@codacy/verity-cli 0.26.0 → 0.27.0-experimental.8f12b5a

package/bin/verity.js

@@ -10325,9 +10325,7 @@ var {
 } = import_index.default;
 
 // src/commands/auth.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_child_process3 = require("node:child_process");
-var import_node_path2 = require("node:path");
+var import_node_child_process4 = require("node:child_process");
 
 // src/lib/auth.ts
 var import_promises = require("node:fs/promises");
@@ -10475,7 +10473,15 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1".length > 0 ? "https://yyfaqvcgslcrzvrbvqik.supabase.co/functions/v1" : PROD_SERVICE_URL;
+var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
+var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
+var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var GITHUB_APP_SLUG = "verity-auth";
+var GITHUB_APP_INSTALL_URL = `https://github.com/apps/${GITHUB_APP_SLUG}/installations/new`;
+function githubAppInstallUrl(accountId) {
+  return accountId != null ? `https://github.com/apps/${GITHUB_APP_SLUG}/installations/new/permissions?target_id=${accountId}` : GITHUB_APP_INSTALL_URL;
+}
 
 // src/lib/auth.ts
 async function resolveToken(flagToken) {
@@ -10641,7 +10647,8 @@ async function apiRequest(options) {
     timeout = 9e4,
     cmd = "unknown",
     retry = false,
-    encodeBody = false
+    encodeBody = false,
+    extraHeaders
   } = options;
   const url = `${serviceUrl}${path}`;
   const headers = {
@@ -10650,6 +10657,9 @@ async function apiRequest(options) {
   if (token) {
     headers["Authorization"] = `Bearer ${token}`;
   }
+  if (extraHeaders) {
+    Object.assign(headers, extraHeaders);
+  }
   const testMockScenario = process.env.VERITY_TEST_MOCK_SCENARIO;
   if (testMockScenario) {
     headers["X-Verity-Mock-Scenario"] = testMockScenario;
@@ -10740,6 +10750,462 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/register.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
+var readline = __toESM(require("node:readline/promises"));
+
+// src/lib/provider-auth.ts
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var form = (fields) => new URLSearchParams(fields).toString();
+async function githubAccountId(owner) {
+  try {
+    const res = await fetch(`https://api.github.com/users/${encodeURIComponent(owner)}`, {
+      headers: {
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "User-Agent": "verity-cli"
+      }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return typeof body.id === "number" ? body.id : null;
+  } catch {
+    return null;
+  }
+}
+async function githubCanSeeRepo(owner, repo, token) {
+  let res;
+  try {
+    res = await fetch(
+      `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/vnd.github+json",
+          "X-GitHub-Api-Version": "2022-11-28",
+          "User-Agent": "verity-cli"
+        }
+      }
+    );
+  } catch (err) {
+    return { ok: false, error: `Network error contacting GitHub: ${err.message}` };
+  }
+  if (res.status === 404) return { ok: true, data: false };
+  if (res.ok) return { ok: true, data: true };
+  return { ok: false, error: `GitHub repo lookup failed (HTTP ${res.status})` };
+}
+async function githubDeviceFlow() {
+  const override = process.env.VERITY_PROVIDER_TOKEN;
+  if (override) return { ok: true, data: override };
+  let dc;
+  try {
+    const res = await fetch(GITHUB_DEVICE_CODE_URL, {
+      method: "POST",
+      headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+      body: form({ client_id: GITHUB_CLIENT_ID })
+    });
+    if (!res.ok) {
+      return { ok: false, error: `GitHub device-code request failed (HTTP ${res.status})` };
+    }
+    dc = await res.json();
+  } catch (err) {
+    return { ok: false, error: `Network error contacting GitHub: ${err.message}` };
+  }
+  if (!dc.device_code || !dc.user_code) {
+    return {
+      ok: false,
+      error: "GitHub did not return a device code (is Device Flow enabled on the OAuth app?)"
+    };
+  }
+  printInfo("");
+  printInfo(`To authorize Verity, open:  ${dc.verification_uri}`);
+  printInfo(`And enter the code:         ${dc.user_code}`);
+  printInfo("Waiting for authorization\u2026");
+  const deadline = Date.now() + (dc.expires_in || 900) * 1e3;
+  let interval = dc.interval || 5;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let data;
+    try {
+      const res = await fetch(GITHUB_ACCESS_TOKEN_URL, {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+        body: form({
+          client_id: GITHUB_CLIENT_ID,
+          device_code: dc.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+        })
+      });
+      data = await res.json().catch(() => ({}));
+    } catch {
+      continue;
+    }
+    if (data.access_token) return { ok: true, data: data.access_token };
+    switch (data.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return { ok: false, error: "Authorization was denied on GitHub." };
+      case "expired_token":
+        return { ok: false, error: "The authorization code expired. Re-run register." };
+      default:
+        if (data.error) return { ok: false, error: `GitHub auth error: ${data.error}` };
+    }
+  }
+  return { ok: false, error: "Timed out waiting for GitHub authorization." };
+}
+
+// src/lib/git.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+function resolveFile(relpath) {
+  if ((0, import_node_fs2.existsSync)(relpath)) return relpath;
+  if ((0, import_node_fs2.existsSync)(".claude/worktrees")) {
+    try {
+      const entries = (0, import_node_fs2.readdirSync)(".claude/worktrees", { withFileTypes: true });
+      for (const entry of entries) {
+        if (!entry.isDirectory()) continue;
+        const candidate = (0, import_node_path2.join)(".claude/worktrees", entry.name, relpath);
+        if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function execGit(cmd) {
+  try {
+    return (0, import_node_child_process3.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return "";
+  }
+}
+function splitLines(s) {
+  return s.split("\n").filter((l) => l.length > 0);
+}
+var SHA_RE = /^[0-9a-f]{40}$/;
+function readBaselineSha() {
+  if (!(0, import_node_fs2.existsSync)(BASELINE_SHA_FILE)) return null;
+  let sha;
+  try {
+    sha = (0, import_node_fs2.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+  } catch {
+    return null;
+  }
+  if (!SHA_RE.test(sha)) return null;
+  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
+  if (!reachable) {
+    try {
+      (0, import_node_fs2.unlinkSync)(BASELINE_SHA_FILE);
+    } catch {
+    }
+    return null;
+  }
+  return sha;
+}
+function writeBaselineSha(sha) {
+  if (!SHA_RE.test(sha)) return;
+  try {
+    (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs2.writeFileSync)(BASELINE_SHA_FILE, sha);
+  } catch {
+  }
+}
+function getChangedFiles() {
+  const sets = /* @__PURE__ */ new Set();
+  let hasRecentCommitFiles = false;
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
+    if (committed.length > 0) {
+      hasRecentCommitFiles = true;
+      for (const f of committed) sets.add(f);
+    }
+  } else {
+    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
+    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
+    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
+    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
+    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
+      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
+      if (recentFiles.length > 0) {
+        hasRecentCommitFiles = true;
+        for (const f of recentFiles) sets.add(f);
+      }
+    }
+  }
+  for (const f of getWorktreeFiles()) sets.add(f);
+  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  return { files: filtered, hasRecentCommitFiles };
+}
+function getStagedFiles() {
+  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function getDirtyFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
+  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+}
+function showContentAtRef(ref, repoRelPath) {
+  if (!ref || ref === "no-git") return null;
+  const normalizedPath = repoRelPath.replace(/\\/g, "/");
+  try {
+    return (0, import_node_child_process3.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
+      encoding: "utf-8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch {
+    return null;
+  }
+}
+function getPushRangeFiles() {
+  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
+  const resolvers = [
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
+    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
+    () => {
+      const branch = execGit("git rev-parse --abbrev-ref HEAD");
+      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
+    }
+  ];
+  for (const resolve of resolvers) {
+    const range = resolve();
+    if (range) return { files: diff(range), range };
+  }
+  const baseline = readBaselineSha();
+  if (baseline) {
+    const files = diff(`${baseline}..HEAD`);
+    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
+  }
+  const last = diff("HEAD~1..HEAD");
+  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
+}
+function getPushRangeMessages() {
+  const { range } = getPushRangeFiles();
+  if (!range) return "";
+  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
+}
+function getWorktreeFiles() {
+  const result = [];
+  const worktreeDir = ".claude/worktrees";
+  if (!(0, import_node_fs2.existsSync)(worktreeDir)) return result;
+  try {
+    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
+    const entries = (0, import_node_fs2.readdirSync)(worktreeDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const wtDir = (0, import_node_path2.join)(worktreeDir, entry.name);
+      scanDir(wtDir, wtDir, fiveMinAgo, result);
+    }
+  } catch {
+  }
+  return result;
+}
+function scanDir(baseDir, dir, minMtime, result) {
+  try {
+    const entries = (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = (0, import_node_path2.join)(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name === "node_modules" || entry.name === ".git") continue;
+        scanDir(baseDir, fullPath, minMtime, result);
+      } else if (entry.isFile()) {
+        const ext = (0, import_node_path2.extname)(entry.name).slice(1);
+        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
+        try {
+          const stat3 = (0, import_node_fs2.statSync)(fullPath);
+          if (stat3.mtimeMs >= minMtime) {
+            const relPath = fullPath.slice(baseDir.length + 1);
+            result.push(relPath);
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function filterAnalyzable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    return ANALYZABLE_EXTENSIONS.has(ext);
+  });
+}
+function filterReviewable(files) {
+  return files.filter((f) => {
+    const ext = (0, import_node_path2.extname)(f).slice(1);
+    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
+    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
+    const basename3 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
+    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
+    return false;
+  });
+}
+function filterSecurity(files) {
+  return files.filter(
+    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
+  );
+}
+function getCurrentCommit() {
+  return execGit("git rev-parse HEAD") || "no-git";
+}
+function detectProvider(host) {
+  const h = host.toLowerCase();
+  if (h.includes("github")) return "github";
+  if (h.includes("gitlab")) return "gitlab";
+  if (h.includes("bitbucket")) return "bitbucket";
+  return "unknown";
+}
+function parseRemote(raw) {
+  if (!raw || typeof raw !== "string") return null;
+  let s = raw.trim();
+  if (!s) return null;
+  let host = "";
+  let path = "";
+  const scp = s.match(/^[^/@]+@([^:/]+):(.+)$/);
+  if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    s = s.replace(/^[^/@]+@/, "");
+    const slash = s.indexOf("/");
+    if (slash === -1) return null;
+    host = s.slice(0, slash);
+    path = s.slice(slash + 1);
+  }
+  host = host.toLowerCase().trim();
+  path = path.replace(/\/+$/, "").replace(/\.git$/, "");
+  if (!host || !path) return null;
+  const segments = path.split("/").filter(Boolean);
+  if (segments.length < 2) return null;
+  const owner = segments[0];
+  const repo = segments[segments.length - 1];
+  if (!owner || !repo) return null;
+  return {
+    host,
+    owner,
+    repo,
+    provider: detectProvider(host),
+    orgUrl: `https://${host}/${owner}`,
+    orgName: owner
+  };
+}
+function listTrackedFiles() {
+  const set = /* @__PURE__ */ new Set();
+  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
+  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
+  return Array.from(set);
+}
+
+// src/lib/register.ts
+var isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
+async function waitForEnter(prompt) {
+  if (!isInteractive()) return;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    await rl.question(prompt);
+  } finally {
+    rl.close();
+  }
+}
+async function ensureAppInstalled(owner, repo, token) {
+  let installUrl = null;
+  const maxAttempts = 3;
+  for (let attempt = 1; ; attempt++) {
+    const visible = await githubCanSeeRepo(owner, repo, token);
+    if (!visible.ok) return { ok: true, data: void 0 };
+    if (visible.data) return { ok: true, data: void 0 };
+    if (installUrl === null) installUrl = githubAppInstallUrl(await githubAccountId(owner));
+    if (!isInteractive() || attempt >= maxAttempts) {
+      return {
+        ok: false,
+        error: `The Verity GitHub App can't see ${owner}/${repo}. Install it on "${owner}" and grant access to this repository, then re-run:
+  ${installUrl}`
+      };
+    }
+    printWarn(`The Verity GitHub App can't see ${owner}/${repo} yet.`);
+    printInfo(`Install it on "${owner}" (grant access to this repo):`);
+    printInfo(`  ${installUrl}`);
+    await waitForEnter("Press Enter once installed to retry\u2026 ");
+  }
+}
+async function registerProject(opts) {
+  const parsed = parseRemote(opts.remote);
+  if (!parsed) {
+    return { ok: false, error: `Could not parse git remote: ${opts.remote}` };
+  }
+  if (parsed.provider !== "github") {
+    return { ok: false, error: `Provider '${parsed.provider}' is not supported yet \u2014 GitHub only for now.` };
+  }
+  const usingTokenOverride = Boolean(process.env.VERITY_PROVIDER_TOKEN);
+  const providerAuth = await githubDeviceFlow();
+  if (!providerAuth.ok) {
+    return { ok: false, error: providerAuth.error };
+  }
+  const providerToken = providerAuth.data;
+  if (!usingTokenOverride) {
+    const installed = await ensureAppInstalled(parsed.owner, parsed.repo, providerToken);
+    if (!installed.ok) {
+      return { ok: false, error: installed.error };
+    }
+  }
+  const result = await apiRequest({
+    method: "POST",
+    path: "/auth/register",
+    serviceUrl: opts.serviceUrl,
+    body: { project_name: opts.projectName, git_remote_url: opts.remote },
+    extraHeaders: { "X-Provider-Token": providerToken },
+    verbose: opts.verbose
+  });
+  if (!result.ok) {
+    return { ok: false, error: result.error };
+  }
+  const { project_id, token, service_url, user } = result.data;
+  try {
+    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises3.writeFile)(
+      CREDENTIALS_FILE,
+      `token: ${token}
+service_url: ${service_url}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Registered with the Verity service, but could not save credentials to ${CREDENTIALS_FILE}: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
+    };
+  }
+  try {
+    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
+    await (0, import_promises3.appendFile)(
+      GLOBAL_CREDENTIALS_FILE,
+      `${opts.remote} token: ${token}
+`,
+      { mode: 384 }
+    );
+    await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
+    });
+  } catch {
+  }
+  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email: user?.email } };
+}
+
 // src/commands/auth.ts
 function registerAuthCommands(program2) {
   const auth = program2.command("auth").description("Manage project authentication");
@@ -10749,36 +11215,26 @@ function registerAuthCommands(program2) {
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
       }
     }
-    const result = await apiRequest({
-      method: "POST",
-      path: "/auth/register",
+    const result = await registerProject({
+      projectName: opts.project,
+      remote,
       serviceUrl,
-      body: { project_name: opts.project, git_remote_url: remote },
       verbose: globals.verbose
     });
-    if (!result.ok) {
-      printError(result.error);
-      process.exit(1);
-    }
-    const { project_id, token, service_url } = result.data;
-    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(CREDENTIALS_FILE, `token: ${token}
-service_url: ${service_url}
-`);
-    try {
-      await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-      await (0, import_promises3.appendFile)(GLOBAL_CREDENTIALS_FILE, `${remote} token: ${token}
-`);
-    } catch {
+    if (!result.ok) {
+      printError(result.error);
+      process.exit(1);
     }
-    printInfo(`Project registered: ${project_id}`);
-    printJson({ project_id, service_url });
+    const { projectId, serviceUrl: resolvedUrl, email } = result.data;
+    printInfo(`Project registered: ${projectId}`);
+    if (email) printInfo(`Authenticated as: ${email}`);
+    printJson({ project_id: projectId, service_url: resolvedUrl });
   });
   auth.command("verify").description("Verify the current token is valid").action(async () => {
     const globals = program2.opts();
@@ -10811,7 +11267,7 @@ service_url: ${service_url}
     let remote = opts.remote;
     if (!remote) {
       try {
-        remote = (0, import_node_child_process3.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+        remote = (0, import_node_child_process4.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
       } catch {
         printError("No git remote found. Use --remote to specify one.");
         process.exit(1);
@@ -10839,11 +11295,11 @@ service_url: ${service_url}
 
 // src/lib/hooks.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path4 = require("node:path");
+var import_node_path5 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
+var import_node_path4 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -10889,7 +11345,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises4.mkdir)((0, import_node_path3.dirname)(file), { recursive: true });
+  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
   await (0, import_promises4.writeFile)(file, next);
   return true;
 }
@@ -11050,13 +11506,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path4.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -11296,8 +11752,8 @@ var import_node_crypto3 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises6 = require("node:fs/promises");
-var import_node_fs2 = require("node:fs");
-var import_node_child_process4 = require("node:child_process");
+var import_node_fs3 = require("node:fs");
+var import_node_child_process5 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
@@ -11332,7 +11788,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs2.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs3.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -11356,7 +11812,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs2.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs3.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises6.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises6.unlink)(INTENT_FILE).catch(() => {
@@ -11400,7 +11856,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process4.execSync)(
+    const output = (0, import_node_child_process5.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -11413,8 +11869,8 @@ function getRecentCommitMessages() {
 
 // src/lib/task-context-buffer.ts
 var import_promises7 = require("node:fs/promises");
-var import_node_fs3 = require("node:fs");
-var import_node_path5 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path6 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -11453,7 +11909,7 @@ async function appendResponseToTaskBuffer(taskId, assistantResponse, actionSumma
 }
 async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
-  if (!(0, import_node_fs3.existsSync)(filePath)) return null;
+  if (!(0, import_node_fs4.existsSync)(filePath)) return null;
   try {
     const content = await (0, import_promises7.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
@@ -11487,12 +11943,12 @@ async function readTaskContextBuffer(taskId) {
 }
 async function cleanupTaskContextBuffers() {
   try {
-    if (!(0, import_node_fs3.existsSync)(TASK_CONTEXT_DIR)) return;
+    if (!(0, import_node_fs4.existsSync)(TASK_CONTEXT_DIR)) return;
     const files = await (0, import_promises7.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path5.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path6.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises7.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -11506,13 +11962,13 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path5.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path6.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
     await (0, import_promises7.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
-    if ((0, import_node_fs3.existsSync)(filePath)) {
+    if ((0, import_node_fs4.existsSync)(filePath)) {
       const stats = await (0, import_promises7.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
         const content = await (0, import_promises7.readFile)(filePath, "utf-8");
@@ -11523,7 +11979,7 @@ async function appendEntry(taskId, entry) {
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs3.existsSync)(filePath) ? await (0, import_promises7.readFile)(filePath, "utf-8") : "";
+    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises7.readFile)(filePath, "utf-8") : "";
     await (0, import_promises7.writeFile)(filePath, existing + line);
   } catch {
   }
@@ -11531,8 +11987,8 @@ async function appendEntry(taskId, entry) {
 
 // src/lib/memory-retrieval.ts
 var import_promises8 = require("node:fs/promises");
-var import_node_fs4 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path7 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -11625,19 +12081,19 @@ function parseFrontmatter(content) {
   return { fm, body: match[2].trim() };
 }
 async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = DEFAULT_BUDGET_TOKENS) {
-  if (!(0, import_node_fs4.existsSync)(memoryDir())) return null;
+  if (!(0, import_node_fs5.existsSync)(memoryDir())) return null;
   const budget = Math.min(budgetTokens, MAX_BUDGET_TOKENS);
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path6.join)(memoryDir(), domain);
-    if (!(0, import_node_fs4.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path7.join)(memoryDir(), domain);
+    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path6.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -11696,8 +12152,8 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 
 // src/lib/memory-sync.ts
 var import_promises9 = require("node:fs/promises");
-var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path8 = require("node:path");
 var import_node_crypto2 = require("node:crypto");
 
 // src/lib/glob-match.ts
@@ -11768,32 +12224,32 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path7.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path8.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) {
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) {
     return { schema_version: 1, nodes: [], index_hash: null, log_length: 0 };
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path7.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path8.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16);
@@ -11806,13 +12262,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path7.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto2.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -11823,15 +12279,15 @@ function hashContent(content) {
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
-  if (!(0, import_node_fs5.existsSync)(memoryDir2())) return out;
+  if (!(0, import_node_fs6.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -11877,8 +12333,8 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path7.join)(memoryDir2(), path);
-    if (!(0, import_node_fs5.existsSync)(full)) continue;
+    const full = (0, import_node_path8.join)(memoryDir2(), path);
+    if (!(0, import_node_fs6.existsSync)(full)) continue;
     let content;
     try {
       content = await (0, import_promises9.readFile)(full, "utf-8");
@@ -11914,15 +12370,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs5.existsSync)((0, import_node_path7.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path7.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path7.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path8.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -11932,7 +12388,7 @@ async function applyOneWrite(write, treePaths) {
       notes.push(`${write.path}: dropped unmatched file_globs [${grounded.dropped.join(", ")}]`);
     }
   }
-  if ((0, import_node_fs5.existsSync)(fullPath)) {
+  if ((0, import_node_fs6.existsSync)(fullPath)) {
     let existing = "";
     try {
       existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
@@ -11944,7 +12400,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path7.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path8.dirname)(fullPath), { recursive: true });
   await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -11985,8 +12441,8 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path7.join)(memoryDir2(), domain);
-    if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
+    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
@@ -11996,7 +12452,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -12020,7 +12476,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path7.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path8.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
@@ -12102,9 +12558,9 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path7.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path8.join)(cwd, "CLAUDE.md");
   let existing = "";
-  if ((0, import_node_fs5.existsSync)(claudeMdPath)) {
+  if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
@@ -12234,7 +12690,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 `;
 
 // src/commands/intent.ts
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 function registerIntentCommands(program2) {
   const intent = program2.command("intent").description("Manage intent capture");
   intent.command("capture").description("Capture user intent from stdin (used by UserPromptSubmit hook)").action(async () => {
@@ -12243,7 +12699,7 @@ function registerIntentCommands(program2) {
         process.chdir(repoRoot());
       } catch {
       }
-      if (!(0, import_node_fs6.existsSync)(VERITY_DIR)) {
+      if (!(0, import_node_fs7.existsSync)(VERITY_DIR)) {
         process.exit(0);
       }
       const chunks = [];
@@ -12822,215 +13278,6 @@ async function sendGeneralFeedback(message, opts, globals) {
 var import_node_fs19 = require("node:fs");
 var import_node_path15 = require("node:path");
 
-// src/lib/git.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_fs7 = require("node:fs");
-var import_node_path8 = require("node:path");
-function resolveFile(relpath) {
-  if ((0, import_node_fs7.existsSync)(relpath)) return relpath;
-  if ((0, import_node_fs7.existsSync)(".claude/worktrees")) {
-    try {
-      const entries = (0, import_node_fs7.readdirSync)(".claude/worktrees", { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const candidate = (0, import_node_path8.join)(".claude/worktrees", entry.name, relpath);
-        if ((0, import_node_fs7.existsSync)(candidate)) return candidate;
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function execGit(cmd) {
-  try {
-    return (0, import_node_child_process5.execSync)(cmd, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-  } catch {
-    return "";
-  }
-}
-function splitLines(s) {
-  return s.split("\n").filter((l) => l.length > 0);
-}
-var SHA_RE = /^[0-9a-f]{40}$/;
-function readBaselineSha() {
-  if (!(0, import_node_fs7.existsSync)(BASELINE_SHA_FILE)) return null;
-  let sha;
-  try {
-    sha = (0, import_node_fs7.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
-  } catch {
-    return null;
-  }
-  if (!SHA_RE.test(sha)) return null;
-  const reachable = execGit(`git cat-file -e ${sha}^{commit} 2>/dev/null && echo ok`) === "ok";
-  if (!reachable) {
-    try {
-      (0, import_node_fs7.unlinkSync)(BASELINE_SHA_FILE);
-    } catch {
-    }
-    return null;
-  }
-  return sha;
-}
-function writeBaselineSha(sha) {
-  if (!SHA_RE.test(sha)) return;
-  try {
-    (0, import_node_fs7.mkdirSync)((0, import_node_path8.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs7.writeFileSync)(BASELINE_SHA_FILE, sha);
-  } catch {
-  }
-}
-function getChangedFiles() {
-  const sets = /* @__PURE__ */ new Set();
-  let hasRecentCommitFiles = false;
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) sets.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) sets.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) sets.add(f);
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const committed = splitLines(execGit(`git diff --name-only ${baseline}..HEAD`));
-    if (committed.length > 0) {
-      hasRecentCommitFiles = true;
-      for (const f of committed) sets.add(f);
-    }
-  } else {
-    const headTimestamp = parseInt(execGit("git log -1 --format=%ct HEAD"), 10) || 0;
-    const commitAge = Math.floor(Date.now() / 1e3) - headTimestamp;
-    const hasUnstaged = splitLines(execGit("git diff --name-only HEAD")).length > 0;
-    const hasStaged = splitLines(execGit("git diff --name-only --cached")).length > 0;
-    if (commitAge < 120 && !hasUnstaged && !hasStaged) {
-      const recentFiles = splitLines(execGit("git diff --name-only HEAD~1..HEAD"));
-      if (recentFiles.length > 0) {
-        hasRecentCommitFiles = true;
-        for (const f of recentFiles) sets.add(f);
-      }
-    }
-  }
-  for (const f of getWorktreeFiles()) sets.add(f);
-  const filtered = Array.from(sets).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  return { files: filtered, hasRecentCommitFiles };
-}
-function getStagedFiles() {
-  return splitLines(execGit("git diff --cached --name-only")).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function getDirtyFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git diff --name-only HEAD"))) set.add(f);
-  for (const f of splitLines(execGit("git diff --name-only --cached"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-}
-function showContentAtRef(ref, repoRelPath) {
-  if (!ref || ref === "no-git") return null;
-  const normalizedPath = repoRelPath.replace(/\\/g, "/");
-  try {
-    return (0, import_node_child_process5.execFileSync)("git", ["show", `${ref}:${normalizedPath}`], {
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-  } catch {
-    return null;
-  }
-}
-function getPushRangeFiles() {
-  const diff = (range) => splitLines(execGit(`git diff --name-only ${range}`)).filter((f) => !f.startsWith(".verity/") && !f.startsWith(".verity\\"));
-  const resolvers = [
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{push}") ? "@{push}..HEAD" : null,
-    () => execGit("git rev-parse --abbrev-ref --symbolic-full-name @{upstream}") ? "@{upstream}..HEAD" : null,
-    () => {
-      const branch = execGit("git rev-parse --abbrev-ref HEAD");
-      return branch && branch !== "HEAD" && execGit(`git rev-parse --verify -q origin/${branch}`) ? `origin/${branch}..HEAD` : null;
-    }
-  ];
-  for (const resolve of resolvers) {
-    const range = resolve();
-    if (range) return { files: diff(range), range };
-  }
-  const baseline = readBaselineSha();
-  if (baseline) {
-    const files = diff(`${baseline}..HEAD`);
-    if (files.length > 0) return { files, range: `${baseline}..HEAD` };
-  }
-  const last = diff("HEAD~1..HEAD");
-  return { files: last, range: last.length > 0 ? "HEAD~1..HEAD" : null };
-}
-function getPushRangeMessages() {
-  const { range } = getPushRangeFiles();
-  if (!range) return "";
-  return execGit(`git log ${range} --format=%B%x00`).split("\0").map((s) => s.trim()).filter(Boolean).join("\n\n");
-}
-function getWorktreeFiles() {
-  const result = [];
-  const worktreeDir = ".claude/worktrees";
-  if (!(0, import_node_fs7.existsSync)(worktreeDir)) return result;
-  try {
-    const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
-    const entries = (0, import_node_fs7.readdirSync)(worktreeDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const wtDir = (0, import_node_path8.join)(worktreeDir, entry.name);
-      scanDir(wtDir, wtDir, fiveMinAgo, result);
-    }
-  } catch {
-  }
-  return result;
-}
-function scanDir(baseDir, dir, minMtime, result) {
-  try {
-    const entries = (0, import_node_fs7.readdirSync)(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      const fullPath = (0, import_node_path8.join)(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (entry.name === "node_modules" || entry.name === ".git") continue;
-        scanDir(baseDir, fullPath, minMtime, result);
-      } else if (entry.isFile()) {
-        const ext = (0, import_node_path8.extname)(entry.name).slice(1);
-        if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
-        try {
-          const stat3 = (0, import_node_fs7.statSync)(fullPath);
-          if (stat3.mtimeMs >= minMtime) {
-            const relPath = fullPath.slice(baseDir.length + 1);
-            result.push(relPath);
-          }
-        } catch {
-        }
-      }
-    }
-  } catch {
-  }
-}
-function filterAnalyzable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path8.extname)(f).slice(1);
-    return ANALYZABLE_EXTENSIONS.has(ext);
-  });
-}
-function filterReviewable(files) {
-  return files.filter((f) => {
-    const ext = (0, import_node_path8.extname)(f).slice(1);
-    if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
-    if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename2 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename2)) return true;
-    if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
-    return false;
-  });
-}
-function filterSecurity(files) {
-  return files.filter(
-    (f) => SECURITY_PATTERNS.some((p) => p.test(f))
-  );
-}
-function getCurrentCommit() {
-  return execGit("git rev-parse HEAD") || "no-git";
-}
-function listTrackedFiles() {
-  const set = /* @__PURE__ */ new Set();
-  for (const f of splitLines(execGit("git ls-files"))) set.add(f);
-  for (const f of splitLines(execGit("git ls-files --others --exclude-standard"))) set.add(f);
-  return Array.from(set);
-}
-
 // src/lib/files.ts
 var import_node_fs8 = require("node:fs");
 var import_node_path9 = require("node:path");
@@ -14638,6 +14885,27 @@ function passAndExit(reason) {
   printJsonCompact({ gate_decision: "PASS", systemMessage: `Verity: ${reason}` });
   process.exit(0);
 }
+var EMPTY_STATIC = {
+  tool: "@codacy/analysis-cli",
+  findings: [],
+  summary: { total_findings: 0, by_severity: {}, tools_run: [] }
+};
+function runLocalStatic(analyzable, securityFiles, baseline, skipStatic) {
+  if (skipStatic || !isCodacyAvailable()) return EMPTY_STATIC;
+  let scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
+  if (baseline) scannable = scannable.filter((f) => changedSinceBaseline(f, baseline));
+  if (scannable.length === 0) return EMPTY_STATIC;
+  return runCodacyAnalysis(scannable);
+}
+function localOnlyAndExit(staticResults) {
+  printJsonCompact({
+    gate_decision: "PASS",
+    systemMessage: "Verity: not authenticated \u2014 ran a local static-only check (no deep review, no upload). Run `verity init` to authenticate and enable the full quality gate.",
+    unauthenticated: true,
+    static_results: staticResults
+  });
+  process.exit(0);
+}
 function registerAnalyzeCommand(program2) {
   program2.command("analyze").description("Run Verity analysis on changed files (stop hook)").option("--debounce <seconds>", "Skip if last analysis was within N seconds", "30").option("--max-iterations <n>", "Force PASS after N FAIL cycles", "2").option("--max-files <n>", "Max files to send for review", "20").option("--max-file-size <bytes>", "Skip files larger than N bytes", "51200").option("--max-total-size <bytes>", "Stop collecting files at N total bytes", "194560").option("--skip-static", "Skip codacy-analysis").option("--mode <mode>", "Force analysis mode (standard|plan|debug|skip)").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
@@ -14688,12 +14956,9 @@ async function runAnalyze(opts, globals) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    passAndExit("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
   }
   const sessionIdForMemory = sessionId || process.env.CLAUDE_SESSION_ID || "";
   let contextFilePaths = [];
@@ -15267,13 +15532,14 @@ async function runReview(opts, globals) {
   }
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
-  if (!tokenResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
-    process.exit(0);
-  }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
-  if (!urlResult.ok) {
-    printError("Not configured yet \u2014 run /verity-setup in Claude Code to enable quality gates.");
+  if (!tokenResult.ok || !urlResult.ok) {
+    printJsonCompact({
+      gate_decision: "PASS",
+      systemMessage: "Verity: not authenticated \u2014 showing local static results only (no deep review, no upload). Run `verity init` to authenticate and unlock the full review.",
+      unauthenticated: true,
+      static_results: staticResults
+    });
     process.exit(0);
   }
   let specs;
@@ -15662,6 +15928,7 @@ var import_node_fs24 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path18 = require("node:path");
 var import_node_child_process9 = require("node:child_process");
+var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs23 = require("node:fs");
@@ -15941,6 +16208,66 @@ function registerMigrateCommand(program2) {
 }
 
 // src/commands/init.ts
+async function promptYes(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function runOptionalAuth() {
+  const existing = await resolveToken();
+  if (existing.ok) {
+    printInfo("Already authenticated \u2014 results will upload to the Verity service. \u2713");
+    return;
+  }
+  let remote = "";
+  try {
+    remote = (0, import_node_child_process9.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+  }
+  const localOnlyNote = () => {
+    printInfo("Verity runs in local-only mode: the gate still runs and shows static findings, but nothing uploads.");
+    printInfo('  Authenticate anytime: run "verity init" again, or "verity auth register".');
+  };
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    console.log("");
+    console.log("  Signing in is optional. What it does:");
+    console.log("    - Confirms you have write access to this repository. The GitHub token");
+    console.log("      is used once to verify that, then discarded \u2014 Verity never stores it.");
+    console.log("    - It does NOT give Verity access to your code. Code checked by the gate");
+    console.log("      is analyzed in memory and discarded \u2014 we never store your code.");
+    console.log("    - It is required to store and access run history for this repo");
+    console.log("      (past results, trends, and shareable reports).");
+    console.log("    - Skip and Verity still works fully locally: the gate runs and shows");
+    console.log("      findings, but nothing is uploaded.");
+    console.log("");
+  }
+  const wantsAuth = await promptYes("Authenticate with GitHub now to upload results to Verity? [Y/skip] ");
+  if (!wantsAuth) {
+    printInfo("Skipped authentication.");
+    localOnlyNote();
+    return;
+  }
+  if (!remote) {
+    printWarn("No git remote found \u2014 cannot authenticate yet.");
+    localOnlyNote();
+    return;
+  }
+  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path18.basename)(process.cwd());
+  printInfo("Authenticating with GitHub\u2026");
+  const result = await registerProject({ projectName, remote, serviceUrl: DEFAULT_SERVICE_URL });
+  if (result.ok) {
+    printInfo(`Project registered: ${result.data.projectId} \u2713`);
+    if (result.data.email) printInfo(`  Authenticated as: ${result.data.email}`);
+  } else {
+    printWarn(`Authentication did not complete: ${result.error}`);
+    localOnlyNote();
+  }
+}
 function resolveDataDir() {
   const candidates = [
     (0, import_node_path18.join)(__dirname, "..", "data"),
@@ -16084,6 +16411,12 @@ function registerInitCommand(program2) {
     const globalVerityDir = (0, import_node_path18.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises13.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
+    try {
+      await runOptionalAuth();
+    } catch (err) {
+      printWarn(`Authentication step skipped: ${err.message}`);
+    }
+    console.log("");
     printInfo("Verity initialized!");
     console.log("");
     console.log("  Installed:");
@@ -16099,6 +16432,7 @@ function registerInitCommand(program2) {
     console.log("    .verity/memory/                  \u2014 knowledge base (8 domains, commit to git)");
     console.log("");
     console.log("  Next step: open this project in Claude Code and run /verity-setup");
+    console.log('  (Not authenticated? Verity runs in local-only mode until you run "verity auth register".)');
     console.log("");
   });
 }
@@ -16827,7 +17161,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.26.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.27.0-experimental.8f12b5a").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerHooksCommands(program);
 registerIntentCommands(program);