@codacy/verity-cli 0.27.1 → 0.27.2-experimental.5fb996a

package/bin/verity.js

@@ -10473,7 +10473,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10483,91 +10483,6 @@ function githubAppInstallUrl(accountId) {
   return accountId != null ? `https://github.com/apps/${GITHUB_APP_SLUG}/installations/new/permissions?target_id=${accountId}` : GITHUB_APP_INSTALL_URL;
 }
 
-// src/lib/auth.ts
-async function resolveToken(flagToken) {
-  if (flagToken) {
-    return { ok: true, data: { token: flagToken, source: "flag" } };
-  }
-  const envToken = process.env.VERITY_TOKEN;
-  if (envToken) {
-    return { ok: true, data: { token: envToken, source: "env" } };
-  }
-  try {
-    const content = await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
-    const match = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
-    if (match) {
-      return { ok: true, data: { token: match[1], source: "local" } };
-    }
-  } catch {
-  }
-  const globalCredentials = `${process.env.HOME}/.verity/credentials`;
-  try {
-    const content = await (0, import_promises.readFile)(globalCredentials, "utf-8");
-    let remote = "";
-    try {
-      remote = (0, import_node_child_process2.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
-    } catch {
-    }
-    if (remote) {
-      const remoteLine = content.split("\n").find((l) => l.includes(remote));
-      if (remoteLine) {
-        const match = remoteLine.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
-        if (match) {
-          return { ok: true, data: { token: match[1], source: "global" } };
-        }
-      }
-    }
-    const plainMatch = content.match(/^token:\s*((?:gate_|verity_)[a-f0-9]+)/m);
-    if (plainMatch) {
-      return { ok: true, data: { token: plainMatch[1], source: "global" } };
-    }
-  } catch {
-  }
-  return { ok: false, error: "No Verity token found. Run /verity-setup to configure." };
-}
-
-// src/lib/service-url.ts
-var import_promises2 = require("node:fs/promises");
-async function resolveServiceUrl(flagUrl) {
-  if (flagUrl) {
-    return { ok: true, data: flagUrl };
-  }
-  const envUrl = process.env.VERITY_SERVICE_URL;
-  if (envUrl) {
-    return { ok: true, data: envUrl };
-  }
-  try {
-    const creds = await (0, import_promises2.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
-    const match = creds.match(/service_url:\s*(https?:\/\/[^\s]+)/);
-    if (match) {
-      return { ok: true, data: match[1] };
-    }
-  } catch {
-  }
-  try {
-    const content = await (0, import_promises2.readFile)(projectPath(VERITY_MD_FILE), "utf-8");
-    const boldMatch = content.match(/\*\*url\*\*/i);
-    if (boldMatch) {
-      const lineMatch = content.split("\n").find((l) => /\*\*url\*\*/i.test(l));
-      if (lineMatch) {
-        const urlMatch = lineMatch.match(/https:\/\/[^\s]+/);
-        if (urlMatch) {
-          return { ok: true, data: urlMatch[0] };
-        }
-      }
-    }
-    const plainLine = content.split("\n").find((l) => /(?:url|service)\s*:/i.test(l));
-    if (plainLine) {
-      const urlMatch = plainLine.match(/https:\/\/[^\s]+/);
-      if (urlMatch) {
-        return { ok: true, data: urlMatch[0] };
-      }
-    }
-  } catch {
-  }
-  return { ok: false, error: "No Verity service URL found. Run /verity-setup to configure." };
-}
-
 // src/lib/output.ts
 var RED = "\x1B[0;31m";
 var YELLOW = "\x1B[1;33m";
@@ -10750,6 +10665,108 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/auth.ts
+function parseIdentity(content) {
+  const idMatch = content.match(/^user_id:\s*(\d+)/m);
+  const emailMatch = content.match(/^email:\s*(\S+)/m);
+  return {
+    userId: idMatch ? Number(idMatch[1]) : void 0,
+    email: emailMatch ? emailMatch[1] : void 0
+  };
+}
+async function resolveToken(flagToken) {
+  if (flagToken) {
+    return { ok: true, data: { token: flagToken, source: "flag" } };
+  }
+  const envToken = process.env.VERITY_TOKEN;
+  if (envToken) {
+    return { ok: true, data: { token: envToken, source: "env" } };
+  }
+  try {
+    const content = await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
+    const match = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
+    if (match) {
+      return { ok: true, data: { token: match[1], source: "local", ...parseIdentity(content) } };
+    }
+  } catch {
+  }
+  const globalCredentials = `${process.env.HOME}/.verity/credentials`;
+  try {
+    const content = await (0, import_promises.readFile)(globalCredentials, "utf-8");
+    let remote = "";
+    try {
+      remote = (0, import_node_child_process2.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
+    } catch {
+    }
+    if (remote) {
+      const remoteLine = content.split("\n").find((l) => l.includes(remote));
+      if (remoteLine) {
+        const match = remoteLine.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
+        if (match) {
+          return { ok: true, data: { token: match[1], source: "global" } };
+        }
+      }
+    }
+    const plainMatch = content.match(/^token:\s*((?:gate_|verity_)[a-f0-9]+)/m);
+    if (plainMatch) {
+      return { ok: true, data: { token: plainMatch[1], source: "global" } };
+    }
+  } catch {
+  }
+  return { ok: false, error: "No Verity token found. Run /verity-setup to configure." };
+}
+async function whoami(token, serviceUrl, verbose) {
+  return apiRequest({
+    method: "GET",
+    path: "/auth/whoami",
+    serviceUrl,
+    token,
+    verbose
+  });
+}
+
+// src/lib/service-url.ts
+var import_promises2 = require("node:fs/promises");
+async function resolveServiceUrl(flagUrl) {
+  if (flagUrl) {
+    return { ok: true, data: flagUrl };
+  }
+  const envUrl = process.env.VERITY_SERVICE_URL;
+  if (envUrl) {
+    return { ok: true, data: envUrl };
+  }
+  try {
+    const creds = await (0, import_promises2.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
+    const match = creds.match(/service_url:\s*(https?:\/\/[^\s]+)/);
+    if (match) {
+      return { ok: true, data: match[1] };
+    }
+  } catch {
+  }
+  try {
+    const content = await (0, import_promises2.readFile)(projectPath(VERITY_MD_FILE), "utf-8");
+    const boldMatch = content.match(/\*\*url\*\*/i);
+    if (boldMatch) {
+      const lineMatch = content.split("\n").find((l) => /\*\*url\*\*/i.test(l));
+      if (lineMatch) {
+        const urlMatch = lineMatch.match(/https:\/\/[^\s]+/);
+        if (urlMatch) {
+          return { ok: true, data: urlMatch[0] };
+        }
+      }
+    }
+    const plainLine = content.split("\n").find((l) => /(?:url|service)\s*:/i.test(l));
+    if (plainLine) {
+      const urlMatch = plainLine.match(/https:\/\/[^\s]+/);
+      if (urlMatch) {
+        return { ok: true, data: urlMatch[0] };
+      }
+    }
+  } catch {
+  }
+  return { ok: false, error: "No Verity service URL found. Run /verity-setup to configure." };
+}
+
 // src/lib/register.ts
 var import_promises3 = require("node:fs/promises");
 var import_node_path3 = require("node:path");
@@ -11047,8 +11064,8 @@ function filterReviewable(files) {
     const ext = (0, import_node_path2.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename3 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename3)) return true;
+    const basename4 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename4)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -11174,13 +11191,18 @@ async function registerProject(opts) {
     return { ok: false, error: result.error };
   }
   const { project_id, token, service_url, user } = result.data;
+  const userId = result.data.user_id ?? user?.id;
+  const email = user?.email;
+  const identityLines = (userId != null ? `user_id: ${userId}
+` : "") + (email ? `email: ${email}
+` : "");
   try {
     await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
     await (0, import_promises3.writeFile)(
       CREDENTIALS_FILE,
       `token: ${token}
 service_url: ${service_url}
-`,
+${identityLines}`,
       { mode: 384 }
     );
     await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
@@ -11203,7 +11225,7 @@ service_url: ${service_url}
     });
   } catch {
   }
-  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email: user?.email } };
+  return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email, userId } };
 }
 
 // src/commands/auth.ts
@@ -11293,13 +11315,70 @@ function registerAuthCommands(program2) {
   });
 }
 
+// src/commands/login.ts
+var import_node_child_process5 = require("node:child_process");
+var import_node_path4 = require("node:path");
+function registerLoginCommand(program2) {
+  program2.command("login").description("Log in to Verity (link your GitHub identity so runs and memory are saved)").option("--force", "Re-authenticate even if already logged in").action(async (opts) => {
+    const globals = program2.opts();
+    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    if (!urlResult.ok) {
+      printError(urlResult.error);
+      process.exit(1);
+    }
+    const serviceUrl = urlResult.data;
+    const existing = await resolveToken(globals.token);
+    if (existing.ok && !opts.force) {
+      if (existing.data.userId != null) {
+        printInfo(`Already logged in as ${existing.data.email ?? `user #${existing.data.userId}`}. \u2713`);
+        printInfo("  Re-authenticate with: verity login --force");
+        return;
+      }
+      const who2 = await whoami(existing.data.token, serviceUrl, globals.verbose);
+      if (who2.ok && who2.data.logged_in) {
+        printInfo(`Already logged in as ${who2.data.email ?? `user #${who2.data.user_id}`}. \u2713`);
+        printInfo("  Re-authenticate with: verity login --force");
+        return;
+      }
+      if (who2.ok && who2.data.anonymous) {
+        printInfo("You have an anonymous token (the gate runs, but nothing is saved). Logging you in\u2026");
+      } else if (!who2.ok) {
+        printWarn("Could not confirm your current login state with the service \u2014 proceeding to log in.");
+      }
+    }
+    let remote = "";
+    try {
+      remote = (0, import_node_child_process5.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    } catch {
+    }
+    if (!remote) {
+      printError("verity login needs a git remote (origin) to link this repository.");
+      printInfo("  Add one with: git remote add origin <url>, then re-run verity login.");
+      process.exit(1);
+    }
+    const projectName = parseRemote(remote)?.repo ?? (0, import_node_path4.basename)(process.cwd());
+    printInfo("Authenticating with GitHub\u2026");
+    const result = await registerProject({ projectName, remote, serviceUrl, verbose: globals.verbose });
+    if (!result.ok) {
+      printError(`Login failed: ${result.error}`);
+      process.exit(1);
+    }
+    const who = result.data.email ?? (result.data.userId != null ? `user #${result.data.userId}` : "your account");
+    printInfo(`Logged in as ${who}. \u2713`);
+    printInfo("  Runs, history, and cloud memory now sync to Verity for this project.");
+    if (result.data.userId == null) {
+      printWarn("  (Server did not return a user id \u2014 update the CLI if this persists.)");
+    }
+  });
+}
+
 // src/lib/hooks.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path4 = require("node:path");
+var import_node_path5 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -11345,7 +11424,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(file), { recursive: true });
+  await (0, import_promises4.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
   await (0, import_promises4.writeFile)(file, next);
   return true;
 }
@@ -11506,13 +11585,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path5.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -11748,12 +11827,12 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises6 = require("node:fs/promises");
 var import_node_fs3 = require("node:fs");
-var import_node_child_process5 = require("node:child_process");
+var import_node_child_process6 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
@@ -11856,7 +11935,7 @@ async function readBufferEntries() {
 }
 function getRecentCommitMessages() {
   try {
-    const output = (0, import_node_child_process5.execSync)(
+    const output = (0, import_node_child_process6.execSync)(
       'git log --since="30 minutes ago" --format="%s" -5',
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -11867,10 +11946,23 @@ function getRecentCommitMessages() {
   }
 }
 
+// src/lib/context-identity.ts
+var import_node_crypto2 = require("node:crypto");
+function contextIdentity(token, sessionId) {
+  const t = (token ?? "").trim();
+  const s = (sessionId ?? "").trim();
+  const userKey = t.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(t).digest("hex").slice(0, 12) : "anon";
+  const sessionKey2 = s.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(s).digest("hex").slice(0, 16) : "_default";
+  return { userKey, sessionKey: sessionKey2, bucket: `${userKey}/${sessionKey2}` };
+}
+function sessionScopeKey(token, sessionId) {
+  return contextIdentity(token, sessionId).bucket;
+}
+
 // src/lib/task-context-buffer.ts
 var import_promises7 = require("node:fs/promises");
 var import_node_fs4 = require("node:fs");
-var import_node_path6 = require("node:path");
+var import_node_path7 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
 var MAX_BUFFER_BYTES = 500 * 1024;
 var MAX_PROMPT_CHARS = 2e3;
@@ -11948,7 +12040,7 @@ async function cleanupTaskContextBuffers() {
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
-      const filePath = (0, import_node_path6.join)(TASK_CONTEXT_DIR, file);
+      const filePath = (0, import_node_path7.join)(TASK_CONTEXT_DIR, file);
       try {
         const stats = await (0, import_promises7.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
@@ -11962,7 +12054,7 @@ async function cleanupTaskContextBuffers() {
 }
 function bufferPath(taskId) {
   const safe = taskId.replace(/[^a-zA-Z0-9_-]/g, "");
-  return (0, import_node_path6.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
+  return (0, import_node_path7.join)(TASK_CONTEXT_DIR, `${safe}.jsonl`);
 }
 async function appendEntry(taskId, entry) {
   try {
@@ -11988,7 +12080,7 @@ async function appendEntry(taskId, entry) {
 // src/lib/memory-retrieval.ts
 var import_promises8 = require("node:fs/promises");
 var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_path8 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations"];
 var DEFAULT_BUDGET_TOKENS = 2e3;
@@ -12086,14 +12178,14 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
   const promptTokens = tokenize(promptText);
   const nodes = [];
   for (const domain of DOMAINS) {
-    const domainDir = (0, import_node_path7.join)(memoryDir(), domain);
+    const domainDir = (0, import_node_path8.join)(memoryDir(), domain);
     if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path7.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -12153,8 +12245,8 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 // src/lib/memory-sync.ts
 var import_promises9 = require("node:fs/promises");
 var import_node_fs6 = require("node:fs");
-var import_node_path8 = require("node:path");
-var import_node_crypto2 = require("node:crypto");
+var import_node_path9 = require("node:path");
+var import_node_crypto3 = require("node:crypto");
 
 // src/lib/glob-match.ts
 function globToRegex(glob) {
@@ -12224,16 +12316,16 @@ var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
   await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path8.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises9.mkdir)((0, import_node_path9.join)(memoryDir2(), domain), { recursive: true });
   }
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "index.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
-  if (!(0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+  if (!(0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md"))) {
+    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
@@ -12242,17 +12334,17 @@ async function buildManifest() {
   }
   const nodes = [];
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
-        const fullPath = (0, import_node_path8.join)(memoryDir2(), filePath);
+        const fullPath = (0, import_node_path9.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
-          const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16);
+          const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
         }
@@ -12262,32 +12354,32 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "index.md"), "utf-8");
-    indexHash = `sha256:${(0, import_node_crypto2.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
+    const indexContent = await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "utf-8");
+    indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
   return { schema_version: 1, nodes, index_hash: indexHash, log_length: logLength };
 }
 function hashContent(content) {
-  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
+  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
   if (!(0, import_node_fs6.existsSync)(memoryDir2())) return out;
   for (const domain of DOMAINS2) {
-    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       for (const file of await (0, import_promises9.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -12333,7 +12425,7 @@ async function computeEditedNodeUploads() {
   const uploads = [];
   for (const [path, prevHash] of prev) {
     if (prevHash == null) continue;
-    const full = (0, import_node_path8.join)(memoryDir2(), path);
+    const full = (0, import_node_path9.join)(memoryDir2(), path);
     if (!(0, import_node_fs6.existsSync)(full)) continue;
     let content;
     try {
@@ -12370,15 +12462,15 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs6.existsSync)((0, import_node_path8.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path8.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
   return count;
 }
 async function applyOneWrite(write, treePaths) {
-  const fullPath = (0, import_node_path8.join)(memoryDir2(), write.path);
+  const fullPath = (0, import_node_path9.join)(memoryDir2(), write.path);
   const notes = [];
   let content = write.content;
   if (treePaths && treePaths.length > 0) {
@@ -12400,7 +12492,7 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path8.dirname)(fullPath), { recursive: true });
+  await (0, import_promises9.mkdir)((0, import_node_path9.dirname)(fullPath), { recursive: true });
   await (0, import_promises9.writeFile)(fullPath, content);
   return { written: true, notes };
 }
@@ -12441,7 +12533,7 @@ async function regenerateIndex() {
   ];
   let totalNodes = 0;
   for (const domain of DOMAINS2.filter((d) => d !== "_archive")) {
-    const domainDir = (0, import_node_path8.join)(memoryDir2(), domain);
+    const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
       const files = await (0, import_promises9.readdir)(domainDir);
@@ -12452,7 +12544,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises9.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -12476,7 +12568,7 @@ async function regenerateIndex() {
     lines.push("No nodes yet. Run an analysis to start building the knowledge graph.");
   }
   const next = lines.join("\n") + "\n";
-  const indexPath = (0, import_node_path8.join)(memoryDir2(), "index.md");
+  const indexPath = (0, import_node_path9.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
     existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
@@ -12558,7 +12650,7 @@ function hasLegacyMemoryBlock(text) {
   return findMarker(text, LEGACY_MD_START) !== -1;
 }
 async function ensureClaudeMdPointer(cwd = repoRoot()) {
-  const claudeMdPath = (0, import_node_path8.join)(cwd, "CLAUDE.md");
+  const claudeMdPath = (0, import_node_path9.join)(cwd, "CLAUDE.md");
   let existing = "";
   if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
     existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
@@ -12720,7 +12812,10 @@ function registerIntentCommands(program2) {
       if (!prompt) {
         process.exit(0);
       }
-      await appendToConversationBuffer(prompt, event.session_id ?? "");
+      const authForScope = await resolveToken(program2.opts().token);
+      const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
+      const scopeSession = event.session_id || process.env.CLAUDE_SESSION_ID || "";
+      await appendToConversationBuffer(prompt, sessionScopeKey(scopeToken, scopeSession));
       try {
         await ensureMemoryDir();
         const injection = await retrieveForInjection(prompt);
@@ -12762,7 +12857,7 @@ async function fireClassify(prompt, sessionId) {
     logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
     return;
   }
-  const promptHash = (0, import_node_crypto3.createHash)("sha256").update(prompt).digest("hex");
+  const promptHash = (0, import_node_crypto4.createHash)("sha256").update(prompt).digest("hex");
   const result = await apiRequest({
     method: "POST",
     path: "/classify-task",
@@ -13113,6 +13208,16 @@ function registerStatusCommand(program2) {
       return;
     }
     printInfo("=== Verity Status ===");
+    if (tokenResult.data.userId != null) {
+      printInfo(`Account:     Logged in as ${tokenResult.data.email ?? `user #${tokenResult.data.userId}`} \u2713`);
+    } else {
+      const who = await whoami(token, serviceUrl, globals.verbose);
+      if (who.ok && who.data.logged_in) {
+        printInfo(`Account:     Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713`);
+      } else if (who.ok && who.data.anonymous) {
+        printInfo('Account:     Anonymous \u2014 runs not saved, no cloud memory. Run "verity login".');
+      }
+    }
     if (mem.project_name) printInfo(`Project:     ${mem.project_name}`);
     if (mem.standard) {
       const s = mem.standard;
@@ -13276,11 +13381,11 @@ async function sendGeneralFeedback(message, opts, globals) {
 
 // src/commands/analyze.ts
 var import_node_fs19 = require("node:fs");
-var import_node_path15 = require("node:path");
+var import_node_path16 = require("node:path");
 
 // src/lib/files.ts
 var import_node_fs8 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_path10 = require("node:path");
 var LANG_MAP = {
   // Analyzable (static analysis + Gemini)
   ts: "typescript",
@@ -13348,7 +13453,7 @@ var LANG_MAP = {
   mk: "make"
 };
 function detectLanguage(filepath) {
-  const ext = (0, import_node_path9.extname)(filepath).slice(1);
+  const ext = (0, import_node_path10.extname)(filepath).slice(1);
   return LANG_MAP[ext] ?? ext;
 }
 function sortByMtime(files) {
@@ -13410,10 +13515,10 @@ function collectCodeDelta(files, opts) {
 
 // src/lib/debounce.ts
 var import_node_fs9 = require("node:fs");
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto4.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+  return `${base}.${(0, import_node_crypto5.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
@@ -13454,7 +13559,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto4.createHash)("sha1");
+  const hash = (0, import_node_crypto5.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
@@ -13543,7 +13648,7 @@ function writeIteration(iteration, commit, _contentHash) {
 }
 
 // src/lib/static-analysis.ts
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 var import_node_fs10 = require("node:fs");
 var SEVERITY_ORDER = {
   Error: 0,
@@ -13556,7 +13661,7 @@ var SEVERITY_ORDER = {
 };
 function isCodacyAvailable() {
   try {
-    (0, import_node_child_process6.execSync)("which codacy-analysis", { stdio: "pipe" });
+    (0, import_node_child_process7.execSync)("which codacy-analysis", { stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -13580,7 +13685,7 @@ function runCodacyAnalysis(files) {
   const fileArgs = existingFiles.join(" ");
   let output;
   try {
-    output = (0, import_node_child_process6.execSync)(
+    output = (0, import_node_child_process7.execSync)(
       `codacy-analysis analyze --install-dependencies --files ${fileArgs} --output-format json --log-level error --parallel-tools 3`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"], maxBuffer: 10 * 1024 * 1024 }
     );
@@ -13634,7 +13739,7 @@ function runCodacyAnalysis(files) {
 
 // src/lib/specs.ts
 var import_node_fs11 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_path11 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
   "AGENTS.md",
@@ -13696,7 +13801,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   try {
     const entries = (0, import_node_fs11.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path10.join)(dir, entry.name);
+      const fullPath = (0, import_node_path11.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
         result.push(fullPath);
       } else if (entry.isDirectory() && depth < maxDepth - 1) {
@@ -13708,7 +13813,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   return result;
 }
 function discoverPlans() {
-  const homePlansDir = (0, import_node_path10.join)(process.env.HOME ?? "", ".claude", "plans");
+  const homePlansDir = (0, import_node_path11.join)(process.env.HOME ?? "", ".claude", "plans");
   const localPlansDir = ".claude/plans";
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -13718,7 +13823,7 @@ function discoverPlans() {
       for (const f of (0, import_node_fs11.readdirSync)(plansDir)) {
         if (!f.endsWith(".md") || seen.has(f)) continue;
         seen.add(f);
-        const fullPath = (0, import_node_path10.join)(plansDir, f);
+        const fullPath = (0, import_node_path11.join)(plansDir, f);
         try {
           const stat3 = (0, import_node_fs11.statSync)(fullPath);
           candidates.push({ name: f, path: fullPath, mtime: stat3.mtimeMs, size: stat3.size });
@@ -13743,15 +13848,15 @@ function discoverPlans() {
 
 // src/lib/snapshot.ts
 var import_node_fs12 = require("node:fs");
-var import_node_path11 = require("node:path");
-var import_node_child_process7 = require("node:child_process");
+var import_node_path12 = require("node:path");
+var import_node_child_process8 = require("node:child_process");
 function generateSnapshotDiffs(files) {
   if (!(0, import_node_fs12.existsSync)(SNAPSHOT_DIR)) {
     return { diffs: [], has_snapshots: false };
   }
   const diffs = [];
   for (const file of files) {
-    const snapshotPath = (0, import_node_path11.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path12.join)(SNAPSHOT_DIR, file.path);
     const language = file.language ?? detectLanguage(file.path);
     if ((0, import_node_fs12.existsSync)(snapshotPath)) {
       const oldContent = (0, import_node_fs12.readFileSync)(snapshotPath, "utf-8");
@@ -13778,21 +13883,21 @@ ${addedLines}`,
 function saveSnapshots(files) {
   const snapshotPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const snapshotPath = (0, import_node_path11.join)(SNAPSHOT_DIR, file.path);
+    const snapshotPath = (0, import_node_path12.join)(SNAPSHOT_DIR, file.path);
     snapshotPaths.add(snapshotPath);
-    (0, import_node_fs12.mkdirSync)((0, import_node_path11.dirname)(snapshotPath), { recursive: true });
+    (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(snapshotPath), { recursive: true });
     (0, import_node_fs12.writeFileSync)(snapshotPath, file.content);
   }
   cleanStaleSnapshots(SNAPSHOT_DIR, snapshotPaths);
 }
 function computeDiff(oldContent, newContent, filePath) {
-  const tmpOld = (0, import_node_path11.join)(SNAPSHOT_DIR, ".diff-old.tmp");
-  const tmpNew = (0, import_node_path11.join)(SNAPSHOT_DIR, ".diff-new.tmp");
+  const tmpOld = (0, import_node_path12.join)(SNAPSHOT_DIR, ".diff-old.tmp");
+  const tmpNew = (0, import_node_path12.join)(SNAPSHOT_DIR, ".diff-new.tmp");
   try {
     (0, import_node_fs12.mkdirSync)(SNAPSHOT_DIR, { recursive: true });
     (0, import_node_fs12.writeFileSync)(tmpOld, oldContent);
     (0, import_node_fs12.writeFileSync)(tmpNew, newContent);
-    const result = (0, import_node_child_process7.execSync)(
+    const result = (0, import_node_child_process8.execSync)(
       `git diff --no-index --unified=10 -- "${tmpOld}" "${tmpNew}"`,
       { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
     );
@@ -13820,7 +13925,7 @@ function cleanStaleSnapshots(dir, keepSet) {
     const entries = (0, import_node_fs12.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
-      const fullPath = (0, import_node_path11.join)(dir, entry.name);
+      const fullPath = (0, import_node_path12.join)(dir, entry.name);
       if (entry.isDirectory()) {
         cleanStaleSnapshots(fullPath, keepSet);
         try {
@@ -13841,24 +13946,24 @@ function cleanStaleSnapshots(dir, keepSet) {
 
 // src/lib/baseline.ts
 var import_node_fs13 = require("node:fs");
-var import_node_path12 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_path13 = require("node:path");
+var import_node_crypto6 = require("node:crypto");
 var BASELINE_VERSION = 1;
 var BASELINE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
 var DEFAULT_SESSION_KEY = "_default";
 function sessionKey(sessionId) {
   if (!sessionId) return DEFAULT_SESSION_KEY;
-  return (0, import_node_crypto5.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return (0, import_node_crypto6.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
-  return (0, import_node_path12.join)(projectPath(BASELINE_DIR), key);
+  return (0, import_node_path13.join)(projectPath(BASELINE_DIR), key);
 }
 function manifestPath(dir) {
-  return (0, import_node_path12.join)(dir, "manifest.json");
+  return (0, import_node_path13.join)(dir, "manifest.json");
 }
 function mirrorPath(dir, repoRelPath) {
-  return (0, import_node_path12.join)(dir, "files", repoRelPath);
+  return (0, import_node_path13.join)(dir, "files", repoRelPath);
 }
 function captureBaseline(opts = {}) {
   const key = sessionKey(opts.sessionId);
@@ -13874,7 +13979,7 @@ function captureBaseline(opts = {}) {
     (0, import_node_fs13.rmSync)(dir, { recursive: true, force: true });
   } catch {
   }
-  const filesDir = (0, import_node_path12.join)(dir, "files");
+  const filesDir = (0, import_node_path13.join)(dir, "files");
   const mirrored = [];
   try {
     (0, import_node_fs13.mkdirSync)(filesDir, { recursive: true });
@@ -13884,7 +13989,7 @@ function captureBaseline(opts = {}) {
       if (content === null) continue;
       const dest = mirrorPath(dir, p);
       try {
-        (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(dest), { recursive: true });
+        (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(dest), { recursive: true });
         (0, import_node_fs13.writeFileSync)(dest, content);
         mirrored.push(p);
       } catch {
@@ -14012,7 +14117,7 @@ function pruneOldBaselines() {
   }
   const now = Date.now();
   for (const name of entries) {
-    const dir = (0, import_node_path12.join)(root, name);
+    const dir = (0, import_node_path13.join)(root, name);
     const manifest = readManifest(dir);
     if (!manifest) {
       try {
@@ -14031,13 +14136,75 @@ function pruneOldBaselines() {
   }
 }
 
+// src/lib/task-context.ts
+var import_node_child_process9 = require("node:child_process");
+var CLOSING_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\b[\s:]*#(\d+)/i;
+var BRANCH_RE = /(?:^|[/_-])(?:issue|gh|fix)[-_/]?(\d+)\b/i;
+function parseLinkedIssue(sources) {
+  for (const c of sources.commits ?? []) {
+    const m = CLOSING_RE.exec(c);
+    if (m) return { issue: parseInt(m[2], 10), via: `commit:${m[1].toLowerCase()}` };
+  }
+  if (sources.branch) {
+    const m = BRANCH_RE.exec(sources.branch);
+    if (m) return { issue: parseInt(m[1], 10), via: "branch" };
+  }
+  return null;
+}
+function safeExec(cmd, timeout) {
+  try {
+    return (0, import_node_child_process9.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
+  } catch {
+    return "";
+  }
+}
+function defaultGhFetch(issue) {
+  const raw = safeExec(`gh issue view ${issue} --json title,body`, 5e3);
+  if (!raw) return null;
+  try {
+    const j = JSON.parse(raw);
+    return j.title ? { title: j.title, body: j.body ?? "" } : null;
+  } catch {
+    return null;
+  }
+}
+function resolveTaskContext(opts) {
+  const branch = opts?.branch ?? safeExec("git rev-parse --abbrev-ref HEAD", 3e3);
+  const commits = opts?.commits ?? safeExec("git log -5 --format=%s%n%b", 3e3).split("\n").map((l) => l.trim()).filter(Boolean);
+  const linked = parseLinkedIssue({ branch, commits });
+  if (!linked) return null;
+  const issue = (opts?.ghFetch ?? defaultGhFetch)(linked.issue);
+  if (!issue) return null;
+  const body = (issue.body ?? "").slice(0, 4e3).trim();
+  const goal = `[#${linked.issue}] ${issue.title}${body ? "\n\n" + body : ""}`;
+  return { number: linked.issue, title: issue.title, goal, via: linked.via };
+}
+
+// src/lib/run-mode.ts
+function parseAutonomousEnv(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v === "") return void 0;
+  if (v === "0" || v === "false" || v === "off" || v === "no") return false;
+  return true;
+}
+function resolveRunMode(inputs = {}) {
+  if (inputs.autonomousFlag === true) return "autonomous";
+  if (inputs.autonomousFlag === false) return "interactive";
+  const env = inputs.env ?? process.env;
+  const envDecision = parseAutonomousEnv(env.VERITY_AUTONOMOUS);
+  if (envDecision !== void 0) return envDecision ? "autonomous" : "interactive";
+  const isTTY = inputs.isTTY ?? Boolean(process.stdin?.isTTY);
+  return isTTY ? "interactive" : "autonomous";
+}
+
 // src/lib/offline.ts
 var import_node_fs14 = require("node:fs");
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function cacheRequest(body) {
   try {
     (0, import_node_fs14.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto6.randomBytes)(4).toString("hex");
+    const suffix = (0, import_node_crypto7.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
     (0, import_node_fs14.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(body));
   } catch {
@@ -14111,7 +14278,7 @@ function gatherContextFiles(contextPaths, deltaFiles) {
 
 // src/lib/cache-cleanup.ts
 var import_node_fs16 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_path14 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
@@ -14119,7 +14286,7 @@ function pruneStaleCache() {
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
     for (const entry of (0, import_node_fs16.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
-      const path = (0, import_node_path13.join)(dir, entry);
+      const path = (0, import_node_path14.join)(dir, entry);
       try {
         const stat3 = (0, import_node_fs16.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
@@ -14242,6 +14409,12 @@ function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPromp
   }
   return "standard";
 }
+function scopeToAuthored(files, actionSummary) {
+  if (!actionSummary) return { files, signal: "no-transcript" };
+  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
+  if (touched.length === 0) return { files: [], signal: "none-authored" };
+  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
+}
 function narrowToAgentAuthored(files, actionSummary) {
   if (!actionSummary) return files;
   const touched = [
@@ -14512,7 +14685,7 @@ function capArray(set, max) {
 // src/lib/seed-runner.ts
 var import_promises12 = require("node:fs/promises");
 var import_node_fs18 = require("node:fs");
-var import_node_path14 = require("node:path");
+var import_node_path15 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
 
 // src/lib/seed.ts
@@ -14794,7 +14967,7 @@ async function runSeed(opts) {
   if (candidates.length === 0) {
     return { created: 0, failed: 0, skipped: "no_candidates", candidates: [] };
   }
-  const overviewPath = (0, import_node_path14.join)(MEMORY_DIR, "domain", "project-overview.md");
+  const overviewPath = (0, import_node_path15.join)(MEMORY_DIR, "domain", "project-overview.md");
   if ((0, import_node_fs18.existsSync)(overviewPath) && !opts.force) {
     return { created: 0, failed: 0, skipped: "already_seeded", candidates };
   }
@@ -14830,9 +15003,9 @@ async function runSeed(opts) {
     }
     const nodeId = res.data.node_id;
     const filePathRel = res.data.file_path;
-    const targetPath = (0, import_node_path14.join)(MEMORY_DIR, filePathRel);
+    const targetPath = (0, import_node_path15.join)(MEMORY_DIR, filePathRel);
     try {
-      await (0, import_promises12.mkdir)((0, import_node_path14.dirname)(targetPath), { recursive: true });
+      await (0, import_promises12.mkdir)((0, import_node_path15.dirname)(targetPath), { recursive: true });
       await (0, import_promises12.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
@@ -14923,7 +15096,10 @@ async function runAnalyze(opts, globals) {
   }
   const { assistantMessage: assistantResponse, stopReason, transcriptPath, sessionId } = await readStopHookStdin();
   const actionSummary = transcriptPath ? await extractActionSummary(transcriptPath) : null;
-  const baselineSessionId = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+  const tokenResult = await resolveToken(globals.token);
+  const scopeToken = tokenResult.ok ? tokenResult.data.token : void 0;
+  const rawSessionId = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+  const baselineSessionId = sessionScopeKey(scopeToken, rawSessionId);
   const baseline = readBaseline(baselineSessionId);
   if (baseline) {
     logEvent("baseline_loaded", {
@@ -14941,7 +15117,7 @@ async function runAnalyze(opts, globals) {
     passAndExit("No analyzable files changed");
   }
   const allForReview = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable]));
-  const conversation = await readAndClearConversationBuffer(sessionId ?? void 0);
+  const conversation = await readAndClearConversationBuffer(baselineSessionId);
   const specs = discoverSpecs();
   const plans = discoverPlans();
   const latestPrompt = conversation?.prompts?.[conversation.prompts.length - 1]?.prompt ?? "";
@@ -14955,7 +15131,6 @@ async function runAnalyze(opts, globals) {
   if (isReflectionQuestion(assistantResponse) && !agentAuthoredCodeThisTurn) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
-  const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) {
     localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
@@ -15049,8 +15224,11 @@ async function runAnalyze(opts, globals) {
       }
       contentHash = hashResult.hash;
       if (analysisMode !== "plan") {
-        const agentNarrowed = narrowToAgentAuthored(allForReview, actionSummary);
-        const baseForReview = agentNarrowed.length > 0 ? agentNarrowed : allForReview;
+        const scoped = scopeToAuthored(allForReview, actionSummary);
+        if (scoped.signal === "none-authored" && (actionSummary?.subagents ?? 0) === 0) {
+          passAndExit("No agent-authored code this turn \u2014 working-tree changes were not authored by this session");
+        }
+        const baseForReview = scoped.signal === "authored" && scoped.files.length > 0 ? scoped.files : allForReview;
         const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
         if (!opts.skipStatic && isCodacyAvailable()) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
@@ -15114,7 +15292,7 @@ async function runAnalyze(opts, globals) {
   let autoSeedNotice = null;
   try {
     await ensureMemoryDir();
-    const seedMarker = (0, import_node_path15.join)(VERITY_DIR, ".seeded");
+    const seedMarker = (0, import_node_path16.join)(VERITY_DIR, ".seeded");
     const hasStandard = (0, import_node_fs19.existsSync)(STANDARD_FILE);
     const alreadyTried = (0, import_node_fs19.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
@@ -15180,7 +15358,9 @@ async function runAnalyze(opts, globals) {
   if (snapshotResult.has_snapshots && snapshotResult.diffs.length > 0) {
     requestBody.snapshot_diffs = snapshotResult.diffs;
   }
-  const hasIntent = (conversation?.prompts?.length ?? 0) > 0 || specs.length > 0 || plans.length > 0 || !!assistantResponse;
+  const noHumanPrompt = (conversation?.prompts?.length ?? 0) === 0;
+  const w4Task = noHumanPrompt && resolveRunMode() === "autonomous" ? resolveTaskContext() : null;
+  const hasIntent = (conversation?.prompts?.length ?? 0) > 0 || specs.length > 0 || plans.length > 0 || !!assistantResponse || !!w4Task;
   if (hasIntent) {
     const intentContext = {};
     if (conversation && conversation.prompts.length > 0) {
@@ -15195,6 +15375,10 @@ async function runAnalyze(opts, globals) {
         intentContext.recent_commits = conversation.recent_commits;
       }
     }
+    if (w4Task && !intentContext.user_prompt) {
+      intentContext.user_prompt = w4Task.goal;
+      logEvent("w4_issue_anchor", { issue: w4Task.number, via: w4Task.via });
+    }
     if (assistantResponse) {
       const cap = analysisMode === "plan" ? MAX_ASSISTANT_RESPONSE_CHARS_PLAN : MAX_ASSISTANT_RESPONSE_CHARS_DEFAULT;
       intentContext.assistant_response = assistantResponse.length > cap ? assistantResponse.slice(0, cap) : assistantResponse;
@@ -15348,6 +15532,7 @@ async function runAnalyze(opts, globals) {
     }
   }
   saveSnapshots(codeDelta.files.map((f) => ({ path: f.path, content: f.content })));
+  const loginNudge = response.persisted === false ? " \u26A0\uFE0F Not logged in \u2014 this run was NOT saved and Verity has no memory of your project. Run `verity login` to unlock run history, trends, and cloud memory." : "";
   switch (decision) {
     case "FAIL": {
       writeIteration(iteration + 1, currentCommit, contentHash ?? void 0);
@@ -15420,6 +15605,9 @@ async function runAnalyze(opts, globals) {
 `);
       }
       process.stderr.write(`${BOLD}Fix these issues, then I will re-analyze automatically.${NC}
+`);
+      if (loginNudge) process.stderr.write(`
+${YELLOW}${loginNudge.trim()}${NC}
 `);
       process.exit(2);
       break;
@@ -15432,6 +15620,7 @@ async function runAnalyze(opts, globals) {
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
+      userSummary += loginNudge;
       printJsonCompact({ gate_decision: "PASS", systemMessage: userSummary });
       process.exit(0);
       break;
@@ -15443,12 +15632,13 @@ async function runAnalyze(opts, globals) {
       const viewUrl = response.view_url ?? "";
       if (viewUrl) userSummary += ` Report: ${viewUrl}`;
       if (autoSeedNotice) userSummary = `${autoSeedNotice} ${userSummary}`;
+      userSummary += loginNudge;
       printJsonCompact({ gate_decision: "WARN", systemMessage: userSummary });
       process.exit(0);
       break;
     }
     default: {
-      const msg = autoSeedNotice ? `${autoSeedNotice} Verity: Analysis complete` : "Verity: Analysis complete";
+      const msg = (autoSeedNotice ? `${autoSeedNotice} Verity: Analysis complete` : "Verity: Analysis complete") + loginNudge;
       printJsonCompact({ gate_decision: "PASS", systemMessage: msg });
       process.exit(0);
     }
@@ -15481,7 +15671,10 @@ function registerBaselineCommands(program2) {
           }
         }
       }
-      const result = captureBaseline({ sessionId, source });
+      const authForScope = await resolveToken(program2.opts().token);
+      const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
+      const scopeSession = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+      const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source });
       logEvent("baseline_capture", {
         created: result.created,
         source: source ?? null,
@@ -15608,9 +15801,9 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs22 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_path17 = require("node:path");
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path16.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path17.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
   return new Promise((resolve) => {
@@ -15926,21 +16119,21 @@ function writeBlockMessage(moment, response) {
 // src/commands/init.ts
 var import_node_fs24 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
-var import_node_path18 = require("node:path");
-var import_node_child_process9 = require("node:child_process");
+var import_node_path19 = require("node:path");
+var import_node_child_process11 = require("node:child_process");
 var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs23 = require("node:fs");
-var import_node_path17 = require("node:path");
-var import_node_child_process8 = require("node:child_process");
+var import_node_path18 = require("node:path");
+var import_node_child_process10 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process8.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process10.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process8.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -15948,7 +16141,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process8.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -15968,8 +16161,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path17.join)(root, ".gate");
-  const verityDir = (0, import_node_path17.join)(root, ".verity");
+  const gateDir = (0, import_node_path18.join)(root, ".gate");
+  const verityDir = (0, import_node_path18.join)(root, ".verity");
   if ((0, import_node_fs23.existsSync)(gateDir) && !(0, import_node_fs23.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -15987,7 +16180,7 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process8.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
@@ -16023,11 +16216,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path17.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path17.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path18.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path18.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs23.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs23.existsSync)(verityCreds)) {
-    (0, import_node_fs23.mkdirSync)((0, import_node_path17.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs23.mkdirSync)((0, import_node_path18.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -16049,7 +16242,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path17.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path18.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs23.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -16060,13 +16253,13 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path17.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path17.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path18.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path18.join)(root, "VERITY.md");
   if (!(0, import_node_fs23.existsSync)(gateMd) || (0, import_node_fs23.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process8.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -16122,7 +16315,7 @@ function readFileSyncSafe(path) {
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process8.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -16149,15 +16342,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk = (relDir) => {
-    const srcDir = (0, import_node_path17.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path18.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs23.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path17.join)(relDir, entry) : entry;
-      const src = (0, import_node_path17.join)(gateDir, rel);
-      const dest = (0, import_node_path17.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path18.join)(relDir, entry) : entry;
+      const src = (0, import_node_path18.join)(gateDir, rel);
+      const dest = (0, import_node_path18.join)(verityDir, rel);
       if ((0, import_node_fs23.statSync)(src).isDirectory()) {
         walk(rel);
       } else if (!(0, import_node_fs23.existsSync)(dest)) {
-        (0, import_node_fs23.mkdirSync)((0, import_node_path17.dirname)(dest), { recursive: true });
+        (0, import_node_fs23.mkdirSync)((0, import_node_path18.dirname)(dest), { recursive: true });
         (0, import_node_fs23.cpSync)(src, dest);
         copied++;
       }
@@ -16167,22 +16360,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path17.join)(root, ".gate");
-  const verityDir = (0, import_node_path17.join)(root, ".verity");
+  const gateDir = (0, import_node_path18.join)(root, ".gate");
+  const verityDir = (0, import_node_path18.join)(root, ".verity");
   if ((0, import_node_fs23.existsSync)(gateDir) && !(0, import_node_fs23.existsSync)(verityDir)) return true;
   if ((0, import_node_fs23.existsSync)(gateDir) && (0, import_node_fs23.existsSync)(verityDir)) {
-    if ((0, import_node_fs23.existsSync)((0, import_node_path17.join)(gateDir, "credentials")) && !(0, import_node_fs23.existsSync)((0, import_node_path17.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs23.existsSync)((0, import_node_path18.join)(gateDir, "credentials")) && !(0, import_node_fs23.existsSync)((0, import_node_path18.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs23.existsSync)((0, import_node_path17.join)(gateDir, "memory")) && !(0, import_node_fs23.existsSync)((0, import_node_path17.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs23.existsSync)((0, import_node_path18.join)(gateDir, "memory")) && !(0, import_node_fs23.existsSync)((0, import_node_path18.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path17.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path18.join)(root, "CLAUDE.md");
   if ((0, import_node_fs23.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs23.existsSync)((0, import_node_path17.join)(root, "GATE.md")) && !(0, import_node_fs23.existsSync)((0, import_node_path17.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs23.existsSync)((0, import_node_path18.join)(root, "GATE.md")) && !(0, import_node_fs23.existsSync)((0, import_node_path18.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -16218,15 +16411,30 @@ async function promptYes(question) {
     rl.close();
   }
 }
-async function runOptionalAuth() {
+async function runOptionalAuth(serviceUrl) {
   const existing = await resolveToken();
   if (existing.ok) {
-    printInfo("Already authenticated \u2014 results will upload to the Verity service. \u2713");
-    return;
+    const who = await whoami(existing.data.token, serviceUrl);
+    if (who.ok && who.data.logged_in) {
+      printInfo(`Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713 \u2014 runs & memory sync to Verity.`);
+      return;
+    }
+    if (!who.ok) {
+      if (existing.data.userId != null) {
+        printInfo(`Logged in as ${existing.data.email ?? `user #${existing.data.userId}`} (cached \u2014 could not reach the Verity service). \u2713`);
+      } else {
+        printInfo("Could not confirm your login state with the service; continuing with your existing token.");
+      }
+      return;
+    }
+    console.log("");
+    printWarn("You are NOT logged in \u2014 this project has only an anonymous token.");
+    printInfo("  The gate still runs, but no runs are saved and Verity keeps no memory of this project.");
+    printInfo("  Log in below to unlock run history, trends, and cloud memory (strongly recommended).");
   }
   let remote = "";
   try {
-    remote = (0, import_node_child_process9.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process11.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
   const localOnlyNote = () => {
@@ -16257,12 +16465,12 @@ async function runOptionalAuth() {
     localOnlyNote();
     return;
   }
-  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path18.basename)(process.cwd());
+  const projectName = parseRemote(remote)?.repo ?? (0, import_node_path19.basename)(process.cwd());
   printInfo("Authenticating with GitHub\u2026");
-  const result = await registerProject({ projectName, remote, serviceUrl: DEFAULT_SERVICE_URL });
+  const result = await registerProject({ projectName, remote, serviceUrl });
   if (result.ok) {
-    printInfo(`Project registered: ${result.data.projectId} \u2713`);
-    if (result.data.email) printInfo(`  Authenticated as: ${result.data.email}`);
+    const who = result.data.email ?? (result.data.userId != null ? `user #${result.data.userId}` : null);
+    printInfo(`Logged in${who ? ` as ${who}` : ""} \u2713 \u2014 runs, history, and cloud memory now sync to Verity.`);
   } else {
     printWarn(`Authentication did not complete: ${result.error}`);
     localOnlyNote();
@@ -16270,15 +16478,15 @@ async function runOptionalAuth() {
 }
 function resolveDataDir() {
   const candidates = [
-    (0, import_node_path18.join)(__dirname, "..", "data"),
+    (0, import_node_path19.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path18.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path19.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path18.join)(process.cwd(), "cli", "data")
+    (0, import_node_path19.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates) {
-    if ((0, import_node_fs24.existsSync)((0, import_node_path18.join)(candidate, "skills"))) {
+    if ((0, import_node_fs24.existsSync)((0, import_node_path19.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -16322,30 +16530,30 @@ function registerInitCommand(program2) {
     }
     printInfo(`  Node.js ${nodeVersion} \u2713`);
     try {
-      const gitVersion = (0, import_node_child_process9.execSync)("git --version", { encoding: "utf-8" }).trim();
+      const gitVersion = (0, import_node_child_process11.execSync)("git --version", { encoding: "utf-8" }).trim();
       printInfo(`  ${gitVersion} \u2713`);
     } catch {
       printError("git is required but not installed. Install from https://git-scm.com");
       process.exit(1);
     }
     try {
-      (0, import_node_child_process9.execSync)("which claude", { encoding: "utf-8" });
+      (0, import_node_child_process11.execSync)("which claude", { encoding: "utf-8" });
       printInfo("  Claude Code \u2713");
     } catch {
       printWarn("  Claude Code not found \u2014 hooks will be configured but need Claude Code to run.");
     }
     try {
-      (0, import_node_child_process9.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
+      (0, import_node_child_process11.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
       printInfo("  @codacy/analysis-cli \u2713");
     } catch {
       printInfo("  Installing @codacy/analysis-cli...");
       try {
-        (0, import_node_child_process9.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
+        (0, import_node_child_process11.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
         printInfo("  @codacy/analysis-cli installed \u2713");
       } catch {
         try {
           printWarn("  Retrying with sudo...");
-          (0, import_node_child_process9.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+          (0, import_node_child_process11.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
           printInfo("  @codacy/analysis-cli installed \u2713");
         } catch {
           printWarn("  Could not install @codacy/analysis-cli automatically.");
@@ -16357,20 +16565,20 @@ function registerInitCommand(program2) {
     console.log("");
     printInfo("Installing skills...");
     const dataDir = resolveDataDir();
-    const skillsSource = (0, import_node_path18.join)(dataDir, "skills");
+    const skillsSource = (0, import_node_path19.join)(dataDir, "skills");
     const skillsDest = ".claude/skills";
     const skills = ["verity-setup", "verity-analyze", "verity-status", "verity-feedback", "verity-learn", "verity-memory", "verity-insights", "verity-reflect"];
     let skillsInstalled = 0;
     for (const skill of skills) {
-      const src = (0, import_node_path18.join)(skillsSource, skill);
-      const dest = (0, import_node_path18.join)(skillsDest, skill);
+      const src = (0, import_node_path19.join)(skillsSource, skill);
+      const dest = (0, import_node_path19.join)(skillsDest, skill);
       if (!(0, import_node_fs24.existsSync)(src)) {
         printWarn(`  Skill data not found: ${skill}`);
         continue;
       }
       if ((0, import_node_fs24.existsSync)(dest) && !force) {
-        const srcSkill = (0, import_node_path18.join)(src, "SKILL.md");
-        const destSkill = (0, import_node_path18.join)(dest, "SKILL.md");
+        const srcSkill = (0, import_node_path19.join)(src, "SKILL.md");
+        const destSkill = (0, import_node_path19.join)(dest, "SKILL.md");
         if ((0, import_node_fs24.existsSync)(destSkill)) {
           try {
             const srcContent = await (0, import_promises13.readFile)(srcSkill, "utf-8");
@@ -16408,11 +16616,13 @@ function registerInitCommand(program2) {
     } catch (err) {
       printWarn(`  Could not update CLAUDE.md: ${err.message}`);
     }
-    const globalVerityDir = (0, import_node_path18.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path19.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises13.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     try {
-      await runOptionalAuth();
+      const globals = program2.opts();
+      const urlResult = await resolveServiceUrl(globals.serviceUrl);
+      await runOptionalAuth(urlResult.ok ? urlResult.data : DEFAULT_SERVICE_URL);
     } catch (err) {
       printWarn(`Authentication step skipped: ${err.message}`);
     }
@@ -16439,7 +16649,7 @@ function registerInitCommand(program2) {
 
 // src/commands/uninstall.ts
 var import_node_fs25 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_path20 = require("node:path");
 var SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -16458,7 +16668,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name of SKILL_NAMES) {
-      const dir = (0, import_node_path19.join)(skillsRoot, name);
+      const dir = (0, import_node_path20.join)(skillsRoot, name);
       if ((0, import_node_fs25.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name}/`,
@@ -16504,7 +16714,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path19.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path20.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs25.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -16703,7 +16913,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs26 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_path21 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -16744,7 +16954,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs26.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs26.unlinkSync)((0, import_node_path20.join)(cacheDir, entry));
+            (0, import_node_fs26.unlinkSync)((0, import_node_path21.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -16771,7 +16981,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs26.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs26.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs26.unlinkSync)((0, import_node_path20.join)(logsDir, entry));
+            (0, import_node_fs26.unlinkSync)((0, import_node_path21.join)(logsDir, entry));
           } catch {
           }
         }
@@ -16782,24 +16992,6 @@ function registerResetCommand(program2) {
   });
 }
 
-// src/lib/run-mode.ts
-function parseAutonomousEnv(raw) {
-  if (raw === void 0) return void 0;
-  const v = raw.trim().toLowerCase();
-  if (v === "") return void 0;
-  if (v === "0" || v === "false" || v === "off" || v === "no") return false;
-  return true;
-}
-function resolveRunMode(inputs = {}) {
-  if (inputs.autonomousFlag === true) return "autonomous";
-  if (inputs.autonomousFlag === false) return "interactive";
-  const env = inputs.env ?? process.env;
-  const envDecision = parseAutonomousEnv(env.VERITY_AUTONOMOUS);
-  if (envDecision !== void 0) return envDecision ? "autonomous" : "interactive";
-  const isTTY = inputs.isTTY ?? Boolean(process.stdin?.isTTY);
-  return isTTY ? "interactive" : "autonomous";
-}
-
 // src/commands/reflect.ts
 function registerReflectCommand(program2) {
   program2.command("reflect").description("Capture learnings \u2014 auto-extract or submit a human reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-confirmed text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--autonomous", "Record the drafted reflection without a confirm step (auto-detected from TTY / VERITY_AUTONOMOUS when omitted)").action(async (opts) => {
@@ -17161,8 +17353,9 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.27.1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.27.2-experimental.5fb996a").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
+registerLoginCommand(program);
 registerHooksCommands(program);
 registerIntentCommands(program);
 registerStandardCommands(program);