@codacy/verity-cli 0.26.0-experimental.d7dfc00 → 0.26.0

package/bin/verity.js

@@ -10325,7 +10325,9 @@ var {
 } = import_index.default;
 
 // src/commands/auth.ts
-var import_node_child_process4 = require("node:child_process");
+var import_promises3 = require("node:fs/promises");
+var import_node_child_process3 = require("node:child_process");
+var import_node_path2 = require("node:path");
 
 // src/lib/auth.ts
 var import_promises = require("node:fs/promises");
@@ -10473,11 +10475,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
-var GITHUB_CLIENT_ID = "Ov23liBpj42KMTtUtN10";
-var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
-var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var GITHUB_OAUTH_SCOPES = "repo user:email";
+var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10643,8 +10641,7 @@ async function apiRequest(options) {
     timeout = 9e4,
     cmd = "unknown",
     retry = false,
-    encodeBody = false,
-    extraHeaders
+    encodeBody = false
   } = options;
   const url = `${serviceUrl}${path}`;
   const headers = {
@@ -10653,9 +10650,6 @@ async function apiRequest(options) {
   if (token) {
     headers["Authorization"] = `Bearer ${token}`;
   }
-  if (extraHeaders) {
-    Object.assign(headers, extraHeaders);
-  }
   const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
   if (testMockScenario) {
     headers["X-Verity-Mock-Scenario"] = testMockScenario;
@@ -10746,388 +10740,6 @@ function analyzeRequest(options) {
   });
 }
 
-// src/lib/register.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
-
-// src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-var form = (fields) => new URLSearchParams(fields).toString();
-async function githubDeviceFlow() {
-  const override = process.env.VERITY_PROVIDER_TOKEN;
-  if (override) return { ok: true, data: override };
-  let dc;
-  try {
-    const res = await fetch(GITHUB_DEVICE_CODE_URL, {
-      method: "POST",
-      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
-      body: form({ client_id: GITHUB_CLIENT_ID, scope: GITHUB_OAUTH_SCOPES })
-    });
-    if (!res.ok) {
-      return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
-    }
-    dc = await res.json();
-  } catch (err) {
-    return { ok: false, error: `Network error contacting GitHub: ${err.message}` };
-  }
-  if (!dc.device_code || !dc.user_code) {
-    return {
-      ok: false,
-      error: "GitHub did not return a device code (is Device Flow enabled on the OAuth app?)"
-    };
-  }
-  printInfo("");
-  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
-  printInfo(`And enter the code:         ${dc.user_code}`);
-  printInfo("Waiting for authorization\u2026");
-  const deadline = Date.now() + (dc.expires_in || 900) * 1e3;
-  let interval = dc.interval || 5;
-  while (Date.now() < deadline) {
-    await sleep(interval * 1e3);
-    let data;
-    try {
-      const res = await fetch(GITHUB_ACCESS_TOKEN_URL, {
-        method: "POST",
-        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
-        body: form({
-          client_id: GITHUB_CLIENT_ID,
-          device_code: dc.device_code,
-          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-        })
-      });
-      data = await res.json().catch(() => ({}));
-    } catch {
-      continue;
-    }
-    if (data.access_token) return { ok: true, data: data.access_token };
-    switch (data.error) {
-      case "authorization_pending":
-        break;
-      case "slow_down":
-        interval += 5;
-        break;
-      case "access_denied":
-        return { ok: false, error: "Authorization was denied on GitHub." };
-      case "expired_token":
-        return { ok: false, error: "The authorization code expired. Re-run register." };
-      default:
-        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
-    }
-  }
-  return { ok: false, error: "Timed out waiting for GitHub authorization." };
-}
-
-// src/lib/git.ts
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs2 = require("node:fs");
-var import_node_path2 = require("node:path");
-function resolveFile(relpath) {
-  if ((0, import_node_fs2.existsSync)(relpath)) return relpath;
-  if ((0, import_node_fs2.existsSync)(".claude/worktrees")) {
-    try {
-      const entries = (0, import_node_fs2.readdirSync)(".claude/worktrees", { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const candidate = (0, import_node_path2.join)(".claude/worktrees", entry.name, relpath);
-        if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function execGit(cmd) {
-  try {
-    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function splitLines(s) {
-  return s.split("\n").filter((l) => l.length > 0);
-}
-var SHA_RE = /^[0-9a-f]{40}$/;
-function readBaselineSha() {
-  if (!(0, import_node_fs2.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs2.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
-    try {
-      (0, import_node_fs2.unlinkSync)(BASELINE_SHA_FILE);
-    } catch {
-    }
-    return null;
-  }
-  return sha;
-}
-function writeBaselineSha(sha) {
-  if (!SHA_RE.test(sha)) return;
-  try {
-    (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs2.writeFileSync)(BASELINE_SHA_FILE, sha);
-  } catch {
-  }
-}
-function getChangedFiles() {
-  const sets = /* @__PURE__ */ new Set();
-  let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
-    if (committed.length > 0) {
-      hasRecentCommitFiles = true;
-      for (const f of committed) sets.add(f);
-    }
-  } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
-    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
-    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
-      if (recentFiles.length > 0) {
-        hasRecentCommitFiles = true;
-        for (const f of recentFiles) sets.add(f);
-      }
-    }
-  }
-  for (const f of getWorktreeFiles()) sets.add(f);
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  return { files: filtered, hasRecentCommitFiles };
-}
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function getDirtyFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function showContentAtRef(ref, repoRelPath) {
-  if (!ref || ref === "no-git") return null;
-  const normalizedPath = repoRelPath.replace(/\\/g, "/");
-  try {
-    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch {
-    return null;
-  }
-}
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGit("git rev-parse --abbrev-ref HEAD");
-      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve of resolvers) {
-    const range = resolve();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
-function getWorktreeFiles() {
-  const result = [];
-  const worktreeDir = ".claude/worktrees";
-  if (!(0, import_node_fs2.existsSync)(worktreeDir)) return result;
-  try {
-    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
-    const entries = (0, import_node_fs2.readdirSync)(worktreeDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const wtDir = (0, import_node_path2.join)(worktreeDir, entry.name);
-      scanDir(wtDir, wtDir, fiveMinAgo, result);
-    }
-  } catch {
-  }
-  return result;
-}
-function scanDir(baseDir, dir, minMtime, result) {
-  try {
-    const entries = (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = (0, import_node_path2.join)(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".git") continue;
-        scanDir(baseDir, fullPath, minMtime, result);
-      } else if (entry.isFile()) {
-        const ext = (0, import_node_path2.extname)(entry.name).slice(1);
-        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
-        try {
-          const stat3 = (0, import_node_fs2.statSync)(fullPath);
-          if (stat3.mtimeMs >= minMtime) {
-            const relPath = fullPath.slice(baseDir.length + 1);
-            result.push(relPath);
-          }
-        } catch {
-        }
-      }
-    }
-  } catch {
-  }
-}
-function filterAnalyzable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path2.extname)(f).slice(1);
-    return ANALYZABLE_EXTENSIONS.has(ext);
-  });
-}
-function filterReviewable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path2.extname)(f).slice(1);
-    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
-    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename3 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
-    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
-    return false;
-  });
-}
-function filterSecurity(files) {
-  return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
-  );
-}
-function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
-}
-function detectProvider(host) {
-  const h = host.toLowerCase();
-  if (h.includes("github")) return "github";
-  if (h.includes("gitlab")) return "gitlab";
-  if (h.includes("bitbucket")) return "bitbucket";
-  return "unknown";
-}
-function parseRemote(raw) {
-  if (!raw || typeof raw !== "string") return null;
-  let s = raw.trim();
-  if (!s) return null;
-  let host = "";
-  let path = "";
-  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
-  if (scp) {
-    host = scp[1];
-    path = scp[2];
-  } else {
-    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
-    s = s.replace(/^[^/@]+@/, "");
-    const slash = s.indexOf("/");
-    if (slash === -1) return null;
-    host = s.slice(0, slash);
-    path = s.slice(slash + 1);
-  }
-  host = host.toLowerCase().trim();
-  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
-  if (!host || !path) return null;
-  const segments = path.split("/").filter(Boolean);
-  if (segments.length < 2) return null;
-  const owner = segments[0];
-  const repo = segments[segments.length - 1];
-  if (!owner || !repo) return null;
-  return {
-    host,
-    owner,
-    repo,
-    provider: detectProvider(host),
-    orgUrl: `https://${host}/${owner}`,
-    orgName: owner
-  };
-}
-function listTrackedFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set);
-}
-
-// src/lib/register.ts
-async function registerProject(opts) {
-  const parsed = parseRemote(opts.remote);
-  if (!parsed) {
-    return { ok: false, error: `Could not parse git remote: ${opts.remote}` };
-  }
-  if (parsed.provider !== "github") {
-    return { ok: false, error: `Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.` };
-  }
-  const providerAuth = await githubDeviceFlow();
-  if (!providerAuth.ok) {
-    return { ok: false, error: providerAuth.error };
-  }
-  const providerToken = providerAuth.data;
-  const result = await apiRequest({
-    method: "POST",
-    path: "/auth/register",
-    serviceUrl: opts.serviceUrl,
-    body: { project_name: opts.projectName, git_remote_url: opts.remote },
-    extraHeaders: { "X-Provider-Token": providerToken },
-    verbose: opts.verbose
-  });
-  if (!result.ok) {
-    return { ok: false, error: result.error };
-  }
-  const { project_id, token, service_url, user } = result.data;
-  try {
-    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(
-      CREDENTIALS_FILE,
-      `token: ${token}
-service_url: ${service_url}
-provider_token: ${providerToken}
-`,
-      { mode: 384 }
-    );
-    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
-    });
-  } catch (err) {
-    return {
-      ok: false,
-      error: `Registered with the Verity service, but could not save credentials to ${CREDENTIALS_FILE}: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
-    };
-  }
-  try {
-    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-    await (0, import_promises3.appendFile)(
-      GLOBAL_CREDENTIALS_FILE,
-      `${opts.remote} token: ${token}
-${opts.remote} provider_token: ${providerToken}
-`,
-      { mode: 384 }
-    );
-    await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
-    });
-  } catch {
-  }
-  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email: user?.email } };
-}
-
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage project authentication");
@@ -11137,26 +10749,36 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
       }
     }
-    const result = await registerProject({
-      projectName: opts.project,
-      remote,
+    const result = await apiRequest({
+      method: "POST",
+      path: "/auth/register",
       serviceUrl,
+      body: { project_name: opts.project, git_remote_url: remote },
       verbose: globals.verbose
     });
     if (!result.ok) {
       printError(result.error);
       process.exit(1);
     }
-    const { projectId, serviceUrl: resolvedUrl, email } = result.data;
-    printInfo(`Project registered: ${projectId}`);
-    if (email) printInfo(`Authenticated as: ${email}`);
-    printJson({ project_id: projectId, service_url: resolvedUrl });
+    const { project_id, token, service_url } = result.data;
+    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises3.writeFile)(CREDENTIALS_FILE, `token: ${token}
+service_url: ${service_url}
+`);
+    try {
+      await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
+      await (0, import_promises3.appendFile)(GLOBAL_CREDENTIALS_FILE, `${remote} token: ${token}
+`);
+    } catch {
+    }
+    printInfo(`Project registered: ${project_id}`);
+    printJson({ project_id, service_url });
   });
   auth.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
@@ -11189,7 +10811,7 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -11217,11 +10839,11 @@ function registerAuthCommands(program2) {
 
 // src/lib/hooks.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_path4 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path4 = require("node:path");
+var import_node_path3 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -11267,7 +10889,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
+  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(file), { recursive: true });
   await (0, import_promises4.writeFile)(file, next);
   return true;
 }
@@ -11428,13 +11050,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -11674,8 +11296,8 @@ var import_node_crypto3 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs3 = require("node:fs");
-var import_node_child_process5 = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_child_process4 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
@@ -11710,7 +11332,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs3.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs2.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -11734,7 +11356,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs3.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs2.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises6.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises6.unlink)(INTENT_FILE).catch(() => {
@@ -11778,7 +11400,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process5.execSync)(
+    const output = (0, import_node_child_process4.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -11791,8 +11413,8 @@ function getRecentCommitMessages() {
 
 // src/lib/task-context-buffer.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_fs4 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs3 = require("node:fs");
+var import_node_path5 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -11831,7 +11453,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs4.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs3.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises7.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -11865,12 +11487,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs4.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs3.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises7.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path6.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path5.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises7.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -11884,13 +11506,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path6.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path5.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises7.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs4.existsSync)(filePath)) {
+    if ((0, import_node_fs3.existsSync)(filePath)) {
       const stats = await (0, import_promises7.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises7.readFile)(filePath, "utf-8");
@@ -11901,7 +11523,7 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises7.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs3.existsSync)(filePath) ? await (0, import_promises7.readFile)(filePath, "utf-8") : "";
     await (0, import_promises7.writeFile)(filePath, existing + line);
   } catch {
   }
@@ -11909,8 +11531,8 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path6 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -12003,19 +11625,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  if (!(0, import_node_fs5.existsSync)(memoryDir())) return null;
+  if (!(0, import_node_fs4.existsSync)(memoryDir())) return null;
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path7.join)(memoryDir(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path6.join)(memoryDir(), domain);
+    if (!(0, import_node_fs4.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -12074,8 +11696,8 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 
 // src/lib/memory-sync.ts
 var import_promises9 = require("node:fs/promises");
-var import_node_fs6 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path7 = require("node:path");
 var import_node_crypto2 = require("node:crypto");
 
 // src/lib/glob-match.ts
@@ -12146,32 +11768,32 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path8.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path7.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs6.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs5.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path8.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path7.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -12184,13 +11806,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto2.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -12201,15 +11823,15 @@ function hashContent(content) {
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs6.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs5.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -12255,8 +11877,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path8.join)(memoryDir2(), path);
-    if (!(0, import_node_fs6.existsSync)(full)) continue;
+    const full = (0, import_node_path7.join)(memoryDir2(), path);
+    if (!(0, import_node_fs5.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises9.readFile)(full, "utf-8");
@@ -12292,15 +11914,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path8.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path7.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -12310,7 +11932,7 @@ async function applyOneWrite(write, treePaths) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs6.existsSync)(fullPath)) {
+  if ((0, import_node_fs5.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
@@ -12322,7 +11944,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path8.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path7.dirname)(fullPath), { recursive: true });
   await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -12363,8 +11985,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -12374,7 +11996,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -12398,7 +12020,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path8.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path7.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
@@ -12480,9 +12102,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path8.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path7.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs5.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -12612,7 +12234,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/commands/intent.ts
-var import_node_fs7 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 function registerIntentCommands(program2) {
   const intent = program2.command("intent").description("Manage intent capture");
   intent.command("capture").description("Capture user intent from stdin (used by UserPromptSubmit hook)").action(async () => {
@@ -12621,7 +12243,7 @@ function registerIntentCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs7.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs6.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       const chunks = [];
@@ -13200,6 +12822,215 @@ async function sendGeneralFeedback(message, opts, globals) {
 var import_node_fs19 = require("node:fs");
 var import_node_path15 = require("node:path");
 
+// src/lib/git.ts
+var import_node_child_process5 = require("node:child_process");
+var import_node_fs7 = require("node:fs");
+var import_node_path8 = require("node:path");
+function resolveFile(relpath) {
+  if ((0, import_node_fs7.existsSync)(relpath)) return relpath;
+  if ((0, import_node_fs7.existsSync)(".claude/worktrees")) {
+    try {
+      const entries = (0, import_node_fs7.readdirSync)(".claude/worktrees", { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const candidate = (0, import_node_path8.join)(".claude/worktrees", entry.name, relpath);
+        if ((0, import_node_fs7.existsSync)(candidate)) return candidate;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function execGit(cmd) {
+  try {
+    return (0, import_node_child_process5.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function splitLines(s) {
+  return s.split("\n").filter((l) => l.length > 0);
+}
+var SHA_RE = /^[0-9a-f]{40}$/;
+function readBaselineSha() {
+  if (!(0, import_node_fs7.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs7.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (!SHA_RE.test(sha)) return null;
+  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  if (!reachable) {
+    try {
+      (0, import_node_fs7.unlinkSync)(BASELINE_SHA_FILE);
+    } catch {
+    }
+    return null;
+  }
+  return sha;
+}
+function writeBaselineSha(sha) {
+  if (!SHA_RE.test(sha)) return;
+  try {
+    (0, import_node_fs7.mkdirSync)((0, import_node_path8.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs7.writeFileSync)(BASELINE_SHA_FILE, sha);
+  } catch {
+  }
+}
+function getChangedFiles() {
+  const sets = /* @__PURE__ */ new Set();
+  let hasRecentCommitFiles = false;
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
+  } else {
+    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
+    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
+      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      if (recentFiles.length > 0) {
+        hasRecentCommitFiles = true;
+        for (const f of recentFiles) sets.add(f);
+      }
+    }
+  }
+  for (const f of getWorktreeFiles()) sets.add(f);
+  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return { files: filtered, hasRecentCommitFiles };
+}
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getDirtyFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function showContentAtRef(ref, repoRelPath) {
+  if (!ref || ref === "no-git") return null;
+  const normalizedPath = repoRelPath.replace(/\\/g, "/");
+  try {
+    return (0, import_node_child_process5.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve of resolvers) {
+    const range = resolve();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
+function getPushRangeMessages() {
+  const { range } = getPushRangeFiles();
+  if (!range) return "";
+  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function getWorktreeFiles() {
+  const result = [];
+  const worktreeDir = ".claude/worktrees";
+  if (!(0, import_node_fs7.existsSync)(worktreeDir)) return result;
+  try {
+    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
+    const entries = (0, import_node_fs7.readdirSync)(worktreeDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const wtDir = (0, import_node_path8.join)(worktreeDir, entry.name);
+      scanDir(wtDir, wtDir, fiveMinAgo, result);
+    }
+  } catch {
+  }
+  return result;
+}
+function scanDir(baseDir, dir, minMtime, result) {
+  try {
+    const entries = (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path8.join)(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".git") continue;
+        scanDir(baseDir, fullPath, minMtime, result);
+      } else if (entry.isFile()) {
+        const ext = (0, import_node_path8.extname)(entry.name).slice(1);
+        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
+        try {
+          const stat3 = (0, import_node_fs7.statSync)(fullPath);
+          if (stat3.mtimeMs >= minMtime) {
+            const relPath = fullPath.slice(baseDir.length + 1);
+            result.push(relPath);
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function filterAnalyzable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path8.extname)(f).slice(1);
+    return ANALYZABLE_EXTENSIONS.has(ext);
+  });
+}
+function filterReviewable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path8.extname)(f).slice(1);
+    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
+    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
+    const basename2 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
+    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
+    return false;
+  });
+}
+function filterSecurity(files) {
+  return files.filter(
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+  );
+}
+function getCurrentCommit() {
+  return execGit("git rev-parse HEAD") || "no-git";
+}
+function listTrackedFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set);
+}
+
 // src/lib/files.ts
 var import_node_fs8 = require("node:fs");
 var import_node_path9 = require("node:path");
@@ -14807,27 +14638,6 @@ function passAndExit(reason) {
   printJsonCompact({ gate_decision: "PASS", systemMessage: `Verity: ${reason}` });
   process.exit(0);
 }
-var EMPTY_STATIC = {
-  tool: "@codacy/analysis-cli",
-  findings: [],
-  summary: { total_findings: 0, by_severity: {}, tools_run: [] }
-};
-function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
-  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
-  let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
-  if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
-  if (scannable.length === 0) return EMPTY_STATIC;
-  return runCodacyAnalysis(scannable);
-}
-function localOnlyAndExit(staticResults) {
-  printJsonCompact({
-    gate_decision: "PASS",
-    systemMessage: "Verity: not authenticated \u2014 ran a local static-only check (no deep review, no upload). Run `verity init` to authenticate and enable the full quality gate.",
-    unauthenticated: true,
-    static_results: staticResults
-  });
-  process.exit(0);
-}
 function registerAnalyzeCommand(program2) {
   program2.command("analyze").description("Run Verity analysis on changed files (stop hook)").option("--debounce <seconds>", "Skip if last analysis was within N seconds", "30").option("--max-iterations <n>", "Force PASS after N FAIL cycles", "2").option("--max-files <n>", "Max files to send for review", "20").option("--max-file-size <bytes>", "Skip files larger than N bytes", "51200").option("--max-total-size <bytes>", "Stop collecting files at N total bytes", "194560").option("--skip-static", "Skip codacy-analysis").option("--mode <mode>", "Force analysis mode (standard|plan|debug|skip)").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -14878,9 +14688,12 @@ async function runAnalyze(opts, globals) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
   const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!tokenResult.ok || !urlResult.ok) {
-    localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
+  if (!urlResult.ok) {
+    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
   }
   const sessionIdForMemory = sessionId || process.env.CLAUDE_SESSION_ID || "";
   let contextFilePaths = [];
@@ -15454,14 +15267,13 @@ async function runReview(opts, globals) {
   }
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
+  if (!tokenResult.ok) {
+    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+    process.exit(0);
+  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!tokenResult.ok || !urlResult.ok) {
-    printJsonCompact({
-      gate_decision: "PASS",
-      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
-      unauthenticated: true,
-      static_results: staticResults
-    });
+  if (!urlResult.ok) {
+    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
     process.exit(0);
   }
   let specs;
@@ -15850,7 +15662,6 @@ var import_node_fs24 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path18 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
-var readline = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs23 = require("node:fs");
@@ -16130,66 +15941,6 @@ function registerMigrateCommand(program2) {
 }
 
 // src/commands/init.ts
-async function promptYes(question) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = (await rl.question(question)).trim().toLowerCase();
-    return answer === "" || answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
-}
-async function runOptionalAuth() {
-  const existing = await resolveToken();
-  if (existing.ok) {
-    printInfo("Already authenticated \u2014 results will upload to the Verity service. \u2713");
-    return;
-  }
-  let remote = "";
-  try {
-    remote = (0, import_node_child_process9.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-  }
-  const localOnlyNote = () => {
-    printInfo("Verity runs in local-only mode: the gate still runs and shows static findings, but nothing uploads.");
-    printInfo('  Authenticate anytime: run "verity init" again, or "verity auth register".');
-  };
-  if (process.stdin.isTTY && process.stdout.isTTY) {
-    console.log("");
-    console.log("  Signing in is optional. What it does:");
-    console.log("    - Confirms you have write access to this repository. The GitHub token");
-    console.log("      is used once to verify that, then discarded \u2014 Verity never stores it.");
-    console.log("    - It does NOT give Verity access to your code. Code checked by the gate");
-    console.log("      is analyzed in memory and discarded \u2014 we never store your code.");
-    console.log("    - It is required to store and access run history for this repo");
-    console.log("      (past results, trends, and shareable reports).");
-    console.log("    - Skip and Verity still works fully locally: the gate runs and shows");
-    console.log("      findings, but nothing is uploaded.");
-    console.log("");
-  }
-  const wantsAuth = await promptYes("Authenticate with GitHub now to upload results to Verity? [Y/skip] ");
-  if (!wantsAuth) {
-    printInfo("Skipped authentication.");
-    localOnlyNote();
-    return;
-  }
-  if (!remote) {
-    printWarn("No git remote found \u2014 cannot authenticate yet.");
-    localOnlyNote();
-    return;
-  }
-  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path18.basename)(process.cwd());
-  printInfo("Authenticating with GitHub\u2026");
-  const result = await registerProject({ projectName, remote, serviceUrl: DEFAULT_SERVICE_URL });
-  if (result.ok) {
-    printInfo(`Project registered: ${result.data.projectId} \u2713`);
-    if (result.data.email) printInfo(`  Authenticated as: ${result.data.email}`);
-  } else {
-    printWarn(`Authentication did not complete: ${result.error}`);
-    localOnlyNote();
-  }
-}
 function resolveDataDir() {
   const candidates = [
     (0, import_node_path18.join)(__dirname, "..", "data"),
@@ -16333,12 +16084,6 @@ function registerInitCommand(program2) {
     const globalVerityDir = (0, import_node_path18.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises13.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
-    try {
-      await runOptionalAuth();
-    } catch (err) {
-      printWarn(`Authentication step skipped: ${err.message}`);
-    }
-    console.log("");
     printInfo("Verity initialized!");
     console.log("");
     console.log("  Installed:");
@@ -16354,7 +16099,6 @@ function registerInitCommand(program2) {
     console.log("    .verity/memory/                  \u2014 knowledge base (8 domains, commit to git)");
     console.log("");
     console.log("  Next step: open this project in Claude Code and run /verity-setup");
-    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity auth register".)');
     console.log("");
   });
 }
@@ -17083,7 +16827,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.26.0-experimental.d7dfc00").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.26.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);

package/data/skills/verity-analyze/SKILL.md

@@ -15,13 +15,7 @@ You are running an on-demand Verity analysis. This is like a "second opinion"
 
 1. Verify `.verity/standard.yaml` exists. If not: "Run `/verity-setup` first."
 2. Verify `verity` CLI is available: `which verity`. If not: "Re-run the Verity installer: `curl -fsSL https://raw.githubusercontent.com/codacy/verity/main/install.sh | bash`"
-3. Run `verity auth verify` to check the token is valid.
-   - **Valid**: proceed with the full deep review.
-   - **Fails / not authenticated**: don't stop. Tell the user Verity is in
-     **local-only mode**, so the review will run static analysis and show findings
-     but won't perform the deep (LLM) review or upload anything. To unlock the deep
-     review they can authenticate with `verity init` (or `verity auth register`).
-     Continue — `verity review` degrades to a local static-only report on its own.
+3. Run `verity auth verify` to check token is valid. If it fails: "Verity not configured. Run `/verity-setup` first."
 
 ---
 

package/data/skills/verity-setup/SKILL.md

@@ -310,60 +310,25 @@ Expected: single-digit findings per file, not hundreds. If you see 50+ issues fr
 
 ---
 
-## Step 6: Verify authentication
-
-Login now happens in `verity init` (an optional, skippable step), **not** here.
-This step only checks whether the user authenticated during init, and branches
-the rest of setup accordingly.
-
-**If the user asks what signing in does or why it matters, tell them:**
-- It confirms they have **write access to this repository** — the GitHub token is
-  used **once** to verify that, then discarded. Verity never stores it.
-- It does **not** give Verity access to their code. Code checked by the gate is
-  analyzed **in memory and discarded** — Verity never stores their code.
-- It is **required to store and access run history** for the repo (past results,
-  trends, and shareable reports).
-- Skipping keeps Verity fully **local-only**: the gate still runs and shows
-  findings, but nothing is uploaded.
+## Step 6: Register with Verity service
+
+Use the `verity` CLI to register. It handles credential storage and service URL automatically.
 
 ```bash
-verity auth verify
+verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
 ```
 
-- **Token valid** (prints the project name): The user authenticated during
-  `verity init`. Continue to Step 7 — the Standard, config, and knowledge base
-  will upload.
-- **Not authenticated / no token**: The user skipped login in `verity init` (or
-  lacks write access). Verity runs in **local-only mode** — the gate still runs on
-  every stop and surfaces static findings, but nothing uploads and no
-  history/org/repo data is stored. **Skip Steps 7 and 7b** (they require a token)
-  and continue to Step 8. Tell the user they can authenticate anytime to unlock
-  deep review, history, and shareable reports by running:
-
-  ```bash
-  verity init          # re-runs init; offers the auth prompt again
-  # or, directly:
-  verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
-  ```
-
-  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub OAuth
-  **device flow** ("open https://github.com/login/device and enter code
-  WXYZ-1234"), proving the user has **write access** to the repo before the
-  service issues a token.
-
-When authenticated, `.verity/credentials` contains `token`, `service_url`, and
-`provider_token` — all subsequent `verity` upload commands work.
+This command:
+- **New project**: Registers, stores token + service URL in `.verity/credentials`, prints `project_id`. Continue.
+- **Already registered**: Automatically discovers the project, ensures `.verity/credentials` has the service URL. If a token already exists in credentials, it updates the file and succeeds. If no token exists, it asks you to paste one.
+- **Other errors**: Show the error and stop.
+
+After this step, `.verity/credentials` will contain both `token` and `service_url` — all subsequent `verity` commands will work.
 
 ---
 
 ## Step 7: Upload Standard and config
 
-> **Skip this entire step if the user is not authenticated** (Step 6 reported
-> local-only mode). These commands require a token and will fail without one. The
-> `.verity/standard.yaml` and `.codacy/codacy.config.json` you generated locally
-> still drive the gate; they'll upload the next time the user authenticates and
-> re-runs setup.
-
 ### Upload the Standard
 
 The `verity` CLI handles YAML→JSON conversion automatically:
@@ -394,10 +359,6 @@ This derives a small set of descriptive memory nodes from what you already analy
 
 ## Step 7b: Enable telemetry (only if the user opted in at Step 3b)
 
-> **Skip this step if the user is not authenticated** (local-only mode) — telemetry
-> export requires the token. Note that `/usage` stays empty until they authenticate
-> and run `verity telemetry install`.
-
 If — and only if — the user said **Yes** in Step 3b, enable the Claude Code telemetry export
 now (the token from Step 6 must already exist):
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.26.0-experimental.d7dfc00",
+  "version": "0.26.0",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
   "repository": {