@codacy/verity-cli 0.28.0 → 0.28.1-experimental.5ec7373

package/data/skills/verity-analyze/SKILL.md

@@ -20,7 +20,8 @@ You are running an on-demand Verity analysis. This is like a "second opinion"
    - **Fails / not authenticated**: don't stop. Tell the user Verity is in
      **local-only mode**, so the review will run static analysis and show findings
      but won't perform the deep (LLM) review or upload anything. To unlock the deep
-     review they can authenticate with `verity init` (or `verity auth register`).
+     review they can authenticate with `verity login` (one login covers every
+     repository they can write to).
      Continue — `verity review` degrades to a local static-only report on its own.
 
 ---

package/data/skills/verity-setup/SKILL.md

@@ -341,20 +341,26 @@ verity auth verify
   deep review, history, and shareable reports by running:
 
   ```bash
-  verity init          # re-runs init; offers the auth prompt again
-  # or, directly:
-  verity auth register --project "PROJECT_NAME" --remote "GIT_REMOTE_URL"
+  verity login         # one GitHub login covers every repo you can write to
+  # or: verity init    # re-runs init; offers the same auth prompt
   ```
 
-  Registration is **provider-gated** (GitHub today): the CLI runs a GitHub App
-  **device flow** ("open https://github.com/login/device and enter code
-  WXYZ-1234"), proving the user has **write access** to the repo before the
-  service issues a token. The GitHub App requests only read-only permissions
-  (Metadata + Email addresses); the resulting token is used once server-side to
-  check repo access and is never persisted.
+  Login is **provider-gated** (GitHub today): the CLI runs a GitHub App **device
+  flow** ("open https://github.com/login/device and enter code WXYZ-1234"),
+  proving the user has **write access** before the service issues a token. The
+  GitHub App requests only read-only permissions (Metadata + Email addresses);
+  the provider token is used once server-side to sweep the repositories the user
+  can write to, and is never persisted.
 
-When authenticated, `.verity/credentials` contains `token` and `service_url` —
-all subsequent `verity` upload commands work.
+  **One login covers every repository** the user can write to, not just this one.
+  Re-running `verity login` is also how access to newly-granted repos is picked
+  up, and how an expired verification is restored. If login reports this
+  repository is **not covered**, the Verity GitHub App has not been granted
+  access to it — grant it, then re-run `verity login`.
+
+When authenticated, the user's `token` and `service_url` are stored in the single
+global credentials file `~/.verity/credentials` — nothing secret is written into
+the repo. All subsequent `verity` upload commands work.
 
 ---
 
@@ -407,10 +413,12 @@ now (the token from Step 6 must already exist):
 verity telemetry install
 ```
 
-This writes the `OTEL_*` env block to the gitignored `.claude/settings.local.json` (which
-holds your token) and points Claude Code's OpenTelemetry exporter at Verity's OTLP endpoint.
-Tell the user it takes effect on their **next** Claude Code session, that first metrics appear
-within ~60s of activity, and point them at `/usage`.
+This writes the `OTEL_*` env block plus an `otelHeadersHelper` to `.claude/settings.local.json`
+and points Claude Code's OpenTelemetry exporter at Verity's OTLP endpoint. No token is written to
+the file — the helper (`verity telemetry headers`) resolves the project token from
+`~/.verity/credentials` at session start, so the secret never lands in the repo. Tell the user it
+takes effect on their **next** Claude Code session, that first metrics appear within ~60s of
+activity, and point them at `/usage`.
 
 If the user declined, skip this step and note that `/usage` will stay empty until they run
 `verity telemetry install`.
@@ -534,7 +542,6 @@ Add these entries to `.gitignore` (create it if it doesn't exist, append if it d
 
 ```
 # Verity
-.verity/credentials
 .verity/.cache/
 .verity/.logs/
 .verity/.last-analysis
@@ -546,14 +553,18 @@ Add these entries to `.gitignore` (create it if it doesn't exist, append if it d
 .claude/settings.local.json
 ```
 
-`.claude/settings.local.json` holds the telemetry env block **including your token**, so it
-must never be committed (`verity telemetry install` also adds this entry automatically).
+`.claude/settings.local.json` is machine-local Claude Code config (telemetry endpoint + an
+`otelHeadersHelper` reference — no token). `verity telemetry install` adds this entry
+automatically.
 
 Do NOT gitignore `.verity/standard.yaml` or `VERITY.md` — those should be committed.
 
 **Commit the knowledge graph, but not its log.** The nodes under `.verity/memory/<domain>/` and `.verity/memory/index.md` are durable project knowledge meant to be committed and reviewed. But `.verity/memory/log.md` is an append-only, per-run timestamped activity log — it churns on every analysis and carries no reviewable content, so it is gitignored above. If a project already committed it, untrack it once with `git rm --cached .verity/memory/log.md`.
 
-The `.verity/credentials` file contains the project token and MUST be gitignored.
+**No secrets live in the repo anymore.** The project token is stored only in the single global
+file `~/.verity/credentials` (outside the repo, keyed by git remote), so there is no
+`.verity/credentials` to ignore. If an older install left one behind, the CLI folds it into the
+global store and removes it automatically on the next `verity` command.
 
 ---
 

package/package.json

@@ -1,12 +1,8 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.28.0",
+  "version": "0.28.1-experimental.5ec7373",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/codacy/verity.git"
-  },
   "bugs": {
     "url": "https://github.com/codacy/verity/issues"
   },