let currentCommit = "";
   if (analysisMode !== "plan") {
     const debounceSeconds = parseInt(opts.debounce, 10);
-    const debounceSkip = checkDebounce(debounceSeconds);
+    const debounceSkip = checkDebounce(debounceSeconds, baselineSessionId);
     if (debounceSkip) {
       if (assistantResponse) {
         analysisMode = "plan";
@@ -14424,7 +14897,7 @@ async function runAnalyze(opts, globals) {
     }
     if (analysisMode !== "plan") {
       const allCheckable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable, ...securityFiles]));
-      const mtimeSkip = checkMtime(allCheckable, hasRecentCommitFiles);
+      const mtimeSkip = checkMtime(allCheckable, hasRecentCommitFiles, baselineSessionId);
       if (mtimeSkip) {
         if (assistantResponse) {
           analysisMode = "plan";
@@ -14434,9 +14907,9 @@ async function runAnalyze(opts, globals) {
       }
     }
     if (analysisMode !== "plan") {
-      recordAnalysisStart();
+      recordAnalysisStart(baselineSessionId);
       const allCheckable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable, ...securityFiles]));
-      const hashResult = checkContentHash(allCheckable);
+      const hashResult = checkContentHash(allCheckable, baselineSessionId);
       if (hashResult.skip) {
         if (assistantResponse) {
           analysisMode = "plan";
@@ -14448,12 +14921,18 @@ async function runAnalyze(opts, globals) {
       if (analysisMode !== "plan") {
         const agentNarrowed = narrowToAgentAuthored(allForReview, actionSummary);
         const baseForReview = agentNarrowed.length > 0 ? agentNarrowed : allForReview;
-        const recentForReview = narrowToRecent(baseForReview);
+        const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
         if (!opts.skipStatic && isCodacyAvailable()) {
-          const allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
-          staticResults = runCodacyAnalysis(allScannable);
+          let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
+          if (baseline) {
+            allScannable = allScannable.filter((f) => changedSinceBaseline(f, baseline));
+          }
+          if (allScannable.length > 0) {
+            staticResults = runCodacyAnalysis(allScannable);
+          }
         }
-        codeDelta = collectCodeDelta(recentForReview, {
+        const deltaSet = baseline ? recentForReview.filter((f) => changedSinceBaseline(f, baseline)) : recentForReview;
+        codeDelta = collectCodeDelta(deltaSet, {
           maxFiles: parseInt(opts.maxFiles, 10),
           maxFileBytes: parseInt(opts.maxFileSize, 10),
           maxTotalBytes: parseInt(opts.maxTotalSize, 10)
@@ -14468,7 +14947,12 @@ async function runAnalyze(opts, globals) {
       }
     }
     if (analysisMode !== "plan") {
-      snapshotResult = generateSnapshotDiffs(codeDelta.files);
+      if (baseline) {
+        const baselineDiffs = generateBaselineDiffs(codeDelta.files, baseline);
+        snapshotResult = { has_snapshots: baselineDiffs.diffs.length > 0, diffs: baselineDiffs.diffs };
+      } else {
+        snapshotResult = generateSnapshotDiffs(codeDelta.files);
+      }
       currentCommit = getCurrentCommit();
       const maxIterations = parseInt(opts.maxIterations, 10);
       const iterResult = checkMaxIterations(currentCommit, maxIterations, contentHash ?? void 0);
@@ -14500,9 +14984,9 @@ async function runAnalyze(opts, globals) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path13.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs18.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs18.existsSync)(seedMarker);
+    const seedMarker = (0, import_node_path14.join)(VERITY_DIR, ".seeded");
+    const hasStandard = (0, import_node_fs19.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs19.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -14515,7 +14999,7 @@ async function runAnalyze(opts, globals) {
             dryRun: false
           });
           if (seedResult.created > 0) {
-            (0, import_node_fs18.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
+            (0, import_node_fs19.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created}
 `);
             autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
             logEvent("auto_seed_ran", {
@@ -14523,7 +15007,7 @@ async function runAnalyze(opts, globals) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs18.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs19.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -14812,7 +15296,7 @@ async function runAnalyze(opts, globals) {
     }
     case "PASS": {
       writeIteration(1, currentCommit, contentHash ?? void 0);
-      if (contentHash) recordPassHash(contentHash);
+      if (contentHash) recordPassHash(contentHash, baselineSessionId);
       if (currentCommit && currentCommit !== "no-git") writeBaselineSha(currentCommit);
       let userSummary = response.user_summary ?? "Verity: PASS";
       const viewUrl = response.view_url ?? "";
@@ -14823,7 +15307,7 @@ async function runAnalyze(opts, globals) {
       break;
     }
     case "WARN": {
-      if (contentHash) recordPassHash(contentHash);
+      if (contentHash) recordPassHash(contentHash, baselineSessionId);
       if (currentCommit && currentCommit !== "no-git") writeBaselineSha(currentCommit);
       let userSummary = response.user_summary ?? "Verity: WARN";
       const viewUrl = response.view_url ?? "";
@@ -14841,8 +15325,54 @@ async function runAnalyze(opts, globals) {
   }
 }
 
+// src/commands/baseline.ts
+var import_node_fs20 = require("node:fs");
+function registerBaselineCommands(program2) {
+  const baseline = program2.command("baseline").description("Manage the task-start working-tree baseline");
+  baseline.command("capture").description("Snapshot the working tree at task start (used by SessionStart hook)").option("--session-id <id>", "Session id (overrides any value from stdin)").option("--source <source>", "Lifecycle hint: startup|resume|clear|compact").action(async (opts) => {
+    try {
+      try {
+        process.chdir(repoRoot());
+      } catch {
+      }
+      if (!(0, import_node_fs20.existsSync)(VERITY_DIR)) {
+        process.exit(0);
+      }
+      let sessionId = opts.sessionId;
+      let source = opts.source;
+      if (!process.stdin.isTTY) {
+        const input = (await readStdin()).trim();
+        if (input) {
+          try {
+            const event = JSON.parse(input);
+            sessionId = sessionId ?? event.session_id;
+            source = source ?? event.source;
+          } catch {
+          }
+        }
+      }
+      const result = captureBaseline({ sessionId, source });
+      logEvent("baseline_capture", {
+        created: result.created,
+        source: source ?? null,
+        dirty_count: result.baseline.dirty_paths.length,
+        head: result.baseline.head_sha.slice(0, 12)
+      });
+    } catch {
+    }
+    process.exit(0);
+  });
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+
 // src/commands/review.ts
-var import_node_fs19 = require("node:fs");
+var import_node_fs21 = require("node:fs");
 function registerReviewCommand(program2) {
   program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -14861,7 +15391,7 @@ async function runReview(opts, globals) {
   const securityFiles = filterSecurity(allFiles);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs19.existsSync)(f) || resolveFile(f) !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs21.existsSync)(f) || resolveFile(f) !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = {
@@ -14872,13 +15402,14 @@ async function runReview(opts, globals) {
   }
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-    process.exit(0);
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    printJsonCompact({
+      gate_decision: "PASS",
+      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      unauthenticated: true,
+      static_results: staticResults
+    });
     process.exit(0);
   }
   let specs;
@@ -14886,10 +15417,10 @@ async function runReview(opts, globals) {
     const specPaths = opts.specs.split(",").map((f) => f.trim()).filter(Boolean);
     specs = [];
     for (const p of specPaths) {
-      if (!(0, import_node_fs19.existsSync)(p)) continue;
+      if (!(0, import_node_fs21.existsSync)(p)) continue;
       try {
-        const { readFileSync: readFileSync11 } = await import("node:fs");
-        const content = readFileSync11(p, "utf-8");
+        const { readFileSync: readFileSync12 } = await import("node:fs");
+        const content = readFileSync12(p, "utf-8");
         specs.push({ path: p, content: content.slice(0, 10240) });
       } catch {
       }
@@ -14946,10 +15477,10 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs20 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path15 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path14.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path15.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve) => {
@@ -15013,7 +15544,7 @@ function classifyCommand(command, on) {
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs20.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs22.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -15033,10 +15564,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs20.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs22.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs20.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs22.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -15046,10 +15577,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs20.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs20.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs22.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs22.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs20.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs20.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs22.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs22.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -15113,7 +15644,7 @@ function buildGuardRequest(moment, files, iter, sessionId, command) {
   const securityFiles = filterSecurity(files);
   let staticResults;
   if (isCodacyAvailable()) {
-    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs20.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+    const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs22.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
     staticResults = runCodacyAnalysis(scannable);
   } else {
     staticResults = { tool: "@codacy/analysis-cli", findings: [], summary: { total_findings: 0, by_severity: {}, tools_run: [] } };
@@ -15158,7 +15689,7 @@ function emitAllowNotice(userMsg, agentMsg) {
 async function runGuard(opts, globals) {
   const on = opts.on.split(",").map((s) => s.trim()).filter((s) => s === "commit" || s === "push");
   const { command, cwd, sessionId } = await readPreToolUseStdin();
-  if (cwd && (0, import_node_fs20.existsSync)(cwd)) {
+  if (cwd && (0, import_node_fs22.existsSync)(cwd)) {
     try {
       process.chdir(cwd);
     } catch {
@@ -15263,14 +15794,15 @@ function writeBlockMessage(moment, response) {
 }
 
 // src/commands/init.ts
-var import_node_fs22 = require("node:fs");
+var import_node_fs24 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
+var readline = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_path16 = require("node:path");
 var import_node_child_process8 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -15306,12 +15838,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path15.join)(root, ".gate");
-  const verityDir = (0, import_node_path15.join)(root, ".verity");
-  if ((0, import_node_fs21.existsSync)(gateDir) && !(0, import_node_fs21.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path16.join)(root, ".gate");
+  const verityDir = (0, import_node_path16.join)(root, ".verity");
+  if ((0, import_node_fs23.existsSync)(gateDir) && !(0, import_node_fs23.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs21.existsSync)(gateDir) && (0, import_node_fs21.existsSync)(verityDir)) {
+  if ((0, import_node_fs23.existsSync)(gateDir) && (0, import_node_fs23.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -15332,13 +15864,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs21.existsSync)(gateDir)) {
+    if ((0, import_node_fs23.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs21.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs23.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -15354,18 +15886,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs21.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs23.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path15.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path15.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs21.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs21.existsSync)(verityCreds)) {
-    (0, import_node_fs21.mkdirSync)((0, import_node_path15.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path16.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path16.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs23.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs23.existsSync)(verityCreds)) {
+    (0, import_node_fs23.mkdirSync)((0, import_node_path16.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -15387,8 +15919,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path15.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs21.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path16.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs23.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -15398,9 +15930,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path15.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path15.join)(root, "VERITY.md");
-  if (!(0, import_node_fs21.existsSync)(gateMd) || (0, import_node_fs21.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path16.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path16.join)(root, "VERITY.md");
+  if (!(0, import_node_fs23.existsSync)(gateMd) || (0, import_node_fs23.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -15412,7 +15944,7 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs21.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs23.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
@@ -15446,14 +15978,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs21.writeFileSync)(verityCreds, verityContent + sep + toAppend.join("\n") + "\n");
+    (0, import_node_fs23.writeFileSync)(verityCreds, verityContent + sep + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs21.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs23.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs21.readFileSync)(path, "utf-8");
+    return (0, import_node_fs23.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -15468,35 +16000,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs21.renameSync)(from, to);
+    (0, import_node_fs23.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs21.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs21.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs23.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs23.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs21.renameSync)(from, to);
+    (0, import_node_fs23.renameSync)(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    (0, import_node_fs21.cpSync)(from, to);
-    (0, import_node_fs21.rmSync)(from, { force: true });
+    (0, import_node_fs23.cpSync)(from, to);
+    (0, import_node_fs23.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
-    const srcDir = (0, import_node_path15.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs21.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path15.join)(relDir, entry) : entry;
-      const src = (0, import_node_path15.join)(gateDir, rel);
-      const dest = (0, import_node_path15.join)(verityDir, rel);
-      if ((0, import_node_fs21.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path16.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs23.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path16.join)(relDir, entry) : entry;
+      const src = (0, import_node_path16.join)(gateDir, rel);
+      const dest = (0, import_node_path16.join)(verityDir, rel);
+      if ((0, import_node_fs23.statSync)(src).isDirectory()) {
         walk(rel);
-      } else if (!(0, import_node_fs21.existsSync)(dest)) {
-        (0, import_node_fs21.mkdirSync)((0, import_node_path15.dirname)(dest), { recursive: true });
-        (0, import_node_fs21.cpSync)(src, dest);
+      } else if (!(0, import_node_fs23.existsSync)(dest)) {
+        (0, import_node_fs23.mkdirSync)((0, import_node_path16.dirname)(dest), { recursive: true });
+        (0, import_node_fs23.cpSync)(src, dest);
         copied++;
       }
     }
@@ -15505,22 +16037,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path15.join)(root, ".gate");
-  const verityDir = (0, import_node_path15.join)(root, ".verity");
-  if ((0, import_node_fs21.existsSync)(gateDir) && !(0, import_node_fs21.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs21.existsSync)(gateDir) && (0, import_node_fs21.existsSync)(verityDir)) {
-    if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(gateDir, "credentials")) && !(0, import_node_fs21.existsSync)((0, import_node_path15.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path16.join)(root, ".gate");
+  const verityDir = (0, import_node_path16.join)(root, ".verity");
+  if ((0, import_node_fs23.existsSync)(gateDir) && !(0, import_node_fs23.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs23.existsSync)(gateDir) && (0, import_node_fs23.existsSync)(verityDir)) {
+    if ((0, import_node_fs23.existsSync)((0, import_node_path16.join)(gateDir, "credentials")) && !(0, import_node_fs23.existsSync)((0, import_node_path16.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(gateDir, "memory")) && !(0, import_node_fs21.existsSync)((0, import_node_path15.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs23.existsSync)((0, import_node_path16.join)(gateDir, "memory")) && !(0, import_node_fs23.existsSync)((0, import_node_path16.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path15.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs21.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path16.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs23.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs21.existsSync)((0, import_node_path15.join)(root, "GATE.md")) && !(0, import_node_fs21.existsSync)((0, import_node_path15.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs23.existsSync)((0, import_node_path16.join)(root, "GATE.md")) && !(0, import_node_fs23.existsSync)((0, import_node_path16.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -15546,17 +16078,77 @@ function registerMigrateCommand(program2) {
 }
 
 // src/commands/init.ts
+async function promptYes(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runOptionalAuth() {
+  const existing = await resolveToken();
+  if (existing.ok) {
+    printInfo("Already authenticated \u2014 results will upload to the Verity service. \u2713");
+    return;
+  }
+  let remote = "";
+  try {
+    remote = (0, import_node_child_process9.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+  }
+  const localOnlyNote = () => {
+    printInfo("Verity runs in local-only mode: the gate still runs and shows static findings, but nothing uploads.");
+    printInfo('  Authenticate anytime: run "verity init" again, or "verity auth register".');
+  };
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    console.log("");
+    console.log("  Signing in is optional. What it does:");
+    console.log("    - Confirms you have write access to this repository. The GitHub token");
+    console.log("      is used once to verify that, then discarded \u2014 Verity never stores it.");
+    console.log("    - It does NOT give Verity access to your code. Code checked by the gate");
+    console.log("      is analyzed in memory and discarded \u2014 we never store your code.");
+    console.log("    - It is required to store and access run history for this repo");
+    console.log("      (past results, trends, and shareable reports).");
+    console.log("    - Skip and Verity still works fully locally: the gate runs and shows");
+    console.log("      findings, but nothing is uploaded.");
+    console.log("");
+  }
+  const wantsAuth = await promptYes("Authenticate with GitHub now to upload results to Verity? [Y/skip] ");
+  if (!wantsAuth) {
+    printInfo("Skipped authentication.");
+    localOnlyNote();
+    return;
+  }
+  if (!remote) {
+    printWarn("No git remote found \u2014 cannot authenticate yet.");
+    localOnlyNote();
+    return;
+  }
+  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path17.basename)(process.cwd());
+  printInfo("Authenticating with GitHub\u2026");
+  const result = await registerProject({ projectName, remote, serviceUrl: DEFAULT_SERVICE_URL });
+  if (result.ok) {
+    printInfo(`Project registered: ${result.data.projectId} \u2713`);
+    if (result.data.email) printInfo(`  Authenticated as: ${result.data.email}`);
+  } else {
+    printWarn(`Authentication did not complete: ${result.error}`);
+    localOnlyNote();
+  }
+}
 function resolveDataDir() {
   const candidates = [
-    (0, import_node_path16.join)(__dirname, "..", "data"),
+    (0, import_node_path17.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path16.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path17.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path16.join)(process.cwd(), "cli", "data")
+    (0, import_node_path17.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs22.existsSync)((0, import_node_path16.join)(candidate, "skills"))) {
+    if ((0, import_node_fs24.existsSync)((0, import_node_path17.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -15572,7 +16164,7 @@ function registerInitCommand(program2) {
   program2.command("init").description("Initialize Verity in the current project").option("--force", "Overwrite existing skills and hooks").action(async (opts) => {
     const force = opts.force ?? false;
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs22.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs24.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -15635,21 +16227,21 @@ function registerInitCommand(program2) {
     console.log("");
     printInfo("Installing skills...");
     const dataDir = resolveDataDir();
-    const skillsSource = (0, import_node_path16.join)(dataDir, "skills");
+    const skillsSource = (0, import_node_path17.join)(dataDir, "skills");
     const skillsDest = ".claude/skills";
     const skills = ["verity-setup", "verity-analyze", "verity-status", "verity-feedback", "verity-learn", "verity-memory", "verity-insights", "verity-reflect"];
     let skillsInstalled = 0;
     for (const skill of skills) {
-      const src = (0, import_node_path16.join)(skillsSource, skill);
-      const dest = (0, import_node_path16.join)(skillsDest, skill);
-      if (!(0, import_node_fs22.existsSync)(src)) {
+      const src = (0, import_node_path17.join)(skillsSource, skill);
+      const dest = (0, import_node_path17.join)(skillsDest, skill);
+      if (!(0, import_node_fs24.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
-      if ((0, import_node_fs22.existsSync)(dest) && !force) {
-        const srcSkill = (0, import_node_path16.join)(src, "SKILL.md");
-        const destSkill = (0, import_node_path16.join)(dest, "SKILL.md");
-        if ((0, import_node_fs22.existsSync)(destSkill)) {
+      if ((0, import_node_fs24.existsSync)(dest) && !force) {
+        const srcSkill = (0, import_node_path17.join)(src, "SKILL.md");
+        const destSkill = (0, import_node_path17.join)(dest, "SKILL.md");
+        if ((0, import_node_fs24.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises12.readFile)(srcSkill, "utf-8");
             const destContent = await (0, import_promises12.readFile)(destSkill, "utf-8");
@@ -15673,6 +16265,7 @@ function registerInitCommand(program2) {
       await writeSettings(hookResult.data);
       printInfo("  Stop hook: verity analyze \u2713");
       printInfo("  Intent hook: verity intent capture \u2713");
+      printInfo("  Baseline hook: verity baseline capture \u2713");
     } else {
       printWarn(`  ${hookResult.error}`);
       printInfo('  Run "verity hooks install --force" to overwrite.');
@@ -15685,9 +16278,15 @@ function registerInitCommand(program2) {
     } catch (err) {
       printWarn(`  Could not update CLAUDE.md: ${err.message}`);
     }
-    const globalVerityDir = (0, import_node_path16.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path17.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises12.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
+    try {
+      await runOptionalAuth();
+    } catch (err) {
+      printWarn(`Authentication step skipped: ${err.message}`);
+    }
+    console.log("");
     printInfo("Verity initialized!");
     console.log("");
     console.log("  Installed:");
@@ -15703,13 +16302,14 @@ function registerInitCommand(program2) {
     console.log("    .verity/memory/                  \u2014 knowledge base (8 domains, commit to git)");
     console.log("");
     console.log("  Next step: open this project in Claude Code and run /verity-setup");
+    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity auth register".)');
     console.log("");
   });
 }
 
 // src/commands/uninstall.ts
-var import_node_fs23 = require("node:fs");
-var import_node_path17 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_path18 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -15728,11 +16328,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path17.join)(skillsRoot, name);
-      if ((0, import_node_fs23.existsSync)(dir)) {
+      const dir = (0, import_node_path18.join)(skillsRoot, name);
+      if ((0, import_node_fs25.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
-          apply: () => (0, import_node_fs23.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs25.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -15746,24 +16346,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs23.existsSync)(verityDir)) {
+    if ((0, import_node_fs25.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs23.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs25.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs23.existsSync)(verityMd)) {
+      if ((0, import_node_fs25.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs23.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs25.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs23.existsSync)(path) && (0, import_node_fs23.statSync)(path).isDirectory() && (0, import_node_fs23.readdirSync)(path).length === 0) {
-        (0, import_node_fs23.rmdirSync)(path);
+      if ((0, import_node_fs25.existsSync)(path) && (0, import_node_fs25.statSync)(path).isDirectory() && (0, import_node_fs25.readdirSync)(path).length === 0) {
+        (0, import_node_fs25.rmdirSync)(path);
       }
     };
     actions.push({
@@ -15774,11 +16374,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path17.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs23.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path18.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs25.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs23.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs25.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -15972,8 +16572,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs24 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs26 = require("node:fs");
+var import_node_path19 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -16010,11 +16610,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs24.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs24.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs26.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs26.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs24.unlinkSync)((0, import_node_path18.join)(cacheDir, entry));
+            (0, import_node_fs26.unlinkSync)((0, import_node_path19.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -16029,19 +16629,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs24.existsSync)(file)) {
+      if ((0, import_node_fs26.existsSync)(file)) {
         try {
-          (0, import_node_fs24.writeFileSync)(file, "");
+          (0, import_node_fs26.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs24.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs24.readdirSync)(logsDir)) {
+      if ((0, import_node_fs26.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs26.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs24.unlinkSync)((0, import_node_path18.join)(logsDir, entry));
+            (0, import_node_fs26.unlinkSync)((0, import_node_path19.join)(logsDir, entry));
           } catch {
           }
         }
@@ -16300,7 +16900,7 @@ function registerRunCommand(program2) {
 
 // src/lib/telemetry.ts
 var import_promises13 = require("node:fs/promises");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var GITIGNORE_FILE = ".gitignore";
 var GITIGNORE_ENTRY = ".claude/settings.local.json";
@@ -16338,7 +16938,7 @@ async function readSettingsLocal() {
 }
 async function writeSettingsLocal(settings) {
   const file = projectPath(SETTINGS_LOCAL_FILE2);
-  await (0, import_promises13.mkdir)((0, import_node_path19.dirname)(file), { recursive: true });
+  await (0, import_promises13.mkdir)((0, import_node_path20.dirname)(file), { recursive: true });
   await (0, import_promises13.writeFile)(file, JSON.stringify(settings, null, 2) + "\n");
 }
 async function ensureGitignore() {
@@ -16434,7 +17034,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.24.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.25.0-experimental.56ef7d8").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);
@@ -16443,6 +17043,7 @@ registerConfigCommands(program);
 registerStatusCommand(program);
 registerFeedbackCommand(program);
 registerAnalyzeCommand(program);
+registerBaselineCommands(program);
 registerReviewCommand(program);
 registerGuardCommand(program);
 registerInitCommand(program);