@codacy/verity-cli 0.27.2 → 0.28.1-experimental.708d3ae

package/data/skills/verity-setup/SKILL.md

@@ -353,8 +353,9 @@ verity auth verify
   (Metadata + Email addresses); the resulting token is used once server-side to
   check repo access and is never persisted.
 
-When authenticated, `.verity/credentials` contains `token` and `service_url` —
-all subsequent `verity` upload commands work.
+When authenticated, the project's `token` and `service_url` are stored in the
+single global credentials file `~/.verity/credentials` (keyed by git remote) —
+nothing secret is written into the repo. All subsequent `verity` upload commands work.
 
 ---
 
@@ -407,10 +408,12 @@ now (the token from Step 6 must already exist):
 verity telemetry install
 ```
 
-This writes the `OTEL_*` env block to the gitignored `.claude/settings.local.json` (which
-holds your token) and points Claude Code's OpenTelemetry exporter at Verity's OTLP endpoint.
-Tell the user it takes effect on their **next** Claude Code session, that first metrics appear
-within ~60s of activity, and point them at `/usage`.
+This writes the `OTEL_*` env block plus an `otelHeadersHelper` to `.claude/settings.local.json`
+and points Claude Code's OpenTelemetry exporter at Verity's OTLP endpoint. No token is written to
+the file — the helper (`verity telemetry headers`) resolves the project token from
+`~/.verity/credentials` at session start, so the secret never lands in the repo. Tell the user it
+takes effect on their **next** Claude Code session, that first metrics appear within ~60s of
+activity, and point them at `/usage`.
 
 If the user declined, skip this step and note that `/usage` will stay empty until they run
 `verity telemetry install`.
@@ -534,7 +537,6 @@ Add these entries to `.gitignore` (create it if it doesn't exist, append if it d
 
 ```
 # Verity
-.verity/credentials
 .verity/.cache/
 .verity/.logs/
 .verity/.last-analysis
@@ -546,14 +548,18 @@ Add these entries to `.gitignore` (create it if it doesn't exist, append if it d
 .claude/settings.local.json
 ```
 
-`.claude/settings.local.json` holds the telemetry env block **including your token**, so it
-must never be committed (`verity telemetry install` also adds this entry automatically).
+`.claude/settings.local.json` is machine-local Claude Code config (telemetry endpoint + an
+`otelHeadersHelper` reference — no token). `verity telemetry install` adds this entry
+automatically.
 
 Do NOT gitignore `.verity/standard.yaml` or `VERITY.md` — those should be committed.
 
 **Commit the knowledge graph, but not its log.** The nodes under `.verity/memory/<domain>/` and `.verity/memory/index.md` are durable project knowledge meant to be committed and reviewed. But `.verity/memory/log.md` is an append-only, per-run timestamped activity log — it churns on every analysis and carries no reviewable content, so it is gitignored above. If a project already committed it, untrack it once with `git rm --cached .verity/memory/log.md`.
 
-The `.verity/credentials` file contains the project token and MUST be gitignored.
+**No secrets live in the repo anymore.** The project token is stored only in the single global
+file `~/.verity/credentials` (outside the repo, keyed by git remote), so there is no
+`.verity/credentials` to ignore. If an older install left one behind, the CLI folds it into the
+global store and removes it automatically on the next `verity` command.
 
 ---
 

package/package.json

@@ -1,12 +1,8 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.27.2",
+  "version": "0.28.1-experimental.708d3ae",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/codacy/verity.git"
-  },
   "bugs": {
     "url": "https://github.com/codacy/verity/issues"
   },