@codacy/verity-cli 0.27.2 → 0.28.1-experimental.b7950e1

package/bin/verity.js

@@ -10328,7 +10328,7 @@ var {
 var import_node_child_process4 = require("node:child_process");
 
 // src/lib/auth.ts
-var import_promises = require("node:fs/promises");
+var import_promises2 = require("node:fs/promises");
 var import_node_child_process2 = require("node:child_process");
 
 // src/constants.ts
@@ -10473,7 +10473,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10551,6 +10551,13 @@ function rotateIfNeeded(file) {
 }
 
 // src/lib/api-client.ts
+function describeFetchError(err, url) {
+  const message = err instanceof Error ? err.message : String(err);
+  const cause = err?.cause;
+  const causeBits = [cause?.code, cause?.hostname].filter(Boolean).join(" ");
+  const detail = causeBits || (cause?.message && cause.message !== message ? cause.message : "");
+  return `${message}${detail ? ` (${detail})` : ""} \u2014 could not reach ${url}`;
+}
 async function apiRequest(options) {
   const {
     method,
@@ -10606,7 +10613,7 @@ async function apiRequest(options) {
     const duration2 = Date.now() - startedAt;
     const isTimeout = err instanceof DOMException && err.name === "TimeoutError";
     const category = isTimeout ? "timeout" : "network";
-    const error = isTimeout ? `Request timed out after ${timeout}ms` : `Network error: ${err.message}`;
+    const error = isTimeout ? `Request timed out after ${timeout}ms (${url})` : `Network error: ${describeFetchError(err, url)}`;
     logHttpCall({ ...logBase, duration_ms: duration2, http_status: null, category, error });
     return { ok: false, error, category, http_status: null };
   }
@@ -10665,6 +10672,60 @@ function analyzeRequest(options) {
   });
 }
 
+// src/lib/service-url.ts
+var import_promises = require("node:fs/promises");
+async function serviceUrlFromCredentials() {
+  try {
+    const creds = await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
+    const match = creds.match(/service_url:\s*(https?:\/\/[^\s]+)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+async function serviceUrlFromVerityMd() {
+  try {
+    const content = await (0, import_promises.readFile)(projectPath(VERITY_MD_FILE), "utf-8");
+    const boldLine = content.split("\n").find((l) => /\*\*url\*\*/i.test(l));
+    if (boldLine) {
+      const urlMatch = boldLine.match(/https:\/\/[^\s]+/);
+      if (urlMatch) return urlMatch[0];
+    }
+    const plainLine = content.split("\n").find((l) => /(?:url|service)\s*:/i.test(l));
+    if (plainLine) {
+      const urlMatch = plainLine.match(/https:\/\/[^\s]+/);
+      if (urlMatch) return urlMatch[0];
+    }
+  } catch {
+  }
+  return null;
+}
+async function resolveServiceUrlDetailed(flagUrl) {
+  if (flagUrl) {
+    return { ok: true, data: { url: flagUrl, source: "flag" } };
+  }
+  const envUrl = process.env.VERITY_SERVICE_URL;
+  if (envUrl) {
+    return { ok: true, data: { url: envUrl, source: "env" } };
+  }
+  const credsUrl = await serviceUrlFromCredentials();
+  if (credsUrl) {
+    return { ok: true, data: { url: credsUrl, source: "credentials" } };
+  }
+  const mdUrl = await serviceUrlFromVerityMd();
+  if (mdUrl) {
+    return { ok: true, data: { url: mdUrl, source: "verity_md" } };
+  }
+  return { ok: false, error: "No Verity service URL found. Run /verity-setup to configure." };
+}
+async function resolveServiceUrl(flagUrl) {
+  const result = await resolveServiceUrlDetailed(flagUrl);
+  return result.ok ? { ok: true, data: result.data.url } : result;
+}
+function isHealCandidate(resolved) {
+  return (resolved.source === "credentials" || resolved.source === "verity_md") && resolved.url !== DEFAULT_SERVICE_URL;
+}
+
 // src/lib/auth.ts
 function parseIdentity(content) {
   const idMatch = content.match(/^user_id:\s*(\d+)/m);
@@ -10683,7 +10744,7 @@ async function resolveToken(flagToken) {
     return { ok: true, data: { token: envToken, source: "env" } };
   }
   try {
-    const content = await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
+    const content = await (0, import_promises2.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
     const match = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
     if (match) {
       return { ok: true, data: { token: match[1], source: "local", ...parseIdentity(content) } };
@@ -10692,7 +10753,7 @@ async function resolveToken(flagToken) {
   }
   const globalCredentials = `${process.env.HOME}/.verity/credentials`;
   try {
-    const content = await (0, import_promises.readFile)(globalCredentials, "utf-8");
+    const content = await (0, import_promises2.readFile)(globalCredentials, "utf-8");
     let remote = "";
     try {
       remote = (0, import_node_child_process2.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
@@ -10721,50 +10782,44 @@ async function whoami(token, serviceUrl, verbose) {
     path: "/auth/whoami",
     serviceUrl,
     token,
-    verbose
+    verbose,
+    cmd: "whoami"
   });
 }
-
-// src/lib/service-url.ts
-var import_promises2 = require("node:fs/promises");
-async function resolveServiceUrl(flagUrl) {
-  if (flagUrl) {
-    return { ok: true, data: flagUrl };
-  }
-  const envUrl = process.env.VERITY_SERVICE_URL;
-  if (envUrl) {
-    return { ok: true, data: envUrl };
+async function probeService(serviceUrl, verbose) {
+  const res = await apiRequest({
+    method: "GET",
+    path: "/auth/whoami",
+    serviceUrl,
+    verbose,
+    timeout: 5e3,
+    cmd: "probe"
+  });
+  if (res.ok || res.http_status != null) return { reachable: true };
+  return { reachable: false, dnsDead: /\bENOTFOUND\b/.test(res.error), error: res.error };
+}
+async function maybeHealServiceUrl(resolution, verbose) {
+  if (!isHealCandidate(resolution)) {
+    return { serviceUrl: resolution.url, healed: false };
   }
-  try {
-    const creds = await (0, import_promises2.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
-    const match = creds.match(/service_url:\s*(https?:\/\/[^\s]+)/);
-    if (match) {
-      return { ok: true, data: match[1] };
-    }
-  } catch {
+  const probe = await probeService(resolution.url, verbose);
+  if (probe.reachable) {
+    return { serviceUrl: resolution.url, healed: false };
   }
-  try {
-    const content = await (0, import_promises2.readFile)(projectPath(VERITY_MD_FILE), "utf-8");
-    const boldMatch = content.match(/\*\*url\*\*/i);
-    if (boldMatch) {
-      const lineMatch = content.split("\n").find((l) => /\*\*url\*\*/i.test(l));
-      if (lineMatch) {
-        const urlMatch = lineMatch.match(/https:\/\/[^\s]+/);
-        if (urlMatch) {
-          return { ok: true, data: urlMatch[0] };
-        }
-      }
-    }
-    const plainLine = content.split("\n").find((l) => /(?:url|service)\s*:/i.test(l));
-    if (plainLine) {
-      const urlMatch = plainLine.match(/https:\/\/[^\s]+/);
-      if (urlMatch) {
-        return { ok: true, data: urlMatch[0] };
-      }
+  const from = resolution.source === "credentials" ? ".verity/credentials" : "VERITY.md";
+  printWarn(`Your configured Verity service URL is unreachable: ${resolution.url}`);
+  printInfo(`  (${probe.error})`);
+  if (probe.dnsDead && (await probeService(DEFAULT_SERVICE_URL, verbose)).reachable) {
+    printInfo(`  The hostname no longer exists \u2014 the URL in ${from} is stale (e.g. a retired preview backend).`);
+    printInfo(`  Falling back to the default Verity service: ${DEFAULT_SERVICE_URL}`);
+    if (resolution.source === "verity_md") {
+      printWarn(`  Note: VERITY.md still contains the stale URL \u2014 update it to ${DEFAULT_SERVICE_URL} and commit.`);
     }
-  } catch {
+    return { serviceUrl: DEFAULT_SERVICE_URL, healed: true };
   }
-  return { ok: false, error: "No Verity service URL found. Run /verity-setup to configure." };
+  printInfo("  Continuing against the configured URL. If it is stale, log in against the default with:");
+  printInfo(`    VERITY_SERVICE_URL=${DEFAULT_SERVICE_URL} verity login`);
+  return { serviceUrl: resolution.url, healed: false };
 }
 
 // src/lib/register.ts
@@ -11185,7 +11240,8 @@ async function registerProject(opts) {
     serviceUrl: opts.serviceUrl,
     body: { project_name: opts.projectName, git_remote_url: opts.remote },
     extraHeaders: { "X-Provider-Token": providerToken },
-    verbose: opts.verbose
+    verbose: opts.verbose,
+    cmd: "register"
   });
   if (!result.ok) {
     return { ok: false, error: result.error };
@@ -11321,14 +11377,18 @@ var import_node_path4 = require("node:path");
 function registerLoginCommand(program2) {
   program2.command("login").description("Log in to Verity (link your GitHub identity so runs and memory are saved)").option("--force", "Re-authenticate even if already logged in").action(async (opts) => {
     const globals = program2.opts();
-    const urlResult = await resolveServiceUrl(globals.serviceUrl);
+    const urlResult = await resolveServiceUrlDetailed(globals.serviceUrl);
     if (!urlResult.ok) {
       printError(urlResult.error);
       process.exit(1);
     }
-    const serviceUrl = urlResult.data;
+    const heal = await maybeHealServiceUrl(urlResult.data, globals.verbose);
+    const serviceUrl = heal.serviceUrl;
+    if (heal.healed) {
+      printInfo("  Completing login re-registers this project and updates .verity/credentials.");
+    }
     const existing = await resolveToken(globals.token);
-    if (existing.ok && !opts.force) {
+    if (existing.ok && !opts.force && !heal.healed) {
       if (existing.data.userId != null) {
         printInfo(`Already logged in as ${existing.data.email ?? `user #${existing.data.userId}`}. \u2713`);
         printInfo("  Re-authenticate with: verity login --force");
@@ -11827,7 +11887,7 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises6 = require("node:fs/promises");
@@ -11946,6 +12006,19 @@ function getRecentCommitMessages() {
   }
 }
 
+// src/lib/context-identity.ts
+var import_node_crypto2 = require("node:crypto");
+function contextIdentity(token, sessionId) {
+  const t = (token ?? "").trim();
+  const s = (sessionId ?? "").trim();
+  const userKey = t.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(t).digest("hex").slice(0, 12) : "anon";
+  const sessionKey2 = s.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(s).digest("hex").slice(0, 16) : "_default";
+  return { userKey, sessionKey: sessionKey2, bucket: `${userKey}/${sessionKey2}` };
+}
+function sessionScopeKey(token, sessionId) {
+  return contextIdentity(token, sessionId).bucket;
+}
+
 // src/lib/task-context-buffer.ts
 var import_promises7 = require("node:fs/promises");
 var import_node_fs4 = require("node:fs");
@@ -12233,7 +12306,7 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 var import_promises9 = require("node:fs/promises");
 var import_node_fs6 = require("node:fs");
 var import_node_path9 = require("node:path");
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 
 // src/lib/glob-match.ts
 function globToRegex(glob) {
@@ -12331,7 +12404,7 @@ async function buildManifest() {
         const fullPath = (0, import_node_path9.join)(memoryDir2(), filePath);
         try {
           const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
-          const hash = (0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16);
+          const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
         }
@@ -12342,7 +12415,7 @@ async function buildManifest() {
   let indexHash = null;
   try {
     const indexContent = await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "utf-8");
-    indexHash = `sha256:${(0, import_node_crypto2.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
+    indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
@@ -12354,7 +12427,7 @@ async function buildManifest() {
   return { schema_version: 1, nodes, index_hash: indexHash, log_length: logLength };
 }
 function hashContent(content) {
-  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
+  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16)}`;
 }
 async function readOnDiskNodes() {
   const out = /* @__PURE__ */ new Map();
@@ -12799,7 +12872,10 @@ function registerIntentCommands(program2) {
       if (!prompt) {
         process.exit(0);
       }
-      await appendToConversationBuffer(prompt, event.session_id ?? "");
+      const authForScope = await resolveToken(program2.opts().token);
+      const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
+      const scopeSession = event.session_id || process.env.CLAUDE_SESSION_ID || "";
+      await appendToConversationBuffer(prompt, sessionScopeKey(scopeToken, scopeSession));
       try {
         await ensureMemoryDir();
         const injection = await retrieveForInjection(prompt);
@@ -12841,7 +12917,7 @@ async function fireClassify(prompt, sessionId) {
     logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
     return;
   }
-  const promptHash = (0, import_node_crypto3.createHash)("sha256").update(prompt).digest("hex");
+  const promptHash = (0, import_node_crypto4.createHash)("sha256").update(prompt).digest("hex");
   const result = await apiRequest({
     method: "POST",
     path: "/classify-task",
@@ -13499,10 +13575,10 @@ function collectCodeDelta(files, opts) {
 
 // src/lib/debounce.ts
 var import_node_fs9 = require("node:fs");
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto4.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+  return `${base}.${(0, import_node_crypto5.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
@@ -13543,7 +13619,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto4.createHash)("sha1");
+  const hash = (0, import_node_crypto5.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
@@ -13931,14 +14007,14 @@ function cleanStaleSnapshots(dir, keepSet) {
 // src/lib/baseline.ts
 var import_node_fs13 = require("node:fs");
 var import_node_path13 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var BASELINE_VERSION = 1;
 var BASELINE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
 var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
 var DEFAULT_SESSION_KEY = "_default";
 function sessionKey(sessionId) {
   if (!sessionId) return DEFAULT_SESSION_KEY;
-  return (0, import_node_crypto5.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return (0, import_node_crypto6.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
   return (0, import_node_path13.join)(projectPath(BASELINE_DIR), key);
@@ -14120,13 +14196,57 @@ function pruneOldBaselines() {
   }
 }
 
+// src/lib/task-context.ts
+var import_node_child_process9 = require("node:child_process");
+var CLOSING_RE = /\b(close[sd]?|fix(?:e[sd])?|resolve[sd]?)\b[\s:]*#(\d+)/i;
+var BRANCH_RE = /(?:^|[/_-])(?:issue|gh|fix)[-_/]?(\d+)\b/i;
+function parseLinkedIssue(sources) {
+  for (const c of sources.commits ?? []) {
+    const m = CLOSING_RE.exec(c);
+    if (m) return { issue: parseInt(m[2], 10), via: `commit:${m[1].toLowerCase()}` };
+  }
+  if (sources.branch) {
+    const m = BRANCH_RE.exec(sources.branch);
+    if (m) return { issue: parseInt(m[1], 10), via: "branch" };
+  }
+  return null;
+}
+function safeExec(cmd, timeout) {
+  try {
+    return (0, import_node_child_process9.execSync)(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout }).trim();
+  } catch {
+    return "";
+  }
+}
+function defaultGhFetch(issue) {
+  const raw = safeExec(`gh issue view ${issue} --json title,body`, 5e3);
+  if (!raw) return null;
+  try {
+    const j = JSON.parse(raw);
+    return j.title ? { title: j.title, body: j.body ?? "" } : null;
+  } catch {
+    return null;
+  }
+}
+function resolveTaskContext(opts) {
+  const branch = opts?.branch ?? safeExec("git rev-parse --abbrev-ref HEAD", 3e3);
+  const commits = opts?.commits ?? safeExec("git log -5 --format=%s%n%b", 3e3).split("\n").map((l) => l.trim()).filter(Boolean);
+  const linked = parseLinkedIssue({ branch, commits });
+  if (!linked) return null;
+  const issue = (opts?.ghFetch ?? defaultGhFetch)(linked.issue);
+  if (!issue) return null;
+  const body = (issue.body ?? "").slice(0, 4e3).trim();
+  const goal = `[#${linked.issue}] ${issue.title}${body ? "\n\n" + body : ""}`;
+  return { number: linked.issue, title: issue.title, goal, via: linked.via };
+}
+
 // src/lib/offline.ts
 var import_node_fs14 = require("node:fs");
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function cacheRequest(body) {
   try {
     (0, import_node_fs14.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto6.randomBytes)(4).toString("hex");
+    const suffix = (0, import_node_crypto7.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
     (0, import_node_fs14.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(body));
   } catch {
@@ -14331,6 +14451,30 @@ function detectAnalysisMode(noFilesChanged, assistantResponse, conversationPromp
   }
   return "standard";
 }
+var FILE_MUTATE_RE = /(?:^|[\s|&;(`])(?:sed\s+-i|perl\s+-i|awk\b|tee\b|dd\b|cp\b|mv\b|ln\b|install\b|touch\b|patch\b|git\s+(?:apply|am)\b|cargo\s+build|go\s+generate|make\b|--write\b|--fix\b|--in-place\b)|>>?(?![&>])/i;
+var GIT_PLUMBING_RE = /^\s*git\s+(?:merge|rebase|stash|cherry-pick|revert|pull|fetch|checkout|switch|reset|restore|clean)\b/i;
+var READ_ONLY_RE = /^\s*(?:git\s+(?:status|diff|log|show|branch|remote|config|rev-parse|ls-files|blame|describe)|ls|cat|head|tail|less|grep|rg|find|pwd|echo|printf|wc|which|type|tree|stat|file|env|printenv|date|whoami)\b/i;
+var CHAIN_RE = /&&|\||;|\$\(|\x60/;
+function hasNonEditAuthorship(actionSummary, sessionAuthoredCode) {
+  if (!actionSummary) return sessionAuthoredCode;
+  if ((actionSummary.subagents ?? 0) > 0) return true;
+  if (Object.keys(actionSummary.tool_counts ?? {}).some((t) => t.startsWith("mcp__"))) return true;
+  const commands = actionSummary.commands ?? [];
+  if (commands.some((c) => FILE_MUTATE_RE.test(c))) return true;
+  if (sessionAuthoredCode) {
+    const allSafe = commands.length > 0 && commands.every(
+      (c) => !CHAIN_RE.test(c) && (GIT_PLUMBING_RE.test(c) || READ_ONLY_RE.test(c))
+    );
+    if (!allSafe) return true;
+  }
+  return false;
+}
+function scopeToAuthored(files, actionSummary) {
+  if (!actionSummary) return { files, signal: "no-transcript" };
+  const touched = [...actionSummary.files_edited ?? [], ...actionSummary.files_created ?? []];
+  if (touched.length === 0) return { files: [], signal: "none-authored" };
+  return { files: narrowToAgentAuthored(files, actionSummary), signal: "authored" };
+}
 function narrowToAgentAuthored(files, actionSummary) {
   if (!actionSummary) return files;
   const touched = [
@@ -14533,6 +14677,7 @@ function buildSummary(lines) {
           searches++;
           break;
         case "Agent":
+        case "Task":
           subagents++;
           break;
         case "WebFetch":
@@ -14585,19 +14730,48 @@ function addPath(set, rawPath) {
 function sanitizeCommand(rawCmd) {
   if (typeof rawCmd !== "string" || !rawCmd) return null;
   let cmd = rawCmd.split("\n")[0];
+  let cut = -1;
+  let marker = "";
   for (const sep of [" | ", " > ", " >> ", " 2>", " && ", " ; "]) {
     const idx = cmd.indexOf(sep);
-    if (idx > 0) cmd = cmd.slice(0, idx);
+    if (idx > 0 && (cut === -1 || idx < cut)) {
+      cut = idx;
+      marker = sep.trim();
+    }
   }
+  if (cut > -1) cmd = cmd.slice(0, cut);
   if (cmd.length > MAX_COMMAND_CHARS) {
     cmd = cmd.slice(0, MAX_COMMAND_CHARS);
   }
-  return cmd.trim() || null;
+  cmd = cmd.trim();
+  if (marker) cmd = cmd ? `${cmd} ${marker}` : marker;
+  return cmd || null;
 }
 function capArray(set, max) {
   return Array.from(set).slice(0, max);
 }
 
+// src/lib/run-mode.ts
+function parseAutonomousEnv(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v === "") return void 0;
+  if (v === "0" || v === "false" || v === "off" || v === "no") return false;
+  return true;
+}
+function resolveRunMode(inputs = {}) {
+  if (inputs.autonomousFlag === true) return "autonomous";
+  if (inputs.autonomousFlag === false) return "interactive";
+  const env = inputs.env ?? process.env;
+  const envDecision = parseAutonomousEnv(env.VERITY_AUTONOMOUS);
+  if (envDecision !== void 0) return envDecision ? "autonomous" : "interactive";
+  const isTTY = inputs.isTTY ?? Boolean(process.stdin?.isTTY);
+  return isTTY ? "interactive" : "autonomous";
+}
+function isExplicitlyAutonomous(env = process.env) {
+  return parseAutonomousEnv(env.VERITY_AUTONOMOUS) === true || parseAutonomousEnv(env.CI) === true || parseAutonomousEnv(env.GITHUB_ACTIONS) === true;
+}
+
 // src/lib/seed-runner.ts
 var import_promises12 = require("node:fs/promises");
 var import_node_fs18 = require("node:fs");
@@ -15012,7 +15186,10 @@ async function runAnalyze(opts, globals) {
   }
   const { assistantMessage: assistantResponse, stopReason, transcriptPath, sessionId } = await readStopHookStdin();
   const actionSummary = transcriptPath ? await extractActionSummary(transcriptPath) : null;
-  const baselineSessionId = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+  const tokenResult = await resolveToken(globals.token);
+  const scopeToken = tokenResult.ok ? tokenResult.data.token : void 0;
+  const rawSessionId = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+  const baselineSessionId = sessionScopeKey(scopeToken, rawSessionId);
   const baseline = readBaseline(baselineSessionId);
   if (baseline) {
     logEvent("baseline_loaded", {
@@ -15030,7 +15207,7 @@ async function runAnalyze(opts, globals) {
     passAndExit("No analyzable files changed");
   }
   const allForReview = Array.from(/* @__PURE__ */ new Set([...analyzable, ...reviewable]));
-  const conversation = await readAndClearConversationBuffer(sessionId ?? void 0);
+  const conversation = await readAndClearConversationBuffer(baselineSessionId);
   const specs = discoverSpecs();
   const plans = discoverPlans();
   const latestPrompt = conversation?.prompts?.[conversation.prompts.length - 1]?.prompt ?? "";
@@ -15044,7 +15221,6 @@ async function runAnalyze(opts, globals) {
   if (isReflectionQuestion(assistantResponse) && !agentAuthoredCodeThisTurn) {
     passAndExit("Reflection-prompt turn \u2014 skipping analysis");
   }
-  const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!tokenResult.ok || !urlResult.ok) {
     localOnlyAndExit(runLocalStatic(analyzable, securityFiles, baseline, !!opts.skipStatic));
@@ -15138,8 +15314,11 @@ async function runAnalyze(opts, globals) {
       }
       contentHash = hashResult.hash;
       if (analysisMode !== "plan") {
-        const agentNarrowed = narrowToAgentAuthored(allForReview, actionSummary);
-        const baseForReview = agentNarrowed.length > 0 ? agentNarrowed : allForReview;
+        const scoped = scopeToAuthored(allForReview, actionSummary);
+        if (scoped.signal === "none-authored" && !hasNonEditAuthorship(actionSummary, sessionAuthoredCode)) {
+          passAndExit("No agent-authored code this turn \u2014 working-tree changes were not authored by this session");
+        }
+        const baseForReview = scoped.signal === "authored" && scoped.files.length > 0 ? scoped.files : allForReview;
         const recentForReview = narrowToRecent(baseForReview, baselineSessionId);
         if (!opts.skipStatic && isCodacyAvailable()) {
           let allScannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles]));
@@ -15269,7 +15448,9 @@ async function runAnalyze(opts, globals) {
   if (snapshotResult.has_snapshots && snapshotResult.diffs.length > 0) {
     requestBody.snapshot_diffs = snapshotResult.diffs;
   }
-  const hasIntent = (conversation?.prompts?.length ?? 0) > 0 || specs.length > 0 || plans.length > 0 || !!assistantResponse;
+  const noHumanPrompt = (conversation?.prompts?.length ?? 0) === 0;
+  const w4Task = noHumanPrompt && isExplicitlyAutonomous() ? resolveTaskContext() : null;
+  const hasIntent = (conversation?.prompts?.length ?? 0) > 0 || specs.length > 0 || plans.length > 0 || !!assistantResponse || !!w4Task;
   if (hasIntent) {
     const intentContext = {};
     if (conversation && conversation.prompts.length > 0) {
@@ -15284,6 +15465,10 @@ async function runAnalyze(opts, globals) {
         intentContext.recent_commits = conversation.recent_commits;
       }
     }
+    if (w4Task && !intentContext.user_prompt) {
+      intentContext.user_prompt = w4Task.goal;
+      logEvent("w4_issue_anchor", { issue: w4Task.number, via: w4Task.via });
+    }
     if (assistantResponse) {
       const cap = analysisMode === "plan" ? MAX_ASSISTANT_RESPONSE_CHARS_PLAN : MAX_ASSISTANT_RESPONSE_CHARS_DEFAULT;
       intentContext.assistant_response = assistantResponse.length > cap ? assistantResponse.slice(0, cap) : assistantResponse;
@@ -15576,7 +15761,10 @@ function registerBaselineCommands(program2) {
           }
         }
       }
-      const result = captureBaseline({ sessionId, source });
+      const authForScope = await resolveToken(program2.opts().token);
+      const scopeToken = authForScope.ok ? authForScope.data.token : void 0;
+      const scopeSession = sessionId || process.env.CLAUDE_SESSION_ID || void 0;
+      const result = captureBaseline({ sessionId: sessionScopeKey(scopeToken, scopeSession), source });
       logEvent("baseline_capture", {
         created: result.created,
         source: source ?? null,
@@ -16022,20 +16210,20 @@ function writeBlockMessage(moment, response) {
 var import_node_fs24 = require("node:fs");
 var import_promises13 = require("node:fs/promises");
 var import_node_path19 = require("node:path");
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var readline2 = __toESM(require("node:readline/promises"));
 
 // src/commands/migrate.ts
 var import_node_fs23 = require("node:fs");
 var import_node_path18 = require("node:path");
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
-  (0, import_node_child_process9.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
+  (0, import_node_child_process10.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
 }
 function isGitTracked(cwd, relPath) {
   try {
-    (0, import_node_child_process9.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)(`git ls-files --error-unmatch ${relPath}`, { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -16043,7 +16231,7 @@ function isGitTracked(cwd, relPath) {
 }
 function isGitRepo(cwd) {
   try {
-    (0, import_node_child_process9.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("git rev-parse --is-inside-work-tree", { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -16082,7 +16270,7 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
       );
     }
     try {
-      (0, import_node_child_process9.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("git mv .gate .verity", { cwd: root, stdio: "pipe" });
       actions.push("Moved .gate/ \u2192 .verity/ (git mv, staged)");
       moved = true;
     } catch {
@@ -16161,7 +16349,7 @@ function migrateStandardFile(root, actions) {
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
-      (0, import_node_child_process9.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
+      (0, import_node_child_process10.execSync)("git mv GATE.md VERITY.md", { cwd: root, stdio: "pipe" });
       moved = true;
     } catch {
     }
@@ -16217,7 +16405,7 @@ function readFileSyncSafe(path) {
 }
 function hasStagedChanges(root) {
   try {
-    (0, import_node_child_process9.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
+    (0, import_node_child_process10.execSync)("git diff --cached --quiet", { cwd: root, stdio: "pipe" });
     return false;
   } catch {
     return true;
@@ -16313,30 +16501,47 @@ async function promptYes(question) {
     rl.close();
   }
 }
-async function runOptionalAuth(serviceUrl) {
-  const existing = await resolveToken();
-  if (existing.ok) {
-    const who = await whoami(existing.data.token, serviceUrl);
-    if (who.ok && who.data.logged_in) {
-      printInfo(`Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713 \u2014 runs & memory sync to Verity.`);
-      return;
+async function confirmExistingLogin(serviceUrl, opts) {
+  const existing = await resolveToken(opts.token);
+  if (!existing.ok) return "drive-login";
+  const who = await whoami(existing.data.token, serviceUrl, opts.verbose);
+  if (who.ok && who.data.logged_in) {
+    printInfo(`Logged in as ${who.data.email ?? `user #${who.data.user_id}`} \u2713 \u2014 runs & memory sync to Verity.`);
+    return "handled";
+  }
+  if (!who.ok) {
+    if (existing.data.userId != null) {
+      printInfo(`Logged in as ${existing.data.email ?? `user #${existing.data.userId}`} (cached \u2014 could not reach the Verity service). \u2713`);
+    } else {
+      printInfo("Could not confirm your login state with the service; continuing with your existing token.");
+      printInfo(`  (${who.error})`);
     }
-    if (!who.ok) {
-      if (existing.data.userId != null) {
-        printInfo(`Logged in as ${existing.data.email ?? `user #${existing.data.userId}`} (cached \u2014 could not reach the Verity service). \u2713`);
-      } else {
-        printInfo("Could not confirm your login state with the service; continuing with your existing token.");
-      }
-      return;
+    return "handled";
+  }
+  console.log("");
+  printWarn("You are NOT logged in \u2014 this project has only an anonymous token.");
+  printInfo("  The gate still runs, but no runs are saved and Verity keeps no memory of this project.");
+  printInfo("  Log in below to unlock run history, trends, and cloud memory (strongly recommended).");
+  return "drive-login";
+}
+async function runOptionalAuth(resolution, opts = {}) {
+  let serviceUrl = resolution?.url ?? DEFAULT_SERVICE_URL;
+  let healed = false;
+  if (resolution) {
+    const heal = await maybeHealServiceUrl(resolution, opts.verbose);
+    serviceUrl = heal.serviceUrl;
+    healed = heal.healed;
+    if (healed) {
+      printInfo("  Log in below to re-register this project and repair .verity/credentials.");
     }
-    console.log("");
-    printWarn("You are NOT logged in \u2014 this project has only an anonymous token.");
-    printInfo("  The gate still runs, but no runs are saved and Verity keeps no memory of this project.");
-    printInfo("  Log in below to unlock run history, trends, and cloud memory (strongly recommended).");
+  }
+  if (!healed) {
+    const state = await confirmExistingLogin(serviceUrl, opts);
+    if (state === "handled") return;
   }
   let remote = "";
   try {
-    remote = (0, import_node_child_process10.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    remote = (0, import_node_child_process11.execSync)("git remote get-url origin", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
   } catch {
   }
   const localOnlyNote = () => {
@@ -16369,7 +16574,7 @@ async function runOptionalAuth(serviceUrl) {
   }
   const projectName = parseRemote(remote)?.repo ?? (0, import_node_path19.basename)(process.cwd());
   printInfo("Authenticating with GitHub\u2026");
-  const result = await registerProject({ projectName, remote, serviceUrl });
+  const result = await registerProject({ projectName, remote, serviceUrl, verbose: opts.verbose });
   if (result.ok) {
     const who = result.data.email ?? (result.data.userId != null ? `user #${result.data.userId}` : null);
     printInfo(`Logged in${who ? ` as ${who}` : ""} \u2713 \u2014 runs, history, and cloud memory now sync to Verity.`);
@@ -16432,30 +16637,30 @@ function registerInitCommand(program2) {
     }
     printInfo(`  Node.js ${nodeVersion} \u2713`);
     try {
-      const gitVersion = (0, import_node_child_process10.execSync)("git --version", { encoding: "utf-8" }).trim();
+      const gitVersion = (0, import_node_child_process11.execSync)("git --version", { encoding: "utf-8" }).trim();
       printInfo(`  ${gitVersion} \u2713`);
     } catch {
       printError("git is required but not installed. Install from https://git-scm.com");
       process.exit(1);
     }
     try {
-      (0, import_node_child_process10.execSync)("which claude", { encoding: "utf-8" });
+      (0, import_node_child_process11.execSync)("which claude", { encoding: "utf-8" });
       printInfo("  Claude Code \u2713");
     } catch {
       printWarn("  Claude Code not found \u2014 hooks will be configured but need Claude Code to run.");
     }
     try {
-      (0, import_node_child_process10.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
+      (0, import_node_child_process11.execSync)("which codacy-analysis", { encoding: "utf-8", stdio: "pipe" });
       printInfo("  @codacy/analysis-cli \u2713");
     } catch {
       printInfo("  Installing @codacy/analysis-cli...");
       try {
-        (0, import_node_child_process10.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
+        (0, import_node_child_process11.execSync)("npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "pipe", timeout: 12e4 });
         printInfo("  @codacy/analysis-cli installed \u2713");
       } catch {
         try {
           printWarn("  Retrying with sudo...");
-          (0, import_node_child_process10.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
+          (0, import_node_child_process11.execSync)("sudo npm install -g @codacy/analysis-cli", { encoding: "utf-8", stdio: "inherit", timeout: 12e4 });
           printInfo("  @codacy/analysis-cli installed \u2713");
         } catch {
           printWarn("  Could not install @codacy/analysis-cli automatically.");
@@ -16523,8 +16728,11 @@ function registerInitCommand(program2) {
     console.log("");
     try {
       const globals = program2.opts();
-      const urlResult = await resolveServiceUrl(globals.serviceUrl);
-      await runOptionalAuth(urlResult.ok ? urlResult.data : DEFAULT_SERVICE_URL);
+      const urlResult = await resolveServiceUrlDetailed(globals.serviceUrl);
+      await runOptionalAuth(urlResult.ok ? urlResult.data : null, {
+        token: globals.token,
+        verbose: globals.verbose
+      });
     } catch (err) {
       printWarn(`Authentication step skipped: ${err.message}`);
     }
@@ -16894,24 +17102,6 @@ function registerResetCommand(program2) {
   });
 }
 
-// src/lib/run-mode.ts
-function parseAutonomousEnv(raw) {
-  if (raw === void 0) return void 0;
-  const v = raw.trim().toLowerCase();
-  if (v === "") return void 0;
-  if (v === "0" || v === "false" || v === "off" || v === "no") return false;
-  return true;
-}
-function resolveRunMode(inputs = {}) {
-  if (inputs.autonomousFlag === true) return "autonomous";
-  if (inputs.autonomousFlag === false) return "interactive";
-  const env = inputs.env ?? process.env;
-  const envDecision = parseAutonomousEnv(env.VERITY_AUTONOMOUS);
-  if (envDecision !== void 0) return envDecision ? "autonomous" : "interactive";
-  const isTTY = inputs.isTTY ?? Boolean(process.stdin?.isTTY);
-  return isTTY ? "interactive" : "autonomous";
-}
-
 // src/commands/reflect.ts
 function registerReflectCommand(program2) {
   program2.command("reflect").description("Capture learnings \u2014 auto-extract or submit a human reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-confirmed text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--autonomous", "Record the drafted reflection without a confirm step (auto-detected from TTY / VERITY_AUTONOMOUS when omitted)").action(async (opts) => {
@@ -17273,7 +17463,7 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.27.2").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.b7950e1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
 registerAuthCommands(program);
 registerLoginCommand(program);
 registerHooksCommands(program);

package/package.json

@@ -1,12 +1,8 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.27.2",
+  "version": "0.28.1-experimental.b7950e1",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/codacy/verity.git"
-  },
   "bugs": {
     "url": "https://github.com/codacy/verity/issues"
   },