@codacy/verity-cli 0.25.0-experimental.e3da48a → 0.25.0-experimental.ed0c319

package/bin/verity.js

@@ -10325,9 +10325,7 @@ var {
 } = import_index.default;
 
 // src/commands/auth.ts
-var import_promises3 = require("node:fs/promises");
 var import_node_child_process4 = require("node:child_process");
-var import_node_path3 = require("node:path");
 
 // src/lib/auth.ts
 var import_promises = require("node:fs/promises");
@@ -10748,6 +10746,10 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/register.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
+
 // src/lib/provider-auth.ts
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
@@ -11003,8 +11005,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path2.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename2 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
+    const basename3 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -11066,6 +11068,66 @@ function listTrackedFiles() {
   return Array.from(set);
 }
 
+// src/lib/register.ts
+async function registerProject(opts) {
+  const parsed = parseRemote(opts.remote);
+  if (!parsed) {
+    return { ok: false, error: `Could not parse git remote: ${opts.remote}` };
+  }
+  if (parsed.provider !== "github") {
+    return { ok: false, error: `Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.` };
+  }
+  const providerAuth = await githubDeviceFlow();
+  if (!providerAuth.ok) {
+    return { ok: false, error: providerAuth.error };
+  }
+  const providerToken = providerAuth.data;
+  const result = await apiRequest({
+    method: "POST",
+    path: "/auth/register",
+    serviceUrl: opts.serviceUrl,
+    body: { project_name: opts.projectName, git_remote_url: opts.remote },
+    extraHeaders: { "X-Provider-Token": providerToken },
+    verbose: opts.verbose
+  });
+  if (!result.ok) {
+    return { ok: false, error: result.error };
+  }
+  const { project_id, token, service_url, user } = result.data;
+  try {
+    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises3.writeFile)(
+      CREDENTIALS_FILE,
+      `token: ${token}
+service_url: ${service_url}
+provider_token: ${providerToken}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Registered with the Verity service, but could not save credentials to ${CREDENTIALS_FILE}: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
+    };
+  }
+  try {
+    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
+    await (0, import_promises3.appendFile)(
+      GLOBAL_CREDENTIALS_FILE,
+      `${opts.remote} token: ${token}
+${opts.remote} provider_token: ${providerToken}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch {
+  }
+  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email: user?.email } };
+}
+
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage project authentication");
@@ -11081,60 +11143,20 @@ function registerAuthCommands(program2) {
         process.exit(1);
       }
     }
-    const parsed = parseRemote(remote);
-    if (!parsed) {
-      printError(`Could not parse git remote: ${remote}`);
-      process.exit(1);
-    }
-    if (parsed.provider !== "github") {
-      printError(`Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.`);
-      process.exit(1);
-    }
-    const providerAuth = await githubDeviceFlow();
-    if (!providerAuth.ok) {
-      printError(providerAuth.error);
-      process.exit(1);
-    }
-    const providerToken = providerAuth.data;
-    const result = await apiRequest({
-      method: "POST",
-      path: "/auth/register",
+    const result = await registerProject({
+      projectName: opts.project,
+      remote,
       serviceUrl,
-      body: { project_name: opts.project, git_remote_url: remote },
-      extraHeaders: { "X-Provider-Token": providerToken },
       verbose: globals.verbose
     });
     if (!result.ok) {
       printError(result.error);
       process.exit(1);
     }
-    const { project_id, token, service_url, user } = result.data;
-    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(
-      CREDENTIALS_FILE,
-      `token: ${token}
-service_url: ${service_url}
-provider_token: ${providerToken}
-`,
-      { mode: 384 }
-    );
-    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
-    });
-    try {
-      await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-      await (0, import_promises3.appendFile)(
-        GLOBAL_CREDENTIALS_FILE,
-        `${remote} token: ${token}
-${remote} provider_token: ${providerToken}
-`
-      );
-      await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
-      });
-    } catch {
-    }
-    printInfo(`Project registered: ${project_id}`);
-    if (user?.email) printInfo(`Authenticated as: ${user.email}`);
-    printJson({ project_id, service_url });
+    const { projectId, serviceUrl: resolvedUrl, email } = result.data;
+    printInfo(`Project registered: ${projectId}`);
+    if (email) printInfo(`Authenticated as: ${email}`);
+    printJson({ project_id: projectId, service_url: resolvedUrl });
   });
   auth.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
@@ -14733,6 +14755,27 @@ function passAndExit(reason) {
   printJsonCompact({ gate_decision: "PASS", systemMessage: `Verity: ${reason}` });
   process.exit(0);
 }
+var EMPTY_STATIC = {
+  tool: "@codacy/analysis-cli",
+  findings: [],
+  summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+};
+function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
+  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
+  let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
+  if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
+  if (scannable.length === 0) return EMPTY_STATIC;
+  return runCodacyAnalysis(scannable);
+}
+function localOnlyAndExit(staticResults) {
+  printJsonCompact({
+    gate_decision: "PASS",
+    systemMessage: "Verity: not authenticated \u2014 ran a local static-only check (no deep review, no upload). Run `verity init` to authenticate and enable the full quality gate.",
+    unauthenticated: true,
+    static_results: staticResults
+  });
+  process.exit(0);
+}
 function registerAnalyzeCommand(program2) {
   program2.command("analyze").description("Run Verity analysis on changed files (stop hook)").option("--debounce <seconds>", "Skip if last analysis was within N seconds", "30").option("--max-iterations <n>", "Force PASS after N FAIL cycles", "2").option("--max-files <n>", "Max files to send for review", "20").option("--max-file-size <bytes>", "Skip files larger than N bytes", "51200").option("--max-total-size <bytes>", "Stop collecting files at N total bytes", "194560").option("--skip-static", "Skip codacy-analysis").option("--mode <mode>", "Force analysis mode (standard|plan|debug|skip)").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -14783,12 +14826,9 @@ async function runAnalyze(opts, globals) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
   }
   const sessionIdForMemory = sessionId || process.env.CLAUDE_SESSION_ID || "";
   let contextFilePaths = [];
@@ -15362,13 +15402,14 @@ async function runReview(opts, globals) {
   }
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-    process.exit(0);
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    printJsonCompact({
+      gate_decision: "PASS",
+      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      unauthenticated: true,
+      static_results: staticResults
+    });
     process.exit(0);
   }
   let specs;
@@ -15757,6 +15798,7 @@ var import_node_fs24 = require("node:fs");
 var import_promises12 = require("node:fs/promises");
 var import_node_path17 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
+var readline = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs23 = require("node:fs");
@@ -16036,6 +16078,66 @@ function registerMigrateCommand(program2) {
 }
 
 // src/commands/init.ts
+async function promptYes(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runOptionalAuth() {
+  const existing = await resolveToken();
+  if (existing.ok) {
+    printInfo("Already authenticated \u2014 results will upload to the Verity service. \u2713");
+    return;
+  }
+  let remote = "";
+  try {
+    remote = (0, import_node_child_process9.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+  }
+  const localOnlyNote = () => {
+    printInfo("Verity runs in local-only mode: the gate still runs and shows static findings, but nothing uploads.");
+    printInfo('  Authenticate anytime: run "verity init" again, or "verity auth register".');
+  };
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    console.log("");
+    console.log("  Signing in is optional. What it does:");
+    console.log("    - Confirms you have write access to this repository. The GitHub token");
+    console.log("      is used once to verify that, then discarded \u2014 Verity never stores it.");
+    console.log("    - It does NOT give Verity access to your code. Code checked by the gate");
+    console.log("      is analyzed in memory and discarded \u2014 we never store your code.");
+    console.log("    - It is required to store and access run history for this repo");
+    console.log("      (past results, trends, and shareable reports).");
+    console.log("    - Skip and Verity still works fully locally: the gate runs and shows");
+    console.log("      findings, but nothing is uploaded.");
+    console.log("");
+  }
+  const wantsAuth = await promptYes("Authenticate with GitHub now to upload results to Verity? [Y/skip] ");
+  if (!wantsAuth) {
+    printInfo("Skipped authentication.");
+    localOnlyNote();
+    return;
+  }
+  if (!remote) {
+    printWarn("No git remote found \u2014 cannot authenticate yet.");
+    localOnlyNote();
+    return;
+  }
+  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path17.basename)(process.cwd());
+  printInfo("Authenticating with GitHub\u2026");
+  const result = await registerProject({ projectName, remote, serviceUrl: DEFAULT_SERVICE_URL });
+  if (result.ok) {
+    printInfo(`Project registered: ${result.data.projectId} \u2713`);
+    if (result.data.email) printInfo(`  Authenticated as: ${result.data.email}`);
+  } else {
+    printWarn(`Authentication did not complete: ${result.error}`);
+    localOnlyNote();
+  }
+}
 function resolveDataDir() {
   const candidates = [
     (0, import_node_path17.join)(__dirname, "..", "data"),
@@ -16179,6 +16281,12 @@ function registerInitCommand(program2) {
     const globalVerityDir = (0, import_node_path17.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises12.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
+    try {
+      await runOptionalAuth();
+    } catch (err) {
+      printWarn(`Authentication step skipped: ${err.message}`);
+    }
+    console.log("");
     printInfo("Verity initialized!");
     console.log("");
     console.log("  Installed:");
@@ -16194,6 +16302,7 @@ function registerInitCommand(program2) {
     console.log("    .verity/memory/                  \u2014 knowledge base (8 domains, commit to git)");
     console.log("");
     console.log("  Next step: open this project in Claude Code and run /verity-setup");
+    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity auth register".)');
     console.log("");
   });
 }
@@ -16925,7 +17034,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.25.0-experimental.e3da48a").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.25.0-experimental.ed0c319").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);

package/data/skills/verity-analyze/SKILL.md

@@ -15,7 +15,13 @@ You are running an on-demand Verity analysis. This is like a "second opinion"
 
 1. Verify `.verity/standard.yaml` exists. If not: "Run `/verity-setup` first."
 2. Verify `verity` CLI is available: `which verity`. If not: "Re-run the Verity installer: `curl -fsSL https://raw.githubusercontent.com/codacy/verity/main/install.sh | bash`"
-3. Run `verity auth verify` to check token is valid. If it fails: "Verity not configured. Run `/verity-setup` first."
+3. Run `verity auth verify` to check the token is valid.
+   - **Valid**: proceed with the full deep review.
+   - **Fails / not authenticated**: don't stop. Tell the user Verity is in
+     **local-only mode**, so the review will run static analysis and show findings
+     but won't perform the deep (LLM) review or upload anything. To unlock the deep
+     review they can authenticate with `verity init` (or `verity auth register`).
+     Continue — `verity review` degrades to a local static-only report on its own.
 
 ---
 

package/data/skills/verity-setup/SKILL.md

@@ -310,32 +310,60 @@ Expected: single-digit findings per file, not hundreds. If you see 50+ issues fr
 
 ---
 
-## Step 6: Register with Verity service
-
-Use the `verity` CLI to register. It handles provider auth, credential storage, and the service URL automatically.
+## Step 6: Verify authentication
+
+Login now happens in `verity init` (an optional, skippable step), **not** here.
+This step only checks whether the user authenticated during init, and branches
+the rest of setup accordingly.
+
+**If the user asks what signing in does or why it matters, tell them:**
+- It confirms they have **write access to this repository** — the GitHub token is
+  used **once** to verify that, then discarded. Verity never stores it.
+- It does **not** give Verity access to their code. Code checked by the gate is
+  analyzed **in memory and discarded** — Verity never stores their code.
+- It is **required to store and access run history** for the repo (past results,
+  trends, and shareable reports).
+- Skipping keeps Verity fully **local-only**: the gate still runs and shows
+  findings, but nothing is uploaded.
 
 ```bash
-verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
+verity auth verify
 ```
 
-Registration is **provider-gated** (GitHub today): the CLI runs a GitHub OAuth
-**device flow** and prints something like *"open https://github.com/login/device
-and enter code WXYZ-1234"*. The user approves in the browser; the CLI then proves
-the user has **write access** to the repo before the service issues a token. Tell
-the user to expect this prompt and to complete it in their browser.
-
-This command:
-- **Write access confirmed**: Registers, stores the verity token + service URL + provider token in `.verity/credentials` (perms 600), prints `project_id` and the authenticated email. Continue.
-- **No write access** (`403 NO_WRITE_ACCESS`): The user lacks push rights on the repo — they can't register it. Verity still runs locally as an anonymous gate, but no history/org/repo data is stored. Stop.
-- **Non-GitHub remote**: Only GitHub is supported for now; show the error and stop.
-- **Other errors**: Show the error and stop.
-
-After this step, `.verity/credentials` will contain `token`, `service_url`, and `provider_token` — all subsequent `verity` commands will work.
+- **Token valid** (prints the project name): The user authenticated during
+  `verity init`. Continue to Step 7 — the Standard, config, and knowledge base
+  will upload.
+- **Not authenticated / no token**: The user skipped login in `verity init` (or
+  lacks write access). Verity runs in **local-only mode** — the gate still runs on
+  every stop and surfaces static findings, but nothing uploads and no
+  history/org/repo data is stored. **Skip Steps 7 and 7b** (they require a token)
+  and continue to Step 8. Tell the user they can authenticate anytime to unlock
+  deep review, history, and shareable reports by running:
+
+  ```bash
+  verity init          # re-runs init; offers the auth prompt again
+  # or, directly:
+  verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
+  ```
+
+  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub OAuth
+  **device flow** ("open https://github.com/login/device and enter code
+  WXYZ-1234"), proving the user has **write access** to the repo before the
+  service issues a token.
+
+When authenticated, `.verity/credentials` contains `token`, `service_url`, and
+`provider_token` — all subsequent `verity` upload commands work.
 
 ---
 
 ## Step 7: Upload Standard and config
 
+> **Skip this entire step if the user is not authenticated** (Step 6 reported
+> local-only mode). These commands require a token and will fail without one. The
+> `.verity/standard.yaml` and `.codacy/codacy.config.json` you generated locally
+> still drive the gate; they'll upload the next time the user authenticates and
+> re-runs setup.
+
 ### Upload the Standard
 
 The `verity` CLI handles YAML→JSON conversion automatically:
@@ -366,6 +394,10 @@ This derives a small set of descriptive memory nodes from what you already analy
 
 ## Step 7b: Enable telemetry (only if the user opted in at Step 3b)
 
+> **Skip this step if the user is not authenticated** (local-only mode) — telemetry
+> export requires the token. Note that `/usage` stays empty until they authenticate
+> and run `verity telemetry install`.
+
 If — and only if — the user said **Yes** in Step 3b, enable the Claude Code telemetry export
 now (the token from Step 6 must already exist):
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.25.0-experimental.e3da48a",
+  "version": "0.25.0-experimental.ed0c319",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {