@codacy/verity-cli 0.25.0 → 0.26.0-experimental.a2dc844

package/bin/verity.js

@@ -10325,9 +10325,7 @@ var {
 } = import_index.default;
 
 // src/commands/auth.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_child_process3 = require("node:child_process");
-var import_node_path2 = require("node:path");
+var import_node_child_process4 = require("node:child_process");
 
 // src/lib/auth.ts
 var import_promises = require("node:fs/promises");
@@ -10475,7 +10473,11 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var GITHUB_CLIENT_ID = "Ov23liBpj42KMTtUtN10";
+var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var GITHUB_OAUTH_SCOPES = "repo user:email";
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10641,7 +10643,8 @@ async function apiRequest(options) {
     timeout = 9e4,
     cmd = "unknown",
     retry = false,
-    encodeBody = false
+    encodeBody = false,
+    extraHeaders
   } = options;
   const url = `${serviceUrl}${path}`;
   const headers = {
@@ -10650,6 +10653,9 @@ async function apiRequest(options) {
   if (token) {
     headers["Authorization"] = `Bearer ${token}`;
   }
+  if (extraHeaders) {
+    Object.assign(headers, extraHeaders);
+  }
   const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
   if (testMockScenario) {
     headers["X-Verity-Mock-Scenario"] = testMockScenario;
@@ -10740,6 +10746,386 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/register.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
+
+// src/lib/provider-auth.ts
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var form = (fields) => new URLSearchParams(fields).toString();
+async function githubDeviceFlow() {
+  const override = process.env.VERITY_PROVIDER_TOKEN;
+  if (override) return { ok: true, data: override };
+  let dc;
+  try {
+    const res = await fetch(GITHUB_DEVICE_CODE_URL, {
+      method: "POST",
+      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+      body: form({ client_id: GITHUB_CLIENT_ID, scope: GITHUB_OAUTH_SCOPES })
+    });
+    if (!res.ok) {
+      return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
+    }
+    dc = await res.json();
+  } catch (err) {
+    return { ok: false, error: `Network error contacting GitHub: ${err.message}` };
+  }
+  if (!dc.device_code || !dc.user_code) {
+    return {
+      ok: false,
+      error: "GitHub did not return a device code (is Device Flow enabled on the OAuth app?)"
+    };
+  }
+  printInfo("");
+  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
+  printInfo(`And enter the code:         ${dc.user_code}`);
+  printInfo("Waiting for authorization\u2026");
+  const deadline = Date.now() + (dc.expires_in || 900) * 1e3;
+  let interval = dc.interval || 5;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let data;
+    try {
+      const res = await fetch(GITHUB_ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+        body: form({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: dc.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      data = await res.json().catch(() => ({}));
+    } catch {
+      continue;
+    }
+    if (data.access_token) return { ok: true, data: data.access_token };
+    switch (data.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return { ok: false, error: "Authorization was denied on GitHub." };
+      case "expired_token":
+        return { ok: false, error: "The authorization code expired. Re-run register." };
+      default:
+        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
+    }
+  }
+  return { ok: false, error: "Timed out waiting for GitHub authorization." };
+}
+
+// src/lib/git.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+function resolveFile(relpath) {
+  if ((0, import_node_fs2.existsSync)(relpath)) return relpath;
+  if ((0, import_node_fs2.existsSync)(".claude/worktrees")) {
+    try {
+      const entries = (0, import_node_fs2.readdirSync)(".claude/worktrees", { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const candidate = (0, import_node_path2.join)(".claude/worktrees", entry.name, relpath);
+        if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function execGit(cmd) {
+  try {
+    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function splitLines(s) {
+  return s.split("\n").filter((l) => l.length > 0);
+}
+var SHA_RE = /^[0-9a-f]{40}$/;
+function readBaselineSha() {
+  if (!(0, import_node_fs2.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs2.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (!SHA_RE.test(sha)) return null;
+  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  if (!reachable) {
+    try {
+      (0, import_node_fs2.unlinkSync)(BASELINE_SHA_FILE);
+    } catch {
+    }
+    return null;
+  }
+  return sha;
+}
+function writeBaselineSha(sha) {
+  if (!SHA_RE.test(sha)) return;
+  try {
+    (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs2.writeFileSync)(BASELINE_SHA_FILE, sha);
+  } catch {
+  }
+}
+function getChangedFiles() {
+  const sets = /* @__PURE__ */ new Set();
+  let hasRecentCommitFiles = false;
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
+  } else {
+    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
+    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
+      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      if (recentFiles.length > 0) {
+        hasRecentCommitFiles = true;
+        for (const f of recentFiles) sets.add(f);
+      }
+    }
+  }
+  for (const f of getWorktreeFiles()) sets.add(f);
+  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return { files: filtered, hasRecentCommitFiles };
+}
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getDirtyFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function showContentAtRef(ref, repoRelPath) {
+  if (!ref || ref === "no-git") return null;
+  const normalizedPath = repoRelPath.replace(/\\/g, "/");
+  try {
+    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve of resolvers) {
+    const range = resolve();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
+function getPushRangeMessages() {
+  const { range } = getPushRangeFiles();
+  if (!range) return "";
+  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function getWorktreeFiles() {
+  const result = [];
+  const worktreeDir = ".claude/worktrees";
+  if (!(0, import_node_fs2.existsSync)(worktreeDir)) return result;
+  try {
+    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
+    const entries = (0, import_node_fs2.readdirSync)(worktreeDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const wtDir = (0, import_node_path2.join)(worktreeDir, entry.name);
+      scanDir(wtDir, wtDir, fiveMinAgo, result);
+    }
+  } catch {
+  }
+  return result;
+}
+function scanDir(baseDir, dir, minMtime, result) {
+  try {
+    const entries = (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path2.join)(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".git") continue;
+        scanDir(baseDir, fullPath, minMtime, result);
+      } else if (entry.isFile()) {
+        const ext = (0, import_node_path2.extname)(entry.name).slice(1);
+        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
+        try {
+          const stat3 = (0, import_node_fs2.statSync)(fullPath);
+          if (stat3.mtimeMs >= minMtime) {
+            const relPath = fullPath.slice(baseDir.length + 1);
+            result.push(relPath);
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function filterAnalyzable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    return ANALYZABLE_EXTENSIONS.has(ext);
+  });
+}
+function filterReviewable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
+    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
+    const basename3 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
+    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
+    return false;
+  });
+}
+function filterSecurity(files) {
+  return files.filter(
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+  );
+}
+function getCurrentCommit() {
+  return execGit("git rev-parse HEAD") || "no-git";
+}
+function detectProvider(host) {
+  const h = host.toLowerCase();
+  if (h.includes("github")) return "github";
+  if (h.includes("gitlab")) return "gitlab";
+  if (h.includes("bitbucket")) return "bitbucket";
+  return "unknown";
+}
+function parseRemote(raw) {
+  if (!raw || typeof raw !== "string") return null;
+  let s = raw.trim();
+  if (!s) return null;
+  let host = "";
+  let path = "";
+  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
+  if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    s = s.replace(/^[^/@]+@/, "");
+    const slash = s.indexOf("/");
+    if (slash === -1) return null;
+    host = s.slice(0, slash);
+    path = s.slice(slash + 1);
+  }
+  host = host.toLowerCase().trim();
+  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
+  if (!host || !path) return null;
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  const owner = segments[0];
+  const repo = segments[segments.length - 1];
+  if (!owner || !repo) return null;
+  return {
+    host,
+    owner,
+    repo,
+    provider: detectProvider(host),
+    orgUrl: `https://${host}/${owner}`,
+    orgName: owner
+  };
+}
+function listTrackedFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set);
+}
+
+// src/lib/register.ts
+async function registerProject(opts) {
+  const parsed = parseRemote(opts.remote);
+  if (!parsed) {
+    return { ok: false, error: `Could not parse git remote: ${opts.remote}` };
+  }
+  if (parsed.provider !== "github") {
+    return { ok: false, error: `Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.` };
+  }
+  const providerAuth = await githubDeviceFlow();
+  if (!providerAuth.ok) {
+    return { ok: false, error: providerAuth.error };
+  }
+  const providerToken = providerAuth.data;
+  const result = await apiRequest({
+    method: "POST",
+    path: "/auth/register",
+    serviceUrl: opts.serviceUrl,
+    body: { project_name: opts.projectName, git_remote_url: opts.remote },
+    extraHeaders: { "X-Provider-Token": providerToken },
+    verbose: opts.verbose
+  });
+  if (!result.ok) {
+    return { ok: false, error: result.error };
+  }
+  const { project_id, token, service_url, user } = result.data;
+  try {
+    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises3.writeFile)(
+      CREDENTIALS_FILE,
+      `token: ${token}
+service_url: ${service_url}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Registered with the Verity service, but could not save credentials to ${CREDENTIALS_FILE}: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
+    };
+  }
+  try {
+    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
+    await (0, import_promises3.appendFile)(
+      GLOBAL_CREDENTIALS_FILE,
+      `${opts.remote} token: ${token}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch {
+  }
+  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email: user?.email } };
+}
+
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage project authentication");
@@ -10749,36 +11135,26 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
       }
     }
-    const result = await apiRequest({
-      method: "POST",
-      path: "/auth/register",
+    const result = await registerProject({
+      projectName: opts.project,
+      remote,
       serviceUrl,
-      body: { project_name: opts.project, git_remote_url: remote },
       verbose: globals.verbose
     });
     if (!result.ok) {
       printError(result.error);
       process.exit(1);
     }
-    const { project_id, token, service_url } = result.data;
-    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(CREDENTIALS_FILE, `token: ${token}
-service_url: ${service_url}
-`);
-    try {
-      await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-      await (0, import_promises3.appendFile)(GLOBAL_CREDENTIALS_FILE, `${remote} token: ${token}
-`);
-    } catch {
-    }
-    printInfo(`Project registered: ${project_id}`);
-    printJson({ project_id, service_url });
+    const { projectId, serviceUrl: resolvedUrl, email } = result.data;
+    printInfo(`Project registered: ${projectId}`);
+    if (email) printInfo(`Authenticated as: ${email}`);
+    printJson({ project_id: projectId, service_url: resolvedUrl });
   });
   auth.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
@@ -10811,7 +11187,7 @@ service_url: ${service_url}
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -10838,8 +11214,63 @@ service_url: ${service_url}
 }
 
 // src/lib/hooks.ts
-var import_promises4 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
+var import_promises5 = require("node:fs/promises");
+var import_node_path5 = require("node:path");
+
+// src/lib/json-file.ts
+var import_promises4 = require("node:fs/promises");
+var import_node_path4 = require("node:path");
+function jsonSemanticEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
+    return a === b;
+  }
+  const aIsArr = Array.isArray(a);
+  const bIsArr = Array.isArray(b);
+  if (aIsArr || bIsArr) {
+    if (!aIsArr || !bIsArr || a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (!jsonSemanticEqual(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const aKeys = Object.keys(ao).filter((k) => ao[k] !== void 0);
+  const bKeys = Object.keys(bo).filter((k) => bo[k] !== void 0);
+  if (aKeys.length !== bKeys.length) return false;
+  for (const k of aKeys) {
+    if (bo[k] === void 0) return false;
+    if (!jsonSemanticEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+function detectJsonIndent(raw) {
+  const m = raw.match(/\n([ \t]+)\S/);
+  return m ? m[1] : 2;
+}
+async function writeJsonFilePreservingStyle(file, value) {
+  let currentRaw = null;
+  try {
+    currentRaw = await (0, import_promises4.readFile)(file, "utf-8");
+  } catch {
+    currentRaw = null;
+  }
+  if (currentRaw !== null) {
+    try {
+      if (jsonSemanticEqual(JSON.parse(currentRaw), value)) return false;
+    } catch {
+    }
+  }
+  const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
+  const next = JSON.stringify(value, null, indent) + "\n";
+  if (next === currentRaw) return false;
+  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
+  await (0, import_promises4.writeFile)(file, next);
+  return true;
+}
+
+// src/lib/hooks.ts
 var VERITY_STOP_HOOK = {
   type: "command",
   command: "verity analyze",
@@ -10917,7 +11348,7 @@ function globalSettingsFile() {
 }
 async function readSettings() {
   try {
-    const content = await (0, import_promises4.readFile)(CLAUDE_SETTINGS_FILE, "utf-8");
+    const content = await (0, import_promises5.readFile)(CLAUDE_SETTINGS_FILE, "utf-8");
     return JSON.parse(content);
   } catch {
     return {};
@@ -10928,7 +11359,7 @@ async function readAllSettings() {
   const out = [];
   for (const f of files) {
     try {
-      out.push(JSON.parse(await (0, import_promises4.readFile)(f, "utf-8")));
+      out.push(JSON.parse(await (0, import_promises5.readFile)(f, "utf-8")));
     } catch {
     }
   }
@@ -10957,7 +11388,7 @@ async function checkExternalVerityHooks() {
   for (const f of [SETTINGS_LOCAL_FILE, globalSettingsFile()]) {
     let settings;
     try {
-      settings = JSON.parse(await (0, import_promises4.readFile)(f, "utf-8"));
+      settings = JSON.parse(await (0, import_promises5.readFile)(f, "utf-8"));
     } catch {
       continue;
     }
@@ -10991,20 +11422,17 @@ async function checkAllVerityHooksDetailed() {
   return { stop, intent, baseline, current: hasCurrent, legacyOnly: hasLegacy && !hasCurrent };
 }
 async function writeSettings(settings) {
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(CLAUDE_SETTINGS_FILE), { recursive: true });
-  await (0, import_promises4.writeFile)(CLAUDE_SETTINGS_FILE, JSON.stringify(settings, null, 2) + "\n");
+  await writeJsonFilePreservingStyle(CLAUDE_SETTINGS_FILE, settings);
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path3.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  const file = (0, import_node_path3.join)(root, CLAUDE_SETTINGS_FILE);
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(file), { recursive: true });
-  await (0, import_promises4.writeFile)(file, JSON.stringify(settings, null, 2) + "\n");
+  await writeJsonFilePreservingStyle((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -11243,9 +11671,9 @@ function registerHooksCommands(program2) {
 var import_node_crypto3 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
-var import_promises5 = require("node:fs/promises");
-var import_node_fs2 = require("node:fs");
-var import_node_child_process4 = require("node:child_process");
+var import_promises6 = require("node:fs/promises");
+var import_node_fs3 = require("node:fs");
+var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
@@ -11255,7 +11683,7 @@ function bufferTmpPath() {
 }
 async function appendToConversationBuffer(prompt, sessionId) {
   try {
-    await (0, import_promises5.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises6.mkdir)(VERITY_DIR, { recursive: true });
     let sanitized = prompt.length > MAX_INTENT_CHARS ? prompt.slice(0, MAX_INTENT_CHARS) : prompt;
     sanitized = stripImageReferences(sanitized);
     const entry = {
@@ -11273,14 +11701,14 @@ async function appendToConversationBuffer(prompt, sessionId) {
     const capped = recent.slice(-CONVERSATION_MAX_ENTRIES);
     const content = capped.map((e) => JSON.stringify(e)).join("\n") + "\n";
     const tmpFile = bufferTmpPath();
-    await (0, import_promises5.writeFile)(tmpFile, content);
-    await (0, import_promises5.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
+    await (0, import_promises6.writeFile)(tmpFile, content);
+    await (0, import_promises6.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
   } catch {
   }
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs2.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs3.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -11291,10 +11719,10 @@ async function readAndClearConversationBuffer(currentSessionId) {
       if (others.length > 0) {
         const remaining = others.map((e) => JSON.stringify(e)).join("\n") + "\n";
         const tmpFile = bufferTmpPath();
-        await (0, import_promises5.writeFile)(tmpFile, remaining);
-        await (0, import_promises5.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
+        await (0, import_promises6.writeFile)(tmpFile, remaining);
+        await (0, import_promises6.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
       } else {
-        await (0, import_promises5.unlink)(CONVERSATION_BUFFER_FILE).catch(() => {
+        await (0, import_promises6.unlink)(CONVERSATION_BUFFER_FILE).catch(() => {
         });
       }
       if (mine.length > 0) {
@@ -11304,10 +11732,10 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs2.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs3.existsSync)(INTENT_FILE)) {
       try {
-        const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
-        await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
+        const content = await (0, import_promises6.readFile)(INTENT_FILE, "utf-8");
+        await (0, import_promises6.unlink)(INTENT_FILE).catch(() => {
         });
         const data = JSON.parse(content);
         if (data.prompt) {
@@ -11330,7 +11758,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
 }
 async function readBufferEntries() {
   try {
-    const content = await (0, import_promises5.readFile)(CONVERSATION_BUFFER_FILE, "utf-8");
+    const content = await (0, import_promises6.readFile)(CONVERSATION_BUFFER_FILE, "utf-8");
     const entries = [];
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -11348,7 +11776,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process4.execSync)(
+    const output = (0, import_node_child_process5.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -11360,9 +11788,9 @@ function getRecentCommitMessages() {
 }
 
 // src/lib/task-context-buffer.ts
-var import_promises6 = require("node:fs/promises");
-var import_node_fs3 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_promises7 = require("node:fs/promises");
+var import_node_fs4 = require("node:fs");
+var import_node_path6 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -11401,9 +11829,9 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs3.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs4.existsSync)(filePath)) return null;
   try {
-    const content = await (0, import_promises6.readFile)(filePath, "utf-8");
+    const content = await (0, import_promises7.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
     const lines = content.split("\n").filter((l) => l.trim());
     const formatted = [];
@@ -11435,16 +11863,16 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs3.existsSync)(TASK_CONTEXT_DIR)) return;
-    const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
+    if (!(0, import_node_fs4.existsSync)(TASK_CONTEXT_DIR)) return;
+    const files = await (0, import_promises7.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path4.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path6.join)(TASK_CONTEXT_DIR, file);
       try {
-        const stats = await (0, import_promises6.stat)(filePath);
+        const stats = await (0, import_promises7.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
-          await (0, import_promises6.unlink)(filePath);
+          await (0, import_promises7.unlink)(filePath);
         }
       } catch {
       }
@@ -11454,33 +11882,33 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path4.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path6.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
-    await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
+    await (0, import_promises7.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs3.existsSync)(filePath)) {
-      const stats = await (0, import_promises6.stat)(filePath);
+    if ((0, import_node_fs4.existsSync)(filePath)) {
+      const stats = await (0, import_promises7.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
-        const content = await (0, import_promises6.readFile)(filePath, "utf-8");
+        const content = await (0, import_promises7.readFile)(filePath, "utf-8");
         const lines = content.split("\n").filter((l) => l.trim());
         const keepFrom = Math.floor(lines.length * 0.25);
         const pruned = lines.slice(keepFrom).join("\n") + "\n";
-        await (0, import_promises6.writeFile)(filePath, pruned);
+        await (0, import_promises7.writeFile)(filePath, pruned);
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs3.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
-    await (0, import_promises6.writeFile)(filePath, existing + line);
+    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises7.readFile)(filePath, "utf-8") : "";
+    await (0, import_promises7.writeFile)(filePath, existing + line);
   } catch {
   }
 }
 
 // src/lib/memory-retrieval.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_fs4 = require("node:fs");
-var import_node_path5 = require("node:path");
+var import_promises8 = require("node:fs/promises");
+var import_node_fs5 = require("node:fs");
+var import_node_path7 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -11573,19 +12001,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  if (!(0, import_node_fs4.existsSync)(memoryDir())) return null;
+  if (!(0, import_node_fs5.existsSync)(memoryDir())) return null;
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path5.join)(memoryDir(), domain);
-    if (!(0, import_node_fs4.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises7.readdir)(domainDir);
+      const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises7.readFile)((0, import_node_path5.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -11643,9 +12071,9 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 }
 
 // src/lib/memory-sync.ts
-var import_promises8 = require("node:fs/promises");
-var import_node_fs5 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_promises9 = require("node:fs/promises");
+var import_node_fs6 = require("node:fs");
+var import_node_path8 = require("node:path");
 var import_node_crypto2 = require("node:crypto");
 
 // src/lib/glob-match.ts
@@ -11714,36 +12142,36 @@ var memoryDir2 = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS2 = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations", "_archive"];
 var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
-  await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
+  await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises8.mkdir)((0, import_node_path6.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path8.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises8.readdir)(domainDir);
+      const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path6.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path8.join)(memoryDir2(), filePath);
         try {
-          const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
+          const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
@@ -11754,13 +12182,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto2.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -11771,15 +12199,15 @@ function hashContent(content) {
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
-      for (const file of await (0, import_promises8.readdir)(domainDir)) {
+      for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -11791,7 +12219,7 @@ async function readOnDiskNodes() {
 async function readSyncBaseline() {
   const out = /* @__PURE__ */ new Map();
   try {
-    const parsed = JSON.parse(await (0, import_promises8.readFile)(syncStateFile(), "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
     if (Array.isArray(parsed?.nodes)) {
       for (const n of parsed.nodes) if (n?.path) out.set(n.path, n.hash ?? null);
     } else if (Array.isArray(parsed?.paths)) {
@@ -11807,12 +12235,12 @@ async function recordSyncedNodePaths() {
     const next = JSON.stringify({ schema: 2, nodes }) + "\n";
     let existing = "";
     try {
-      existing = await (0, import_promises8.readFile)(syncStateFile(), "utf-8");
+      existing = await (0, import_promises9.readFile)(syncStateFile(), "utf-8");
     } catch {
     }
     if (existing === next) return;
-    await (0, import_promises8.mkdir)(projectPath(VERITY_DIR), { recursive: true });
-    await (0, import_promises8.writeFile)(syncStateFile(), next);
+    await (0, import_promises9.mkdir)(projectPath(VERITY_DIR), { recursive: true });
+    await (0, import_promises9.writeFile)(syncStateFile(), next);
   } catch {
   }
 }
@@ -11825,11 +12253,11 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path6.join)(memoryDir2(), path);
-    if (!(0, import_node_fs5.existsSync)(full)) continue;
+    const full = (0, import_node_path8.join)(memoryDir2(), path);
+    if (!(0, import_node_fs6.existsSync)(full)) continue;
     let content;
     try {
-      content = await (0, import_promises8.readFile)(full, "utf-8");
+      content = await (0, import_promises9.readFile)(full, "utf-8");
     } catch {
       continue;
     }
@@ -11862,15 +12290,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs5.existsSync)((0, import_node_path6.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises8.writeFile)((0, import_node_path6.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path6.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path8.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -11880,10 +12308,10 @@ async function applyOneWrite(write, treePaths) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs5.existsSync)(fullPath)) {
+  if ((0, import_node_fs6.existsSync)(fullPath)) {
     let existing = "";
     try {
-      existing = await (0, import_promises8.readFile)(fullPath, "utf-8");
+      existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
     } catch {
     }
     if (existing === content) return { written: false, notes };
@@ -11892,8 +12320,8 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises8.mkdir)((0, import_node_path6.dirname)(fullPath), { recursive: true });
-  await (0, import_promises8.writeFile)(fullPath, content);
+  await (0, import_promises9.mkdir)((0, import_node_path8.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, notes };
 }
 function groundFileGlobs(content, treePaths) {
@@ -11933,10 +12361,10 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path6.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises8.readdir)(domainDir);
+      const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       if (mdFiles.length === 0) continue;
       lines.push(`## ${domain}/ (${mdFiles.length})`);
@@ -11944,7 +12372,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -11968,14 +12396,14 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path6.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path8.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
-    existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
+    existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
   } catch {
   }
   if (existing === next) return;
-  await (0, import_promises8.writeFile)(indexPath, next);
+  await (0, import_promises9.writeFile)(indexPath, next);
 }
 function pickFrontmatter(content, key) {
   const re = new RegExp(`^${key}:\\s*"?([^"\\n]+?)"?\\s*$`, "m");
@@ -12050,10 +12478,10 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path6.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path8.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs5.existsSync)(claudeMdPath)) {
-    existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
+  if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
+    existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
   let endTag = CLAUDE_MD_END;
@@ -12109,7 +12537,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
     next = existing.replace(/\n*$/, "") + "\n\n" + block + "\n";
   }
   if (next === existing) return;
-  await (0, import_promises8.writeFile)(claudeMdPath, next);
+  await (0, import_promises9.writeFile)(claudeMdPath, next);
 }
 function extractPreserveContent(interior) {
   for (const [start, end] of [
@@ -12182,7 +12610,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/commands/intent.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 function registerIntentCommands(program2) {
   const intent = program2.command("intent").description("Manage intent capture");
   intent.command("capture").description("Capture user intent from stdin (used by UserPromptSubmit hook)").action(async () => {
@@ -12191,7 +12619,7 @@ function registerIntentCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs6.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs7.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       const chunks = [];
@@ -12292,7 +12720,7 @@ async function fireClassify(prompt, sessionId) {
 }
 
 // src/commands/standard.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 var import_yaml = __toESM(require_dist());
 function registerStandardCommands(program2) {
   const standard = program2.command("standard").description("Manage the project Standard");
@@ -12310,7 +12738,7 @@ function registerStandardCommands(program2) {
     }
     let yamlContent;
     try {
-      yamlContent = await (0, import_promises9.readFile)(opts.file, "utf-8");
+      yamlContent = await (0, import_promises10.readFile)(opts.file, "utf-8");
     } catch {
       printError(`Cannot read ${opts.file}`);
       process.exit(1);
@@ -12401,7 +12829,7 @@ function registerStandardCommands(program2) {
 }
 
 // src/commands/config.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
   config.command("push").description("Upload the analysis config to the service").option("--file <path>", "Path to config file", CODACY_CONFIG_FILE).action(async (opts) => {
@@ -12418,7 +12846,7 @@ function registerConfigCommands(program2) {
     }
     let content;
     try {
-      const raw = await (0, import_promises10.readFile)(opts.file, "utf-8");
+      const raw = await (0, import_promises11.readFile)(opts.file, "utf-8");
       content = JSON.parse(raw);
     } catch {
       printError(`Cannot read or parse ${opts.file}`);
@@ -12618,370 +13046,161 @@ function registerStatusCommand(program2) {
     if (hookStatus.guardOn.includes("push")) moments.push("pre-push/PR");
     printInfo(`Moments:     ${moments.length > 0 ? moments.join(", ") : "none (run /verity-setup)"}`);
     if (mem.recent_runs) {
-      const r = mem.recent_runs;
-      printInfo("");
-      printInfo("--- Last Run ---");
-      printInfo(`Decision:    ${r.last_gate_decision ?? "none"}`);
-      printInfo(`Quality:     ${r.last_quality_score ?? "-"}/10`);
-      printInfo(`Security:    ${r.last_security_score ?? "-"}/10`);
-      printInfo(`Trend:       ${r.trend}`);
-      printInfo(`Runs:        ${r.count} recorded`);
-    }
-    if (mem.pending_items && mem.pending_items.length > 0) {
-      printInfo("");
-      printInfo("--- Pending Items ---");
-      for (const item of mem.pending_items) {
-        printInfo(`  [${item.priority.toUpperCase()}] ${item.description}`);
-      }
-    }
-    const recentTasks = mem.recent_tasks;
-    const currentTask = mem.current_task;
-    const contextFiles = mem.context_files;
-    if (recentTasks && recentTasks.length > 0) {
-      printInfo("");
-      printInfo("--- Active Tasks ---");
-      for (const task of recentTasks) {
-        const isCurrent = currentTask && task.id === currentTask.id;
-        const marker = isCurrent ? "\u25CF" : "\u25CB";
-        const runCount = task.run_count ?? 0;
-        const lastAt = task.last_run_at ? timeAgo(task.last_run_at) : "no runs";
-        printInfo(`  ${marker} ${task.label}  ${runCount} run${runCount === 1 ? "" : "s"}, ${lastAt}`);
-      }
-      if (currentTask) {
-        printInfo("");
-        printInfo(`Current task: ${currentTask.label}`);
-        if (contextFiles && contextFiles.length > 0) {
-          printInfo(`  Files in task: ${contextFiles.length} (${contextFiles.slice(0, 3).join(", ")}${contextFiles.length > 3 ? "..." : ""})`);
-        }
-      }
-    }
-    if (opts.history) {
-      const runsResult = await apiRequest({
-        method: "GET",
-        path: `/runs?limit=${opts.limit}`,
-        serviceUrl,
-        token,
-        verbose: globals.verbose
-      });
-      if (runsResult.ok && runsResult.data.runs.length > 0) {
-        printInfo("");
-        printInfo("--- Recent Runs ---");
-        printInfo(`${"Run ID".padEnd(32)} ${"Decision".padEnd(10)}${"Q".padEnd(4)}${"S".padEnd(4)}${"Findings".padEnd(32)}Date`);
-        for (const run of runsResult.data.runs) {
-          const q = run.quality_score != null ? `${run.quality_score}` : "-";
-          const s = run.security_score != null ? `${run.security_score}` : "-";
-          const findings = formatFindingsSummary(run.findings_count);
-          const date = run.created_at.slice(0, 19).replace("T", " ");
-          printInfo(`${run.run_id.padEnd(32)} ${run.gate_decision.padEnd(10)}${q.padEnd(4)}${s.padEnd(4)}${findings.padEnd(32)}${date}`);
-        }
-      }
-    }
-  });
-}
-
-// src/commands/feedback.ts
-function registerFeedbackCommand(program2) {
-  const feedbackCmd = program2.command("feedback").description("Send feedback to the Verity team");
-  feedbackCmd.command("message <text>").description("Send general feedback").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
-    const globals = program2.opts();
-    await sendGeneralFeedback(message, opts, globals);
-  });
-  feedbackCmd.command("finding <run-id> <pattern-id> <action> [note]").description("Submit per-finding feedback (false_positive, acknowledged, useful, etc.)").option("--file <path>", "File path the finding applies to").option("--line <n>", "Line number", parseInt).action(async (runId, patternId, action, note, opts) => {
-    const globals = program2.opts();
-    const validActions = ["false_positive", "acknowledged", "will_fix_later", "wrong_severity", "useful"];
-    if (!validActions.includes(action)) {
-      printError(`Invalid action "${action}". Must be one of: ${validActions.join(", ")}`);
-      process.exit(1);
-    }
-    const tokenResult = await resolveToken(globals.token);
-    if (!tokenResult.ok) {
-      printError(tokenResult.error);
-      process.exit(1);
-    }
-    const urlResult = await resolveServiceUrl(globals.serviceUrl);
-    if (!urlResult.ok) {
-      printError(urlResult.error);
-      process.exit(1);
-    }
-    const body = {
-      run_id: runId,
-      pattern_id: patternId,
-      action
-    };
-    if (note) body.note = note;
-    if (opts.file) body.file_path = opts.file;
-    if (opts.line != null) body.line = opts.line;
-    const result = await apiRequest({
-      method: "POST",
-      path: "/feedback/findings",
-      serviceUrl: urlResult.data,
-      token: tokenResult.data.token,
-      body,
-      verbose: globals.verbose
-    });
-    if (!result.ok) {
-      printError(`Couldn't submit finding feedback: ${result.error}`);
-      process.exit(1);
-    }
-    const status = result.data.suppression_active ? "Suppression active \u2014 this pattern will be skipped in future runs for matching files." : "Feedback recorded.";
-    printInfo(status);
-  });
-  feedbackCmd.argument("[message]", "Feedback message (for backwards compat)").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
-    if (!message) return;
-    const globals = program2.opts();
-    await sendGeneralFeedback(message, opts, globals);
-  });
-}
-async function sendGeneralFeedback(message, opts, globals) {
-  const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    printError(tokenResult.error);
-    printInfo(`Your message: ${message}`);
-    process.exit(1);
-  }
-  const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    printError(urlResult.error);
-    printInfo(`Your message: ${message}`);
-    process.exit(1);
-  }
-  const body = { message };
-  const sessionId = opts.sessionId ?? process.env.CLAUDE_SESSION_ID;
-  const model = opts.model ?? process.env.CLAUDE_MODEL ?? "unknown";
-  if (sessionId) body.session_id = sessionId;
-  if (model) body.agent_model = model;
-  const result = await apiRequest({
-    method: "POST",
-    path: "/feedback",
-    serviceUrl: urlResult.data,
-    token: tokenResult.data.token,
-    body,
-    verbose: globals.verbose
-  });
-  if (!result.ok) {
-    printError(`Couldn't send feedback: ${result.error}`);
-    printInfo(`Your message: ${message}`);
-    process.exit(1);
-  }
-  printInfo("Thanks, feedback sent!");
-}
-
-// src/commands/analyze.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path14 = require("node:path");
-
-// src/lib/git.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_fs7 = require("node:fs");
-var import_node_path7 = require("node:path");
-function resolveFile(relpath) {
-  if ((0, import_node_fs7.existsSync)(relpath)) return relpath;
-  if ((0, import_node_fs7.existsSync)(".claude/worktrees")) {
-    try {
-      const entries = (0, import_node_fs7.readdirSync)(".claude/worktrees", { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const candidate = (0, import_node_path7.join)(".claude/worktrees", entry.name, relpath);
-        if ((0, import_node_fs7.existsSync)(candidate)) return candidate;
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function execGit(cmd) {
-  try {
-    return (0, import_node_child_process5.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function splitLines(s) {
-  return s.split("\n").filter((l) => l.length > 0);
-}
-var SHA_RE = /^[0-9a-f]{40}$/;
-function readBaselineSha() {
-  if (!(0, import_node_fs7.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs7.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
-    try {
-      (0, import_node_fs7.unlinkSync)(BASELINE_SHA_FILE);
-    } catch {
-    }
-    return null;
-  }
-  return sha;
-}
-function writeBaselineSha(sha) {
-  if (!SHA_RE.test(sha)) return;
-  try {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path7.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs7.writeFileSync)(BASELINE_SHA_FILE, sha);
-  } catch {
-  }
-}
-function getChangedFiles() {
-  const sets = /* @__PURE__ */ new Set();
-  let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
-    if (committed.length > 0) {
-      hasRecentCommitFiles = true;
-      for (const f of committed) sets.add(f);
-    }
-  } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
-    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
-    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
-      if (recentFiles.length > 0) {
-        hasRecentCommitFiles = true;
-        for (const f of recentFiles) sets.add(f);
-      }
-    }
-  }
-  for (const f of getWorktreeFiles()) sets.add(f);
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  return { files: filtered, hasRecentCommitFiles };
-}
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function getDirtyFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function showContentAtRef(ref, repoRelPath) {
-  if (!ref || ref === "no-git") return null;
-  const normalizedPath = repoRelPath.replace(/\\/g, "/");
-  try {
-    return (0, import_node_child_process5.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch {
-    return null;
-  }
-}
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGit("git rev-parse --abbrev-ref HEAD");
-      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve of resolvers) {
-    const range = resolve();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
-function getWorktreeFiles() {
-  const result = [];
-  const worktreeDir = ".claude/worktrees";
-  if (!(0, import_node_fs7.existsSync)(worktreeDir)) return result;
-  try {
-    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
-    const entries = (0, import_node_fs7.readdirSync)(worktreeDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const wtDir = (0, import_node_path7.join)(worktreeDir, entry.name);
-      scanDir(wtDir, wtDir, fiveMinAgo, result);
+      const r = mem.recent_runs;
+      printInfo("");
+      printInfo("--- Last Run ---");
+      printInfo(`Decision:    ${r.last_gate_decision ?? "none"}`);
+      printInfo(`Quality:     ${r.last_quality_score ?? "-"}/10`);
+      printInfo(`Security:    ${r.last_security_score ?? "-"}/10`);
+      printInfo(`Trend:       ${r.trend}`);
+      printInfo(`Runs:        ${r.count} recorded`);
     }
-  } catch {
-  }
-  return result;
-}
-function scanDir(baseDir, dir, minMtime, result) {
-  try {
-    const entries = (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = (0, import_node_path7.join)(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".git") continue;
-        scanDir(baseDir, fullPath, minMtime, result);
-      } else if (entry.isFile()) {
-        const ext = (0, import_node_path7.extname)(entry.name).slice(1);
-        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
-        try {
-          const stat3 = (0, import_node_fs7.statSync)(fullPath);
-          if (stat3.mtimeMs >= minMtime) {
-            const relPath = fullPath.slice(baseDir.length + 1);
-            result.push(relPath);
-          }
-        } catch {
+    if (mem.pending_items && mem.pending_items.length > 0) {
+      printInfo("");
+      printInfo("--- Pending Items ---");
+      for (const item of mem.pending_items) {
+        printInfo(`  [${item.priority.toUpperCase()}] ${item.description}`);
+      }
+    }
+    const recentTasks = mem.recent_tasks;
+    const currentTask = mem.current_task;
+    const contextFiles = mem.context_files;
+    if (recentTasks && recentTasks.length > 0) {
+      printInfo("");
+      printInfo("--- Active Tasks ---");
+      for (const task of recentTasks) {
+        const isCurrent = currentTask && task.id === currentTask.id;
+        const marker = isCurrent ? "\u25CF" : "\u25CB";
+        const runCount = task.run_count ?? 0;
+        const lastAt = task.last_run_at ? timeAgo(task.last_run_at) : "no runs";
+        printInfo(`  ${marker} ${task.label}  ${runCount} run${runCount === 1 ? "" : "s"}, ${lastAt}`);
+      }
+      if (currentTask) {
+        printInfo("");
+        printInfo(`Current task: ${currentTask.label}`);
+        if (contextFiles && contextFiles.length > 0) {
+          printInfo(`  Files in task: ${contextFiles.length} (${contextFiles.slice(0, 3).join(", ")}${contextFiles.length > 3 ? "..." : ""})`);
+        }
+      }
+    }
+    if (opts.history) {
+      const runsResult = await apiRequest({
+        method: "GET",
+        path: `/runs?limit=${opts.limit}`,
+        serviceUrl,
+        token,
+        verbose: globals.verbose
+      });
+      if (runsResult.ok && runsResult.data.runs.length > 0) {
+        printInfo("");
+        printInfo("--- Recent Runs ---");
+        printInfo(`${"Run ID".padEnd(32)} ${"Decision".padEnd(10)}${"Q".padEnd(4)}${"S".padEnd(4)}${"Findings".padEnd(32)}Date`);
+        for (const run of runsResult.data.runs) {
+          const q = run.quality_score != null ? `${run.quality_score}` : "-";
+          const s = run.security_score != null ? `${run.security_score}` : "-";
+          const findings = formatFindingsSummary(run.findings_count);
+          const date = run.created_at.slice(0, 19).replace("T", " ");
+          printInfo(`${run.run_id.padEnd(32)} ${run.gate_decision.padEnd(10)}${q.padEnd(4)}${s.padEnd(4)}${findings.padEnd(32)}${date}`);
         }
       }
     }
-  } catch {
-  }
-}
-function filterAnalyzable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path7.extname)(f).slice(1);
-    return ANALYZABLE_EXTENSIONS.has(ext);
   });
 }
-function filterReviewable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path7.extname)(f).slice(1);
-    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
-    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename2 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
-    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
-    return false;
+
+// src/commands/feedback.ts
+function registerFeedbackCommand(program2) {
+  const feedbackCmd = program2.command("feedback").description("Send feedback to the Verity team");
+  feedbackCmd.command("message <text>").description("Send general feedback").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
+    const globals = program2.opts();
+    await sendGeneralFeedback(message, opts, globals);
+  });
+  feedbackCmd.command("finding <run-id> <pattern-id> <action> [note]").description("Submit per-finding feedback (false_positive, acknowledged, useful, etc.)").option("--file <path>", "File path the finding applies to").option("--line <n>", "Line number", parseInt).action(async (runId, patternId, action, note, opts) => {
+    const globals = program2.opts();
+    const validActions = ["false_positive", "acknowledged", "will_fix_later", "wrong_severity", "useful"];
+    if (!validActions.includes(action)) {
+      printError(`Invalid action "${action}". Must be one of: ${validActions.join(", ")}`);
+      process.exit(1);
+    }
+    const tokenResult = await resolveToken(globals.token);
+    if (!tokenResult.ok) {
+      printError(tokenResult.error);
+      process.exit(1);
+    }
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    const body = {
+      run_id: runId,
+      pattern_id: patternId,
+      action
+    };
+    if (note) body.note = note;
+    if (opts.file) body.file_path = opts.file;
+    if (opts.line != null) body.line = opts.line;
+    const result = await apiRequest({
+      method: "POST",
+      path: "/feedback/findings",
+      serviceUrl: urlResult.data,
+      token: tokenResult.data.token,
+      body,
+      verbose: globals.verbose
+    });
+    if (!result.ok) {
+      printError(`Couldn't submit finding feedback: ${result.error}`);
+      process.exit(1);
+    }
+    const status = result.data.suppression_active ? "Suppression active \u2014 this pattern will be skipped in future runs for matching files." : "Feedback recorded.";
+    printInfo(status);
+  });
+  feedbackCmd.argument("[message]", "Feedback message (for backwards compat)").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
+    if (!message) return;
+    const globals = program2.opts();
+    await sendGeneralFeedback(message, opts, globals);
   });
 }
-function filterSecurity(files) {
-  return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
-  );
-}
-function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
-}
-function listTrackedFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set);
+async function sendGeneralFeedback(message, opts, globals) {
+  const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError(tokenResult.error);
+    printInfo(`Your message: ${message}`);
+    process.exit(1);
+  }
+  const urlResult = await resolveServiceUrl(globals.serviceUrl);
+  if (!urlResult.ok) {
+    printError(urlResult.error);
+    printInfo(`Your message: ${message}`);
+    process.exit(1);
+  }
+  const body = { message };
+  const sessionId = opts.sessionId ?? process.env.CLAUDE_SESSION_ID;
+  const model = opts.model ?? process.env.CLAUDE_MODEL ?? "unknown";
+  if (sessionId) body.session_id = sessionId;
+  if (model) body.agent_model = model;
+  const result = await apiRequest({
+    method: "POST",
+    path: "/feedback",
+    serviceUrl: urlResult.data,
+    token: tokenResult.data.token,
+    body,
+    verbose: globals.verbose
+  });
+  if (!result.ok) {
+    printError(`Couldn't send feedback: ${result.error}`);
+    printInfo(`Your message: ${message}`);
+    process.exit(1);
+  }
+  printInfo("Thanks, feedback sent!");
 }
 
+// src/commands/analyze.ts
+var import_node_fs19 = require("node:fs");
+var import_node_path15 = require("node:path");
+
 // src/lib/files.ts
 var import_node_fs8 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_path9 = require("node:path");
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -13049,7 +13268,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path8.extname)(filepath).slice(1);
+  const ext = (0, import_node_path9.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -13335,7 +13554,7 @@ function runCodacyAnalysis(files) {
 
 // src/lib/specs.ts
 var import_node_fs11 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_path10 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -13397,7 +13616,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   try {
     const entries = (0, import_node_fs11.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path9.join)(dir, entry.name);
+      const fullPath = (0, import_node_path10.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -13409,7 +13628,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path9.join)(process.env.HOME ?? "", ".claude", "plans");
+  const homePlansDir = (0, import_node_path10.join)(process.env.HOME ?? "", ".claude", "plans");
   const localPlansDir = ".claude/plans";
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -13419,7 +13638,7 @@ function discoverPlans() {
       for (const f of (0, import_node_fs11.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
-        const fullPath = (0, import_node_path9.join)(plansDir, f);
+        const fullPath = (0, import_node_path10.join)(plansDir, f);
         try {
           const stat3 = (0, import_node_fs11.statSync)(fullPath);
           candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
@@ -13444,7 +13663,7 @@ function discoverPlans() {
 
 // src/lib/snapshot.ts
 var import_node_fs12 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var import_node_child_process7 = require("node:child_process");
 function generateSnapshotDiffs(files) {
   if (!(0, import_node_fs12.existsSync)(SNAPSHOT_DIR)) {
@@ -13452,7 +13671,7 @@ function generateSnapshotDiffs(files) {
   }
   const diffs = [];
   for (const file of files) {
-    const snapshotPath = (0, import_node_path10.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path11.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
     if ((0, import_node_fs12.existsSync)(snapshotPath)) {
       const oldContent = (0, import_node_fs12.readFileSync)(snapshotPath, "utf-8");
@@ -13479,16 +13698,16 @@ ${addedLines}`,
 function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const snapshotPath = (0, import_node_path10.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path11.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs12.mkdirSync)((0, import_node_path11.dirname)(snapshotPath), { recursive: true });
     (0, import_node_fs12.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path10.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path10.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path11.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path11.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
     (0, import_node_fs12.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs12.writeFileSync)(tmpOld, oldContent);
@@ -13521,7 +13740,7 @@ function cleanStaleSnapshots(dir, keepSet) {
     const entries = (0, import_node_fs12.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
-      const fullPath = (0, import_node_path10.join)(dir, entry.name);
+      const fullPath = (0, import_node_path11.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
@@ -13542,7 +13761,7 @@ function cleanStaleSnapshots(dir, keepSet) {
 
 // src/lib/baseline.ts
 var import_node_fs13 = require("node:fs");
-var import_node_path11 = require("node:path");
+var import_node_path12 = require("node:path");
 var import_node_crypto5 = require("node:crypto");
 var BASELINE_VERSION = 1;
 var BASELINE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -13553,13 +13772,13 @@ function sessionKey(sessionId) {
   return (0, import_node_crypto5.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path11.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path12.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path11.join)(dir, "manifest.json");
+  return (0, import_node_path12.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path11.join)(dir, "files", repoRelPath);
+  return (0, import_node_path12.join)(dir, "files", repoRelPath);
 }
 function captureBaseline(opts = {}) {
   const key = sessionKey(opts.sessionId);
@@ -13575,7 +13794,7 @@ function captureBaseline(opts = {}) {
     (0, import_node_fs13.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path11.join)(dir, "files");
+  const filesDir = (0, import_node_path12.join)(dir, "files");
   const mirrored = [];
   try {
     (0, import_node_fs13.mkdirSync)(filesDir, { recursive: true });
@@ -13585,7 +13804,7 @@ function captureBaseline(opts = {}) {
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(dest), { recursive: true });
+        (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(dest), { recursive: true });
         (0, import_node_fs13.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
@@ -13713,7 +13932,7 @@ function pruneOldBaselines() {
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path11.join)(root, name);
+    const dir = (0, import_node_path12.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
@@ -13812,7 +14031,7 @@ function gatherContextFiles(contextPaths, deltaFiles) {
 
 // src/lib/cache-cleanup.ts
 var import_node_fs16 = require("node:fs");
-var import_node_path12 = require("node:path");
+var import_node_path13 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
@@ -13820,7 +14039,7 @@ function pruneStaleCache() {
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
     for (const entry of (0, import_node_fs16.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path12.join)(dir, entry);
+      const path = (0, import_node_path13.join)(dir, entry);
       try {
         const stat3 = (0, import_node_fs16.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
@@ -14211,9 +14430,9 @@ function capArray(set, max) {
 }
 
 // src/lib/seed-runner.ts
-var import_promises11 = require("node:fs/promises");
+var import_promises12 = require("node:fs/promises");
 var import_node_fs18 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_path14 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -14457,7 +14676,7 @@ async function runSeed(opts) {
   }
   let standardDoc;
   try {
-    const raw = await (0, import_promises11.readFile)(STANDARD_FILE, "utf-8");
+    const raw = await (0, import_promises12.readFile)(STANDARD_FILE, "utf-8");
     standardDoc = (0, import_yaml2.parse)(raw);
   } catch {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
@@ -14466,7 +14685,7 @@ async function runSeed(opts) {
   let readmeContent;
   if ((0, import_node_fs18.existsSync)("README.md")) {
     try {
-      readmeContent = await (0, import_promises11.readFile)("README.md", "utf-8");
+      readmeContent = await (0, import_promises12.readFile)("README.md", "utf-8");
     } catch {
     }
   }
@@ -14474,7 +14693,7 @@ async function runSeed(opts) {
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
     if ((0, import_node_fs18.existsSync)(p)) {
       try {
-        claudeMdContent = await (0, import_promises11.readFile)(p, "utf-8");
+        claudeMdContent = await (0, import_promises12.readFile)(p, "utf-8");
         break;
       } catch {
       }
@@ -14495,7 +14714,7 @@ async function runSeed(opts) {
   if (candidates.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path13.join)(MEMORY_DIR, "domain", "project-overview.md");
+  const overviewPath = (0, import_node_path14.join)(MEMORY_DIR, "domain", "project-overview.md");
   if ((0, import_node_fs18.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
@@ -14531,10 +14750,10 @@ async function runSeed(opts) {
     }
     const nodeId = res.data.node_id;
     const filePathRel = res.data.file_path;
-    const targetPath = (0, import_node_path13.join)(MEMORY_DIR, filePathRel);
+    const targetPath = (0, import_node_path14.join)(MEMORY_DIR, filePathRel);
     try {
-      await (0, import_promises11.mkdir)((0, import_node_path13.dirname)(targetPath), { recursive: true });
-      await (0, import_promises11.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
+      await (0, import_promises12.mkdir)((0, import_node_path14.dirname)(targetPath), { recursive: true });
+      await (0, import_promises12.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
     } catch (err) {
@@ -14586,6 +14805,27 @@ function passAndExit(reason) {
   printJsonCompact({ gate_decision: "PASS", systemMessage: `Verity: ${reason}` });
   process.exit(0);
 }
+var EMPTY_STATIC = {
+  tool: "@codacy/analysis-cli",
+  findings: [],
+  summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+};
+function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
+  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
+  let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
+  if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
+  if (scannable.length === 0) return EMPTY_STATIC;
+  return runCodacyAnalysis(scannable);
+}
+function localOnlyAndExit(staticResults) {
+  printJsonCompact({
+    gate_decision: "PASS",
+    systemMessage: "Verity: not authenticated \u2014 ran a local static-only check (no deep review, no upload). Run `verity init` to authenticate and enable the full quality gate.",
+    unauthenticated: true,
+    static_results: staticResults
+  });
+  process.exit(0);
+}
 function registerAnalyzeCommand(program2) {
   program2.command("analyze").description("Run Verity analysis on changed files (stop hook)").option("--debounce <seconds>", "Skip if last analysis was within N seconds", "30").option("--max-iterations <n>", "Force PASS after N FAIL cycles", "2").option("--max-files <n>", "Max files to send for review", "20").option("--max-file-size <bytes>", "Skip files larger than N bytes", "51200").option("--max-total-size <bytes>", "Stop collecting files at N total bytes", "194560").option("--skip-static", "Skip codacy-analysis").option("--mode <mode>", "Force analysis mode (standard|plan|debug|skip)").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -14636,12 +14876,9 @@ async function runAnalyze(opts, globals) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
   }
   const sessionIdForMemory = sessionId || process.env.CLAUDE_SESSION_ID || "";
   let contextFilePaths = [];
@@ -14797,7 +15034,7 @@ async function runAnalyze(opts, globals) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path14.join)(VERITY_DIR, ".seeded");
+    const seedMarker = (0, import_node_path15.join)(VERITY_DIR, ".seeded");
     const hasStandard = (0, import_node_fs19.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs19.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
@@ -15215,13 +15452,14 @@ async function runReview(opts, globals) {
   }
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-    process.exit(0);
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    printJsonCompact({
+      gate_decision: "PASS",
+      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      unauthenticated: true,
+      static_results: staticResults
+    });
     process.exit(0);
   }
   let specs;
@@ -15290,9 +15528,9 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs22 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_path16 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path15.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path16.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve) => {
@@ -15607,13 +15845,14 @@ function writeBlockMessage(moment, response) {
 
 // src/commands/init.ts
 var import_node_fs24 = require("node:fs");
-var import_promises12 = require("node:fs/promises");
-var import_node_path17 = require("node:path");
+var import_promises13 = require("node:fs/promises");
+var import_node_path18 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
+var readline = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs23 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 var import_node_child_process8 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -15649,8 +15888,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path16.join)(root, ".gate");
-  const verityDir = (0, import_node_path16.join)(root, ".verity");
+  const gateDir = (0, import_node_path17.join)(root, ".gate");
+  const verityDir = (0, import_node_path17.join)(root, ".verity");
   if ((0, import_node_fs23.existsSync)(gateDir) && !(0, import_node_fs23.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -15704,11 +15943,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path16.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path16.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path17.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path17.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs23.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs23.existsSync)(verityCreds)) {
-    (0, import_node_fs23.mkdirSync)((0, import_node_path16.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs23.mkdirSync)((0, import_node_path17.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -15730,7 +15969,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path16.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path17.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs23.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -15741,8 +15980,8 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path16.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path16.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path17.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path17.join)(root, "VERITY.md");
   if (!(0, import_node_fs23.existsSync)(gateMd) || (0, import_node_fs23.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
@@ -15830,15 +16069,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
-    const srcDir = (0, import_node_path16.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path17.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs23.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path16.join)(relDir, entry) : entry;
-      const src = (0, import_node_path16.join)(gateDir, rel);
-      const dest = (0, import_node_path16.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path17.join)(relDir, entry) : entry;
+      const src = (0, import_node_path17.join)(gateDir, rel);
+      const dest = (0, import_node_path17.join)(verityDir, rel);
       if ((0, import_node_fs23.statSync)(src).isDirectory()) {
         walk(rel);
       } else if (!(0, import_node_fs23.existsSync)(dest)) {
-        (0, import_node_fs23.mkdirSync)((0, import_node_path16.dirname)(dest), { recursive: true });
+        (0, import_node_fs23.mkdirSync)((0, import_node_path17.dirname)(dest), { recursive: true });
         (0, import_node_fs23.cpSync)(src, dest);
         copied++;
       }
@@ -15848,22 +16087,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path16.join)(root, ".gate");
-  const verityDir = (0, import_node_path16.join)(root, ".verity");
+  const gateDir = (0, import_node_path17.join)(root, ".gate");
+  const verityDir = (0, import_node_path17.join)(root, ".verity");
   if ((0, import_node_fs23.existsSync)(gateDir) && !(0, import_node_fs23.existsSync)(verityDir)) return true;
   if ((0, import_node_fs23.existsSync)(gateDir) && (0, import_node_fs23.existsSync)(verityDir)) {
-    if ((0, import_node_fs23.existsSync)((0, import_node_path16.join)(gateDir, "credentials")) && !(0, import_node_fs23.existsSync)((0, import_node_path16.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs23.existsSync)((0, import_node_path17.join)(gateDir, "credentials")) && !(0, import_node_fs23.existsSync)((0, import_node_path17.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs23.existsSync)((0, import_node_path16.join)(gateDir, "memory")) && !(0, import_node_fs23.existsSync)((0, import_node_path16.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs23.existsSync)((0, import_node_path17.join)(gateDir, "memory")) && !(0, import_node_fs23.existsSync)((0, import_node_path17.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path16.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path17.join)(root, "CLAUDE.md");
   if ((0, import_node_fs23.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs23.existsSync)((0, import_node_path16.join)(root, "GATE.md")) && !(0, import_node_fs23.existsSync)((0, import_node_path16.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs23.existsSync)((0, import_node_path17.join)(root, "GATE.md")) && !(0, import_node_fs23.existsSync)((0, import_node_path17.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -15889,17 +16128,77 @@ function registerMigrateCommand(program2) {
 }
 
 // src/commands/init.ts
+async function promptYes(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runOptionalAuth() {
+  const existing = await resolveToken();
+  if (existing.ok) {
+    printInfo("Already authenticated \u2014 results will upload to the Verity service. \u2713");
+    return;
+  }
+  let remote = "";
+  try {
+    remote = (0, import_node_child_process9.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+  }
+  const localOnlyNote = () => {
+    printInfo("Verity runs in local-only mode: the gate still runs and shows static findings, but nothing uploads.");
+    printInfo('  Authenticate anytime: run "verity init" again, or "verity auth register".');
+  };
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    console.log("");
+    console.log("  Signing in is optional. What it does:");
+    console.log("    - Confirms you have write access to this repository. The GitHub token");
+    console.log("      is used once to verify that, then discarded \u2014 Verity never stores it.");
+    console.log("    - It does NOT give Verity access to your code. Code checked by the gate");
+    console.log("      is analyzed in memory and discarded \u2014 we never store your code.");
+    console.log("    - It is required to store and access run history for this repo");
+    console.log("      (past results, trends, and shareable reports).");
+    console.log("    - Skip and Verity still works fully locally: the gate runs and shows");
+    console.log("      findings, but nothing is uploaded.");
+    console.log("");
+  }
+  const wantsAuth = await promptYes("Authenticate with GitHub now to upload results to Verity? [Y/skip] ");
+  if (!wantsAuth) {
+    printInfo("Skipped authentication.");
+    localOnlyNote();
+    return;
+  }
+  if (!remote) {
+    printWarn("No git remote found \u2014 cannot authenticate yet.");
+    localOnlyNote();
+    return;
+  }
+  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path18.basename)(process.cwd());
+  printInfo("Authenticating with GitHub\u2026");
+  const result = await registerProject({ projectName, remote, serviceUrl: DEFAULT_SERVICE_URL });
+  if (result.ok) {
+    printInfo(`Project registered: ${result.data.projectId} \u2713`);
+    if (result.data.email) printInfo(`  Authenticated as: ${result.data.email}`);
+  } else {
+    printWarn(`Authentication did not complete: ${result.error}`);
+    localOnlyNote();
+  }
+}
 function resolveDataDir() {
   const candidates = [
-    (0, import_node_path17.join)(__dirname, "..", "data"),
+    (0, import_node_path18.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path17.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path18.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path17.join)(process.cwd(), "cli", "data")
+    (0, import_node_path18.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs24.existsSync)((0, import_node_path17.join)(candidate, "skills"))) {
+    if ((0, import_node_fs24.existsSync)((0, import_node_path18.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -15908,8 +16207,8 @@ function resolveDataDir() {
   );
 }
 async function copyDir(src, dest) {
-  await (0, import_promises12.mkdir)(dest, { recursive: true });
-  await (0, import_promises12.cp)(src, dest, { recursive: true, force: true });
+  await (0, import_promises13.mkdir)(dest, { recursive: true });
+  await (0, import_promises13.cp)(src, dest, { recursive: true, force: true });
 }
 function registerInitCommand(program2) {
   program2.command("init").description("Initialize Verity in the current project").option("--force", "Overwrite existing skills and hooks").action(async (opts) => {
@@ -15978,24 +16277,24 @@ function registerInitCommand(program2) {
     console.log("");
     printInfo("Installing skills...");
     const dataDir = resolveDataDir();
-    const skillsSource = (0, import_node_path17.join)(dataDir, "skills");
+    const skillsSource = (0, import_node_path18.join)(dataDir, "skills");
     const skillsDest = ".claude/skills";
     const skills = ["verity-setup", "verity-analyze", "verity-status", "verity-feedback", "verity-learn", "verity-memory", "verity-insights", "verity-reflect"];
     let skillsInstalled = 0;
     for (const skill of skills) {
-      const src = (0, import_node_path17.join)(skillsSource, skill);
-      const dest = (0, import_node_path17.join)(skillsDest, skill);
+      const src = (0, import_node_path18.join)(skillsSource, skill);
+      const dest = (0, import_node_path18.join)(skillsDest, skill);
       if (!(0, import_node_fs24.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
       if ((0, import_node_fs24.existsSync)(dest) && !force) {
-        const srcSkill = (0, import_node_path17.join)(src, "SKILL.md");
-        const destSkill = (0, import_node_path17.join)(dest, "SKILL.md");
+        const srcSkill = (0, import_node_path18.join)(src, "SKILL.md");
+        const destSkill = (0, import_node_path18.join)(dest, "SKILL.md");
         if ((0, import_node_fs24.existsSync)(destSkill)) {
           try {
-            const srcContent = await (0, import_promises12.readFile)(srcSkill, "utf-8");
-            const destContent = await (0, import_promises12.readFile)(destSkill, "utf-8");
+            const srcContent = await (0, import_promises13.readFile)(srcSkill, "utf-8");
+            const destContent = await (0, import_promises13.readFile)(destSkill, "utf-8");
             if (srcContent === destContent) {
               skillsInstalled++;
               continue;
@@ -16021,7 +16320,7 @@ function registerInitCommand(program2) {
       printWarn(`  ${hookResult.error}`);
       printInfo('  Run "verity hooks install --force" to overwrite.');
     }
-    await (0, import_promises12.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises13.mkdir)(VERITY_DIR, { recursive: true });
     await ensureMemoryDir();
     try {
       await ensureClaudeMdPointer();
@@ -16029,8 +16328,14 @@ function registerInitCommand(program2) {
     } catch (err) {
       printWarn(`  Could not update CLAUDE.md: ${err.message}`);
     }
-    const globalVerityDir = (0, import_node_path17.join)(process.env.HOME ?? "", ".verity");
-    await (0, import_promises12.mkdir)(globalVerityDir, { recursive: true });
+    const globalVerityDir = (0, import_node_path18.join)(process.env.HOME ?? "", ".verity");
+    await (0, import_promises13.mkdir)(globalVerityDir, { recursive: true });
+    console.log("");
+    try {
+      await runOptionalAuth();
+    } catch (err) {
+      printWarn(`Authentication step skipped: ${err.message}`);
+    }
     console.log("");
     printInfo("Verity initialized!");
     console.log("");
@@ -16047,13 +16352,14 @@ function registerInitCommand(program2) {
     console.log("    .verity/memory/                  \u2014 knowledge base (8 domains, commit to git)");
     console.log("");
     console.log("  Next step: open this project in Claude Code and run /verity-setup");
+    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity auth register".)');
     console.log("");
   });
 }
 
 // src/commands/uninstall.ts
 var import_node_fs25 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_path19 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -16072,7 +16378,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path18.join)(skillsRoot, name);
+      const dir = (0, import_node_path19.join)(skillsRoot, name);
       if ((0, import_node_fs25.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
@@ -16118,7 +16424,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path18.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path19.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs25.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -16317,7 +16623,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs26 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -16358,7 +16664,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs26.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs26.unlinkSync)((0, import_node_path19.join)(cacheDir, entry));
+            (0, import_node_fs26.unlinkSync)((0, import_node_path20.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -16385,7 +16691,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs26.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs26.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs26.unlinkSync)((0, import_node_path19.join)(logsDir, entry));
+            (0, import_node_fs26.unlinkSync)((0, import_node_path20.join)(logsDir, entry));
           } catch {
           }
         }
@@ -16643,8 +16949,7 @@ function registerRunCommand(program2) {
 }
 
 // src/lib/telemetry.ts
-var import_promises13 = require("node:fs/promises");
-var import_node_path20 = require("node:path");
+var import_promises14 = require("node:fs/promises");
 var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
 var GITIGNORE_FILE = ".gitignore";
 var GITIGNORE_ENTRY = ".claude/settings.local.json";
@@ -16675,21 +16980,19 @@ function buildTelemetryEnv(serviceUrl, token) {
 var VERITY_TELEMETRY_KEYS = Object.keys(buildTelemetryEnv("", ""));
 async function readSettingsLocal() {
   try {
-    return JSON.parse(await (0, import_promises13.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
+    return JSON.parse(await (0, import_promises14.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsLocal(settings) {
-  const file = projectPath(SETTINGS_LOCAL_FILE2);
-  await (0, import_promises13.mkdir)((0, import_node_path20.dirname)(file), { recursive: true });
-  await (0, import_promises13.writeFile)(file, JSON.stringify(settings, null, 2) + "\n");
+  await writeJsonFilePreservingStyle(projectPath(SETTINGS_LOCAL_FILE2), settings);
 }
 async function ensureGitignore() {
   const file = projectPath(GITIGNORE_FILE);
   let content = "";
   try {
-    content = await (0, import_promises13.readFile)(file, "utf-8");
+    content = await (0, import_promises14.readFile)(file, "utf-8");
   } catch {
   }
   const lines = content.split("\n").map((l) => l.trim());
@@ -16698,7 +17001,7 @@ async function ensureGitignore() {
   }
   const block = "# Verity telemetry \u2014 holds your project token\n" + GITIGNORE_ENTRY + "\n";
   const next = content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block;
-  await (0, import_promises13.writeFile)(file, next);
+  await (0, import_promises14.writeFile)(file, next);
 }
 async function installTelemetry(serviceUrl, token) {
   const env = buildTelemetryEnv(serviceUrl, token);
@@ -16778,7 +17081,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.25.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.26.0-experimental.a2dc844").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);