@codacy/verity-cli 0.28.0 → 0.28.1-experimental.9155758

package/bin/verity.js

@@ -10327,10 +10327,6 @@ var {
 // src/commands/auth.ts
 var import_node_child_process4 = require("node:child_process");
 
-// src/lib/auth.ts
-var import_promises2 = require("node:fs/promises");
-var import_node_child_process2 = require("node:child_process");
-
 // src/constants.ts
 var import_node_child_process = require("node:child_process");
 var import_node_path = require("node:path");
@@ -10347,7 +10343,6 @@ function repoRoot() {
 }
 var VERITY_DIR = ".verity";
 var CREDENTIALS_FILE = `${VERITY_DIR}/credentials`;
-var GLOBAL_CREDENTIALS_FILE = `${process.env.HOME}/.verity/credentials`;
 var DEBOUNCE_FILE = `${VERITY_DIR}/.last-analysis`;
 var ITERATION_FILE = `${VERITY_DIR}/.iteration-count`;
 var HASH_FILE = `${VERITY_DIR}/.last-pass-hash`;
@@ -10473,7 +10468,7 @@ var SECURITY_PATTERNS = [
   /Dockerfile/
 ];
 var PROD_SERVICE_URL = "https://ofcamwrjwrkazqvdchko.supabase.co/functions/v1";
-var DEFAULT_SERVICE_URL = "".length > 0 ? "" : PROD_SERVICE_URL;
+var DEFAULT_SERVICE_URL = "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1".length > 0 ? "https://wukeddyzpijoegyajtnc.supabase.co/functions/v1" : PROD_SERVICE_URL;
 var GITHUB_CLIENT_ID = "Iv23li88HxAi3ZrbYzWh";
 var GITHUB_DEVICE_CODE_URL = "https://github.com/login/device/code";
 var GITHUB_ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -10673,19 +10668,174 @@ function analyzeRequest(options) {
 }
 
 // src/lib/service-url.ts
+var import_promises2 = require("node:fs/promises");
+
+// src/lib/credentials.ts
 var import_promises = require("node:fs/promises");
-async function serviceUrlFromCredentials() {
+var import_node_path2 = require("node:path");
+var import_node_child_process2 = require("node:child_process");
+function globalCredentialsPath() {
+  return `${process.env.HOME}/.verity/credentials`;
+}
+function currentRemote() {
+  try {
+    return (0, import_node_child_process2.execSync)("git remote get-url origin", {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+var TOKEN_RE = /token:\s*((?:gate_|verity_)[a-f0-9]+)/;
+function parseCredentialLine(line) {
+  const idx = line.indexOf(" token:");
+  const remote = idx === -1 ? "" : line.slice(0, idx).trim();
+  const rest = idx === -1 ? line : line.slice(idx);
+  const tokenMatch = rest.match(TOKEN_RE);
+  if (!tokenMatch) return null;
+  const serviceUrl = rest.match(/service_url:\s*(https?:\/\/\S+)/)?.[1];
+  const userIdRaw = rest.match(/user_id:\s*(\d+)/)?.[1];
+  const email = rest.match(/email:\s*(\S+)/)?.[1];
+  return {
+    remote,
+    rec: {
+      token: tokenMatch[1],
+      serviceUrl,
+      userId: userIdRaw != null ? Number(userIdRaw) : void 0,
+      email
+    }
+  };
+}
+function encodeRemoteKey(remote) {
+  return remote.replace(
+    /[%\x00-\x20\x7f]/g,
+    (c) => "%" + c.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase()
+  );
+}
+function serializeCredential(remote, rec) {
+  const key = encodeRemoteKey(remote);
+  const out = [key ? `${key} token: ${rec.token}` : `token: ${rec.token}`];
+  if (rec.serviceUrl) out.push(`service_url: ${rec.serviceUrl}`);
+  if (rec.userId != null) out.push(`user_id: ${rec.userId}`);
+  if (rec.email) out.push(`email: ${rec.email}`);
+  return out.join(" ");
+}
+async function readGlobalCredential(remote) {
+  let content;
   try {
-    const creds = await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
-    const match = creds.match(/service_url:\s*(https?:\/\/[^\s]+)/);
-    return match ? match[1] : null;
+    content = await (0, import_promises.readFile)(globalCredentialsPath(), "utf-8");
   } catch {
     return null;
   }
+  const lines = content.split("\n");
+  const key = encodeRemoteKey(remote);
+  if (key) {
+    let last = null;
+    for (const line of lines) {
+      const parsed = parseCredentialLine(line);
+      if (parsed && parsed.remote === key) last = parsed.rec;
+    }
+    if (last) return last;
+  }
+  let plain = null;
+  for (const line of lines) {
+    const parsed = parseCredentialLine(line);
+    if (parsed && parsed.remote === "") plain = parsed.rec;
+  }
+  return plain;
+}
+async function upsertGlobalCredential(remote, rec) {
+  const path = globalCredentialsPath();
+  await (0, import_promises.mkdir)((0, import_node_path2.dirname)(path), { recursive: true });
+  let content = "";
+  try {
+    content = await (0, import_promises.readFile)(path, "utf-8");
+  } catch {
+  }
+  const line = serializeCredential(remote, rec);
+  const key = encodeRemoteKey(remote);
+  const kept = [];
+  let replaced = false;
+  for (const existing of content ? content.split("\n") : []) {
+    const parsed = parseCredentialLine(existing);
+    const matches = parsed !== null && parsed.remote === key;
+    if (matches) {
+      if (!replaced) {
+        kept.push(line);
+        replaced = true;
+      }
+      continue;
+    }
+    kept.push(existing);
+  }
+  while (kept.length && kept[kept.length - 1].trim() === "") kept.pop();
+  if (!replaced) kept.push(line);
+  const body = kept.join("\n") + "\n";
+  await (0, import_promises.writeFile)(path, body, { mode: 384 });
+  await (0, import_promises.chmod)(path, 384).catch(() => {
+  });
+}
+function parseLocalCredentialFile(content) {
+  const tokenMatch = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
+  if (!tokenMatch) return null;
+  const userIdMatch = content.match(/^user_id:\s*(\d+)/m);
+  return {
+    token: tokenMatch[1],
+    serviceUrl: content.match(/service_url:\s*(https?:\/\/\S+)/)?.[1],
+    userId: userIdMatch ? Number(userIdMatch[1]) : void 0,
+    email: content.match(/^email:\s*(\S+)/m)?.[1]
+  };
+}
+async function readLegacyLocalCredential() {
+  try {
+    return parseLocalCredentialFile(await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+async function foldLegacyLocalCredential(remoteArg) {
+  let content;
+  try {
+    content = await (0, import_promises.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
+  } catch {
+    return false;
+  }
+  const local = parseLocalCredentialFile(content);
+  if (!local) {
+    await (0, import_promises.unlink)(projectPath(CREDENTIALS_FILE)).catch(() => {
+    });
+    return false;
+  }
+  const remote = remoteArg ?? currentRemote();
+  if (!remote) {
+    return false;
+  }
+  const existing = await readGlobalCredential(remote);
+  const merged = {
+    token: existing?.token ?? local.token,
+    serviceUrl: existing?.serviceUrl ?? local.serviceUrl,
+    userId: existing?.userId ?? local.userId,
+    email: existing?.email ?? local.email
+  };
+  try {
+    await upsertGlobalCredential(remote, merged);
+  } catch {
+    return false;
+  }
+  await (0, import_promises.unlink)(projectPath(CREDENTIALS_FILE)).catch(() => {
+  });
+  return true;
+}
+
+// src/lib/service-url.ts
+async function serviceUrlFromCredentials() {
+  const rec = await readGlobalCredential(currentRemote());
+  return rec?.serviceUrl ?? null;
 }
 async function serviceUrlFromVerityMd() {
   try {
-    const content = await (0, import_promises.readFile)(projectPath(VERITY_MD_FILE), "utf-8");
+    const content = await (0, import_promises2.readFile)(projectPath(VERITY_MD_FILE), "utf-8");
     const boldLine = content.split("\n").find((l) => /\*\*url\*\*/i.test(l));
     if (boldLine) {
       const urlMatch = boldLine.match(/https:\/\/[^\s]+/);
@@ -10727,14 +10877,6 @@ function isHealCandidate(resolved) {
 }
 
 // src/lib/auth.ts
-function parseIdentity(content) {
-  const idMatch = content.match(/^user_id:\s*(\d+)/m);
-  const emailMatch = content.match(/^email:\s*(\S+)/m);
-  return {
-    userId: idMatch ? Number(idMatch[1]) : void 0,
-    email: emailMatch ? emailMatch[1] : void 0
-  };
-}
 async function resolveToken(flagToken) {
   if (flagToken) {
     return { ok: true, data: { token: flagToken, source: "flag" } };
@@ -10743,36 +10885,19 @@ async function resolveToken(flagToken) {
   if (envToken) {
     return { ok: true, data: { token: envToken, source: "env" } };
   }
-  try {
-    const content = await (0, import_promises2.readFile)(projectPath(CREDENTIALS_FILE), "utf-8");
-    const match = content.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
-    if (match) {
-      return { ok: true, data: { token: match[1], source: "local", ...parseIdentity(content) } };
-    }
-  } catch {
+  const rec = await readGlobalCredential(currentRemote());
+  if (rec) {
+    return {
+      ok: true,
+      data: { token: rec.token, source: "global", userId: rec.userId, email: rec.email }
+    };
   }
-  const globalCredentials = `${process.env.HOME}/.verity/credentials`;
-  try {
-    const content = await (0, import_promises2.readFile)(globalCredentials, "utf-8");
-    let remote = "";
-    try {
-      remote = (0, import_node_child_process2.execSync)("git remote get-url origin", { encoding: "utf-8" }).trim();
-    } catch {
-    }
-    if (remote) {
-      const remoteLine = content.split("\n").find((l) => l.includes(remote));
-      if (remoteLine) {
-        const match = remoteLine.match(/token:\s*((?:gate_|verity_)[a-f0-9]+)/);
-        if (match) {
-          return { ok: true, data: { token: match[1], source: "global" } };
-        }
-      }
-    }
-    const plainMatch = content.match(/^token:\s*((?:gate_|verity_)[a-f0-9]+)/m);
-    if (plainMatch) {
-      return { ok: true, data: { token: plainMatch[1], source: "global" } };
-    }
-  } catch {
+  const local = await readLegacyLocalCredential();
+  if (local) {
+    return {
+      ok: true,
+      data: { token: local.token, source: "local", userId: local.userId, email: local.email }
+    };
   }
   return { ok: false, error: "No Verity token found. Run /verity-setup to configure." };
 }
@@ -10806,7 +10931,7 @@ async function maybeHealServiceUrl(resolution, verbose) {
   if (probe.reachable) {
     return { serviceUrl: resolution.url, healed: false };
   }
-  const from = resolution.source === "credentials" ? ".verity/credentials" : "VERITY.md";
+  const from = resolution.source === "credentials" ? "~/.verity/credentials" : "VERITY.md";
   printWarn(`Your configured Verity service URL is unreachable: ${resolution.url}`);
   printInfo(`  (${probe.error})`);
   if (probe.dnsDead && (await probeService(DEFAULT_SERVICE_URL, verbose)).reachable) {
@@ -10823,8 +10948,6 @@ async function maybeHealServiceUrl(resolution, verbose) {
 }
 
 // src/lib/register.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
 var readline = __toESM(require("node:readline/promises"));
 
 // src/lib/provider-auth.ts
@@ -10934,7 +11057,7 @@ async function githubDeviceFlow() {
 // src/lib/git.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_fs2 = require("node:fs");
-var import_node_path2 = require("node:path");
+var import_node_path3 = require("node:path");
 function resolveFile(relpath) {
   if ((0, import_node_fs2.existsSync)(relpath)) return relpath;
   if ((0, import_node_fs2.existsSync)(".claude/worktrees")) {
@@ -10942,7 +11065,7 @@ function resolveFile(relpath) {
       const entries = (0, import_node_fs2.readdirSync)(".claude/worktrees", { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const candidate = (0, import_node_path2.join)(".claude/worktrees", entry.name, relpath);
+        const candidate = (0, import_node_path3.join)(".claude/worktrees", entry.name, relpath);
         if ((0, import_node_fs2.existsSync)(candidate)) return candidate;
       }
     } catch {
@@ -10983,7 +11106,7 @@ function readBaselineSha() {
 function writeBaselineSha(sha) {
   if (!SHA_RE.test(sha)) return;
   try {
-    (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs2.mkdirSync)((0, import_node_path3.dirname)(BASELINE_SHA_FILE), { recursive: true });
     (0, import_node_fs2.writeFileSync)(BASELINE_SHA_FILE, sha);
   } catch {
   }
@@ -11077,7 +11200,7 @@ function getWorktreeFiles() {
     const entries = (0, import_node_fs2.readdirSync)(worktreeDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const wtDir = (0, import_node_path2.join)(worktreeDir, entry.name);
+      const wtDir = (0, import_node_path3.join)(worktreeDir, entry.name);
       scanDir(wtDir, wtDir, fiveMinAgo, result);
     }
   } catch {
@@ -11088,12 +11211,12 @@ function scanDir(baseDir, dir, minMtime, result) {
   try {
     const entries = (0, import_node_fs2.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = (0, import_node_path2.join)(dir, entry.name);
+      const fullPath = (0, import_node_path3.join)(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name === ".git") continue;
         scanDir(baseDir, fullPath, minMtime, result);
       } else if (entry.isFile()) {
-        const ext = (0, import_node_path2.extname)(entry.name).slice(1);
+        const ext = (0, import_node_path3.extname)(entry.name).slice(1);
         if (!ANALYZABLE_EXTENSIONS.has(ext)) continue;
         try {
           const stat3 = (0, import_node_fs2.statSync)(fullPath);
@@ -11110,13 +11233,13 @@ function scanDir(baseDir, dir, minMtime, result) {
 }
 function filterAnalyzable(files) {
   return files.filter((f) => {
-    const ext = (0, import_node_path2.extname)(f).slice(1);
+    const ext = (0, import_node_path3.extname)(f).slice(1);
     return ANALYZABLE_EXTENSIONS.has(ext);
   });
 }
 function filterReviewable(files) {
   return files.filter((f) => {
-    const ext = (0, import_node_path2.extname)(f).slice(1);
+    const ext = (0, import_node_path3.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
     const basename4 = f.split("/").pop() ?? "";
@@ -11249,38 +11372,19 @@ async function registerProject(opts) {
   const { project_id, token, service_url, user } = result.data;
   const userId = result.data.user_id ?? user?.id;
   const email = user?.email;
-  const identityLines = (userId != null ? `user_id: ${userId}
-` : "") + (email ? `email: ${email}
-` : "");
   try {
-    await (0, import_promises3.mkdir)(VERITY_DIR, { recursive: true });
-    await (0, import_promises3.writeFile)(
-      CREDENTIALS_FILE,
-      `token: ${token}
-service_url: ${service_url}
-${identityLines}`,
-      { mode: 384 }
-    );
-    await (0, import_promises3.chmod)(CREDENTIALS_FILE, 384).catch(() => {
+    await upsertGlobalCredential(opts.remote, {
+      token,
+      serviceUrl: service_url,
+      userId: userId ?? void 0,
+      email
     });
   } catch (err) {
     return {
       ok: false,
-      error: `Registered with the Verity service, but could not save credentials to ${CREDENTIALS_FILE}: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
+      error: `Registered with the Verity service, but could not save credentials to ~/.verity/credentials: ${err.message}. Check filesystem permissions and re-run "verity auth register".`
     };
   }
-  try {
-    await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(GLOBAL_CREDENTIALS_FILE), { recursive: true });
-    await (0, import_promises3.appendFile)(
-      GLOBAL_CREDENTIALS_FILE,
-      `${opts.remote} token: ${token}
-`,
-      { mode: 384 }
-    );
-    await (0, import_promises3.chmod)(GLOBAL_CREDENTIALS_FILE, 384).catch(() => {
-    });
-  } catch {
-  }
   return { ok: true, data: { projectId: project_id, serviceUrl: service_url, email, userId } };
 }
 
@@ -11385,7 +11489,7 @@ function registerLoginCommand(program2) {
     const heal = await maybeHealServiceUrl(urlResult.data, globals.verbose);
     const serviceUrl = heal.serviceUrl;
     if (heal.healed) {
-      printInfo("  Completing login re-registers this project and updates .verity/credentials.");
+      printInfo("  Completing login re-registers this project and updates ~/.verity/credentials.");
     }
     const existing = await resolveToken(globals.token);
     if (existing.ok && !opts.force && !heal.healed) {
@@ -11433,11 +11537,11 @@ function registerLoginCommand(program2) {
 }
 
 // src/lib/hooks.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises4 = require("node:fs/promises");
 var import_node_path6 = require("node:path");
 
 // src/lib/json-file.ts
-var import_promises4 = require("node:fs/promises");
+var import_promises3 = require("node:fs/promises");
 var import_node_path5 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
@@ -11471,7 +11575,7 @@ function detectJsonIndent(raw) {
 async function writeJsonFilePreservingStyle(file, value) {
   let currentRaw = null;
   try {
-    currentRaw = await (0, import_promises4.readFile)(file, "utf-8");
+    currentRaw = await (0, import_promises3.readFile)(file, "utf-8");
   } catch {
     currentRaw = null;
   }
@@ -11484,8 +11588,8 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises4.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
-  await (0, import_promises4.writeFile)(file, next);
+  await (0, import_promises3.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
+  await (0, import_promises3.writeFile)(file, next);
   return true;
 }
 
@@ -11567,7 +11671,7 @@ function globalSettingsFile() {
 }
 async function readSettings() {
   try {
-    const content = await (0, import_promises5.readFile)(CLAUDE_SETTINGS_FILE, "utf-8");
+    const content = await (0, import_promises4.readFile)(CLAUDE_SETTINGS_FILE, "utf-8");
     return JSON.parse(content);
   } catch {
     return {};
@@ -11578,7 +11682,7 @@ async function readAllSettings() {
   const out = [];
   for (const f of files) {
     try {
-      out.push(JSON.parse(await (0, import_promises5.readFile)(f, "utf-8")));
+      out.push(JSON.parse(await (0, import_promises4.readFile)(f, "utf-8")));
     } catch {
     }
   }
@@ -11607,7 +11711,7 @@ async function checkExternalVerityHooks() {
   for (const f of [SETTINGS_LOCAL_FILE, globalSettingsFile()]) {
     let settings;
     try {
-      settings = JSON.parse(await (0, import_promises5.readFile)(f, "utf-8"));
+      settings = JSON.parse(await (0, import_promises4.readFile)(f, "utf-8"));
     } catch {
       continue;
     }
@@ -11645,7 +11749,7 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises5.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
@@ -11890,7 +11994,7 @@ function registerHooksCommands(program2) {
 var import_node_crypto4 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
-var import_promises6 = require("node:fs/promises");
+var import_promises5 = require("node:fs/promises");
 var import_node_fs3 = require("node:fs");
 var import_node_child_process6 = require("node:child_process");
 var import_node_crypto = require("node:crypto");
@@ -11902,7 +12006,7 @@ function bufferTmpPath() {
 }
 async function appendToConversationBuffer(prompt, sessionId) {
   try {
-    await (0, import_promises6.mkdir)(VERITY_DIR, { recursive: true });
+    await (0, import_promises5.mkdir)(VERITY_DIR, { recursive: true });
     let sanitized = prompt.length > MAX_INTENT_CHARS ? prompt.slice(0, MAX_INTENT_CHARS) : prompt;
     sanitized = stripImageReferences(sanitized);
     const entry = {
@@ -11920,8 +12024,8 @@ async function appendToConversationBuffer(prompt, sessionId) {
     const capped = recent.slice(-CONVERSATION_MAX_ENTRIES);
     const content = capped.map((e) => JSON.stringify(e)).join("\n") + "\n";
     const tmpFile = bufferTmpPath();
-    await (0, import_promises6.writeFile)(tmpFile, content);
-    await (0, import_promises6.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
+    await (0, import_promises5.writeFile)(tmpFile, content);
+    await (0, import_promises5.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
   } catch {
   }
 }
@@ -11938,10 +12042,10 @@ async function readAndClearConversationBuffer(currentSessionId) {
       if (others.length > 0) {
         const remaining = others.map((e) => JSON.stringify(e)).join("\n") + "\n";
         const tmpFile = bufferTmpPath();
-        await (0, import_promises6.writeFile)(tmpFile, remaining);
-        await (0, import_promises6.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
+        await (0, import_promises5.writeFile)(tmpFile, remaining);
+        await (0, import_promises5.rename)(tmpFile, CONVERSATION_BUFFER_FILE);
       } else {
-        await (0, import_promises6.unlink)(CONVERSATION_BUFFER_FILE).catch(() => {
+        await (0, import_promises5.unlink)(CONVERSATION_BUFFER_FILE).catch(() => {
         });
       }
       if (mine.length > 0) {
@@ -11953,8 +12057,8 @@ async function readAndClearConversationBuffer(currentSessionId) {
     }
     if ((0, import_node_fs3.existsSync)(INTENT_FILE)) {
       try {
-        const content = await (0, import_promises6.readFile)(INTENT_FILE, "utf-8");
-        await (0, import_promises6.unlink)(INTENT_FILE).catch(() => {
+        const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
+        await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
         });
         const data = JSON.parse(content);
         if (data.prompt) {
@@ -11977,7 +12081,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
 }
 async function readBufferEntries() {
   try {
-    const content = await (0, import_promises6.readFile)(CONVERSATION_BUFFER_FILE, "utf-8");
+    const content = await (0, import_promises5.readFile)(CONVERSATION_BUFFER_FILE, "utf-8");
     const entries = [];
     for (const line of content.split("\n")) {
       const trimmed = line.trim();
@@ -12020,7 +12124,7 @@ function sessionScopeKey(token, sessionId) {
 }
 
 // src/lib/task-context-buffer.ts
-var import_promises7 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_fs4 = require("node:fs");
 var import_node_path7 = require("node:path");
 var TASK_CONTEXT_DIR = `${VERITY_DIR}/.task-context`;
@@ -12063,7 +12167,7 @@ async function readTaskContextBuffer(taskId) {
   const filePath = bufferPath(taskId);
   if (!(0, import_node_fs4.existsSync)(filePath)) return null;
   try {
-    const content = await (0, import_promises7.readFile)(filePath, "utf-8");
+    const content = await (0, import_promises6.readFile)(filePath, "utf-8");
     if (!content.trim()) return null;
     const lines = content.split("\n").filter((l) => l.trim());
     const formatted = [];
@@ -12096,15 +12200,15 @@ async function readTaskContextBuffer(taskId) {
 async function cleanupTaskContextBuffers() {
   try {
     if (!(0, import_node_fs4.existsSync)(TASK_CONTEXT_DIR)) return;
-    const files = await (0, import_promises7.readdir)(TASK_CONTEXT_DIR);
+    const files = await (0, import_promises6.readdir)(TASK_CONTEXT_DIR);
     const cutoffMs = Date.now() - RETENTION_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (!file.endsWith(".jsonl")) continue;
       const filePath = (0, import_node_path7.join)(TASK_CONTEXT_DIR, file);
       try {
-        const stats = await (0, import_promises7.stat)(filePath);
+        const stats = await (0, import_promises6.stat)(filePath);
         if (stats.mtimeMs < cutoffMs) {
-          await (0, import_promises7.unlink)(filePath);
+          await (0, import_promises6.unlink)(filePath);
         }
       } catch {
       }
@@ -12118,27 +12222,27 @@ function bufferPath(taskId) {
 }
 async function appendEntry(taskId, entry) {
   try {
-    await (0, import_promises7.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
+    await (0, import_promises6.mkdir)(TASK_CONTEXT_DIR, { recursive: true });
     const filePath = bufferPath(taskId);
     if ((0, import_node_fs4.existsSync)(filePath)) {
-      const stats = await (0, import_promises7.stat)(filePath);
+      const stats = await (0, import_promises6.stat)(filePath);
       if (stats.size >= MAX_BUFFER_BYTES) {
-        const content = await (0, import_promises7.readFile)(filePath, "utf-8");
+        const content = await (0, import_promises6.readFile)(filePath, "utf-8");
         const lines = content.split("\n").filter((l) => l.trim());
         const keepFrom = Math.floor(lines.length * 0.25);
         const pruned = lines.slice(keepFrom).join("\n") + "\n";
-        await (0, import_promises7.writeFile)(filePath, pruned);
+        await (0, import_promises6.writeFile)(filePath, pruned);
       }
     }
     const line = JSON.stringify(entry) + "\n";
-    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises7.readFile)(filePath, "utf-8") : "";
-    await (0, import_promises7.writeFile)(filePath, existing + line);
+    const existing = (0, import_node_fs4.existsSync)(filePath) ? await (0, import_promises6.readFile)(filePath, "utf-8") : "";
+    await (0, import_promises6.writeFile)(filePath, existing + line);
   } catch {
   }
 }
 
 // src/lib/memory-retrieval.ts
-var import_promises8 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_fs5 = require("node:fs");
 var import_node_path8 = require("node:path");
 var memoryDir = () => projectPath(`${VERITY_DIR}/memory`);
@@ -12241,11 +12345,11 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
     const domainDir = (0, import_node_path8.join)(memoryDir(), domain);
     if (!(0, import_node_fs5.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises8.readdir)(domainDir);
+      const files = await (0, import_promises7.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         try {
-          const content = await (0, import_promises8.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises7.readFile)((0, import_node_path8.join)(domainDir, file), "utf-8");
           const { fm, body } = parseFrontmatter(content);
           if (fm.status && fm.status !== "active") continue;
           nodes.push({
@@ -12303,7 +12407,7 @@ async function retrieveForInjection(promptText, taskFiles = [], budgetTokens = D
 }
 
 // src/lib/memory-sync.ts
-var import_promises9 = require("node:fs/promises");
+var import_promises8 = require("node:fs/promises");
 var import_node_fs6 = require("node:fs");
 var import_node_path9 = require("node:path");
 var import_node_crypto3 = require("node:crypto");
@@ -12374,18 +12478,18 @@ var memoryDir2 = () => projectPath(`${VERITY_DIR}/memory`);
 var DOMAINS2 = ["decisions", "quality", "security", "intent", "gotchas", "patterns", "domain", "integrations", "_archive"];
 var syncStateFile = () => projectPath(`${VERITY_DIR}/.memory-sync-state.json`);
 async function ensureMemoryDir() {
-  await (0, import_promises9.mkdir)(memoryDir2(), { recursive: true });
+  await (0, import_promises8.mkdir)(memoryDir2(), { recursive: true });
   for (const domain of DOMAINS2) {
-    await (0, import_promises9.mkdir)((0, import_node_path9.join)(memoryDir2(), domain), { recursive: true });
+    await (0, import_promises8.mkdir)((0, import_node_path9.join)(memoryDir2(), domain), { recursive: true });
   }
   if (!(0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "SCHEMA.md"), SCHEMA_TEMPLATE);
   }
   if (!(0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "index.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "# Project Memory Index\n\nNo nodes yet. Run an analysis to start building the knowledge graph.\n");
   }
   if (!(0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md"))) {
-    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "# Memory Log\n\n");
   }
 }
 async function buildManifest() {
@@ -12397,13 +12501,13 @@ async function buildManifest() {
     const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises9.readdir)(domainDir);
+      const files = await (0, import_promises8.readdir)(domainDir);
       for (const file of files) {
         if (!file.endsWith(".md")) continue;
         const filePath = `${domain}/${file}`;
         const fullPath = (0, import_node_path9.join)(memoryDir2(), filePath);
         try {
-          const content = await (0, import_promises9.readFile)(fullPath, "utf-8");
+          const content = await (0, import_promises8.readFile)(fullPath, "utf-8");
           const hash = (0, import_node_crypto3.createHash)("sha256").update(content).digest("hex").slice(0, 16);
           nodes.push({ path: filePath, content_hash: `sha256:${hash}` });
         } catch {
@@ -12414,13 +12518,13 @@ async function buildManifest() {
   }
   let indexHash = null;
   try {
-    const indexContent = await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "utf-8");
+    const indexContent = await (0, import_promises8.readFile)((0, import_node_path9.join)(memoryDir2(), "index.md"), "utf-8");
     indexHash = `sha256:${(0, import_node_crypto3.createHash)("sha256").update(indexContent).digest("hex").slice(0, 16)}`;
   } catch {
   }
   let logLength = 0;
   try {
-    const logContent = await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8");
+    const logContent = await (0, import_promises8.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8");
     logLength = logContent.split("\n").length;
   } catch {
   }
@@ -12436,10 +12540,10 @@ async function readOnDiskNodes() {
     const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
-      for (const file of await (0, import_promises9.readdir)(domainDir)) {
+      for (const file of await (0, import_promises8.readdir)(domainDir)) {
         if (!file.endsWith(".md")) continue;
         try {
-          out.set(`${domain}/${file}`, hashContent(await (0, import_promises9.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8")));
+          out.set(`${domain}/${file}`, hashContent(await (0, import_promises8.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8")));
         } catch {
         }
       }
@@ -12451,7 +12555,7 @@ async function readOnDiskNodes() {
 async function readSyncBaseline() {
   const out = /* @__PURE__ */ new Map();
   try {
-    const parsed = JSON.parse(await (0, import_promises9.readFile)(syncStateFile(), "utf-8"));
+    const parsed = JSON.parse(await (0, import_promises8.readFile)(syncStateFile(), "utf-8"));
     if (Array.isArray(parsed?.nodes)) {
       for (const n of parsed.nodes) if (n?.path) out.set(n.path, n.hash ?? null);
     } else if (Array.isArray(parsed?.paths)) {
@@ -12467,12 +12571,12 @@ async function recordSyncedNodePaths() {
     const next = JSON.stringify({ schema: 2, nodes }) + "\n";
     let existing = "";
     try {
-      existing = await (0, import_promises9.readFile)(syncStateFile(), "utf-8");
+      existing = await (0, import_promises8.readFile)(syncStateFile(), "utf-8");
     } catch {
     }
     if (existing === next) return;
-    await (0, import_promises9.mkdir)(projectPath(VERITY_DIR), { recursive: true });
-    await (0, import_promises9.writeFile)(syncStateFile(), next);
+    await (0, import_promises8.mkdir)(projectPath(VERITY_DIR), { recursive: true });
+    await (0, import_promises8.writeFile)(syncStateFile(), next);
   } catch {
   }
 }
@@ -12489,7 +12593,7 @@ async function computeEditedNodeUploads() {
     if (!(0, import_node_fs6.existsSync)(full)) continue;
     let content;
     try {
-      content = await (0, import_promises9.readFile)(full, "utf-8");
+      content = await (0, import_promises8.readFile)(full, "utf-8");
     } catch {
       continue;
     }
@@ -12522,8 +12626,8 @@ async function applyMemoryWrites(writes, opts = {}) {
   const logLines = [`- ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16)} \u2014 Applied ${count} write(s) from server`];
   for (const n of notes) logLines.push(`  - ${n}`);
   try {
-    const existing = (0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md")) ? await (0, import_promises9.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
-    await (0, import_promises9.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
+    const existing = (0, import_node_fs6.existsSync)((0, import_node_path9.join)(memoryDir2(), "log.md")) ? await (0, import_promises8.readFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), "utf-8") : "# Memory Log\n\n";
+    await (0, import_promises8.writeFile)((0, import_node_path9.join)(memoryDir2(), "log.md"), existing + logLines.join("\n") + "\n");
   } catch {
   }
   await recordSyncedNodePaths();
@@ -12543,7 +12647,7 @@ async function applyOneWrite(write, treePaths) {
   if ((0, import_node_fs6.existsSync)(fullPath)) {
     let existing = "";
     try {
-      existing = await (0, import_promises9.readFile)(fullPath, "utf-8");
+      existing = await (0, import_promises8.readFile)(fullPath, "utf-8");
     } catch {
     }
     if (existing === content) return { written: false, notes };
@@ -12552,8 +12656,8 @@ async function applyOneWrite(write, treePaths) {
       return { written: false, notes };
     }
   }
-  await (0, import_promises9.mkdir)((0, import_node_path9.dirname)(fullPath), { recursive: true });
-  await (0, import_promises9.writeFile)(fullPath, content);
+  await (0, import_promises8.mkdir)((0, import_node_path9.dirname)(fullPath), { recursive: true });
+  await (0, import_promises8.writeFile)(fullPath, content);
   return { written: true, notes };
 }
 function groundFileGlobs(content, treePaths) {
@@ -12596,7 +12700,7 @@ async function regenerateIndex() {
     const domainDir = (0, import_node_path9.join)(memoryDir2(), domain);
     if (!(0, import_node_fs6.existsSync)(domainDir)) continue;
     try {
-      const files = await (0, import_promises9.readdir)(domainDir);
+      const files = await (0, import_promises8.readdir)(domainDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       if (mdFiles.length === 0) continue;
       lines.push(`## ${domain}/ (${mdFiles.length})`);
@@ -12604,7 +12708,7 @@ async function regenerateIndex() {
       for (const file of mdFiles.sort()) {
         const slug = file.replace(/\.md$/, "");
         try {
-          const content = await (0, import_promises9.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8");
+          const content = await (0, import_promises8.readFile)((0, import_node_path9.join)(domainDir, file), "utf-8");
           const title = pickFrontmatter(content, "title") ?? slug;
           const kind = pickFrontmatter(content, "kind") ?? "-";
           const confidence = pickFrontmatter(content, "confidence");
@@ -12631,11 +12735,11 @@ async function regenerateIndex() {
   const indexPath = (0, import_node_path9.join)(memoryDir2(), "index.md");
   let existing = null;
   try {
-    existing = await (0, import_promises9.readFile)(indexPath, "utf-8");
+    existing = await (0, import_promises8.readFile)(indexPath, "utf-8");
   } catch {
   }
   if (existing === next) return;
-  await (0, import_promises9.writeFile)(indexPath, next);
+  await (0, import_promises8.writeFile)(indexPath, next);
 }
 function pickFrontmatter(content, key) {
   const re = new RegExp(`^${key}:\\s*"?([^"\\n]+?)"?\\s*$`, "m");
@@ -12713,7 +12817,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
   const claudeMdPath = (0, import_node_path9.join)(cwd, "CLAUDE.md");
   let existing = "";
   if ((0, import_node_fs6.existsSync)(claudeMdPath)) {
-    existing = await (0, import_promises9.readFile)(claudeMdPath, "utf-8");
+    existing = await (0, import_promises8.readFile)(claudeMdPath, "utf-8");
   }
   let startTag = CLAUDE_MD_START;
   let endTag = CLAUDE_MD_END;
@@ -12769,7 +12873,7 @@ async function ensureClaudeMdPointer(cwd = repoRoot()) {
     next = existing.replace(/\n*$/, "") + "\n\n" + block + "\n";
   }
   if (next === existing) return;
-  await (0, import_promises9.writeFile)(claudeMdPath, next);
+  await (0, import_promises8.writeFile)(claudeMdPath, next);
 }
 function extractPreserveContent(interior) {
   for (const [start, end] of [
@@ -12955,7 +13059,7 @@ async function fireClassify(prompt, sessionId) {
 }
 
 // src/commands/standard.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises9 = require("node:fs/promises");
 var import_yaml = __toESM(require_dist());
 function registerStandardCommands(program2) {
   const standard = program2.command("standard").description("Manage the project Standard");
@@ -12973,7 +13077,7 @@ function registerStandardCommands(program2) {
     }
     let yamlContent;
     try {
-      yamlContent = await (0, import_promises10.readFile)(opts.file, "utf-8");
+      yamlContent = await (0, import_promises9.readFile)(opts.file, "utf-8");
     } catch {
       printError(`Cannot read ${opts.file}`);
       process.exit(1);
@@ -13064,7 +13168,7 @@ function registerStandardCommands(program2) {
 }
 
 // src/commands/config.ts
-var import_promises11 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 function registerConfigCommands(program2) {
   const config = program2.command("config").description("Manage analysis configuration");
   config.command("push").description("Upload the analysis config to the service").option("--file <path>", "Path to config file", CODACY_CONFIG_FILE).action(async (opts) => {
@@ -13081,7 +13185,7 @@ function registerConfigCommands(program2) {
     }
     let content;
     try {
-      const raw = await (0, import_promises11.readFile)(opts.file, "utf-8");
+      const raw = await (0, import_promises10.readFile)(opts.file, "utf-8");
       content = JSON.parse(raw);
     } catch {
       printError(`Cannot read or parse ${opts.file}`);
@@ -14773,7 +14877,7 @@ function isExplicitlyAutonomous(env = process.env) {
 }
 
 // src/lib/seed-runner.ts
-var import_promises12 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var import_node_fs18 = require("node:fs");
 var import_node_path15 = require("node:path");
 var import_yaml2 = __toESM(require_dist());
@@ -15019,7 +15123,7 @@ async function runSeed(opts) {
   }
   let standardDoc;
   try {
-    const raw = await (0, import_promises12.readFile)(STANDARD_FILE, "utf-8");
+    const raw = await (0, import_promises11.readFile)(STANDARD_FILE, "utf-8");
     standardDoc = (0, import_yaml2.parse)(raw);
   } catch {
     return { created: 0, failed: 0, skipped: "no_standard", candidates: [] };
@@ -15028,7 +15132,7 @@ async function runSeed(opts) {
   let readmeContent;
   if ((0, import_node_fs18.existsSync)("README.md")) {
     try {
-      readmeContent = await (0, import_promises12.readFile)("README.md", "utf-8");
+      readmeContent = await (0, import_promises11.readFile)("README.md", "utf-8");
     } catch {
     }
   }
@@ -15036,7 +15140,7 @@ async function runSeed(opts) {
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
     if ((0, import_node_fs18.existsSync)(p)) {
       try {
-        claudeMdContent = await (0, import_promises12.readFile)(p, "utf-8");
+        claudeMdContent = await (0, import_promises11.readFile)(p, "utf-8");
         break;
       } catch {
       }
@@ -15095,8 +15199,8 @@ async function runSeed(opts) {
     const filePathRel = res.data.file_path;
     const targetPath = (0, import_node_path15.join)(MEMORY_DIR, filePathRel);
     try {
-      await (0, import_promises12.mkdir)((0, import_node_path15.dirname)(targetPath), { recursive: true });
-      await (0, import_promises12.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
+      await (0, import_promises11.mkdir)((0, import_node_path15.dirname)(targetPath), { recursive: true });
+      await (0, import_promises11.writeFile)(targetPath, renderNodeMarkdown(c, nodeId, createdAt));
       created++;
       opts.onCreated?.(nodeId, filePathRel, c);
     } catch (err) {
@@ -16217,6 +16321,98 @@ var readline2 = __toESM(require("node:readline/promises"));
 var import_node_fs23 = require("node:fs");
 var import_node_path18 = require("node:path");
 var import_node_child_process10 = require("node:child_process");
+
+// src/lib/telemetry.ts
+var import_promises12 = require("node:fs/promises");
+var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
+var GITIGNORE_FILE = ".gitignore";
+var GITIGNORE_ENTRY = ".claude/settings.local.json";
+var OTEL_HEADERS_HELPER_CMD = "verity telemetry headers";
+var LEGACY_TELEMETRY_ENV_KEYS = ["OTEL_EXPORTER_OTLP_HEADERS"];
+function deriveOtlpEndpoint(serviceUrl) {
+  return serviceUrl.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1/otlp";
+}
+function buildTelemetryEnv(serviceUrl) {
+  return {
+    CLAUDE_CODE_ENABLE_TELEMETRY: "1",
+    OTEL_METRICS_EXPORTER: "otlp",
+    OTEL_TRACES_EXPORTER: "otlp",
+    CLAUDE_CODE_ENHANCED_TELEMETRY_BETA: "1",
+    OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
+    OTEL_EXPORTER_OTLP_ENDPOINT: deriveOtlpEndpoint(serviceUrl),
+    OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE: "delta",
+    OTEL_LOG_USER_PROMPTS: "0",
+    OTEL_LOG_TOOL_DETAILS: "0",
+    OTEL_LOG_TOOL_CONTENT: "0",
+    OTEL_METRICS_INCLUDE_SESSION_ID: "true",
+    OTEL_METRICS_INCLUDE_ACCOUNT_UUID: "false",
+    OTEL_METRICS_INCLUDE_VERSION: "false",
+    OTEL_METRIC_EXPORT_INTERVAL: "60000"
+  };
+}
+var VERITY_TELEMETRY_KEYS = Object.keys(buildTelemetryEnv(""));
+async function readSettingsLocal() {
+  try {
+    return JSON.parse(await (0, import_promises12.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
+  } catch {
+    return {};
+  }
+}
+async function writeSettingsLocal(settings) {
+  await writeJsonFilePreservingStyle(projectPath(SETTINGS_LOCAL_FILE2), settings);
+}
+async function ensureGitignore() {
+  const file = projectPath(GITIGNORE_FILE);
+  let content = "";
+  try {
+    content = await (0, import_promises12.readFile)(file, "utf-8");
+  } catch {
+  }
+  const lines = content.split("\n").map((l) => l.trim());
+  if (lines.includes(GITIGNORE_ENTRY) || lines.includes(".claude/") || lines.includes(".claude")) {
+    return;
+  }
+  const block = "# Verity telemetry \u2014 machine-local Claude Code settings\n" + GITIGNORE_ENTRY + "\n";
+  const next = content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block;
+  await (0, import_promises12.writeFile)(file, next);
+}
+async function installTelemetry(serviceUrl) {
+  const env = buildTelemetryEnv(serviceUrl);
+  const settings = await readSettingsLocal();
+  settings.env = { ...settings.env ?? {}, ...env };
+  for (const key of LEGACY_TELEMETRY_ENV_KEYS) delete settings.env[key];
+  settings.otelHeadersHelper = OTEL_HEADERS_HELPER_CMD;
+  await writeSettingsLocal(settings);
+  await ensureGitignore();
+  return { ok: true, data: { endpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT } };
+}
+async function checkTelemetry() {
+  const env = (await readSettingsLocal()).env ?? {};
+  const enabled = env.CLAUDE_CODE_ENABLE_TELEMETRY === "1" && !!env.OTEL_EXPORTER_OTLP_ENDPOINT;
+  return { enabled, endpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT ?? null, settingsPath: SETTINGS_LOCAL_FILE2 };
+}
+async function uninstallTelemetry() {
+  const settings = await readSettingsLocal();
+  const hadHelper = settings.otelHeadersHelper === OTEL_HEADERS_HELPER_CMD;
+  if (hadHelper) delete settings.otelHeadersHelper;
+  if (!settings.env) {
+    if (hadHelper) await writeSettingsLocal(settings);
+    return { ok: true, data: { removed: 0 } };
+  }
+  let removed = 0;
+  for (const key of VERITY_TELEMETRY_KEYS) {
+    if (key in settings.env) {
+      delete settings.env[key];
+      removed++;
+    }
+  }
+  for (const key of LEGACY_TELEMETRY_ENV_KEYS) delete settings.env[key];
+  if (Object.keys(settings.env).length === 0) delete settings.env;
+  await writeSettingsLocal(settings);
+  return { ok: true, data: { removed } };
+}
+
+// src/commands/migrate.ts
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
   (0, import_node_child_process10.execSync)(`npm rm -g ${pkg}`, { stdio: "pipe", timeout: 12e4 });
@@ -16247,6 +16443,7 @@ async function runMigration(opts = {}) {
   await migrateLegacyHooks(root, actions);
   await migrateClaudeMd(root, actions);
   migrateStandardFile(root, actions);
+  await migrateTelemetryHeaders(root, actions);
   removeLegacyPackage(movedProjectDir, npmRemover, actions);
   return { actions, migrated: actions.length > 0 };
 }
@@ -16360,6 +16557,25 @@ function migrateStandardFile(root, actions) {
   if (refreshed !== content) (0, import_node_fs23.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
+async function migrateTelemetryHeaders(root, actions) {
+  const file = (0, import_node_path18.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs23.existsSync)(file)) return;
+  let settings;
+  try {
+    settings = JSON.parse(readFileSyncSafe(file) || "{}");
+  } catch {
+    return;
+  }
+  const env = settings.env;
+  const hasInlineHeader = !!env && "OTEL_EXPORTER_OTLP_HEADERS" in env;
+  const telemetryEnabled = env?.CLAUDE_CODE_ENABLE_TELEMETRY === "1";
+  const needsHelper = telemetryEnabled && settings.otelHeadersHelper !== OTEL_HEADERS_HELPER_CMD;
+  if (!hasInlineHeader && !needsHelper) return;
+  if (hasInlineHeader && env) delete env["OTEL_EXPORTER_OTLP_HEADERS"];
+  if (telemetryEnabled) settings.otelHeadersHelper = OTEL_HEADERS_HELPER_CMD;
+  await writeJsonFilePreservingStyle(file, settings);
+  actions.push("Moved the telemetry token out of .claude/settings.local.json (now resolved at runtime)");
+}
 function removeLegacyPackage(movedProjectDir, npmRemover, actions) {
   if (!movedProjectDir) return;
   try {
@@ -16532,7 +16748,7 @@ async function runOptionalAuth(resolution, opts = {}) {
     serviceUrl = heal.serviceUrl;
     healed = heal.healed;
     if (healed) {
-      printInfo("  Log in below to re-register this project and repair .verity/credentials.");
+      printInfo("  Log in below to re-register this project and repair ~/.verity/credentials.");
     }
   }
   if (!healed) {
@@ -17330,89 +17546,6 @@ function registerRunCommand(program2) {
   });
 }
 
-// src/lib/telemetry.ts
-var import_promises14 = require("node:fs/promises");
-var SETTINGS_LOCAL_FILE2 = ".claude/settings.local.json";
-var GITIGNORE_FILE = ".gitignore";
-var GITIGNORE_ENTRY = ".claude/settings.local.json";
-function deriveOtlpEndpoint(serviceUrl) {
-  return serviceUrl.replace(/\/+$/, "").replace(/\/v1$/, "") + "/v1/otlp";
-}
-function buildTelemetryEnv(serviceUrl, token) {
-  return {
-    CLAUDE_CODE_ENABLE_TELEMETRY: "1",
-    OTEL_METRICS_EXPORTER: "otlp",
-    OTEL_TRACES_EXPORTER: "otlp",
-    CLAUDE_CODE_ENHANCED_TELEMETRY_BETA: "1",
-    OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
-    OTEL_EXPORTER_OTLP_ENDPOINT: deriveOtlpEndpoint(serviceUrl),
-    // <token> is whatever is in .verity/credentials — verity_ OR legacy gate_.
-    // The server hashes the raw token regardless of prefix.
-    OTEL_EXPORTER_OTLP_HEADERS: `Authorization=Bearer ${token}`,
-    OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE: "delta",
-    OTEL_LOG_USER_PROMPTS: "0",
-    OTEL_LOG_TOOL_DETAILS: "0",
-    OTEL_LOG_TOOL_CONTENT: "0",
-    OTEL_METRICS_INCLUDE_SESSION_ID: "true",
-    OTEL_METRICS_INCLUDE_ACCOUNT_UUID: "false",
-    OTEL_METRICS_INCLUDE_VERSION: "false",
-    OTEL_METRIC_EXPORT_INTERVAL: "60000"
-  };
-}
-var VERITY_TELEMETRY_KEYS = Object.keys(buildTelemetryEnv("", ""));
-async function readSettingsLocal() {
-  try {
-    return JSON.parse(await (0, import_promises14.readFile)(projectPath(SETTINGS_LOCAL_FILE2), "utf-8"));
-  } catch {
-    return {};
-  }
-}
-async function writeSettingsLocal(settings) {
-  await writeJsonFilePreservingStyle(projectPath(SETTINGS_LOCAL_FILE2), settings);
-}
-async function ensureGitignore() {
-  const file = projectPath(GITIGNORE_FILE);
-  let content = "";
-  try {
-    content = await (0, import_promises14.readFile)(file, "utf-8");
-  } catch {
-  }
-  const lines = content.split("\n").map((l) => l.trim());
-  if (lines.includes(GITIGNORE_ENTRY) || lines.includes(".claude/") || lines.includes(".claude")) {
-    return;
-  }
-  const block = "# Verity telemetry \u2014 holds your project token\n" + GITIGNORE_ENTRY + "\n";
-  const next = content ? content + (content.endsWith("\n") ? "" : "\n") + "\n" + block : block;
-  await (0, import_promises14.writeFile)(file, next);
-}
-async function installTelemetry(serviceUrl, token) {
-  const env = buildTelemetryEnv(serviceUrl, token);
-  const settings = await readSettingsLocal();
-  settings.env = { ...settings.env ?? {}, ...env };
-  await writeSettingsLocal(settings);
-  await ensureGitignore();
-  return { ok: true, data: { endpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT } };
-}
-async function checkTelemetry() {
-  const env = (await readSettingsLocal()).env ?? {};
-  const enabled = env.CLAUDE_CODE_ENABLE_TELEMETRY === "1" && !!env.OTEL_EXPORTER_OTLP_ENDPOINT;
-  return { enabled, endpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT ?? null, settingsPath: SETTINGS_LOCAL_FILE2 };
-}
-async function uninstallTelemetry() {
-  const settings = await readSettingsLocal();
-  if (!settings.env) return { ok: true, data: { removed: 0 } };
-  let removed = 0;
-  for (const key of VERITY_TELEMETRY_KEYS) {
-    if (key in settings.env) {
-      delete settings.env[key];
-      removed++;
-    }
-  }
-  if (Object.keys(settings.env).length === 0) delete settings.env;
-  await writeSettingsLocal(settings);
-  return { ok: true, data: { removed } };
-}
-
 // src/commands/telemetry.ts
 function registerTelemetryCommands(program2) {
   const telemetry = program2.command("telemetry").description("Manage Claude Code OpenTelemetry export to Verity (cost & usage)");
@@ -17428,16 +17561,25 @@ function registerTelemetryCommands(program2) {
       printError(urlResult.error);
       process.exit(1);
     }
-    const result = await installTelemetry(urlResult.data, tokenResult.data.token);
+    const result = await installTelemetry(urlResult.data);
     if (!result.ok) {
       printError(result.error);
       process.exit(1);
     }
     printInfo(`Telemetry enabled \u2192 ${result.data.endpoint}`);
-    printInfo(`  wrote ${SETTINGS_LOCAL_FILE2} (gitignored \u2014 it holds your project token)`);
+    printInfo(`  wrote ${SETTINGS_LOCAL_FILE2} (no token stored \u2014 resolved at runtime via otelHeadersHelper)`);
     printInfo("  takes effect on your NEXT Claude Code session; first metrics appear within ~60s of activity");
     printInfo("  view cost & usage at /usage");
   });
+  telemetry.command("headers").description("Print the OTLP Authorization header as JSON (used by Claude Code otelHeadersHelper)").action(async () => {
+    const globals = program2.opts();
+    const tokenResult = await resolveToken(globals.token);
+    if (tokenResult.ok) {
+      printJsonCompact({ Authorization: `Bearer ${tokenResult.data.token}` });
+    } else {
+      printJsonCompact({});
+    }
+  });
   telemetry.command("check").description("Show whether Claude Code telemetry export to Verity is enabled").option("--json", "Output status as JSON").action(async (opts) => {
     const status = await checkTelemetry();
     if (opts.json) {
@@ -17463,7 +17605,12 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.28.0").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr");
+program.name("verity").description("CLI for Verity quality gate service").version("0.28.1-experimental.9155758").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async () => {
+  try {
+    await foldLegacyLocalCredential();
+  } catch {
+  }
+});
 registerAuthCommands(program);
 registerLoginCommand(program);
 registerHooksCommands(program);
@@ -17485,4 +17632,8 @@ registerMemoryCommand(program);
 registerRunCommand(program);
 registerMigrateCommand(program);
 registerTelemetryCommands(program);
-program.parse();
+program.parseAsync().catch((err) => {
+  process.stderr.write(`[verity] ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(1);
+});

package/data/skills/verity-setup/SKILL.md

@@ -353,8 +353,9 @@ verity auth verify
   (Metadata + Email addresses); the resulting token is used once server-side to
   check repo access and is never persisted.
 
-When authenticated, `.verity/credentials` contains `token` and `service_url` —
-all subsequent `verity` upload commands work.
+When authenticated, the project's `token` and `service_url` are stored in the
+single global credentials file `~/.verity/credentials` (keyed by git remote) —
+nothing secret is written into the repo. All subsequent `verity` upload commands work.
 
 ---
 
@@ -407,10 +408,12 @@ now (the token from Step 6 must already exist):
 verity telemetry install
 ```
 
-This writes the `OTEL_*` env block to the gitignored `.claude/settings.local.json` (which
-holds your token) and points Claude Code's OpenTelemetry exporter at Verity's OTLP endpoint.
-Tell the user it takes effect on their **next** Claude Code session, that first metrics appear
-within ~60s of activity, and point them at `/usage`.
+This writes the `OTEL_*` env block plus an `otelHeadersHelper` to `.claude/settings.local.json`
+and points Claude Code's OpenTelemetry exporter at Verity's OTLP endpoint. No token is written to
+the file — the helper (`verity telemetry headers`) resolves the project token from
+`~/.verity/credentials` at session start, so the secret never lands in the repo. Tell the user it
+takes effect on their **next** Claude Code session, that first metrics appear within ~60s of
+activity, and point them at `/usage`.
 
 If the user declined, skip this step and note that `/usage` will stay empty until they run
 `verity telemetry install`.
@@ -534,7 +537,6 @@ Add these entries to `.gitignore` (create it if it doesn't exist, append if it d
 
 ```
 # Verity
-.verity/credentials
 .verity/.cache/
 .verity/.logs/
 .verity/.last-analysis
@@ -546,14 +548,18 @@ Add these entries to `.gitignore` (create it if it doesn't exist, append if it d
 .claude/settings.local.json
 ```
 
-`.claude/settings.local.json` holds the telemetry env block **including your token**, so it
-must never be committed (`verity telemetry install` also adds this entry automatically).
+`.claude/settings.local.json` is machine-local Claude Code config (telemetry endpoint + an
+`otelHeadersHelper` reference — no token). `verity telemetry install` adds this entry
+automatically.
 
 Do NOT gitignore `.verity/standard.yaml` or `VERITY.md` — those should be committed.
 
 **Commit the knowledge graph, but not its log.** The nodes under `.verity/memory/<domain>/` and `.verity/memory/index.md` are durable project knowledge meant to be committed and reviewed. But `.verity/memory/log.md` is an append-only, per-run timestamped activity log — it churns on every analysis and carries no reviewable content, so it is gitignored above. If a project already committed it, untrack it once with `git rm --cached .verity/memory/log.md`.
 
-The `.verity/credentials` file contains the project token and MUST be gitignored.
+**No secrets live in the repo anymore.** The project token is stored only in the single global
+file `~/.verity/credentials` (outside the repo, keyed by git remote), so there is no
+`.verity/credentials` to ignore. If an older install left one behind, the CLI folds it into the
+global store and removes it automatically on the next `verity` command.
 
 ---
 

package/package.json

@@ -1,12 +1,8 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.28.0",
+  "version": "0.28.1-experimental.9155758",
   "description": "CLI for Verity quality gate service",
   "homepage": "https://verity.md",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/codacy/verity.git"
-  },
   "bugs": {
     "url": "https://github.com/codacy/verity/issues"
   },